> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt
> Use this file to discover all available pages before exploring further.

# Operating Lerian BC Correios

> Readiness probes, the BACEN request quota, credentials and keys, storage and retention, metrics, and the production posture of Lerian BC Correios.

Lerian BC Correios carries your official correspondence with BACEN, so an instance that is not ready is an operational event.

## Health and readiness

***

`GET /health` reports liveness. It answers `200` while the process runs, and it does not check dependencies.

`GET /readyz` runs the dependency checks. It answers `200` when the service can take traffic, and `503` when it cannot or while it shuts down. It reuses a result for 250 milliseconds.

| Check | What it probes |
| - | - |
| `postgres` | The PostgreSQL database. |
| `cache` | The Valkey or Redis cache. |
| `rabbitmq` | The RabbitMQ broker. |
| `storage` | The object storage for attachments. |
| `license_client` | The Lerian license server. |
| `startup_self_probe` | The startup self-check of the service. |
| `systemplane` | The runtime configuration store, when present. |

In multi-tenant mode, `/readyz` also checks the Tenant Manager and its event Redis.

`/readyz` does not call BC Correio, because each tenant has its own credentials. To check the link to BC Correio for a tenant, call `POST /settings/test-connection`.

`GET /version` returns the build version of the service.

## BACEN request quota and circuit breaker

***

Lerian BC Correios limits its calls to BC Correio per Sisbacen credential:

* `BC_CORREIO_RATE_LIMIT_PER_MINUTE` calls per minute, 50 by default.
* `BC_CORREIO_RATE_LIMIT_PER_HOUR` calls per hour, 2700 by default.

The service refuses a value above 60 per minute or 3000 per hour. When the cache is available, all replicas share one count per credential. A call waits up to `BC_CORREIO_RATE_LIMIT_MAX_WAIT_SEC` seconds for a free slot, 90 by default.

Each tenant has its own circuit breaker for BC Correio. Five failures in a row open it. After 30 seconds, it lets one call through to test BC Correio again.

## Credentials and keys

***

`ENCRYPTION_KEY` holds the AES-256-GCM key that encrypts the BC Correio credentials, the AI API keys, and the stored idempotency answers. It takes exactly 32 bytes. Outside the `development` environment, the service does not start without it.

`AMQP_SIGNING_KEY` holds the key that signs the audit messages on RabbitMQ. Without it, the service derives a separate key from `ENCRYPTION_KEY`. When you set it, it takes exactly 32 bytes and must differ from `ENCRYPTION_KEY`.

## Storage, outbox and retention

***

Lerian BC Correios stores mail in PostgreSQL. It stores attachments in S3-compatible object storage, or on the local filesystem when `OBJECT_STORAGE_PROVIDER` is `local`.

User actions reach the audit trail through an outbox table and RabbitMQ. The outbox tries each event up to `AUDIT_OUTBOX_MAX_ATTEMPTS` times, 50 by default. The retention worker deletes published outbox rows after `AUDIT_OUTBOX_RETENTION_DAYS` days, 7 by default.

The retention worker runs once every 24 hours and applies the retention period of each tenant.

The service does not apply its own database schema. A separate migration step applies it before the service starts.

## Metrics and tracing

***

Set `TRACING_ENABLED=true` to export traces, and `METRICS_ENABLED=true` to export metrics, over OTLP to `OTEL_EXPORTER_OTLP_ENDPOINT`.

Set `METRICS_PROMETHEUS_ENABLED=true` to open a separate listener for a Prometheus scrape, on `METRICS_PROMETHEUS_ADDRESS`. The default address is `127.0.0.1:9076`. The main port has no metrics endpoint.

See [Observability](/en/platform/observability) for the platform view.

## Deployment posture

***

`DEPLOYMENT_MODE` takes `local`, `byoc`, or `saas`. In `saas`, every configured dependency must use TLS, or the service does not start.

`ENV_NAME` decides how strict the startup checks are. With any value other than `development`, the service also requires:

* `POSTGRES_USER` and `POSTGRES_NAME`, with a `POSTGRES_SSLMODE` other than `disable`.
* `RABBITMQ_URL`, without the `guest:guest` credentials. The service does not start if it cannot connect to RabbitMQ.
* `ENCRYPTION_KEY`, with exactly 32 bytes.
* `ALLOWED_ORIGINS`, with a value other than `*`.
* `FEATURE_AUDIT_ENABLED` not set to `false`.

Every environment needs `LICENSE_KEY` and an explicit `true` or `false` in `PLUGIN_AUTH_ENABLED`. A missing or invalid value stops the boot.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.