config.schema.json

{
  "$id": "https://github.com/ory/kratos/driver/config/.schema/config.schema.json",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "Ory Kratos Configuration",
  "type": "object",
  "definitions": {
    "baseUrl": {
      "title": "Base URL",
      "description": "The URL where the endpoint is exposed at. This domain is used to generate redirects, form URLs, and more.",
      "type": "string",
      "format": "uri-reference",
      "examples": [
        "https://my-app.com/",
        "https://my-app.com/.ory/kratos/public"
      ]
    },
    "socket": {
      "type": "object",
      "additionalProperties": false,
      "description": "Sets the permissions of the unix socket",
      "properties": {
        "owner": {
          "type": "string",
          "description": "Owner of unix socket. If empty, the owner will be the user running Kratos.",
          "default": ""
        },
        "group": {
          "type": "string",
          "description": "Group of unix socket. If empty, the group will be the primary group of the user running Kratos.",
          "default": ""
        },
        "mode": {
          "type": "integer",
          "description": "Mode of unix socket in numeric form",
          "default": 493,
          "minimum": 0,
          "maximum": 511
        }
      }
    },
    "defaultReturnTo": {
      "title": "Redirect browsers to set URL per default",
      "description": "Ory Kratos redirects to this URL per default on completion of self-service flows and other browser interaction. Read this [article for more information on browser redirects](https://www.ory.sh/kratos/docs/concepts/browser-redirect-flow-completion).",
      "type": "string",
      "format": "uri-reference",
      "examples": [
        "https://my-app.com/dashboard",
        "/dashboard"
      ]
    },
    "selfServiceSessionRevokerHook": {
      "type": "object",
      "properties": {
        "hook": {
          "const": "revoke_active_sessions"
        }
      },
      "additionalProperties": false,
      "required": [
        "hook"
      ]
    },
    "selfServiceSessionIssuerHook": {
      "type": "object",
      "properties": {
        "hook": {
          "const": "session"
        }
      },
      "additionalProperties": false,
      "required": [
        "hook"
      ]
    },
    "selfServiceRequireVerifiedAddressHook": {
      "type": "object",
      "properties": {
        "hook": {
          "const": "require_verified_address"
        }
      },
      "additionalProperties": false,
      "required": [
        "hook"
      ]
    },
    "webHookAuthBasicAuthProperties": {
      "properties": {
        "type": {
          "const": "basic_auth"
        },
        "config": {
          "type": "object",
          "properties": {
            "user": {
              "type": "string",
              "description": "user name for basic auth"
            },
            "password": {
              "type": "string",
              "description": "password for basic auth"
            }
          },
          "additionalProperties": false,
          "required": [
            "user",
            "password"
          ]
        }
      },
      "additionalProperties": false,
      "required": [
        "type",
        "config"
      ]
    },
    "webHookAuthApiKeyProperties": {
      "properties": {
        "type": {
          "const": "api_key"
        },
        "config": {
          "type": "object",
          "properties": {
            "name": {
              "type": "string",
              "description": "The name of the api key"
            },
            "value": {
              "type": "string",
              "description": "The value of the api key"
            },
            "in": {
              "type": "string",
              "description": "How the api key should be transferred",
              "enum": [
                "header",
                "cookie"
              ]
            }
          },
          "additionalProperties": false,
          "required": [
            "name",
            "value",
            "in"
          ]
        }
      },
      "additionalProperties": false,
      "required": [
        "type",
        "config"
      ]
    },
    "selfServiceWebHook": {
      "type": "object",
      "properties": {
        "hook": {
          "const": "web_hook"
        },
        "config": {
          "type": "object",
          "title": "Web-Hook Configuration",
          "description": "Define what the hook should do",
          "properties": {
            "url": {
              "type": "string",
              "description": "The URL the Web-Hook should call",
              "format": "uri"
            },
            "method": {
              "type": "string",
              "description": "The HTTP method to use (GET, POST, etc)."
            },
            "body": {
              "type": "string",
              "oneOf": [
                {
                  "format": "uri",
                  "pattern": "^(http|https|file|base64)://",
                  "description": "URI pointing to the jsonnet template used for payload generation. Only used for those HTTP methods, which support HTTP body payloads",
                  "examples": [
                    "file:///path/to/body.jsonnet",
                    "file://./body.jsonnet",
                    "base64://ZnVuY3Rpb24oY3R4KSB7CiAgaWRlbnRpdHlfaWQ6IGlmIGN0eFsiaWRlbnRpdHkiXSAhPSBudWxsIHRoZW4gY3R4LmlkZW50aXR5LmlkLAp9=",
                    "https://oryapis.com/default_body.jsonnet"
                  ]
                },
                {
                  "description": "DEPRECATED: please use a URI instead (i.e. prefix your filepath with 'file://')",
                  "not": {
                    "pattern": "^(http|https|file|base64)://"
                  }
                }
              ]
            },
            "auth": {
              "type": "object",
              "title": "Auth mechanisms",
              "description": "Define which auth mechanism the Web-Hook should use",
              "oneOf": [
                {
                  "$ref": "#/definitions/webHookAuthApiKeyProperties"
                },
                {
                  "$ref": "#/definitions/webHookAuthBasicAuthProperties"
                }
              ]
            },
            "additionalProperties": false
          },
          "additionalProperties": false,
          "required": [
            "url",
            "method"
          ]
        }
      },
      "additionalProperties": false,
      "required": [
        "hook",
        "config"
      ]
    },
    "OIDCClaims": {
      "title": "OpenID Connect claims",
      "description": "The OpenID Connect claims and optionally their properties which should be included in the id_token or returned from the UserInfo Endpoint.",
      "type": "object",
      "examples": [
        {
          "id_token": {
            "email": null,
            "email_verified": null
          }
        },
        {
          "userinfo": {
            "given_name": {
              "essential": true
            },
            "nickname": null,
            "email": {
              "essential": true
            },
            "email_verified": {
              "essential": true
            },
            "picture": null,
            "http://example.info/claims/groups": null
          },
          "id_token": {
            "auth_time": {
              "essential": true
            },
            "acr": {
              "values": [
                "urn:mace:incommon:iap:silver"
              ]
            }
          }
        }
      ],
      "patternProperties": {
        "^userinfo$|^id_token$": {
          "type": "object",
          "additionalProperties": false,
          "patternProperties": {
            ".*": {
              "oneOf": [
                {
                  "const": null,
                  "description": "Indicates that this Claim is being requested in the default manner."
