---
url: "https://vueda.dev/v3/reference/configuration.md"
title: "Server configuration"
---
# Server configuration
Config keys are inputs read through the env adapter by `get_defaults` and `get_production_defaults`. Django settings are the values the application reads after settings assembly. A config key can supply a differently named or nested Django setting.
Defaults below are Python expressions from source, not values from a running project. A key without a default is required whenever its read executes. Production keys apply only when calling `get_production_defaults`; Mailgun keys apply only with that email backend. Projects can override the returned Django settings.
The settings inventory includes direct reads, local fallbacks, and selected conditional factory outputs. Standard Django settings used without changing their meaning can have explicit exemptions, listed below. Factory declarations show source expressions and overrides in order; they do not evaluate local variables or optional imports.
See [Configuration surface and defaults](/v3/core-concepts/configuration-surface-and-defaults.md) for assembly and override behavior, and [Configure cache and sessions](/v3/guides/configure-cache-and-sessions.md) for cache setup. Client configuration belongs in the [JavaScript API reference](/v3/reference/api/js/index.md).
## Config keys
| Key | Django setting paths | Default or requirement |
| --- | --- | --- |
| [`ACCOUNT_REAUTHENTICATION_TIMEOUT`](/v3/reference/configuration.md#config-account-reauthentication-timeout) | `ACCOUNT_REAUTHENTICATION_TIMEOUT` | `300` |
| [`ALLAUTH_ACCOUNT_ADAPTER`](/v3/reference/configuration.md#config-allauth-account-adapter) | `ACCOUNT_ADAPTER` | `'vueda.user.adapters.VuedaAllAuthAccountAdapter'` |
| [`ALLAUTH_HEADLESS_ADAPTER`](/v3/reference/configuration.md#config-allauth-headless-adapter) | `HEADLESS_ADAPTER` | `'vueda.user.adapters.VuedaAllAuthHeadlessAdapter'` |
| [`ALLAUTH_MFA_ADAPTER`](/v3/reference/configuration.md#config-allauth-mfa-adapter) | `MFA_ADAPTER` | `'vueda.user.adapters.VuedaAllAuthMFAAdapter'` |
| [`ALLOWED_HOSTS`](/v3/reference/configuration.md#config-allowed-hosts) | `ALLOWED_HOSTS` | Required when read |
| [`ANYMAIL_MAILGUN_API_KEY`](/v3/reference/configuration.md#config-anymail-mailgun-api-key) | `ANYMAIL_MAILGUN_API_KEY` | Required when read |
| [`ANYMAIL_MAILGUN_API_URL`](/v3/reference/configuration.md#config-anymail-mailgun-api-url) | `ANYMAIL_MAILGUN_API_URL` | `'https://api.mailgun.net/v3'` |
| [`ANYMAIL_MAILGUN_SENDER_DOMAIN`](/v3/reference/configuration.md#config-anymail-mailgun-sender-domain) | `ANYMAIL_MAILGUN_SENDER_DOMAIN` | Required when read |
| [`ANYMAIL_MAILGUN_WEBHOOK_SIGNING_KEY`](/v3/reference/configuration.md#config-anymail-mailgun-webhook-signing-key) | `ANYMAIL_MAILGUN_WEBHOOK_SIGNING_KEY` | Required when read |
| [`ANYMAIL_WEBHOOK_SECRET`](/v3/reference/configuration.md#config-anymail-webhook-secret) | `ANYMAIL_WEBHOOK_SECRET` | Required when read |
| [`AUTH_USER_MODEL`](/v3/reference/configuration.md#config-auth-user-model) | `AUTH_USER_MODEL` | Required when read |
| [`CACHE_URL`](/v3/reference/configuration.md#config-cache-url) | `CACHES.default` | Required when read |
| [`CELERY_BROKER_URL`](/v3/reference/configuration.md#config-celery-broker-url) | `CELERY_BROKER_URL` | `''` |
| [`CORS_ALLOWED_ORIGINS`](/v3/reference/configuration.md#config-cors-allowed-origins) | `CORS_ALLOWED_ORIGINS` | Required when read |
| [`CSRF_TRUSTED_ORIGINS`](/v3/reference/configuration.md#config-csrf-trusted-origins) | `CSRF_TRUSTED_ORIGINS` | Required when read |
| [`DATABASE_BACKUP_DIR`](/v3/reference/configuration.md#config-database-backup-dir) | `DATABASE_BACKUP_DIR` | Required when read |
| [`DATABASE_URL`](/v3/reference/configuration.md#config-database-url) | `DATABASES.default` | Required when read |
| [`DEBUG`](/v3/reference/configuration.md#config-debug) | `DEBUG` | `False` |
| [`DJANGO_APPS`](/v3/reference/configuration.md#config-django-apps) | `DJANGO_APPS` | `['django.contrib.auth', 'django.contrib.contenttypes', 'django.contrib.sessions', 'django.contrib.sites', 'django.contrib.messages', 'django.contrib.staticfiles', 'django.contrib.postgres']` |
| [`EMAIL_BACKEND`](/v3/reference/configuration.md#config-email-backend) | `EMAIL_BACKEND`, `MAILERS.default.BACKEND` | `'django.core.mail.backends.console.EmailBackend'` |
| [`EMAIL_SUBJECT_PREFIX`](/v3/reference/configuration.md#config-email-subject-prefix) | `EMAIL_SUBJECT_PREFIX` | `''` |
| [`FRONTEND_DOMAIN`](/v3/reference/configuration.md#config-frontend-domain) | `FRONTEND_DOMAIN` | Required when read |
| [`FRONTEND_LOGIN_URL`](/v3/reference/configuration.md#config-frontend-login-url) | `FRONTEND_LOGIN_URL` | Required when read |
| [`FRONTEND_RESET_URL`](/v3/reference/configuration.md#config-frontend-reset-url) | `FRONTEND_RESET_URL` | `'/reset-password'` |
| [`LANGUAGE_CODE`](/v3/reference/configuration.md#config-language-code) | `LANGUAGE_CODE` | `'en-us'` |
| [`LOCAL_APPS`](/v3/reference/configuration.md#config-local-apps) | `LOCAL_APPS` | `[]` |
| [`LOGS_FOLDER`](/v3/reference/configuration.md#config-logs-folder) | `LOGGING.handlers.file.filename` | `'.'` |
| [`MEDIA_ROOT`](/v3/reference/configuration.md#config-media-root) | `MEDIA_ROOT` | `'/tmp/media'` |
| [`MEDIA_URL`](/v3/reference/configuration.md#config-media-url) | `MEDIA_URL` | `'/media/'` |
| [`NO_REPLY_EMAIL`](/v3/reference/configuration.md#config-no-reply-email) | `NO_REPLY_EMAIL` | Required when read |
| [`PACKAGE_MANAGER`](/v3/reference/configuration.md#config-package-manager) | `PACKAGE_MANAGER` | `'auto'` |
| [`SECRET_KEY`](/v3/reference/configuration.md#config-secret-key) | `SECRET_KEY` | Required when read |
| [`SECURE_CONTENT_TYPE_NOSNIFF`](/v3/reference/configuration.md#config-secure-content-type-nosniff) | `SECURE_CONTENT_TYPE_NOSNIFF` | `True` |
| [`SECURE_CROSS_ORIGIN_OPENER_POLICY`](/v3/reference/configuration.md#config-secure-cross-origin-opener-policy) | `SECURE_CROSS_ORIGIN_OPENER_POLICY` | `'same-origin'` |
| [`SECURE_HSTS_SECONDS`](/v3/reference/configuration.md#config-secure-hsts-seconds) | `SECURE_HSTS_SECONDS` | `31536000` |
| [`SECURE_REFERRER_POLICY`](/v3/reference/configuration.md#config-secure-referrer-policy) | `SECURE_REFERRER_POLICY` | `'same-origin'` |
| [`SENTRY_DSN`](/v3/reference/configuration.md#config-sentry-dsn) | `SENTRY_DSN` | Required when read |
| [`SENTRY_ENVIRONMENT`](/v3/reference/configuration.md#config-sentry-environment) | `SENTRY_ENVIRONMENT` | `'production'` |
| [`SENTRY_LOG_LEVEL`](/v3/reference/configuration.md#config-sentry-log-level) | `SENTRY_LOG_LEVEL` | `logging.INFO` |
| [`SENTRY_TRACES_SAMPLE_RATE`](/v3/reference/configuration.md#config-sentry-traces-sample-rate) | `SENTRY_TRACES_SAMPLE_RATE` | `0.1` |
| [`SITE_ID`](/v3/reference/configuration.md#config-site-id) | `SITE_ID` | `1` |
| [`SITE_NAME`](/v3/reference/configuration.md#config-site-name) | `SITE_NAME` | Required when read |
| [`STATIC_ROOT`](/v3/reference/configuration.md#config-static-root) | `STATIC_ROOT` | Required when read |
| [`STATIC_URL`](/v3/reference/configuration.md#config-static-url) | `STATIC_URL` | `'/static/'` |
| [`STATICFILES_DIRS`](/v3/reference/configuration.md#config-staticfiles-dirs) | `STATICFILES_DIRS` | Required when read |
| [`SUPPORT_EMAIL`](/v3/reference/configuration.md#config-support-email) | `SUPPORT_EMAIL` | Required when read |
| [`TEST_POSTGRES_DB`](/v3/reference/configuration.md#config-test-postgres-db) | `TEST_POSTGRES_DB` | `'dbname=postgres user=postgres'` |
| [`THIRD_PARTY_APPS`](/v3/reference/configuration.md#config-third-party-apps) | `THIRD_PARTY_APPS` | `['rest_framework', 'corsheaders', 'django_extensions', 'private_storage', 'django_filters', 'generic_relations', 'phonenumber_field', 'anymail', 'allauth', 'allauth.account', 'allauth.headless', 'allauth.mfa']` |
| [`TIME_ZONE`](/v3/reference/configuration.md#config-time-zone) | `TIME_ZONE` | Required when read |
| [`TWILIO_ACCOUNT_SID`](/v3/reference/configuration.md#config-twilio-account-sid) | `TWILIO_ACCOUNT_SID` | `''` |
| [`TWILIO_AUTH_TOKEN`](/v3/reference/configuration.md#config-twilio-auth-token) | `TWILIO_AUTH_TOKEN` | `''` |
| [`TWILIO_CALLER_ID`](/v3/reference/configuration.md#config-twilio-caller-id) | `TWILIO_CALLER_ID` | `''` |
| [`VUEDA_APPS`](/v3/reference/configuration.md#config-vueda-apps) | `VUEDA_APPS` | `['vueda.core', 'vueda.history', 'vueda.info', 'vueda.user', 'vueda.workflow', 'vueda.vdq', 'vueda.release']` |
| [`VUEDA_USER_ADAPTER`](/v3/reference/configuration.md#config-vueda-user-adapter) | `VUEDA_USER_ADAPTER` | `'vueda.user.adapters.DefaultUserAdapter'` |
### ACCOUNT_REAUTHENTICATION_TIMEOUT {#config-account-reauthentication-timeout}
Time in seconds during which django-allauth considers a recent authentication valid for reauthentication checks.
