# Settings.json endpoint usage

**URL:** <https://community.passbolt.com/t/settings-json-endpoint-usage/14025>\
**Category:** API & Customization issues\
**Created:** [January 16, 2026, 5:57am UTC](https://community.passbolt.com/t/settings-json-endpoint-usage/14025 "2026-01-16T05:57:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sysadmin.pv](https://avatars.discourse-cdn.com/v4/letter/s/dec6dc/32.png) [@sysadmin.pv](https://community.passbolt.com/u/sysadmin.pv)\
**Post date:** [January 16, 2026, 5:57am UTC](https://community.passbolt.com/t/settings-json-endpoint-usage/14025/1 "2026-01-16T05:57:51Z")

</div>

Why is this endpoint the only one that’s public? It asks for a token, but when queried, it’s accessible:

 ![image](https://canada1.discourse-cdn.com/flex031/uploads/passbolt/original/2X/f/fdb3c66823423da122370db16ff5339699826cd3.png)

---

<div class="post-metadata">

**Author:** ![remy](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/remy/32/17_2.png) [@remy](https://community.passbolt.com/u/remy)\
**Post date:** [January 16, 2026, 12:51pm UTC](https://community.passbolt.com/t/settings-json-endpoint-usage/14025/2 "2026-01-16T12:51:02Z")

</div>

Hello,

GET /settings.json unauthenticated contains information about the instrance configuration that can be used by the clients. This include things such as what is the prefered locale, where is the privacy policy, is SSO enabled, is public registration open, etc.

This endpoint contains additional information when authenticated, such as which other plugins are enabled, e.g. what are the other server capabilities.

Cheers,

---

<div class="post-metadata">

**Author:** ![sysadmin.pv](https://avatars.discourse-cdn.com/v4/letter/s/dec6dc/32.png) [@sysadmin.pv](https://community.passbolt.com/u/sysadmin.pv)\
**Post date:** [January 16, 2026, 2:30pm UTC](https://community.passbolt.com/t/settings-json-endpoint-usage/14025/3 "2026-01-16T14:30:55Z")

</div>

Hello,

Thank you for the explanation, that part is clear now.

Just to clarify my original question: I wasn’t asking _what the endpoint is used for_, but rather whether it is **expected and considered normal/safe that `/settings.json` is publicly accessible (unauthenticated) on an internet-exposed Passbolt instance**.

Since the instance is reachable from the internet, I wanted to confirm that exposing this endpoint by design is not a misconfiguration or a security concern, but an intentional behavior required for clients to function.

So, to summarize my doubt:

- Is it normal and expected that `/settings.json` is publicly accessible?

- Is this exposure considered safe from a security standpoint?

Thanks in advance for the clarification.

Best regards,

---

<div class="post-metadata">

**Author:** ![remy](https://yyz1.discourse-cdn.com/flex031/user_avatar/community.passbolt.com/remy/32/17_2.png) [@remy](https://community.passbolt.com/u/remy)\
**Post date:** [January 16, 2026, 2:36pm UTC](https://community.passbolt.com/t/settings-json-endpoint-usage/14025/4 "2026-01-16T14:36:57Z")

</div>

> Is this exposure considered safe from a security standpoint?

Yes as it only exposes the minimal number of information that is required for the client to operate (like language preferences), and by default all instances have the same config. That’s why it contains different types of information when you are logged in or not, since the other information is not needed unless logged in.