> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flowx.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Deployment guidelines v5.9.0

> Component versions, environment variables, and configuration changes for FlowX.AI 5.9.0 deployments.

<Info>
  After upgrading to a new platform version, always ensure that your installed component versions match the versions specified in the release notes. To verify this, navigate to **FlowX.AI Designer > Platform Status**.
</Info>

<Info>
  **Upgrading from 5.1.x LTS?** This page describes the steady-state 5.9.0 deployment. For the architecture delta, deprecation list, and upgrade steps, see [Migrating from 5.1 LTS](/5.9/migrating-from-5.1-lts/overview).
</Info>

<Note>
  **Deployment packaging.** 5.9.x is the last LTS release distributed as a multi-chart deployment, where each FlowX service is installed from its own Helm chart.
</Note>

<Frame>
  ![Platform Status screen showing component versions](https://s3.eu-west-1.amazonaws.com/docx.flowx.ai/4.6/platform_status.png)
</Frame>

## Component versions

The following tables list component versions per FlowX.AI release. Verify your installed versions against the 5.9.0 column in **FlowX.AI Designer → Platform Status**.

| Component                  | 5.9.0    | 5.8.0    | 5.7.0    | 5.6.0    | 5.5.0   | 5.4.0   |
| -------------------------- | -------- | -------- | -------- | -------- | ------- | ------- |
| **process-engine**         | 10.135.0 | 10.106.0 | 10.96.0  | 10.77.0  | 10.60.0 | 10.38.0 |
| **admin**                  | 10.116.0 | 10.93.0  | 10.83.0  | 10.66.0  | 10.53.0 | 10.38.0 |
| **designer**               | 10.230.2 | 10.181.0 | 10.164.0 | 10.127.3 | 10.91.0 | 10.59.1 |
| **cms-core**               | 10.86.0  | 10.67.0  | 10.58.0  | 10.43.0  | 10.35.0 | 10.22.0 |
| **scheduler-core**         | 10.70.0  | 10.53.0  | 10.45.0  | 10.31.0  | 10.25.0 | 10.15.0 |
| **events-gateway**         | 10.72.0  | 10.55.0  | 10.47.0  | 10.33.1  | 10.27.0 | 10.17.0 |
| **notification-plugin**    | 10.83.0  | 10.64.0  | 10.56.0  | 10.42.1  | 10.35.0 | 10.22.0 |
| **document-plugin**        | 10.94.0  | 10.75.0  | 10.64.0  | 10.46.0  | 10.35.0 | 10.23.0 |
| **task-management-plugin** | 10.84.0  | 10.66.0  | 10.57.0  | 10.41.1  | 10.35.0 | 10.25.0 |
| **data-search**            | 10.69.0  | 10.52.0  | 10.44.0  | 10.30.1  | 10.25.0 | 10.14.0 |
| **audit-core**             | 10.79.0  | 10.63.0  | 10.54.0  | 10.40.0  | 10.31.0 | 10.21.0 |
| **advancing-controller**   | 10.73.0  | 10.55.0  | 10.45.0  | 10.33.1  | 10.27.0 | 10.16.0 |
| **integration-designer**   | 10.162.0 | 10.128.0 | 10.113.0 | 10.84.0  | 10.63.0 | 10.38.0 |
| **application-manager**    | 10.123.0 | 10.97.0  | 10.88.0  | 10.69.1  | 10.53.0 | 10.37.0 |
| **runtime-manager**        | 10.123.0 | 10.97.0  | 10.88.0  | 10.69.1  | 10.53.0 | 10.37.0 |
| **data-sync**              | 10.81.0  | 10.58.0  | 10.50.0  | 10.38.0  | 10.31.1 | 10.20.1 |
| **authorization-system**   | 10.96.1  | 10.77.0  | 10.68.0  | 10.51.0  | 10.42.1 | 10.28.0 |
| **nosql-db-runner**        | 10.75.0  | 10.56.0  | 10.48.0  | 10.34.0  | 10.27.0 | 10.17.0 |
| **email-gateway**          | 10.74.0  | 10.56.0  | 10.47.0  | 10.32.1  | 10.24.0 | 10.9.0  |
| **organization-manager**   | 10.71.0  | 10.53.0  | 10.44.0  | 10.26.1  | 10.19.2 | -       |
| **webhook-gateway**        | 10.44.0  | 10.25.0  | 10.15.0  | 10.1.1   | -       | -       |
| **file-gateway**           | 10.8.0   | -        | -        | -        | -       | -       |
| **license**                | 10.63.0  | 10.46.0  | 10.36.0  | -        | -       | -       |

