From 1e8b01ac72ba5721ca4c65efae51ec60f7c1529c Mon Sep 17 00:00:00 2001
From: Simon Schweizer <simon@schwzr.de>
Date: Tue, 10 Feb 2026 11:26:33 +0100
Subject: [PATCH 1/5] content for dsf v2.0.2

---
 docs/src/.vuepress/layouts/PageLayout.vue     |   5 +-
 .../sidebar/fetch-versioned-release-notes.sh  |   2 +-
 docs/src/.vuepress/theme.ts                   |   5 +-
 docs/src/index.md                             |   2 +-
 docs/src/operations/latest                    |   2 +-
 docs/src/operations/old-versions.md           |   1 +
 docs/src/operations/v2.0.0/release-notes.md   |  51 +-
 docs/src/operations/v2.0.1/release-notes.md   | 113 +-
 docs/src/operations/v2.0.1/upgrade-from-1.md  |   4 +-
 docs/src/operations/v2.0.1/upgrade-from-2.md  |   4 +-
 docs/src/operations/v2.0.2/allowList-mgm.md   |  34 +
 .../v2.0.2/bpe-reverse-proxy/README.md        |   6 +
 .../v2.0.2/bpe-reverse-proxy/configuration.md | 109 ++
 docs/src/operations/v2.0.2/bpe/README.md      |  10 +
 .../operations/v2.0.2/bpe/access-control.md   | 104 ++
 .../operations/v2.0.2/bpe/configuration.md    | 963 ++++++++++++++++++
 .../v2.0.2/bpe/fhir-client-connections.md     |  87 ++
 docs/src/operations/v2.0.2/bpe/logging.md     | 788 ++++++++++++++
 docs/src/operations/v2.0.2/bpe/oidc.md        |  56 +
 .../v2.0.2/fhir-reverse-proxy/README.md       |   6 +
 .../fhir-reverse-proxy/configuration.md       | 116 +++
 docs/src/operations/v2.0.2/fhir/README.md     |   9 +
 .../operations/v2.0.2/fhir/access-control.md  | 146 +++
 .../operations/v2.0.2/fhir/configuration.md   | 551 ++++++++++
 docs/src/operations/v2.0.2/fhir/logging.md    | 704 +++++++++++++
 docs/src/operations/v2.0.2/fhir/oidc.md       |  63 ++
 docs/src/operations/v2.0.2/index.md           |  23 +
 docs/src/operations/v2.0.2/install-plugins.md |  78 ++
 docs/src/operations/v2.0.2/install.md         | 228 +++++
 .../operations/v2.0.2/passwords-secrets.md    |  33 +
 docs/src/operations/v2.0.2/release-notes.md   |  11 +
 .../operations/v2.0.2/root-certificates.md    | 234 +++++
 docs/src/operations/v2.0.2/upgrade-from-1.md  | 214 ++++
 docs/src/operations/v2.0.2/upgrade-from-2.md  |  76 ++
 34 files changed, 4722 insertions(+), 116 deletions(-)
 create mode 100644 docs/src/operations/v2.0.2/allowList-mgm.md
 create mode 100644 docs/src/operations/v2.0.2/bpe-reverse-proxy/README.md
 create mode 100644 docs/src/operations/v2.0.2/bpe-reverse-proxy/configuration.md
 create mode 100644 docs/src/operations/v2.0.2/bpe/README.md
 create mode 100644 docs/src/operations/v2.0.2/bpe/access-control.md
 create mode 100644 docs/src/operations/v2.0.2/bpe/configuration.md
 create mode 100644 docs/src/operations/v2.0.2/bpe/fhir-client-connections.md
 create mode 100644 docs/src/operations/v2.0.2/bpe/logging.md
 create mode 100644 docs/src/operations/v2.0.2/bpe/oidc.md
 create mode 100644 docs/src/operations/v2.0.2/fhir-reverse-proxy/README.md
 create mode 100644 docs/src/operations/v2.0.2/fhir-reverse-proxy/configuration.md
 create mode 100644 docs/src/operations/v2.0.2/fhir/README.md
 create mode 100644 docs/src/operations/v2.0.2/fhir/access-control.md
 create mode 100644 docs/src/operations/v2.0.2/fhir/configuration.md
 create mode 100644 docs/src/operations/v2.0.2/fhir/logging.md
 create mode 100644 docs/src/operations/v2.0.2/fhir/oidc.md
 create mode 100644 docs/src/operations/v2.0.2/index.md
 create mode 100644 docs/src/operations/v2.0.2/install-plugins.md
 create mode 100644 docs/src/operations/v2.0.2/install.md
 create mode 100644 docs/src/operations/v2.0.2/passwords-secrets.md
 create mode 100644 docs/src/operations/v2.0.2/release-notes.md
 create mode 100644 docs/src/operations/v2.0.2/root-certificates.md
 create mode 100644 docs/src/operations/v2.0.2/upgrade-from-1.md
 create mode 100644 docs/src/operations/v2.0.2/upgrade-from-2.md

diff --git a/docs/src/.vuepress/layouts/PageLayout.vue b/docs/src/.vuepress/layouts/PageLayout.vue
index b18602e2a..3e16805ff 100644
--- a/docs/src/.vuepress/layouts/PageLayout.vue
+++ b/docs/src/.vuepress/layouts/PageLayout.vue
@@ -4,7 +4,7 @@ import { useRoute, useRouter } from "vue-router";
 import { ref, onMounted } from 'vue'
 
 const version = ref("");
-const latestVersion = "v2.0.1";
+const latestVersion = "v2.0.2";
 
 
 function setVersionBasedOnCurrentPath() : void {
@@ -55,7 +55,8 @@ function navigateToNewVersion() {
       <div class="version-selector" v-if="route.path.startsWith('/operations/')">
         <label class="vp-sidebar-header" for="version-select"><strong>Version:</strong> </label>
         <select id="version-select" class="vp-sidebar-header" v-model="version" @change="navigateToNewVersion">
-        <option value="v2.0.1">latest (2.0.1)</option>
+        <option value="v2.0.2">latest (2.0.2)</option>
+        <option value="v2.0.1">2.0.1</option>
         <option value="v2.0.0">2.0.0</option>
         <option value="v1.9.0">1.9.0</option>
         <option value="v1.8.0">1.8.0</option>
diff --git a/docs/src/.vuepress/sidebar/fetch-versioned-release-notes.sh b/docs/src/.vuepress/sidebar/fetch-versioned-release-notes.sh
index 3030c1353..badd2ac6e 100755
--- a/docs/src/.vuepress/sidebar/fetch-versioned-release-notes.sh
+++ b/docs/src/.vuepress/sidebar/fetch-versioned-release-notes.sh
@@ -10,7 +10,7 @@ REPO_NAME="dsf"
 OUTPUT_BASE_DIR="../../operations"
 
 # Define the range of versions 
-VERSIONS=("v1.0.0" "v1.1.0" "v1.2.0" "v1.3.0" "v1.3.1" "v1.3.2" "v1.4.0" "v1.5.0" "v1.5.1" "v1.5.2" "v1.6.0" "v1.7.0" "v1.7.1" "v1.8.0" "v1.9.0" "v2.0.0")
+VERSIONS=("v1.0.0" "v1.1.0" "v1.2.0" "v1.3.0" "v1.3.1" "v1.3.2" "v1.4.0" "v1.5.0" "v1.5.1" "v1.5.2" "v1.6.0" "v1.7.0" "v1.7.1" "v1.8.0" "v1.9.0" "v2.0.0" "v2.0.1" "v2.0.2")
 
 # Fetch all release details
 echo "Fetching all releases..."
diff --git a/docs/src/.vuepress/theme.ts b/docs/src/.vuepress/theme.ts
index c3f727500..c69747292 100644
--- a/docs/src/.vuepress/theme.ts
+++ b/docs/src/.vuepress/theme.ts
@@ -43,7 +43,7 @@ export default hopeTheme({
             link: "v1.9.0/readme.md",
             icon: "launch"
           }, {
-            text: "Current version - 2.0.1",
+            text: "Current version - 2.0.2",
             link: "get-started.md",
             icon: "launch"
           }, "old-versions.md"],
@@ -130,7 +130,8 @@ export default hopeTheme({
     "/operations/old-versions": [],
     "/operations/latest/": generate_v2_latest_sidebar(),
     "/operations/next/": [],
-    "/operations/v2.0.1/": generate_v2_latest_sidebar(),
+    "/operations/v2.0.2/": generate_v2_latest_sidebar(),
+    "/operations/v2.0.1/": generate_v2_0_0_sidebar(),
     "/operations/v2.0.0/": generate_v2_0_0_sidebar(),
     "/operations/v1.9.0/": generate_v1_latest_sidebar(),
     "/operations/v1.8.0/": generate_v1_gt_eq_1_7_0_sidebar(),
diff --git a/docs/src/index.md b/docs/src/index.md
index 01d316123..8ffea3252 100644
--- a/docs/src/index.md
+++ b/docs/src/index.md
@@ -38,7 +38,7 @@ The **Data Sharing Framework (DSF)** is a concept for a secure middleware to dis
 ![DSF concept](/photos/info/introduction/dsf-concept.png)
 
 
-## News
+## [News](/news/)
 
 ::: info **DSF Spring School 2026 - Registrations are now open!**
 Get ready for the third edition of the **DSF Community Spring School 2026**, happening **February 24–26 at Heilbronn University**! Dive into a immersive, hand-on experience and connect with the DSF Community. Sign up now, save the date, and be part of it!
diff --git a/docs/src/operations/latest b/docs/src/operations/latest
index 81ef58f26..b02d37b0f 120000
--- a/docs/src/operations/latest
+++ b/docs/src/operations/latest
@@ -1 +1 @@
-v2.0.1
\ No newline at end of file
+v2.0.2
\ No newline at end of file
diff --git a/docs/src/operations/old-versions.md b/docs/src/operations/old-versions.md
index 7f44da463..c4c735811 100644
--- a/docs/src/operations/old-versions.md
+++ b/docs/src/operations/old-versions.md
@@ -5,6 +5,7 @@ icon: launch
 
 ## DSF v1
 
+- [1.9.0](./v1.9.0/)
 - [1.8.0](./v1.8.0/)
 - [1.7.1](./v1.7.1/)
 - [1.7.0](./v1.7.0/)
diff --git a/docs/src/operations/v2.0.0/release-notes.md b/docs/src/operations/v2.0.0/release-notes.md
index da34295fd..f2fd94c8f 100644
--- a/docs/src/operations/v2.0.0/release-notes.md
+++ b/docs/src/operations/v2.0.0/release-notes.md
@@ -1,18 +1,21 @@
----
-title: Release Notes (v2.0.0)
-icon: note
----
-
-## [Release Notes for v2.0.0](https://github.com/datasharingframework/dsf/releases/tag/v2.0.0)
-
-::: tip Release Notes
-You can access all release notes on our [GitHub](https://github.com/datasharingframework/dsf/releases).
-:::
-
-### Second Release Candidate for 2.0.0
+---
+title: Release Notes (v2.0.0)
+icon: note
+---
+
+## [Release Notes for v2.0.0](https://github.com/datasharingframework/dsf/releases/tag/v2.0.0)
+
+::: tip Release Notes
+You can access all release notes on our [GitHub](https://github.com/datasharingframework/dsf/releases).
+:::
+
+### 2.0.0 - Major Release
 General remarks:
-- This is the second release candidate for the upcoming major version 2.0.0. Do not use this release in production.
-- Two new default trusted server root CAs were added and a number of bugs fixed since the 2.0.0-RC1 release, for details see PRs: [#394](https://github.com/datasharingframework/dsf/issues/394) and [#396](https://github.com/datasharingframework/dsf/issues/396).
+
+- This is the 2.0.0 major release of the DSF. DSF installations in version 1.9.0 can be upgraded to this release.
+- To Update an existing 1.x installation, please see the [1.9.0 -> 2.0.0 upgrade guide](https://dsf.dev/operations/v2.0.0/upgrade-from-1.html). 
+- For a fresh deployment, follow the [installation instructions](https://dsf.dev/operations/v2.0.0/install.html).
+- A list of compatible process plugins can be found in the [plugin install guide](https://dsf.dev/operations/latest/install-plugins.html).
 
 Feature Summary:
 - With the 2.0.0 release the workflow engine for the **DSF BPE Server** was migrated from *Camunda 7* to the community-driven, open-source BPMN engine [Operaton](https://operaton.org). The migration includes a byte-code rewriting layer that allows existing v1 process plugins compiled against Camunda classes to continue running without recompilation.
@@ -22,17 +25,17 @@ Feature Summary:
  - The DSF 2.0.0 code-base was upgraded to Java 25 and uses latest versions of Jetty and HAPI. A new [dsf-maven-plugin](https://repo1.maven.org/maven2/dev/dsf/dsf-maven-plugin/2.0.0-RC2) was created to automate build steps and help process plugins developers in generating configuration documentation and docker-compose based DSF development setups.
 
 Docker images for this release can be accessed via the GitHub Docker registry - ghcr.io:
-* **bpe**: [ghcr.io/datasharingframework/bpe:2.0.0-RC2](https://github.com/orgs/datasharingframework/packages/container/bpe/581165653?tag=2.0.0-RC2)
-* **bpe_proxy**: [ghcr.io/datasharingframework/bpe_proxy:2.0.0-RC2](https://github.com/orgs/datasharingframework/packages/container/bpe_proxy/581150393?tag=2.0.0-RC2)
-* **fhir**: [ghcr.io/datasharingframework/fhir:2.0.0-RC2](https://github.com/orgs/datasharingframework/packages/container/fhir/581159107?tag=2.0.0-RC2)
-* **fhir_proxy**: [ghcr.io/datasharingframework/fhir_proxy:2.0.0-RC2](https://github.com/orgs/datasharingframework/packages/container/fhir_proxy/581149400?tag=2.0.0-RC2)
+* **bpe**: [ghcr.io/datasharingframework/bpe:2.0.0](https://github.com/orgs/datasharingframework/packages/container/bpe/590035938?tag=2.0.0)
+* **bpe_proxy**: [ghcr.io/datasharingframework/bpe_proxy:2.0.0](https://github.com/orgs/datasharingframework/packages/container/bpe_proxy/590020738?tag=2.0.0)
+* **fhir**: [ghcr.io/datasharingframework/fhir:2.0.0](https://github.com/orgs/datasharingframework/packages/container/fhir/590028980?tag=2.0.0)
+* **fhir_proxy**: [ghcr.io/datasharingframework/fhir_proxy:2.0.0](https://github.com/orgs/datasharingframework/packages/container/fhir_proxy/590020411?tag=2.0.0)
 
 Process Plugin API v1 on Maven Central:
 ```xml
 <dependency>
     <groupId>dev.dsf</groupId>
     <artifactId>dsf-bpe-process-api-v1</artifactId>
-    <version>2.0.0-RC2</version>
+    <version>2.0.0</version>
 </dependency>
 ```
 Process Plugin API v2 on Maven Central:
@@ -40,7 +43,7 @@ Process Plugin API v2 on Maven Central:
 <dependency>
     <groupId>dev.dsf</groupId>
     <artifactId>dsf-bpe-process-api-v2</artifactId>
-    <version>2.0.0-RC2</version>
+    <version>2.0.0</version>
 </dependency>
 ```
 DSF Maven Plugin on Maven Central:
@@ -48,11 +51,13 @@ DSF Maven Plugin on Maven Central:
 <plugin>
     <groupId>dev.dsf</groupId>
     <artifactId>dsf-maven-plugin</artifactId>
-    <version>2.0.0-RC2</version>
+    <version>2.0.0</version>
 </plugin>
 ```
 
 Issues closed:
+- 1.9.0 to 2.0.0 Transition [#400](https://github.com/datasharingframework/dsf/issues/400)
+- Fix 2.0.0-RC2 Bugs [#397](https://github.com/datasharingframework/dsf/issues/397)
 - Add New D-Trust Server Certificate Root CAs [#395](https://github.com/datasharingframework/dsf/issues/395)
 - Fix 2.0.0-RC1 Bugs [#393](https://github.com/datasharingframework/dsf/issues/393)
 - Add Licence Headers [#391](https://github.com/datasharingframework/dsf/issues/391)
@@ -107,5 +112,5 @@ Issues closed:
 - Add Constants for organization-role and practitioner-role CodeSystems [#81](https://github.com/datasharingframework/dsf/issues/81)
 - Improve DefaultUserTaskListener [#78](https://github.com/datasharingframework/dsf/issues/78)
 
-This release contains contributions from [@alexanderkiel](https://github.com/alexanderkiel), [@EmteZogaf](https://github.com/EmteZogaf), [@hhund](https://github.com/hhund), [@jaboehri](https://github.com/jaboehri), [@MadMax93](https://github.com/MadMax93), [@schwzr](https://github.com/schwzr) and [@wetret](https://github.com/wetret).
-
+This release contains contributions from [@alexanderkiel](https://github.com/alexanderkiel), [@EmteZogaf](https://github.com/EmteZogaf), [@hhund](https://github.com/hhund), [@jaboehri](https://github.com/jaboehri), [@MadMax93](https://github.com/MadMax93), [@schwzr](https://github.com/schwzr) and [@wetret](https://github.com/wetret).
+
diff --git a/docs/src/operations/v2.0.1/release-notes.md b/docs/src/operations/v2.0.1/release-notes.md
index e7caa9b82..30a1b0749 100644
--- a/docs/src/operations/v2.0.1/release-notes.md
+++ b/docs/src/operations/v2.0.1/release-notes.md
@@ -1,38 +1,38 @@
----
-title: Release Notes (v2.0.1)
-icon: note
----
-
-## [Release Notes for v2.0.1](https://github.com/datasharingframework/dsf/releases/tag/v2.0.1)
-
-::: tip Release Notes
-You can access all release notes on our [GitHub](https://github.com/datasharingframework/dsf/releases).
-:::
-
-### Second Release Candidate for 2.0.0
+---
+title: Release Notes (v2.0.1)
+icon: note
+---
+
+## [Release Notes for v2.0.1](https://github.com/datasharingframework/dsf/releases/tag/v2.0.1)
+
+::: tip Release Notes
+You can access all release notes on our [GitHub](https://github.com/datasharingframework/dsf/releases).
+:::
+
+### 2.0.1 - Maintenance Release
 General remarks:
-- This is the second release candidate for the upcoming major version 2.0.0. Do not use this release in production.
-- Two new default trusted server root CAs were added and a number of bugs fixed since the 2.0.0-RC1 release, for details see PRs: [#394](https://github.com/datasharingframework/dsf/issues/394) and [#396](https://github.com/datasharingframework/dsf/issues/396).
 