Django setting paths: `ACCOUNT_REAUTHENTICATION_TIMEOUT`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env.int(...)` | `300` | Base defaults | `server/vueda/core/default_settings.py:304` |
### ALLAUTH_ACCOUNT_ADAPTER {#config-allauth-account-adapter}
Class path assigned to ACCOUNT_ADAPTER for django-allauth account behavior.
Django setting paths: `ACCOUNT_ADAPTER`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `'vueda.user.adapters.VuedaAllAuthAccountAdapter'` | Base defaults | `server/vueda/core/default_settings.py:300` |
### ALLAUTH_HEADLESS_ADAPTER {#config-allauth-headless-adapter}
Class path assigned to HEADLESS_ADAPTER for django-allauth headless behavior.
Django setting paths: `HEADLESS_ADAPTER`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `'vueda.user.adapters.VuedaAllAuthHeadlessAdapter'` | Base defaults | `server/vueda/core/default_settings.py:299` |
### ALLAUTH_MFA_ADAPTER {#config-allauth-mfa-adapter}
Class path assigned to MFA_ADAPTER for django-allauth multi-factor authentication behavior.
Django setting paths: `MFA_ADAPTER`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `'vueda.user.adapters.VuedaAllAuthMFAAdapter'` | Base defaults | `server/vueda/core/default_settings.py:301` |
### ALLOWED_HOSTS {#config-allowed-hosts}
Hostnames that Django accepts in incoming requests. Use hostnames without URL schemes or ports.
Django setting paths: `ALLOWED_HOSTS`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env.list(...)` | Required when read | Base defaults | `server/vueda/core/default_settings.py:181` |
### ANYMAIL_MAILGUN_API_KEY {#config-anymail-mailgun-api-key}
API credential for sending email through Mailgun.
Django setting paths: `ANYMAIL_MAILGUN_API_KEY`.
Applies: When EMAIL_BACKEND selects anymail.backends.mailgun.EmailBackend.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | Required when read | Base defaults; `email_backend == 'anymail.backends.mailgun.EmailBackend'` | `server/vueda/core/default_settings.py:411` |
### ANYMAIL_MAILGUN_API_URL {#config-anymail-mailgun-api-url}
Mailgun API base URL used by the email backend.
Django setting paths: `ANYMAIL_MAILGUN_API_URL`.
Applies: When EMAIL_BACKEND selects anymail.backends.mailgun.EmailBackend.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `'https://api.mailgun.net/v3'` | Base defaults; `email_backend == 'anymail.backends.mailgun.EmailBackend'` | `server/vueda/core/default_settings.py:413` |
### ANYMAIL_MAILGUN_SENDER_DOMAIN {#config-anymail-mailgun-sender-domain}
Mailgun sending domain for outgoing email.
Django setting paths: `ANYMAIL_MAILGUN_SENDER_DOMAIN`.
Applies: When EMAIL_BACKEND selects anymail.backends.mailgun.EmailBackend.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | Required when read | Base defaults; `email_backend == 'anymail.backends.mailgun.EmailBackend'` | `server/vueda/core/default_settings.py:412` |
### ANYMAIL_MAILGUN_WEBHOOK_SIGNING_KEY {#config-anymail-mailgun-webhook-signing-key}
Signing key for validating Mailgun webhook payloads.
Django setting paths: `ANYMAIL_MAILGUN_WEBHOOK_SIGNING_KEY`.
Applies: When EMAIL_BACKEND selects anymail.backends.mailgun.EmailBackend.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | Required when read | Base defaults; `email_backend == 'anymail.backends.mailgun.EmailBackend'` | `server/vueda/core/default_settings.py:414` |
### ANYMAIL_WEBHOOK_SECRET {#config-anymail-webhook-secret}
Shared secret used by django-anymail webhook authentication.
Django setting paths: `ANYMAIL_WEBHOOK_SECRET`.
Applies: When EMAIL_BACKEND selects anymail.backends.mailgun.EmailBackend.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | Required when read | Base defaults; `email_backend == 'anymail.backends.mailgun.EmailBackend'` | `server/vueda/core/default_settings.py:415` |
### AUTH_USER_MODEL {#config-auth-user-model}
Django user model label used by VUEDA model relationships and migration generation.
Django setting paths: `AUTH_USER_MODEL`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | Required when read | Base defaults | `server/vueda/core/default_settings.py:223` |
### CACHE_URL {#config-cache-url}
Cache connection URL parsed into CACHES.default. Required because the factory stores sessions in this cache. Use a shared cache for multiple worker processes; a Redis URL also needs the redis extra.
Django setting paths: `CACHES.default`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env.dj_cache_url(...)` | Required when read | Base defaults | `server/vueda/core/default_settings.py:189` |
### CELERY_BROKER_URL {#config-celery-broker-url}
Broker URL for Celery task delivery, including the VDQ dispatch queue.
Django setting paths: `CELERY_BROKER_URL`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `''` | Base defaults | `server/vueda/core/default_settings.py:131` |
### CORS_ALLOWED_ORIGINS {#config-cors-allowed-origins}
Origins allowed by the configured CORS middleware for HTTP and ASGI requests.
Django setting paths: `CORS_ALLOWED_ORIGINS`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env.list(...)` | Required when read | Base defaults | `server/vueda/core/default_settings.py:372` |
### CSRF_TRUSTED_ORIGINS {#config-csrf-trusted-origins}
Origins Django trusts for CSRF origin checks. Include each origin’s URL scheme.
Django setting paths: `CSRF_TRUSTED_ORIGINS`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env.list(...)` | Required when read | Base defaults | `server/vueda/core/default_settings.py:206` |
### DATABASE_BACKUP_DIR {#config-database-backup-dir}
Directory where the VUEDA update command writes a PostgreSQL backup before applying migrations.
Django setting paths: `DATABASE_BACKUP_DIR`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | Required when read | Base defaults | `server/vueda/core/default_settings.py:399` |
### DATABASE_URL {#config-database-url}
Database connection URL parsed into DATABASES.default. The factory enables atomic requests, disables persistent connections, and selects repeatable-read isolation for supported PostgreSQL backends.
Django setting paths: `DATABASES.default`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env.dj_db_url(...)` | Required when read | Base defaults | `server/vueda/core/default_settings.py:182` |
### DEBUG {#config-debug}
Enables Django debug mode and VUEDA debug routes and exception details. Also lowers the CORS preflight cache lifetime to 600 seconds.
Django setting paths: `DEBUG`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env.bool(...)` | `False` | Base defaults | `server/vueda/core/default_settings.py:135` |
### DJANGO_APPS {#config-django-apps}
Django applications included in the assembled INSTALLED_APPS list.
Django setting paths: `DJANGO_APPS`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env.list(...)` | `['django.contrib.auth', 'django.contrib.contenttypes', 'django.contrib.sessions', 'django.contrib.sites', 'django.contrib.messages', 'django.contrib.staticfiles', 'django.contrib.postgres']` | Base defaults | `server/vueda/core/default_settings.py:254` |
### EMAIL_BACKEND {#config-email-backend}
Email backend class path. The console backend prints messages during development. With use_mailers=True, the factory places this value in MAILERS.default.BACKEND; otherwise it sets EMAIL_BACKEND. Selecting the Mailgun backend also reads the ANYMAIL_MAILGUN_* keys and ANYMAIL_WEBHOOK_SECRET.