                },
                {
                  "type": "object",
                  "additionalProperties": false,
                  "properties": {
                    "essential": {
                      "description": "Indicates whether the Claim being requested is an Essential Claim.",
                      "type": "boolean"
                    },
                    "value": {
                      "description": "Requests that the Claim be returned with a particular value.",
                      "$comment": "There seem to be no constrains on value"
                    },
                    "values": {
                      "description": "Requests that the Claim be returned with one of a set of values, with the values appearing in order of preference.",
                      "type": "array",
                      "items": {
                        "$comment": "There seem to be no constrains on individual items"
                      }
                    }
                  }
                }
              ]
            }
          }
        }
      }
    },
    "selfServiceOIDCProvider": {
      "type": "object",
      "properties": {
        "id": {
          "type": "string",
          "examples": [
            "google"
          ]
        },
        "provider": {
          "title": "Provider",
          "description": "Can be one of github, github-app, gitlab, generic, google, microsoft, discord, slack, facebook, auth0, vk, yandex.",
          "type": "string",
          "enum": [
            "github",
            "gitlab",
            "gitlab-app",
            "generic",
            "google",
            "microsoft",
            "discord",
            "slack",
            "facebook",
            "auth0",
            "vk",
            "yandex"
          ],
          "examples": [
            "google"
          ]
        },
        "label": {
          "title": "Optional string which will be used when generating labels for UI buttons.",
          "type": "string"
        },
        "client_id": {
          "type": "string"
        },
        "client_secret": {
          "type": "string"
        },
        "issuer_url": {
          "type": "string",
          "format": "uri",
          "examples": [
            "https://accounts.google.com"
          ]
        },
        "auth_url": {
          "type": "string",
          "format": "uri",
          "examples": [
            "https://accounts.google.com/o/oauth2/v2/auth"
          ]
        },
        "token_url": {
          "type": "string",
          "format": "uri",
          "examples": [
            "https://www.googleapis.com/oauth2/v4/token"
          ]
        },
        "mapper_url": {
          "title": "Jsonnet Mapper URL",
          "description": "The URL where the jsonnet source is located for mapping the provider's data to Ory Kratos data.",
          "type": "string",
          "format": "uri",
          "examples": [
            "file://path/to/oidc.jsonnet",
            "https://foo.bar.com/path/to/oidc.jsonnet",
            "base64://bG9jYWwgc3ViamVjdCA9I..."
          ]
        },
        "scope": {
          "type": "array",
          "items": {
            "type": "string",
            "examples": [
              "offline_access",
              "profile"
            ]
          }
        },
        "tenant": {
          "title": "Azure AD Tenant",
          "description": "The Azure AD Tenant to use for authentication.",
          "type": "string",
          "examples": [
            "common",
            "organizations",
            "consumers",
            "8eaef023-2b34-4da1-9baa-8bc8c9d6a490",
            "contoso.onmicrosoft.com"
          ]
        },
        "requested_claims": {
          "$ref": "#/definitions/OIDCClaims"
        }
      },
      "additionalProperties": false,
      "required": [
        "id",
        "provider",
        "client_id",
        "client_secret",
        "mapper_url"
      ],
      "if": {
        "properties": {
          "provider": {
            "const": "microsoft"
          }
        },
        "required": [
          "provider"
        ]
      },
      "then": {
        "required": [
          "tenant"
        ]
      },
      "else": {
        "not": {
          "properties": {
            "tenant": {}
          },
          "required": [
            "tenant"
          ]
        }
      }
    },
    "selfServiceHooks": {
      "type": "array",
      "items": {
        "anyOf": [
          {
            "$ref": "#/definitions/selfServiceWebHook"
          }
        ]
      },
      "uniqueItems": true,
      "additionalItems": false
    },
    "selfServiceAfterSettingsMethod": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "default_browser_return_url": {
          "$ref": "#/definitions/defaultReturnTo"
        },
        "hooks": {
          "type": "array",
          "items": {
            "anyOf": [
              {
                "$ref": "#/definitions/selfServiceWebHook"
              }
            ]
          },
          "uniqueItems": true,
          "additionalItems": false
        }
      }
    },
    "selfServiceAfterPasswordLoginMethod": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "default_browser_return_url": {
          "$ref": "#/definitions/defaultReturnTo"
        },
        "hooks": {
          "type": "array",
          "items": {
            "anyOf": [
              {
                "$ref": "#/definitions/selfServiceSessionRevokerHook"
              },
              {
                "$ref": "#/definitions/selfServiceRequireVerifiedAddressHook"
              },
              {
                "$ref": "#/definitions/selfServiceWebHook"
              }
            ]
          },
          "uniqueItems": true,
          "additionalItems": false
        }
      }
    },
    "selfServiceAfterOIDCLoginMethod": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "default_browser_return_url": {
          "$ref": "#/definitions/defaultReturnTo"
        },
        "hooks": {
          "type": "array",
          "items": {
            "anyOf": [
              {
                "$ref": "#/definitions/selfServiceSessionRevokerHook"
              },
              {
                "$ref": "#/definitions/selfServiceWebHook"
              }
            ]
          },
          "uniqueItems": true,
          "additionalItems": false
        }
      }
    },
    "selfServiceAfterRegistrationMethod": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "default_browser_return_url": {
          "$ref": "#/definitions/defaultReturnTo"
        },
        "hooks": {
          "type": "array",
          "items": {
            "anyOf": [
              {
                "$ref": "#/definitions/selfServiceSessionIssuerHook"
              },
              {
                "$ref": "#/definitions/selfServiceWebHook"
              }
            ]
          },
          "uniqueItems": true,
          "additionalItems": false
        }
      }
    },
    "selfServiceAfterSettings": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "default_browser_return_url": {
          "$ref": "#/definitions/defaultReturnTo"
        },
        "password": {
          "$ref": "#/definitions/selfServiceAfterSettingsMethod"
        },
        "profile": {
          "$ref": "#/definitions/selfServiceAfterSettingsMethod"
        },
        "hooks": {
          "$ref": "#/definitions/selfServiceHooks"
        }
      }
    },
    "selfServiceBeforeLogin": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "hooks": {
          "$ref": "#/definitions/selfServiceHooks"
        }
      }
    },
    "selfServiceAfterLogin": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "default_browser_return_url": {
          "$ref": "#/definitions/defaultReturnTo"
        },
        "password": {
          "$ref": "#/definitions/selfServiceAfterPasswordLoginMethod"
        },
        "oidc": {
          "$ref": "#/definitions/selfServiceAfterOIDCLoginMethod"
        },
        "hooks": {
          "$ref": "#/definitions/selfServiceHooks"
        }
      }
    },
    "selfServiceBeforeRegistration": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "hooks": {
          "$ref": "#/definitions/selfServiceHooks"
        }
      }
    },
    "selfServiceAfterRegistration": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "default_browser_return_url": {
          "$ref": "#/definitions/defaultReturnTo"
        },
        "password": {
          "$ref": "#/definitions/selfServiceAfterRegistrationMethod"