-Feature Summary:
-- With the 2.0.0 release the workflow engine for the **DSF BPE Server** was migrated from *Camunda 7* to the community-driven, open-source BPMN engine [Operaton](https://operaton.org). The migration includes a byte-code rewriting layer that allows existing v1 process plugins compiled against Camunda classes to continue running without recompilation.
-- The release includes a new **Process Plugin API v2**, offering cleaner abstractions, new services and expanded metadata. The API introduces foundational support for FHIR validation services (planned to be fully activated in 2.1) and provides utilities such as data encryption, compression and new logging facilities. Using the new FHIR server connections API, credentials for local FHIR data servers can be shared between process plugins, with password, mTLS and OIDC based authentication supported.
- - Default FHIR profiles for all supported resources have been created for version 2.0.0 on the **DSF FHIR Server**, with automated data-migration to ensure compliance for existing installations. The authorization system now supports fine-grained, resource-specific roles and enhanced practitioner-based access control for `Task` and `QuestionnaireResponse` resources. Internal optimizations improve performance for `Binary` resources with a new size limit of resources constraint by PostgreSQL's 4TB limit of *Large Objects* (limits of forwarding- and reverse-proxies for uploads may be smaller).
- - Finally, the **user experience** has been modernized with a more responsive layout and a new statistics panels on the FHIR server visible to administrators. Extensive configuration cleanup and unified logging controls simplify administration across both the BPE and FHIR servers.
- - The DSF 2.0.0 code-base was upgraded to Java 25 and uses latest versions of Jetty and HAPI. A new [dsf-maven-plugin](https://repo1.maven.org/maven2/dev/dsf/dsf-maven-plugin/2.0.0-RC2) was created to automate build steps and help process plugins developers in generating configuration documentation and docker-compose based DSF development setups.
+- This is an update for DSF 2.0.0. A description of changes between the 1.9.0 and 2.0.0 releases can be found in the [2.0.0 release notes](https://github.com/datasharingframework/dsf/releases/tag/v2.0.0).
+- To Update from an existing 1.x installation, please see the [1.x -> 2.0.1 Upgrade Guide](https://dsf.dev/operations/v2.0.1/upgrade-from-1.html). 
+- To Update from an existing 2.x installation, please see the [2.x -> 2.0.1 Upgrade Guide](https://dsf.dev/operations/v2.0.1/upgrade-from-2.html). 
+- For a fresh deployment, follow the [installation instructions](https://dsf.dev/operations/v2.0.1/install.html).
+- With this release a startup bug related to ECC client certificate was fixed.
+
+Bug Fixes:
+- Starting the DSF 2.0.0 FHIR or BPE server with an ECC client certificate without `keyEncipherment` extension, resulted in a `First certificate from '...' not a client certificate` error ([#405](https://github.com/datasharingframework/dsf/issues/405)). The requirement for the `keyEncipherment` extension was removed with this release.
 
 Docker images for this release can be accessed via the GitHub Docker registry - ghcr.io:
-* **bpe**: [ghcr.io/datasharingframework/bpe:2.0.0-RC2](https://github.com/orgs/datasharingframework/packages/container/bpe/581165653?tag=2.0.0-RC2)
-* **bpe_proxy**: [ghcr.io/datasharingframework/bpe_proxy:2.0.0-RC2](https://github.com/orgs/datasharingframework/packages/container/bpe_proxy/581150393?tag=2.0.0-RC2)
-* **fhir**: [ghcr.io/datasharingframework/fhir:2.0.0-RC2](https://github.com/orgs/datasharingframework/packages/container/fhir/581159107?tag=2.0.0-RC2)
-* **fhir_proxy**: [ghcr.io/datasharingframework/fhir_proxy:2.0.0-RC2](https://github.com/orgs/datasharingframework/packages/container/fhir_proxy/581149400?tag=2.0.0-RC2)
+* **bpe**: [ghcr.io/datasharingframework/bpe:2.0.1](https://github.com/orgs/datasharingframework/packages/container/bpe/590707284?tag=2.0.1)
+* **bpe_proxy**: [ghcr.io/datasharingframework/bpe_proxy:2.0.1](https://github.com/datasharingframework/dsf/pkgs/container/bpe_proxy/667793346?tag=2.0.1)
+* **fhir**: [ghcr.io/datasharingframework/fhir:2.0.1](https://github.com/orgs/datasharingframework/packages/container/fhir/590702812?tag=2.0.1)
+* **fhir_proxy**: [ghcr.io/datasharingframework/fhir_proxy:2.0.1](https://github.com/datasharingframework/dsf/pkgs/container/fhir_proxy/667792891?tag=2.0.1)
 
 Process Plugin API v1 on Maven Central:
 ```xml
 <dependency>
     <groupId>dev.dsf</groupId>
     <artifactId>dsf-bpe-process-api-v1</artifactId>
-    <version>2.0.0-RC2</version>
+    <version>2.0.1</version>
 </dependency>
 ```
 Process Plugin API v2 on Maven Central:
@@ -40,7 +40,7 @@ Process Plugin API v2 on Maven Central:
 <dependency>
     <groupId>dev.dsf</groupId>
     <artifactId>dsf-bpe-process-api-v2</artifactId>
-    <version>2.0.0-RC2</version>
+    <version>2.0.1</version>
 </dependency>
 ```
 DSF Maven Plugin on Maven Central:
@@ -48,64 +48,13 @@ DSF Maven Plugin on Maven Central:
 <plugin>
     <groupId>dev.dsf</groupId>
     <artifactId>dsf-maven-plugin</artifactId>
-    <version>2.0.0-RC2</version>
+    <version>2.0.1</version>
 </plugin>
 ```
 
 Issues closed:
-- Add New D-Trust Server Certificate Root CAs [#395](https://github.com/datasharingframework/dsf/issues/395)
-- Fix 2.0.0-RC1 Bugs [#393](https://github.com/datasharingframework/dsf/issues/393)
-- Add Licence Headers [#391](https://github.com/datasharingframework/dsf/issues/391)
-- Improve FHIR Server UI [#388](https://github.com/datasharingframework/dsf/issues/388)
-- Delete dsf-fhir-auth and Move Code to dsf-fhir-server [#387](https://github.com/datasharingframework/dsf/issues/387)
-- Upgrade to PostgreSQL 18 [#385](https://github.com/datasharingframework/dsf/issues/385)
-- Rename Test-Setups to Dev-Setups [#383](https://github.com/datasharingframework/dsf/issues/383)
-- Add Methods for Additional Metadata to v2 ProcessPluginDefinition [#382](https://github.com/datasharingframework/dsf/issues/382)
-- Add FHIR Profiles for All Supported Resource Types [#378](https://github.com/datasharingframework/dsf/issues/378)
-- Allow Updates to Output Parameters of in-progress Tasks via Plugin API [#373](https://github.com/datasharingframework/dsf/issues/373)
-- Add Service to Validate FHIR Resources via Plugin API [#372](https://github.com/datasharingframework/dsf/issues/372)
-- Improve User to Task and QuestionnaireResponse Association [#367](https://github.com/datasharingframework/dsf/issues/367)
-- Extended FHIR Server User Role Config - Role Per Resource [#365](https://github.com/datasharingframework/dsf/issues/365)
-- Migrate Camunda 7 to Operaton 1 [#353](https://github.com/datasharingframework/dsf/issues/353)
-- Add Service With Data Compression Functions to Plugin API [#349](https://github.com/datasharingframework/dsf/issues/349)
-- Simplify Prototype Scoped Bean Definition for BPMN Activities [#347](https://github.com/datasharingframework/dsf/issues/347)
-- Runtime Access to ProcessPluginDefinition via API [#346](https://github.com/datasharingframework/dsf/issues/346)
-- Properly Display FHIR Duration Type in DSF FHIR Server UI [#344](https://github.com/datasharingframework/dsf/issues/344)
-- Add Library.content to HTML View [#341](https://github.com/datasharingframework/dsf/issues/341)
-- Simplify Specification of Name, Version and Release-Date of Process Plugins Using Values From Maven pom [#338](https://github.com/datasharingframework/dsf/issues/338)
-- DSF Maven Plugin: Add ability to generate .password-files [#332](https://github.com/datasharingframework/dsf/issues/332)
-- Add Validation Support for Process Plugins [#331](https://github.com/datasharingframework/dsf/issues/331)
-- Add DocumentReference HTML View [#325](https://github.com/datasharingframework/dsf/issues/325)
-- Improve Allow-List and Enable Thumbprints on Endpoint Resources [#317](https://github.com/datasharingframework/dsf/issues/317)
-- Reorganize dsf-tools Modules [#315](https://github.com/datasharingframework/dsf/issues/315)
-- Extend dsf-tools-documentation-generator Maven Plugin for v2 Process Plugins [#309](https://github.com/datasharingframework/dsf/issues/309)
-- Create Target Provider [#307](https://github.com/datasharingframework/dsf/issues/307)
-- Upgrade Dependencies [#301](https://github.com/datasharingframework/dsf/issues/301)
-- Upgrade to HAPI 8.0.0 [#297](https://github.com/datasharingframework/dsf/issues/297)
-- Optimize FHIR Binary Resource Handling [#296](https://github.com/datasharingframework/dsf/issues/296)
-- Add Mechanism to the API for Modifying Process Plugin FHIR Resources During Startup [#292](https://github.com/datasharingframework/dsf/issues/292)
-- Remove Camunda Dependency from Process Plugin API v2 [#284](https://github.com/datasharingframework/dsf/issues/284)
-- Validator Ignores CodeSystem Version [#281](https://github.com/datasharingframework/dsf/issues/281)
-- Add BPE Integration Tests [#271](https://github.com/datasharingframework/dsf/issues/271)
-- Add Mechanism to Manage Connections to Local FHIR Servers [#270](https://github.com/datasharingframework/dsf/issues/270)
-- Port Fixes and Features From 1.7.0 to 2.0.0 [#268](https://github.com/datasharingframework/dsf/issues/268)
-- Complete Class and Resource Allow Lists for ProcessPluginApiClassLoader [#241](https://github.com/datasharingframework/dsf/issues/241)
-- Port Fixes and Features From 1.6.0 to 2.0.0 [#239](https://github.com/datasharingframework/dsf/issues/239)
-- Add Methods for Accessing "Local" BPMN Variables to the Plugin API [#210](https://github.com/datasharingframework/dsf/issues/210)
-- Add Service to Log Debug Information Including Context Information via Plugin API [#209](https://github.com/datasharingframework/dsf/issues/209)
-- Add Service to Log Sensitive Data if Enabled via Plugin API [#208](https://github.com/datasharingframework/dsf/issues/208)
-- Add Service to Access Trusted Certificate Authorities via Plugin API [#207](https://github.com/datasharingframework/dsf/issues/207)
-- Add Service to Encrypt and Decrypt Binary Data via Plugin API [#206](https://github.com/datasharingframework/dsf/issues/206)
-- Add Service to Check Mime-Type of Binary Data via Plugin API [#205](https://github.com/datasharingframework/dsf/issues/205)
-- Add Default Trusted Certificate Authorities to Docker Images [#204](https://github.com/datasharingframework/dsf/issues/204)
-- Upgrade to Jetty 12 [#203](https://github.com/datasharingframework/dsf/issues/203)
-- Upgrade to Java 25 [#202](https://github.com/datasharingframework/dsf/issues/202)
-- Web Application Style Class Loading for Process Plugins [#201](https://github.com/datasharingframework/dsf/issues/201)
-- Create API v2 Maven Module [#200](https://github.com/datasharingframework/dsf/issues/200)
-- Process Plugin API v2 [#197](https://github.com/datasharingframework/dsf/issues/197)
-- Don't require DEV_DSF_FHIR_SERVER_ORGANIZATION_THUMBPRINT [#177](https://github.com/datasharingframework/dsf/issues/177)
-- Add Constants for organization-role and practitioner-role CodeSystems [#81](https://github.com/datasharingframework/dsf/issues/81)
-- Improve DefaultUserTaskListener [#78](https://github.com/datasharingframework/dsf/issues/78)
-
-This release contains contributions from [@alexanderkiel](https://github.com/alexanderkiel), [@EmteZogaf](https://github.com/EmteZogaf), [@hhund](https://github.com/hhund), [@jaboehri](https://github.com/jaboehri), [@MadMax93](https://github.com/MadMax93), [@schwzr](https://github.com/schwzr) and [@wetret](https://github.com/wetret).
+- Start New Development Cycle [#406](https://github.com/datasharingframework/dsf/issues/406)
+- DSF Fails to Start with Certain ECC Client Certificates [#405](https://github.com/datasharingframework/dsf/issues/405)
 
+This release contains contributions from [@hhund](https://github.com/hhund) and [@schwzr](https://github.com/schwzr).
+
diff --git a/docs/src/operations/v2.0.1/upgrade-from-1.md b/docs/src/operations/v2.0.1/upgrade-from-1.md
index ee3636f07..e08a315ee 100644
--- a/docs/src/operations/v2.0.1/upgrade-from-1.md
+++ b/docs/src/operations/v2.0.1/upgrade-from-1.md
@@ -86,11 +86,11 @@ The environment variable `DEV_DSF_FHIR_SERVER_ORGANIZATION_THUMBPRINT` does not
     ```
 
 5. Verify your upgrade:
-    * Verify the DSF FHIR server is running in version 2.0.0. The log should contain a message:  
+    * Verify the DSF FHIR server is running in version 2.0.1. The log should contain a message:  
         `INFO main - BuildInfoReaderImpl.logBuildInfo(137) | Artifact: dsf-fhir-server-jetty, version: 2.0.1, [...]`
     * Verify the DSF FHIR server started without errors
     * Verify the DSF FHIR server is accessible via https, for example by browsing to https://your-dsf-endpoint.de/fhir/ (authentication with your client-certificate)
-    * Verify the DSF BPE server is running in version 2.0.0. The log should contain a message:  
+    * Verify the DSF BPE server is running in version 2.0.1. The log should contain a message:  
         `INFO main - BuildInfoReaderImpl.logBuildInfo(137) | Artifact: dsf-bpe-server-jetty, version: 2.0.1, [...]`
     * Verify the DSF BPE server started without errors
     * Verify your install with a ping/pong test  
diff --git a/docs/src/operations/v2.0.1/upgrade-from-2.md b/docs/src/operations/v2.0.1/upgrade-from-2.md
index 8594df379..2f6bf609a 100644
--- a/docs/src/operations/v2.0.1/upgrade-from-2.md
+++ b/docs/src/operations/v2.0.1/upgrade-from-2.md
@@ -63,11 +63,11 @@ DSF 2 was designed to run DSF 1 (APIv1) process plugins, but due to stricter val
     ```
 