### Embedded components

* **SpiceDB**
* **Qdrant** (vector database) — bundled in the AI Platform Helm chart; its version is managed by the chart and not pinned here. See the [Qdrant setup guide](/5.9/setup-guides/qdrant) for deployment and configuration.

### Renderers

| Component                          | 5.9.0    | 5.8.0    | 5.7.0    | 5.6.0    | 5.5.0   | 5.4.0   |
| ---------------------------------- | -------- | -------- | -------- | -------- | ------- | ------- |
| **@flowx/angular-sdk**             | 10.230.2 | 10.181.0 | 10.164.0 | 10.127.3 | 10.68.0 | 10.59.1 |
| **@flowx/angular-theme**           | 10.230.2 | 10.181.0 | 10.164.0 | 10.127.3 | 10.68.0 | 10.59.1 |
| **@flowx/angular-ui-toolkit**      | 10.230.2 | 10.181.0 | 10.164.0 | 10.127.3 | 10.68.0 | 10.59.1 |
| **@flowx/react-sdk**               | 10.230.2 | 10.181.0 | 10.164.0 | 10.127.3 | 10.68.0 | 10.59.1 |
| **@flowx/react-theme**             | 10.230.2 | 10.181.0 | 10.164.0 | 10.127.3 | 10.68.0 | 10.59.1 |
| **@flowx/react-ui-toolkit**        | 10.230.2 | 10.181.0 | 10.164.0 | 10.127.3 | 10.68.0 | 10.59.1 |
| **@flowx/react-native-sdk**        | 10.230.2 | -        | -        | -        | -       | -       |
| **@flowx/react-native-theme**      | 10.230.2 | -        | -        | -        | -       | -       |
| **@flowx/react-native-ui-toolkit** | 10.230.2 | -        | -        | -        | -       | -       |
| **@flowx/core-sdk**                | 10.230.2 | 10.181.0 | 10.164.0 | 10.127.3 | 10.68.0 | 10.59.1 |
| **@flowx/core-theme**              | 10.230.2 | 10.181.0 | 10.164.0 | 10.127.3 | 10.68.0 | 10.59.1 |
| **react-saas**                     | 10.230.2 | -        | -        | -        | -       | -       |
| **iOS renderer**                   | 10.4.1   | 10.3.0   | 10.3.0   | 10.3.0   | 10.3.0  | 10.2.0  |
| **Android renderer**               | 10.5.0   | 10.3.0   | 10.3.0   | 10.3.0   | 10.3.0  | 10.2.0  |

The **react-saas** container app tracks the designer version.

### Plugins

| Component            | 5.9.0  | 5.8.0  | 5.7.0  | 5.6.0  | 5.5.0  | 5.4.0  |
| -------------------- | ------ | ------ | ------ | ------ | ------ | ------ |
| **ocr-plugin**       | 1.0.19 | 1.0.17 | 1.0.17 | 1.0.17 | 1.0.17 | 1.0.17 |
| **reporting-plugin** | 0.2.6  | 0.2.3  | 0.2.3  | 0.2.3  | 0.2.3  | 0.2.3  |

### AI components

FlowX.AI groups AI services into four tiers by deployment role. **AI Base** components are the foundation; **AI Runtime** and **AI Dev Time** components both require Base to be installed first; **AI Extensions** are optional add-ons layered on top.

