## On this page

Many settings are also available at the Project level, allowing them to be configured for specific tenants on the server rather than globally. Only Super Admin users are allowed to edit Project settings.

Additional details are available in the full [`Project` resource schema](/content/docs/api/fhir/medplum/project/index.html).

| Setting | Description | Default |
| --- | --- | --- |
| `superAdmin` | Users belonging to a Project with this flag are granted [Super Admin](/content/docs/access/projects#superadmin/index.html) access to the server. Multiple Projects can have this set. | `false` |
| `checkReferencesOnWrite` | If `true`, the server will reject any create or write operations to FHIR resources with a reference to a resource that does not exist. | `false` |
| `features` | A list of optional features that are enabled for the project. Possible values are listed [below](/content/docs/self-hosting/project-settings#project-feature-flags/index.html). |  |
| `defaultPatientAccessPolicy` | The default [`AccessPolicy`](/content/docs/access/access-policies/index.html) applied to all [Patient Users](/content/docs/user-management/project-vs-server-scoped-users#project-scoped-users/index.html) invited to this [`Project`](/content/docs/api/fhir/medplum/project/index.html). This is required to enable [open patient registration](/content/docs/user-management/open-patient-registration/index.html). |  |
| `link` | Additional Projects whose [contents should be accessible](/content/docs/access/projects#project-linking/index.html) to users in the current Project. |  |
| `defaultProfile` | [Resource profiles](http://hl7.org/fhir/R4/profiling.html#resources) that will be added to resources written in the Project that do not specify a profile directly. This enables automatic custom resource validation. See [Default Profiles](/content/docs/access/projects#default-profiles/index.html) for details and examples. |  |
| `setting` | Arbitrary key-value pairs available to anyone in the Project, can be set by Project Admins. |  |
| `secret` | Key-value pairs similar to `setting`, that can only be read by Project Admins. These can be used to [pass secrets to Bots](/content/docs/bots/bot-secrets/index.html) |  |
| `systemSetting` | Server settings related to the Project: visible to anyone, but can only be set by Super Admins. |  |
| `systemSecret` | Key-value pairs that can only be accessed by Super Admins. |  |

## Project feature flags [​](/content/docs/self-hosting/project-settings#project-feature-flags "Direct link to Project feature flags"/index.html)

Medplum server exposes settings to control access to specific features on a per-Project basis. The available features are:

| Feature | Description |
| --- | --- |
| `bots` | Project is allowed to create and run [Bots](/content/docs/bots/bot-basics/index.html) |
| `cron` | Can run Bots periodically on [CRON timers](/content/docs/bots/bot-cron-job/index.html) |
| `email` | Bots in this project can [send emails](/content/docs/sdk/core.medplumclient.sendemail) |
| `google-auth-required` | [Google authentication](/content/docs/auth/google-auth/index.html) is the only method allowed |
| `graphql-introspection` | Allows potentially-expensive [GraphQL schema introspection](/content/docs/graphql/index.html) queries |
| `terminology` | Enable full standards-compliant implementation for the [`ValueSet/$expand` operation](/content/docs/api/fhir/operations/valueset-expand/index.html) |
| `websocket-subscriptions` | Allows setting up a [Subscription](/content/docs/subscriptions/index.html) over Websockets |
| `transaction-bundles` | Process `transaction` Bundles atomically. Without this flag, `transaction` Bundles are processed as batches. See [FHIR Batch Requests](/content/docs/fhir-datastore/fhir-batch-requests#transaction-limits/index.html) |

## Project system settings [​](/content/docs/self-hosting/project-settings#project-system-settings "Direct link to Project system settings"/index.html)

The supported options that can be specified by a Super Admin in `Project.systemSetting`:

| systemSetting | Type | Description | Default |
| --- | --- | --- | --- |
| `authRateLimit` | integer | The maximum requests per minute allowed for authentication endpoints per IP address | 160 |
| `graphqlBatchedSearchSize` | integer | For some GraphQL nested searches, the maximum number of searches to batch per SQL query | 0 |
| `graphqlMaxDepth` | integer | The maximum allowed depth of a GraphQL query | 12 |
| `graphqlMaxSearches` | integer | The maximum number of searches allowed in a GraphQL query | none |
| `legacyFhirJsonResponseFormat` | boolean | If true, plain JSON formatting is incorrectly used instead of [FHIR JSON](https://hl7.org/fhir/R4/json.html) for some responses with content type `application/fhir+json` | false |
| `rateLimit` | integer | The maximum requests per minute allowed per IP address | 60000 |
| `userFhirQuota` | integer | The maximum number of FHIR interactions that can be performed in a minute by any single User in the project. See [Fhir Interaction Quota](/content/docs/rate-limits#fhir-interaction-load-rate-limit/index.html). To enforce, set `enableFhirQuota` to true. | 50000 |
| `totalFhirQuota` | integer | Similar to `userFhirQuota`, but calculated as a sum of all Users' FHIR interactions in the project. To enforce, set `enableFhirQuota` to true. | 500000 |
| `enableFhirQuota` | boolean | If true, the totalFhirQuota limit will be enforced, returning `429 Too Many Requests` errors when the limit is exceeded over a minute. Please note that as of `v4.1.6`, FHIR quotas are enabled by default. | true |
| `searchOnReader` | boolean | If true, FHIR search requests (except in batch requests) are served by the reader database pool if available | false |
| `redactAuditEvents` | boolean | If true, remove human-readable detail strings from AuditEvent resources saved to the database and logs | false |

## Multi-factor authentication [​](/content/docs/self-hosting/project-settings#multi-factor-authentication "Direct link to Multi-factor authentication"/index.html)

Set the `mfaRequired` key in `Project.setting` to `valueBoolean: true` to require MFA for all existing and new users who sign in to the Project with a username and password. Users who have not enrolled will be required to enroll during their next password login. This project-wide requirement takes precedence over an individual user's `User.mfaRequired` value; setting the user value to `false` does not create an exception. See [Requiring MFA for all Project users](/content/docs/auth/mfa#requiring-mfa-for-all-project-users/index.html) for configuration examples and details.

The MFA methods users in a Project can enroll in are controlled by the `allowedMfaMethods` key in `Project.setting`, a comma-delimited list of `totp` and/or `email`. When unset, only authenticator-app (TOTP) MFA is offered. See [Configuring allowed MFA methods](/content/docs/auth/mfa#configuring-allowed-mfa-methods/index.html) for details and examples, including how to enable email-based MFA.

The `appName` key in `Project.setting` white-labels the MFA content Medplum generates: emailed verification codes and the authenticator app entries created by enrollment QR codes. When unset, both name Medplum. See [Branding MFA emails and authenticator apps](/content/docs/auth/mfa#branding-mfa-emails-and-authenticator-apps/index.html).

## Project SMTP [​](/content/docs/self-hosting/project-settings#project-smtp "Direct link to Project SMTP"/index.html)

Projects can send email through their own SMTP relay instead of the server-wide email provider, configured via `Project.secret` entries. See [Project SMTP](/content/docs/user-management/project-smtp/index.html) for the full configuration reference. Operators can disable this fleet-wide with the [`allowProjectSmtp`](/content/docs/self-hosting/server-config#allowprojectsmtp/index.html) server config setting.

- [Project feature flags](/content/docs/self-hosting/project-settings#project-feature-flags/index.html)
- [Project system settings](/content/docs/self-hosting/project-settings#project-system-settings/index.html)
- [Multi-factor authentication](/content/docs/self-hosting/project-settings#multi-factor-authentication/index.html)
- [Project SMTP](/content/docs/self-hosting/project-settings#project-smtp/index.html)