        },
        "oidc": {
          "$ref": "#/definitions/selfServiceAfterRegistrationMethod"
        },
        "hooks": {
          "$ref": "#/definitions/selfServiceHooks"
        }
      }
    },
    "selfServiceAfterVerification": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "default_browser_return_url": {
          "$ref": "#/definitions/defaultReturnTo"
        },
        "hooks": {
          "$ref": "#/definitions/selfServiceHooks"
        }
      }
    },
    "selfServiceAfterRecovery": {
      "type": "object",
      "properties": {
        "default_browser_return_url": {
          "$ref": "#/definitions/defaultReturnTo"
        },
        "hooks": {
          "$ref": "#/definitions/selfServiceHooks"
        }
      },
      "additionalProperties": false
    },
    "tlsxSource": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "path": {
          "title": "Path to PEM-encoded Fle",
          "type": "string",
          "examples": [
            "path/to/file.pem"
          ]
        },
        "base64": {
          "title": "Base64 Encoded Inline",
          "description": "The base64 string of the PEM-encoded file content. Can be generated using for example `base64 -i path/to/file.pem`.",
          "type": "string",
          "examples": [
            "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tXG5NSUlEWlRDQ0FrMmdBd0lCQWdJRVY1eE90REFOQmdr..."
          ]
        }
      }
    },
    "tlsx": {
      "title": "HTTPS",
      "description": "Configure HTTP over TLS (HTTPS). All options can also be set using environment variables by replacing dots (`.`) with underscores (`_`) and uppercasing the key. For example, `some.prefix.tls.key.path` becomes `export SOME_PREFIX_TLS_KEY_PATH`. If all keys are left undefined, TLS will be disabled.",
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "key": {
          "title": "Private Key (PEM)",
          "allOf": [
            {
              "$ref": "#/definitions/tlsxSource"
            }
          ]
        },
        "cert": {
          "title": "TLS Certificate (PEM)",
          "allOf": [
            {
              "$ref": "#/definitions/tlsxSource"
            }
          ]
        }
      }
    }
  },
  "properties": {
    "selfservice": {
      "type": "object",
      "additionalProperties": false,
      "required": [
        "default_browser_return_url"
      ],
      "properties": {
        "default_browser_return_url": {
          "$ref": "#/definitions/defaultReturnTo"
        },
        "whitelisted_return_urls": {
          "title": "Whitelisted Return To URLs",
          "description": "List of URLs that are allowed to be redirected to. A redirection request is made by appending `?return_to=...` to Login, Registration, and other self-service flows.",
          "type": "array",
          "items": {
            "type": "string",
            "format": "uri-reference"
          },
          "examples": [
            [
              "https://app.my-app.com/dashboard",
              "/dashboard",
              "https://www.my-app.com/"
            ]
          ],
          "uniqueItems": true
        },
        "flows": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "settings": {
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "ui_url": {
                  "title": "URL of the Settings page.",
                  "description": "URL where the Settings UI is hosted. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).",
                  "type": "string",
                  "format": "uri-reference",
                  "examples": [
                    "https://my-app.com/user/settings"
                  ],
                  "default": "https://www.ory.sh/kratos/docs/fallback/settings"
                },
                "lifespan": {
                  "type": "string",
                  "pattern": "^[0-9]+(ns|us|ms|s|m|h)$",
                  "default": "1h",
                  "examples": [
                    "1h",
                    "1m",
                    "1s"
                  ]
                },
                "privileged_session_max_age": {
                  "type": "string",
                  "pattern": "^[0-9]+(ns|us|ms|s|m|h)$",
                  "default": "1h",
                  "examples": [
                    "1h",
                    "1m",
                    "1s"
                  ]
                },
                "after": {
                  "$ref": "#/definitions/selfServiceAfterSettings"
                }
              }
            },
            "logout": {
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "after": {
                  "type": "object",
                  "additionalProperties": false,
                  "properties": {
                    "default_browser_return_url": {
                      "$ref": "#/definitions/defaultReturnTo"
                    }
                  }
                }
              }
            },
            "registration": {
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "ui_url": {
                  "title": "Registration UI URL",
                  "description": "URL where the Registration UI is hosted. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).",
                  "type": "string",
                  "format": "uri-reference",
                  "examples": [
                    "https://my-app.com/signup"
                  ],
                  "default": "https://www.ory.sh/kratos/docs/fallback/registration"
                },
                "lifespan": {
                  "type": "string",
                  "pattern": "^[0-9]+(ns|us|ms|s|m|h)$",
                  "default": "1h",
                  "examples": [
                    "1h",
                    "1m",
                    "1s"
                  ]
                },
                "before": {
                  "$ref": "#/definitions/selfServiceBeforeRegistration"
                },
                "after": {
                  "$ref": "#/definitions/selfServiceAfterRegistration"
                }
              }
            },
            "login": {
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "ui_url": {
                  "title": "Login UI URL",
                  "description": "URL where the Login UI is hosted. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).",
                  "type": "string",
                  "format": "uri-reference",
                  "examples": [
                    "https://my-app.com/login"
                  ],
                  "default": "https://www.ory.sh/kratos/docs/fallback/login"
                },
                "lifespan": {
                  "type": "string",
                  "pattern": "^[0-9]+(ns|us|ms|s|m|h)$",
                  "default": "1h",
                  "examples": [
                    "1h",
                    "1m",
                    "1s"
                  ]
                },
                "before": {
                  "$ref": "#/definitions/selfServiceBeforeLogin"
                },
                "after": {
                  "$ref": "#/definitions/selfServiceAfterLogin"
                }
              }
            },
            "verification": {
              "title": "Email and Phone Verification and Account Activation Configuration",
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "enabled": {
                  "type": "boolean",
                  "title": "Enable Email/Phone Verification",
                  "description": "If set to true will enable [Email and Phone Verification and Account Activation](https://www.ory.sh/kratos/docs/self-service/flows/verify-email-account-activation/).",
                  "default": false
                },
                "ui_url": {
                  "title": "Verify UI URL",
                  "description": "URL where the Ory Verify UI is hosted. This is the page where users activate and / or verify their email or telephone number. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).",
                  "type": "string",
                  "format": "uri-reference",
                  "examples": [
                    "https://my-app.com/verify"
                  ],
                  "default": "https://www.ory.sh/kratos/docs/fallback/verification"
                },
                "after": {
                  "$ref": "#/definitions/selfServiceAfterVerification"
                },
                "lifespan": {
                  "title": "Self-Service Verification Request Lifespan",