Django setting paths: `EMAIL_BACKEND`, `MAILERS.default.BACKEND`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `'django.core.mail.backends.console.EmailBackend'` | Base defaults | `server/vueda/core/default_settings.py:128` |
### EMAIL_SUBJECT_PREFIX {#config-email-subject-prefix}
Prefix for account email subjects. When empty, the user adapter uses SITE_NAME in square brackets.
Django setting paths: `EMAIL_SUBJECT_PREFIX`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `''` | Base defaults | `server/vueda/core/default_settings.py:190` |
### FRONTEND_DOMAIN {#config-frontend-domain}
Frontend origin prepended to login and password-reset paths in account emails.
Django setting paths: `FRONTEND_DOMAIN`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | Required when read | Base defaults | `server/vueda/core/default_settings.py:173` |
### FRONTEND_LOGIN_URL {#config-frontend-login-url}
Frontend login path used in account emails, appended to FRONTEND_DOMAIN.
Django setting paths: `FRONTEND_LOGIN_URL`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | Required when read | Base defaults | `server/vueda/core/default_settings.py:174` |
### FRONTEND_RESET_URL {#config-frontend-reset-url}
Frontend password-reset path used to build the reset link with its token and user identifier.
Django setting paths: `FRONTEND_RESET_URL`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `'/reset-password'` | Base defaults | `server/vueda/core/default_settings.py:175` |
### LANGUAGE_CODE {#config-language-code}
Default language code used by Django.
Django setting paths: `LANGUAGE_CODE`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `'en-us'` | Base defaults | `server/vueda/core/default_settings.py:177` |
### LOCAL_APPS {#config-local-apps}
Project applications appended to INSTALLED_APPS. VUEDA also uses this list to group models in the permissions overview.
Django setting paths: `LOCAL_APPS`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env.list(...)` | `[]` | Base defaults | `server/vueda/core/default_settings.py:296` |
### LOGS_FOLDER {#config-logs-folder}
Directory containing django.log for the rotating file handler declared in LOGGING. The root logger uses only the console handler by default.
Django setting paths: `LOGGING.handlers.file.filename`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `'.'` | Base defaults | `server/vueda/core/default_settings.py:158` |
### MEDIA_ROOT {#config-media-root}
Filesystem directory for uploaded media.
Django setting paths: `MEDIA_ROOT`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `'/tmp/media'` | Base defaults | `server/vueda/core/default_settings.py:216` |
### MEDIA_URL {#config-media-url}
URL prefix for uploaded media.
Django setting paths: `MEDIA_URL`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `'/media/'` | Base defaults | `server/vueda/core/default_settings.py:217` |
### NO_REPLY_EMAIL {#config-no-reply-email}
Sender address for user account email and the SYSTEM sender record used by VDQ.
Django setting paths: `NO_REPLY_EMAIL`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | Required when read | Base defaults | `server/vueda/core/default_settings.py:203` |
### PACKAGE_MANAGER {#config-package-manager}
Returned package-manager preference (auto, uv, or pipenv). The current update command detects the manager from project files and executable availability; it does not read this setting.
Django setting paths: `PACKAGE_MANAGER`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `'auto'` | Base defaults | `server/vueda/core/default_settings.py:400` |
### SECRET_KEY {#config-secret-key}
Django signing secret. Supply a private value for each project environment.
Django setting paths: `SECRET_KEY`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | Required when read | Base defaults | `server/vueda/core/default_settings.py:136` |
### SECURE_CONTENT_TYPE_NOSNIFF {#config-secure-content-type-nosniff}
Controls the nosniff response header from Django security middleware.
Django setting paths: `SECURE_CONTENT_TYPE_NOSNIFF`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env.bool(...)` | `True` | Base defaults | `server/vueda/core/default_settings.py:195` |
### SECURE_CROSS_ORIGIN_OPENER_POLICY {#config-secure-cross-origin-opener-policy}
Cross-origin opener policy for Django security middleware. An empty string becomes None and disables the header.
Django setting paths: `SECURE_CROSS_ORIGIN_OPENER_POLICY`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `'same-origin'` | Base defaults | `server/vueda/core/default_settings.py:196` |
### SECURE_HSTS_SECONDS {#config-secure-hsts-seconds}
Lifetime in seconds advertised by the HTTP Strict Transport Security header.
Django setting paths: `SECURE_HSTS_SECONDS`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env.int(...)` | `31536000` | Base defaults | `server/vueda/core/default_settings.py:197` |
### SECURE_REFERRER_POLICY {#config-secure-referrer-policy}
Referrer policy for Django security middleware. An empty string becomes None and disables the header.
Django setting paths: `SECURE_REFERRER_POLICY`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `'same-origin'` | Base defaults | `server/vueda/core/default_settings.py:199` |
### SENTRY_DSN {#config-sentry-dsn}
Sentry destination supplied by the production defaults for project error-reporting setup.
Django setting paths: `SENTRY_DSN`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | Required when read | Production defaults | `server/vueda/core/default_settings.py:547` |
### SENTRY_ENVIRONMENT {#config-sentry-environment}
Environment name supplied by the production defaults for Sentry events.
Django setting paths: `SENTRY_ENVIRONMENT`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `'production'` | Production defaults | `server/vueda/core/default_settings.py:549` |
### SENTRY_LOG_LEVEL {#config-sentry-log-level}
Logging threshold supplied by the production defaults. logging.INFO is the Python INFO logging level.
Django setting paths: `SENTRY_LOG_LEVEL`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env.int(...)` | `logging.INFO` | Production defaults | `server/vueda/core/default_settings.py:548` |
### SENTRY_TRACES_SAMPLE_RATE {#config-sentry-traces-sample-rate}
Trace sampling rate supplied by the production defaults for Sentry.
Django setting paths: `SENTRY_TRACES_SAMPLE_RATE`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env.float(...)` | `0.1` | Production defaults | `server/vueda/core/default_settings.py:550` |
### SITE_ID {#config-site-id}
Django sites framework identifier for this installation.
Django setting paths: `SITE_ID`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env.int(...)` | `1` | Base defaults | `server/vueda/core/default_settings.py:176` |
### SITE_NAME {#config-site-name}
Site name in account email templates and the fallback email subject prefix.
Django setting paths: `SITE_NAME`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | Required when read | Base defaults | `server/vueda/core/default_settings.py:200` |
### STATIC_ROOT {#config-static-root}
Destination directory for collected static files.
Django setting paths: `STATIC_ROOT`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | Required when read | Base defaults | `server/vueda/core/default_settings.py:209` |
### STATIC_URL {#config-static-url}
URL prefix for static files.
Django setting paths: `STATIC_URL`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `'/static/'` | Base defaults | `server/vueda/core/default_settings.py:210` |
### STATICFILES_DIRS {#config-staticfiles-dirs}
Additional directories searched for static files.
Django setting paths: `STATICFILES_DIRS`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env.list(...)` | Required when read | Base defaults | `server/vueda/core/default_settings.py:211` |
### SUPPORT_EMAIL {#config-support-email}
Support address inserted into account email context.
Django setting paths: `SUPPORT_EMAIL`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | Required when read | Base defaults | `server/vueda/core/default_settings.py:201` |
### TEST_POSTGRES_DB {#config-test-postgres-db}
PostgreSQL connection string supplied as TEST_POSTGRES_DB for project test setup.
Django setting paths: `TEST_POSTGRES_DB`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `'dbname=postgres user=postgres'` | Base defaults | `server/vueda/core/default_settings.py:353` |
### THIRD_PARTY_APPS {#config-third-party-apps}
Third-party applications included in INSTALLED_APPS. The factory appends pgtrigger and pghistory, plus drf_spectacular when importable.
Django setting paths: `THIRD_PARTY_APPS`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env.list(...)` | `['rest_framework', 'corsheaders', 'django_extensions', 'private_storage', 'django_filters', 'generic_relations', 'phonenumber_field', 'anymail', 'allauth', 'allauth.account', 'allauth.headless', 'allauth.mfa']` | Base defaults | `server/vueda/core/default_settings.py:279` |
### TIME_ZONE {#config-time-zone}
Default time zone used by Django. The factory also enables time-zone-aware datetimes.
Django setting paths: `TIME_ZONE`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | Required when read | Base defaults | `server/vueda/core/default_settings.py:178` |
### TWILIO_ACCOUNT_SID {#config-twilio-account-sid}
Twilio account identifier. VDQ initializes its Twilio client and status polling only when this value is nonempty and the Twilio package is available.
Django setting paths: `TWILIO_ACCOUNT_SID`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `''` | Base defaults | `server/vueda/core/default_settings.py:132` |
### TWILIO_AUTH_TOKEN {#config-twilio-auth-token}
Twilio credential used to send SMS messages and validate incoming webhook signatures.
Django setting paths: `TWILIO_AUTH_TOKEN`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `''` | Base defaults | `server/vueda/core/default_settings.py:134` |
### TWILIO_CALLER_ID {#config-twilio-caller-id}
Sender phone number for user account SMS messages and the SYSTEM sender record.
