Configuration Settings
Keeper EPM Configuration Settings Reference
This document is the complete configuration-settings reference for the Keeper Endpoint Privilege Manager (EPM) agent. It lists every setting the agent reads, organized by functional area.
Each entry shows the setting's key, default value, a description of what it controls, and any notes an administrator should know before touching it.
Total configuration settings
358
Contents
Service, Network & Messaging (37)
Security & Trust (19)
MFA & Execution Grants (6)
Session & Watchdog (12)
Logging & Monitoring (11)
Logger (11)
Boot & Performance (6)
Policy Engine (23)
Cloud & API (10)
Client UI (18)
Redirect (5)
Windows Injector (3)
Agentic / Intel (15)
Path Protection (6)
Linux Agent (14)
macOS System Extension (15)
Inventory (17)
Path Variables (1)
Deploy / MDM (3)
Job Orchestration, Automation & PAM (16)
Plugin Bootstrap & Shared Wiring (13)
Environment Variables & Platform Detection (6)
Duplicate Configuration Copies (7)
Localization (2)
Runtime & Encrypted State (6)
Research / Non-Production Tooling (3)
Service, Network & Messaging
MqttBrokerSettings:IpAddress
127.0.0.1
Embedded MQTT broker bind address (must stay localhost)
Must remain loopback for isolation; surfacing it lets admins audit/bind policy and reject non-localhost drift.
MqttBrokerSettings:Port
8675
Embedded MQTT broker port
Broker port collisions break all plugins; admins can reassign 8675 without reinstalling the agent.
Settings:KestrelHttpPort
6988
Local HTTP management API port
Port conflicts and local tooling require fleet-wide control of this endpoint.
Settings:KestrelHttpsPort
6989
Local HTTPS management API port
Plugins and jobs call the HTTPS API; relocate it if 6989 is taken or firewalled.
Settings:ServiceName
KeeperPrivilegeManager
Windows service / process display name
Some enterprises require a branded or environment-specific service name.
JobStore:StorePath
"" (data dir)
Override path for persisted job store
Admins can relocate persisted job state for large fleets/storage policies.
Settings:PluginPath
Plugins
Plugin manifest directory
Supports non-default plugin layouts (side-by-side builds, golden images).
Settings:RepositoryPath
KeeperStorage
Encrypted local repository root
Relocate encrypted state to custom data volumes or separate from Program Files.
Settings:ScriptsPath
Jobs/Scripts
Job script assets directory
Job scripts are referenced as {ScriptsPath}; relocate for least-privilege ACLs.
Settings:SharedRepositoryPath
SharedRepository
Shared cross-plugin storage root
Cross-plugin shared state may need a tenant-chosen volume for backup/capacity planning.
MqttJobPublishSettings:PublishMqtt:MaxPayloadSizeBytes
10240
Soft cap on publish-mqtt job-command payload size
Raise if legitimate payloads exceed the 10KB default.
MqttJobPublishSettings:PublishMqtt:MaxJsonDepth
10
Max JSON nesting depth accepted in publish-mqtt payloads
Bounds JSON-parsing cost/attack surface for job-published messages.
MqttJobPublishSettings:PublishMqtt:MaxJsonArraySize
1000
Max array/object element count accepted in publish-mqtt payloads
Same rationale as JSON depth; large-fleet event batching may need to exceed it.
AllowedHosts
*
ASP.NET Core host-header allowlist
⚠️ Warning: Do not edit. This governs which HTTP Host headers the local management API accepts. Changing it without understanding reverse-proxy/header behavior can break the local API entirely.
Messaging:MalformedJsonRepair:EscapeMap
Unicode control escapes
Maps control characters to JSON escapes when repairing malformed MQTT payloads
⚠️ Warning: Do not edit. Internal defensive parser plumbing; incorrect values corrupt event JSON silently.
Messaging:MalformedJsonRepair:UnmappedControlCharacterFormat
\u{X4}
Fallback escape format for unmapped control characters
⚠️ Warning: Do not edit. Developer-facing repair format, not an operational policy.