                  "description": "Sets how long the verification request (for the UI interaction) is valid.",
                  "type": "string",
                  "pattern": "^[0-9]+(ns|us|ms|s|m|h)$",
                  "default": "1h",
                  "examples": [
                    "1h",
                    "1m",
                    "1s"
                  ]
                }
              }
            },
            "recovery": {
              "title": "Account Recovery Configuration",
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "enabled": {
                  "type": "boolean",
                  "title": "Enable Account Recovery",
                  "description": "If set to true will enable [Account Recovery](https://www.ory.sh/kratos/docs/self-service/flows/password-reset-account-recovery/).",
                  "default": false
                },
                "ui_url": {
                  "title": "Recovery UI URL",
                  "description": "URL where the Ory Recovery UI is hosted. This is the page where users request and complete account recovery. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).",
                  "type": "string",
                  "format": "uri-reference",
                  "examples": [
                    "https://my-app.com/verify"
                  ],
                  "default": "https://www.ory.sh/kratos/docs/fallback/recovery"
                },
                "after": {
                  "$ref": "#/definitions/selfServiceAfterRecovery"
                },
                "lifespan": {
                  "title": "Self-Service Recovery Request Lifespan",
                  "description": "Sets how long the recovery request is valid. If expired, the user has to redo the flow.",
                  "type": "string",
                  "pattern": "^[0-9]+(ns|us|ms|s|m|h)$",
                  "default": "1h",
                  "examples": [
                    "1h",
                    "1m",
                    "1s"
                  ]
                }
              }
            },
            "error": {
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "ui_url": {
                  "title": "Ory Kratos Error UI URL",
                  "description": "URL where the Ory Kratos Error UI is hosted. Check the [reference implementation](https://github.com/ory/kratos-selfservice-ui-node).",
                  "type": "string",
                  "format": "uri-reference",
                  "examples": [
                    "https://my-app.com/kratos-error"
                  ],
                  "default": "https://www.ory.sh/kratos/docs/fallback/error"
                }
              }
            }
          }
        },
        "methods": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "profile": {
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "enabled": {
                  "type": "boolean",
                  "title": "Enables Profile Management Method",
                  "default": true
                }
              }
            },
            "link": {
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "enabled": {
                  "type": "boolean",
                  "title": "Enables Link Method",
                  "default": true
                },
                "config": {
                  "type": "object",
                  "title": "Link Configuration",
                  "description": "Additional configuration for the link strategy.",
                  "properties": {
                    "lifespan": {
                      "title": "How long a link is valid for",
                      "type": "string",
                      "pattern": "^[0-9]+(ns|us|ms|s|m|h)$",
                      "default": "1h",
                      "examples": [
                        "1h",
                        "1m",
                        "1s"
                      ]
                    }
                  }
                }
              }
            },
            "password": {
              "type": "object",
              "additionalProperties": false,
              "properties": {
                "enabled": {
                  "type": "boolean",
                  "title": "Enables Username/Email and Password Method",
                  "default": true
                },
                "config": {
                  "type": "object",
                  "title": "Password Configuration",
                  "description": "Define how passwords are validated.",
                  "properties": {
                    "haveibeenpwned_host": {
                      "title": "Custom haveibeenpwned host",
                      "description": "Allows changing the default HIBP host to a self hosted version.",
                      "type": "string",
                      "default": "api.pwnedpasswords.com"
                    },
                    "haveibeenpwned_enabled": {
                      "title": "Enable the HaveIBeenPwned API",
                      "description": "If set to false the password validation does not utilize the Have I Been Pwnd API.",
                      "type": "boolean",
                      "default": true
                    },
                    "max_breaches": {
                      "title": "Allow Password Breaches",
                      "description": "Defines how often a password may have been breached before it is rejected.",
                      "type": "integer",
                      "minimum": 0,
                      "maximum": 100,
                      "default": 0
                    },
                    "ignore_network_errors": {
                      "title": "Ignore Lookup Network Errors",
                      "description": "If set to false the password validation fails when the network or the Have I Been Pwnd API is down.",
                      "type": "boolean",
                      "default": true
                    }
                  },
                  "additionalProperties": false
                }
              }
            },
            "oidc": {
              "type": "object",
              "title": "Specify OpenID Connect and OAuth2 Configuration",
              "showEnvVarBlockForObject": true,
              "additionalProperties": false,
              "properties": {
                "enabled": {
                  "type": "boolean",
                  "title": "Enables OpenID Connect Method",
                  "default": false
                },
                "config": {
                  "type": "object",
                  "additionalProperties": false,
                  "properties": {
                    "providers": {
                      "title": "OpenID Connect and OAuth2 Providers",
                      "description": "A list and configuration of OAuth2 and OpenID Connect providers Ory Kratos should integrate with.",
                      "type": "array",
                      "items": {
                        "$ref": "#/definitions/selfServiceOIDCProvider"
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    },
    "dsn": {
      "type": "string",
      "title": "Data Source Name",
      "description": "DSN is used to specify the database credentials as a connection URI.",
      "examples": [
        "postgres://user: password@postgresd:5432/database?sslmode=disable&max_conns=20&max_idle_conns=4",
        "mysql://user:secret@tcp(mysqld:3306)/database?max_conns=20&max_idle_conns=4",
        "cockroach://user@cockroachdb:26257/database?sslmode=disable&max_conns=20&max_idle_conns=4",
        "sqlite:///var/lib/sqlite/db.sqlite?_fk=true&mode=rwc"
      ]
    },
    "courier": {
      "type": "object",
      "title": "Courier configuration",
      "description": "The courier is responsible for sending and delivering messages over email, sms, and other means.",
      "properties": {
        "template_override_path": {
          "type": "string",
          "title": "Override message templates",
          "description": "You can override certain or all message templates by pointing this key to the path where the templates are located.",
          "examples": [
            "/conf/courier-templates"
          ]
        },
        "smtp": {
          "title": "SMTP Configuration",
          "description": "Configures outgoing emails using the SMTP protocol.",
          "type": "object",
          "properties": {
            "connection_uri": {
              "title": "SMTP connection string",