Django setting paths: `TWILIO_CALLER_ID`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `''` | Base defaults | `server/vueda/core/default_settings.py:133` |
### VUEDA_APPS {#config-vueda-apps}
VUEDA applications included in INSTALLED_APPS. The factory requires vueda.history because the shipped migrations depend on it. Including vueda.workflow also adds its OpenAPI tag when drf_spectacular is available.
Django setting paths: `VUEDA_APPS`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env.list(...)` | `['vueda.core', 'vueda.history', 'vueda.info', 'vueda.user', 'vueda.workflow', 'vueda.vdq', 'vueda.release']` | Base defaults | `server/vueda/core/default_settings.py:266` |
### VUEDA_USER_ADAPTER {#config-vueda-user-adapter}
Class path for the user adapter that implements VUEDA account operations.
Django setting paths: `VUEDA_USER_ADAPTER`.
| Accessor | Default or requirement | Scope | Read at |
| --- | --- | --- | --- |
| `env(...)` | `'vueda.user.adapters.DefaultUserAdapter'` | Base defaults | `server/vueda/core/default_settings.py:278` |
## Django settings
Local fallbacks belong to individual reads. They do not replace values supplied by the defaults factories or by a project's settings module.
- [`AUTH_USER_MODEL`](/v3/reference/configuration.md#setting-auth-user-model)
- [`CACHES`](/v3/reference/configuration.md#setting-caches)
- [`COLUMN_TOTALS_PARAM`](/v3/reference/configuration.md#setting-column-totals-param)
- [`CORS_ALLOW_CREDENTIALS`](/v3/reference/configuration.md#setting-cors-allow-credentials)
- [`CORS_ALLOW_HEADERS`](/v3/reference/configuration.md#setting-cors-allow-headers)
- [`CORS_ALLOW_METHODS`](/v3/reference/configuration.md#setting-cors-allow-methods)
- [`CORS_ALLOWED_ORIGINS`](/v3/reference/configuration.md#setting-cors-allowed-origins)
- [`CORS_EXPOSE_HEADERS`](/v3/reference/configuration.md#setting-cors-expose-headers)
- [`CORS_PREFLIGHT_MAX_AGE`](/v3/reference/configuration.md#setting-cors-preflight-max-age)
- [`DATABASE_BACKUP_DIR`](/v3/reference/configuration.md#setting-database-backup-dir)
- [`DATABASES`](/v3/reference/configuration.md#setting-databases)
- [`DEBUG`](/v3/reference/configuration.md#setting-debug)
- [`EMAIL_BACKEND`](/v3/reference/configuration.md#setting-email-backend)
- [`EMAIL_SUBJECT_PREFIX`](/v3/reference/configuration.md#setting-email-subject-prefix)
- [`EMAIL_TIMEOUT`](/v3/reference/configuration.md#setting-email-timeout)
- [`FRONTEND_DOMAIN`](/v3/reference/configuration.md#setting-frontend-domain)
- [`FRONTEND_LOGIN_URL`](/v3/reference/configuration.md#setting-frontend-login-url)
- [`FRONTEND_RESET_URL`](/v3/reference/configuration.md#setting-frontend-reset-url)
- [`IN_TESTS`](/v3/reference/configuration.md#setting-in-tests)
- [`INSTALLED_APPS`](/v3/reference/configuration.md#setting-installed-apps)
- [`LOCAL_APPS`](/v3/reference/configuration.md#setting-local-apps)
- [`MAILERS`](/v3/reference/configuration.md#setting-mailers)
- [`MAX_PAGE_SIZE`](/v3/reference/configuration.md#setting-max-page-size)
- [`MIDDLEWARE`](/v3/reference/configuration.md#setting-middleware)
- [`NO_REPLY_EMAIL`](/v3/reference/configuration.md#setting-no-reply-email)
- [`PAGE_QUERY_PARAM`](/v3/reference/configuration.md#setting-page-query-param)
- [`PAGE_SIZE_QUERY_PARAM`](/v3/reference/configuration.md#setting-page-size-query-param)
- [`PERMISSION_NAMES_MAPPING`](/v3/reference/configuration.md#setting-permission-names-mapping)
- [`PGHISTORY_APPEND_ONLY`](/v3/reference/configuration.md#setting-pghistory-append-only)
- [`PGHISTORY_CREATED_AT_FUNCTION`](/v3/reference/configuration.md#setting-pghistory-created-at-function)
- [`QUEUE_ITEM_SERIALIZER`](/v3/reference/configuration.md#setting-queue-item-serializer)
- [`REST_AUTH`](/v3/reference/configuration.md#setting-rest-auth)
- [`REST_FLEX_FIELDS2`](/v3/reference/configuration.md#setting-rest-flex-fields2)
- [`REST_FRAMEWORK`](/v3/reference/configuration.md#setting-rest-framework)
- [`SEND_QUEUE_VIEWSET`](/v3/reference/configuration.md#setting-send-queue-viewset)
- [`SENT_ITEM_SERIALIZER`](/v3/reference/configuration.md#setting-sent-item-serializer)
- [`SENT_ITEM_VIEWSET`](/v3/reference/configuration.md#setting-sent-item-viewset)
- [`SESSION_CACHE_ALIAS`](/v3/reference/configuration.md#setting-session-cache-alias)
- [`SESSION_ENGINE`](/v3/reference/configuration.md#setting-session-engine)
- [`SITE_NAME`](/v3/reference/configuration.md#setting-site-name)
- [`SPECTACULAR_SETTINGS`](/v3/reference/configuration.md#setting-spectacular-settings)
- [`SUPPORT_EMAIL`](/v3/reference/configuration.md#setting-support-email)
- [`TWILIO_ACCOUNT_SID`](/v3/reference/configuration.md#setting-twilio-account-sid)
- [`TWILIO_AUTH_TOKEN`](/v3/reference/configuration.md#setting-twilio-auth-token)
- [`TWILIO_CALLER_ID`](/v3/reference/configuration.md#setting-twilio-caller-id)
- [`TWILIO_WEBHOOK_URL`](/v3/reference/configuration.md#setting-twilio-webhook-url)
- [`VDQ_EMAIL_TRACKING_STRATEGY`](/v3/reference/configuration.md#setting-vdq-email-tracking-strategy)
- [`VDQ_MAX_FILES_AGE_IN_SECONDS`](/v3/reference/configuration.md#setting-vdq-max-files-age-in-seconds)
- [`VDQ_TWILIO_SMS_TIMEOUT_HOURS`](/v3/reference/configuration.md#setting-vdq-twilio-sms-timeout-hours)
- [`VDQ_URL`](/v3/reference/configuration.md#setting-vdq-url)
- [`VUEDA_USER_ADAPTER`](/v3/reference/configuration.md#setting-vueda-user-adapter)
- [`VUEDA_VDQ_RECEIVER_MODEL`](/v3/reference/configuration.md#setting-vueda-vdq-receiver-model)
- [`VUEDA_VDQ_SENDER_MODEL`](/v3/reference/configuration.md#setting-vueda-vdq-sender-model)
### AUTH_USER_MODEL {#setting-auth-user-model}
Django user model label used by VUEDA model relationships and migration generation.
Config input: [`AUTH_USER_MODEL`](/v3/reference/configuration.md#config-auth-user-model).
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:223`.
```python
AUTH_USER_MODEL = env('AUTH_USER_MODEL')
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/user/management/commands/makegroupmigrations.py:497` | `attribute` | None supplied |
| `server/vueda/user/migrations/0001_initial.py:9` | `attribute` | None supplied |
| `server/vueda/user/migrations/0001_initial.py:22` | `attribute` | None supplied |
| `server/vueda/user/migrations/0001_initial.py:34` | `attribute` | None supplied |
| `server/vueda/user/migrations/0003_totpdevice.py:14` | `attribute` | None supplied |
| `server/vueda/user/migrations/0003_totpdevice.py:59` | `attribute` | None supplied |
| `server/vueda/user/migrations/0006_totpdeviceevent_totpdevice_insert_insert_and_more.py:17` | `attribute` | None supplied |
| `server/vueda/user/migrations/0006_totpdeviceevent_totpdevice_insert_insert_and_more.py:132` | `attribute` | None supplied |
| `server/vueda/user/models.py:208` | `attribute` | None supplied |
| `server/vueda/vdq/migrations/0002_workflow_migrations_2025_09_22.py:2122` | `attribute` | None supplied |
| `server/vueda/vdq/migrations/0005_workflow_migrations_2025_11_21.py:1018` | `attribute` | None supplied |
| `server/vueda/workflow/management/commands/makeworkflowmigrations.py:173` | `attribute` | None supplied |
| `server/vueda/workflow/migrations/0001_initial.py:25` | `attribute` | None supplied |
| `server/vueda/workflow/migrations/0001_initial.py:195` | `attribute` | None supplied |
| `server/vueda/workflow/migrations/0002_statepermission_historical_group_name_and_more.py:14` | `attribute` | None supplied |
| `server/vueda/workflow/migrations/0002_statepermission_historical_group_name_and_more.py:114` | `attribute` | None supplied |
| `server/vueda/workflow/migrations/0002_statepermission_historical_group_name_and_more.py:176` | `attribute` | None supplied |
| `server/vueda/workflow/migrations/0002_statepermission_historical_group_name_and_more.py:241` | `attribute` | None supplied |
| `server/vueda/workflow/migrations/0002_statepermission_historical_group_name_and_more.py:303` | `attribute` | None supplied |
| `server/vueda/workflow/migrations/0002_statepermission_historical_group_name_and_more.py:366` | `attribute` | None supplied |
| `server/vueda/workflow/migrations/0002_statepermission_historical_group_name_and_more.py:426` | `attribute` | None supplied |
| `server/vueda/workflow/migrations/0002_statepermission_historical_group_name_and_more.py:501` | `attribute` | None supplied |
| `server/vueda/workflow/migrations/0002_statepermission_historical_group_name_and_more.py:542` | `attribute` | None supplied |
### CACHES {#setting-caches}
VUEDA checks that the cache selected for sessions can be shared between production workers.