 5. Verify your upgrade:
-    * Verify the DSF FHIR server is running in version 2.0.0. The log should contain a message:  
+    * Verify the DSF FHIR server is running in version 2.0.1. The log should contain a message:  
         `INFO main - BuildInfoReaderImpl.logBuildInfo(137) | Artifact: dsf-fhir-server-jetty, version: 2.0.1, [...]`
     * Verify the DSF FHIR server started without errors
     * Verify the DSF FHIR server is accessible via https, for example by browsing to https://your-dsf-endpoint.de/fhir/ (authentication with your client-certificate)
-    * Verify the DSF BPE server is running in version 2.0.0. The log should contain a message:  
+    * Verify the DSF BPE server is running in version 2.0.1. The log should contain a message:  
         `INFO main - BuildInfoReaderImpl.logBuildInfo(137) | Artifact: dsf-bpe-server-jetty, version: 2.0.1, [...]`
     * Verify the DSF BPE server started without errors
     * Verify your install with a ping/pong test  
diff --git a/docs/src/operations/v2.0.2/allowList-mgm.md b/docs/src/operations/v2.0.2/allowList-mgm.md
new file mode 100644
index 000000000..f15eb7144
--- /dev/null
+++ b/docs/src/operations/v2.0.2/allowList-mgm.md
@@ -0,0 +1,34 @@
+---
+title: Allow List Management
+icon: share
+---
+You can read all about the concept of Allow Lists [in our introduction](/explore/concepts/allow-list.md).
+
+## Overview
+To simplify the DSF Allow List Management we have built a portal for administration. The portal is managed by the GECKO Institute at Heilbronn University. You as an DSF administrator can create or update your Allow List information. The information you provide on this portal will be transferred to us and will be used to built Allow List bundles that get distributed to the communication partners of the distributed processes. 
+
+The DSF Allow List management tool uses client certificates for authentication. You can either use a personal client certificate or the client certificate from your DSF BPE, which needs to be added to your web-browsers certificate store.
+
+
+## Prerequisites
+1. Deployed DSF instance (test or production infrastructure)
+    1.1  If none exists yet, read [the installation guide](install)
+2. Certificate 
+    2.1  If none exists yet, read [the certificate requirements](install#client-server-certificates)
+3. Organization identifier, shortest FQDN of your organizations website, e.g. `my-hospital.de`
+4. FHIR endpoint URL, e.g. `https://dsf.my-hospital.de/fhir`
+5. Contact details from a responsible person of your organization
+6. Access to the E-Mail address from your organization for verification 
+ 
+
+## Start here
+When you have fulfilled all the prerequisites, you can start managing your Allow Lists via the environment specific Allow List Management Tool:
+
+- [**Test** infrastructure](https://allowlist-test.gecko.hs-heilbronn.de)
+- [**Production** infrastructure](https://allowlist.gecko.hs-heilbronn.de)
+
+We use different highlight colors for the DSF Allow List Management Tool: Green for the **Test** environment and blue for the **Production** infrastructure. To access the site, you have to authenticate yourself with a client certificate. Your web-browser will show a dialog to choose a valid certificate.
+
+::: tip Ideas for improvement?
+Have you found an error or is something unclear to you? Then please feel free to contact us on the <a href="https://mii.zulipchat.com/#narrow/stream/392426-Data-Sharing-Framework-.28DSF.29">MII-Zulip Channel</a> or write us at <a href="mailto:dsf-gecko@hs-heilbronn.de">dsf-gecko@hs-heilbronn.de</a>. Thank you very much!
+:::
\ No newline at end of file
diff --git a/docs/src/operations/v2.0.2/bpe-reverse-proxy/README.md b/docs/src/operations/v2.0.2/bpe-reverse-proxy/README.md
new file mode 100644
index 000000000..4e6a614a0
--- /dev/null
+++ b/docs/src/operations/v2.0.2/bpe-reverse-proxy/README.md
@@ -0,0 +1,6 @@
+---
+title: BPE Reverse Proxy
+icon: module
+---
+## Overview
+- [Configuration Parameters](configuration)
diff --git a/docs/src/operations/v2.0.2/bpe-reverse-proxy/configuration.md b/docs/src/operations/v2.0.2/bpe-reverse-proxy/configuration.md
new file mode 100644
index 000000000..ead8cf697
--- /dev/null
+++ b/docs/src/operations/v2.0.2/bpe-reverse-proxy/configuration.md
@@ -0,0 +1,109 @@
+---
+title: Configuration Parameters
+icon: config
+---
+
+### APP_SERVER_IP
+- **Required:** Yes
+- **Description:** Hostname or IP-Address of the DSF BPE server application container, the reverse proxy target
+- **Example:** `app`, `172.28.1.3`
+
+
+### HTTPS_SERVER_NAME_PORT
+- **Required:** Yes
+- **Description:** FQDN of your DSF BPE server with port, typically `443`
+- **Example:** `my-external.fqdn:443`
+
+
+### PROXY_PASS_CONNECTION_TIMEOUT_HTTP
+- **Required:** No
+- **Description:** Connection timeout (seconds) for reverse proxy to app server http connection, time the proxy waits for a connection to be established
+- **Default:** `30` seconds
+
+
+### PROXY_PASS_CONNECTION_TIMEOUT_WS
+- **Required:** No
+- **Description:** Connection timeout (seconds) for reverse proxy to app server ws connection, time the proxy waits for a connection to be established
+- **Default:** `30` seconds
+
+
+### PROXY_PASS_TIMEOUT_HTTP
+- **Required:** No
+- **Description:** Timeout (seconds) for reverse proxy to app server http connection, time the proxy waits for a reply
+- **Default:** `60` seconds
+
+
+### PROXY_PASS_TIMEOUT_WS
+- **Required:** No
+- **Description:** Timeout (seconds) for reverse proxy to app server ws connection, time the proxy waits for a reply
+- **Default:** `60` seconds
+
+
+### SERVER_CONTEXT_PATH
+- **Required:** No
+- **Description:** Reverse proxy context path that delegates to the app server, `/` character at start, no `/` character at end, use `''` (empty string) to configure root as context path
+- **Default:** `/bpe`
+
+
+### SSL_CA_CERTIFICATE_FILE
+- **Required:** No
+- **Description:** Certificate chain file including all issuing, intermediate and root certificates used to validate client certificates, PEM encoded, sets the apache httpd parameter `SSLCACertificateFile`; not used by default, overrides *SSL_CA_CERTIFICATE_PATH* if not empty
+
+
+### SSL_CA_CERTIFICATE_PATH
+- **Required:** No
+- **Description:** Folder with trusted full CA chains for validating client certificates
+- **Recommendation:** Override default folder content via bind mount or add *.crt files to default folder via bind mount
+- **Default:** `ca/client_ca_chains`
+
+
+### SSL_CA_DN_REQUEST_FILE
+- **Required:** No
+- **Description:** File containing all signing certificates excepted, will be used to specify the `Acceptable client certificate CA names` send to the client, during TLS handshake, sets the apache httpd parameter `SSLCADNRequestFile`; if omitted all entries from *SSL_CA_CERTIFICATE_FILE* are used; not used by default, overrides *SSL_CA_DN_REQUEST_PATH* if not empty
+
+
+### SSL_CA_DN_REQUEST_PATH
+- **Required:** No
+- **Description:**  Folder with trusted client certificate issuing CAs, modifies the "Acceptable client certificate CA names" send to the client, uses all from *SSL_CA_CERTIFICATE_FILE* or *SSL_CA_CERTIFICATE_PATH* if not set or empty
+- **Recommendation:** Override default folder content via bind mount or add *.crt files to default folder via bind mount
+- **Default:** `ca/client_issuing_cas`
+
+
+### SSL_CERTIFICATE_CHAIN_FILE
+- **Required:** No
+- **Description:** Certificate chain file, PEM encoded, must contain all certificates between the server certificate and the root ca certificate (excluding the root ca certificate), sets the apache httpd parameter `SSLCertificateChainFile`; can be omitted if either no chain is needed (self signed server certificate) or the file specified via *SSL_CERTIFICATE_FILE* contains the certificate chain
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/ssl_certificate_chain_file.pem`
+
+
+### SSL_CERTIFICATE_FILE
+- **Required:** Yes
+- **Description:** Server certificate file, PEM encoded, sets the apache httpd parameter `SSLCertificateFile`, may contain all certificates between the server certificate and the root ca certificate (excluding the root ca certificate). Omit *SSL_CERTIFICATE_CHAIN_FILE* if chain included
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/ssl_certificate_file.pem`
+
+
+### SSL_CERTIFICATE_KEY_FILE
+- **Required:** Yes
+- **Description:** Server certificate private key file, PEM encoded, unencrypted, sets the apache httpd parameter `SSLCertificateKeyFile`
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/ssl_certificate_key_file.pem`
+
+
+### SSL_EXPECTED_CLIENT_S_DN_C_VALUES
+- **Required:** No
+- **Description:** Expected client certificate subject DN country `C` values, must be a comma-separated list of strings in single quotation marks, e.g. `'DE', 'FR'`. If a client certificate with a not configured subject country `C` value is used, the server answers with a `403 Forbidden` status code
+- **Default:** `'DE'`
+
+
+### SSL_EXPECTED_CLIENT_I_DN_CN_VALUES
+- **Required:** No
+- **Description:** Expected client certificate issuer DN common-name `CN` values, must be a comma-separated list of strings in single quotation marks. If a client certificate from a not configured issuing ca common-name is used, the server answers with a `403 Forbidden` status code
+- **Default:** `'GEANT TLS ECC 1', 'HARICA OV TLS ECC', 'GEANT TLS RSA 1', 'HARICA OV TLS RSA', 'GEANT S/MIME ECC 1', 'HARICA Client Authentication ECC', 'HARICA S/MIME ECC', 'GEANT S/MIME RSA 1', 'HARICA Client Authentication RSA', 'HARICA S/MIME RSA', 'DFN-Verein Global Issuing CA', 'Fraunhofer User CA - G02', 'D-TRUST SSL Class 3 CA 1 2009', 'Sectigo RSA Organization Validation Secure Server CA', 'GEANT OV RSA CA 4', 'GEANT Personal CA 4', 'GEANT eScience Personal CA 4', 'Sectigo ECC Organization Validation Secure Server CA', 'GEANT OV ECC CA 4', 'GEANT Personal ECC CA 4', 'GEANT eScience Personal ECC CA 4', 'D-TRUST Limited Basic CA 1-2 2019', 'D-TRUST Limited Basic CA 1-3 2019'`
+
+
+### SSL_VERIFY_CLIENT
+- **Required:** No
+- **Description:** Modifies the apache mod_ssl config parameter `SSLVerifyClient`
+- **Recommendation:** Set to `optional` when using OIDC authentication
+- **Default:** `require`
\ No newline at end of file
diff --git a/docs/src/operations/v2.0.2/bpe/README.md b/docs/src/operations/v2.0.2/bpe/README.md
new file mode 100644
index 000000000..93cd24fc6
--- /dev/null
+++ b/docs/src/operations/v2.0.2/bpe/README.md
@@ -0,0 +1,10 @@
+---
+title: BPE Server
+icon: module
+---
+## Overview
+- [Configuration Parameters](configuration)
+- [Access Control](access-control)
+- [OpenID Connect](oidc)
+- [Logging](logging)
+- [FHIR Client Connections](fhir-client-connections)
\ No newline at end of file
diff --git a/docs/src/operations/v2.0.2/bpe/access-control.md b/docs/src/operations/v2.0.2/bpe/access-control.md
new file mode 100644
index 000000000..e51587c62
--- /dev/null
+++ b/docs/src/operations/v2.0.2/bpe/access-control.md
@@ -0,0 +1,104 @@
+---
+title: Access Control
+icon: config
+---
+
+## Overview
+
+The DSF BPE server provides a user interface for administrators. Without any additional configuration the user interface is not accessible with the organizations X.509 client certificate or any other certificate or OpenID Connect authenticated user.
+
+::: tip OpenID Connect
+To enable OpenID Connect authentication of local user, see the DSF BPE server OpenID Connect [configuration page](oidc).
+:::
+
+Access to the user interface can be enabled for client certificates and local users authenticating via OAuth 2.0 OpenID Connect. Access can be configured for so called roles, with all roles specified using the configuration parameter [DEV_DSF_BPE_SERVER_ROLECONFIG](configuration#dev-dsf-bpe-server-roleconfig). The value for this environment variable is specified as YAML using the block scalar `|`.
+
+The listing below shows a minimal configuration to enable access for a specific client-certificate:
+
+```yaml
+      DEV_DSF_BPE_SERVER_ROLECONFIG: |
+        - example_read_only_role:
+            thumbprint: 00474993fa261b0225f93c5a66aa6fcc... [a-f0-9]{128}
+            dsf-role:
+              - ADMIN
+```
+The list of user roles above contains a single rule-entry `example_read_only_role`, matching the user via a client certificate SHA-512 thumprint and assigning three DSF roles. Any string can be used as the name for the rule-enty.
+
+::: tip Certificate Thumbprints
+SHA-512 certificate thumbprints in HEX form `[a-f0-9]{128}` can be calculated using:
+```sh
+certtool --fingerprint --hash=sha512 --infile=certificate.pem
+```
+:::
+
+Multiple user roles can be specified and all matching roles will be applied to an authenticated users. Use an empty string `""` or a single block scalar `|` character as the value for the configuration parameter [DEV_DSF_BPE_SERVER_ROLECONFIG](configuration#dev-dsf-bpe-server-roleconfig) if no roles should be configured.
+
+## Matching Users
+
+To apply roles, users can be matched via the `thumbprint`, `email`, `token-role` or `token-group` properties. A single value or a list of values can be specified.
+
+#### thumbprint
+
+The property `thumbprint` can used to specify one or multiple SHA-512 certificate thumbprints. Roles from this rule are applied to the authenticating user if the certificate matches one of the specified thumbprints.
+
+#### email
+
+Using the property `email` users can be matched against e-mail addresses specified in X.509 client certificates and in OpenID Connect access tokens. Values will be matched against e-mail addresses specified in the subject DN (via PKCS#9 extension 1.2.840.113549.1.9.1) and RFC-822 Name entries of the Subject Alternative Name field. If the user authenticates via OpenID Connect, the `email` [claim](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) from the access token will be matched against the property values.
+
+#### token-role and token-group
+
+With the properties `token-role` and `token-group` role and group names can be specified to match against role and group claims within OAuth 2.0 access tokens.
+
+
+## DSF and Practitioner Roles
+
+Two types of roles can be applied to matched users. 
+
+#### dsf-role
+
+DSF roles specified via the `dsf-role` property define general access to the user interface. Allowed values are:
+
+`ADMIN`.
+
+#### practitioner-role
+
+The BPE server currently does not support any practionier-roles.
+
+
+## Examples
+
+The first example defines a group of DSF administrators. Two client certificates match against this role:
+
+```yaml
+      DEV_DSF_BPE_SERVER_ROLECONFIG: |
+        - certificate-admins:
+            thumbprint: 
+              - afb68b1d9d47e691b8b3d50fd9848467cada8b1c76f5f4b45f00c9f8432d505361a3ee27805f4aa06799d9ac8dace94b3f1942fce44d84866961259b13be825d
+              - 2441bfddcad97eeb83c8c31fe181b90652787b8b59bf4e569219da7db4429e389479cb7c4a2f311e34217357d594ecad7d58ccfeef2a9e93c6fcf8d98897d88c
+            dsf-role:
+              - ADMIN
+```
+
+
+The second example defines a group of DSF administrators by specifying an `admin` role that gets matched against OAuth 2.0 access tokens:
+
+```yaml
+      DEV_DSF_BPE_SERVER_ROLECONFIG: |
+        - token-role-admins:
+            token-role: admin
+            dsf-role:
+              - ADMIN
+```
+
+
+The third example allows administrator access and users e-mail addresses to match this role. E-mail addresses from X.509 client certificates and OAuth 2.0 access tokens are matched:
+
+```yaml
+      DEV_DSF_BPE_SERVER_ROLECONFIG: |
+        - email-admins:
+            email:
+              - first.user@test.org
+              - second.user@test.org
+            dsf-role:
+              - ADMIN
+```
diff --git a/docs/src/operations/v2.0.2/bpe/configuration.md b/docs/src/operations/v2.0.2/bpe/configuration.md
new file mode 100644
index 000000000..aceeb51aa
--- /dev/null
+++ b/docs/src/operations/v2.0.2/bpe/configuration.md
@@ -0,0 +1,963 @@
+---
+title: Configuration Parameters
+icon: config
+---
+
+### DEV_DSF_BPE_DB_LIQUIBASE_FORCEUNLOCK
+- **Property:** dev.dsf.bpe.db.liquibase.forceUnlock
+- **Required:** No
+- **Description:** To force liquibase to unlock the migration lock set to `true`
+- **Recommendation:** Only use this option temporarily to unlock a stuck DB migration step
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_DB_LIQUIBASE_LOCKWAITTIME
+- **Property:** dev.dsf.bpe.db.liquibase.lockWaitTime
+- **Required:** No
+- **Description:** Liquibase change lock wait time in minutes, default 2 minutes
+- **Default:** `2`
+
+
+### DEV_DSF_BPE_DB_LIQUIBASE_PASSWORD or DEV_DSF_BPE_DB_LIQUIBASE_PASSWORD_FILE
+- **Property:** dev.dsf.bpe.db.liquibase.password
+- **Required:** Yes
+- **Description:** Password to access the database from the DSF BPE server to execute database migrations
+- **Recommendation:** Use docker secret file to configure by using *DEV_DSF_BPE_DB_LIQUIBASE_PASSWORD_FILE*
+- **Example:** `/run/secrets/db_liquibase.password`
+
+
+### DEV_DSF_BPE_DB_LIQUIBASE_USERNAME
+- **Property:** dev.dsf.bpe.db.liquibase.username
+- **Required:** No
+- **Description:** Username to access the database from the DSF BPE server to execute database migrations
+- **Default:** `liquibase_user`
+
+
+### DEV_DSF_BPE_DB_URL
+- **Property:** dev.dsf.bpe.db.url
+- **Required:** Yes
+- **Description:** Address of the database used for the DSF BPE server
+- **Recommendation:** Change only if you don't use the provided docker-compose from the installation guide or made changes to the database settings/networking in the docker-compose
+- **Example:** `jdbc:postgresql://db/bpe`
+
+
+### DEV_DSF_BPE_DB_USER_ENGINE_GROUP
+- **Property:** dev.dsf.bpe.db.user.engine.group
+- **Required:** No
+- **Description:** Name of the user group to access the database from the DSF BPE server workflow engine
+- **Default:** `bpe_engine_users`
+
+
+### DEV_DSF_BPE_DB_USER_ENGINE_PASSWORD or DEV_DSF_BPE_DB_USER_ENGINE_PASSWORD_FILE
+- **Property:** dev.dsf.bpe.db.user.engine.password
+- **Required:** Yes
+- **Description:** Password to access the database from the DSF BPE server workflow engine