              "description": "This URI will be used to connect to the SMTP server. Use the query parameter to allow (`?skip_ssl_verify=true`) or disallow (`?skip_ssl_verify=false`) self-signed TLS certificates. Please keep in mind that any host other than localhost / 127.0.0.1 must use smtp over TLS (smtps) or the connection will not be possible.",
              "examples": [
                "smtps://foo:bar@my-mailserver:1234/?skip_ssl_verify=false"
              ],
              "type": "string",
              "pattern": "^smtps?:\\/\\/.*"
            },
            "from_address": {
              "title": "SMTP Sender Address",
              "description": "The recipient of an email will see this as the sender address.",
              "type": "string",
              "format": "email",
              "default": "no-reply@ory.kratos.sh"
            },
            "from_name": {
              "title": "SMTP Sender Name",
              "description": "The recipient of an email will see this as the sender name.",
              "type": "string",
              "examples": [
                "Bob"
              ]
            },
            "headers": {
              "title": "SMTP Headers",
              "description": "These headers will be passed in the SMTP conversation -- e.g. when using the AWS SES SMTP interface for cross-account sending.",
              "type": "object",
              "examples": [
                {
                  "X-SES-SOURCE-ARN": "arn:aws:ses:us-west-2:123456789012:identity/example.com",
                  "X-SES-FROM-ARN": "arn:aws:ses:us-west-2:123456789012:identity/example.com",
                  "X-SES-RETURN-PATH-ARN": "arn:aws:ses:us-west-2:123456789012:identity/example.com"
                }
              ]
            }
          },
          "required": [
            "connection_uri"
          ],
          "additionalProperties": false
        }
      },
      "required": [
        "smtp"
      ],
      "additionalProperties": false
    },
    "serve": {
      "type": "object",
      "properties": {
        "admin": {
          "type": "object",
          "properties": {
            "base_url": {
              "title": "Admin Base URL",
              "description": "The URL where the admin endpoint is exposed at.",
              "type": "string",
              "format": "uri",
              "examples": [
                "https://kratos.private-network:4434/"
              ]
            },
            "host": {
              "title": "Admin Host",
              "description": "The host (interface) kratos' admin endpoint listens on.",
              "type": "string",
              "default": "0.0.0.0"
            },
            "port": {
              "title": "Admin Port",
              "description": "The port kratos' admin endpoint listens on.",
              "type": "integer",
              "minimum": 1,
              "maximum": 65535,
              "examples": [
                4434
              ],
              "default": 4434
            },
            "socket": {
              "$ref": "#/definitions/socket"
            },
            "tls": {
              "$ref": "#/definitions/tlsx"
            }
          },
          "additionalProperties": false
        },
        "public": {
          "type": "object",
          "properties": {
            "cors": {
              "type": "object",
              "additionalProperties": false,
              "description": "Configures Cross Origin Resource Sharing for public endpoints.",
              "properties": {
                "enabled": {
                  "type": "boolean",
                  "description": "Sets whether CORS is enabled.",
                  "default": false
                },
                "allowed_origins": {
                  "type": "array",
                  "description": "A list of origins a cross-domain request can be executed from. If the special * value is present in the list, all origins will be allowed. An origin may contain a wildcard (*) to replace 0 or more characters (i.e.: http://*.domain.com). Only one wildcard can be used per origin.",
                  "items": {
                    "type": "string",
                    "minLength": 1,
                    "not": {
                      "type": "string",
                      "description": "does match all strings that contain two or more (*)",
                      "pattern": ".*\\*.*\\*.*"
                    },
                    "anyOf": [
                      {
                        "format": "uri"
                      },
                      {
                        "const": "*"
                      }
                    ]
                  },
                  "uniqueItems": true,
                  "default": [
                    "*"
                  ],
                  "examples": [
                    [
                      "https://example.com",
                      "https://*.example.com",
                      "https://*.foo.example.com"
                    ]
                  ]
                },
                "allowed_methods": {
                  "type": "array",
                  "description": "A list of HTTP methods the user agent is allowed to use with cross-domain requests.",
                  "default": [
                    "POST",
                    "GET",
                    "PUT",
                    "PATCH",
                    "DELETE"
                  ],
                  "items": {
                    "type": "string",
                    "enum": [
                      "POST",
                      "GET",
                      "PUT",
                      "PATCH",
                      "DELETE",
                      "CONNECT",
                      "HEAD",
                      "OPTIONS",
                      "TRACE"
                    ]
                  }
                },
                "allowed_headers": {
                  "type": "array",
                  "description": "A list of non simple headers the client is allowed to use with cross-domain requests.",
                  "default": [
                    "Authorization",
                    "Content-Type",
                    "X-Session-Token"
                  ],
                  "items": {
                    "type": "string"
                  }
                },
                "exposed_headers": {
                  "type": "array",
                  "description": "Sets which headers are safe to expose to the API of a CORS API specification.",
                  "default": [
                    "Content-Type"
                  ],
                  "items": {
                    "type": "string"
                  }
                },
                "allow_credentials": {
                  "type": "boolean",
                  "description": "Sets whether the request can include user credentials like cookies, HTTP authentication or client side SSL certificates.",
                  "default": true
                },
                "options_passthrough": {
                  "type": "boolean",
                  "description": "TODO",
                  "default": false
                },
                "max_age": {
                  "type": "integer",
                  "description": "Sets how long (in seconds) the results of a preflight request can be cached. If set to 0, every request is preceded by a preflight request.",
                  "default": 0,
                  "minimum": 0
                },
                "debug": {
                  "type": "boolean",
                  "description": "Adds additional log output to debug server side CORS issues.",
                  "default": false
                }
              }
            },
            "base_url": {
              "$ref": "#/definitions/baseUrl"
            },
            "domain_aliases": {
              "title": "Domain Aliases",
              "description": "Adds an alias domain. If a request with the hostname (FQDN) matching the hostname in the alias is found, that URL is used as the base URL.",
              "type": "array",
              "items": [
                {
                  "additionalProperties": false,
                  "type": "object",
                  "required": [
                    "match_domain",
                    "base_path",
                    "scheme"
                  ],
                  "properties": {
                    "match_domain": {
                      "minLength": 1,
                      "title": "Matching Domain",
                      "description": "Sets the matching domain. If the domain matches with this entry, the accompanying base_url will be used.",
