Instance application settings. GitLab application-setting fields are declared inside the organizational sections below.
Application setting properties
Every field below can be placed in exactly one organizational section. Expand a range to see each field's type, accepted values, bounds, and GitLab behavior.
force_secret_update boolean
Force a write when a declared write-only secret must be rotated and no readable field has drifted. Default: false.
A–D application fields
abuse_notification_email string
If set, abuse reports are sent to this address. Abuse reports are always available in the Admin area.
active_context_pause_indexing boolean
Pause ActiveContext indexing
admin_mode boolean
Require administrators to enable Admin Mode by re-authenticating for administrative tasks.
after_sign_out_path string
Where to redirect users after logout.
after_sign_up_text string
Text shown to the user after signing up.
ai_action_api_rate_limit integer
Maximum number of requests allowed to the aiAction GraphQL mutation per user per eight hours. Default: 160. Set to 0 to disable the rate limit.
ai_audit_events_streaming_enabled string
akismet_api_key string
API key for Akismet spam protection.
akismet_enabled boolean
(If enabled, requires: akismet_api_key) Enable or disable Akismet spam protection.
allow_account_deletion boolean
Set to true to allow users to delete their accounts. Premium and Ultimate only.
allow_all_integrations boolean
When false, only integrations in allowed_integrations are allowed on the instance. Ultimate only.
allow_bypass_placeholder_confirmation boolean
Skip confirmation when administrators reassign placeholder users. Introduced in GitLab 18.0.
allow_contribution_mapping_to_admins string
allow_deploy_tokens_and_keys_with_external_authn string
allow_group_owners_to_manage_ldap boolean
Set to true to allow group owners to manage LDAP. Premium and Ultimate only.
allow_local_requests_from_system_hooks boolean
Allow requests to the local network from system hooks.
allow_local_requests_from_web_hooks_and_services boolean
Allow requests to the local network from webhooks and integrations.
allow_possible_spam string
allow_project_creation_for_guest_and_below boolean
Indicates whether users assigned up to the Guest role can create groups and personal projects. Defaults to true.
allow_runner_registration_token boolean
Allow using a registration token to create a runner. Defaults to true.
allow_s3_compatible_storage_for_offline_transfer boolean
Allow S3-compatible object storage for offline transfer. Introduced in GitLab 18.9.
allow_top_level_group_owners_to_create_service_accounts string
allowed_integrations array of strings
When allow_all_integrations is false, lists the integrations allowed on the instance. Every item must be a known GitLab integration name. Ultimate only.
anonymous_searches_allowed string
archive_builds_in_human_readable string
Set the duration for which the jobs are considered as old and expired. After that time passes, the jobs are archived and no longer able to be retried. Make it empty to never expire jobs. It has to be no less than 1 day, for example: 15 days, 1 month, 2 years.
asciidoc_max_includes integer
Maximum limit of AsciiDoc include directives being processed in any one document. Default: 32. Maximum: 64.
asset_proxy_enabled boolean
(If enabled, requires: asset_proxy_url) Enable proxying of assets. GitLab restart is required to apply changes.
asset_proxy_secret_key string
Shared secret with the asset proxy server. GitLab restart is required to apply changes.
asset_proxy_url string
URL of the asset proxy server. GitLab restart is required to apply changes.
authn_data_retention_cleanup_enabled boolean
If true, runs cleanup workers that permanently delete authentication login history older than one year, and previously revoked OAuth access tokens and grants older than one month. Default value: false. Introduced in GitLab 18.7.
authorized_keys_enabled boolean
By default, the authorized_keys file supports Git over SSH without additional configuration. GitLab can be optimized to authenticate SSH keys via the database file. Only disable this if you have configured your OpenSSH server to use the AuthorizedKeysCommand.
auto_ban_user_on_excessive_projects_download boolean
When enabled, users will get automatically banned from the application when they download more than the maximum number of unique projects in the time period specified by max_number_of_repository_downloads and max_number_of_repository_downloads_within_time_period. GitLab Self-Managed, Ultimate only.
auto_devops_domain string
Specify a domain to use by default for every project's Auto Review Apps and Auto Deploy stages.
auto_devops_enabled boolean
Enable Auto DevOps for projects by default. It automatically builds, tests, and deploys applications based on a predefined CI/CD configuration.
auto_duo_code_review_enabled boolean
Enable automatic reviews by GitLab Duo on merge requests
autocomplete_users_limit integer
Rate limit for authenticated requests to users autocomplete endpoint
autocomplete_users_unauthenticated_limit integer
Rate limit for authenticated requests to users autocomplete endpoint
automatic_purchased_storage_allocation boolean
Enabling this permits automatic allocation of purchased storage in a namespace. Relevant only to EE distributions.
background_operations_max_jobs string
built_in_project_templates_enabled boolean
Enable built-in project templates when users create projects. Premium and Ultimate only. Introduced in GitLab 19.0 with a feature flag named use_built_in_project_templates_enabled. Disabled by default. Generally available in GitLab 19.2. Feature flag use_built_in_project_templates_enabled removed.
bulk_import_concurrent_pipeline_batch_limit integer
Maximum simultaneous direct transfer batch exports to process.
bulk_import_enabled boolean
Enable migrating GitLab groups by direct transfer. Setting also available in the Admin area.
bulk_import_max_download_file integer
Maximum download file size in MB when importing from source GitLab instances by direct transfer
bulk_import_max_download_file_size integer
Maximum download file size when importing from source GitLab instances by direct transfer. Introduced in GitLab 16.3.
can_create_group boolean
Indicates whether users can create top-level groups. Defaults to true.
can_create_organization string
check_namespace_plan boolean
Enabling this makes only licensed EE features available to projects if the project namespace's plan includes the feature or if the project is public. Premium and Ultimate only.
ci_cd_catalog_projects_allowlist string
ci_cd_catalog_projects_allowlist_raw string
ci_delete_pipelines_in_seconds_limit_human_readable string
Maximum value that is allowed for configuring pipeline retention. Defaults to 1 year.
ci_job_live_trace_enabled boolean
Turns on incremental logging for job logs. When turned on, archived job logs are incrementally uploaded to object storage. Object storage must be configured. You can also configure this setting in the Admin area.
ci_job_telemetry_sampling_rate number
Sampling rate for CI job telemetry (0.0 to 1.0)
ci_lint_limit_per_user integer
Maximum number of CI Lint requests per minute per user. Disabled by default.
ci_max_caches_per_job integer
Maximum number of caches that can be defined in a single CI/CD job
ci_max_includes integer
The maximum number of includes per pipeline. Default is 150.
ci_max_total_yaml_size_bytes integer
The maximum amount of memory, in bytes, that can be allocated for the pipeline configuration, with all included YAML configuration files.
ci_partitions_in_seconds_limit_human_readable string
The time window before new CI partitions are created and the system switches to the next set of partitions. Must be between 1 month and 6 months. Defaults to 1 month.
ci_telemetry_otel_endpoint string
OTEL Collector endpoint URL for CI job telemetry
code_suggestions_api_rate_limit integer
Maximum requests a user can make per minute to code suggestions endpoint
commit_email_hostname string
Custom hostname (for private commit emails).
concurrent_bitbucket_import_jobs_limit integer
Maximum number of simultaneous import jobs for the Bitbucket Cloud importer. Default is 100. Introduced in GitLab 16.11.
concurrent_bitbucket_server_import_jobs_limit integer
Maximum number of simultaneous import jobs for the Bitbucket Server importer. Default is 100. Introduced in GitLab 16.11.
concurrent_github_import_jobs_limit integer
Maximum number of simultaneous import jobs for the GitHub importer. Default is 1000. Introduced in GitLab 16.11.
concurrent_relation_batch_export_limit integer
Maximum number of simultaneous batch export jobs to process. Introduced in GitLab 17.6.
container_expiration_policies_enable_historic_entries boolean
Enable cleanup policies for all projects.