MqttTopics:publish
product topic list
Host MQTT client publish allowlist
⚠️ Warning: Do not edit. This is the product's pub/sub contract; edits desync plugins from the broker and drop audit/policy traffic.
MqttTopics:subscribe
product topic list
Host MQTT client subscribe allowlist
⚠️ Warning: Do not edit. Ship-with-build wiring, not an estate policy setting.
MqttTopics:AuditTopic
AuditMessage
Logical audit topic name
⚠️ Warning: Do not edit. Renaming breaks every publisher/subscriber that expects AuditMessage.
MqttJobPublishSettings:PublishMqtt:AllowedTopics
product wildcards
Global allowlist of topics jobs may publish to
⚠️ Warning: Do not edit. Security-critical fence for job processes; free-form edits can open broad publish access or break job status reporting.
*.metadata.mqttTopics (per plugin)
plugin-specific
Per-plugin publish/subscribe topic arrays
⚠️ Warning: Do not edit. Editing a plugin's MQTT role graph can silently break elevation, policy, or logging chains.
*.metadata.mqttRole (per plugin)
subscriber/publisher
Declares each plugin's MQTT role
⚠️ Warning: Do not edit. Loader/authorization topology metadata, not a tunable setting.
Subscription.Topic / Qos / CleanSession (per plugin)
per plugin
Primary MQTT subscription block on each plugin's manifest
⚠️ Warning: Do not edit. Changing QoS/CleanSession without coordinated code changes is unsupported and can disconnect the plugin from the broker.
MqttJobPublishSettings:PublishMqtt:MaxPayloadSizeBytesHardLimit
102400
Compile-time hard ceiling on publish-mqtt payload size
⚠️ Note: This is a code-enforced safety ceiling above the tenant-tunable soft cap and cannot be changed via configuration.
MqttJobPublishSettings:ShowToast:MaxPayloadSizeBytes / ShowToast:DefaultSeverity
10240 / Info
Payload cap and default severity for the show-toast job command
⚠️ Warning: Do not edit. Raising the payload cap without coordinated client changes can cause silent message drops.
publishing.topic / .qos / .retain / .frequency, message.payloadformat / .maxsize
various
Default MQTT wiring handed to any plugin lacking its own configuration
⚠️ Warning: Do not edit. Internal protocol defaults, not an independent tenant setting.
Logging:LogLevel:Microsoft
Information
ASP.NET Microsoft.* category log level
⚠️ Note: Framework noise knob; the equivalent Keeper-level logging controls are listed under Logging & Monitoring.
Logging:LogLevel:Microsoft.AspNetCore.Server.Kestrel
Information
Kestrel web-server category log level
⚠️ Note: Rarely useful outside engineering diagnostics of the local HTTPS endpoint.
Logging:LogLevel:Microsoft.Hosting.Lifetime
Information
Hosting lifetime category log level
⚠️ Note: Startup/shutdown framework logging, not an operational setting.
Logging:LogLevel:System
Information
System.* framework category log level
⚠️ Note: Overlaps with the Keeper-specific logging controls listed under Logging & Monitoring.
broker.host / broker.port (injected)
mirrors of broker settings
MQTT host/port injected into every plugin's settings
⚠️ Note: Duplicate mirror of the broker settings above; change the source once, not per plugin.
system.service.https_port / .http_port / .name (injected)
mirrors of service settings
Service identity/port re-projected to every plugin
⚠️ Note: Duplicate mirror of the service settings above.
broker.connectiontimeout / broker.keepalive / system.mqtt.enabled (injected)
10000 / 60 / true
Hardcoded MQTT connection tuning advertised to every plugin
⚠️ Note: Not configurable at all — literal constants in code.
system.transaction.default_timeout_minutes / .max_per_plugin / .cleanup_interval_minutes (injected)
30 / 50 / 60
Transaction tuning values advertised to plugins
⚠️ Note: Confirmed dead/inconsistent in current code; not a functioning tenant knob.
