rayfin.yml reference

Complete Rayfin 1.36.2 rayfin.yml schema for services, static hosting, Functions, storage, connectors, and secret declarations.

rayfin/rayfin.yml is the committed project configuration. The CLI reads it for rayfin dev, rayfin up, rayfin env, Functions, connectors, and secret type generation.

Top-level keys

Key	Type	Required	Description
`id`	string	yes	Project identifier. `rayfin up` uses it as the default Fabric item display name.
`name`	string	yes	Human-readable project name.
`version`	string	yes	Project version string written by scaffolding.
`services`	object	yes	Service configuration.
`connectors`	array	no	External data connector entries. The parser also tolerates legacy map shape on read.
`secrets`	array	no	Secret declarations used by Functions typing. New in 1.36
`frontend`	object	no	Deprecated; framework is auto-detected at runtime.
`publishable_key`	string	no	Legacy. Current CLI writes `RAYFIN_PUBLIC_PUBLISHABLE_KEY` to `rayfin/.env`.

`services.auth`

Microsoft Entra ID through Fabric SSO is the supported identity provider.

Key	Type	Required	Description
`enabled`	boolean	yes	Turns Auth on or off.
`fabric.enabled`	boolean	when Auth is enabled	Enables Fabric brokered auth.
`fabric.externalEntraExchange`	boolean	no	Allows callers that already hold a delegated Entra token to exchange it for a Rayfin session through external brokered endpoints. Defaults to absent/false.
`allowedRedirectUris`	string[]	no	Redirect origins accepted by Auth. `rayfin dev` and `rayfin up` add local dev and hosted origins.
`expiryInMinutes`	number	no	Session token lifetime.
`customClaims`	`Record<string, string>`	no	Custom claims added to issued tokens.
`scopes`	string[]	no	OAuth scopes.
`refreshToken.lifetimeInDays`	number	no	Refresh token lifetime.

`services.data`

Key	Type	Required	Description
`enabled`	boolean	yes	Turns Data on or off.
`dialect`	`mssql`	when enabled	Database dialect. Fabric supports `mssql`.
`allowIntrospection`	boolean	no	Enables GraphQL `__schema` / `__type` introspection. Defaults to false when omitted.
`path`	string	no	Data package directory relative to the project root.
`buildCommand`	string	no	Command to run before entity compilation.

`services.staticHosting`

Key	Type	Required	Description
`enabled`	boolean	yes	Turns static hosting on or off.
`path`	string	no	Frontend package directory relative to the project root.
`root`	string	no	Frontend root relative to `path` or project root. Absolute and parent-traversing values are invalid.
`folder`	string	when enabled	Build output folder relative to `root`.
`buildCommand`	string	no	Command to run before deploy.
`indexDocument`	string	no	Default document, usually `index.html`.
`assetAccess`	`protected` \| `public`	required for static-hosted deploys	Who can load hosted assets: `protected` requires Fabric sign-in, `public` serves anyone with the link. Replaces `anonymousAccess`. New projects scaffold `protected`, and non-interactive `rayfin up` writes `protected` when it is missing. New in 1.35.1
`embedded.only`	boolean	no	Whether the app loads only inside the Fabric portal.

Older projects may omit assetAccess. Choose explicitly before deployment; do not rely on implicit access changes.

`services.functions`

Changed in 1.36

Functions no longer need a feature flag, and enabled Functions must declare auth.type: application.

Note

Functions are not available in every Fabric region or tenant.

Key	Type	Required	Description
`enabled`	boolean	yes	Turns Functions on or off.
`auth.type`	`application`	required when enabled	Artifact-level Functions authentication. No default is applied during validation; `rayfin init --services functions` and `rayfin functions init` scaffold it. New in 1.36
`path`	string	no	Functions package directory relative to the project root. Defaults to `rayfin/functions`.
`buildCommand`	string	no	Build command before local run or deploy. Defaults to `npm run build` in local Functions tooling when omitted.

Functions that call Rayfin data through ctx.getDataClient() remain caller-scoped to the invocation's Rayfin token. Functions that use declared external connections through ctx.Tokens.<Audience> receive app-identity tokens for the configured audience, not the signed-in user's delegated token.

Invalid Functions config fails with exact messages such as:

Invalid services.functions.auth: authentication is required when Functions are enabled. Set services.functions.auth.type to "application".