#### AI Base components

Foundation services. Install these before any Runtime or Dev Time component.

| Component                                | 5.9.0  | 5.8.0  | 5.7.0  | 5.6.0  | 5.5.0  | 5.4.0 |
| ---------------------------------------- | ------ | ------ | ------ | ------ | ------ | ----- |
| **ai-platform-knowledgebase-indexer-v2** | 10.7.0 | 10.7.0 | 10.6.2 | 10.6.0 | 10.2.0 | -     |
| **ai-platform-knowledgebase-rag**        | 10.7.0 | 10.7.0 | 10.6.2 | 10.6.0 | 10.2.0 | -     |
| **ai-platform-embedder**                 | 10.7.0 | 10.7.0 | 10.6.2 | -      | -      | -     |
| **doc-parser**                           | 10.9.0 | 10.7.0 | 10.6.2 | 10.5.1 | -      | -     |

#### AI Runtime components

Requires AI Base. Services that execute AI workloads at runtime.

| Component                     | 5.9.0  | 5.8.0  | 5.7.0  | 5.6.0  | 5.5.0  | 5.4.0  |
| ----------------------------- | ------ | ------ | ------ | ------ | ------ | ------ |
| **ai-platform-agent-builder** | 10.7.0 | 10.7.0 | 10.6.2 | 10.6.0 | 10.4.0 | 10.1.3 |
| **data-privacy**              | 10.1.0 | 10.1.0 | 10.0.8 | -      | -      | -      |
| **doc-converter**             | 10.2.3 | 10.2.3 | 10.2.3 | 10.2.2 | -      | -      |
| **evals-judge**               | 10.1.1 | -      | -      | -      | -      | -      |
| **speech-to-text**            | 10.3.4 | -      | -      | -      | -      | -      |
| **web-crawler**               | 10.3.5 | 10.3.5 | 10.3.2 | -      | -      | -      |

#### AI Dev Time components

Requires AI Base. Services used at design time inside the Designer.

| Component                    | 5.9.0  | 5.8.0  | 5.7.0  | 5.6.0  | 5.5.0  | 5.4.0  |
| ---------------------------- | ------ | ------ | ------ | ------ | ------ | ------ |
| **ai-gateway**               | 10.7.0 | -      | -      | -      | -      | -      |
| **ai-platform-ai-analyst**   | 10.7.0 | 10.7.0 | 10.6.2 | 10.6.0 | 10.4.0 | 10.1.3 |
| **ai-platform-ai-assistant** | 10.7.0 | 10.7.0 | 10.6.2 | -      | -      | -      |
| **ai-platform-ai-designer**  | 10.7.0 | 10.7.0 | 10.6.2 | 10.6.0 | 10.4.0 | 10.1.3 |
| **ai-platform-ai-developer** | 10.7.0 | 10.7.0 | 10.6.2 | 10.6.0 | 10.4.0 | 10.1.3 |
| **ai-platform-planner**      | 10.7.0 | 10.7.0 | 10.6.2 | 10.6.0 | 10.4.0 | 10.1.3 |
| **di-platform**              | 10.3.1 | 10.3.0 | 10.3.0 | 10.3.0 | 10.2.6 | 10.2.5 |
| **flowx-docs**               | 5.9.0  | -      | -      | -      | -      | -      |

#### AI Extensions

Optional add-ons layered on the AI Platform.

| Component          | 5.9.0  | 5.8.0  | 5.7.0  | 5.6.0 | 5.5.0 | 5.4.0 |
| ------------------ | ------ | ------ | ------ | ----- | ----- | ----- |
| **modpod**         | 10.0.7 | 10.0.7 | 10.0.7 | -     | -     | -     |
| **ai-observatory** | 10.3.2 | -      | -      | -     | -     | -     |