transaction.enabletracking (system-level)
false
Legacy system-wide transaction-tracking flag
⚠️ Note: Hardcoded legacy flag; the feature it referred to was removed.
metadata (per plugin, via Admin API)
plugin's manifest JSON
Read-through mirror of a plugin's canonical manifest
⚠️ Warning: Read-only. Source code explicitly documents this as not customer-tunable — the live manifest file always wins over any stored copy.
security.usetls (injected)
false
Default TLS-usage flag for plugin MQTT/HTTP connections
⚠️ Warning: Do not edit. Flipping this fleet-wide without coordinated certificate/broker configuration will break connections.
Security & Trust
Settings:AllowedNonAdminExecutables
product UI list
Binaries allowed without admin rights in the user context
Controls which Keeper UI helpers may run unelevated.
Settings:AlternativeSignatures
[]
Extra trusted code-signing thumbprints for plugins
Required if partners/internal builds sign plugins with non-Keeper certificates.
Settings:CriticalSystemDirectories
OS critical dirs
Directories protected from elevation/redirect tampering
Blocks grants that target OS-critical trees.
Settings:CriticalSystemFiles
OS critical exes
Files protected from elevation/redirect tampering
Defines OS binaries that elevation/redirect must never rewrite.
Settings:MaintainKeeperAccount
false
Persist the KeeperUserSession account across restarts (Windows hybrid AAD + Intune)
Required for hybrid AAD+Intune endpoints to retain elevation after reboot.
ConfigurationLkg:Enabled
true
Last-known-good reconciliation for policy-written configuration
Enables self-healing after a bad configuration push.
Settings:CertName
""
Certificate subject/name in store
Required whenever CertStore is used in corporate PKI deployments.
Settings:CertPassword
""
TLS certificate password
Secret value — vault/mask in the console; never store as plaintext.
Settings:CertPath
""
TLS certificate file path
Custom TLS for the local API using enterprise PKI paths.
Settings:CertStore
""
Windows certificate store name
For enterprises using Windows certificate stores instead of files.
Plugins:JobService:AgentInactiveJobAllowlist
registration, StartKeeperClient, ...
Jobs allowed to run when the agent UI is inactive
Security-sensitive allowlist; misuse can launch UI jobs headlessly.
KeeperRunAs.metadata.elevationStage
first
Marks the first stage of two-stage elevation
⚠️ Warning: Do not edit. Hard-wired stage identity; changing it does not re-architect elevation, it only breaks diagnostics.
KeeperRunAs.metadata.launches
KeeperRunElevated
Downstream elevated executable name
⚠️ Warning: Do not edit. Wrong target breaks all Windows elevations.
KeeperRunAs.metadata.credentialHandling
ephemeral-accounts
Credential strategy label
⚠️ Note: Descriptive product contract, not a selectable account model.
KeeperRunAs.metadata.features / securityLevel / launchesElevated
product tags
Feature tags for the RunAs stage
⚠️ Note: Documentation metadata for tooling; no runtime effect.
KeeperRunElevated.metadata.elevationProxy
true
Marks the elevation-proxy role
⚠️ Warning: Do not edit. Stage identity for the elevation proxy.
KeeperRunElevated.metadata.requiresEphemeralCredentials
true
Requires ephemeral admin credentials
⚠️ Warning: Do not edit. Product security invariant; disabling is unsupported and weakens the elevation model.
KeeperRunElevated.metadata.apiEndpoints
elevation API paths
Documents the local elevation API routes
⚠️ Note: Reference metadata; routes are compiled into the product.
KeeperRunElevated.metadata.features / securityLevel
product tags
Feature tags for the elevation proxy
⚠️ Note: Non-behavioral metadata.
MFA & Execution Grants
ExecutionGrant:DefaultDurationMinutes
240
Default execution grant lifetime (minutes)
Default JIT grant lifetime for approved elevations.
ExecutionGrant:MaxDurationMinutes
10080
Maximum execution grant lifetime (7 days)
Hard ceiling so policies cannot issue week-plus grants.