`services.storage`

Experimental

Warning

Storage is experimental and may not be available in every Fabric region or tenant. Enable it with RAYFIN_FEATURE_FLAGS=storage or services.storage.enabled: true.

Key	Type	Required	Description
`enabled`	boolean	yes	Turns Storage on or off.
`path`	string	no	Storage package directory relative to the project root.

Storage depends on Data; rayfin init rejects storage without data.

`services.connectors`

Key	Type	Description
`enabled`	boolean	Deprecated no-op. Connectors are generally available and the CLI command group is always registered. Changed in 1.36

Do not add this block to new configs.

`connectors`

Top-level connectors is an array. See Connector for the command reference.

Field	Type	Required	Description
`name`	string	yes	Unique connector name, 1–256 chars, alphanumeric plus hyphen and underscore.
`type`	connector type	yes	`fabric-sqlanalytics`, `fabric-warehouse`, `fabric-sqldatabase`, `fabric-semanticmodel`, or existing `kusto`.
`version`	positive integer string	Category B	Required for `fabric-semanticmodel` and `kusto`, for example `'1'`.
`config.workspaceId`	string	Fabric connectors	Fabric workspace ID.
`config.itemId`	string	Fabric connectors	Fabric item ID.
`auth.type`	`delegated` \| `application`	yes	Required. Category A defaults to `application` when added by CLI in 1.36; Category B supports `delegated` only. Changed in 1.36
`operations[].name`	operation	no	Subset of allowed operations; omit for all allowed operations.

Type	Category	Default auth in 1.36	Allowed auth	Operations	Authoring status
`fabric-sqlanalytics`	Category A	`application`	`delegated`, `application`	`read`	Released
`fabric-warehouse`	Category A	`application`	`delegated`, `application`	`read`, `create`, `update`, `delete`	Released
`fabric-sqldatabase`	Category A	`application`	`delegated`, `application`	`read`, `create`, `update`, `delete`	Released
`fabric-semanticmodel`	Category B	`delegated`	`delegated`	`executeQuery`	Released
`kusto`	Category B	`delegated`	`delegated`	`executeQuery`, `executeCommand`	Held: existing declarations validate and deploy, but 1.36 authoring commands reject new Kusto connectors. Changed in 1.36

`secrets`

New in 1.36

rayfin secret set --describe="..." appends declarations here. Values are never stored in rayfin.yml; only names and descriptions are committed.

rayfin/rayfin.yml

secrets:
  - name: STRIPE_API_KEY
    description: API key used by payment functions

Field	Type	Required	Description
`name`	string	yes	Secret name used by `ctx.Secrets.<NAME>` and type generation.
`description`	string	no	Human-readable description. When omitted from `rayfin secret set`, the CLI writes `TODO: Add description for this secret`.

Complete example

rayfin/rayfin.yml

id: universal-app
name: Universal App
version: 1.0.0
services:
  auth:
    enabled: true
    fabric:
      enabled: true
      externalEntraExchange: true
    allowedRedirectUris:
      - http://localhost:5173
  data:
    enabled: true
    dialect: mssql
    allowIntrospection: false
  staticHosting:
    enabled: true
    path: packages/frontend
    folder: dist
    buildCommand: npm run build:fabric
    indexDocument: index.html
    assetAccess: protected
    embedded:
      only: false
  functions:
    enabled: true
    path: packages/functions
    buildCommand: npm run build
    auth:
      type: application
  storage:
    enabled: false
connectors:
  - name: sales_warehouse
    type: fabric-warehouse
    config:
      workspaceId: 00000000-0000-0000-0000-000000000000
      itemId: 11111111-1111-1111-1111-111111111111
    auth:
      type: application
secrets:
  - name: STRIPE_API_KEY
    description: API key used by payment functions

Environment interpolation

Any value may use ${VAR} or ${VAR:-default}. See Environment variable interpolation.

PromptFix a Rayfin 1.36 configuration

Read rayfin/rayfin.yml and update it for Rayfin 1.36: add
`services.staticHosting.assetAccess: protected` if static hosting is enabled and missing,
add `services.functions.auth.type: application` if Functions are enabled, and remove any
need for `services.connectors.enabled`. Then run `npx rayfin up --dry-run`.

Something wrong on this page?Report an issueEdit this page

rayfin.yml reference

On this page