***

## Third-party supported component versions

Within each version line listed below, versions that have reached upstream end of life are not supported, even though their major/minor is listed.

| FlowX.AI Version | 3rd Party Dependency              | Supported Versions |
| ---------------- | --------------------------------- | ------------------ |
| 5.9.x            | Keycloak                          | 26                 |
| 5.9.x            | Kafka                             | 3.9, 4.0, 4.1, 4.2 |
| 5.9.x            | PostgreSQL                        | 16, 17, 18         |
| 5.9.x            | Oracle Database                   | 21c, 23ai          |
| 5.9.x            | MongoDB                           | 7, 8               |
| 5.9.x            | Redis                             | 7, 8               |
| 5.9.x            | Elasticsearch                     | 8, 9               |
| 5.9.x            | Elasticsearch Sink Connector (\*) | 15                 |
| 5.9.x            | Angular (Web SDK)                 | 20.3               |
| 5.9.x            | React (Web SDK)                   | 19                 |

(\*) Required only if using indexing via Kafka. Multiple sink connector implementations also work, as long as they are compatible with both the deployed Kafka and Elasticsearch version.

<Info>
  The table lists version lines, not individual versions. A version is supported for as long as its vendor still supports it, so check the version you plan to deploy against that vendor's lifecycle page before committing to it. When a version reaches upstream end of life it is no longer supported; upgrade that component to keep your deployment on a supported configuration. Versions can also be added during the family's lifetime as FlowX validates them.
</Info>

***

## Kafka topics

### Document-plugin archive and extract listeners

5.9.0 exposes four Kafka topics for the document-plugin **archive** and **extract** operations. Both follow the encrypt/decrypt trigger and reply pattern: document-plugin consumes the `trigger.*.file` topic and process-engine consumes the matching `engine.receive.*.file.results` reply.

| Topic                                                             | Producer        | Consumer        |
| ----------------------------------------------------------------- | --------------- | --------------- |
| `ai.flowx.plugin.document.trigger.archive.file.v1`                | process-engine  | document-plugin |
| `ai.flowx.engine.receive.plugin.document.archive.file.results.v1` | document-plugin | process-engine  |
| `ai.flowx.plugin.document.trigger.extract.file.v1`                | process-engine  | document-plugin |
| `ai.flowx.engine.receive.plugin.document.extract.file.results.v1` | document-plugin | process-engine  |

The four topic names are exposed as env vars on the document-plugin side (`KAFKA_TOPIC_FILE_ARCHIVE_IN`, `KAFKA_TOPIC_FILE_ARCHIVE_OUT`, `KAFKA_TOPIC_FILE_EXTRACT_IN`, `KAFKA_TOPIC_FILE_EXTRACT_OUT`). See [Documents plugin setup → File archive / File extract](/5.9/setup-guides/documents-plugin-setup#file-archive). Two new thread-pool entries are added: `KAFKA_CONSUMER_THREADPOOLS_THREADPOOLGENERIC_THREADCOUNTPERCONTAINER_FILEARCHIVEIN` and `..._FILEEXTRACTIN`, both defaulting to `5`.

### Document-plugin encrypt and decrypt listeners

The **encrypt** and **decrypt** operations follow the same trigger-and-reply pattern: process-engine produces the `trigger.*.file` topic and document-plugin replies on the matching `engine.receive.*.file.results` topic.

| Topic                                                             | Producer        | Consumer        |
| ----------------------------------------------------------------- | --------------- | --------------- |
| `ai.flowx.plugin.document.trigger.encrypt.file.v1`                | process-engine  | document-plugin |
| `ai.flowx.engine.receive.plugin.document.encrypt.file.results.v1` | document-plugin | process-engine  |
| `ai.flowx.plugin.document.trigger.decrypt.file.v1`                | process-engine  | document-plugin |
| `ai.flowx.engine.receive.plugin.document.decrypt.file.results.v1` | document-plugin | process-engine  |

The topic names are exposed as env vars on the document-plugin side: `KAFKA_TOPIC_FILE_ENCRYPT_IN`, `KAFKA_TOPIC_FILE_ENCRYPT_OUT`, `KAFKA_TOPIC_FILE_DECRYPT_IN`, `KAFKA_TOPIC_FILE_DECRYPT_OUT`.

