---
title: "Site Settings"
manual: "TCA_API"
version: "2.2"
permalink: "https://docs.typo3.org/permalink/maikschneider/tca-api:site-settings@2.2"
source: "Configuration/SiteSettings.rst"
rendered: "2026-10-12T13:17:40+00:00"
---

# Site Settings {#site-settings}

The following settings are configurable per site in the TYPO3 backend under
**Site Management → Sites → Settings** in the **TCA_API** category.

## General {#general}

-   **tca_api.enabled**

    -   *Type:* bool
    -   *Default:* `true`

    Enable or disable the API for this site. When disabled, the middleware
    passes all requests through without processing.

-   **tca_api.apiPrefix**

    -   *Type:* string
    -   *Default:* `/_api/`

    URL path prefix for all API endpoints. Must start and end with a slash.
    The API is inactive until this is set.

-   **tca_api.defaultItemsPerPage**

    -   *Type:* int
    -   *Default:* `20`

    Default number of items returned per page in collection responses.
    Can be overridden per resource in the resource definition.

-   **tca_api.allowedResources**

    -   *Type:* string
    -   *Default:* *(empty — all)*

    Comma-separated list of resource names to expose on this site. Leave
    empty to allow all registered resources.

-   **tca_api.debugMode**

    -   *Type:* bool
    -   *Default:* `false`

    Return verbose error details in API responses, and re-throw contained
    processor failures instead of degrading the column to `null` (see
    [Processor failures are contained](https://docs.typo3.org/permalink/maikschneider/tca-api:processor-error-containment@2.2)). **Disable on production sites.**

## API specification {#api-specification}

-   **tca_api.openApiExposed**

    -   *Type:* string
    -   *Default:* `PUBLIC`

    Who may access the OpenAPI JSON spec at `{apiPrefix}openapi.json`.
    Allowed values: `PUBLIC`, `FE_USER`, `BE_USER`, `BE_ADMIN`,
    `NONE`.

-   **tca_api.apiSpecTitle**

    -   *Type:* string
    -   *Default:* `TCA_API`

    Title shown in the OpenAPI spec info block and Swagger UI header.

-   **tca_api.apiSpecDescription**

    -   *Type:* string
    -   *Default:* *(empty)*

    Short description shown in the OpenAPI spec info block and Swagger UI.

-   **tca_api.apiSpecVersion**

    -   *Type:* string
    -   *Default:* `1.0.0`

    Version string for the OpenAPI spec info block.

-   **tca_api.swaggerUiEnabled**

    -   *Type:* string
    -   *Default:* `PUBLIC`

    Who may access the interactive Swagger UI at `{apiPrefix}swagger-ui`.
    Allowed values: `PUBLIC`, `FE_USER`, `BE_USER`, `BE_ADMIN`,
    `NONE`.

## CORS {#cors}

-   **tca_api.corsEnabled**

    -   *Type:* bool
    -   *Default:* `false`

    Add CORS headers to API responses.

-   **tca_api.corsOrigin**

    -   *Type:* string
    -   *Default:* `*`

    Value for the `Access-Control-Allow-Origin` header. Use `*` to allow
    all origins.

-   **tca_api.corsAllowCredentials**

    -   *Type:* bool
    -   *Default:* `false`

    When enabled, adds `Access-Control-Allow-Credentials: true` to CORS
    responses. Required when the frontend sends cookies or `Authorization`
    headers with cross-origin requests. Note: browsers reject credentialed
    requests when `corsOrigin` is `*` — set it to the specific origin
    instead.