container_registry_cleanup_tags_service_max_list_size integer
The maximum number of tags that can be deleted in a single execution of cleanup policies.
container_registry_delete_tags_service_timeout integer
The maximum time, in seconds, that the cleanup process can take to delete a batch of tags for cleanup policies.
container_registry_expiration_policies_caching boolean
Caching during the execution of cleanup policies.
container_registry_expiration_policies_worker_capacity integer
Number of workers for cleanup policies.
container_registry_token_expire_delay integer
Container registry token duration in minutes.
create_organization_api_limit string
cube_api_base_url string
cube_api_key string
custom_http_clone_url_root string
Set a custom Git clone URL for HTTP(S).
deactivate_dormant_users boolean
Enable automatic deactivation of dormant users.
deactivate_dormant_users_period integer
Length of time (in days) after which a user is considered dormant.
deactivation_email_additional_text string
decompress_archive_file_timeout integer
Default timeout for decompressing archived files, in seconds. Set to 0 to disable timeouts. Introduced in GitLab 16.4.
default_artifacts_expire_in string
Set the default expiration time for each job's artifacts.
default_branch_name string
Set the initial branch name for all projects in an instance.
default_ci_config_path string
Default CI/CD configuration file and path for new projects (.gitlab-ci.yml if not set).
default_dark_syntax_highlighting_theme integer
Default dark mode syntax highlighting theme for users who are new or not signed in. See IDs of available themes.
default_group_visibility string
What visibility level new groups receive. Can take private, internal and public as a parameter. Default is private. Changed in GitLab 16.4: cannot be set to any levels in restricted_visibility_levels. Can be one of: private, internal, public.
default_preferred_language string
Default preferred language for users who are not logged in.
default_project_creation integer
Default minimum role required to create projects. Can take: 0 _(No one)_, 1 _(Maintainers)_, 2 _(Developers)_, 3 _(Administrators)_ or 4 _(Owners)_. Can be one of: 0, 3, 4, 1, 2.
default_project_deletion_protection boolean
Enable default project deletion protection so only administrators can delete projects. Default is false. GitLab Self-Managed, Premium and Ultimate only.
default_project_visibility string
What visibility level new projects receive. Can take private, internal and public as a parameter. Default is private. Changed in GitLab 16.4: cannot be set to any levels in restricted_visibility_levels. Can be one of: private, internal, public.
default_projects_limit integer
Project limit per user. Default is 100000.
default_search_scope string
default_snippet_visibility string
What visibility level new snippets receive. Can take private, internal and public as a parameter. Default is private. Can be one of: private, internal, public.
default_syntax_highlighting_theme integer
Default syntax highlighting theme for users who are new or not signed in. See IDs of available themes.
delay_user_account_self_deletion string
delete_inactive_projects boolean
Enable dormant project deletion. Default is false. Became operational without feature flag in GitLab 15.4.
delete_unconfirmed_users boolean
Specifies whether users who have not confirmed their email should be deleted. Default is false. When set to true, unconfirmed users are deleted after unconfirmed_users_delete_after_days days. Introduced in GitLab 16.1. GitLab Self-Managed, Premium and Ultimate only.
deletion_adjourned_period integer
Number of days to wait before deleting a project or group that is marked for deletion. Value must be between 1 and 90. Defaults to 30.
deny_all_requests_except_allowed string
dependency_firewall_policies_per_configuration_limit string
dependency_scanning_sbom_scan_api_download_limit string
dependency_scanning_sbom_scan_api_upload_limit string
description_and_note_max_size integer
Maximum work item, merge request, and vulnerability description and comment content size in bytes. Default is 1048576.
diagramsnet_enabled boolean
(If enabled, requires diagramsnet_url) Enable Diagrams.net integration. Default is true.
diagramsnet_url string
The Diagrams.net instance URL for integration.
diff_max_commits integer
Maximum number of diff commits per merge request.
diff_max_files integer
Maximum files in a diff.
diff_max_lines integer
Maximum lines in a diff.
diff_max_patch_bytes integer
Maximum diff patch size, in bytes.
diff_max_versions integer
Maximum number of diff versions per merge request.
disable_admin_oauth_scopes boolean
Stops administrators from connecting their GitLab accounts to non-trusted OAuth 2.0 applications that have the api, read_api, read_repository, write_repository, read_registry, write_registry, or sudo scopes.
disable_feed_token boolean
Disable display of RSS/Atom and calendar feed tokens.
disable_invite_members boolean
Disable invite members functionality for group.
disable_overriding_approvers_per_merge_request boolean
Prevent editing approval rules in projects and merge requests
disable_password_authentication_for_users_with_sso_identities boolean
Disable password authentication in the web interface for users with an SSO identity. This does not affect Git operations over HTTP(S). Default is false.
disable_personal_access_tokens boolean
Disable personal access tokens. GitLab Self-Managed, Premium and Ultimate only. There is no method available to enable a personal access token that's been disabled through the API. This is a known issue. For more information about available workarounds, see Workaround.
disabled_direct_code_suggestions boolean
Indicates if direct connection for Code Suggestions is disabled for users
display_gitlab_credits_user_data string
dns_rebinding_protection_enabled boolean
Enforce DNS-rebinding attack protection.
domain_allowlist_raw string
domain_denylist_enabled boolean
(If enabled, requires: domain_denylist) Allows you to block new user accounts with emails from specific domains.
domain_denylist_raw string
downstream_pipeline_trigger_limit_per_project_user_sha integer
Maximum downstream pipeline trigger rate. Default: 0 (no restriction). Introduced in GitLab 16.10.
dsa_key_restriction integer
The minimum allowed bit length of an uploaded DSA key. Default is 0 (no restriction). -1 disables DSA keys. Can be one of: 0, 1024, 2048, 3072, -1.
duo_agent_platform_enabled string
duo_availability string
duo_chat_expiration_column string
duo_chat_expiration_days string
duo_cli_enabled string
duo_custom_agents_availability string
duo_custom_agents_enabled boolean
Indicates whether custom agents are allowed for this instance. Default: true. GitLab Self-Managed, Premium and Ultimate only. Introduced in GitLab 19.0.
duo_custom_flows_availability string
duo_custom_flows_enabled boolean
Indicates whether custom flows are allowed for this instance. Default: true. GitLab Self-Managed, Premium and Ultimate only. Introduced in GitLab 19.0.
duo_external_agents_availability string
duo_external_agents_enabled boolean
Indicates whether external agents are allowed for this instance. Default: true. GitLab Self-Managed, Premium and Ultimate only. Introduced in GitLab 19.0.
duo_features_enabled boolean
Indicates whether GitLab Duo features are enabled for this instance. Introduced in GitLab 16.10. GitLab Self-Managed, Premium and Ultimate only.
duo_foundational_flows_availability string
duo_foundational_flows_enabled string
duo_remote_flows_availability string
duo_remote_flows_enabled boolean
Indicates whether GitLab Duo remote flows are enabled for the instance
duo_template_project_id integer
The ID of a project to use as the Duo Code Review custom instructions template for this instance
duo_workflow_oauth_application_id string
duo_workflows_default_image_registry string
Default container registry for Duo Agent Platform foundational flow images
E–H application fields
ecdsa_key_restriction integer
The minimum allowed curve size (in bits) of an uploaded ECDSA key. Default is 0 (no restriction). -1 disables ECDSA keys. Can be one of: 0, 256, 384, 521, -1.
ecdsa_sk_key_restriction integer
The minimum allowed curve size (in bits) of an uploaded ECDSA_SK key. Default is 0 (no restriction). -1 disables ECDSA_SK keys. Can be one of: 0, 256, -1.
ed25519_key_restriction integer
The minimum allowed curve size (in bits) of an uploaded ED25519 key. Default is 0 (no restriction). -1 disables ED25519 keys. Can be one of: 0, 256, -1.
