> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/administration-guide/access/content-providers-and-uri-patterns/content-provider-reference.md). # Content provider and URI pattern reference Every field on the content provider and URI pattern screens, the shipped defaults, the DEFAULT\_CP seed with its 29 URI patterns, and the menu root properties. ## What this covers The exhaustive lists behind two screens: `/webconsole/editContentProvider?providerId=` and `/webconsole/editProviderPattern?id=&providerId=`. Every field, what it writes, what the product ships in it, and the seed data a fresh installation starts from. Nothing here is a procedure. How routing resolves is [Content providers and URI patterns](/administration-guide/access/content-providers-and-uri-patterns.md); publishing an application is [Protect an application behind the Access Gateway](/administration-guide/gateway/protect-an-application.md). ## Content provider fields | Field | Column | What it decides | | ---------------------------------------------------------- | ------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | | `domainPattern` | `DOMAIN_PATTERN` | The host this provider claims. Half of the unique key | | `ssl` | `IS_SSL` | `Y`, `N`, or unset for "don't care". The other half of the unique key | | `isPublic` | `IS_PUBLIC` | Whether the provider's resource is public | | `authProviderId` | `PROVIDER_ID` | The authentication provider. `NOT NULL` | | `oauthProviderId` | `OAUTH_CLIENT_ID` | The OAuth client, for OAuth-authenticated contexts | | `authCookieName` / `authCookieDomain` | `AUTH_COOKIE_NAME` / `AUTH_COOKIE_DOMAIN` | Session cookie scope. Getting the domain wrong either breaks SSO between hosts or leaks the session across tenants | | `loginURL` | `LOGIN_URL` | Where an unauthenticated request is sent | | `postbackURLParamName` | `POSTBACK_URL_PARAM_NAME` | The query parameter carrying the return destination | | `serverSet` | `CONTENT_PROVIDER_SERVER` | Upstream application servers, unique per `(provider, SERVER_URL)` | | `themeId` | `UI_THEME_ID` | Look and feel — see [UI themes](#ui-themes-and-the-stylesheet-url) | | `showOnApplicationPage` | `SHOW_ON_APP_PAGE` | Launchpad visibility. **Not** authorization | | `accessControlAllowOriginHeader` | `SET_ACC_CTRL_ALLOW_ORG_HDR` | Whether the CORS origin header is emitted | | `globalLogout` | — | Whether logout propagates to linked sessions | | `unavailable` / `unavailableURL` / `unavailableResourceId` | `IS_UNAVAILABLE` / `IS_UNAVAILABLE_URL` / `IS_UNAVAILABLE_RESOURCE` | Maintenance mode and where it sends people | | `categoryTypeId` | `CATEGORY_TYPE_ID` | An `APPLICATION_CATEGORY` resource, for catalog grouping | | `ruleXrefs` | `CP_RULE_XREF` | Which authentication rules this provider supports, with an `EXEC_ORDER` | | `rabbitMQAdminURL` | — | Used when generating default patterns for the RabbitMQ admin UI | The **Authentication Cookie Domain** has a validation rule worth knowing before you type: the domain pattern must end with the cookie domain, or the save is refused with *"The Domain Pattern must end with the Authentication Cookie Domain"*. ## URI pattern fields | Field | What it decides | | --------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | | `pattern` | The path. Wildcard at the start **or** the end, never both, never in the middle | | `matchMode` | The **Match Mode** for the query string — see [Match Mode](#match-mode-values) | | **`proxyPassLocation`** | Where the proxy forwards to. **This is the field labelled "Application Path"** | | `servers` | Pattern-level upstream servers, overriding the provider's | | `isPublic` | Whether the pattern's resource is public | | `resourceId` / `resourceCoorelatedName` | The `URL_PATTERN` resource that carries the entitlement | | `authProviderId` | Pattern-level authentication provider override | | `methods` | One row per HTTP method under **Supported HTTP Methods**, each with its own match mode, parameters, metadata and `URI_PATTERN_METHOD` resource | | `params` | Declared parameters for `SPECIFIC_PARAMS` | | `metaEntitySet` | The inject and exclude rules — see [Metadata](#metadata-what-belongs-on-this-page-and-what-does-not) | | `substitutions` | HTML body rewrites, held in `URI_HTML_SUBSTITUTION` — see [HTML substitution