Config input: [`CACHE_URL`](/v3/reference/configuration.md#config-cache-url).
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:189`.
```python
CACHES = {'default': env.dj_cache_url('CACHE_URL')}
```
Local fallback values: `{}`. These apply only at the read sites that supply them.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/core/checks.py:468` | `getattr` | `{}` |
### COLUMN_TOTALS_PARAM {#setting-column-totals-param}
Query parameter selecting named column totals for list requests. The client has a matching constant that must change with this setting.
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:369`.
```python
COLUMN_TOTALS_PARAM = 'ct'
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/core/open_api.py:453` | `attribute` | None supplied |
| `server/vueda/core/viewsets/__init__.py:348` | `attribute` | None supplied |
| `server/vueda/core/viewsets/__init__.py:1309` | `attribute` | None supplied |
### CORS_ALLOW_CREDENTIALS {#setting-cors-allow-credentials}
Allows credentials in cross-origin requests accepted by the CORS middleware.
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:396`.
```python
CORS_ALLOW_CREDENTIALS = True
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/core/middleware.py:73` | `attribute` | None supplied |
### CORS_ALLOW_HEADERS {#setting-cors-allow-headers}
Request headers allowed by the CORS middleware, including VUEDA’s dry-run and acknowledge-warnings headers.
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:381`.
```python
CORS_ALLOW_HEADERS = ['accept', 'accept-encoding', 'content-type', 'user-agent', 'x-csrftoken', 'x-requested-with', 'dry-run', 'acknowledge-warnings']
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/core/middleware.py:70` | `attribute` | None supplied |
### CORS_ALLOW_METHODS {#setting-cors-allow-methods}
HTTP methods allowed by the CORS middleware.
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:373`.
```python
CORS_ALLOW_METHODS = ['DELETE', 'GET', 'OPTIONS', 'PATCH', 'POST', 'PUT']
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/core/middleware.py:72` | `attribute` | None supplied |
### CORS_ALLOWED_ORIGINS {#setting-cors-allowed-origins}
Origins allowed by the configured CORS middleware for HTTP and ASGI requests.
Config input: [`CORS_ALLOWED_ORIGINS`](/v3/reference/configuration.md#config-cors-allowed-origins).
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:372`.
```python
CORS_ALLOWED_ORIGINS = env.list('CORS_ALLOWED_ORIGINS')
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/core/middleware.py:69` | `attribute` | None supplied |
### CORS_EXPOSE_HEADERS {#setting-cors-expose-headers}
Response headers readable by cross-origin browser clients. The factory exposes content-disposition and retry-after.
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:391`.
```python
CORS_EXPOSE_HEADERS = ['content-disposition', 'retry-after']
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/core/middleware.py:71` | `attribute` | None supplied |
### CORS_PREFLIGHT_MAX_AGE {#setting-cors-preflight-max-age}
Lifetime in seconds of cached CORS preflight results. DEBUG reduces the factory value from 86400 to 600.
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:395`.
```python
CORS_PREFLIGHT_MAX_AGE = 86400
```
Base defaults; `return_dict['DEBUG']`. Source: `server/vueda/core/default_settings.py:419`.
```python
CORS_PREFLIGHT_MAX_AGE = 600
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/core/middleware.py:74` | `attribute` | None supplied |
### DATABASE_BACKUP_DIR {#setting-database-backup-dir}
Directory where the VUEDA update command writes a PostgreSQL backup before applying migrations.
Config input: [`DATABASE_BACKUP_DIR`](/v3/reference/configuration.md#config-database-backup-dir).
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:399`.
```python
DATABASE_BACKUP_DIR = env('DATABASE_BACKUP_DIR')
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/update.py:235` | `attribute` | None supplied |
### DATABASES {#setting-databases}
The update command reads the default database connection to create backups.
Config input: [`DATABASE_URL`](/v3/reference/configuration.md#config-database-url).
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:182`.
```python
DATABASES = {'default': env.dj_db_url('DATABASE_URL')}
```
Base defaults. Source: `server/vueda/core/default_settings.py:492`.
```python
DATABASES["default"]["ATOMIC_REQUESTS"] = True
```
Base defaults; `'OPTIONS' not in return_dict['DATABASES']['default']`. Source: `server/vueda/core/default_settings.py:494`.
```python
DATABASES["default"]["OPTIONS"] = {}
```
Base defaults; `return_dict['DATABASES']['default'].get('ENGINE') in _POSTGRES_ENGINES`. Source: `server/vueda/core/default_settings.py:496`.
```python
DATABASES["default"]["OPTIONS"]["isolation_level"] = IsolationLevel.REPEATABLE_READ
```
Base defaults. Source: `server/vueda/core/default_settings.py:498`.
```python
DATABASES["default"]["CONN_MAX_AGE"] = 0
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/update.py:236` | `attribute` | None supplied |
| `server/vueda/update.py:237` | `attribute` | None supplied |
### DEBUG {#setting-debug}
Enables Django debug mode and VUEDA debug routes and exception details. Also lowers the CORS preflight cache lifetime to 600 seconds.
Config input: [`DEBUG`](/v3/reference/configuration.md#config-debug).
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:135`.
```python
DEBUG = env.bool('DEBUG', default=False)
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/core/checks.py:462` | `attribute` | None supplied |
| `server/vueda/core/exceptions.py:95` | `attribute` | None supplied |
| `server/vueda/core/exceptions.py:99` | `attribute` | None supplied |
| `server/vueda/info/urls.py:24` | `attribute` | None supplied |
| `server/vueda/update.py:295` | `attribute` | None supplied |
| `server/vueda/update.py:349` | `attribute` | None supplied |
| `server/vueda/update.py:472` | `attribute` | None supplied |
| `server/vueda/update.py:492` | `attribute` | None supplied |
| `server/vueda/update.py:535` | `attribute` | None supplied |
| `server/vueda/user/urls.py:50` | `attribute` | None supplied |
| `server/vueda/workflow/urls.py:20` | `attribute` | None supplied |
### EMAIL_BACKEND {#setting-email-backend}
Email backend class path. The console backend prints messages during development. With use_mailers=True, the factory places this value in MAILERS.default.BACKEND; otherwise it sets EMAIL_BACKEND. Selecting the Mailgun backend also reads the ANYMAIL_MAILGUN_* keys and ANYMAIL_WEBHOOK_SECRET.
Config input: [`EMAIL_BACKEND`](/v3/reference/configuration.md#config-email-backend).
Factory declarations and overrides
Base defaults; `not (use_mailers)`. Source: `server/vueda/core/default_settings.py:406`.
```python
EMAIL_BACKEND = email_backend
```
### EMAIL_SUBJECT_PREFIX {#setting-email-subject-prefix}
Prefix for account email subjects. When empty, the user adapter uses SITE_NAME in square brackets.
Config input: [`EMAIL_SUBJECT_PREFIX`](/v3/reference/configuration.md#config-email-subject-prefix).
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:190`.
```python
EMAIL_SUBJECT_PREFIX = env('EMAIL_SUBJECT_PREFIX', default='')
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/user/adapters.py:116` | `attribute` | None supplied |
### EMAIL_TIMEOUT {#setting-email-timeout}
Email timeout in seconds supplied when use_mailers=False.
Factory declarations and overrides
Base defaults; `not (use_mailers)`. Source: `server/vueda/core/default_settings.py:407`.
```python
EMAIL_TIMEOUT = 5
```
### FRONTEND_DOMAIN {#setting-frontend-domain}
Frontend origin prepended to login and password-reset paths in account emails.
Config input: [`FRONTEND_DOMAIN`](/v3/reference/configuration.md#config-frontend-domain).
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:173`.
```python
FRONTEND_DOMAIN = env('FRONTEND_DOMAIN')
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/user/models.py:126` | `attribute` | None supplied |
| `server/vueda/user/models.py:139` | `attribute` | None supplied |
### FRONTEND_LOGIN_URL {#setting-frontend-login-url}
Frontend login path used in account emails, appended to FRONTEND_DOMAIN.
Config input: [`FRONTEND_LOGIN_URL`](/v3/reference/configuration.md#config-frontend-login-url).