                      "type": "string",
                      "examples": [
                        "localhost",
                        "my-domain.com"
                      ]
                    },
                    "scheme": {
                      "title": "Scheme",
                      "description": "Sets the scheme, for example https or http.",
                      "type": "string",
                      "enum": [
                        "http",
                        "https"
                      ]
                    },
                    "base_path": {
                      "minLength": 1,
                      "title": "Base Path",
                      "description": "Sets the base path for the matched domain.",
                      "type": "string",
                      "default": "/",
                      "pattern": "^/.*$",
                      "examples": [
                        "/",
                        "/.ory/kratos"
                      ]
                    }
                  }
                }
              ]
            },
            "host": {
              "title": "Public Host",
              "description": "The host (interface) kratos' public endpoint listens on.",
              "type": "string",
              "default": "0.0.0.0"
            },
            "port": {
              "title": "Public Port",
              "description": "The port kratos' public endpoint listens on.",
              "type": "integer",
              "minimum": 1,
              "maximum": 65535,
              "examples": [
                4433
              ],
              "default": 4433
            },
            "socket": {
              "$ref": "#/definitions/socket"
            },
            "tls": {
              "$ref": "#/definitions/tlsx"
            }
          },
          "additionalProperties": false
        }
      },
      "additionalProperties": false
    },
    "tracing": {
      "type": "object",
      "additionalProperties": false,
      "description": "Ory Kratos supports distributed tracing.",
      "properties": {
        "provider": {
          "type": "string",
          "description": "Set this to the tracing backend you wish to use. Supports Jaeger, Zipkin, DataDog, elastic-apm and instana. If omitted or empty, tracing will be disabled. Use environment variables to configure DataDog (see https://docs.datadoghq.com/tracing/setup/go/#configuration).",
          "enum": [
            "jaeger",
            "zipkin",
            "datadog",
            "elastic-apm",
            "instana"
          ],
          "examples": [
            "jaeger"
          ]
        },
        "service_name": {
          "type": "string",
          "description": "Specifies the service name to use on the tracer.",
          "examples": [
            "Ory Kratos"
          ]
        },
        "providers": {
          "type": "object",
          "additionalProperties": false,
          "properties": {
            "jaeger": {
              "type": "object",
              "additionalProperties": false,
              "description": "Configures the jaeger tracing backend.",
              "properties": {
                "local_agent_address": {
                  "type": "string",
                  "description": "The address of the jaeger-agent where spans should be sent to.",
                  "oneOf": [
                    {
                      "pattern": "^\\[(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))]:([0-9]*)$"
                    },
                    {
                      "pattern": "^([0-9]{1,3}\\.){3}[0-9]{1,3}:([0-9]*)$"
                    },
                    {
                      "format": "uri"
                    }
                  ],
                  "examples": [
                    "127.0.0.1:6831"
                  ]
                },
                "propagation": {
                  "type": "string",
                  "description": "The tracing header format",
                  "examples": [
                    "jaeger"
                  ]
                },
                "sampling": {
                  "type": "object",
                  "propertyNames": {
                    "enum": [
                      "type",
                      "value",
                      "server_url"
                    ]
                  },
                  "allOf": [
                    {
                      "oneOf": [
                        {
                          "properties": {
                            "type": {
                              "description": "The type of the sampler you want to use.",
                              "const": "const"
                            },
                            "value": {
                              "type": "integer",
                              "description": "The value passed to the sampler type that has been configured.",
                              "minimum": 0,
                              "maximum": 1
                            }
                          }
                        },
                        {
                          "properties": {
                            "type": {
                              "description": "The type of the sampler you want to use.",
                              "const": "rateLimiting"
                            },
                            "value": {
                              "type": "integer",
                              "description": "The value passed to the sampler type that has been configured.",
                              "minimum": 0
                            }
                          }
                        },
                        {
                          "properties": {
                            "type": {
                              "description": "The type of the sampler you want to use.",
                              "const": "probabilistic"
                            },
                            "value": {
                              "type": "number",
                              "description": "The value passed to the sampler type that has been configured.",
                              "minimum": 0,
                              "maximum": 1
                            }
                          }
                        }
                      ]
                    },
                    {
                      "properties": {
                        "server_url": {
                          "type": "string",
                          "description": "The address of jaeger-agent's HTTP sampling server",
                          "format": "uri"
                        }
                      }
                    }
                  ],
                  "examples": [
                    {
                      "type": "const",
                      "value": 1,
                      "server_url": "http://localhost:5778/sampling"
                    }
                  ]
                }
              }
            },
            "zipkin": {
              "type": "object",
              "additionalProperties": false,
              "description": "Configures the zipkin tracing backend.",
              "properties": {
                "server_url": {
                  "type": "string",
                  "description": "The address of Zipkin server where spans should be sent to.",
                  "format": "uri"
                }
              },
              "examples": [
                {
                  "server_url": "http://localhost:9411/api/v2/spans"
                }
              ]
            }
          }
        }
      }
    },
    "log": {
      "title": "Log",
      "description": "Configure logging using the following options. Logging will always be sent to stdout and stderr.",
      "type": "object",
      "properties": {
        "level": {
          "description": "Debug enables stack traces on errors. Can also be set using environment variable LOG_LEVEL.",
          "type": "string",
          "default": "info",
          "enum": [
            "trace",
            "debug",
            "info",
            "warning",
            "error",
            "fatal",
            "panic"
          ]
        },
        "leak_sensitive_values": {
          "type": "boolean",
          "title": "Leak Sensitive Log Values",
          "description": "If set will leak sensitive values (e.g. emails) in the logs."
