Configuration settings

SAIF.Web.API is a redistributable NuGet class library, not a deployable host — it consumes configuration but does not supply it. It ships no Web.config and no <appSettings> of its own; the only config file in the project (src/SAIF.Web.API/app.config) contains solely an assembly binding redirect and a <startup> element. Every key below is read from the ambient application's configuration at runtime; no supplying application or its configuration file exists in this repository, so which application (if any) provisions these keys cannot be observed here.* Three unique setting keys are consumed directly: two via IEnvironmentService.GetConfigSetting and one via ConfigurationManager.AppSettings.

Configuration retrieval methods

Method	Class / Interface	Namespace	Usage pattern
GetConfigSetting(string key)	IEnvironmentService	SAIF.Core.Services (external — SAIF.Framework.Core NuGet)	Resolved per-request from the Web API dependency scope (request.GetDependencyScope().GetService(typeof(IEnvironmentService))), then passed into ApiResponseHandler.BuildMessageURL(IEnvironmentService), which reads two plain-text keys. Null-guarded: if the service is not registered, hard-coded defaults are used instead.
ConfigurationManager.AppSettings.AllKeys / ConfigurationManager.AppSettings[key]	System.Configuration.ConfigurationManager	System.Configuration	Direct read of the ambient application's <appSettings> section, bypassing IEnvironmentService; no such application or <appSettings> section exists in this repository.* Key existence is first probed via AllKeys.FirstOrDefault(x => x == key), then the value is read by indexer and parsed with bool.TryParse.

Retrieval methods explicitly not present in this library (verified by absence across all .cs files in src/SAIF.Web.API/): GetSecureConfigSetting, DbConnectionManager/GetOracleConnectionString/GetSqlConnectionString/EnvironmentConfigKeys, ApplicationSettingsBase/Settings.Default, <connectionStrings>, custom <configSections>, appsettings.json/IConfiguration/IOptions<T> (this is .NET Framework 4.6.2).

Environment API settings

Settings retrieved via IEnvironmentService (centralized environment configuration service). Both keys are read on every response that passes through ApiResponseHandler — there is no caching.

Setting key	Method	Data type	Purpose	Consuming class	Source
splunksearch	GetConfigSetting	string (URL)	Base Splunk search-endpoint URL used to build the MessageIDUrl deep-link. Falls back to https://splunk/en-US/app/search/search when null/empty (see BR-WEBAPI-006).	ApiResponseHandler.BuildMessageURL	src/SAIF.Web.API/ApiResponseHandler.cs
splunk.error.query	GetConfigSetting	string (Splunk search expression)	Splunk search query fragment (index/sourcetype/time window) appended to the Splunk URL. Only substituted with the hard-coded fallback search index=db_mssql sourcetype=Businessonline.error earliest=-1month when splunksearch is also blank — a configured splunksearch with a blank splunk.error.query yields an empty query fragment.*	ApiResponseHandler.BuildMessageURL	src/SAIF.Web.API/ApiResponseHandler.cs

Non-configuration IEnvironmentService members consumed (listed for completeness — hosting-context properties, not config keys): .User.Identity.Name (SaifAuthorizeAttribute.IsAuthorized) and .UserId() (SaifAuthorizeAttribute.HandleUnauthorizedRequest, GetContext).

AppSettings (Web.config)

Settings retrieved via ConfigurationManager.AppSettings. src/SAIF.Web.API/app.config declares no <appSettings> section of its own; the library reads this key from whatever <appSettings> section is present in the ambient application's configuration at runtime — no such application or configuration file exists in this repository.*

Setting key	Default value	Purpose	Consuming class	Source
RequireSSLForLocal	Not declared in this repository	Controls whether HTTPS is required for local requests only. If the key is absent, requireSSL is forced to false (local requests skip HTTPS). If present, bool.TryParse(value, out requireSSL) is applied directly against the field; because bool.TryParse always assigns its out parameter, a value that fails to parse also results in requireSSL being set to false (local requests skip HTTPS), the same as when the key is absent. Non-local requests never consult this key and always require HTTPS.	RequireSSLAttribute.RequiresSSL	src/SAIF.Web.API/RequireSSLAttribute.cs

Database connection configuration

Not applicable — no database configuration detected. SAIF.Web.API performs no database access and declares no connection configuration; no DbConnectionManager, GetOracleConnectionString, GetSqlConnectionString, <connectionStrings>, or ORM references exist anywhere in the library. The hard-coded Splunk fallback query string contains the literal token index=db_mssql, which is a Splunk index name inside a search expression, not a database connection.

Secure settings

Not applicable — no secure/encrypted configuration detected. Verified by absence: no GetSecureConfigSetting, protected-configuration provider, or credential retrieval of any kind. Both configuration keys consumed via IEnvironmentService are plain-text.

Transitive configuration (from dependencies)

SAIF.Web.API declares no <ProjectReference>s, so no same-repo project's configuration is transitive to it. The only SAIF-internal package dependency is SAIF.Framework.Core. Its runtime configuration requirements could not be determined from this repository or the Legends CLI index: the only indexed library matching the name SAIF.Framework.Core/saif.framework.core is a different library (the IT.BOF.Framework BOF-suite package of the same name), not the Framework4 SAIF.Framework.Core 2.0.x package this library depends on — every Legends CLI query scoped to the actual package returned no matching content.**

Grpc.Core and Microsoft.AspNet.WebApi.WebHost are third-party packages with no SAIF-specific configuration keys associated with them.

Configuration dependencies

Dependency	Type	Required at	Impact if missing
IEnvironmentService registration	Service (hosting app's IDependencyResolver)	Request time	ApiResponseHandler.BuildMessageURL degrades gracefully to hard-coded Splunk defaults; SaifAuthorizeAttribute.IsAuthorized throws MissingDependencyException("IEnvironmentService").
ISecurityApiClient registration	Service (hosting app's IDependencyResolver)	Request time	SaifAuthorizeAttribute.IsAuthorized throws MissingDependencyException("ISecurityApiClient") — fails closed rather than allowing or silently denying.
splunksearch / splunk.error.query	Environment API setting	Request time	Hard-coded Splunk URL/query defaults are used instead (graceful).
RequireSSLForLocal	AppSettings key	Request time (local requests only)	Absent key: local requests bypass HTTPS enforcement. Deployed (non-local) requests are unaffected.

Related documentation

• Index
• Overview
• Architecture
• Dependencies
• Operations and processes
• Business rules
• Security and authorization
• API reference

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

• src/SAIF.Web.API/ApiResponseHandler.cs
• src/SAIF.Web.API/RequireSSLAttribute.cs
• src/SAIF.Web.API/SaifAuthorizeAttribute.cs
• src/SAIF.Web.API/app.config
• src/SAIF.Web.API/SAIF.Web.API.csproj
• src/SAIF.Web.API/NuGet.config
• src/nuget.config