MfaGracePeriod:GracePeriodMinutes
5
Skip MFA re-prompt window after a successful challenge
Balances productivity vs. session-hijack risk.
MfaLockout:LockoutDurationMinutes
15
MFA lockout duration after maximum failures
Balances lockout pain vs. attacker retry windows.
MfaLockout:MaxFailedAttempts
5
Failed MFA attempts before lockout
Sets brute-force resistance for MFA controls.
Controls:maxJustificationTextLength
512
Max characters in justification control text
Caps justification payload size; aligns with ticket-field limits.
Session & Watchdog
SessionMonitoring:Enabled
true
Enable user-session polling
Master switch for detecting logons/sessions that start KeeperClient.
SessionMonitoring:ExcludedUsers
SYSTEM, LOCAL SERVICE, ...
Accounts excluded from session handling
Prevents session handling for service accounts.
SessionMonitoring:StartKeeperClientOnLogin
true
Launch KeeperClient when a user logs in
Required for request/approval workflows to be reachable.
SessionMonitoring:StartKeeperClientOnReconnect
true
Relaunch KeeperClient on session reconnect
Needed for RDP/reconnect scenarios.
Watchdog:AutoRemediate
true
Automatically restart unhealthy KEPM components
Chooses self-healing vs. alert-only when unhealthy.
SessionEventDispatcher:StartKeeperClientCoalesceSeconds
12
Debounce rapid session events before starting the client
Prevents duplicate KeeperClient launches from bursty logon events.
SessionMonitoring:PollingIntervalSeconds
5
How often active sessions are scanned
CPU vs. detection-latency knob for dense/VDI hosts.
Watchdog:CheckIntervalSec
10
Watchdog health-check interval
Faster intervals detect outages sooner but add host noise.
Watchdog:StartupDelaySec
90
Grace period after boot before remediation
Avoids false unhealthy restarts during slow boots/AV scans.
Watchdog:UnhealthyRestartThreshold
3
Consecutive failures before restart
Prevents flapping on transient blips.
SessionMonitoring:LinuxDesktopProcesses
gnome-shell, kwin, ...
Linux processes that indicate an interactive desktop
Desktop-session heuristics differ by distro/DE.
SessionMonitoring:MacOSDesktopProcesses
Dock, Finder, WindowServer
macOS processes that indicate an interactive desktop
Customize for atypical macOS environments.
Logging & Monitoring
KeeperSystemLogging:MinimumSystemLogLevel
Information
Floor for OS system-log entries
Filters OS-log volume vs. security-event fidelity.
KeeperSystemLogging:SystemLoggingEnabled
true
Master switch for OS event-log / syslog output
Required by many SIEM/compliance pipelines.
Settings:system.logging.level
Warning
Main service log level shorthand
Primary troubleshooting lever; escalate to Debug fleet-wide without remote access.
PluginMonitoring:Enabled
true
Master switch for plugin process health monitoring
Disables fleet-wide health monitoring when off.
KeeperSystemLogging:EnableInfoFallback
true
Fallback Info-level logging when KeeperLogger is down
Preserves audit breadcrumbs during outages.
KeeperSystemLogging:PluginCheckIntervalMinutes
5
How often Logger plugin health is verified
Lower to detect silent log loss faster.
PluginMonitoring:CheckIntervalMinutes
0.5
Plugin process health-check cadence
Availability vs. CPU tradeoff for crash detection.
KeeperSystemLogging:DebugFilteredMessages
false
Verbose diagnostics for filtered system-log messages
Shows what the system logger dropped; used for SIEM filter tuning.
Logging:LogLevel:Default
Information
ASP.NET framework default log level
Useful when Kestrel/auth middleware issues must be captured.
PluginMonitoring:LogHealthChecks
false
Log every plugin health-check result
Verbose health spam for short-lived diagnosis of restart loops.