### Document-plugin session-upload listeners

Multi-file upload for UI flows routes uploaded files to the document-plugin for persistence. process-engine produces the trigger topic and document-plugin consumes it — `session` for a single upload session and `session.bulk` for batched multi-file uploads.

| Topic                                                               | Producer       | Consumer        |
| ------------------------------------------------------------------- | -------------- | --------------- |
| `ai.flowx.plugin.document.trigger.persist.document.session.v1`      | process-engine | document-plugin |
| `ai.flowx.plugin.document.trigger.persist.document.session.bulk.v1` | process-engine | document-plugin |

The topic names are exposed on process-engine as `KAFKA_TOPIC_SESSION_UPLOAD_OUT` and `KAFKA_TOPIC_SESSION_UPLOAD_BULK_OUT`, and on document-plugin as `KAFKA_TOPIC_DOCUMENT_PERSIST_SESSION_IN` and `KAFKA_TOPIC_DOCUMENT_PERSIST_SESSION_BULK_IN`.

### AI Platform job topics

`integration-designer` dispatches asynchronous jobs to the standalone AI services over Kafka, using a request/response pair per service. Provision these topics when you deploy the corresponding AI service (see [AI components](#ai-components) above).

| Topic                                                 | Producer             | Consumer             |
| ----------------------------------------------------- | -------------------- | -------------------- |
| `ai.flowx.ai-platform.doc-parser.job.request.v1`      | integration-designer | doc-parser           |
| `ai.flowx.ai-platform.doc-parser.job.response.v1`     | doc-parser           | integration-designer |
| `ai.flowx.ai-platform.evals-judge.job.request.v1`     | integration-designer | evals-judge          |
| `ai.flowx.ai-platform.evals-judge.job.response.v1`    | evals-judge          | integration-designer |
| `ai.flowx.ai-platform.speech-to-text.job.request.v1`  | integration-designer | speech-to-text       |
| `ai.flowx.ai-platform.speech-to-text.job.response.v1` | speech-to-text       | integration-designer |

On `integration-designer` the topic names are set via `KAFKA_TOPIC_AI_<SERVICE>_JOB_REQUEST_OUT` and `..._RESPONSE_IN` (for example `KAFKA_TOPIC_AI_EVALSJUDGE_JOB_REQUEST_OUT`). Each service also has a dead-letter topic — `ai.flowx.ai-platform.<service>.job.dlq.v1`, set via `KAFKA_TOPIC_AI_<SERVICE>_JOB_DLQ_IN` — that integration-designer consumes for failed jobs.

### UI Flow runtime triggers

process-engine consumes two trigger topics that back the UI Flow runtime cache and expiration features. `update` invalidates a cached UI Flow when its definition changes; `expire` removes expired UI Flow runtime data.

| Topic                                     | Producer                              | Consumer       |
| ----------------------------------------- | ------------------------------------- | -------------- |
| `ai.flowx.core.trigger.ui-flow.update.v1` | document-plugin, integration-designer | process-engine |
| `ai.flowx.core.trigger.expire.ui-flow.v1` | scheduler-core                        | process-engine |

On process-engine these are set via `KAFKA_TOPIC_UIFLOW_UPDATE_IN` and `KAFKA_TOPIC_UIFLOW_EXPIRE_IN`; the producers expose `KAFKA_TOPIC_UIFLOW_UPDATE_OUT`. The expire trigger uses the platform scheduler: when a UI Flow session is created, process-engine registers a delayed message with scheduler-core, which publishes it back to this topic at the expiry time. It is consumed by a dedicated consumer group (`KAFKA_CONSUMER_GROUPID_PROCESS_UIFLOWEXPIRE`, default `ui-flow-expire`).