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:174`.
```python
FRONTEND_LOGIN_URL = env('FRONTEND_LOGIN_URL')
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/user/models.py:126` | `attribute` | None supplied |
### FRONTEND_RESET_URL {#setting-frontend-reset-url}
Frontend password-reset path used to build the reset link with its token and user identifier.
Config input: [`FRONTEND_RESET_URL`](/v3/reference/configuration.md#config-frontend-reset-url).
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:175`.
```python
FRONTEND_RESET_URL = env('FRONTEND_RESET_URL', '/reset-password')
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/user/models.py:139` | `attribute` | None supplied |
### IN_TESTS {#setting-in-tests}
Treat exception handling as a test environment even when DEBUG is false. Includes diagnostic tracebacks in responses and suppresses Sentry capture of ValidationError exceptions.
The defaults factories do not set this Django setting.
Local fallback values: `False`. These apply only at the read sites that supply them.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/core/exceptions.py:95` | `getattr` | `False` |
| `server/vueda/core/exceptions.py:99` | `getattr` | `False` |
### INSTALLED_APPS {#setting-installed-apps}
Assembled from DJANGO_APPS, VUEDA_APPS, THIRD_PARTY_APPS, and LOCAL_APPS. VUEDA uses it to detect optional application behavior.
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:532`.
```python
INSTALLED_APPS = return_dict['DJANGO_APPS'] + return_dict['VUEDA_APPS'] + return_dict['THIRD_PARTY_APPS'] + return_dict['LOCAL_APPS']
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/core/installed_apps.py:22` | `attribute` | None supplied |
| `server/vueda/user/mixins.py:50` | `attribute` | None supplied |
### LOCAL_APPS {#setting-local-apps}
Project applications appended to INSTALLED_APPS. VUEDA also uses this list to group models in the permissions overview.
Config input: [`LOCAL_APPS`](/v3/reference/configuration.md#config-local-apps).
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:296`.
```python
LOCAL_APPS = env.list('LOCAL_APPS', default=[])
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/user/views.py:363` | `attribute` | None supplied |
### MAILERS {#setting-mailers}
With use_mailers=True, the factory creates the default mailer and its timeout option.
Config input: [`EMAIL_BACKEND`](/v3/reference/configuration.md#config-email-backend).
Factory declarations and overrides
Base defaults; `use_mailers`. Source: `server/vueda/core/default_settings.py:404`.
```python
MAILERS = {'default': {'BACKEND': email_backend, 'OPTIONS': {'timeout': 5}}}
```
### MAX_PAGE_SIZE {#setting-max-page-size}
Maximum requested page size. VUEDA also uses it when computing pagination metadata and documenting page-size defaults.
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:359`.
```python
MAX_PAGE_SIZE = 200
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/core/open_api.py:380` | `attribute` | None supplied |
| `server/vueda/core/pagination.py:22` | `attribute` | None supplied |
| `server/vueda/core/pagination.py:37` | `attribute` | None supplied |
| `server/vueda/core/pagination.py:68` | `attribute` | None supplied |
| `server/vueda/core/spectacular_hooks.py:105` | `attribute` | None supplied |
| `server/vueda/info/serializers.py:1748` | `attribute` | None supplied |
| `server/vueda/info/serializers.py:1759` | `attribute` | None supplied |
| `server/vueda/info/serializers.py:1915` | `attribute` | None supplied |
| `server/vueda/info/serializers.py:1929` | `attribute` | None supplied |
| `server/vueda/info/serializers.py:2049` | `attribute` | None supplied |
| `server/vueda/info/serializers.py:2063` | `attribute` | None supplied |
### MIDDLEWARE {#setting-middleware}
Default Django, CORS, allauth, and VUEDA history middleware. The factory inserts VuedaHistoryMiddleware immediately after AuthenticationMiddleware to record the actor and request. History checks validate its presence and order. User decorators also check for CSRF middleware.
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:242`.
```python
MIDDLEWARE = ['corsheaders.middleware.CorsMiddleware', 'django.middleware.security.SecurityMiddleware', 'django.contrib.sessions.middleware.SessionMiddleware', 'django.middleware.locale.LocaleMiddleware', 'django.middleware.common.CommonMiddleware', 'django.middleware.csrf.CsrfViewMiddleware', 'django.contrib.auth.middleware.AuthenticationMiddleware', 'django.contrib.messages.middleware.MessageMiddleware', 'django.middleware.common.BrokenLinkEmailsMiddleware', 'allauth.account.middleware.AccountMiddleware']
```
Base defaults. Source: `server/vueda/core/default_settings.py:519`.
```python
MIDDLEWARE = middleware
```
Local fallback values: `None`. These apply only at the read sites that supply them.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/history/checks.py:36` | `getattr` | `None` |
| `server/vueda/user/decorators.py:19` | `attribute` | None supplied |
### NO_REPLY_EMAIL {#setting-no-reply-email}
Sender address for user account email and the SYSTEM sender record used by VDQ.
Config input: [`NO_REPLY_EMAIL`](/v3/reference/configuration.md#config-no-reply-email).
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:203`.
```python
NO_REPLY_EMAIL = env('NO_REPLY_EMAIL')
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/user/adapters.py:148` | `attribute` | None supplied |
| `server/vueda/user/adapters.py:167` | `attribute` | None supplied |
### PAGE_QUERY_PARAM {#setting-page-query-param}
Query parameter for the requested page. Server schemas and request validation use this name. A change requires a matching client constant change.
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:361`.
```python
PAGE_QUERY_PARAM = 'p'
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/core/open_api.py:374` | `attribute` | None supplied |
| `server/vueda/core/pagination.py:20` | `attribute` | None supplied |
| `server/vueda/core/viewsets/__init__.py:1300` | `attribute` | None supplied |
### PAGE_SIZE_QUERY_PARAM {#setting-page-size-query-param}
Query parameter for the requested page size. Server schemas and request validation use this name. A change requires a matching client constant change.
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:360`.
```python
PAGE_SIZE_QUERY_PARAM = 'ps'
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/core/open_api.py:379` | `attribute` | None supplied |
| `server/vueda/core/pagination.py:21` | `attribute` | None supplied |
| `server/vueda/core/viewsets/__init__.py:1301` | `attribute` | None supplied |
### PERMISSION_NAMES_MAPPING {#setting-permission-names-mapping}
Maps Django permission verbs to VUEDA CRUDL verbs (create, read, update, delete, and list). The factory remaps add, change, and view. Runtime authorization and metadata read this mapping. Set it before importing vueda.core.patch_django; changing it does not rename existing permission rows.
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:236`.
```python
PERMISSION_NAMES_MAPPING = {'add': 'create', 'change': 'update', 'view': 'read'}
```
Local fallback values: `None`. These apply only at the read sites that supply them.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/core/checks.py:503` | `getattr` | `None` |
| `server/vueda/core/patch_django.py:31` | `attribute` | None supplied |
| `server/vueda/core/patch_django.py:119` | `attribute` | None supplied |
| `server/vueda/core/permissions.py:394` | `attribute` | None supplied |
| `server/vueda/core/permissions.py:395` | `attribute` | None supplied |
| `server/vueda/info/serializers.py:208` | `attribute` | None supplied |
| `server/vueda/info/serializers.py:209` | `attribute` | None supplied |
| `server/vueda/info/serializers.py:212` | `attribute` | None supplied |
| `server/vueda/info/serializers.py:213` | `attribute` | None supplied |
| `server/vueda/info/viewsets.py:306` | `attribute` | None supplied |
| `server/vueda/info/viewsets.py:307` | `attribute` | None supplied |
| `server/vueda/info/viewsets.py:310` | `attribute` | None supplied |
| `server/vueda/info/viewsets.py:311` | `attribute` | None supplied |
| `server/vueda/info/viewsets.py:558` | `attribute` | None supplied |
| `server/vueda/info/viewsets.py:559` | `attribute` | None supplied |
| `server/vueda/info/viewsets.py:562` | `attribute` | None supplied |
| `server/vueda/info/viewsets.py:563` | `attribute` | None supplied |
### PGHISTORY_APPEND_ONLY {#setting-pghistory-append-only}
Requires tracked event rows to remain immutable. The factory sets this to True to match the trigger operations in shipped migrations.
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:523`.
```python
PGHISTORY_APPEND_ONLY = True
```
### PGHISTORY_CREATED_AT_FUNCTION {#setting-pghistory-created-at-function}
Uses clock_timestamp() so each event records its write time, rather than the transaction start time. This matches the trigger operations in shipped migrations.
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:529`.
```python
PGHISTORY_CREATED_AT_FUNCTION = 'clock_timestamp()'
```
### QUEUE_ITEM_SERIALIZER {#setting-queue-item-serializer}
Serializer class object for queued items, selected at module import time. Supply the class itself, not a dotted import string.
The defaults factories do not set this Django setting.
Local fallback values: `DefaultQueueItemSerializer`. These apply only at the read sites that supply them.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/vdq/serializers.py:122` | `getattr` | `DefaultQueueItemSerializer` |
### REST_AUTH {#setting-rest-auth}
Authentication serializer defaults. The who-is endpoint imports USER_DETAILS_SERIALIZER, with vueda.user.serializers.WhoIsSerializer as its fallback when the dictionary omits that key.