KeeperPolicy.metadata.processTreeDebug.logToEventLog
false
Enables very-high-volume process-ancestry debug logging
⚠️ Warning: Debug-only. Floods the Event Log; enable only for a live troubleshooting session under Keeper support guidance, then disable it again.
Logger
KeeperLogger.metadata.logFileName
Log/KeeperLogger.log
Log file path
Redirect logs to approved paths for ACL and collection agents.
KeeperLogger.metadata.logRetentionDays
15
Days to keep rotated logs
Must match legal hold / SIEM ingest SLAs.
KeeperLogger.metadata.logToFile
true
Write aggregated logs to disk
Required for offline forensics on locked-down images.
KeeperLogger.metadata.maxFileSizeMB
100
Log rotation size (MB)
Affects disk usage and log history depth.
KeeperLogger.metadata.loggingHttpEndpoint
""
Remote HTTP log sink URL
Target for remote log forwarding when enabled.
KeeperLogger.metadata.logToHttpEndpoint
false
Forward logs to an HTTP sink
Ship logs to a tenant HTTP collector without a separate forwarder.
KeeperLogger.metadata.mqttRole / mqttTopics
subscriber
Logger MQTT wiring
⚠️ Warning: Do not edit. Topology only — the actual sink settings are listed above.
KeeperLogger.metadata.taskDelay
250
MQTT loop delay (ms)
⚠️ Note: Internal pacing/micro-tuning; changing it fleet-wide risks message backlog with no clear benefit.
KeeperUSession.metadata.mqttTopics / mqttRole
product topics
USession / injector host MQTT map
⚠️ Warning: Do not edit. Windows injector host wiring; the admin-facing controls are allow.dat/exclude.dat under Windows Injector.
KeeperUSession.metadata.logToFile / logFileName / maxFileSizeMB / logRetentionDays / logToHttpEndpoint / loggingHttpEndpoint
logger-like defaults
Legacy logging block on the USession component
⚠️ Warning: Do not edit. Duplicates the Logger settings above; editing both creates split-brain logging. Use the Logger settings instead.
KeeperUSession.metadata.taskDelay
250
USession MQTT loop delay
⚠️ Note: Same micro-tuning concern as the Logger's taskDelay.
Boot & Performance
Settings:BootPhase:Enabled
true
Defer non-critical jobs after boot/logon
Protects login-time UX by deferring heavy jobs during boot storms.
Settings:BootPhase:DeferNonCriticalJobsAfterBootMinutes
3
Post-boot grace window (minutes)
Prevents inventory/updater contention with logon scripts.
Settings:BootPhase:DeferNonCriticalJobsAfterLogonMinutes
2
Post-logon grace window (minutes)
Per-user logon grace for multi-session hosts.
Settings:BootPhase:DeferPolicyPathObservedDuringGrace
true
Buffer inventory/path triggers during grace
Prevents queuing dozens of scans during logon storms.
Settings:BootPhase:KeeperUpdaterLogonDeferralSeconds
90
Updater deferral after logon (seconds)
Stops updater I/O from colliding with first-login installs.
Settings:BootPhase:MaxConcurrentExternalProcessesDuringGrace
3
Max external job processes during grace
Caps job fan-out to protect CPU/disk on thin clients.
Policy Engine
KeeperPolicy.metadata.admin.enforce_policies_for_administrators
true
When true, wildcard-user policies also apply to administrators
Core security posture — whether local admins bypass wildcard policies.
KeeperPolicy.metadata.execution_grant.default_duration_minutes
240
Policy-level override for grant TTL
Independent of the host ExecutionGrant default for tighter JIT control.
KeeperPolicy.metadata.riskscore.default_score
5.0
Default risk score when assessment is unavailable
Sets allow/deny bias for incomplete risk data.
KeeperPolicy.metadata.riskscore.use_default_on_failure
false
Use the default score vs. fail when a risk job errors
Security-critical fail-open vs. fail-closed switch.
KeeperPolicy.metadata.agentApplicationInventory.maxAgeSeconds
86400
Stale-inventory threshold for agentic/vulnerability gates
Tune for offline or slow-sync endpoints.