        },
        "format": {
          "description": "The log format can either be text or JSON.",
          "type": "string",
          "enum": [
            "json",
            "text"
          ]
        }
      },
      "additionalProperties": false
    },
    "identity": {
      "type": "object",
      "properties": {
        "default_schema_url": {
          "title": "JSON Schema URL for default identity traits",
          "description": "URL for JSON Schema which describes a default identity's traits. Can be a file path, a https URL, or a base64 encoded string. Will have ID: \"default\"",
          "type": "string",
          "format": "uri",
          "examples": [
            "file://path/to/identity.traits.schema.json",
            "https://foo.bar.com/path/to/identity.traits.schema.json",
            "base64://ewogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInR5cGUiOiAib2JqZWN0IiwKICAicHJvcGVydGllcyI6IHsKICAgICJiYXIiOiB7CiAgICAgICJ0eXBlIjogInN0cmluZyIKICAgIH0KICB9LAogICJyZXF1aXJlZCI6IFsKICAgICJiYXIiCiAgXQp9"
          ]
        },
        "schemas": {
          "type": "array",
          "title": "Additional JSON Schemas for Identity Traits",
          "examples": [
            [
              {
                "id": "customer",
                "url": "base64://ewogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInR5cGUiOiAib2JqZWN0IiwKICAicHJvcGVydGllcyI6IHsKICAgICJiYXIiOiB7CiAgICAgICJ0eXBlIjogInN0cmluZyIKICAgIH0KICB9LAogICJyZXF1aXJlZCI6IFsKICAgICJiYXIiCiAgXQp9"
              },
              {
                "id": "employee",
                "url": "https://foo.bar.com/path/to/employee.traits.schema.json"
              },
              {
                "id": "employee-v2",
                "url": "file://path/to/employee.v2.traits.schema.json"
              }
            ]
          ],
          "items": {
            "type": "object",
            "properties": {
              "id": {
                "title": "The schema's ID.",
                "type": "string",
                "examples": [
                  "employee"
                ]
              },
              "url": {
                "type": "string",
                "title": "JSON Schema URL for identity traits schema",
                "description": "URL for JSON Schema which describes a identity's traits. Can be a file path, a https URL, or a base64 encoded string.",
                "format": "uri",
                "examples": [
                  "file://path/to/identity.traits.schema.json",
                  "https://foo.bar.com/path/to/identity.traits.schema.json",
                  "base64://ewogICIkc2NoZW1hIjogImh0dHA6Ly9qc29uLXNjaGVtYS5vcmcvZHJhZnQtMDcvc2NoZW1hIyIsCiAgInR5cGUiOiAib2JqZWN0IiwKICAicHJvcGVydGllcyI6IHsKICAgICJiYXIiOiB7CiAgICAgICJ0eXBlIjogInN0cmluZyIKICAgIH0KICB9LAogICJyZXF1aXJlZCI6IFsKICAgICJiYXIiCiAgXQp9"
                ]
              }
            },
            "required": [
              "id",
              "url"
            ],
            "not": {
              "type": "object",
              "properties": {
                "id": {
                  "const": "default"
                }
              },
              "additionalProperties": true
            }
          }
        }
      },
      "required": [
        "default_schema_url"
      ],
      "additionalProperties": false
    },
    "secrets": {
      "type": "object",
      "properties": {
        "default": {
          "type": "array",
          "title": "Default Encryption Signing Secrets",
          "description": "The first secret in the array is used for signing and encrypting things while all other keys are used to verify and decrypt older things that were signed with that old secret.",
          "items": {
            "type": "string",
            "minLength": 16
          },
          "uniqueItems": true
        },
        "cookie": {
          "type": "array",
          "title": "Signing Keys for Cookies",
          "description": "The first secret in the array is used for encrypting cookies while all other keys are used to decrypt older cookies that were signed with that old secret.",
          "items": {
            "type": "string",
            "minLength": 16
          },
          "uniqueItems": true
        }
      },
      "additionalProperties": false
    },
    "hashers": {
      "title": "Hashing Algorithm Configuration",
      "type": "object",
      "properties": {
        "algorithm": {
          "title": "Password hashing algorithm",
          "description": "One of the values: argon2, bcrypt",
          "type": "string",
          "default": "bcrypt",
          "enum": [
            "argon2",
            "bcrypt"
          ]
        },
        "argon2": {
          "title": "Configuration for the Argon2id hasher.",
          "type": "object",
          "properties": {
            "memory": {
              "type": "string",
              "pattern": "^[0-9]+(B|KB|MB|GB|TB|PB|EB)",
              "default": "128MB"
            },
            "iterations": {
              "type": "integer",
              "minimum": 1,
              "default": 1
            },
            "parallelism": {
              "type": "integer",
              "minimum": 1,
              "description": "Number of parallel workers, defaults to 2*runtime.NumCPU()."