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_BPE_DB_USER_ENGINE_PASSWORD_FILE*
+- **Example:** `/run/secrets/db_user_engine.password`
+
+
+### DEV_DSF_BPE_DB_USER_ENGINE_USERNAME
+- **Property:** dev.dsf.bpe.db.user.engine.username
+- **Required:** No
+- **Description:** Username to access the database from the DSF BPE server workflow engine
+- **Recommendation:** Use a different user then in *DEV_DSF_BPE_DB_USER_USERNAME*
+- **Default:** `bpe_server_engine_user`
+
+
+### DEV_DSF_BPE_DB_USER_GROUP
+- **Property:** dev.dsf.bpe.db.user.group
+- **Required:** No
+- **Description:** Name of the user group to access the database from the DSF BPE server
+- **Default:** `bpe_users`
+
+
+### DEV_DSF_BPE_DB_USER_PASSWORD or DEV_DSF_BPE_DB_USER_PASSWORD_FILE
+- **Property:** dev.dsf.bpe.db.user.password
+- **Required:** Yes
+- **Description:** Password to access the database from the DSF BPE server
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_BPE_DB_USER_PASSWORD_FILE*
+- **Example:** `/run/secrets/db_user.password`
+
+
+### DEV_DSF_BPE_DB_USER_USERNAME
+- **Property:** dev.dsf.bpe.db.user.username
+- **Required:** No
+- **Description:** Username to access the database from the DSF BPE server
+- **Default:** `bpe_server_user`
+
+
+### DEV_DSF_BPE_DEBUG_LOG_MESSAGE_CURRENTUSER
+- **Property:** dev.dsf.bpe.debug.log.message.currentUser
+- **Required:** No
+- **Description:** To enable logging of the currently requesting user set to `true`
+- **Recommendation:** This debug function should only be activated during development; WARNING: Confidential information may be leaked via the debug log!
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_DEBUG_LOG_MESSAGE_DBSTATEMENT
+- **Property:** dev.dsf.bpe.debug.log.message.dbStatement
+- **Required:** No
+- **Description:** To enable logging of DB queries set to `true`
+- **Recommendation:** This debug function should only be activated during development; WARNING: Confidential information may be leaked via the debug log!
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_DEBUG_LOG_MESSAGE_ONACTIVITYEND
+- **Property:** dev.dsf.bpe.debug.log.message.onActivityEnd
+- **Required:** No
+- **Description:** To enable debug log messages for every bpmn activity end, set to `true`
+- **Recommendation:** This debug function should only be activated during process plugin development
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_DEBUG_LOG_MESSAGE_ONACTIVITYSTART
+- **Property:** dev.dsf.bpe.debug.log.message.onActivityStart
+- **Required:** No
+- **Description:** To enable debug log messages for every bpmn activity start, set to `true`
+- **Recommendation:** This debug function should only be activated during process plugin development
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_DEBUG_LOG_MESSAGE_VARIABLES
+- **Property:** dev.dsf.bpe.debug.log.message.variables
+- **Required:** No
+- **Description:** To enable logging of bpmn variables for every bpmn activity start or end, when logging of these events is enabled, set to `true`
+- **Recommendation:** This debug function should only be activated during process plugin development; WARNING: Confidential information may be leaked via the debug log!
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_DEBUG_LOG_MESSAGE_VARIABLESLOCAL
+- **Property:** dev.dsf.bpe.debug.log.message.variablesLocal
+- **Required:** No
+- **Description:** To enable logging of local bpmn variables for every bpmn activity start or end, when logging of these events is enabled, set to `true`
+- **Recommendation:** This debug function should only be activated during process plugin development; WARNING: Confidential information may be leaked via the debug log!
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_DEBUG_LOG_MESSAGE_WEBSERVICEREQUEST
+- **Property:** dev.dsf.bpe.debug.log.message.webserviceRequest
+- **Required:** No
+- **Description:** To enable logging of webservices requests set to `true`
+- **Recommendation:** This debug function should only be activated during development; WARNING: Confidential information may be leaked via the debug log!
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_CERTIFICATE
+- **Property:** dev.dsf.bpe.fhir.client.certificate
+- **Required:** Yes
+- **Description:** PEM encoded file with local client certificate for https connections to local and remote DSF FHIR servers
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/app_client_certificate.pem`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY
+- **Property:** dev.dsf.bpe.fhir.client.certificate.private.key
+- **Required:** Yes
+- **Description:** Private key corresponding to the local client certificate as PEM encoded file. Use DEV_DSF_BPE_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD* or *DEV_DSF_BPE_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE* if private key is encrypted
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/app_client_certificate_private_key.pem`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD or DEV_DSF_BPE_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE
+- **Property:** dev.dsf.bpe.fhir.client.certificate.private.key.password
+- **Required:** No
+- **Description:** Password to decrypt the local client certificate encrypted private key
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_BPE_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE*
+- **Example:** `/run/secrets/app_client_certificate_private_key.pem.password`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG
+- **Property:** dev.dsf.bpe.fhir.client.connections.config
+- **Required:** No
+- **Description:** FHIR server connections YAML config for v2 process plugins
+
+<!-- see https://github.com/datasharingframework/dsf/issues/411
+### DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG_DEFAULT_ENABLE_DEBUG_LOGGING
+- **Property:** dev.dsf.bpe.fhir.client.connections.config.default.enable.debug.logging
+- **Required:** No
+- **Description:** FHIR server connections YAML: Default value for properties `enable-debug-logging` and `oidc-auth.enable-debug-logging`
+- **Recommendation:** To enable debug logging of requests and responses to configured FHIR servers by default set to `true`
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG_DEFAULT_ENABLE_DEBUG_LOGGING
+- **Property:** dev.dsf.bpe.fhir.client.connections.config.default.enable.debug.logging
+- **Required:** No
+- **Description:** FHIR server connections YAML: Default value for properties `oidc-auth.verify-authorized-party`
+- **Recommendation:** To disable verification of the authorized party (aud) claim by default set to `false`
+- **Default:** `true`
+-->
+
+### DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG_DEFAULT_OIDC_DISCOVERY_PATH
+- **Property:** dev.dsf.bpe.fhir.client.connections.config.default.oidc.discovery.path
+- **Required:** No
+- **Description:** FHIR server connections YAML: Default value for property `oidc-auth.discovery-path`
+- **Default:** `/.well-known/openid-configuration`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG_DEFAULT_TEST_CONNECTION_ON_STARTUP
+- **Property:** dev.dsf.bpe.fhir.client.connections.config.default.test.connection.on.startup
+- **Required:** No
+- **Description:** FHIR server connections YAML: Default value for properties `test-connection-on-startup` and `oidc-auth.test-connection-on-startup`
+- **Recommendation:** To perform connection tests on BPE startup to configured FHIR servers by default set to `true`
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG_DEFAULT_TIMEOUT_CONNECT
+- **Property:** dev.dsf.bpe.fhir.client.connections.config.default.timeout.connect
+- **Required:** No
+- **Description:** FHIR server connections YAML: Default value for properties `connect-timeout` and `oidc-auth.connect-timeout`
+- **Default:** `PT2S`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG_DEFAULT_TIMEOUT_READ
+- **Property:** dev.dsf.bpe.fhir.client.connections.config.default.timeout.read
+- **Required:** No
+- **Description:** FHIR server connections YAML: Default value for properties `read-timeout` and `oidc-auth.read-timeout`
+- **Default:** `PT10M`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG_DEFAULT_TRUST_SERVER_CERTIFICATE_CAS
+- **Property:** dev.dsf.bpe.fhir.client.connections.config.default.trust.server.certificate.cas
+- **Required:** No
+- **Description:** FHIR server connections YAML: Default value for properties `trusted-root-certificates-file` and `oidc-auth.trusted-root-certificates-file`. Folder with PEM encoded files (*.crt, *.pem) or a single PEM encoded file with one or more trusted root certificates.
+- **Recommendation:** Add file to default folder via bind mount or use docker secret file to configure
+- **Example:** `/run/secrets/app_client_trust_certificates.pem`
+- **Default:** `ca/server_root_cas`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG_OIDC_CACHE
+- **Property:** dev.dsf.bpe.fhir.client.connections.config.oidc.cache
+- **Required:** No
+- **Description:** Set `false` to disable caching of OIDC discovery and jwks resources as well as access tokens in the 'Client Credentials Grant' client; access tokens are evicted 10 seconds before they expire
+- **Default:** `true`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG_OIDC_CACHE_TIMEOUT_ACCESS_TOKEN
+- **Property:** dev.dsf.bpe.fhir.client.connections.config.oidc.cache.timeout.access.token
+- **Required:** No
+- **Description:** OIDC 'Client Credentials Grant' client cache timeout of access tokens before they expire, duration is subtracted from the expires at value of the access token
+- **Default:** `PT10S`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG_OIDC_CACHE_TIMEOUT_CONFIGURATION_RESOURCE
+- **Property:** dev.dsf.bpe.fhir.client.connections.config.oidc.cache.timeout.configuration.resource
+- **Required:** No
+- **Description:** OIDC 'Client Credentials Grant' client cache timeout of the 'openid-configuration' discovery resource
+- **Default:** `PT1H`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG_OIDC_CACHE_TIMEOUT_JWKS_RESOURCE
+- **Property:** dev.dsf.bpe.fhir.client.connections.config.oidc.cache.timeout.jwks.resource
+- **Required:** No
+- **Description:** OIDC 'Client Credentials Grant' client cache timeout of the jwks resource
+- **Default:** `PT1H`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG_OIDC_TIME_VALIDATION_LEEWAY
+- **Property:** dev.dsf.bpe.fhir.client.connections.config.oidc.time.validation.leeway
+- **Required:** No
+- **Description:** OIDC 'Client Credentials Grant' client access token time validation leeway for 'Not Before', 'Issued At' and 'Expires At' values
+- **Default:** `PT10S`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_LOCAL_TIMEOUT_CONNECT
+- **Property:** dev.dsf.bpe.fhir.client.local.timeout.connect
+- **Required:** No
+- **Description:** Timeout until a connection is established with the local DSF FHIR server
+- **Recommendation:** Change default value only if timeout exceptions occur
+- **Default:** `PT2S`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_LOCAL_TIMEOUT_READ
+- **Property:** dev.dsf.bpe.fhir.client.local.timeout.read
+- **Required:** No
+- **Description:** Timeout until reading a resource from the local DSF FHIR server is aborted
+- **Recommendation:** Change default value only if timeout exceptions occur
+- **Default:** `PT60S`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_LOCAL_VERBOSE
+- **Property:** dev.dsf.bpe.fhir.client.local.verbose
+- **Required:** No
+- **Description:** To enable verbose logging of requests to and replies from the local DSF FHIR server, set to `true`
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_REMOTE_TIMEOUT_CONNECT
+- **Property:** dev.dsf.bpe.fhir.client.remote.timeout.connect
+- **Required:** No
+- **Description:** Timeout until a connection is established with a remote DSF FHIR server
+- **Recommendation:** Change default value only if timeout exceptions occur
+- **Default:** `PT5S`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_REMOTE_TIMEOUT_READ
+- **Property:** dev.dsf.bpe.fhir.client.remote.timeout.read
+- **Required:** No
+- **Description:** Timeout until a reading a resource from a remote DSF FHIR server is aborted
+- **Recommendation:** Change default value only if timeout exceptions occur
+- **Default:** `PT60S`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_REMOTE_VERBOSE
+- **Property:** dev.dsf.bpe.fhir.client.remote.verbose
+- **Required:** No
+- **Description:** To enable verbose logging of requests to and replies from remote DSF FHIR servers, set to `true`
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_FHIR_CLIENT_TRUST_SERVER_CERTIFICATE_CAS
+- **Property:** dev.dsf.bpe.fhir.client.trust.server.certificate.cas
+- **Required:** No
+- **Description:** Folder with PEM encoded files (*.crt, *.pem) or a single PEM encoded file with one or more trusted root certificates to validate server certificates for https connections to local and remote DSF FHIR servers
+- **Recommendation:** Add file to default folder via bind mount or use docker secret file to configure
+- **Example:** `/run/secrets/app_client_trust_certificates.pem`
+- **Default:** `ca/server_root_cas`
+
+
+### DEV_DSF_BPE_FHIR_QUESTIONNAIRE_RESPONSE_SUBSCRIPTION_SEARCH_PARAMETER
+- **Property:** dev.dsf.bpe.fhir.questionnaire.response.subscription.search.parameter
+- **Required:** No
+- **Description:** Subscription to receive notifications about questionnaire response resources from the DSF FHIR server
+- **Default:** `?criteria:exact=QuestionnaireResponse%3Fstatus%3Dcompleted&status=active&type=websocket&payload=application/fhir%2Bjson`
+
+
+### DEV_DSF_BPE_FHIR_SERVER_BASE_URL
+- **Property:** dev.dsf.bpe.fhir.server.base.url
+- **Required:** Yes
+- **Description:** Base address of the local DSF FHIR server to read/store fhir resources
+- **Example:** `https://foo.bar/fhir`
+
+
+### DEV_DSF_BPE_FHIR_TASK_SUBSCRIPTION_RETRY_MAX
+- **Property:** dev.dsf.bpe.fhir.task.subscription.retry.max
+- **Required:** No
+- **Description:** Number of retries until a websocket connection can be established with the DSF FHIR server, `-1` means infinite number of retries
+- **Default:** `-1`
+
+
+### DEV_DSF_BPE_FHIR_TASK_SUBSCRIPTION_RETRY_SLEEP
+- **Property:** dev.dsf.bpe.fhir.task.subscription.retry.sleep
+- **Required:** No
+- **Description:** Time between two retries to establish a websocket connection with the DSF FHIR server
+- **Default:** `PT5S`
+
+
+### DEV_DSF_BPE_FHIR_TASK_SUBSCRIPTION_SEARCH_PARAMETER
+- **Property:** dev.dsf.bpe.fhir.task.subscription.search.parameter
+- **Required:** No
+- **Description:** Subscription to receive notifications about task resources from the DSF FHIR server
+- **Default:** `?criteria:exact=Task%3Fstatus%3Drequested&status=active&type=websocket&payload=application/fhir%2Bjson`
+
+
+### DEV_DSF_BPE_MAIL_CLIENT_CERTIFICATE
+- **Property:** dev.dsf.bpe.mail.client.certificate
+- **Required:** No
+- **Description:** PEM encoded file with client certificate used to authenticate against the SMTP server. Requires SMTP over TLS to be enabled via *DEV_DSF_BPE_MAIL_USESMTPS*
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/smtp_server_client_certificate.pem`
+
+
+### DEV_DSF_BPE_MAIL_CLIENT_CERTIFICATE_PRIVATE_KEY
+- **Property:** dev.dsf.bpe.mail.client.certificate.private.key
+- **Required:** No
+- **Description:** Private key corresponging to the SMTP server client certificate as PEM encoded file. Use DEV_DSF_BPE_MAIL_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD* or *DEV_DSF_BPE_MAIL_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE* if private key is encrypted. Requires SMTP over TLS to be enabled via *DEV_DSF_BPE_MAIL_USESMTPS*
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/smtp_server_client_certificate_private_key.pem`
+
+
+### DEV_DSF_BPE_MAIL_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD or DEV_DSF_BPE_MAIL_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE
+- **Property:** dev.dsf.bpe.mail.client.certificate.private.key.password
+- **Required:** No
+- **Description:** Password to decrypt the local client certificate encrypted private key
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_BPE_MAIL_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE*
+- **Example:** `/run/secrets/smtp_server_client_certificate_private_key.pem.password`
+
+
+### DEV_DSF_BPE_MAIL_FROMADDRESS
+- **Property:** dev.dsf.bpe.mail.fromAddress
+- **Required:** No
+- **Description:** Mail service sender address
+- **Example:** `sender@localhost`
+
+
+### DEV_DSF_BPE_MAIL_HOST
+- **Property:** dev.dsf.bpe.mail.host
+- **Required:** No
+- **Description:** SMTP server hostname
+- **Example:** `smtp.server.de`
+
+
+### DEV_DSF_BPE_MAIL_MAILONERRORLOGEVENTBUFFERSIZE
+- **Property:** dev.dsf.bpe.mail.mailOnErrorLogEventBufferSize
+- **Required:** No
+- **Description:** Number of previous INFO, WARN log messages to include in ERROR log event mails (>=0); requires send mail on ERROR log event option to be enabled to have an effect
+- **Default:** `4`
+
+
+### DEV_DSF_BPE_MAIL_MAILONERRORLOGEVENTDEBUGLOGLOCATION
+- **Property:** dev.dsf.bpe.mail.mailOnErrorLogEventDebugLogLocation
+- **Required:** No
+- **Description:** Location of the BPE debug log as displayed in the footer of ERROR log event mails, does not modify the actual location of the debug log file; requires send mail on ERROR log event option to be enabled to have an effect
+- **Default:** `/opt/bpe/log/bpe.log`
+
+
+### DEV_DSF_BPE_MAIL_PASSWORD or DEV_DSF_BPE_MAIL_PASSWORD_FILE
+- **Property:** dev.dsf.bpe.mail.password
+- **Required:** No
+- **Description:** SMTP server authentication password
+- **Recommendation:** Configure if the SMTP server requires username/password authentication; use docker secret file to configure using *DEV_DSF_BPE_MAIL_PASSWORD_FILE*; enable SMTP over TLS via *DEV_DSF_BPE_MAIL_USESMTPS*
+
+
+### DEV_DSF_BPE_MAIL_PORT
+- **Property:** dev.dsf.bpe.mail.port
+- **Required:** No
+- **Description:** SMTP server port
+- **Example:** `465`
+- **Default:** `0`
+
+
+### DEV_DSF_BPE_MAIL_REPLYTOADDRESSES
+- **Property:** dev.dsf.bpe.mail.replyToAddresses