fields](#html-substitution-fields) | | `redirectTo` / `redirectToGroovyScriptId` | A static redirect, or a Groovy-computed one | | `errorMappings` | HTTP status code → redirect URL, unique per `(pattern, ERROR_CODE)` | | `xssRules` | Per-parameter XSS exemptions | | `ignoreXSS` | Pattern-wide XSS exemption | | `cacheable` / `cacheTTL` | Response caching | | `showOnApplicationPage` / `applicationName` / `url` | Launchpad presentation | | `pageTemplates` | `METADATA_URI_XREF` — which page template renders here | | `themeId` | Theme override | | `ruleXrefs` / `orderedRuleXrefs` | Authentication rules for this pattern, in the **Supported Authentication Levels** section | {% hint style="info" %} **The field labelled "Application Path" is the proxy-pass location.** Its underlying name is `proxyPassLocation`, and the label is set by the message key `content.provider.entitlements.proxyPassLocation`. Its validation message states the rule: *"Invalid application Path. The path must begin with '/' and must not contain '*' characters."\* (message key `openiam.ui.uri.pattern.proxyPassLocation.invalid.characters`, error `PROXY_PATH_INVALID_CHARACTER` / 786). Confirm the rule by typing `app/*` into the field and saving — you will get exactly that message. The name matters because everything you know about Apache's `ProxyPass` applies to this field, and nothing about "application paths" does. {% endhint %} ### Match Mode values **Match Mode** is the drop-down on a URI pattern, and on each of its HTTP methods, that decides how the query string is treated. It accepts four values. Each carries a specificity level, used when more than one method could match: | Value | Label on screen | Level | Matches when | | ----------------- | --------------------------------------- | ----- | ---------------------------------------------------------------------------------------- | | `IGNORE` | Ignore Request Parameters When Matching | 0 | Always — the query string is not considered | | `NO_PARAMS` | No Request Parameters | 1 | The query string is empty | | `ANY_PARAMS` | Any Number of Parameters Present | 2 | The query string is non-empty | | `SPECIFIC_PARAMS` | Specific Request Parameters Present | 3 | Every parameter declared on the pattern (or the method) is present with a matching value | `IGNORE` is what the shipped seed uses everywhere, and what **Create default URI patterns** sets on anything it creates. The pattern screen itself is the authoritative list of accepted values on your release: the **Request Parameters** section offers the four above, **Metadata** offers the metadata types, and **Supported HTTP Methods** offers the methods. ### HTML substitution fields Each row of **HTML Substitution List** rewrites text in the response body before it reaches the browser. The fields, with the column each writes: | Field on screen | Column | Notes | | ------------------- | ----------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- | | Text Query | `QUERY` | Required — a blank one is refused with *"A query is required for this substitution"*. `varchar(100)` | | Replace With | `REPLACE_WITH` | `varchar(300)`, nullable | | Is Exact Match | `IS_EXACT_MATCH` | Ships `N` | | Is Fast Search | `IS_FAST_SEARCH` | Ships `N` | | *(execution order)* | `EXECUTION_ORDER` | Required, and unique per pattern — constraint `UNIQUE_URI_SUB_ORDER` on `(URI_PATTERN_ID, EXECUTION_ORDER)`. Two substitutions cannot share an order | Substitutions are applied to the response in `EXECUTION_ORDER`, so a later rule sees the text an earlier rule has already rewritten. ## Metadata: what belongs on this page, and what does not The six metadata types, the five value sources and their resolution order, and the two propagation checkboxes are catalogued in [Access Gateway reference](/administration-guide/gateway/access-gateway-reference.md#uri-pattern-metadata-types). Three things about them are properties of the *pattern* rather than of the gateway, so they are stated here. **Where a metadata entry can be attached.** Either to the pattern (`URI_PATTERN_META`) or to one HTTP method of it (`URI_PATTERN_METHOD_META`). Both are unique per `(owner, metadata type)`, so a pattern can carry each of the six types exactly once, and so can each of its methods. **Static values are truncated differently at the two levels.