ed25519_sk_key_restriction integer
The minimum allowed curve size (in bits) of an uploaded ED25519_SK key. Default is 0 (no restriction). -1 disables ED25519_SK keys. Can be one of: 0, 256, -1.
eks_access_key_id string
AWS IAM access key ID.
eks_account_id string
Amazon account ID.
eks_integration_enabled boolean
Enable integration with Amazon EKS.
eks_secret_access_key string
AWS IAM secret access key.
elastic_migration_worker_enabled string
elasticsearch_advanced_search_pause_indexing boolean
Pause advanced search indexing
elasticsearch_analyzers_kuromoji_enabled string
elasticsearch_analyzers_kuromoji_search string
elasticsearch_analyzers_smartcn_enabled string
elasticsearch_analyzers_smartcn_search string
elasticsearch_aws boolean
Enable the use of AWS hosted Elasticsearch. Premium and Ultimate only.
elasticsearch_aws_access_key string
AWS IAM access key. Premium and Ultimate only.
elasticsearch_aws_region string
The AWS region the Elasticsearch domain is configured. Premium and Ultimate only.
elasticsearch_aws_role_arn string
elasticsearch_aws_secret_access_key string
AWS IAM secret access key. Premium and Ultimate only.
elasticsearch_client_adapter string
The Faraday adapter used by the Elasticsearch Ruby Client. Defaults to typhoeus. Possible values are typhoeus and net_http. Introduced in GitLab 18.5. Premium and Ultimate only.
elasticsearch_client_request_timeout string
elasticsearch_code_scope string
elasticsearch_indexed_field_length_limit integer
Maximum size of text fields to index by Elasticsearch. 0 value means no limit. This does not apply to repository and wiki indexing. Premium and Ultimate only.
elasticsearch_indexed_file_size_limit_kb integer
Maximum size of repository and wiki files that are indexed by Elasticsearch. Premium and Ultimate only.
elasticsearch_indexing boolean
Turn on indexing for advanced search. Premium and Ultimate only.
elasticsearch_indexing_timeout_minutes string
elasticsearch_limit_indexing boolean
Limit Elasticsearch to index certain namespaces and projects. Premium and Ultimate only.
elasticsearch_max_bulk_concurrency integer
Maximum concurrency of Elasticsearch bulk requests per indexing operation. This only applies to repository indexing operations. Premium and Ultimate only.
elasticsearch_max_bulk_size_mb integer
Maximum size of Elasticsearch bulk indexing requests in MB. This only applies to repository indexing operations. Premium and Ultimate only.
elasticsearch_max_code_indexing_concurrency integer
Maximum concurrency of Elasticsearch code indexing background jobs. This only applies to repository indexing operations. Premium and Ultimate only.
elasticsearch_password string
The password of your Elasticsearch instance. Premium and Ultimate only.
elasticsearch_pause_indexing boolean
Pause Elasticsearch indexing (global control for both Advanced Search and ActiveContext)
elasticsearch_replicas integer or object
Number of replicas for Elasticsearch indices. An integer applies to every index; an object assigns an integer to each named index. When using the object form, provide both elasticsearch_replicas and elasticsearch_shards for every index. An index missing either value is skipped. Premium and Ultimate only.
Object form of elasticsearch_replicas
<index_name> integer
Replica count for the named Elasticsearch index, for example gitlab-production: 1.
elasticsearch_requeue_workers boolean
Enable automatic requeuing of indexing workers. This improves non-code indexing throughput by enqueuing Sidekiq jobs until all documents are processed. Premium and Ultimate only.
elasticsearch_retry_on_failure integer
Maximum number of possible retries for Elasticsearch search requests. Premium and Ultimate only.
elasticsearch_search boolean
Enable Elasticsearch search. Premium and Ultimate only.
elasticsearch_shards integer or object
Number of shards for Elasticsearch indices. An integer applies to every index; an object assigns an integer to each named index. When using the object form, provide both elasticsearch_shards and elasticsearch_replicas for every index. An index missing either value is skipped. Premium and Ultimate only.
Object form of elasticsearch_shards
<index_name> integer
Shard count for the named Elasticsearch index, for example gitlab-production: 5.
elasticsearch_url string or array of strings
URL used to connect to Elasticsearch. For a cluster, use either a comma-separated string such as http://localhost:9200, http://localhost:9201 or an array of URL strings. Premium and Ultimate only.
elasticsearch_username string
The username of your Elasticsearch instance. Premium and Ultimate only.
elasticsearch_worker_number_of_shards integer
Number of indexing worker shards. This improves non-code indexing throughput by enqueuing more parallel Sidekiq jobs. Default is 2. Premium and Ultimate only.
email_additional_text string
Additional text added to the bottom of every email for legal/auditing/compliance reasons. Premium and Ultimate only.
email_author_in_body boolean
Some email servers do not support overriding the email sender name. Enable this option to include the name of the author of the issue, merge request or comment in the email body instead.
email_confirmation_setting string
Specifies whether users must confirm their email before sign in. Possible values are off, soft, and hard. Can be one of: off, soft, hard.
email_otp_enabled boolean
Enable Email-based one-time passwords (OTP) as a multi-factor authentication method. Disabled by default. Requires require_email_verification_on_account_locked to be true.
email_restrictions string
Regular expression that is checked against the email used during registration.
email_restrictions_enabled boolean
Prevent new users from creating an account by email.
enable_artifact_external_redirect_warning_page boolean
Show the external redirect page that warns you about user-generated content in GitLab Pages.
enable_language_server_restrictions boolean
Enables enforcing language server restrictions
enable_member_promotion_management string
enabled_expanded_logging string
enabled_git_access_protocol string
Enabled protocols for Git access. Allowed values are: ssh, http, and all to allow both protocols. all value introduced in GitLab 16.9. Can be one of: ssh, http, all.
enforce_ci_inbound_job_token_scope_enabled string
enforce_email_subaddress_restrictions string
enforce_granular_tokens string
enforce_namespace_storage_limit boolean
Enabling this permits enforcement of namespace storage limits.
enforce_pipl_compliance boolean
Sets whether pipl compliance is enforced for the saas application or not
enforce_terms boolean
(If enabled, requires: terms) Enforce application ToS to all users.
error_tracking_api_url string
error_tracking_enabled string
external_auth_client_cert string
(If enabled, requires: external_auth_client_key) The certificate to use to authenticate with the external authorization service.
external_auth_client_key string
Private key for the certificate when authentication is required for the external authorization service, this is encrypted when stored.
external_auth_client_key_pass string
Passphrase to use for the private key when authenticating with the external service this is encrypted when stored.
external_authorization_service_default_label string
The default classification label to use when requesting authorization and no classification label has been specified on the project.
external_authorization_service_enabled boolean
(If enabled, requires: external_authorization_service_default_label, external_authorization_service_timeout and external_authorization_service_url) Enable using an external authorization service for accessing projects.
external_authorization_service_timeout number
The timeout after which an authorization request is aborted, in seconds. When a request times out, access is denied to the user. (min: 0.001, max: 10, step: 0.001).
external_authorization_service_url string
URL to which authorization requests are directed.
external_pipeline_validation_service_timeout integer
How long to wait for a response from the pipeline validation service. Assumes OK if it times out.
external_pipeline_validation_service_token string
Optional. Token to include as the X-Gitlab-Token header in requests to the URL in external_pipeline_validation_service_url.
external_pipeline_validation_service_url string
URL to use for pipeline validation requests.
failed_login_attempts_unlock_period_in_minutes integer
Time period in minutes after which the user is unlocked when maximum number of failed sign-in attempts reached.
fetch_observability_alerts_from_cloud string
file_template_project_id integer
The ID of a project to load custom file templates from. Premium and Ultimate only.
first_day_of_week integer
Start day of the week for calendar views and date pickers. Valid values are 0 (default) for Sunday, 1 for Monday, and 6 for Saturday.