KeeperPolicy.metadata.agentApplicationInventory.path
"" (env/platform default)
Override path for the agent-application-inventory mirror file
Same storage-relocation rationale as RepositoryPath/SharedRepositoryPath.
KeeperPolicy.metadata.agenticSnapshot.vulnerabilityRiskMaxContribution
3.0
Max vulnerability risk contribution from the inventory mirror
Prevents vulnerability noise from dominating policy scores.
KeeperPolicy.metadata.eventTypeJobMapping
product map
EventType → control-job ID mapping
Routes event types to control workflows.
KeeperPolicy.metadata.eventTypeRiskJobMapping
product map
EventType → risk-assessment job mapping
Chooses which risk job runs per event type.
KeeperPolicy.metadata.processCatalog.retentionHours
24
Cross-session process-catalog retention
Longer retention helps RDP/JIT attribution but grows disk use.
KeeperPolicy.metadata.lookup.slowCallTimeoutSeconds
5
macOS/Linux slow policy-lookup timeout
Raise when directory servers are slow.
KeeperPolicy.metadata.maxRetryAttempts
3
Retries for failed policy operations
Resilience against transient MQTT/API failures.
KeeperPolicy.metadata.taskDelay
250
MQTT message loop delay (ms)
Advanced tuning when policy latency or CPU spikes appear.
KeeperPolicy.metadata.eventTypeJobMapping._defaultJobId
default-policy-controls
Fallback control-workflow job when no EventType mapping matches
⚠️ Note: Sub-field of the eventTypeJobMapping setting listed above; the default fallback specifically is not separately editable.
KeeperPolicy.metadata.eventTypeJobMapping.mappings
EventType→job-id map
Maps policy EventType → job ID for controls workflows
⚠️ Note: Sub-field of the eventTypeJobMapping setting listed above.
KeeperPolicy.metadata.eventTypeRiskJobMapping._defaultJobId
composite-risk-evaluation
Fallback risk-assessment job
⚠️ Note: Sub-field of the eventTypeRiskJobMapping setting listed above.
KeeperPolicy.metadata.eventTypeRiskJobMapping.mappings
EventType→risk-job map
Maps policy EventType → risk-assessment job ID
⚠️ Note: Sub-field of the eventTypeRiskJobMapping setting listed above.
KeeperPolicy.metadata.storage.sharedContainers
PolicyRegistry, AgentApplicationInventory
Named shared storage container definitions
⚠️ Warning: Do not edit. Renaming containers orphans encrypted data.
KeeperPolicy.metadata.agenticSnapshot.path
""
Deprecated telemetry snapshot path
⚠️ Warning: Deprecated. Realtime writer now uses the inventory mirror; do not point this at a live path.
KeeperPolicy.metadata.agenticSnapshot.maxAgeSeconds
120
Deprecated snapshot max age
⚠️ Note: Dead alongside the deprecated snapshot path above.
KeeperPolicy.metadata.processCatalog.path
""
Durable process-catalog path
⚠️ Note: Empty means in-memory only; this is deployment plumbing, not a tenant policy decision.
KeeperPolicy.startupPriority / .autoStart / .requiresMonitoring / .autoRestart
15 / true / true / true
Core policy-engine service lifecycle
⚠️ Warning: Do not edit. Boot ordering is carefully chosen; reordering can cause race conditions at startup.
KeeperPolicy.metadata.mqttTopics.subscribe / .publish
["RequestApproval"] / 15-entry list
MQTT wiring for the policy engine
⚠️ Warning: Do not edit. Editing the policy engine's MQTT role graph can break elevation/policy chains fleet-wide.
Cloud & API
KeeperApi.metadata.cveCatalog.refreshHours
6
CVE catalog refresh interval (hours)
Air-gapped/bandwidth-limited sites may need longer intervals.
KeeperApi.metadata.maxJustificationTextLength
512
Max justification text synced with the cloud
Must match ticket systems and the Controls limit.