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:339`.
```python
REST_AUTH = {'LOGIN_SERIALIZER': 'vueda.user.serializers.LoginSerializer', 'USER_DETAILS_SERIALIZER': 'vueda.user.serializers.WhoIsSerializer', 'TOKEN_MODEL': None, 'TOKEN_SERIALIZER': 'vueda.user.serializers.VuedaTokenSerializer', 'OLD_PASSWORD_FIELD_ENABLED': True}
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/user/views.py:119` | `attribute` | None supplied |
### REST_FLEX_FIELDS2 {#setting-rest-flex-fields2}
Names of the expand, selected-field, and omitted-field query parameters, plus the maximum expansion depth. VUEDA reads these for serialization, request validation, metadata, and OpenAPI. Query names must agree with the client.
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:346`.
```python
REST_FLEX_FIELDS2 = {'EXPAND_PARAM': 'e', 'FIELDS_PARAM': 'f', 'OMIT_PARAM': 'om', 'MAXIMUM_EXPANSION_DEPTH': 4}
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/core/open_api.py:616` | `attribute` | None supplied |
| `server/vueda/core/serializers/__init__.py:675` | `attribute` | None supplied |
| `server/vueda/core/serializers/__init__.py:680` | `attribute` | None supplied |
| `server/vueda/core/serializers/__init__.py:691` | `attribute` | None supplied |
| `server/vueda/core/serializers/__init__.py:757` | `attribute` | None supplied |
| `server/vueda/core/serializers/__init__.py:777` | `attribute` | None supplied |
| `server/vueda/core/serializers/__init__.py:847` | `attribute` | None supplied |
| `server/vueda/core/serializers/__init__.py:1265` | `attribute` | None supplied |
| `server/vueda/core/serializers/__init__.py:1266` | `attribute` | None supplied |
| `server/vueda/core/spectacular_hooks.py:18` | `attribute` | None supplied |
| `server/vueda/core/spectacular_hooks.py:135` | `attribute` | None supplied |
| `server/vueda/core/viewsets/__init__.py:595` | `attribute` | None supplied |
| `server/vueda/core/viewsets/__init__.py:1302` | `attribute` | None supplied |
| `server/vueda/core/viewsets/__init__.py:1303` | `attribute` | None supplied |
| `server/vueda/core/viewsets/__init__.py:1304` | `attribute` | None supplied |
| `server/vueda/core/viewsets/__init__.py:1315` | `attribute` | None supplied |
| `server/vueda/core/viewsets/__init__.py:1316` | `attribute` | None supplied |
| `server/vueda/core/viewsets/__init__.py:1317` | `attribute` | None supplied |
| `server/vueda/core/viewsets/__init__.py:1354` | `attribute` | None supplied |
| `server/vueda/core/viewsets/__init__.py:1355` | `attribute` | None supplied |
| `server/vueda/core/viewsets/__init__.py:1357` | `attribute` | None supplied |
| `server/vueda/core/viewsets/__init__.py:1359` | `attribute` | None supplied |
| `server/vueda/core/viewsets/__init__.py:1373` | `attribute` | None supplied |
| `server/vueda/core/viewsets/__init__.py:1394` | `attribute` | None supplied |
| `server/vueda/info/schema.py:135` | `attribute` | None supplied |
| `server/vueda/info/serializers.py:559` | `attribute` | None supplied |
| `server/vueda/info/serializers.py:1625` | `attribute` | None supplied |
| `server/vueda/workflow/schema.py:28` | `attribute` | None supplied |
| `server/vueda/workflow/serializers.py:96` | `attribute` | None supplied |
| `server/vueda/workflow/serializers.py:105` | `attribute` | None supplied |
### REST_FRAMEWORK {#setting-rest-framework}
VUEDA defaults for DRF renderers, authentication, pagination, filtering, permissions, throttling, and exception handling. VUEDA reads PAGE_SIZE, SEARCH_PARAM, and ORDERING_PARAM directly. Query names must agree with the client. When drf_spectacular imports successfully, the factory adds DEFAULT_SCHEMA_CLASS.
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:309`.
```python
REST_FRAMEWORK = {'DEFAULT_THROTTLE_RATES': {'change_password': '5/min', 'forgot_password': '20/hour', 'totp_send_destination': '5/hour', 'totp_send_user': '5/hour'}, 'NON_FIELD_ERRORS_KEY': 'non_field_errors', 'DEFAULT_RENDERER_CLASSES': ['vueda.core.renderers.VuedaJSONRenderer'], 'DEFAULT_AUTHENTICATION_CLASSES': ['rest_framework.authentication.SessionAuthentication'], 'DEFAULT_PAGINATION_CLASS': 'vueda.core.pagination.VUEDAPageNumberPagination', 'PAGE_SIZE': 100, 'SEARCH_PARAM': 's', 'DEFAULT_FILTER_BACKENDS': ('vueda.core.filters.VuedaOrderingFilter', 'vueda.core.filters.VuedaSearchFilterBackend', 'django_filters.rest_framework.DjangoFilterBackend'), 'DEFAULT_PERMISSION_CLASSES': ['vueda.core.permissions.ObjectPermissions'], 'UPLOADED_FILES_USE_URL': True, 'EXCEPTION_HANDLER': 'vueda.core.exceptions.debug_stack_exception_handler', 'ORDERING_PARAM': 'o'}
```
Base defaults; `imports succeed: import drf_spectacular`. Source: `server/vueda/core/default_settings.py:458`.
```python
REST_FRAMEWORK["DEFAULT_SCHEMA_CLASS"] = 'vueda.core.open_api.VuedaAutoSchema'
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/core/open_api.py:395` | `attribute` | None supplied |
| `server/vueda/core/open_api.py:396` | `attribute` | None supplied |
| `server/vueda/core/pagination.py:19` | `attribute` | None supplied |
| `server/vueda/core/viewsets/__init__.py:1305` | `attribute` | None supplied |
| `server/vueda/core/viewsets/__init__.py:1306` | `attribute` | None supplied |
### SEND_QUEUE_VIEWSET {#setting-send-queue-viewset}
Viewset class object for queued items, selected at module import time. Supply the class itself, not a dotted import string.
The defaults factories do not set this Django setting.
Local fallback values: `DefaultSendQueueViewSet`. These apply only at the read sites that supply them.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/vdq/viewsets.py:58` | `getattr` | `DefaultSendQueueViewSet` |
### SENT_ITEM_SERIALIZER {#setting-sent-item-serializer}
Serializer class object for sent items, selected at module import time. Supply the class itself, not a dotted import string.
The defaults factories do not set this Django setting.
Local fallback values: `DefaultSentItemSerializer`. These apply only at the read sites that supply them.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/vdq/serializers.py:153` | `getattr` | `DefaultSentItemSerializer` |
### SENT_ITEM_VIEWSET {#setting-sent-item-viewset}
Viewset class object for sent items, selected at module import time. Supply the class itself, not a dotted import string.
The defaults factories do not set this Django setting.
Local fallback values: `DefaultSentItemViewSet`. These apply only at the read sites that supply them.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/vdq/viewsets.py:95` | `getattr` | `DefaultSentItemViewSet` |
### SESSION_CACHE_ALIAS {#setting-session-cache-alias}
Cache alias inspected by VUEDA’s production session-cache check. The local fallback is default, matching Django’s session cache alias.
The defaults factories do not set this Django setting.
Local fallback values: `'default'`. These apply only at the read sites that supply them.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/core/checks.py:467` | `getattr` | `'default'` |
### SESSION_ENGINE {#setting-session-engine}
The factory selects cache-backed sessions. Production checks reject a process-local session cache.
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:191`.
```python
SESSION_ENGINE = 'django.contrib.sessions.backends.cache'
```
Local fallback values: `''`. These apply only at the read sites that supply them.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/core/checks.py:464` | `getattr` | `''` |
### SITE_NAME {#setting-site-name}
Site name in account email templates and the fallback email subject prefix.
Config input: [`SITE_NAME`](/v3/reference/configuration.md#config-site-name).
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:200`.
```python
SITE_NAME = env('SITE_NAME')
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/user/adapters.py:118` | `attribute` | None supplied |
| `server/vueda/user/adapters.py:136` | `attribute` | None supplied |
| `server/vueda/user/adapters.py:185` | `attribute` | None supplied |
### SPECTACULAR_SETTINGS {#setting-spectacular-settings}
OpenAPI title, tags, schema options, and hooks supplied only when drf_spectacular imports successfully. Tags depend on the selected VUEDA_APPS.
Factory declarations and overrides
Base defaults; `imports succeed: import drf_spectacular`. Source: `server/vueda/core/default_settings.py:459`.
