# URL configuration

Use this page to understand service URL fields for Ripple Custody. The example shows one possible URL shape; your DNS records, ingress hosts, TLS certificates, and service subdomains depend on your deployment.

This page applies to on-premise deployments only. For current defaults and the full supported schema, use the configuration packaged with your release.

## What this config controls

The `harmonize.urls` section defines the base URL and service URLs used by Ripple Custody. By default, service URLs are derived as subdomains of the base URL.

## Configuration fields

Location: `harmonize.urls`

| Parameter | Type | Default | Description |
|  --- | --- | --- | --- |
| `base` | string | `flat.m3t4c0.fun` | Base URL for services. Other URLs are derived as subdomains of this value. |
| `tls` | boolean | `false` | Enables TLS/HTTPS for ingress endpoints. |
| `frontend` | string | `<base>` | UI URL for Frontend V1. |
| `frontend-v2` | string | `v2.<base>` | UI URL for Frontend V2. |
| `api` | string | `api.<base>` | API Gateway URL. |
| `graphapi` | string | `graphapi.<base>` | GraphQL API URL. |
| `auth` | string | `openid.<base>` | OpenID authentication URL. |
| `oidc` | string | `openid.<base>` | OIDC/Keycloak URL. |


Additional internal subdomains, such as Notary and Vault services, follow the same `<service>.<base>` pattern unless you override them in your release configuration.

## Constraints and relationships

- DNS records need to resolve the configured hostnames to your ingress or load balancer.
- TLS certificates need to cover the configured hostnames when `tls` is `true`.
- Override individual service URLs only when your DNS layout requires a non-default pattern.
- Ingress certificate and route settings are configured separately. See [Networking configuration](/products/custody/v1.36/deployment/reference/networking).


## Example

This example uses the default subdomain pattern:


```yaml
harmonize:
  urls:
    base: "custody.yourcompany.com"
    tls: true
```

This creates:

https://custody.yourcompany.com — Frontend

https://v2.custody.yourcompany.com — Frontend V2

https://api.custody.yourcompany.com — API Gateway

https://openid.custody.yourcompany.com — OpenID authentication

Additional service URLs (`graphapi`, `notary-bridge`, `vault-bridge`, etc.) are also derived automatically. Override individual URLs only when you need a non-standard subdomain pattern.

## Related topics

- [Networking configuration](/products/custody/v1.36/deployment/reference/networking)
- [OAuth server configuration](/products/custody/v1.36/deployment/reference/oauth-server)
- [Keycloak configuration](/products/custody/v1.36/deployment/reference/keycloak)