+- **Required:** No
+- **Description:** Mail service reply to addresses; comma or space separated list, YAML block scalars supported
+- **Example:** `reply.to@localhost`
+
+
+### DEV_DSF_BPE_MAIL_SENDMAILONERRORLOGEVENT
+- **Property:** dev.dsf.bpe.mail.sendMailOnErrorLogEvent
+- **Required:** No
+- **Description:** To enable mails being send for every ERROR logged, set to `true`; requires SMTP server to be configured
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_MAIL_SENDTESTMAILONSTARTUP
+- **Property:** dev.dsf.bpe.mail.sendTestMailOnStartup
+- **Required:** No
+- **Description:** To enable a test mail being send on startup of the BPE, set to `true`; requires SMTP server to be configured
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_MAIL_SMIME_P12KEYSTORE
+- **Property:** dev.dsf.bpe.mail.smime.p12Keystore
+- **Required:** No
+- **Description:** PKCS12 encoded file with S/MIME certificate, private key and certificate chain to enable send mails to be S/MIME signed
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/smime_certificate.p12`
+
+
+### DEV_DSF_BPE_MAIL_SMIME_P12KEYSTORE_PASSWORD or DEV_DSF_BPE_MAIL_SMIME_P12KEYSTORE_PASSWORD_FILE
+- **Property:** dev.dsf.bpe.mail.smime.p12Keystore.password
+- **Required:** No
+- **Description:** Password to decrypt the PKCS12 encoded S/MIMIE certificate file
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_BPE_MAIL_SMIME_P12KEYSTORE_PASSWORD_FILE*
+- **Example:** `/run/secrets/smime_certificate.p12.password`
+
+
+### DEV_DSF_BPE_MAIL_TOADDRESSES
+- **Property:** dev.dsf.bpe.mail.toAddresses
+- **Required:** No
+- **Description:** Mail service recipient addresses, configure at least one; comma or space separated list, YAML block scalars supported
+- **Example:** `recipient@localhost`
+
+
+### DEV_DSF_BPE_MAIL_TOADDRESSESCC
+- **Property:** dev.dsf.bpe.mail.toAddressesCc
+- **Required:** No
+- **Description:** Mail service CC recipient addresses; comma or space separated list, YAML block scalars supported
+- **Example:** `cc.recipient@localhost`
+
+
+### DEV_DSF_BPE_MAIL_TRUST_SERVER_CERTIFICATE_CAS
+- **Property:** dev.dsf.bpe.mail.trust.server.certificate.cas
+- **Required:** No
+- **Description:** Folder with PEM encoded files (*.crt, *.pem) or a single PEM encoded file with one or more trusted root certificates to validate the server certificate of the SMTP server. Requires SMTP over TLS to be enabled via *DEV_DSF_BPE_MAIL_USESMTPS*
+- **Recommendation:** Add file to default folder via bind mount or use docker secret file to configure
+- **Example:** `/run/secrets/smtp_server_trust_certificates.pem`
+- **Default:** `ca/server_root_cas`
+
+
+### DEV_DSF_BPE_MAIL_USERNAME
+- **Property:** dev.dsf.bpe.mail.username
+- **Required:** No
+- **Description:** SMTP server authentication username
+- **Recommendation:** Configure if the SMTP server requires username/password authentication; enable SMTP over TLS via *DEV_DSF_BPE_MAIL_USESMTPS*
+
+
+### DEV_DSF_BPE_MAIL_USESMTPS
+- **Property:** dev.dsf.bpe.mail.useSmtps
+- **Required:** No
+- **Description:** To enable SMTP over TLS (smtps), set to `true`
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_PROCESS_API_ALLOWED_BPE_CLASSES
+- **Property:** dev.dsf.bpe.process.api.allowed.bpe.classes
+- **Required:** No
+- **Description:** Map with files containing qualified class names allowed to be loaded by plugins for api versions; map key must match v([1-9]+[0-9]*)
+- **Recommendation:** Change only during development
+- **Example:** `{v1: 'some/example.file', v2: 'other.file'}`
+- **Default:** `{:}`
+
+
+### DEV_DSF_BPE_PROCESS_API_ALLOWED_BPE_RESOURCE
+- **Property:** dev.dsf.bpe.process.api.allowed.bpe.resource
+- **Required:** No
+- **Description:** Map with files containing resources allowed to be loaded by plugins for api versions; map key must match v([1-9]+[0-9]*)
+- **Recommendation:** Change only during development
+- **Example:** `{v1: 'some/example.file', v2: 'other.file'}`
+- **Default:** `{:}`
+
+
+### DEV_DSF_BPE_PROCESS_API_DIRECTORY
+- **Property:** dev.dsf.bpe.process.api.directory
+- **Required:** No
+- **Description:** Directory containing the DSF BPE process plugin api jar files
+- **Recommendation:** Change only during development
+- **Default:** `api`
+
+
+### DEV_DSF_BPE_PROCESS_API_RESOURCES_WITH_PRIORITY
+- **Property:** dev.dsf.bpe.process.api.resources.with.priority
+- **Required:** No
+- **Description:** Map with files containing api/plugin resource with priority over bpe resources for plugins for api versions; map key must match v([1-9]+[0-9]*)
+- **Recommendation:** Change only during development
+- **Example:** `{v1: 'some/example.file', v2: 'other.file'}`
+- **Default:** `{:}`
+
+
+### DEV_DSF_BPE_PROCESS_ENGINE_COREPOOLSIZE
+- **Property:** dev.dsf.bpe.process.engine.corePoolSize
+- **Required:** No
+- **Description:** Process engine job executor core pool size
+- **Default:** `4`
+
+
+### DEV_DSF_BPE_PROCESS_ENGINE_MAXPOOLSIZE
+- **Property:** dev.dsf.bpe.process.engine.maxPoolSize
+- **Required:** No
+- **Description:** Process engine job executor max pool size, additional threads until max pool size are created if the queue is full
+- **Default:** `10`
+
+
+### DEV_DSF_BPE_PROCESS_ENGINE_QUEUESIZE
+- **Property:** dev.dsf.bpe.process.engine.queueSize
+- **Required:** No
+- **Description:** Process engine job executor queue size, jobs are added to the queue if all core pool threads are busy
+- **Default:** `40`
+
+
+### DEV_DSF_BPE_PROCESS_EXCLUDED
+- **Property:** dev.dsf.bpe.process.excluded
+- **Required:** No
+- **Description:** List of process names that should be excluded from deployment during startup of the DSF BPE server; comma or space separated list, YAML block scalars supported
+- **Recommendation:** Only deploy processes that can be started depending on your organization's roles in the Allow-List
+- **Example:** `dsfdev_updateAllowList|1.0, another_process|x.y`
+
+
+### DEV_DSF_BPE_PROCESS_FHIR_SERVER_RETRY_MAX
+- **Property:** dev.dsf.bpe.process.fhir.server.retry.max
+- **Required:** No
+- **Description:** Number of retries until a connection can be established with the local DSF FHIR server during process deployment, `-1` means infinite number of retries
+- **Default:** `-1`
+
+
+### DEV_DSF_BPE_PROCESS_FHIR_SERVER_RETRY_SLEEP
+- **Property:** dev.dsf.bpe.process.fhir.server.retry.sleep
+- **Required:** No
+- **Description:** Time between two retries to establish a connection with the local DSF FHIR server during process deployment
+- **Default:** `PT5S`
+
+
+### DEV_DSF_BPE_PROCESS_FHIR_VALIDATION_ENABLED
+- **Property:** dev.dsf.bpe.process.fhir.validation.enabled
+- **Required:** No
+- **Description:** Set to true to enable FHIR validation feature for process plugins, not implemented for DSF version 2.0.x
+- **Default:** `false`
+
+
+### DEV_DSF_BPE_PROCESS_PLUGIN_DIRECTORY
+- **Property:** dev.dsf.bpe.process.plugin.directory
+- **Required:** No
+- **Description:** Directory containing the DSF BPE process plugins for deployment on startup of the DSF BPE server
+- **Recommendation:** Change only if you don't use the provided directory structure from the installation guide or made changes to tit
+- **Default:** `process`
+
+
+### DEV_DSF_BPE_PROCESS_PLUGIN_EXPLODED
+- **Property:** dev.dsf.bpe.process.plugin.exploded
+- **Required:** No
+- **Description:** Directories containing exploded DSF BPE process plugins for deployment on startup of the DSF BPE server; comma or space separated list, YAML block scalars supported
+- **Recommendation:** Only for testing
+
+
+### DEV_DSF_BPE_PROCESS_RETIRED
+- **Property:** dev.dsf.bpe.process.retired
+- **Required:** No
+- **Description:** List of already deployed process names that should be retired during startup of the DSF BPE server; comma or space separated list, YAML block scalars supported
+- **Recommendation:** Retire processes that where deployed previously but are not anymore available
+- **Example:** `old_process|x.y`
+
+
+### DEV_DSF_BPE_PROCESS_THREADS
+- **Property:** dev.dsf.bpe.process.threads
+- **Required:** No
+- **Description:** Number of parallel Task / QuestionnaireResponse threads to start new or continue existing processes, a value `<= 0` means number of cpu cores
+- **Default:** `-1`
+
+
+### DEV_DSF_BPE_SERVER_BASE_URL
+- **Property:** dev.dsf.bpe.server.base.url
+- **Required:** No
+- **Description:** Base address of the BPE server, configure when exposing the web-ui
+- **Example:** `https://foo.bar/bpe`
+- **Default:** `https://localhost/bpe`
+
+
+### DEV_DSF_BPE_SERVER_ROLECONFIG
+- **Property:** dev.dsf.bpe.server.roleConfig
+- **Required:** No
+- **Description:** Role config YAML as defined in [BPE Server: Access Control](access-control)
+
+
+### DEV_DSF_BPE_SERVER_STATIC_RESOURCE_CACHE
+- **Property:** dev.dsf.bpe.server.static.resource.cache
+- **Required:** No
+- **Description:** To disable static resource caching, set to `false`
+- **Recommendation:** Only set to `false` for development
+- **Default:** `true`
+
+
+### DEV_DSF_BPE_SERVER_UI_THEME
+- **Property:** dev.dsf.bpe.server.ui.theme
+- **Required:** No
+- **Description:** UI theme parameter, adds a color indicator to the ui to distinguish `dev`, `test` and `prod` environments if configured; supported values: `dev`, `test` and `prod`
+
+
+### DEV_DSF_LOG_CONFIG
+- **Property:** dev.dsf.log.config
+- **Required:** No
+- **Description:** Location of a log4j configuration xml file; if file is readable, overrides configuration specified via *DEV_DSF_LOG_...* parameters
+- **Default:** `conf/log4j2.xml`
+
+
+### DEV_DSF_LOG_CONSOLE_ERR_ENABLED
+- **Property:** dev.dsf.log.console.err.enabled
+- **Required:** No
+- **Description:** Set to `true` to enable console err output of the standard logger
+- **Default:** `false`
+
+
+### DEV_DSF_LOG_CONSOLE_ERR_LEVEL
+- **Property:** dev.dsf.log.console.err.level
+- **Required:** No
+- **Description:** Standard logger console err output level, one of: `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`
+- **Default:** `INFO`
+
+
+### DEV_DSF_LOG_CONSOLE_ERR_STYLE
+- **Property:** dev.dsf.log.console.err.style
+- **Required:** No
+- **Description:** Standard logger console err output style, one of: `JSON_ECS`, `JSON_GCP`, `JSON_GELF`, `JSON_LOGSTASH`, `TEXT_MDC`, `TEXT`, `TEXT_COLOR_MDC`, `TEXT_COLOR`
+- **Default:** `TEXT_COLOR`
+
+
+### DEV_DSF_LOG_CONSOLE_OUT_ENABLED
+- **Property:** dev.dsf.log.console.out.enabled
+- **Required:** No
+- **Description:** Set to `false` to disable console out output of the standard logger
+- **Default:** `true`
+
+
+### DEV_DSF_LOG_CONSOLE_OUT_LEVEL
+- **Property:** dev.dsf.log.console.out.level
+- **Required:** No
+- **Description:** Standard logger console out output level, one of: `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`
+- **Default:** `INFO`
+
+
+### DEV_DSF_LOG_CONSOLE_OUT_STYLE
+- **Property:** dev.dsf.log.console.out.style
+- **Required:** No
+- **Description:** Standard logger console out output style, one of: `JSON_ECS`, `JSON_GCP`, `JSON_GELF`, `JSON_LOGSTASH`, `TEXT_MDC`, `TEXT`, `TEXT_COLOR_MDC`, `TEXT_COLOR`
+- **Default:** `TEXT_COLOR`
+
+
+### DEV_DSF_LOG_DATA_CONSOLE_ERR_ENABLED
+- **Property:** dev.dsf.log.data.console.err.enabled
+- **Required:** No
+- **Description:** Set to `true` to enable console err output of the special data logger; the data logger can be used by process plugins to log sensitive data
+- **Default:** `false`
+
+
+### DEV_DSF_LOG_DATA_CONSOLE_ERR_STYLE
+- **Property:** dev.dsf.log.data.console.err.style
+- **Required:** No
+- **Description:** Special data logger console err style, one of: `JSON_ECS`, `JSON_GCP`, `JSON_GELF`, `JSON_LOGSTASH`, `TEXT_MDC`, `TEXT`
+- **Default:** `TEXT`
+
+
+### DEV_DSF_LOG_DATA_CONSOLE_OUT_ENABLED
+- **Property:** dev.dsf.log.data.console.out.enabled
+- **Required:** No
+- **Description:** Set to `true` to enable console out output of the special data logger; the data logger can be used by process plugins to log sensitive data
+- **Default:** `false`
+
+
+### DEV_DSF_LOG_DATA_CONSOLE_OUT_STYLE
+- **Property:** dev.dsf.log.data.console.out.style
+- **Required:** No
+- **Description:** Special data logger console out style, one of: `JSON_ECS`, `JSON_GCP`, `JSON_GELF`, `JSON_LOGSTASH`, `TEXT_MDC`, `TEXT`
+- **Default:** `TEXT`
+
+
+### DEV_DSF_LOG_DATA_FILE_ENABLED
+- **Property:** dev.dsf.log.data.file.enabled
+- **Required:** No
+- **Description:** Set to `true` to enable log file output of the special data logger; the data logger can be used by process plugins to log sensitive data
+- **Default:** `false`
+
+
+### DEV_DSF_LOG_DATA_FILE_STYLE
+- **Property:** dev.dsf.log.data.file.style
+- **Required:** No
+- **Description:** Special data logger file style, one of: `JSON_ECS`, `JSON_GCP`, `JSON_GELF`, `JSON_LOGSTASH`, `TEXT_MDC`, `TEXT`
+- **Default:** `TEXT`
+
+
+### DEV_DSF_LOG_FILE_ENABLED
+- **Property:** dev.dsf.log.file.enabled
+- **Required:** No
+- **Description:** Set to `false` to disable log file output of the standard logger
+- **Default:** `true`
+
+
+### DEV_DSF_LOG_FILE_LEVEL
+- **Property:** dev.dsf.log.file.level
+- **Required:** No
+- **Description:** Standard logger log file output level, one of: `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`
+- **Default:** `DEBUG`
+
+
+### DEV_DSF_LOG_FILE_STYLE
+- **Property:** dev.dsf.log.file.style
+- **Required:** No
+- **Description:** Standard logger log file output style, one of: `JSON_ECS`, `JSON_GCP`, `JSON_GELF`, `JSON_LOGSTASH`, `TEXT_MDC`, `TEXT`
+- **Default:** `TEXT_MDC`
+
+
+### DEV_DSF_PROXY_NOPROXY
+- **Property:** dev.dsf.proxy.noProxy
+- **Required:** No
+- **Description:** Forward proxy no-proxy list, entries will match exactly or against (one level) sub-domains, if no port is specified - all ports are matched; comma or space separated list, YAML block scalars supported
+- **Example:** `foo.bar, test.com:8080`
+
+
+### DEV_DSF_PROXY_PASSWORD or DEV_DSF_PROXY_PASSWORD_FILE
+- **Property:** dev.dsf.proxy.password
+- **Required:** No
+- **Description:** Forward Proxy password
+- **Recommendation:** Configure password if proxy requires authentication, use docker secret file to configure using *DEV_DSF_PROXY_PASSWORD_FILE*
+
+
+### DEV_DSF_PROXY_URL
+- **Property:** dev.dsf.proxy.url
+- **Required:** No
+- **Description:** Forward (http/https) proxy url, use *DEV_DSF_BPE_PROXY_NOPROXY* to list domains that do not require a forward proxy
+- **Example:** `http://proxy.foo:8080`
+
+
+### DEV_DSF_PROXY_USERNAME
+- **Property:** dev.dsf.proxy.username
+- **Required:** No
+- **Description:** Forward proxy username
+- **Recommendation:** Configure username if proxy requires authentication
+
+
+### DEV_DSF_SERVER_API_HOST
+- **Property:** dev.dsf.server.api.host
+- **Required:** No
+- **Description:** API connector host, default in docker image: `0.0.0.0`
+- **Default:** `127.0.0.1`
+
+
+### DEV_DSF_SERVER_API_PORT
+- **Property:** dev.dsf.server.api.port
+- **Required:** No
+- **Description:** API connector port, default in docker image: `8080`
+
+
+### DEV_DSF_SERVER_AUTH_CLIENT_CERTIFICATE_HEADER
+- **Property:** dev.dsf.server.auth.client.certificate.header
+- **Required:** No
+- **Description:** Name of HTTP header with client certificate from reverse proxy
+- **Default:** `X-ClientCert`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW
+- **Property:** dev.dsf.server.auth.oidc.authorization.code.flow
+- **Required:** No
+- **Description:** Set to `true` to enable OIDC authorization code flow
+- **Recommendation:** Requires *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL*, *DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID* and *DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET* or *DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE* to be specified
+- **Default:** `false`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT
+- **Property:** dev.dsf.server.auth.oidc.back.channel.logout
+- **Required:** No
+- **Description:** Set to `true` to enable OIDC back-channel logout
+- **Recommendation:** Requires *DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW* to be set to `true` (enabled), *DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID* and *DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT_PATH* to be specified
+- **Default:** `false`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT_PATH
+- **Property:** dev.dsf.server.auth.oidc.back.channel.logout.path
+- **Required:** No
+- **Description:** Path called by the OIDC provide to request back-channel logout
+- **Default:** `/back-channel-logout`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_BEARER_TOKEN
+- **Property:** dev.dsf.server.auth.oidc.bearer.token
+- **Required:** No
+- **Description:** Set to `true` to enable OIDC bearer token authentication
+- **Recommendation:** Requires *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL* to be specified
+- **Default:** `false`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_BEARER_TOKEN_AUDIENCE
+- **Property:** dev.dsf.server.auth.oidc.bearer.token.audience
+- **Required:** No
+- **Description:** Audience (aud) value to verify before accepting OIDC bearer tokens, uses value from `DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID` by default, set blank string e.g. `''` to disable
+- **Recommendation:** Requires *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL* to be specified and *DEV_DSF_SERVER_AUTH_OIDC_BEARER_TOKEN* set tor `true`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID
+- **Property:** dev.dsf.server.auth.oidc.client.id
+- **Required:** No
+- **Description:** OIDC provider client_id, must be specified if *DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW* is enabled
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET or DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE
+- **Property:** dev.dsf.server.auth.oidc.client.secret
+- **Required:** No
+- **Description:** OIDC provider client_secret, must be specified if *DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW* is enabled
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE
+- **Property:** dev.dsf.server.auth.oidc.provider.client.certificate