### File and webhook process triggers

Two trigger topics let the file-gateway and webhook-gateway start or resume processes in process-engine. The **start-for-event** topic starts a process when a watched file arrives (file-gateway) or an incoming webhook fires (webhook-gateway); the **message event** topic resumes a running process that is waiting on an intermediate message catch event.

| Topic                                              | Producer                      | Consumer       |
| -------------------------------------------------- | ----------------------------- | -------------- |
| `ai.flowx.core.trigger.start-for-event.process.v1` | file-gateway, webhook-gateway | process-engine |
| `ai.flowx.core.message.event.process.v1`           | webhook-gateway               | process-engine |

On the producers, the start-for-event topic is set via `KAFKA_TOPIC_TRIGGER_STARTFOREVENT_PROCESS_OUT` (file-gateway) and `KAFKA_TOPIC_PROCESS_START_OUT` (webhook-gateway); process-engine consumes it via `KAFKA_TOPIC_PROCESS_STARTFOREVENT_IN`. The message event topic uses `KAFKA_TOPIC_PROCESS_EVENT_MESSAGE` on both webhook-gateway and process-engine. Like every service, file-gateway and webhook-gateway also publish to the shared audit topic `ai.flowx.core.trigger.save.audit.v1` via `KAFKA_TOPIC_AUDIT_OUT` (consumed by audit-core).

***

## Environment variables

<Warning>
  **A configuration that blocks startup is a required configuration.** If a service fails to start and its logs report a missing or empty configuration value, treat that value as required and provide it, even when it is not flagged as required here. These guides document the most common variables; they are not an exhaustive list of every value your deployment topology requires.
</Warning>

### Data-sync: Keycloak admin credentials

The data-sync job provisions FlowX-managed end-user groups and runtime roles in Keycloak on first run, using the Keycloak admin API. Configure the following on the data-sync job:

| Environment Variable     | Description                                                                                                                                                 | Default Value | Component |
| ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- | --------- |
| `FLOWX_OPENID_PROVIDER`  | OpenID provider type. Set to `keycloak` (the only supported provider).                                                                                      | `keycloak`    | data-sync |
| `FLOWX_OPENID_SERVERURL` | Base URL of the Keycloak server, including the `/auth/` path.                                                                                               | `-`           | data-sync |
| `FLOWX_OPENID_USER`      | Username of a Keycloak admin account that can manage groups and roles in the FlowX realm.                                                                   | `-`           | data-sync |
| `FLOWX_OPENID_PASSWORD`  | Password for the admin account above. Store in a Kubernetes Secret.                                                                                         | `-`           | data-sync |
| `FLOWX_OPENID_CLIENTID`  | Keycloak admin client used to obtain the admin token. Typically `admin-cli` for standard Keycloak deployments. Must be set explicitly. There is no default. | `-`           | data-sync |

For full data-sync configuration, see [Data-sync job setup](/5.9/setup-guides/data-sync#openid-provider-configuration).

### Anonymous service account: shared client secret

5.9.x introduces a single shared service-account client, `flowx-anonymous-sa`, used by FlowX backend services for inter-service calls on anonymous (unauthenticated) runtime flows. One client secret is reused across all consumers — it must be provided in two places.