floc_enabled boolean
Enable FloC (Federated Learning of Cohorts)
force_pages_access_control string
foundational_agents_default_enabled string
foundational_agents_statuses string
geo_node_allowed_ips string
Comma-separated list of IPs and CIDRs of allowed secondary nodes. For example, 1.1.1.1, 2.2.2.0/24. GitLab Self-Managed, Premium and Ultimate only.
geo_status_timeout integer
The amount of seconds after which a request to get a secondary node status times out. GitLab Self-Managed, Premium and Ultimate only.
git_push_pipeline_limit integer
Set the maximum number of tag or branch pipelines that can be triggered by a single Git push. For more information about this limit, see number of pipelines per Git push.
git_two_factor_session_expiry integer
Maximum duration (in minutes) of a session for Git operations when 2FA is enabled. Premium and Ultimate only.
gitaly_timeout_default integer
Default Gitaly timeout, in seconds. This timeout is not enforced for Git fetch/push operations or Sidekiq jobs. Set to 0 to disable timeouts.
gitaly_timeout_fast integer
Gitaly fast operation timeout, in seconds. Some Gitaly operations are expected to be fast. If they exceed this threshold, there may be a problem with a storage shard and 'failing fast' can help maintain the stability of the GitLab instance. Set to 0 to disable timeouts.
gitaly_timeout_medium integer
Medium Gitaly timeout, in seconds. This should be a value between the Fast and the Default timeout. Set to 0 to disable timeouts.
gitlab_dedicated_instance boolean
Indicates whether the instance was provisioned for GitLab Dedicated.
gitlab_environment_toolkit_instance boolean
Indicates whether the instance was provisioned with the GitLab Environment Toolkit for Service Ping reporting.
gitlab_product_usage_data_enabled boolean
Indicates if product usage data collection is enabled. When the GITLAB_PRODUCT_USAGE_DATA_ENABLED environment variable is set, the API returns the effective value from the environment variable.
gitlab_shell_operation_limit integer
Maximum number of Git operations per minute a user can perform. Default: 600. Introduced in GitLab 16.2.
gitpod_enabled boolean
(If enabled, requires: gitpod_url) Enable Ona integration. Default is false.
gitpod_url string
The Ona instance URL for integration.
global_search_block_anonymous_searches_enabled string
global_search_code_enabled string
global_search_commits_enabled string
global_search_limited_indexing_enabled string
global_search_merge_requests_enabled string
global_search_snippet_titles_enabled string
global_search_users_enabled string
global_search_wiki_enabled string
global_search_work_items_enabled string
globally_allowed_ips string
Comma-separated list of IP addresses and CIDRs always allowed for inbound traffic. For example, 1.1.1.1, 2.2.2.0/24.
grafana_enabled boolean
Enable Grafana.
grafana_url string
Grafana URL.
granular_tokens_enforced_after string
gravatar_enabled boolean
Enable Gravatar.
group_api_limit string
group_archive_unarchive_api_limit string
group_download_export_limit string
group_export_limit string
group_import_limit string
group_invited_groups_api_limit string
group_owners_can_manage_default_branch_protection boolean
Prevent overrides of default branch protection. GitLab Self-Managed, Premium and Ultimate only.
group_projects_api_limit string
group_runner_token_expiration_interval integer
Set the expiration time (in seconds) of authentication tokens of newly registered group runners. Minimum value is 7200 seconds. For more information, see Automatically rotate authentication tokens.
group_secrets_limit integer
Maximum number of secrets allowed per group in Secrets Manager. Default: 500. To disable the limit, set to 0. Ultimate only. Introduced in GitLab 18.9.
group_shared_groups_api_limit string
groups_api_limit string
hashed_storage_enabled boolean
Create new projects using hashed storage paths: Enable immutable, hash-based paths and repository names to store repositories on disk. This prevents repositories from having to be moved or renamed when the Project URL changes and may improve disk I/O performance. (Always enabled in GitLab versions 13.0 and later, configuration is scheduled for removal in 14.0)
helm_max_packages_count integer
Maximum number of Helm packages that can be listed per channel. Must be at least 1. Default is 1000.
help_page_documentation_base_url string
Alternate documentation pages URL.
help_page_hide_commercial_content boolean
Hide marketing-related entries from help.
help_page_support_url string
Alternate support URL for help page and help dropdown list.
help_page_text string
Custom text displayed on the help page.
hide_third_party_offers boolean
Do not display offers from third parties in GitLab.
home_page_url string
Redirect to this URL when not logged in.
housekeeping_enabled boolean
Enable or disable Git housekeeping. Requires additional fields to be set.
housekeeping_optimize_repository_period integer
Number of Git pushes after which an incremental git repack is run.
html_emails_enabled boolean
Enable HTML emails.
I–L application fields
iframe_rendering_allowlist_raw string
Raw newline- or comma-separated list of allowed iframe src host[:port] entries.
iframe_rendering_enabled boolean
Allow rendering of iframes in Markdown. Disabled by default.
inactive_projects_delete_after_months integer
If delete_inactive_projects is true, the time (in months) to wait before deleting dormant projects. Default is 2. Became operational in GitLab 15.0.
inactive_projects_min_size_mb integer
If delete_inactive_projects is true, the minimum repository size for projects to be checked for inactivity. Default is 0. Became operational in GitLab 15.0.
inactive_projects_send_warning_email_after_months integer
If delete_inactive_projects is true, sets the time (in months) to wait before emailing Maintainers that the project is scheduled be deleted because it is dormant. Default is 1. Became operational in GitLab 15.0.
inactive_resource_access_tokens_delete_after_days integer
Specifies retention period for inactive project and group access tokens. Default is 30.
include_optional_metrics_in_service_ping boolean
Whether or not optional metrics are enabled in Service Ping. Introduced in GitLab 16.10.
instance_level_ai_beta_features_enabled string
instance_token_prefix string
invisible_captcha_enabled boolean
Enable Invisible CAPTCHA spam detection during account creation. Disabled by default.
invitation_flow_enforcement string
issues_create_limit integer
Maximum number of issue creation requests per minute per user. Disabled by default.
jira_connect_additional_audience_url string
jira_connect_application_key string
ID of the OAuth application used to authenticate with the GitLab for Jira Cloud app.
jira_connect_proxy_url string
URL of the GitLab instance used as a proxy for the GitLab for Jira Cloud app.
jira_connect_public_key_storage_enabled boolean
Enable public key storage for the GitLab for Jira Cloud app.
jira_forge_app_id string
Atlassian Forge app ID (ARI) of the GitLab for Jira Cloud app, used to verify inbound Forge Invocation Tokens.
keep_latest_artifact boolean
Prevent the deletion of the artifacts from the most recent successful jobs, regardless of the expiry time. Enabled by default.
kroki_diagram_proxy_enabled boolean
Enable Kroki diagram proxy. Default is false.
kroki_enabled boolean
(If enabled, requires: kroki_url) Enable Kroki integration. Default is false.
kroki_formats object
Additional formats supported by the Kroki instance.