+- **Required:** No
+- **Description:** PEM encoded file with client certificate for https connections to the OIDC provider
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/oidc_provider_client_certificate.pem`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY
+- **Property:** dev.dsf.server.auth.oidc.provider.client.certificate.private.key
+- **Required:** No
+- **Description:** Private key corresponding to the client certificate for the OIDC provider as PEM encoded file. Use *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD* or *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE* if private key is encrypted
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/oidc_provider_client_certificate_private_key.pem`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD or DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE
+- **Property:** dev.dsf.server.auth.oidc.provider.client.certificate.private.key.password
+- **Required:** No
+- **Description:** Password to decrypt the client certificate for the OIDC provider encrypted private key
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE*
+- **Example:** `/run/secrets/oidc_provider_client_certificate_private_key.pem.password`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TIMEOUT_CONNECT
+- **Property:** dev.dsf.server.auth.oidc.provider.client.timeout.connect
+- **Required:** No
+- **Description:** OIDC provider client connect timeout
+- **Default:** `PT5S`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TIMEOUT_READ
+- **Property:** dev.dsf.server.auth.oidc.provider.client.timeout.read
+- **Required:** No
+- **Description:** OIDC provider client read timeout
+- **Default:** `PT30S`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS
+- **Property:** dev.dsf.server.auth.oidc.provider.client.trust.server.certificate.cas
+- **Required:** No
+- **Description:** Folder with PEM encoded files (*.crt, *.pem) or a single PEM encoded file with one or more trusted root certificates to validate server certificates for https connections to the OIDC provider
+- **Recommendation:** Add file to default folder via bind mount or use docker secret file to configure
+- **Example:** `/run/secrets/oidc_provider_trust_certificates.pem`
+- **Default:** `ca/server_root_cas`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_DISCOVERY_PATH
+- **Property:** dev.dsf.server.auth.oidc.provider.discovery.path
+- **Required:** No
+- **Description:** OIDC provider discovery path
+- **Default:** `/.well-known/openid-configuration`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL
+- **Property:** dev.dsf.server.auth.oidc.provider.realm.base.url
+- **Required:** No
+- **Description:** OIDC provider realm base url
+- **Example:** `https://keycloak.test.com:8443/realms/example-realm-name`
+
+
+### DEV_DSF_SERVER_AUTH_TRUST_CLIENT_CERTIFICATE_CAS
+- **Property:** dev.dsf.server.auth.trust.client.certificate.cas
+- **Required:** No
+- **Description:** Folder with PEM encoded files (*.crt, *.pem) or a single PEM encoded file with one or more trusted full CA chains to validate client certificates for https connections from local and remote clients
+- **Recommendation:** Add file to default folder via bind mount or use docker secret file to configure
+- **Example:** `/run/secrets/app_client_trust_certificates.pem`
+- **Default:** `ca/client_ca_chains`
+
+
+### DEV_DSF_SERVER_CERTIFICATE
+- **Property:** dev.dsf.server.certificate
+- **Required:** No
+- **Description:** Server certificate file for testing
+- **Recommendation:** Only specify For testing when terminating TLS in jetty server
+
+
+### DEV_DSF_SERVER_CERTIFICATE_CHAIN
+- **Property:** dev.dsf.server.certificate.chain
+- **Required:** No
+- **Description:** Server certificate chain file for testing
+- **Recommendation:** Only specify For testing when terminating TLS in jetty server
+
+
+### DEV_DSF_SERVER_CERTIFICATE_KEY
+- **Property:** dev.dsf.server.certificate.key
+- **Required:** No
+- **Description:** Server certificate private key file for testing
+- **Recommendation:** Only specify For testing when terminating TLS in jetty server
+
+
+### DEV_DSF_SERVER_CERTIFICATE_KEY_PASSWORD or DEV_DSF_SERVER_CERTIFICATE_KEY_PASSWORD_FILE
+- **Property:** dev.dsf.server.certificate.key.password
+- **Required:** No
+- **Description:** Server certificate private key file password for testing
+- **Recommendation:** Only specify For testing when terminating TLS in jetty server
+
+
+### DEV_DSF_SERVER_CONTEXT_PATH
+- **Property:** dev.dsf.server.context.path
+- **Required:** No
+- **Description:** Web application context path, default in `bpe` docker image: `/bpe`, default in `fhir` docker image: `/fhir`
+- **Recommendation:** Only modify for testing
+
+
+### DEV_DSF_SERVER_STATUS_HOST
+- **Property:** dev.dsf.server.status.host
+- **Required:** No
+- **Description:** Status connector host
+- **Default:** `127.0.0.1`
+
+
+### DEV_DSF_SERVER_STATUS_PORT
+- **Property:** dev.dsf.server.status.port
+- **Required:** No
+- **Description:** Status connector port, default in docker image: `10000`
\ No newline at end of file
diff --git a/docs/src/operations/v2.0.2/bpe/fhir-client-connections.md b/docs/src/operations/v2.0.2/bpe/fhir-client-connections.md
new file mode 100644
index 000000000..ad5e80c0d
--- /dev/null
+++ b/docs/src/operations/v2.0.2/bpe/fhir-client-connections.md
@@ -0,0 +1,87 @@
+---
+title: FHIR Client Connections
+icon: config
+---
+
+::: info Compatible Process Plugins
+To our knowledge, as of January 2026 no process plugins have been released into production compatible with this plugin API v2 feature.
+:::
+
+AS part of the process plugin API v2 the DSF BPE Server provides a standardized way for plugins to use FHIR (data) server client connections configured for the entire BPE server. Connections are configured using YAML and specified via the environment variable [`DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG`](configuration.html#dev-dsf-bpe-fhir-client-connections-config). The value for this environment variable is specified as YAML using the block scalar |.
+
+The listing below shows a minimal configuration:
+
+```yaml
+      DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG: |
+        min-server:
+          base-url: http://min.server/fhir
+```
+
+
+The mechanism supports authenticated and non-authenticated connections to FHIR (data) servers using `http` and `https` connections. Basic, Bearer-Token, Client-Certificate, and OIDC Client-Credentials-Flow authentication schemes are supported.
+
+Multiple connections can be configured. Every connection has an ID (valid YAML property name) that needs to be supplied to the process plugin that is supposed to use the connection. Multiple process plugins can use the same connection config.
+
+<!-- TODO default values and environment variables to configure them -->
+
+A JSON schema is available to validate the configuration YAML: https://dsf.dev/schema/fhir_client_connections.json
+
+### Configuration Examples
+
+#### No Authentication, some defaults overridden
+
+ID: `no-auth-server` 
+
+```yaml
+# yaml-language-server: $schema=https://dsf.dev/schema/fhir_client_connections.json
+no-auth-server:
+  base-url: https://no.auth.server:8443/fhir
+  test-connection-on-startup: yes
+  enable-debug-logging: yes
+  connect-timeout: PT0.5S
+  read-timeout: PT5M
+  trusted-root-certificates-file: 'ca.crt'
+```
+
+#### Basic Authentication
+
+ID: `basic-auth-server` 
+
+```yaml
+# yaml-language-server: $schema=https://dsf.dev/schema/fhir_client_connections.json
+basic-auth-server:
+  base-url: https://basic.auth.server/fhir
+  basic-auth:
+    username: user
+    password-file: 'password.file’
+```
+
+#### Client Certificate Authentication
+
+ID: `cert-auth-server` 
+
+```yaml
+# yaml-language-server: $schema=https://dsf.dev/schema/fhir_client_connections.json
+cert-auth-server:
+  base-url: https://cert.auth.server/fhir/foo
+  cert-auth:
+    private-key-file: 'client.key'
+    certificate-file: 'client.crt'
+    password: 'password'
+```
+
+#### OIDC Client-Credentials-Flow Authentication
+
+ID: `oidc-auth-server`
+
+```yaml
+# yaml-language-server: $schema=https://dsf.dev/schema/fhir_client_connections.json
+oidc-auth-server:
+  base-url: https://oidc.auth.server/fhir
+  oidc-auth:
+    base-url: https://oidc.server
+    client-id: some_client_id
+    client-secret-file: 'path/password.file’
+```
+
+For a full list of configuration properties see the FHIR client connections [validation schema](https://dsf.dev/schema/fhir_client_connections.json).
\ No newline at end of file
diff --git a/docs/src/operations/v2.0.2/bpe/logging.md b/docs/src/operations/v2.0.2/bpe/logging.md
new file mode 100644
index 000000000..4707125c5
--- /dev/null
+++ b/docs/src/operations/v2.0.2/bpe/logging.md
@@ -0,0 +1,788 @@
+---
+title: Logging
+icon: config
+---
+
+The DSF BPE Server provides a **Standard Application Logger** and a dedicated **Data Logger** to help debug problems with process plugins. Both mechanisms can output there messages to standard output (stdout), standard error (stderr) and dedicated log files.
+
+By default the **Standard Application Logger** is configured to output with min. level `INFO` and format `TEXT_COLOR` to *stdout* as well as min. level `DEBUG` and format `TEXT_MDC` to a dedicated log file. The **Data Logger** is disabled by default and should only be used to debug problems with process plugins temporarily.
+
+### Standard Application Logger
+The file, *stdout* and *stderr* outputs for the **Standard Application Logger** can be enabled or disabled using the environment variables [`DEV_DSF_LOG_FILE_ENABLED`](./configuration.md#dev-dsf-log-file-enabled), [`DEV_DSF_LOG_CONSOLE_OUT_ENABLED`](./configuration.md#dev-dsf-log-console-out-enabled) and [`DEV_DSF_LOG_CONSOLE_ERR_ENABLED`](./configuration.md#dev-dsf-log-console-err-enabled).
+
+#### Output Level
+Log messages are grouped by severity (low to high): `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`. A minimal log level can be configured for the file, *stdout* and *stderr* outputs using the environment variables [`DEV_DSF_LOG_FILE_LEVEL`](./configuration.md#dev-dsf-log-file-level), [`DEV_DSF_LOG_CONSOLE_OUT_LEVEL`](./configuration.md#dev-dsf-log-console-out-level) and [`DEV_DSF_LOG_CONSOLE_ERR_LEVEL`](./configuration.md#dev-dsf-log-console-err-level).
+
+#### Output Style
+Multiple styles are supported for the **Standard Application Logger** file, *stdout* and *stderr* outputs. All structured logging JSON styles include additional infos (Mapped Diagnostic Context) about the executing process plugin and process instance, or the requesting user. The output style can be configured using the environment variables [`DEV_DSF_LOG_FILE_STYLE`](./configuration.md#dev-dsf-log-file-style), [`DEV_DSF_LOG_CONSOLE_OUT_STYLE`](./configuration.md#dev-dsf-log-console-out-style) and [`DEV_DSF_LOG_CONSOLE_ERR_STYLE`](./configuration.md#dev-dsf-log-console-err-style). The **TEXT_COLOR** and **TEXT_COLOR_MDC** styles are not supported for the file output.
+* **TEXT** a minimal text format.
+* **TEXT_COLOR** a minimal text format with ANSI escape sequences to colorize WARN and ERROR messages. Not supported for the file output.
+* **TEXT_MDC** text format with additional infos (Mapped Diagnostic Context) about the requesting user.
+* **TEXT_COLOR_MDC** text format with additional infos (Mapped Diagnostic Context) about the requesting user and ANSI escape sequences to colorize WARN and ERROR events. Not supported for the file output.
+* **JSON_ECS** follows the Elastic Common Schema (ECS) reference.
+* **JSON_GCP** uses the Google Cloud Platform structured logging model with additional `_thread`, `_logger` and `_exception` fields.
+* **JSON_GELF** follows the Graylog Extended Log Format (GELF) payload specification with added `_thread` and `_logger` fields.
+* **JSON_LOGSTASH** uses the Logstash json_event pattern for log4j.
+
+::: code-tabs#shell
+
+@tab TEXT
+
+```text :no-line-numbers
+2026-01-14 12:21:17,892 [main] INFO  dev.dsf.common.buildinfo.BuildInfoReaderImpl - Artifact: dsf-bpe-server-jetty, version: 2.0.1, build: 2025-11-26T20:24:46+01:00, branch: main, commit: 77ac1d45a35fae8666d531953572ab6c51a58685
+2026-01-14 12:23:15,922 [main] ERROR org.springframework.web.context.ContextLoader - Context initialization failed
+org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'fhirClientConnectionsConfig' defined in URL [jar:file:/opt/bpe/lib/dsf-bpe-server-2.0.1.jar!/dev/dsf/bpe/spring/config/FhirClientConnectionsConfig.class]: Error creating bean with name 'fhirClientConfigs' defined in dev.dsf.bpe.spring.config.FhirClientConnectionsConfig: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1826)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:607)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)
+	at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)
+	at org.springframework.beans.factory.support.DefaultListableBeanFactory.instantiateSingleton(DefaultListableBeanFactory.java:1228)
+	at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingleton(DefaultListableBeanFactory.java:1194)
+	at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:1130)
+	at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:990)
+	at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:627)
+	at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:394)
+	at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:274)
+	at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:126)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.callContextInitialized(ServletContextHandler.java:1614)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.contextInitialized(ServletContextHandler.java:501)
+	at org.eclipse.jetty.ee10.servlet.ServletHandler.initialize(ServletHandler.java:675)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.startContext(ServletContextHandler.java:1348)
+	at org.eclipse.jetty.ee10.webapp.WebAppContext.startWebapp(WebAppContext.java:1429)
+	at org.eclipse.jetty.ee10.webapp.WebAppContext.startContext(WebAppContext.java:1387)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.lambda$doStart$0(ServletContextHandler.java:1066)
+	at org.eclipse.jetty.server.handler.ContextHandler$ScopedContext.call(ContextHandler.java:1636)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.doStart(ServletContextHandler.java:1063)
+	at org.eclipse.jetty.ee10.webapp.WebAppContext.doStart(WebAppContext.java:520)
+	at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)
+	at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:170)
+	at org.eclipse.jetty.server.Server.start(Server.java:689)
+	at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:121)
+	at org.eclipse.jetty.server.Handler$Abstract.doStart(Handler.java:545)
+	at org.eclipse.jetty.server.Server.doStart(Server.java:630)
+	at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)
+	at dev.dsf.common.jetty.JettyServer.start(JettyServer.java:374)
+	at dev.dsf.bpe.BpeJettyServer.main(BpeJettyServer.java:56)
+Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'fhirClientConfigs' defined in dev.dsf.bpe.spring.config.FhirClientConnectionsConfig: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)
+	at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)
+	at dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.fhirClientConfigs(<generated>)
+	at dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.afterPropertiesSet(FhirClientConnectionsConfig.java:138)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1873)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1822)
+	... 33 more
+Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)
+	... 48 more
+Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)
+	at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)
+	at dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)
+	at dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.createDsfConfig(FhirClientConnectionsConfig.java:129)
+	at dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.fhirClientConfigs(FhirClientConnectionsConfig.java:105)
+	at dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.CGLIB$fhirClientConfigs$1(<generated>)
+	at dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)
+	at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)
+	at dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.fhirClientConfigs(<generated>)
+	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:565)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)
+	... 51 more
+Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)
+	... 73 more
+Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:645)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:357)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:212)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:431)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)
+	at dev.dsf.bpe.spring.config.PropertiesConfig$$SpringCGLIB$$0.getDsfClientKeyStore(<generated>)
+	at dev.dsf.bpe.spring.config.DsfClientConfig.clientProvider(DsfClientConfig.java:93)
+	at dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.CGLIB$clientProvider$1(<generated>)
+	at dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)
+	at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)
+	at dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)
+	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:565)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)
+	... 76 more
+Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)
+	... 95 more
+Caused by: java.lang.RuntimeException: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at dev.dsf.common.config.AbstractCertificateConfig.createClientKeyStore(AbstractCertificateConfig.java:235)
+	at dev.dsf.bpe.spring.config.PropertiesConfig.getDsfClientKeyStore(PropertiesConfig.java:579)
+	at dev.dsf.bpe.spring.config.PropertiesConfig$$SpringCGLIB$$0.CGLIB$getDsfClientKeyStore$23(<generated>)
+	at dev.dsf.bpe.spring.config.PropertiesConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)
+	at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)
