Message Ops

An environment is a saved Solace broker connection, with a stable ID used in API requests, jobs, schedules and role assignments. Open System → Environments, not the Admin submenu. Creating environments requires suitable environment-management permissions; changes may prompt for a recent MFA verification. See RBAC.

Prepare a broker connection

Obtain the SEMP base URL, messaging URL, default Message VPN (optional), and separate SEMP and messaging usernames/passwords from the broker owner. Confirm that the API and Worker execution paths can resolve and reach these endpoints; a browser’s ability to reach them is insufficient. Ask the infrastructure operator to check networking and CA trust.

Use HTTPS for SEMP where available. Explicit http:// SEMP endpoints are supported in production; the form warns that HTTP exposes SEMP traffic and authentication credentials without TLS. Save HTTP only when your network security policy permits it. The product never downgrades HTTPS to HTTP automatically. This setting affects only SEMP; it does not disable database, browser, SSO, OTLP or messaging TLS controls.

Create and verify

1. Select Create Environment.
2. Enter Environment ID, Name, Default VPN name if required, SEMP base URL, Messaging URL, SEMP username, Messaging username, and both passwords. Leave Enabled selected when the environment is ready for use.
3. Keep Verify broker TLS certificate selected. Supply Broker CA certificate (PEM, optional) when the messaging broker uses a private CA; do not disable verification as a connectivity workaround. This field controls messaging trust, not PostgreSQL or IdP trust.
4. Select Create Environment and complete MFA if prompted.
5. Use Test Connection, inspect the result and health, then select the environment and Message VPN in the sidebar. Confirm Queue explorer lists the expected queues and a bounded message search completes. Connection testing alone does not prove every message permission.

The API encrypts broker passwords in PostgreSQL; Worker reads them using the shared credential encryption key. The UI manages the internal credential reference. Configure these credentials through the application, independently of deployment secrets.

If connection testing fails, first check the exact hostname, scheme/port, VPN and credentials. Have the operator check DNS/routes/firewalls and CA chains from the server execution path. Do not paste passwords into tickets or logs. If queue listing works but a job fails, inspect the job’s item report and verify the messaging account’s broker permissions separately.

Environment names must be unique. Creating or renaming a profile to an existing name returns HTTP 409 with “An environment with this name already exists”. Choose a different name and retry. A rejected create or edit leaves existing profiles and their stored credentials unchanged.

Edit, rotate or retire

Use Edit then Save Changes. The ID cannot be edited; use a meaningful stable identifier at creation. Leave either password blank to keep its stored value when its endpoint destination is unchanged; enter the new password to rotate it. Changing an endpoint host, port or scheme requires re-entering that endpoint’s password. The API rejects the update with HTTP 400 if the matching password is missing or blank, so stored credentials cannot follow a new destination. Disabling messaging TLS verification or adding, replacing or clearing the broker CA also requires the messaging password; otherwise the API returns HTTP 400 CREDENTIAL_REENTRY_REQUIRED. Coordinate broker-side rotation, save, test connectivity and complete an approved test job before retiring old broker credentials. No API/Worker restart is required for an environment credential edit.

Uncheck Enabled to suspend use without deleting the profile. Before deleting, review pending jobs, schedules, environment groups and scoped assignments. Deleting a profile does not reverse completed message operations. Record the change and confirm users can access only intended remaining environments.

For everyday selection and empty states, see Environments for users.