Properties of kroki_formats
bpmn boolean
Enable or disable BPMN diagrams.
blockdiag boolean
Enable or disable BlockDiag diagrams.
excalidraw boolean
Enable or disable Excalidraw diagrams.
mermaid boolean
Enable or disable Mermaid diagrams.
kroki_url string
The Kroki instance URL for integration.
local_markdown_version integer
Increase this value when any cached Markdown should be invalidated.
lock_built_in_project_templates_enabled boolean
Enforce the built_in_project_templates_enabled setting for all groups. Premium and Ultimate only. Introduced in GitLab 19.0 with a feature flag named use_built_in_project_templates_enabled. Disabled by default. Generally available in GitLab 19.2. Feature flag use_built_in_project_templates_enabled removed.
lock_duo_custom_agents_enabled boolean
Indicates whether the custom agents enabled setting is enforced for all groups. Default: false. GitLab Self-Managed, Premium and Ultimate only. Introduced in GitLab 19.0.
lock_duo_custom_flows_enabled boolean
Indicates whether the custom flows enabled setting is enforced for all groups. Default: false. GitLab Self-Managed, Premium and Ultimate only. Introduced in GitLab 19.0.
lock_duo_external_agents_enabled boolean
Indicates whether the external agents enabled setting is enforced for all groups. Default: false. GitLab Self-Managed, Premium and Ultimate only. Introduced in GitLab 19.0.
lock_duo_features_enabled boolean
Indicates whether the GitLab Duo features enabled setting is enforced for all subgroups. Introduced in GitLab 16.10. GitLab Self-Managed, Premium and Ultimate only.
lock_duo_remote_flows_enabled boolean
Indicates if the GitLab Duo remote flows enabled setting is enforced for all subgroups
lock_memberships_to_ldap string
lock_memberships_to_saml boolean
Enforce a global lock on SAML group memberships.
lock_model_prompt_cache_enabled string
lock_require_sha_for_merge string
lock_resource_access_token_notify_inherited string
logging_field_dual_emit_target integer
Version to dual-emit alongside schema_version. Must be strictly greater than schema_version, or omit/null to disable. Can be one of: 1.
logging_field_schema_version integer
Logging field schema version (v0, v1, …). Cannot be downgraded. Can be one of: 0, 1.
login_recaptcha_protection_enabled boolean
Enable reCAPTCHA for login.
M–P application fields
mailgun_events_enabled boolean
Enable Mailgun event receiver.
mailgun_signing_key string
The Mailgun HTTP webhook signing key for receiving events from webhook.
maintenance_mode boolean
When instance is in maintenance mode, non-administrative users can sign in with read-only access and make read-only API requests. Premium and Ultimate only.
maintenance_mode_message string
Message displayed when instance is in maintenance mode. Premium and Ultimate only.
make_profile_private boolean
Flag indicating if users are permitted to make their profiles private
math_rendering_limits_enabled string
maven_package_requests_forwarding boolean
Use repo.maven.apache.org as a default remote repository when the package is not found in the GitLab package registry for Maven. Premium and Ultimate only.
max_artifacts_content_include_size string
max_artifacts_size integer
Maximum artifacts size in MB.
max_attachment_size integer
Limit attachment size in MB.
max_decompressed_archive_size integer
Maximum decompressed file size for imported archives in MB. Set to 0 for unlimited. Default is 25600.
max_export_size integer
Maximum export size in MB. 0 for unlimited. Default = 0 (unlimited).
max_github_response_json_value_count integer
Maximum allowed value count for GitHub API responses. 0 for unlimited. Count is an estimate based on the number of :, ,, { and [ occurrences in the response.
max_github_response_size_limit integer
Maximum allowed GitHub API response size in MB. 0 for unlimited.
max_http_decompressed_size integer
Maximum allowed size in MiB for Gzip-compressed HTTP responses from outbound requests after decompression. 0 for unlimited.
max_http_response_csv_structural_chars integer
Maximum allowed object count in CSV HTTP responses from outbound requests. Count is an estimate based on the number of ,, ;, \t and \n occurrences in the response. Introduced in GitLab 18.4.
max_http_response_json_depth integer
Maximum allowed nesting depth in JSON HTTP responses from outbound requests.
max_http_response_json_structural_chars integer
Maximum allowed object count in JSON HTTP responses from outbound requests. Count is an estimate based on the number of :, ,, { and [ occurrences in the response. Introduced in GitLab 18.4.
max_http_response_size_limit integer
Maximum allowed size in MiB for HTTP responses from outbound requests. 0 for unlimited. Applicable for integrations, importers and webhooks. Introduced in GitLab 18.4.
max_http_response_xml_structural_chars integer
Maximum allowed object count in XML HTTP responses from outbound requests. Count is an estimate based on the number of <, and = occurrences in the response. Introduced in GitLab 18.4.
max_import_remote_file_size integer
Maximum remote file size for imports from external object storages. Introduced in GitLab 16.3.
max_import_size integer
Maximum import size in MB. 0 for unlimited. Default = 0 (unlimited).
max_login_attempts integer
Maximum number of sign-in attempts before locking out the user.
max_number_of_repository_downloads integer
Maximum number of unique repositories a user can download in the specified time period before they are banned. Default: 0, Maximum: 10,000 repositories. GitLab Self-Managed, Ultimate only.
max_number_of_repository_downloads_within_time_period integer
Reporting time period (in seconds). Default: 0, Maximum: 864000 seconds (10 days). GitLab Self-Managed, Ultimate only.
max_pages_custom_domains_per_project integer
Maximum number of GitLab Pages custom domains per project
max_pages_size integer
Maximum size of pages repositories in MB.
max_personal_access_token_lifetime integer
Maximum allowable lifetime for access tokens in days. When left blank, default value of 365 is applied. When set, value must be 365 or less. When changed, existing access tokens with an expiration date beyond the maximum allowable lifetime are revoked. GitLab Self-Managed, Ultimate only. In GitLab 17.6 or later, the maximum lifetime limit can be extended to 400 days by enabling a feature flag named buffered_token_expiration_limit.
max_ssh_key_lifetime integer
Maximum allowable lifetime for SSH keys in days. GitLab Self-Managed, Ultimate only. In GitLab 17.6 or later, the maximum lifetime limit can be extended to 400 days by enabling a feature flag named buffered_token_expiration_limit.
max_terraform_state_size_bytes integer
Maximum size in bytes of the Terraform state files. Set this to 0 for unlimited file size.
max_yaml_depth integer
The maximum depth of nested CI/CD configuration added with the include keyword. Default: 100.
max_yaml_size_bytes integer
The maximum size in bytes of a single CI/CD configuration file. Default: 2097152.
mcp_server_enabled string
members_delete_limit string
metrics_method_call_threshold integer
A method call is only tracked when it takes longer than the given amount of milliseconds.
minimum_language_server_version string
The minimum language server version to accept requests from
minimum_password_length integer
Indicates whether passwords require a minimum length. Premium and Ultimate only.
mirror_available boolean
Allow repository mirroring to configured by project Maintainers. If disabled, only Administrators can configure repository mirroring.
mirror_capacity_threshold integer
Minimum capacity to be available before scheduling more mirrors preemptively. Premium and Ultimate only.
mirror_max_capacity integer
Maximum number of mirrors that can be synchronizing at the same time. Premium and Ultimate only.
mirror_max_delay integer
Maximum time (in minutes) between updates that a mirror can have when scheduled to synchronize. Premium and Ultimate only.
model_prompt_cache_enabled string
namespace_aggregation_schedule_lease_duration_in_seconds integer
Maximum duration (in seconds) between refreshes of namespace statistics (Default: 300)
notes_create_limit string
notes_create_limit_allowlist_raw string
notify_on_unknown_sign_in boolean
Enable sending notification if sign in from unknown IP address happens.
npm_package_requests_forwarding boolean
Use npmjs.org as a default remote repository when the package is not found in the GitLab package registry for npm. Premium and Ultimate only.
nuget_skip_metadata_url_validation boolean
Indicates whether to skip metadata URL validation for the NuGet package. Introduced in GitLab 17.0.
oauth_access_token_expires_in integer
Maximum lifetime in seconds of all new OAuth access tokens issued by the instance. Minimum value: 300 (5 minutes). Default value: 7200 (2 hours). If blank or null, uses default value. Does not affect existing OAuth access tokens.
observability_backend_ssl_verification_enabled string
organization_cluster_agent_authorization_enabled string
outbound_local_requests_allowlist_raw string
package_metadata_purl_types array of integers
Package registry metadata types to synchronize. GitLab Self-Managed, Ultimate only.
package_registry_allow_anyone_to_pull_option boolean
Enable to allow anyone to pull from package registry visible and changeable.