+	at dev.dsf.bpe.spring.config.PropertiesConfig$$SpringCGLIB$$0.getDsfClientKeyStore(<generated>)
+	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:565)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)
+	... 98 more
+Caused by: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:435)
+	at de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:398)
+	at dev.dsf.common.config.AbstractCertificateConfig.createClientKeyStore(AbstractCertificateConfig.java:228)
+	... 107 more
+Caused by: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo.decryptPrivateKeyInfo(Unknown Source)
+	at de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:430)
+	... 109 more
+Caused by: org.bouncycastle.crypto.io.InvalidCipherTextIOException: Error finalising cipher
+	at org.bouncycastle.jcajce.io.CipherInputStream.finaliseCipher(Unknown Source)
+	at org.bouncycastle.jcajce.io.CipherInputStream.nextChunk(Unknown Source)
+	at org.bouncycastle.jcajce.io.CipherInputStream.read(Unknown Source)
+	at org.bouncycastle.util.io.Streams.pipeAll(Unknown Source)
+	at org.bouncycastle.util.io.Streams.pipeAll(Unknown Source)
+	at org.bouncycastle.util.io.Streams.readAll(Unknown Source)
+	... 111 more
+Caused by: javax.crypto.BadPaddingException: pad block corrupted
+	at org.bouncycastle.jcajce.provider.symmetric.util.BaseBlockCipher$BufferedGenericBlockCipher.doFinal(Unknown Source)
+	at org.bouncycastle.jcajce.provider.symmetric.util.BaseBlockCipher.engineDoFinal(Unknown Source)
+	at java.base/javax.crypto.Cipher.doFinal(Cipher.java:2139)
+	... 117 more
+2026-01-14 12:24:35,514 [pool-2-thread-1] INFO  dev.dsf.bpe.v2.listener.StartListener - Starting process http://dsf.dev/bpe/Process/helloWorld|2.0 at 2026-01-14T12:24:35+01:00 [task: https://fhir/fhir/Task/04c2ff6f-dfce-4201-9c3d-bbce15dc892a, requester: webbrowser.test.user@invalid, business-key: 92f2eee2-319e-47dc-8bdb-f646740b05c8, message: helloWorld]
+2026-01-14 12:24:35,521 [pool-2-thread-1] INFO  dev.dsf.bpe.service.HelloWorld - Hello World from organization with identifier 'webbrowser.test.user@invalid'
+```
+
+@tab TEXT_MDC
+
+```text :no-line-numbers
+2026-01-14 12:25:51,000 [main] INFO  dev.dsf.common.buildinfo.BuildInfoReaderImpl - Artifact: dsf-bpe-server-jetty, version: 2.0.1, build: 2025-11-26T20:24:46+01:00, branch: main, commit: 77ac1d45a35fae8666d531953572ab6c51a58685
+2026-01-14 12:26:24,075 [main] ERROR org.springframework.web.context.ContextLoader - Context initialization failed
+org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'fhirClientConnectionsConfig' defined in URL [jar:file:/opt/bpe/lib/dsf-bpe-server-2.0.1.jar!/dev/dsf/bpe/spring/config/FhirClientConnectionsConfig.class]: Error creating bean with name 'fhirClientConfigs' defined in dev.dsf.bpe.spring.config.FhirClientConnectionsConfig: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1826)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:607)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)
+	at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)
+	at org.springframework.beans.factory.support.DefaultListableBeanFactory.instantiateSingleton(DefaultListableBeanFactory.java:1228)
+	at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingleton(DefaultListableBeanFactory.java:1194)
+	at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:1130)
+	at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:990)
+	at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:627)
+	at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:394)
+	at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:274)
+	at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:126)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.callContextInitialized(ServletContextHandler.java:1614)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.contextInitialized(ServletContextHandler.java:501)
+	at org.eclipse.jetty.ee10.servlet.ServletHandler.initialize(ServletHandler.java:675)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.startContext(ServletContextHandler.java:1348)
+	at org.eclipse.jetty.ee10.webapp.WebAppContext.startWebapp(WebAppContext.java:1429)
+	at org.eclipse.jetty.ee10.webapp.WebAppContext.startContext(WebAppContext.java:1387)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.lambda$doStart$0(ServletContextHandler.java:1066)
+	at org.eclipse.jetty.server.handler.ContextHandler$ScopedContext.call(ContextHandler.java:1636)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.doStart(ServletContextHandler.java:1063)
+	at org.eclipse.jetty.ee10.webapp.WebAppContext.doStart(WebAppContext.java:520)
+	at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)
+	at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:170)
+	at org.eclipse.jetty.server.Server.start(Server.java:689)
+	at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:121)
+	at org.eclipse.jetty.server.Handler$Abstract.doStart(Handler.java:545)
+	at org.eclipse.jetty.server.Server.doStart(Server.java:630)
+	at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)
+	at dev.dsf.common.jetty.JettyServer.start(JettyServer.java:374)
+	at dev.dsf.bpe.BpeJettyServer.main(BpeJettyServer.java:56)
+Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'fhirClientConfigs' defined in dev.dsf.bpe.spring.config.FhirClientConnectionsConfig: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)
+	at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)
+	at dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.fhirClientConfigs(<generated>)
+	at dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.afterPropertiesSet(FhirClientConnectionsConfig.java:138)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1873)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1822)
+	... 33 more
+Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)
+	... 48 more
+Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)
+	at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)
+	at dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)
+	at dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.createDsfConfig(FhirClientConnectionsConfig.java:129)
+	at dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.fhirClientConfigs(FhirClientConnectionsConfig.java:105)
+	at dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.CGLIB$fhirClientConfigs$1(<generated>)
+	at dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)
+	at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)
+	at dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.fhirClientConfigs(<generated>)
+	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:565)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)
+	... 51 more
+Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)
+	... 73 more
+Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:645)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:357)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:212)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:431)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)
+	at dev.dsf.bpe.spring.config.PropertiesConfig$$SpringCGLIB$$0.getDsfClientKeyStore(<generated>)
+	at dev.dsf.bpe.spring.config.DsfClientConfig.clientProvider(DsfClientConfig.java:93)
+	at dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.CGLIB$clientProvider$1(<generated>)
+	at dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)
+	at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)
+	at dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)
+	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:565)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)
+	... 76 more
+Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)
+	... 95 more
+Caused by: java.lang.RuntimeException: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at dev.dsf.common.config.AbstractCertificateConfig.createClientKeyStore(AbstractCertificateConfig.java:235)
+	at dev.dsf.bpe.spring.config.PropertiesConfig.getDsfClientKeyStore(PropertiesConfig.java:579)
+	at dev.dsf.bpe.spring.config.PropertiesConfig$$SpringCGLIB$$0.CGLIB$getDsfClientKeyStore$23(<generated>)
+	at dev.dsf.bpe.spring.config.PropertiesConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)
+	at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)
+	at dev.dsf.bpe.spring.config.PropertiesConfig$$SpringCGLIB$$0.getDsfClientKeyStore(<generated>)
+	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:565)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)
+	... 98 more
+Caused by: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:435)
+	at de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:398)
+	at dev.dsf.common.config.AbstractCertificateConfig.createClientKeyStore(AbstractCertificateConfig.java:228)
+	... 107 more
+Caused by: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo.decryptPrivateKeyInfo(Unknown Source)
+	at de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:430)
+	... 109 more
+Caused by: org.bouncycastle.crypto.io.InvalidCipherTextIOException: Error finalising cipher
+	at org.bouncycastle.jcajce.io.CipherInputStream.finaliseCipher(Unknown Source)
+	at org.bouncycastle.jcajce.io.CipherInputStream.nextChunk(Unknown Source)
+	at org.bouncycastle.jcajce.io.CipherInputStream.read(Unknown Source)
+	at org.bouncycastle.util.io.Streams.pipeAll(Unknown Source)
+	at org.bouncycastle.util.io.Streams.pipeAll(Unknown Source)
+	at org.bouncycastle.util.io.Streams.readAll(Unknown Source)
+	... 111 more
+Caused by: javax.crypto.BadPaddingException: pad block corrupted
+	at org.bouncycastle.jcajce.provider.symmetric.util.BaseBlockCipher$BufferedGenericBlockCipher.doFinal(Unknown Source)
+	at org.bouncycastle.jcajce.provider.symmetric.util.BaseBlockCipher.engineDoFinal(Unknown Source)
+	at java.base/javax.crypto.Cipher.doFinal(Cipher.java:2139)
+	... 117 more
+2026-01-14 12:28:10,811 [pool-2-thread-1] INFO  dev.dsf.bpe.v2.listener.StartListener - {dsf.plugin.api=2, dsf.plugin.jar=process/dsf-process-hello-world-2.0.0.0-SNAPSHOT.jar, dsf.plugin.name=dsf-process-hello-world, dsf.plugin.version=2.0.0.0, dsf.process=http://dsf.dev/bpe/Process/helloWorld|2.0, dsf.process.activityId=StartEvent_1, dsf.process.businessKey=110f2d10-e140-4e9f-a76d-63e9c3eb4579, dsf.process.definitionId=dsfdev_helloWorld:1:28f93392-f13b-11f0-92c1-5ed660dabcfa, dsf.process.definitionKey=dsfdev_helloWorld, dsf.process.instanceId=1b5bd4cf-f13c-11f0-8e80-b6c09f49be99, dsf.process.requester.start=webbrowser.test.user@invalid, dsf.process.task.start=https://fhir/fhir/Task/b822f6cb-3cf0-4132-926e-fd7730e780f0} - Starting process http://dsf.dev/bpe/Process/helloWorld|2.0 at 2026-01-14T12:28:10+01:00 [task: https://fhir/fhir/Task/b822f6cb-3cf0-4132-926e-fd7730e780f0, requester: webbrowser.test.user@invalid, business-key: 110f2d10-e140-4e9f-a76d-63e9c3eb4579, message: helloWorld]
+2026-01-14 12:28:10,820 [pool-2-thread-1] INFO  dev.dsf.bpe.service.HelloWorld - {dsf.plugin.api=2, dsf.plugin.jar=process/dsf-process-hello-world-2.0.0.0-SNAPSHOT.jar, dsf.plugin.name=dsf-process-hello-world, dsf.plugin.version=2.0.0.0, dsf.process=http://dsf.dev/bpe/Process/helloWorld|2.0, dsf.process.activityId=helloWorldTask, dsf.process.activityName=Hello World, dsf.process.businessKey=110f2d10-e140-4e9f-a76d-63e9c3eb4579, dsf.process.definitionId=dsfdev_helloWorld:1:28f93392-f13b-11f0-92c1-5ed660dabcfa, dsf.process.definitionKey=dsfdev_helloWorld, dsf.process.instanceId=1b5bd4cf-f13c-11f0-8e80-b6c09f49be99, dsf.process.requester.start=webbrowser.test.user@invalid, dsf.process.task.start=https://fhir/fhir/Task/b822f6cb-3cf0-4132-926e-fd7730e780f0} - Hello World from organization with identifier 'webbrowser.test.user@invalid'
+```
+
+@tab JSON_ECS
+
+```json :no-line-numbers
+{
+    "@timestamp": "2026-01-14T11:33:31.869Z",
+    "ecs.version": "1.2.0",
+    "log.level": "INFO",
+    "message": "Artifact: dsf-bpe-server-jetty, version: 2.0.1, build: 2025-11-26T20:24:46+01:00, branch: main, commit: 77ac1d45a35fae8666d531953572ab6c51a58685",
+    "process.thread.name": "main",
+    "log.logger": "dev.dsf.common.buildinfo.BuildInfoReaderImpl"
+}
+{
+    "@timestamp": "2026-01-14T11:34:59.557Z",
+    "ecs.version": "1.2.0",
+    "log.level": "ERROR",
+    "message": "Context initialization failed",
+    "process.thread.name": "main",
+    "log.logger": "org.springframework.web.context.ContextLoader",
+    "error.type": "org.springframework.beans.factory.BeanCreationException",
+    "error.message": "Error creating bean with name 'fhirClientConnectionsConfig' defined in URL [jar:file:/opt/bpe/lib/dsf-bpe-server-2.0.1.jar!/dev/dsf/bpe/spring/config/FhirClientConnectionsConfig.class]: Error creating bean with name 'fhirClientConfigs' defined in dev.dsf.bpe.spring.config.FhirClientConnectionsConfig: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher",
+    "error.stack_trace": "org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'fhirClientConnectionsConfig' defined in URL [jar:file:/opt/bpe/lib/dsf-bpe-server-2.0.1.jar!/dev/dsf/bpe/spring/config/FhirClientConnectionsConfig.class]: Error creating bean with name 'fhirClientConfigs' defined in dev.dsf.bpe.spring.config.FhirClientConnectionsConfig: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1826)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:607)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.instantiateSingleton(DefaultListableBeanFactory.java:1228)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingleton(DefaultListableBeanFactory.java:1194)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:1130)\n\tat org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:990)\n\tat org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:627)\n\tat org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:394)\n\tat org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:274)\n\tat org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:126)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.callContextInitialized(ServletContextHandler.java:1614)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.contextInitialized(ServletContextHandler.java:501)\n\tat org.eclipse.jetty.ee10.servlet.ServletHandler.initialize(ServletHandler.java:675)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.startContext(ServletContextHandler.java:1348)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startWebapp(WebAppContext.java:1429)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startContext(WebAppContext.java:1387)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.lambda$doStart$0(ServletContextHandler.java:1066)\n\tat org.eclipse.jetty.server.handler.ContextHandler$ScopedContext.call(ContextHandler.java:1636)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.doStart(ServletContextHandler.java:1063)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.doStart(WebAppContext.java:520)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:170)\n\tat org.eclipse.jetty.server.Server.start(Server.java:689)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:121)\n\tat org.eclipse.jetty.server.Handler$Abstract.doStart(Handler.java:545)\n\tat org.eclipse.jetty.server.Server.doStart(Server.java:630)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat dev.dsf.common.jetty.JettyServer.start(JettyServer.java:374)\n\tat dev.dsf.bpe.BpeJettyServer.main(BpeJettyServer.java:56)\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'fhirClientConfigs' defined in dev.dsf.bpe.spring.config.FhirClientConnectionsConfig: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.fhirClientConfigs(<generated>)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.afterPropertiesSet(FhirClientConnectionsConfig.java:138)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1873)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1822)\n\t... 33 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 48 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.createDsfConfig(FhirClientConnectionsConfig.java:129)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.fhirClientConfigs(FhirClientConnectionsConfig.java:105)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.CGLIB$fhirClientConfigs$2(<generated>)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.fhirClientConfigs(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 51 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 73 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:645)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:357)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:212)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:431)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.bpe.spring.config.PropertiesConfig$$SpringCGLIB$$0.getDsfClientKeyStore(<generated>)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig.clientProvider(DsfClientConfig.java:93)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.CGLIB$clientProvider$1(<generated>)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.ja…"
+}
+{
+    "@timestamp": "2026-01-14T11:36:22.477Z",
+    "ecs.version": "1.2.0",
+    "log.level": "INFO",
+    "message": "Starting process http://dsf.dev/bpe/Process/helloWorld|2.0 at 2026-01-14T12:36:22+01:00 [task: https://fhir/fhir/Task/8e9cd5b0-17db-460a-9e4a-73d6c8128ed4, requester: webbrowser.test.user@invalid, business-key: 6d808467-4b71-44bd-8c4c-1ec9f5482855, message: helloWorld]",
+    "process.thread.name": "pool-2-thread-1",
+    "log.logger": "dev.dsf.bpe.v2.listener.StartListener",
+    "dsf.plugin.api": "2",
+    "dsf.plugin.jar": "process/dsf-process-hello-world-2.0.0.0-SNAPSHOT.jar",
+    "dsf.plugin.name": "dsf-process-hello-world",
+    "dsf.plugin.version": "2.0.0.0",
+    "dsf.process": "http://dsf.dev/bpe/Process/helloWorld|2.0",
+    "dsf.process.activityId": "StartEvent_1",
+    "dsf.process.businessKey": "6d808467-4b71-44bd-8c4c-1ec9f5482855",
+    "dsf.process.definitionId": "dsfdev_helloWorld:1:28f93392-f13b-11f0-92c1-5ed660dabcfa",
+    "dsf.process.definitionKey": "dsfdev_helloWorld",
+    "dsf.process.instanceId": "406b2d2f-f13d-11f0-9f64-5e3458c5889b",
+    "dsf.process.requester.start": "webbrowser.test.user@invalid",
+    "dsf.process.task.start": "https://fhir/fhir/Task/8e9cd5b0-17db-460a-9e4a-73d6c8128ed4"
+}
+{