```python
SPECTACULAR_SETTINGS = {'TITLE': 'VUEDA API', 'DESCRIPTION': "VUEDA is designed for projects that integrate Vue.js frontends with Django REST Framework backends. This server library enhances Django's native authentication and permissions systems with default DRF classes and optimizes integration with django-filter, drf-flex-fields2, and drf-writable-nested. It offers essential out-of-the-box functionalities such as custom workflow management, audit trails (with DRF support for django-pghistory), and row-level permissions. Additionally, vueda-server provides DRF classes to expose Django model details to the frontend, filtered by user permissions. It is built with customization in mind, offering most features as base classes that can be extended in your application, ensuring both control and adaptability.", 'VERSION': '1.0.0', 'TAGS': spectacular_tags, 'COMPONENT_SPLIT_PATCH': False, 'SHOW_REQUEST_BODY': True, 'SHOW_RESPONSE_BODY': True, 'DEFAULT_MODEL_DEPTH': None, 'SERVE_INCLUDE_SCHEMA': False, 'PARSER_WHITELIST': ['rest_framework.parsers.JSONParser'], 'PREPROCESSING_HOOKS': ['vueda.core.spectacular_hooks.preprocessing_hooks', 'vueda.core.spectacular_hooks.register_cart_with_model_info'], 'POSTPROCESSING_HOOKS': ['drf_spectacular.hooks.postprocess_schema_enums', 'vueda.core.spectacular_hooks.postprocess_schema_components'], 'SORT_OPERATION_PARAMETERS': False}
```
### SUPPORT_EMAIL {#setting-support-email}
Support address inserted into account email context.
Config input: [`SUPPORT_EMAIL`](/v3/reference/configuration.md#config-support-email).
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:201`.
```python
SUPPORT_EMAIL = env('SUPPORT_EMAIL')
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/user/models.py:127` | `attribute` | None supplied |
### TWILIO_ACCOUNT_SID {#setting-twilio-account-sid}
Twilio account identifier. VDQ initializes its Twilio client and status polling only when this value is nonempty and the Twilio package is available.
Config input: [`TWILIO_ACCOUNT_SID`](/v3/reference/configuration.md#config-twilio-account-sid).
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:132`.
```python
TWILIO_ACCOUNT_SID = env('TWILIO_ACCOUNT_SID', default='')
```
Local fallback values: `None`. These apply only at the read sites that supply them.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/user/adapters.py:210` | `attribute` | None supplied |
| `server/vueda/user/utils.py:34` | `getattr` | `None` |
| `server/vueda/vdq/celery.py:34` | `getattr` | `None` |
| `server/vueda/vdq/celery.py:40` | `getattr` | `None` |
| `server/vueda/vdq/handlers.py:189` | `getattr` | `None` |
| `server/vueda/vdq/handlers.py:191` | `attribute` | None supplied |
### TWILIO_AUTH_TOKEN {#setting-twilio-auth-token}
Twilio credential used to send SMS messages and validate incoming webhook signatures.
Config input: [`TWILIO_AUTH_TOKEN`](/v3/reference/configuration.md#config-twilio-auth-token).
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:134`.
```python
TWILIO_AUTH_TOKEN = env('TWILIO_AUTH_TOKEN', default='')
```
Local fallback values: `None`. These apply only at the read sites that supply them.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/user/adapters.py:210` | `attribute` | None supplied |
| `server/vueda/user/utils.py:35` | `getattr` | `None` |
| `server/vueda/vdq/handlers.py:192` | `attribute` | None supplied |
| `server/vueda/vdq/views.py:48` | `attribute` | None supplied |
### TWILIO_CALLER_ID {#setting-twilio-caller-id}
Sender phone number for user account SMS messages and the SYSTEM sender record.
Config input: [`TWILIO_CALLER_ID`](/v3/reference/configuration.md#config-twilio-caller-id).
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:133`.
```python
TWILIO_CALLER_ID = env('TWILIO_CALLER_ID', default='')
```
Local fallback values: `None`. These apply only at the read sites that supply them.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/user/adapters.py:199` | `attribute` | None supplied |
| `server/vueda/user/adapters.py:213` | `attribute` | None supplied |
| `server/vueda/user/utils.py:36` | `getattr` | `None` |
### TWILIO_WEBHOOK_URL {#setting-twilio-webhook-url}
Twilio SMS status callback URL. A truthy URL enables webhook-based status updates with timeout polling; a false value selects status polling. Configure the URL when using Twilio callbacks.
The defaults factories do not set this Django setting.
Local fallback values: `False`. These apply only at the read sites that supply them.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/vdq/celery.py:35` | `getattr` | `False` |
| `server/vueda/vdq/celery.py:40` | `getattr` | `False` |
| `server/vueda/vdq/handlers.py:207` | `getattr` | `False` |
### VDQ_EMAIL_TRACKING_STRATEGY {#setting-vdq-email-tracking-strategy}
Class, or dotted import path of the class, that attaches the queue item's key to an outgoing email and reads it back from an Anymail tracking event. The read site falls back to vueda.vdq.tracking.MetadataEmailTrackingStrategy, which carries the key in Anymail metadata. Set vueda.vdq.tracking.EmailTrackingStrategy to send without tracking data on an ESP that accepts no metadata.
The defaults factories do not set this Django setting.
Local fallback values: `MetadataEmailTrackingStrategy`. These apply only at the read sites that supply them.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/vdq/tracking.py:65` | `getattr` | `MetadataEmailTrackingStrategy` |
### VDQ_MAX_FILES_AGE_IN_SECONDS {#setting-vdq-max-files-age-in-seconds}
A value of zero deletes queue attachment files when an item reaches a done state. The current read site does nothing for None or positive values; this setting alone does not schedule age-based cleanup.
The defaults factories do not set this Django setting.
Local fallback values: `None`. These apply only at the read sites that supply them.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/vdq/models.py:155` | `getattr` | `None` |
### VDQ_TWILIO_SMS_TIMEOUT_HOURS {#setting-vdq-twilio-sms-timeout-hours}
Time in hours before awaiting SMS messages time out. Also determines the retry count of the unknown-message check task. The task class reads it at import time.
The defaults factories do not set this Django setting.
Local fallback values: `2`. These apply only at the read sites that supply them.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/vdq/handlers.py:275` | `getattr` | `2` |
| `server/vueda/vdq/handlers.py:311` | `getattr` | `2` |
| `server/vueda/vdq/tasks.py:184` | `getattr` | `2` |
### VDQ_URL {#setting-vdq-url}
VDQ URL prefix used to build attachment download URLs. Supply it when serializing queue attachments; neither get_defaults nor the read site supplies a fallback.
The defaults factories do not set this Django setting.
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/vdq/serializers.py:60` | `attribute` | None supplied |
### VUEDA_USER_ADAPTER {#setting-vueda-user-adapter}
Class path for the user adapter that implements VUEDA account operations.
Config input: [`VUEDA_USER_ADAPTER`](/v3/reference/configuration.md#config-vueda-user-adapter).
Factory declarations and overrides
Base defaults. Source: `server/vueda/core/default_settings.py:278`.
```python
VUEDA_USER_ADAPTER = env('VUEDA_USER_ADAPTER', default='vueda.user.adapters.DefaultUserAdapter')
```
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/user/adapters.py:223` | `attribute` | None supplied |
### VUEDA_VDQ_RECEIVER_MODEL {#setting-vueda-vdq-receiver-model}
Swapper model label for the VDQ receiver. Swapper supplies vueda_vdq.Receiver when no override exists; VUEDA migration files read the setting directly. Choose the replacement model before creating project migrations.
The defaults factories do not set this Django setting.
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/vdq/migrations/0001_initial.py:170` | `attribute` | None supplied |
| `server/vueda/vdq/migrations/0001_initial.py:186` | `attribute` | None supplied |
| `server/vueda/vdq/migrations/0001_initial.py:212` | `attribute` | None supplied |
| `server/vueda/vdq/migrations/0001_initial.py:228` | `attribute` | None supplied |
| `server/vueda/vdq/migrations/0001_initial.py:254` | `attribute` | None supplied |
| `server/vueda/vdq/migrations/0001_initial.py:270` | `attribute` | None supplied |
| `server/vueda/vdq/migrations/0001_initial.py:309` | `attribute` | None supplied |
| `server/vueda/vdq/migrations/0007_queueitemevent_receiverevent_senderevent_and_more.py:253` | `attribute` | None supplied |
| `server/vueda/vdq/migrations/0007_queueitemevent_receiverevent_senderevent_and_more.py:285` | `attribute` | None supplied |
### VUEDA_VDQ_SENDER_MODEL {#setting-vueda-vdq-sender-model}
Swapper model label for the VDQ sender. Swapper supplies vueda_vdq.Sender when no override exists; VUEDA migration files read the setting directly. Choose the replacement model before creating project migrations.
The defaults factories do not set this Django setting.
No fallback at the direct read sites. The setting must exist when those reads execute.
Read locations
| Source | Access | Local fallback |
| --- | --- | --- |
| `server/vueda/vdq/migrations/0001_initial.py:316` | `attribute` | None supplied |
| `server/vueda/vdq/migrations/0007_queueitemevent_receiverevent_senderevent_and_more.py:264` | `attribute` | None supplied |
| `server/vueda/vdq/migrations/0007_queueitemevent_receiverevent_senderevent_and_more.py:306` | `attribute` | None supplied |
## Django exemptions
- `MIGRATION_MODULES`: Django migration module overrides retain their Django meaning in migration discovery and generation.