package_registry_cleanup_policies_worker_capacity integer
Number of workers assigned to the packages cleanup policies.
pages_domain_verification_enabled boolean
Require users to prove ownership of custom domains. Domain verification is an essential security measure for public GitLab sites. Users are required to demonstrate they control a domain before it is enabled.
pages_extra_deployments_default_expiry_seconds string
pages_unique_domain_default_enabled boolean
Enable unique domains by default for Pages sites to avoid cookie sharing between sites under a given namespace. Default is true.
password_authentication_enabled boolean
Flag indicating if password authentication is enabled for the web interface
password_authentication_enabled_for_git boolean
Enable authentication for Git over HTTP(S) via a GitLab account password. Default is true.
password_authentication_enabled_for_web boolean
Enable authentication for the web interface via a GitLab account password. Default is true.
password_lowercase_required boolean
Indicates whether passwords require at least one lowercase letter. Premium and Ultimate only.
password_number_required boolean
Indicates whether passwords require at least one number. Premium and Ultimate only.
password_symbol_required boolean
Indicates whether passwords require at least one symbol character. Premium and Ultimate only.
password_uppercase_required boolean
Indicates whether passwords require at least one uppercase letter. Premium and Ultimate only.
performance_bar_allowed_group_path string
Path of the group that is allowed to toggle the performance bar.
personal_access_token_prefix string
Prefix for all generated personal access tokens.
pipeline_execution_policies_per_configuration_limit string
pipeline_limit_per_project_user_sha integer
Maximum number of pipeline creation requests per minute per user and commit. Disabled by default.
pipeline_limit_per_user integer
Maximum number of pipeline creation requests per minute per user.
plantuml_diagram_proxy_enabled boolean
Enable PlantUML diagram proxy. Default is false.
plantuml_enabled boolean
(If enabled, requires: plantuml_url) Enable PlantUML integration. Default is false.
plantuml_url string
The PlantUML instance URL for integration.
policy_store_experiment_enabled string
polling_interval_multiplier number
Interval multiplier used by endpoints that perform polling. Set to 0 to disable polling.
prevent_merge_requests_author_approval boolean
Prevent approval by merge request creator (author)
prevent_merge_requests_committers_approval boolean
Prevent approval by committers to merge requests
product_analytics_configurator_connection_string string
product_analytics_data_collector_host string
product_analytics_enabled string
project_api_limit string
project_download_export_limit string
project_export_enabled boolean
Enable project export.
project_export_limit string
project_import_limit string
project_invited_groups_api_limit string
project_jobs_api_rate_limit integer
Maximum authenticated requests to /project/:id/jobs per minute. Introduced in GitLab 16.5. Default: 600.
project_members_api_limit string
project_runner_token_expiration_interval integer
Set the expiration time (in seconds) of authentication tokens of newly registered project runners. Minimum value is 7200 seconds. For more information, see Automatically rotate authentication tokens.
project_secrets_limit integer
Maximum number of secrets allowed per project in Secrets Manager. Default: 100. To disable the limit, set to 0. Ultimate only. Introduced in GitLab 18.9.
projects_api_limit string
projects_api_rate_limit_unauthenticated integer
Maximum number of requests per 10 minutes per IP address for unauthenticated requests to the list all projects API. Default: 400. To disable throttling, set to 0.
prometheus_metrics_enabled boolean
Enable Prometheus metrics.
protected_ci_variables boolean
CI/CD variables are protected by default.
protected_paths_for_get_request_raw string
protected_paths_raw string
push_event_activities_limit integer
Maximum number of changes (branches or tags) in a single push above which a bulk push event is created. Setting to 0 does not disable throttling.
push_event_hooks_limit integer
Maximum number of changes (branches or tags) in a single push above which webhooks and integrations are not triggered. Setting to 0 does not disable throttling. Default: 3.
pypi_package_requests_forwarding boolean
Use pypi.org as a default remote repository when the package is not found in the GitLab package registry for PyPI. Premium and Ultimate only.
Q–T application fields
rate_limiting_response_text string
When rate limiting is enabled via the throttle_* settings, send this plain text response when a rate limit is exceeded. 'Retry later' is sent if this is blank.
raw_blob_request_limit integer
Maximum number of requests per minute for each raw path (default is 300). Set to 0 to disable throttling.
raw_blob_request_limit_unauthenticated integer
Maximum number of unauthenticated requests per minute across all raw paths in a project (default is 800). Set to 0 to disable throttling.
recaptcha_enabled boolean
(If enabled, requires: recaptcha_private_key and recaptcha_site_key) Enable reCAPTCHA.
recaptcha_private_key string
Private key for reCAPTCHA.
recaptcha_site_key string
Site key for reCAPTCHA.
receive_max_input_size integer
Maximum push size (MB).
receptive_cluster_agents_enabled boolean
Enable receptive mode for GitLab agents for Kubernetes.
reindexing_minimum_index_size string
reindexing_minimum_relative_bloat_size string
relation_export_batch_size integer
The size of each batch when exporting batched relations. Introduced in GitLab 18.2.
remember_me_enabled boolean
Enable Remember me setting. Introduced in GitLab 16.0.
repository_checks_enabled boolean
GitLab periodically runs git fsck in all project and wiki repositories to look for silent disk corruption issues.
repository_size_limit integer
Size limit per repository (MB). Premium and Ultimate only.
require_admin_approval_after_user_signup boolean
When enabled, any user that signs up for an account using the registration form is placed under a Pending approval state and has to be explicitly approved by an administrator.
require_admin_two_factor_authentication boolean
Allow administrators to require 2FA for all administrators on the instance.
require_email_verification_on_account_locked boolean
If true, all users on the instance must verify their identity after suspicious sign-in activity is detected.
require_personal_access_token_expiry boolean
When enabled, users must set an expiration date when creating a group or project access token, or a personal access token owned by a non-service account.
require_sha_for_merge string
require_two_factor_authentication boolean
(If enabled, requires: two_factor_grace_period) Require all users to set up two-factor authentication.
resource_access_token_notify_inherited string
root_moved_permanently_redirection boolean
Return 301 Moved Permanently, rather than 302 Found, when redirecting the instance root to another site such as the configured home page URL.
rsa_key_restriction integer
The minimum allowed bit length of an uploaded RSA key. Default is 0 (no restriction). -1 disables RSA keys. Can be one of: 0, 1024, 2048, 3072, 4096, -1.
runner_jobs_endpoints_api_limit integer
Maximum number of requests per minute per job token for requests to /jobs/* requests to the runner jobs API endpoints. Default: 200. To disable throttling, set to 0. Introduced in GitLab 18.5.
runner_jobs_patch_trace_api_limit integer
Maximum number of requests per minute per runner token for requests to the PATCH /jobs/:id/trace runner jobs API endpoint. Default: 2000. To disable throttling, set to 0. Introduced in GitLab 18.5.
runner_jobs_request_api_limit integer
Maximum number of requests per minute per runner token for requests to the /jobs/request runner jobs API endpoint. Default: 2000. To disable throttling, set to 0. Introduced in GitLab 18.5.
runner_token_expiration_interval integer
Set the expiration time (in seconds) of authentication tokens of newly registered instance runners. Minimum value is 7200 seconds. For more information, see Automatically rotate authentication tokens.
scan_execution_policies_action_limit integer
Maximum number of actions per scan execution policy. Default: 0. Maximum: 20
scan_execution_policies_per_configuration_limit string
scan_execution_policies_schedule_limit integer
Maximum number of type: schedule rules per scan execution policy. Default: 0. Maximum: 20
search_max_docs_denominator string
search_max_shard_size_gb string
search_min_docs_before_rollover string
search_rate_limit integer
Maximum number of requests per minute for performing a search while authenticated. Default: 30. To disable throttling, set to 0.
