The agent container requires the configuration to be in YAML format in the /home/moveworks/agent/conf directory with the file name as agent_config.yml.

The configuration encompasses various aspects such as Moveworks-specific settings, LDAP and REST client configurations, secrets management, and proxy settings.

Secret Object

A secret object is a field in the configuration that is a protected value. All credentials in the configuration are stored as a secret object. There are 3 types of secret objects:

1. Plaintext/Encrypted Plaintext: These secrets are stored in the config YAML itself. Once the agent starts, all value objects are converted to encrypted_value objects for security.

   1
   value: "your-default-secret"
   2
   # Or after encryption:
   3
   # encrypted_value: "your-encrypted-secret"
2. AWS Secrets Manager: These secrets can be fetched from AWS Secrets Manager.

   1
   aws_entry:
   2
     secret_name: "my-aws-secret"  # Name of the secret in AWS Secrets Manager
   3
     region: "us-west-2"           # AWS region where the secret is stored
   4
     refresh_time_sec: 3600        # Time interval in seconds to refresh / retrieve the secret
3. Azure Key Vault: These secrets can be fetched from Azure Key Vault

   1
   azure_entry:
   2
     secret_name: "my-azure-secret"  # Name of the secret in Azure Key Vault
   3
     vault: "my-azure-vault"         # Name of the Azure Key Vault
   4
     refresh_time_sec: 3600          # Time interval in seconds to refresh / retrieve the secret
   
   

For worked examples of complete configurations, see Configuration Examples.

Top-Level Fields

moveworks_config

secrets_provider_config

ldap_config

ldap_forest_config uses the same fields as ldap_config, with domain names as map keys.

rest_configs

moveworks_proxy_configs

Decorators

Decorators attach authentication or fixed values to every request made through a REST client. Multiple decorators can be combined in a single rest_configs entry.

Header Decorators

Add to header_decorators. Applied to the HTTP headers of every outbound request.

plain — Fields: header_key (string), header_value (string).

file — Fields: file_path (string). File must be a flat JSON object mapping header names to values.

basic_auth — Fields: username (string), password (secret object).

OAuth2 types (oauth2_client_credentials_auth, oauth2_basic_auth, oauth2_refresh_token_auth) share these top-level fields:

rest_call_config (shared by all OAuth2 types):

custom_auth uses the same fields as rest_call_config directly (no nested object). Use it for non-standard token endpoints that don’t follow OAuth2 conventions.

For full YAML examples of every header decorator type, see Header Decorators in Configuration Examples.

---

Body Decorators

Add to body_decorators. Merge key-value pairs into the request body of every outbound request.

plain — Fields: body_key (string), body_value (string).

file — Fields: file_path (string). File must be a flat JSON object mapping field names to values.

See Body Decorators in Configuration Examples.

---

URL Decorators

Add to url_decorators. Append query parameters to the URL of every outbound request.

plain_query_parameter — Fields: query_key (string), query_value (secret object).

oracle_web_centre_auth — Fields: username (string), password (secret object), query_parameter (object with query_key, query_template, and rest_call_config).

See URL Decorators in Configuration Examples.