            },
            "salt_length": {
              "type": "integer",
              "minimum": 16,
              "default": 16
            },
            "key_length": {
              "type": "integer",
              "minimum": 16,
              "default": 32
            },
            "expected_duration": {
              "description": "The time a hashing operation (~login latency) should take.",
              "type": "string",
              "pattern": "^[0-9]+(ns|us|ms|s|m|h)$",
              "default": "500ms"
            },
            "expected_deviation": {
              "description": "The standard deviation expected for hashing operations. If this value is exceeded you will be warned in the logs to adjust the parameters.",
              "type": "string",
              "pattern": "^[0-9]+(ns|us|ms|s|m|h)$",
              "default": "500ms"
            },
            "dedicated_memory": {
              "description": "The memory dedicated for Kratos. As password hashing is very resource intense, Kratos will monitor the memory consumption and warn about high values.",
              "type": "string",
              "pattern": "^[0-9]+(B|KB|MB|GB|TB|PB|EB)",
              "default": "1GB"
            }
          },
          "additionalProperties": false
        },
        "bcrypt": {
          "title": "Configuration for the Bcrypt hasher. Minimum is 4 when --dev flag is used and 12 otherwise.",
          "type": "object",
          "additionalProperties": false,
          "required": [
            "cost"
          ],
          "properties": {
            "cost": {
              "type": "integer",
              "minimum": 4,
              "maximum": 31,
              "default": 12
            }
          }
        }
      },
      "additionalProperties": false
    },
    "cookies": {
      "type": "object",
      "title": "HTTP Cookie Configuration",
      "description": "Configure the HTTP Cookies. Applies to both CSRF and session cookies.",
      "properties": {
        "domain": {
          "title": "HTTP Cookie Domain",
          "description": "Sets the cookie domain for session and CSRF cookies. Useful when dealing with subdomains. Use with care!",
          "type": "string"
        },
        "path": {
          "title": "HTTP  Cookie Path",
          "description": "Sets the session and CSRF cookie path. Use with care!",
          "type": "string",
          "default": "/"
        },
        "same_site": {
          "title": "HTTP Cookie Same Site Configuration",
          "description": "Sets the session and CSRF cookie SameSite.",
          "type": "string",
          "enum": [
            "Strict",
            "Lax",
            "None"
          ],
          "default": "Lax"
        }
      },
      "additionalProperties": false
    },
    "session": {
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "lifespan": {
          "title": "Session Lifespan",
          "description": "Defines how long a session is active. Once that lifespan has been reached, the user needs to sign in again.",
          "type": "string",
          "pattern": "^[0-9]+(ns|us|ms|s|m|h)$",
          "default": "24h",
          "examples": [
            "1h",
            "1m",
            "1s"
          ]
        },
        "cookie": {
          "type": "object",
          "properties": {
            "domain": {
              "title": "Session Cookie Domain",
              "description": "Sets the session cookie domain. Useful when dealing with subdomains. Use with care! Overrides `cookies.domain`.",
              "type": "string"
            },
            "name": {
              "title": "Session Cookie Name",
              "description": "Sets the session cookie name. Use with care!",
              "type": "string",
              "default": "ory_kratos_session"
            },
            "persistent": {
              "title": "Make Session Cookie Persistent",
              "description": "If set to true will persist the cookie in the end-user's browser using the `max-age` parameter which is set to the `session.lifespan` value. Persistent cookies are not deleted when the browser is closed (e.g. on reboot or alt+f4).",
              "type": "boolean",
              "default": true
            },
            "path": {
              "title": "Session Cookie Path",
              "description": "Sets the session cookie path. Use with care! Overrides `cookies.path`.",
              "type": "string"
            },
            "same_site": {
              "title": "Session Cookie SameSite Configuration",
              "description": "Sets the session cookie SameSite. Overrides `cookies.same_site`.",
              "type": "string",
              "enum": [
                "Strict",
                "Lax",
                "None"
              ]
            }
          },
          "additionalProperties": false
        }
      }
    },
    "version": {
      "title": "The kratos version this config is written for.",
      "description": "SemVer according to https://semver.org/ prefixed with `v` as in our releases.",
      "type": "string",
      "pattern": "^v(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$",
      "examples": [
        "v0.5.0-alpha.1"
      ]
    },
    "dev": {
      "type": "boolean"
    },
    "help": {
      "type": "boolean"
    },
    "sqa-opt-out": {
      "type": "boolean",
      "default": false,
      "description": "This is a CLI flag and environment variable and can not be set using the config file."
    },
    "watch-courier": {
      "type": "boolean",
      "default": false,
      "description": "This is a CLI flag and environment variable and can not be set using the config file."
    },
    "expose-metrics-port": {
      "title": "Metrics port",
      "description": "The port the courier's metrics endpoint listens on (0/disabled by default). This is a CLI flag and environment variable and can not be set using the config file.",
      "type": "integer",
      "minimum": 0,
      "maximum": 65535,
      "examples": [
        4434
      ],
      "default": 0
    },
    "config": {
      "type": "array",
      "items": {
        "type": "string"
      },
      "description": "This is a CLI flag and environment variable and can not be set using the config file."
    }
  },
  "allOf": [
    {
      "if": {
        "properties": {
          "selfservice": {
            "properties": {
              "flows": {
                "oneOf": [
                  {
                    "properties": {
                      "verification": {
                        "properties": {
                          "enabled": {
                            "const": true
                          }
                        },
                        "required": [
                          "enabled"
                        ]
                      }
                    },
                    "required": [
                      "verification"
                    ]
                  },
                  {
                    "properties": {
                      "recovery": {
                        "properties": {
                          "enabled": {
                            "const": true
                          }
                        },
                        "required": [
                          "enabled"
                        ]
                      }
                    },
                    "required": [
                      "recovery"
                    ]
                  }
                ]
              }
            },
            "required": [
              "flows"
            ]
          }
        },
        "required": [
          "selfservice"
        ]
      },
      "then": {
        "required": [
          "courier"
        ]
      }
    }
  ],
  "required": [
    "identity",
    "dsn",
    "selfservice"
  ],
  "additionalProperties": false
}