{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/daytona-io/json-schema/daytona-io-daytona-configuration-schema.json",
  "title": "DaytonaConfiguration",
  "x-generated": "2026-11-10",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/daytona-io-config-api-openapi.yml#/components/schemas/DaytonaConfiguration",
  "properties": {
    "version": {
      "description": "Daytona version",
      "type": "string"
    },
    "buildSha": {
      "description": "Commit sha of the source the app was built from",
      "type": "string"
    },
    "posthog": {
      "allOf": [
        {
          "$ref": "#/$defs/PosthogConfig"
        }
      ],
      "description": "PostHog configuration"
    },
    "oidc": {
      "allOf": [
        {
          "$ref": "#/$defs/OidcConfig"
        }
      ],
      "description": "OIDC configuration"
    },
    "ssoOidc": {
      "allOf": [
        {
          "$ref": "#/$defs/SsoOidcConfig"
        }
      ],
      "description": "OIDC configuration for org-SSO logins (Daytona Auth issuer). Present only when the secondary (org-SSO) issuer is configured; the dashboard uses it as its authority when entered via an organization SSO link."
    },
    "forcedFeatureFlags": {
      "description": "Feature flags forced on for this deployment regardless of PostHog targeting. Lets environments without PostHog (previews, local dev) enable flag-gated dashboard features.",
      "items": {
        "type": "string"
      },
      "type": "array"
    },
    "linkedAccountsEnabled": {
      "description": "Whether linked accounts are enabled",
      "type": "boolean"
    },
    "announcements": {
      "additionalProperties": {
        "$ref": "#/$defs/Announcement"
      },
      "description": "System announcements",
      "type": "object"
    },
    "pylonAppId": {
      "description": "Pylon application ID",
      "type": "string"
    },
    "proxyTemplateUrl": {
      "description": "Proxy template URL",
      "type": "string"
    },
    "proxyToolboxUrl": {
      "description": "Toolbox template URL",
      "type": "string"
    },
    "defaultSnapshot": {
      "description": "Default snapshot for sandboxes",
      "type": "string"
    },
    "dashboardUrl": {
      "description": "Dashboard URL",
      "type": "string"
    },
    "maxAutoArchiveInterval": {
      "description": "Maximum auto-archive interval in minutes",
      "type": "number"
    },
    "maintananceMode": {
      "description": "Whether maintenance mode is enabled",
      "type": "boolean"
    },
    "environment": {
      "description": "Current environment",
      "type": "string"
    },
    "billingApiUrl": {
      "description": "Billing API URL",
      "type": "string"
    },
    "analyticsApiUrl": {
      "description": "Analytics API URL",
      "type": "string"
    },
    "stripePublishableKey": {
      "description": "Stripe publishable key for client-side Stripe.js",
      "type": "string"
    },
    "sshGatewayCommand": {
      "description": "SSH Gateway command",
      "type": "string"
    },
    "sshGatewayPublicKey": {
      "description": "Base64 encoded SSH Gateway public key",
      "type": "string"
    },
    "sshGatewayHost": {
      "description": "Hostname of the SSH Gateway that sandbox SSH connections terminate at",
      "type": "string"
    },
    "sshGatewayPort": {
      "description": "TCP port of the SSH Gateway",
      "type": "number"
    },
    "sshGatewayHostKeys": {
      "description": "SSH host public keys presented by the SSH Gateway, as OpenSSH public key lines (`<type> <base64>`). To build a known_hosts entry, prefix each with `sshGatewayHost` when `sshGatewayPort` is 22, or with `[sshGatewayHost]:sshGatewayPort` otherwise.",
      "items": {
        "type": "string"
      },
      "type": "array"
    },
    "sshGatewayHostKeyFingerprints": {
      "description": "SHA256 fingerprints of sshGatewayHostKeys, in the same order, in `ssh-keygen -lf` format. Compare against the fingerprint published at https://github.com/daytona/.github/blob/main/SECURITY.md#ssh-host-key-verification",
      "items": {
        "type": "string"
      },
      "type": "array"
    },
    "rateLimit": {
      "allOf": [
        {
          "$ref": "#/$defs/RateLimitConfig"
        }
      ],
      "description": "Rate limit configuration"
    }
  },
  "required": [
    "announcements",
    "dashboardUrl",
    "defaultSnapshot",
    "environment",
    "linkedAccountsEnabled",
    "maintananceMode",
    "maxAutoArchiveInterval",
    "oidc",
    "proxyTemplateUrl",
    "proxyToolboxUrl",
    "version"
  ],
  "type": "object",
  "$defs": {
    "Announcement": {
      "properties": {
        "text": {
          "description": "The announcement text",