search_rate_limit_allowlist_raw string
search_rate_limit_unauthenticated integer
Maximum number of requests per minute for performing a search while unauthenticated. Default: 10. To disable throttling, set to 0.
secret_detection_revocation_token_types_url string
The configured Secret Detection Revocation Token Types instance URL
secret_detection_service_auth_token string
secret_detection_service_url string
secret_detection_token_revocation_enabled boolean
Enable Secret Detection Token Revocation
secret_detection_token_revocation_token string
secret_detection_token_revocation_url string
The configured Secret Detection Token Revocation instance URL
secret_push_protection_available boolean
Allow projects to enable secret push protection. This does not enable secret push protection. Ultimate only.
security_approval_policies_limit integer
Maximum number of active merge request approval policies per security policy project. Default: 5. Maximum: 20
security_mr_report_cache_lifetime_minutes integer
Number of minutes to cache security reports on merge requests (10-60). Default: 10. Premium and Ultimate only. Introduced in GitLab 18.10.
security_policy_global_group_approvers_enabled boolean
Whether to look up merge request approval policy approval groups globally or within project hierarchies.
security_scan_stale_after_days integer
Number of days to retain security scan data before purging. Must be between 7 and 90 days. Default: 30 days for GitLab.com, 90 days for self-managed. Premium and Ultimate only. Introduced in GitLab 18.9.
security_txt_content string
Public security contact information. Introduced in GitLab 16.7.
sentry_clientside_dsn string
sentry_clientside_traces_sample_rate string
sentry_dsn string
sentry_enabled string
sentry_environment string
service_access_tokens_expiration_enforced boolean
Flag to indicate if token expiry date can be optional for service account users. Premium and Ultimate only.
session_expire_delay integer
Session duration in minutes. GitLab restart is required to apply changes.
session_expire_from_init boolean
If true, sessions expire a number of minutes after the session was created rather than after the last activity. This lifetime of a session is defined by session_expire_delay.
shared_runners_enabled boolean
(If enabled, requires: shared_runners_text and shared_runners_minutes) Enable instance runners for new projects.
shared_runners_minutes integer
Set the maximum number of compute minutes that a group can use on instance runners per month. Premium and Ultimate only.
shared_runners_text string
Instance runners text.
show_migrate_from_jenkins_banner boolean
Enable Jenkins migration banner
sidekiq_job_limiter_compression_threshold_bytes integer
The threshold in bytes at which Sidekiq jobs are compressed before being stored in Redis. Default: 100,000 bytes (100 KB).
sidekiq_job_limiter_limit_bytes integer
The threshold in bytes at which Sidekiq jobs are rejected. Default: 0 bytes (doesn't reject any job).
sidekiq_job_limiter_mode string
track or compress. Sets the behavior for Sidekiq job size limits. Default: 'compress'.
sign_in_restrictions object
Application sign-in restrictions.
Properties of sign_in_restrictions
disable_password_authentication_for_users_with_sso_identities boolean
Require users with one or more associated SSO identities to sign in through SSO instead of using password authentication.
root_moved_permanently_redirection boolean
Return 301 Moved Permanently, rather than 302 Found, when redirecting the instance root to another site such as the configured home page URL.
session_expire_from_init boolean
Expire sessions after the configured lifetime measured from session creation, even while a session remains active. These sessions cannot be extended.
require_minimum_email_based_otp_for_users_with_passwords boolean
Require users who sign in with a password to use at least email-based OTP. Email OTP is optional when another two-factor method is enabled. Requires email_otp_enabled.
email_otp_enabled boolean
Make email-based one-time passwords available as a multi-factor authentication method. Requires working outbound email delivery.
signup_enabled boolean
Enable registration. Default is true.
silent_admin_exports_enabled boolean
Enable Silent admin exports. Default is false.
silent_mode_enabled boolean
Enable Silent mode. Default is false.
slack_app_enabled boolean
(If enabled, requires: slack_app_id, slack_app_secret, slack_app_signing_secret, and slack_app_verification_token) Enable the GitLab for Slack app.
slack_app_id string
The client ID of the GitLab for Slack app.
slack_app_secret string
The client secret of the GitLab for Slack app. Used for authenticating OAuth requests from the app.
slack_app_signing_secret string
The signing secret of the GitLab for Slack app. Used for authenticating API requests from the app.
snippet_size_limit integer
Maximum snippet content size in bytes. Default: 52428800 Bytes (50 MB).
snowplow_app_id string
The Snowplow site name / application ID. (for example, gitlab)
snowplow_collector_hostname string
The Snowplow collector hostname. (for example, snowplowprd.trx.gitlab.net)
snowplow_cookie_domain string
The Snowplow cookie domain. (for example, .gitlab.com)
snowplow_database_collector_hostname string
The Snowplow collector for database events hostname. (for example, db-snowplow.trx.gitlab.net)
snowplow_enabled boolean
Enable snowplow tracking.
sourcegraph_enabled boolean
Enables Sourcegraph integration. Default is false. If enabled, requires sourcegraph_url.
sourcegraph_public_only boolean
Blocks Sourcegraph from being loaded on private and internal projects. Default is true.
sourcegraph_url string
The Sourcegraph instance URL for integration.
spam_check_api_key string
API key used by GitLab for accessing the Spam Check service endpoint.
spam_check_endpoint_enabled boolean
Enables spam checking using external Spam Check API endpoint. Default is false.
spam_check_endpoint_url string
URL of the external Spamcheck service endpoint. Valid URI schemes are grpc or tls. Specifying tls forces communication to be encrypted.
static_objects_external_storage_auth_token string
Authentication token for the external storage linked in static_objects_external_storage_url.
static_objects_external_storage_url string
URL to an external storage for repository static objects.
suggest_pipeline_enabled boolean
Enable pipeline suggestion banner.
terminal_max_session_time integer
Maximum time for web terminal websocket connection (in seconds). Set to 0 for unlimited time.
terms string
(Required by: enforce_terms) Markdown content for the ToS.
terraform_state_encryption_enabled boolean
Enable encryption for Terraform state files
throttle_authenticated_api_enabled boolean
(If enabled, requires: throttle_authenticated_api_period_in_seconds and throttle_authenticated_api_requests_per_period) Enable authenticated API request rate limit. Helps reduce request volume (for example, from crawlers or abusive bots).
throttle_authenticated_api_period_in_seconds integer
Rate limit period (in seconds).
throttle_authenticated_api_requests_per_period integer
Maximum requests per period per user.
throttle_authenticated_deprecated_api_enabled string
throttle_authenticated_deprecated_api_period_in_seconds string
throttle_authenticated_deprecated_api_requests_per_period string
throttle_authenticated_files_api_enabled string
throttle_authenticated_files_api_period_in_seconds string
throttle_authenticated_files_api_requests_per_period string
throttle_authenticated_git_http_enabled boolean
If true, enforces the authenticated Git HTTP request rate limit. Default value: false.
throttle_authenticated_git_http_period_in_seconds integer
Rate limit period in seconds. throttle_authenticated_git_http_enabled must be true. Default value: 3600.
throttle_authenticated_git_http_requests_per_period integer
Maximum requests per period per user. throttle_authenticated_git_http_enabled must be true. Default value: 3600.
throttle_authenticated_git_lfs_enabled string
throttle_authenticated_git_lfs_period_in_seconds string
throttle_authenticated_git_lfs_requests_per_period string
throttle_authenticated_packages_api_enabled boolean
(If enabled, requires: throttle_authenticated_packages_api_period_in_seconds and throttle_authenticated_packages_api_requests_per_period) Enable authenticated API request rate limit. Helps reduce request volume (for example, from crawlers or abusive bots). View package registry rate limits for more details.
throttle_authenticated_packages_api_period_in_seconds integer
Rate limit period (in seconds). View package registry rate limits for more details.
throttle_authenticated_packages_api_requests_per_period integer
Maximum requests per period per user. View package registry rate limits for more details.