** `STATIC_VALUE` is `varchar(4096)` on the method table and `varchar(100)` on the pattern table, so a long literal that saves on a method will not save on the pattern. {% hint style="warning" %} **Method-level metadata replaces pattern-level metadata; it does not add to it.** When a request matches one of the pattern's declared HTTP methods, OpenIAM processes that method's metadata and does not look at the pattern's. If the method carries no metadata at all, the pattern's is skipped too — so declaring a method purely to set a match mode silently turns off every header, cookie and form post the pattern was injecting for that method. Keep injection at one level per pattern, and when you add a method to a pattern that already injects, re-test the injection. {% endhint %} ### Value from User Profile resolves through the content provider, not the pattern **Principal** and **Password** are read against the managed system of the **content provider's** authentication provider. A pattern-level authentication provider override does not change which managed system they come from — which is worth knowing before you set one. A user with no login on that managed system therefore has no principal to send. **Principal** resolves to nothing and is quietly omitted. **Password** is worse: it fails the whole metadata entry, dropping every attribute in it that does not have **Propagate on Error** set, and logging *"Rule … will not propagate to the proxy due to an error"*. If you use form fill, confirm the target population actually holds logins on the authentication provider's managed system before you enable it. ## UI themes and the stylesheet URL A **UI theme** is one stylesheet URL plus a set of uploaded logos and favicons, and it is how a content provider serves its own branding. Creating one and attaching it is [Brand the pages OpenIAM renders for this site](/administration-guide/gateway/request-and-response-transformations.md#brand-the-pages-openiam-renders-for-this-site). The stored shape: | Field | Column | Notes | | -------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | UI Theme Name | `UI_THEME_NAME` | Required, `varchar(100)`, unique — a clash is refused with *"A UI Theme with this name already exists"* | | Stylesheet URL | `URL` | Required — *"A stylesheet URL is required"*. `varchar(300)`; over that the save is refused with *"UI Theme URL is too long. Maximum length: 300 characters."* | Routes are `/webconsole/uiThemes`, `/webconsole/newUITheme` and `/webconsole/editUITheme?id=`. Saving records audit action `CREATE_UI_THEME` on a new theme and `MODIFY_UI_THEME` on an edit, with the message *"UI Theme saved successfully"*. Uploaded images are held per theme by type. Fifteen types exist, each with the size the upload screen recommends: `BIG_LOGO` (270×110, labelled **Upload Login and Self-Registration Logo**), `SMALL_LOGO` (110×40, **Upload Application Logo**), and thirteen square favicons — `FAVICON_16X16`, `FAVICON_32X32`, `FAVICON_57X57`, `FAVICON_60X60`, `FAVICON_72X72`, `FAVICON_76X76`, `FAVICON_96X96`, `FAVICON_114X114`, `FAVICON_120X120`, `FAVICON_144X144`, `FAVICON_152X152`, `FAVICON_180X180` and `FAVICON_192X192`. **Which theme a page gets** is decided per matched URI pattern: the pattern's own theme if it has one, otherwise the content provider's, otherwise none. OpenIAM emits the resolved theme's URL into the page as ``. ## Shipped field defaults Two `CONTENT_PROVIDER` columns were added with a value applied to every existing row, which is the closest thing to a documented default: | Column | Field | Shipped value | History | | ------------------------- | ---------------------- | -------------------- | ------------------------------------------------------------------ | | `LOGIN_URL` | `loginURL` | `/idp/login` | `/idp/login.html` from 3.3.0.0; `.html` stripped as of 4.2.0.0 | | `POSTBACK_URL_PARAM_NAME` | `postbackURLParamName` | `postbackUrl` | `postbackURL` from 3.3.0.0; recased to `postbackUrl` as of 4.2.0.0 | | `AUTH_COOKIE_NAME` | `authCookieName` | `OPENIAM_AUTH_TOKEN` | Applied to every existing provider as of 4.0.0.0 | Read your own values at `/webconsole/editContentProvider?providerId=` — on an upgraded system these are the values the upgrade wrote unless someone has changed them since. {% hint style="warning" %} The postback parameter name changed case: `postbackURL` → `postbackUrl`. Anything that constructs a return URL by hand — a custom login page, an external portal link, a bookmark — breaks silently on an upgraded system if it still uses the old capitalisation. All three columns are `NOT NULL`, so a value is always present; it just may not be the one your integration expects. {% endhint %} Two further defaults apply to providers created without the fields being set — by an integration calling the API rather than by the Webconsole, which always sends them. Such a provider comes out with **Show on Application Page** on and the CORS `Access-Control-Allow-Origin` header enabled, so it is launchpad-visible to everyone entitled to it and it emits that header. If an integration creates providers for you, open one afterwards and turn both off unless you meant them. ## The `DEFAULT_CP` seed The shipped content provider is created by the stored procedure `SETUP_CONTENT_PROVIDERS`, which has been part of the schema since 4.0.0.0. Two things about it matter before you read the values. First, its whole body is guarded by a check that the `CONTENT_PROVIDER` table is empty, so it seeds only a genuinely empty installation and does nothing on upgrade. An upgraded system therefore keeps whatever providers it already had, and none of the values below. Second, **no part of the upgrade path calls it.** It takes four parameters — `cpDomain`, `serverDomain`, `cookieDomain`, `cookieName` — supplied at install time from the deployment's own hostnames, so the domain and cookie values on a running system come from your installation and not from a default this guide can quote. Read the actual values at `/webconsole/contentProviders`, and confirm the setup ran by looking for audit action `SETUP_CONTENT_PROVIDER`. Whether it ran at all on your system, and with which hostnames, is a question for whoever installed it — the console records the resulting values, not the parameters. What the procedure creates: | Object | Values | | ------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `RES` row `DEFAULT_CP` | Type `CONTENT_PROVIDER`, name `Default Content Provider`, `IS_PUBLIC='Y'`, `URL = 'http://' + cpDomain + '/selfservice'` | | `CONTENT_PROVIDER` row `DEFAULT_CP` | Name `Default Content Provider`, `IS_PUBLIC='Y'`, `DOMAIN_PATTERN = cpDomain`, `IS_SSL = NULL`, `PROVIDER_ID = 'OPENIAM_DEFAULT_AUTH'`, cookie domain and name from the parameters | | `CP_AUTH_LEVEL_GRP_XREF` | `DEFAULT_CP` → `PASSWORD_AUTH`, exec order `0` | | `CONTENT_PROVIDER_SERVER` row `DEFAULT_CP` | `SERVER_URL = serverDomain` | Note `IS_SSL = NULL` on the shipped provider: it matches both `http` and `https`. ### The 29 seeded URI patterns Every one is created with `PARAM_MATCH_MODE='IGNORE'` and `IS_PUBLIC='Y'`. The **Auth level** column is the `URI_AUTH_LEVEL_GRP_XREF` row; patterns with no row inherit the provider's `PASSWORD_AUTH`. | Pattern ID | Pattern | Auth level | Notes | | ----------------------------- | -------------------------------------------------------- | ------------------- | --------------------------------------------------------------------- | | `DEF_CP_SELSERVICE_SLASH` | `/selfservice/*` | *(inherits)* | Carries page template `NEW_USER_TEMPLATE` | | `DEF_CP_WEBCONSOLE_SLASH` | `/webconsole/*` | *(inherits)* | | | `DEF_CP_WEBCONSOLE_AM_SLASH` | `/webconsole-am/*` | *(inherits)* | | | `DEF_CP_WEBCONSOLE_IDM_SLASH` | `/webconsole-idm/*` | *(inherits)* | | | `SELFREG_PATTERN` | `/selfservice/selfRegistration.html` | `NONE` | Carries `NEW_USER_TEMPLATE` | | `UI_STATIC` | `/openiam-ui-static/*` | `NONE` | The path a theme stylesheet can safely be served from | | `LOGIN_HTML` | `/idp/login.html` | `NONE` | XSS ignored on parameter `password` | | `LOGOUT_PATTERN` | `/idp/logout.html` | `NONE` | | | `CHANGE_PASSWORD` | `/idp/changePassword.html` | `NONE` | XSS ignored on `currentPassword`, `newPassword`, `newPasswordConfirm` | | `UNLOCK_PASSWORD` | `/idp/unlockPassword.html` | `NONE` | | | `UNLOCK_PASSWORD_QUESTIONS` | `/idp/unlockPasswordQuestions.html` | `NONE` | | | `UNLOCK_USER_RESET_FORM` | `/idp/unlockUserResetPasswordForm.html` | **`PASSWORD_AUTH`** | XSS ignored on `newPassword`, `newPasswordConfirm` | | `SAML_LOGIN_PATTERN` | `/idp/SAMLLogin.html` | `NONE` | `IGNORE_XSS='Y'` for the whole pattern | | `SAML_METADATA_PATTERN` | `/idp/SAMLMetadata.html` | `NONE` | | | `SP_PATTERN` | `/idp/sp/*` | `NONE` | `IGNORE_XSS='Y'` | | `PWD_VALIDATION_PATTERN` | `/idp/rest/api/password/validation/*` | `NONE` | See the defect note below | | `LANGUAGE_SUPPORT_PATTERN` | `/selfservice/language/languageSupport.html` | `NONE` | `IGNORE_XSS='Y'` | | `REPORTVIEWER_PATTERN` | `/reportviewer/*` | `NONE` | | | `WEBCONSOLE_CLEAR_CNTX` | `/webconsole/clearContext.html` | `NONE` | | | `WEBCONSOLE_AM_CLEAR_CNTX` | `/webconsole-am/clearContext.html` | `NONE` | | | `WEBCONSOLE_IDM_CLEAR_CNTX` | `/webconsole-idm/clearContext.html` | `NONE` | | | `SELFSERVICE_CLEAR_CNTX` | `/selfservice/clearContext.html` | `NONE` | | | `SELFSERVICE_EXT_CLEAR_CNTX` | `/selfservice-ext/clearContext.html` | `NONE` | | | `SEARCH_ORG_PATTERN` | `/selfservice/rest/api/entitlements/searchOrganizations` | `NONE` | | | `SEARCH_ROLES_PATTERN` | `/selfservice/rest/api/entitlements/searchRoles` | `NONE` | | | `SEARCH_GROUPS_PATTERN` | `/selfservice/rest/api/entitlements/searchGroups` | `NONE` | | | `ROLE_METADATA_PATTERN` | `/selfservice/rest/api/metadata/roleMetadata` | `NONE` | | | `GROUP_METADATA_PATTERN` | `/selfservice/rest/api/metadata/groupMetadata` | `NONE` | | | `ORG_METADATA_PATTERN` | `/selfservice/rest/api/metadata/organizationMetadata` | `NONE` | | {% hint style="info" %} `PWD_VALIDATION_PATTERN` is seeded pointing at the resource that belongs to a **different** pattern, `SP_PATTERN`. Every other seeded pattern points at its own resource. Entitling or protecting the password-validation pattern will therefore act on the SAML SP pattern's resource instead. To check your own system, open `/webconsole/editProviderPattern?id=PWD_VALIDATION_PATTERN&providerId=` and compare the resource it names with the one on `SP_PATTERN`; if they are the same resource, create a dedicated one for the password-validation pattern before you entitle either. {% endhint %} The `.html` suffixes above are the 4.0 seed. As of 4.2.0.0 the content provider's `LOGIN_URL` has `.html` stripped, and the modern default-pattern set uses extension-less paths. ## Create default URI patterns The **Create default URI patterns** action on a content provider seeds that provider from a shipped definition file of **220** patterns as of 2026.10.2 (216 before the four MCP patterns were added; they are described in [Connect AI assistants through the MCP server](/administration-guide/federation/mcp-server.md#publish-it-through-the-access-gateway)). What it seeds, group by group, is in [What Add Default Patterns seeds](/administration-guide/gateway/access-gateway-reference.md#what-add-default-patterns-seeds). The seed is not re-applied on upgrade: patterns added in a newer release reach an existing content provider only when you press the button again, or add them by hand. The file OpenIAM reads is named by the property `org.openiam.uri.patterns.defaut.object.file`, which ships `default.uri.content.provider.patterns.json`. Note the misspelled `defaut` in the key: it is spelled that way in the product and you must spell it that way to override it. {% hint style="warning" %} **The operation is upsert, not replace, and the upsert overwrites your customisations.** Existing patterns whose string matches one of the 220 are *updated*: public flag, XSS flag, authentication-rule xrefs and XSS parameter rules are brought in line with the default, and if the default declares no XSS rules the existing ones are **cleared**. Patterns not in the default set are left alone, and new ones are created with **Match Mode** `IGNORE`. Export the provider before you run it, and re-apply customisations after seeding rather than before. To see exactly what it did, diff the export from before against the one from after; the operation reports completion, not a change list. `org.openiam.content.provider.setup.poll.attempts` ships `30` and is how many times the Webconsole polls for completion. {% endhint %} ## Uniqueness constraints and their error text | Constraint | On | Error | Message | | ---------------------- | ----------------------------------- | ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- | | `UNIQUE_CP_PATTERN` | `(DOMAIN_PATTERN, IS_SSL)` | `CONTENT_PROVIDER_DOMAIN_PATTERN_EXISTS` (124) | *"Content Provider with this Domain Pattern and Is SSL fields already exists"* | | — | `CONTENT_PROVIDER_NAME` | — | A