KeeperApi.metadata.approval.useNewTypes
true
Use the new approval-type mapping for agentic policies
Feature flag during rollout of new policy schemas.
KeeperApi.metadata.transactionTracking
true
Track cloud transaction state for API calls
Enables cloud transaction correlation for support/audit.
ROUTER_URL (environment variable)
(unset)
Environment override for the Keeper cloud router URL
For air-gapped or private Keeper router deployments.
KeeperApi.metadata.mqttTopics / mqttRole
cloud bridge topics
KeeperApi MQTT topology
⚠️ Warning: Do not edit. Cloud-bridge wiring; edits can disconnect the agent from the Keeper backend.
KeeperApi.metadata.category
Keeper API
UI category label
⚠️ Note: Cosmetic label only.
KeeperApi.metadata.cveCatalog.subfolder
AgenticIntel
Subfolder name under the data directory for CVE intel
⚠️ Note: Folder naming is product layout; the refresh interval above is the tunable setting.
KeeperApi.requiredPermissions / startupPriority / .autoStart / .requiresMonitoring / .autoRestart / Subscription.Topic / .Qos / .CleanSession
various
Core backend-communication plugin bootstrap and lifecycle
⚠️ Warning: Do not edit. This plugin is started early and monitored by design; reordering or disabling monitoring can break cloud connectivity.
KeeperApi.metadata.mqttTopics.publish / .subscribe
topic lists
Publish/subscribe topics for the cloud-bridge plugin
⚠️ Warning: Do not edit. Same MQTT-role-graph risk as above.
Client UI
elevation-allowed-extensions.json
windows: .exe/.bat/.cmd/.msi/.ps1
Allowed Request Elevation file types per OS
Wrong list blocks .msi/.ps1 requests or opens risky file types.
keeperAgent.metadata.approvalExpirationHours
72
Hours until a pending approval expires
Prevents approval queues from growing stale.
keeperAgent.metadata.approvedRequestExpirationHours
24
Hours until an approved grant can no longer launch
Shorter TTL reduces lingering privilege.
KeeperClient.metadata.LanguageOverride
DEFAULT
UI language override
Forces UI locale independent of OS language.
KeeperClient.metadata.showInTray
true
Show the KeeperClient system tray icon
Some kiosks hide tray icons; interactive desktops usually require them.
keeperAgent.metadata.historyRetentionDays
30
Local request-history retention
Balances self-service value against privacy/disk limits.
keeperAgent.metadata.maxPayloadSizeBytes
1048576
Max MQTT payload size the agent UI accepts
Raise if request/approval payloads legitimately need to be larger.
keeperAgent.metadata.showInTray
false
Show the keeperAgent tray icon
Separate tray presence from KeeperClient.
KeeperClient.metadata.menu.autoRefresh
true
Auto-refresh the tray menu on a timer
Disable to stop timer churn on locked-down thin clients.
KeeperClient.metadata.menu.items
product menu
Tray menu jobs, dialogs, and visibility filters
Customizes which request/approval jobs appear in the tray.
KeeperClient.metadata.menu.refreshIntervalMinutes
5
Tray menu refresh interval
Tune for VDI density vs. API load.
keeperAgent.metadata.maxHistoryItems
20
Max history items shown in the UI
Bounds rendering cost on busy approvers' machines.
keeperAgent.metadata.maxRequestItems
20
Max pending requests shown in the UI
Prevents huge pending queues from freezing the dialog.
KeeperClient.metadata.mqttTopics / mqttRole / uiComponent / requiresDisplay
UI host flags + topics
Client MQTT wiring and UI host flags
⚠️ Warning: Do not edit. Tray/language/menu settings above are the supported controls; the underlying MQTT/UI-host flags are bootstrap plumbing.
keeperAgent.metadata.mqttTopics / mqttRole / uiComponent / requiresDisplay
UI host flags + topics
Agent UI MQTT wiring and host flags
⚠️ Warning: Do not edit. Same bootstrap-plumbing concern as KeeperClient.