          "type": "string"
        },
        "learnMoreUrl": {
          "description": "URL to learn more about the announcement",
          "type": "string"
        }
      },
      "required": [
        "text"
      ],
      "type": "object"
    },
    "CliOidcConfig": {
      "properties": {
        "issuer": {
          "description": "WorkOS issuer of the Daytona CLI application",
          "type": "string"
        },
        "clientId": {
          "description": "WorkOS client ID of the Daytona CLI application",
          "type": "string"
        }
      },
      "required": [
        "clientId",
        "issuer"
      ],
      "type": "object"
    },
    "OidcConfig": {
      "properties": {
        "issuer": {
          "description": "OIDC issuer",
          "type": "string"
        },
        "clientId": {
          "description": "OIDC client ID",
          "type": "string"
        },
        "audience": {
          "description": "OIDC audience",
          "type": "string"
        },
        "provider": {
          "description": "Which identity provider the advertised issuer above belongs to. The dashboard needs this because provider-specific logout URLs are not discoverable from the issuer alone: ending an Auth0 session uses its proprietary /v2/logout, which does not exist on WorkOS AuthKit. Anything that branches on provider behaviour must read this rather than pattern-matching the issuer hostname.",
          "enum": [
            "auth0",
            "workos"
          ],
          "type": "string"
        },
        "authApiHostname": {
          "description": "WorkOS \"Authentication API\" custom domain the dashboard's client-side SDK should call instead of api.workos.com, so the refresh-token cookie is first-party. Present only when the provider is workos and a custom domain is configured (WorkOS production environments only); absent means the SDK runs in devMode and keeps the refresh token in localStorage.",
          "type": "string"
        },
        "cli": {
          "allOf": [
            {
              "$ref": "#/$defs/CliOidcConfig"
            }
          ],
          "description": "WorkOS application the Daytona CLI logs in through, configured apart from the dashboard's so CLI sessions can have their own lifetime. Present only when the provider is workos and a CLI application is configured; absent means the CLI uses the issuer and client ID above."
        }
      },
      "required": [
        "audience",
        "clientId",
        "issuer",
        "provider"
      ],
      "type": "object"
    },
    "PosthogConfig": {
      "properties": {
        "apiKey": {
          "description": "PostHog API key",
          "type": "string"
        },
        "host": {
          "description": "PostHog host URL",
          "type": "string"
        }
      },
      "required": [
        "apiKey",
        "host"
      ],
      "type": "object"
    },
    "RateLimitConfig": {
      "properties": {
        "failedAuth": {
          "allOf": [
            {
              "$ref": "#/$defs/RateLimitEntry"
            }
          ],
          "description": "Failed authentication rate limit"
        },
        "authenticated": {
          "allOf": [
            {
              "$ref": "#/$defs/RateLimitEntry"
            }
          ],
          "description": "Authenticated rate limit"
        },
        "sandboxCreate": {
          "allOf": [
            {
              "$ref": "#/$defs/RateLimitEntry"
            }
          ],
          "description": "Sandbox create rate limit"
        },
        "sandboxLifecycle": {
          "allOf": [
            {
              "$ref": "#/$defs/RateLimitEntry"
            }
          ],
          "description": "Sandbox lifecycle rate limit"
        },
        "sandboxList": {
          "allOf": [
            {
              "$ref": "#/$defs/RateLimitEntry"
            }
          ],
          "description": "Sandbox list rate limit"
        }
      },
      "type": "object"
    },
    "RateLimitEntry": {
      "properties": {
        "ttl": {
          "description": "Rate limit TTL in seconds",
          "type": "number"
        },
        "limit": {
          "description": "Rate limit max requests",
          "type": "number"
        }
      },
      "type": "object"
    },
    "SsoOidcConfig": {
      "properties": {
        "issuer": {
          "description": "OIDC issuer for org-SSO logins (Daytona Auth)",
          "type": "string"
        },
        "clientId": {
          "description": "OIDC client ID for org-SSO logins",
          "type": "string"
        }
      },
      "required": [
        "clientId",
        "issuer"
      ],
      "type": "object"
    }
  }
}