**On `authorization-system`** — passed to Liquibase so the client is provisioned with the correct secret when FlowX manages Keycloak:

| Environment Variable                                                   | Description                                                                                                                                                                | Default Value | Component              |
| ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------- | ---------------------- |
| `SPRING_LIQUIBASE_PARAMETERS_SECRETS_SERVICEACCOUNTS_FLOWXANONYMOUSSA` | Client secret used by Liquibase to create the `flowx-anonymous-sa` client in the service-accounts realm at first boot. Required when `SECURITY_KEYCLOAKADMINENABLED=true`. | `-`           | `authorization-system` |

**On every consuming service** — the Spring Security OAuth2 client registration for the `anonymousidentity` alias resolves the same secret at runtime:

| Environment Variable                                                        | Description                                                                                                                                      | Default Value | Component                                                                                                                                                                                                                                                                                                  |
| --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | ------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `SPRING_SECURITY_OAUTH2_CLIENT_REGISTRATION_ANONYMOUSIDENTITY_CLIENTSECRET` | Client secret for the `anonymousidentity` registration. **Must be the same value across every service** — it is a single shared service account. | `-`           | `admin`, `application-manager`, `authorization-system`, `document-plugin`, `email-gateway`, `events-gateway`, `file-gateway`, `integration-designer`, `license`, `mock-server`, `nosql-db-runner`, `organization-manager`, `process-engine`, `scheduler-core`, `task-management-plugin`, `webhook-gateway` |

<Warning>
  This is a secret. Store it in your secrets management solution (e.g., Kubernetes Secret, Vault) and reference it from there. Never commit it to version control.
</Warning>

For the Keycloak-side context (`flowx-anonymous-sa` client, `SA_FLOWX_ANONYMOUS` realm role, manual-configuration recipe for deployments without Keycloak admin access), see [Manual Keycloak configuration](/5.9/setup-guides/access-management/configuring-an-iam-solution#manual-keycloak-configuration).

### Knowledgebase-rag: Qdrant search tuning

Two env vars control the fanout of dense and sparse Qdrant queries inside the `knowledgebase-rag` service. Defaults are tunable per environment.

| Environment Variable    | Description                                                                                                                  | Default Value | Component         |
| ----------------------- | ---------------------------------------------------------------------------------------------------------------------------- | ------------- | ----------------- |
| `QDRANT_PREFETCH_LIMIT` | Maximum points returned by each dense/sparse prefetch stage in a hybrid search before fusion.                                | `100`         | knowledgebase-rag |
| `QDRANT_FUSION_LIMIT`   | Maximum points returned after RRF fusion (hybrid search) or by a single-stage dense/keyword search. Caps the reranker input. | `80`          | knowledgebase-rag |

Raise both when recall is insufficient on very large or long-tailed Knowledge Bases. Lower them when Qdrant pods report memory pressure or filter-heavy queries time out.

### CORS handling: `APPLICATION_CORS_ALLOWORIGIN`

CORS is enforced at the application layer. Each backend service exposed via admin or public URLs reads its allowed-origin list from a single environment variable. Allowed methods, allowed headers, exposed headers, and credential handling are baked into each service's `application.yaml` with safe defaults. The 5.9.x default allow-headers set is `Accept, Content-Type, Authorization, Fx-Workspace-Id, Fx-Client-Host, Referer, User-Agent, Flowx-Platform, X-Fx-Anonymous-Session-Id, Fx-BuildId, Fx-AppId`, and `X-Fx-Anonymous-Session-Id` is exposed to the browser for anonymous runtime sessions. Only `APPLICATION_CORS_ALLOWORIGIN` is deployment-specific.

| Environment Variable              | Description                                                                                                                                                                                                                             | Default Value               | Component                                                                                                                                                                                                                                                                                                               |
| --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `APPLICATION_CORS_ALLOWORIGIN`    | Comma-separated list of origins allowed to call this service from the browser. Supports wildcard subdomains (`https://*.yourcompany.com`). Must include every Designer, runtime renderer, and integration domain that calls FlowX APIs. | `-`                         | `admin`, `ai-gateway`, `application-manager`, `audit-core`, `authorization-system`, `cms-core`, `document-plugin`, `events-gateway`, `file-gateway`, `integration-designer`, `license`, `notification-plugin`, `organization-manager`, `process-engine`, `runtime-manager`, `task-management-plugin`, `webhook-gateway` |
| `APPLICATION_CORS_EXPOSEDHEADERS` | Response headers exposed to browser JavaScript. The default carries the anonymous-session header; override only if you need to expose additional custom headers.                                                                        | `X-Fx-Anonymous-Session-Id` | all services (shared security library)                                                                                                                                                                                                                                                                                  |

For migration guidance and the full list of removed NGINX CORS annotations, see [Ingress routing and CORS](/5.9/migrating-from-5.1-lts/ingress-routing).