throttle_authenticated_web_enabled boolean
(If enabled, requires: throttle_authenticated_web_period_in_seconds and throttle_authenticated_web_requests_per_period) Enable authenticated web request rate limit. Helps reduce request volume (for example, from crawlers or abusive bots).
throttle_authenticated_web_period_in_seconds integer
Rate limit period (in seconds).
throttle_authenticated_web_requests_per_period integer
Maximum requests per period per user.
throttle_incident_management_notification_enabled string
throttle_incident_management_notification_per_period string
throttle_incident_management_notification_period_in_seconds string
throttle_protected_paths_enabled string
throttle_protected_paths_period_in_seconds string
throttle_protected_paths_requests_per_period string
throttle_unauthenticated_api_enabled boolean
(If enabled, requires: throttle_unauthenticated_api_period_in_seconds and throttle_unauthenticated_api_requests_per_period) Enable unauthenticated API request rate limit. Helps reduce request volume (for example, from crawlers or abusive bots).
throttle_unauthenticated_api_period_in_seconds integer
Rate limit period in seconds.
throttle_unauthenticated_api_requests_per_period integer
Maximum requests per period per IP.
throttle_unauthenticated_deprecated_api_enabled string
throttle_unauthenticated_deprecated_api_period_in_seconds string
throttle_unauthenticated_deprecated_api_requests_per_period string
throttle_unauthenticated_files_api_enabled string
throttle_unauthenticated_files_api_period_in_seconds string
throttle_unauthenticated_files_api_requests_per_period string
throttle_unauthenticated_git_http_enabled boolean
If true, enforces the unauthenticated Git HTTP request rate limit. Default value: false.
throttle_unauthenticated_git_http_period_in_seconds integer
Rate limit period in seconds. throttle_unauthenticated_git_http_enabled must be true. Default value: 3600.
throttle_unauthenticated_git_http_requests_per_period integer
Maximum requests per period per IP. throttle_unauthenticated_git_http_enabled must be true. Default value: 3600.
throttle_unauthenticated_packages_api_enabled boolean
(If enabled, requires: throttle_unauthenticated_packages_api_period_in_seconds and throttle_unauthenticated_packages_api_requests_per_period) Enable unauthenticated API request rate limit. Helps reduce request volume (for example, from crawlers or abusive bots). View package registry rate limits for more details.
throttle_unauthenticated_packages_api_period_in_seconds integer
Rate limit period (in seconds). View package registry rate limits for more details.
throttle_unauthenticated_packages_api_requests_per_period integer
Maximum requests per period per user. View package registry rate limits for more details.
throttle_unauthenticated_web_enabled boolean
(If enabled, requires: throttle_unauthenticated_web_period_in_seconds and throttle_unauthenticated_web_requests_per_period) Enable unauthenticated web request rate limit. Helps reduce request volume (for example, from crawlers or abusive bots).
throttle_unauthenticated_web_period_in_seconds integer
Rate limit period in seconds.
throttle_unauthenticated_web_requests_per_period integer
Maximum requests per period per IP.
time_tracking_limit_to_hours boolean
Limit display of time tracking units to hours. Default is false.
tool_approval_for_session_availability string
tool_approval_for_session_enabled string
top_level_group_creation_enabled boolean
Allows a user to create top-level-groups. Default is true.
two_factor_grace_period integer
Amount of time (in hours) that users are allowed to skip forced configuration of two-factor authentication.
U–Z application fields
unconfirmed_users_delete_after_days integer
Specifies how many days after account creation to delete users who have not confirmed their email. Only applicable if delete_unconfirmed_users is set to true. Must be 1 or greater. Default is 7. Introduced in GitLab 16.1. GitLab Self-Managed, Premium and Ultimate only.
unique_ips_limit_enabled boolean
(If enabled, requires: unique_ips_limit_per_user and unique_ips_limit_time_window) Limit sign in from multiple IPs.
unique_ips_limit_per_user integer
Maximum number of IPs per user.
unique_ips_limit_time_window integer
How many seconds an IP is counted towards the limit.
update_runner_versions_enabled boolean
Fetch GitLab Runner release version data from GitLab.com. For more information, see how to determine which runners need to be upgraded.
updating_name_disabled_for_users boolean
Disable user profile name changes.
usage_ping_enabled boolean
Every week GitLab reports license usage back to GitLab, Inc.
usage_ping_features_enabled string
usage_ping_generation_enabled string
use_clickhouse_for_analytics boolean
Enables ClickHouse as a data source for analytics reports. ClickHouse must be configured for this setting to take effect. Available on Premium and Ultimate only.
user_contributed_projects_api_limit string
user_deactivation_emails_enabled boolean
Send an email to users upon account deactivation.
user_default_external boolean
Newly registered users are external by default.
user_default_internal_regex string
Specify an email address regex pattern to identify default internal users.
user_defaults_to_private_profile boolean
Newly created users have private profile by default. Defaults to false.
user_oauth_applications boolean
Allow users to register any application to use GitLab as an OAuth provider. This setting does not affect group-level OAuth applications.
user_projects_api_limit string
user_show_add_ssh_key_message boolean
When set to false disable the You won't be able to pull or push repositories via SSH until you add an SSH key to your profile warning shown to users with no uploaded SSH key.
user_starred_projects_api_limit string
users_api_limit_followers integer
Maximum number of requests per minute, per user or IP address. Default: 100. Set to 0 to disable limits. Introduced in GitLab 17.10.
users_api_limit_following integer
Maximum number of requests per minute, per user or IP address. Default: 100. Set to 0 to disable limits. Introduced in GitLab 17.10.
users_api_limit_gpg_key integer
Maximum number of requests per minute, per user or IP address. Default: 120. Set to 0 to disable limits. Introduced in GitLab 17.10.
users_api_limit_gpg_keys integer
Maximum number of requests per minute, per user or IP address. Default: 120. Set to 0 to disable limits. Introduced in GitLab 17.10.
users_api_limit_ssh_key string
users_api_limit_ssh_keys string
users_api_limit_status integer
Maximum number of requests per minute, per user or IP address. Default: 240. Set to 0 to disable limits. Introduced in GitLab 17.10.
users_get_by_id_limit integer
Maximum number of calls to the /users/:id API per 10 minutes per user. Set to 0 for unlimited requests.
users_get_by_id_limit_allowlist_raw string
vac_project_ids_raw string
version_check_enabled boolean
Let GitLab inform you when an update is available.
virtual_registries_endpoints_api_limit integer
Maximum number of requests on virtual registries endpoints, per IP address, per 15 seconds. Default: 4000. To disable limits, set to 0. Introduced in GitLab 17.11.
vscode_extension_marketplace_enabled string
vscode_extension_marketplace_extension_host_domain string
vscode_extension_marketplace_single_origin_fallback_enabled string
vulnerability_management_policies_per_configuration_limit string
whats_new_variant string
What's new variant, possible values: all_tiers, current_tier, and disabled. Can be one of: all_tiers, current_tier, disabled.
wiki_asciidoc_allow_uri_includes boolean
Allow URI includes for AsciiDoc wiki pages
wiki_page_max_content_bytes integer
Maximum wiki page content size in bytes. Default: 5242880 Bytes (5 MB). The minimum value is 1024 bytes.
zoekt_auto_index_root_namespace string
zoekt_cache_response string
zoekt_cpu_to_tasks_ratio string
zoekt_default_number_of_replicas string
zoekt_force_reindexing_percentage string
zoekt_indexed_file_size_limit string
zoekt_indexing_enabled string
zoekt_indexing_parallelism string
zoekt_indexing_paused string
zoekt_indexing_timeout string
zoekt_lost_node_threshold string
zoekt_max_projects_for_legacy_search string
zoekt_max_restarts_15m string
zoekt_maximum_files string
zoekt_rollout_batch_size string
zoekt_rollout_retry_interval string
zoekt_search_enabled string
zoekt_trigram_max string