System Settings API

Key-value store for global system configuration. Settings with isPublic: true are accessible without authentication.

GraphQL

Queries

List All Settings (auth required)

query { systemSettings { key value description isPublic createdAt updatedAt } }

Get Single Setting (auth required)

query { systemSetting(key: "registration_enabled") { key value description isPublic } }

Public Settings (no auth)

query { publicSettings { key value } }

Mutations

All mutations require settings:write permission.

Create Setting

mutation {
  createSystemSetting(input: {
    key: "maintenance_mode"
    value: "false"
    description: "Enable maintenance mode"
    isPublic: false
  }) { key value }
}

Update Setting

mutation {
  updateSystemSetting(key: "registration_enabled", input: { value: "false" }) { key value }
}

Delete Setting

Requires settings:delete permission.

mutation { deleteSystemSetting(key: "maintenance_mode") }

REST API

Endpoints

Method	Path	Auth	Description
GET	/v1/settings	Bearer	List all settings
GET	/v1/settings/public	No	List public settings
GET	/v1/settings/{key}	Bearer	Get setting by key
POST	/v1/settings	settings:write	Create setting
PUT	/v1/settings/{key}	settings:write	Update setting
DELETE	/v1/settings/{key}	settings:delete	Delete setting

Example

# Get public settings (no auth)
curl http://localhost:3000/v1/settings/public

# Update a setting
curl -X PUT http://localhost:3000/v1/settings/registration_enabled \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"value": "false"}'

Built-in Settings

Key	Default	Public	Description
registration_enabled	true	Yes	Global registration toggle. When false, no new accounts can be created regardless of per-platform settings.

Audit Events

Event	Logged When
system_setting_created	New setting created
system_setting_updated	Setting value changed (logs old + new value)
system_setting_deleted	Setting removed