The agent container requires the configuration to be in YAML format in the /home/moveworks/agent/conf directory with the file name as agent_config.yml.

The configuration encompasses various aspects such as Moveworks-specific settings, LDAP and REST client configurations, user-authorized OAuth2 connectors, encryption keys, secrets management, and proxy settings.

Secret Object

A secret object is a field in the configuration that is a protected value. All credentials in the configuration are stored as a secret object. There are 3 types of secret objects:

1. Plaintext/Encrypted Plaintext: These secrets are stored in the config YAML itself. Once the agent starts, all value objects are converted to encrypted_value objects for security.

   value: "your-default-secret"
   # Or after encryption:
   # encrypted_value: "your-encrypted-secret"
2. AWS Secrets Manager: These secrets can be fetched from AWS Secrets Manager.

   aws_entry:
     secret_name: "my-aws-secret"  # Name of the secret in AWS Secrets Manager
     region: "us-west-2"           # AWS region where the secret is stored
     refresh_time_sec: 3600        # Time interval in seconds to refresh / retrieve the secret
3. Azure Key Vault: These secrets can be fetched from Azure Key Vault

   azure_entry:
     secret_name: "my-azure-secret"  # Name of the secret in Azure Key Vault
     vault: "my-azure-vault"         # Name of the Azure Key Vault
     refresh_time_sec: 3600          # Time interval in seconds to refresh / retrieve the secret
   
   

For worked examples of complete configurations, see Configuration Examples.

Top-Level Fields

moveworks_config

secrets_provider_config

ldap_config

ldap_forest_config uses the same fields as ldap_config, with domain names as map keys.

rest_configs

encryption_keys

The agent uses these keys to encrypt employee access and refresh tokens before they leave the customer network. Moveworks stores only the encrypted form. encryption_keys is a map keyed by key ID, an integer from 1 to 4294967295. Key ID 0 is reserved.

At least one key is required when user_rest_configs has any entry. Otherwise the agent exits at startup with user_rest_configs requires at least one encryption key.

encryption_keys:
    "1":
        secret:
            encrypted_value: <encrypted>

A key held in AWS Secrets Manager or Azure Key Vault is read once at startup, so a rotated vault value takes effect after an agent restart. A key stored in the file as encrypted_value is encrypted with the host’s agent_key.pem, so a replacement host needs that file or the original base64 value.

user_rest_configs

user_rest_configs holds one entry per system where employees sign in as themselves with the OAuth2 authorization code grant. It is a map keyed by service name and requires agent 2.11.0 or later. The agent handles token exchange, refresh, revoke, and API calls for the matching OAuth 2.0 Authorization Code connector, and encrypts the employee’s tokens with a key from encryption_keys.

user_rest_configs:
    JIRA:
        service: JIRA
        oauth2_authorization_code:
            client_secret:
                encrypted_value: <encrypted>

oauth2_authorization_code

A PKCE public client with no secret is written as oauth2_authorization_code: {}.

requests

By default, the agent encrypts access_token and refresh_token in token exchange and refresh responses. API call and revoke responses pass through unchanged. A call profile in requests changes this handling for one call type. Each call type takes at most one profile:

• BOND_CALL_TYPE_TOKEN_EXCHANGE
• BOND_CALL_TYPE_REFRESH
• BOND_CALL_TYPE_REVOKE
• BOND_CALL_TYPE_API_CALL

transport accepts these fields:

moveworks_proxy_configs

Decorators

Decorators attach authentication or fixed values to every request made through a REST client. Multiple decorators can be combined in a single rest_configs entry.

Header Decorators

Add to header_decorators. Applied to the HTTP headers of every outbound request.

plain — Fields: header_key (string), header_value (string).

file — Fields: file_path (string). File must be a flat JSON object mapping header names to values.

basic_auth — Fields: username (string), password (secret object).

OAuth2 types (oauth2_client_credentials_auth, oauth2_basic_auth, oauth2_refresh_token_auth) share these top-level fields:

rest_call_config (shared by all OAuth2 types):

custom_auth uses the same fields as rest_call_config directly (no nested object). Use it for non-standard token endpoints that don’t follow OAuth2 conventions.

For full YAML examples of every header decorator type, see Header Decorators in Configuration Examples.

Body Decorators

Add to body_decorators. Merge key-value pairs into the request body of every outbound request.

plain — Fields: body_key (string), body_value (string).

file — Fields: file_path (string). File must be a flat JSON object mapping field names to values.

See Body Decorators in Configuration Examples.

URL Decorators

Add to url_decorators. Append query parameters to the URL of every outbound request.

plain_query_parameter — Fields: query_key (string), query_value (secret object).

oracle_web_centre_auth — Fields: username (string), password (secret object), query_parameter (object with query_key, query_template, and rest_call_config).

See URL Decorators in Configuration Examples.