# Kds.Ai.ApiService - Deployment Parameters

REST API service providing endpoints for monitor management, alert events, and anomaly detection orchestration.

## Required Configuration Parameters

### 1. Database Connection Strings

#### Application Database (PostgreSQL)
- **Parameter**: `ConnectionStrings:kdsaidb`
- **Environment Variable**: `ConnectionStrings__kdsaidb`
- **Type**: Connection string
- **Required**: Yes
- **Description**: PostgreSQL connection string for the main application database storing monitor specifications, runs, and alerts
- **Format**: `Host=<host>;Port=<port>;Database=<dbname>;Username=<user>;Password=<password>`
- **Example**: `Host=localhost;Port=13313;Database=kdsaidb;Username=postgres;Password=Passw0rd!`
- **Environment Variable Example**:
  ```bash
  export ConnectionStrings__kdsaidb="Host=localhost;Port=13313;Database=kdsaidb;Username=postgres;Password=Passw0rd!"
  ```
- **Used by**: 
  - Entity Framework Core DbContext
  - TickerQ operational store
  - Monitor specs, runs, and alert events storage

#### Warehouse Database (PostgreSQL)
- **Parameter**: `ConnectionStrings:warehousedb`
- **Environment Variable**: `ConnectionStrings__warehousedb`
- **Type**: Connection string
- **Required**: Yes
- **Description**: Read-only PostgreSQL connection string for the data warehouse queried by anomaly detection agents
- **Format**: `Host=<host>;Port=<port>;Database=<dbname>;Username=<user>;Password=<password>`
- **Example**: `Host=warehouse.example.com;Port=5432;Database=restaurant_data;Username=readonly;Password=<password>`
- **Environment Variable Example**:
  ```bash
  export ConnectionStrings__warehousedb="Host=warehouse.example.com;Port=5432;Database=restaurant_data;Username=readonly;Password=SecurePass123"
  ```
- **Used by**:
  - Anomaly detection agent for executing data queries
  - Warehouse query tool provider

#### Redshift Warehouse Database (Tenant-Aware Runtime)
- **Parameter**: `ConnectionStrings:redshiftwarehousedb`
- **Environment Variable**: `ConnectionStrings__redshiftwarehousedb`
- **Type**: Connection string
- **Required**: For Redshift-backed ETL/runtime features
- **Description**: Base Redshift connection string used by the tenant-aware warehouse foundation. Runtime connections reuse this string and override only the target database name.
- **Format**: `Host=<host>;Port=5439;Database=<admin-db>;Username=<user>;Password=<password>;Ssl Mode=Require`
- **Environment Variable Example**:
  ```bash
  export ConnectionStrings__redshiftwarehousedb="Host=redshift.example.amazonaws.com;Port=5439;Database=dev;Username=admin;Password=SecurePass123;Ssl Mode=Require"
  ```
- **Used by**:
  - Tenant warehouse bootstrap/admin operations
  - Tenant-resolved Redshift runtime reads

### 2. AWS Credentials

#### Access Key ID
- **Parameter**: `AwsCredentials:AccessKeyId`
- **Environment Variable**: `AwsCredentials__AccessKeyId`
- **Type**: String (Secret)
- **Required**: Yes
- **Description**: AWS IAM access key ID with permissions to invoke AWS Bedrock models and access S3
- **Security**: Sensitive credential - should be stored in secrets management
- **Environment Variable Example**:
  ```bash
  export AwsCredentials__AccessKeyId="AKIAIOSFODNN7EXAMPLE"
  ```
- **Used by**: AWS Bedrock Runtime client for LLM access, S3 client for document storage

#### Secret Access Key
- **Parameter**: `AwsCredentials:SecretAccessKey`
- **Environment Variable**: `AwsCredentials__SecretAccessKey`
- **Type**: String (Secret)
- **Required**: Yes
- **Description**: AWS IAM secret access key paired with the access key ID
- **Security**: Sensitive credential - should be stored in secrets management
- **Environment Variable Example**:
  ```bash
  export AwsCredentials__SecretAccessKey="wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
  ```
- **Used by**: AWS Bedrock Runtime client for LLM access, S3 client for document storage

#### Model ID
- **Parameter**: `AwsCredentials:ModelId`
- **Environment Variable**: `AwsCredentials__ModelId`
- **Type**: String
- **Required**: Yes
- **Description**: AWS Bedrock model identifier for the LLM used in anomaly detection
- **Valid Options**:
  - `global.anthropic.claude-sonnet-4-5-20250929-v1:0` (Recommended for production)
  - `global.anthropic.claude-haiku-4-5-20251001-v1:0` (Cost-optimized)
- **Default**: `global.anthropic.claude-haiku-4-5-20251001-v1:0`
- **Environment Variable Example**:
  ```bash
  export AwsCredentials__ModelId="global.anthropic.claude-sonnet-4-5-20250929-v1:0"
  ```
- **Used by**: Chat client for agent-based anomaly detection

### 3. Warehouse Database Query Settings (Optional)

#### Max Rows
- **Parameter**: `WarehouseDbSettings:MaxRows`
- **Environment Variable**: `WarehouseDbSettings__MaxRows`
- **Type**: Integer
- **Required**: No
- **Default**: `10000`
- **Description**: Maximum number of rows the anomaly detection agent can retrieve in a single query
- **Purpose**: Prevents runaway queries from consuming excessive memory
- **Recommended Range**: 1000-50000 depending on available memory
- **Environment Variable Example**:
  ```bash
  export WarehouseDbSettings__MaxRows="10000"
  ```

#### Command Timeout (Optional)
- **Parameter**: `WarehouseDbSettings:CommandTimeoutSeconds`
- **Environment Variable**: `WarehouseDbSettings__CommandTimeoutSeconds`
- **Type**: Integer
- **Required**: No
- **Default**: `30`
- **Description**: Timeout in seconds for individual SQL queries against the warehouse database
- **Purpose**: Prevents long-running queries from blocking detection
- **Recommended Range**: 10-120 seconds
- **Environment Variable Example**:
  ```bash
  export WarehouseDbSettings__CommandTimeoutSeconds="30"
  ```

## .NET Aspire Configuration

When running via the AppHost (`Kds.Ai.AppHost`) using `aspire run`:

- **First Run**: Aspire will prompt for AWS credentials (`AccessKeyId` and `SecretAccessKey`) and securely store them in the .NET user secrets store
- **Subsequent Runs**: Credentials are automatically loaded from the secret store
- **Database Connection Strings**: Automatically injected via resource references in the AppHost configuration
- **Local Redshift Secret**: Set `ConnectionStrings__redshiftwarehousedb` locally from the AWS SSM value stored at `/ecs/kds-ai/ConnectionStrings__redshiftwarehousedb`

Configuration details in `AppHost.cs`:
```csharp
// Database references
builder.AddProject<Kds_Ai_ApiService>("apiservice")
    .WithReference(aiDatabase)           // Injects ConnectionStrings:kdsaidb
    .WithReference(warehouseDb)          // Injects ConnectionStrings:warehousedb
    .WithReference(redshiftWarehouseDb)  // Injects ConnectionStrings:redshiftwarehousedb
    
// AWS parameters
    .WithEnvironment("AwsCredentials__ModelId", analysisModel)
    .WithEnvironment("AwsCredentials__AccessKeyId", awsAccessKeyId)
    .WithEnvironment("AwsCredentials__SecretAccessKey", awsSecretAccessKey)
```