### Process-engine and integration-designer: native script engine

The default script engine for JavaScript and Python execution is a **native subprocess pool**. Scripts run in isolated Node.js and Python worker processes.

| Environment Variable                                                  | Description                                       | Default Value      | Component                            |
| --------------------------------------------------------------------- | ------------------------------------------------- | ------------------ | ------------------------------------ |
| `APPLICATION_SCRIPTENGINE_PROVIDER`                                   | Script engine provider                            | `native`           | process-engine, integration-designer |
| `APPLICATION_SCRIPTENGINE_NATIVEENGINE_JS_POOLSIZE`                   | Node.js worker pool size                          | `16`               | process-engine, integration-designer |
| `APPLICATION_SCRIPTENGINE_NATIVEENGINE_JS_EXECUTABLE`                 | Path to the Node.js binary                        | `/usr/bin/node`    | process-engine, integration-designer |
| `APPLICATION_SCRIPTENGINE_NATIVEENGINE_JS_EXECUTIONTIMEOUTMS`         | JS script execution timeout (ms)                  | `5000`             | process-engine, integration-designer |
| `APPLICATION_SCRIPTENGINE_NATIVEENGINE_JS_MAXEXECUTIONSPERWORKER`     | Max executions before a JS worker is recycled     | `10000`            | process-engine, integration-designer |
| `APPLICATION_SCRIPTENGINE_NATIVEENGINE_JS_MAXPAYLOADSIZEBYTES`        | Max JS input payload size (bytes)                 | `1048576`          | process-engine, integration-designer |
| `APPLICATION_SCRIPTENGINE_NATIVEENGINE_PYTHON_POOLSIZE`               | Python worker pool size                           | `8`                | process-engine, integration-designer |
| `APPLICATION_SCRIPTENGINE_NATIVEENGINE_PYTHON_EXECUTABLE`             | Path to the Python 3 binary                       | `/usr/bin/python3` | process-engine, integration-designer |
| `APPLICATION_SCRIPTENGINE_NATIVEENGINE_PYTHON_EXECUTIONTIMEOUTMS`     | Python script execution timeout (ms)              | `10000`            | process-engine, integration-designer |
| `APPLICATION_SCRIPTENGINE_NATIVEENGINE_PYTHON_MAXEXECUTIONSPERWORKER` | Max executions before a Python worker is recycled | `10000`            | process-engine, integration-designer |
| `APPLICATION_SCRIPTENGINE_NATIVEENGINE_PYTHON_MAXPAYLOADSIZEBYTES`    | Max Python input payload size (bytes)             | `1048576`          | process-engine, integration-designer |

To use GraalVM instead of the native engine, set `APPLICATION_SCRIPTENGINE_PROVIDER=graalvm` on both services.


## Related topics

- [FlowX.AI 5.9.0 Release Notes](/release-notes/v5.x/v5.9.0-june-2026/v5.9.0-june-2026.md)
- [Deployment guidelines v5.6.0](/release-notes/v5.x/v5.6.0-march-2026/deployment-guidelines-v5.6.md)
- [Deployment guidelines v5.3.0](/release-notes/v5.x/v5.3.0-december-2025/deployment-guidelines-v5.3.md)
- [Deployment guidelines v5.4.0](/release-notes/v5.x/v5.4.0-january-2026/deployment-guidelines-v5.4.md)
- [Deployment guidelines v5.5.0](/release-notes/v5.x/v5.5.0-february-2026/deployment-guidelines-v5.5.md)