provider name is unique across the system | | `URI_PATTERN_UNIQUE` | `(CONTENT_PROVIDER_ID, PATTERN)` | `URI_PATTERN_EXISTS` (129) | *"URI Pattern with the specified pattern already exists for Content Provider"* (`openiam.ui.am.uri.pattern.exists`) | | `UNIQUE_URI_SUB_ORDER` | `(URI_PATTERN_ID, EXECUTION_ORDER)` | — | Two HTML substitutions on one pattern cannot share an execution order | `URI_PATTERN_UNIQUE` has been present since 3.0.0.1 and never relaxed. `UNIQUE_CP_PATTERN` has covered those two columns only since 3.0.0.1 — before that it also included the context path, so a system upgraded from 3.0 may hold providers that would not be creatable today. The same pattern string **is** allowed under a different content provider, which is how one path can behave differently per host. Because the unique key is on the literal string, `/app/*` and `/app/**` are two different rows — and only one of them is a valid pattern. `URI_PATTERN_METHOD_XREF` has no unique constraint on `(URI_PATTERN_ID, HTTP_METHOD_ID)`, so duplicate method rows are possible in the database; the Webconsole refuses them with *"Method '' is defined more than once for this URI pattern. Each method must be a unique combination of matching mode and parameters."* ## Menu root properties Each Webconsole screen finds its own menu root through one of these properties, with their shipped values: | Property | Value | | ---------------------------------------------------- | ------------------------- | | `org.openiam.ui.landingpage.menu.name` | `IDM` | | `org.openiam.ui.content.provider.root.name` | `CONTENT_PROV_ROOT` | | `org.openiam.ui.content.provider.edit.name` | `CONTENT_PROV_EDIT` | | `org.openiam.ui.content.provider.pattern.name` | `URI_PATTERN_EDIT` | | `org.openiam.ui.am.provider.root.name` | `AM_PROV_ROOT` | | `org.openiam.ui.am.provider.edit.name` | `AM_PROV_EDIT` | | `org.openiam.ui.am.provider.control.panel.name` | `AUTH_PROV_CTRL_PANEL` | | `org.openiam.ui.auth.rule.root.name` | `AUTH_RULE_ROOT` | | `org.openiam.ui.landingpage.resource.root.name` | `RESOURCE_MENU_ROOT` | | `org.openiam.ui.landingpage.resource.type.root.name` | `RES_TYPE_MENU_ROOT` | | `org.openiam.ui.resource.edit.menu.name` | `RESOURCE_EDIT_PAGE_ROOT` | | `org.openiam.ui.landingpage.role.root.name` | `ROLE_ROOT_MENU` | | `org.openiam.ui.landingpage.group.root.name` | `GROUP_ROOT_MENU` | | `org.openiam.ui.organization.root.menu.id` | `ORGANIZATION_ROOT_ID` | | `org.openiam.ui.access.right.menu.id` | `ACCESS_RIGHT_ROOT` | | `org.openiam.ui.business.rule.root.name` | `BUSINESS_RULES_LM` | The SelfService menu tree is rooted at `SELFSERVICE` rather than `IDM`, from the same `org.openiam.ui.landingpage.menu.name` key in its own properties. ## The two debug tools Seeded under `CONTENT_PROV_ROOT` as of 4.0.0.0: | Resource | URL | Display name | | --------------------- | -------------------------------------------- | -------------------- | | `FEDERATE_URI_DEBUG` | `/webconsole-am/federateURIDebug.html` | URI Debug Tool | | `PRINCIPAL_URI_DEBUG` | `/webconsole-am/proxyURIPrincipalDebug.html` | Principal Debug Tool | Use the first when you cannot work out which pattern a URL resolves to, and the second when the upstream is receiving the wrong identity. ## Related * [Content providers and URI patterns](/administration-guide/access/content-providers-and-uri-patterns.md) — how routing resolves, and the inheritance rules * [Protect an application behind the Access Gateway](/administration-guide/gateway/protect-an-application.md) — the procedure these fields belong to * [Give the application the authenticated identity](/administration-guide/gateway/inject-identity.md) — header injection and form fill, worked through * [Advanced request and response transformations](/administration-guide/gateway/request-and-response-transformations.md) — substitutions, redirects and branding, worked through * [Access Gateway reference](/administration-guide/gateway/access-gateway-reference.md) — the metadata types and value sources, the gateway's own properties and directives *Applies to OpenIAM 2026.8.1. Last reviewed 17 October 2026.* --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.openiam.com/administration-guide/access/content-providers-and-uri-patterns/content-provider-reference.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.