+    "@timestamp": "2026-01-14T11:36:22.483Z",
+    "ecs.version": "1.2.0",
+    "log.level": "INFO",
+    "message": "Hello World from organization with identifier 'webbrowser.test.user@invalid'",
+    "process.thread.name": "pool-2-thread-1",
+    "log.logger": "dev.dsf.bpe.service.HelloWorld",
+    "dsf.plugin.api": "2",
+    "dsf.plugin.jar": "process/dsf-process-hello-world-2.0.0.0-SNAPSHOT.jar",
+    "dsf.plugin.name": "dsf-process-hello-world",
+    "dsf.plugin.version": "2.0.0.0",
+    "dsf.process": "http://dsf.dev/bpe/Process/helloWorld|2.0",
+    "dsf.process.activityId": "helloWorldTask",
+    "dsf.process.activityName": "Hello World",
+    "dsf.process.businessKey": "6d808467-4b71-44bd-8c4c-1ec9f5482855",
+    "dsf.process.definitionId": "dsfdev_helloWorld:1:28f93392-f13b-11f0-92c1-5ed660dabcfa",
+    "dsf.process.definitionKey": "dsfdev_helloWorld",
+    "dsf.process.instanceId": "406b2d2f-f13d-11f0-9f64-5e3458c5889b",
+    "dsf.process.requester.start": "webbrowser.test.user@invalid",
+    "dsf.process.task.start": "https://fhir/fhir/Task/8e9cd5b0-17db-460a-9e4a-73d6c8128ed4"
+}
+```
+
+@tab JSON_GCP
+
+```json :no-line-numbers
+{
+    "timestampSeconds": 1768390669,
+    "timestampNanos": 347278835,
+    "severity": "INFO",
+    "message": "Artifact: dsf-bpe-server-jetty, version: 2.0.1, build: 2025-11-26T20:24:46+01:00, branch: main, commit: 77ac1d45a35fae8666d531953572ab6c51a58685",
+    "logging.googleapis.com/sourceLocation": {
+        "function": "dev.dsf.common.buildinfo.BuildInfoReaderImpl.logBuildInfo"
+    },
+    "logging.googleapis.com/trace_sampled": true,
+    "thread": "main",
+    "logger": "dev.dsf.common.buildinfo.BuildInfoReaderImpl"
+}
+{
+    "timestampSeconds": 1768390720,
+    "timestampNanos": 287531451,
+    "severity": "ERROR",
+    "message": "Context initialization failed\norg.springframework.beans.factory.BeanCreationException: Error creating bean with name 'fhirClientConnectionsConfig' defined in URL [jar:file:/opt/bpe/lib/dsf-bpe-server-2.0.1.jar!/dev/dsf/bpe/spring/config/FhirClientConnectionsConfig.class]: Error creating bean with name 'fhirClientConfigs' defined in dev.dsf.bpe.spring.config.FhirClientConnectionsConfig: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1826)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:607)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.instantiateSingleton(DefaultListableBeanFactory.java:1228)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingleton(DefaultListableBeanFactory.java:1194)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:1130)\n\tat org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:990)\n\tat org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:627)\n\tat org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:394)\n\tat org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:274)\n\tat org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:126)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.callContextInitialized(ServletContextHandler.java:1614)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.contextInitialized(ServletContextHandler.java:501)\n\tat org.eclipse.jetty.ee10.servlet.ServletHandler.initialize(ServletHandler.java:675)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.startContext(ServletContextHandler.java:1348)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startWebapp(WebAppContext.java:1429)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startContext(WebAppContext.java:1387)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.lambda$doStart$0(ServletContextHandler.java:1066)\n\tat org.eclipse.jetty.server.handler.ContextHandler$ScopedContext.call(ContextHandler.java:1636)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.doStart(ServletContextHandler.java:1063)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.doStart(WebAppContext.java:520)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:170)\n\tat org.eclipse.jetty.server.Server.start(Server.java:689)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:121)\n\tat org.eclipse.jetty.server.Handler$Abstract.doStart(Handler.java:545)\n\tat org.eclipse.jetty.server.Server.doStart(Server.java:630)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat dev.dsf.common.jetty.JettyServer.start(JettyServer.java:374)\n\tat dev.dsf.bpe.BpeJettyServer.main(BpeJettyServer.java:56)\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'fhirClientConfigs' defined in dev.dsf.bpe.spring.config.FhirClientConnectionsConfig: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.fhirClientConfigs(<generated>)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.afterPropertiesSet(FhirClientConnectionsConfig.java:138)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1873)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1822)\n\t... 33 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 48 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.createDsfConfig(FhirClientConnectionsConfig.java:129)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.fhirClientConfigs(FhirClientConnectionsConfig.java:105)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.CGLIB$fhirClientConfigs$1(<generated>)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.fhirClientConfigs(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 51 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 73 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:645)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:357)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:212)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:431)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.bpe.spring.config.PropertiesConfig$$SpringCGLIB$$0.getDsfClientKeyStore(<generated>)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig.clientProvider(DsfClientConfig.java:93)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.CGLIB$clientProvider$1(<generated>)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(…",
+    "logging.googleapis.com/sourceLocation": {
+        "function": "org.springframework.web.context.ContextLoader.initWebApplicationContext"
+    },
+    "logging.googleapis.com/trace_sampled": true,
+    "exception": "org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'fhirClientConnectionsConfig' defined in URL [jar:file:/opt/bpe/lib/dsf-bpe-server-2.0.1.jar!/dev/dsf/bpe/spring/config/FhirClientConnectionsConfig.class]: Error creating bean with name 'fhirClientConfigs' defined in dev.dsf.bpe.spring.config.FhirClientConnectionsConfig: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1826)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:607)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.instantiateSingleton(DefaultListableBeanFactory.java:1228)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingleton(DefaultListableBeanFactory.java:1194)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:1130)\n\tat org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:990)\n\tat org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:627)\n\tat org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:394)\n\tat org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:274)\n\tat org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:126)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.callContextInitialized(ServletContextHandler.java:1614)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.contextInitialized(ServletContextHandler.java:501)\n\tat org.eclipse.jetty.ee10.servlet.ServletHandler.initialize(ServletHandler.java:675)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.startContext(ServletContextHandler.java:1348)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startWebapp(WebAppContext.java:1429)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startContext(WebAppContext.java:1387)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.lambda$doStart$0(ServletContextHandler.java:1066)\n\tat org.eclipse.jetty.server.handler.ContextHandler$ScopedContext.call(ContextHandler.java:1636)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.doStart(ServletContextHandler.java:1063)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.doStart(WebAppContext.java:520)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:170)\n\tat org.eclipse.jetty.server.Server.start(Server.java:689)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:121)\n\tat org.eclipse.jetty.server.Handler$Abstract.doStart(Handler.java:545)\n\tat org.eclipse.jetty.server.Server.doStart(Server.java:630)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat dev.dsf.common.jetty.JettyServer.start(JettyServer.java:374)\n\tat dev.dsf.bpe.BpeJettyServer.main(BpeJettyServer.java:56)\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'fhirClientConfigs' defined in dev.dsf.bpe.spring.config.FhirClientConnectionsConfig: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.fhirClientConfigs(<generated>)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.afterPropertiesSet(FhirClientConnectionsConfig.java:138)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1873)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1822)\n\t... 33 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 48 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.createDsfConfig(FhirClientConnectionsConfig.java:129)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.fhirClientConfigs(FhirClientConnectionsConfig.java:105)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.CGLIB$fhirClientConfigs$1(<generated>)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.fhirClientConfigs(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 51 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 73 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:645)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:357)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:212)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:431)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.bpe.spring.config.PropertiesConfig$$SpringCGLIB$$0.getDsfClientKeyStore(<generated>)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig.clientProvider(DsfClientConfig.java:93)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.CGLIB$clientProvider$1(<generated>)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.ja…",
+    "thread": "main",
+    "logger": "org.springframework.web.context.ContextLoader"
+}
+{
+    "timestampSeconds": 1768390780,
+    "timestampNanos": 130358998,
+    "severity": "INFO",
+    "message": "Starting process http://dsf.dev/bpe/Process/helloWorld|2.0 at 2026-01-14T12:39:40+01:00 [task: https://fhir/fhir/Task/cf656fa3-2067-4e7e-8325-7f6cf1f4300d, requester: webbrowser.test.user@invalid, business-key: 6741a33d-09bd-405e-b011-81c16f42f08f, message: helloWorld]",
+    "logging.googleapis.com/labels": {
+        "dsf.plugin.api": "2",
+        "dsf.plugin.jar": "process/dsf-process-hello-world-2.0.0.0-SNAPSHOT.jar",
+        "dsf.plugin.name": "dsf-process-hello-world",
+        "dsf.plugin.version": "2.0.0.0",
+        "dsf.process": "http://dsf.dev/bpe/Process/helloWorld|2.0",
+        "dsf.process.activityId": "StartEvent_1",
+        "dsf.process.businessKey": "6741a33d-09bd-405e-b011-81c16f42f08f",
+        "dsf.process.definitionId": "dsfdev_helloWorld:1:28f93392-f13b-11f0-92c1-5ed660dabcfa",
+        "dsf.process.definitionKey": "dsfdev_helloWorld",
+        "dsf.process.instanceId": "b63a052a-f13d-11f0-b579-bad729d5f5ed",
+        "dsf.process.requester.start": "webbrowser.test.user@invalid",
+        "dsf.process.task.start": "https://fhir/fhir/Task/cf656fa3-2067-4e7e-8325-7f6cf1f4300d"
+    },
+    "logging.googleapis.com/sourceLocation": {
+        "function": "dev.dsf.bpe.v2.listener.StartListener.logStart"
+    },
+    "logging.googleapis.com/trace_sampled": true,
+    "thread": "pool-2-thread-1",
+    "logger": "dev.dsf.bpe.v2.listener.StartListener"
+}
+{
+    "timestampSeconds": 1768390780,
+    "timestampNanos": 137602932,
+    "severity": "INFO",
+    "message": "Hello World from organization with identifier 'webbrowser.test.user@invalid'",
+    "logging.googleapis.com/labels": {
+        "dsf.plugin.api": "2",
+        "dsf.plugin.jar": "process/dsf-process-hello-world-2.0.0.0-SNAPSHOT.jar",
+        "dsf.plugin.name": "dsf-process-hello-world",
+        "dsf.plugin.version": "2.0.0.0",
+        "dsf.process": "http://dsf.dev/bpe/Process/helloWorld|2.0",
+        "dsf.process.activityId": "helloWorldTask",
+        "dsf.process.activityName": "Hello World",
+        "dsf.process.businessKey": "6741a33d-09bd-405e-b011-81c16f42f08f",
+        "dsf.process.definitionId": "dsfdev_helloWorld:1:28f93392-f13b-11f0-92c1-5ed660dabcfa",
+        "dsf.process.definitionKey": "dsfdev_helloWorld",
+        "dsf.process.instanceId": "b63a052a-f13d-11f0-b579-bad729d5f5ed",
+        "dsf.process.requester.start": "webbrowser.test.user@invalid",
+        "dsf.process.task.start": "https://fhir/fhir/Task/cf656fa3-2067-4e7e-8325-7f6cf1f4300d"
+    },
+    "logging.googleapis.com/sourceLocation": {
+        "function": "dev.dsf.bpe.service.HelloWorld.execute"
+    },
+    "logging.googleapis.com/trace_sampled": true,
+    "thread": "pool-2-thread-1",
+    "logger": "dev.dsf.bpe.service.HelloWorld"
+}
+```
+
+@tab JSON_GELF
+
+```json :no-line-numbers
+{
+    "version": "1.1",
+    "host": "ce85e727ccb2",
+    "short_message": "Artifact: dsf-bpe-server-jetty, version: 2.0.1, build: 2025-11-26T20:24:46+01:00, branch: main, commit: 77ac1d45a35fae8666d531953572ab6c51a58685",
+    "timestamp": 1768390889.4524915,
+    "level": 6,
+    "_logger": "dev.dsf.common.buildinfo.BuildInfoReaderImpl",
+    "_thread": "main"
+}
+{
+    "version": "1.1",
+    "host": "4fa9b078922b",
+    "short_message": "Context initialization failed",
+    "full_message": "org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'fhirClientConnectionsConfig' defined in URL [jar:file:/opt/bpe/lib/dsf-bpe-server-2.0.1.jar!/dev/dsf/bpe/spring/config/FhirClientConnectionsConfig.class]: Error creating bean with name 'fhirClientConfigs' defined in dev.dsf.bpe.spring.config.FhirClientConnectionsConfig: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1826)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:607)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.instantiateSingleton(DefaultListableBeanFactory.java:1228)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingleton(DefaultListableBeanFactory.java:1194)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:1130)\n\tat org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:990)\n\tat org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:627)\n\tat org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:394)\n\tat org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:274)\n\tat org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:126)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.callContextInitialized(ServletContextHandler.java:1614)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.contextInitialized(ServletContextHandler.java:501)\n\tat org.eclipse.jetty.ee10.servlet.ServletHandler.initialize(ServletHandler.java:675)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.startContext(ServletContextHandler.java:1348)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startWebapp(WebAppContext.java:1429)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startContext(WebAppContext.java:1387)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.lambda$doStart$0(ServletContextHandler.java:1066)\n\tat org.eclipse.jetty.server.handler.ContextHandler$ScopedContext.call(ContextHandler.java:1636)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.doStart(ServletContextHandler.java:1063)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.doStart(WebAppContext.java:520)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:170)\n\tat org.eclipse.jetty.server.Server.start(Server.java:689)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:121)\n\tat org.eclipse.jetty.server.Handler$Abstract.doStart(Handler.java:545)\n\tat org.eclipse.jetty.server.Server.doStart(Server.java:630)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat dev.dsf.common.jetty.JettyServer.start(JettyServer.java:374)\n\tat dev.dsf.bpe.BpeJettyServer.main(BpeJettyServer.java:56)\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'fhirClientConfigs' defined in dev.dsf.bpe.spring.config.FhirClientConnectionsConfig: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.fhirClientConfigs(<generated>)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.afterPropertiesSet(FhirClientConnectionsConfig.java:138)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1873)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1822)\n\t... 33 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 48 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.createDsfConfig(FhirClientConnectionsConfig.java:129)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.fhirClientConfigs(FhirClientConnectionsConfig.java:105)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.CGLIB$fhirClientConfigs$2(<generated>)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.fhirClientConfigs(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 51 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 73 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:645)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:357)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:212)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:431)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.bpe.spring.config.PropertiesConfig$$SpringCGLIB$$0.getDsfClientKeyStore(<generated>)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig.clientProvider(DsfClientConfig.java:93)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.CGLIB$clientProvider$1(<generated>)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.ja…",
+    "timestamp": 1768390920.9521272,
+    "level": 3,
+    "_logger": "org.springframework.web.context.ContextLoader",
+    "_thread": "main"
+}
+{
+    "version": "1.1",
+    "host": "bfc8c2c136fd",
+    "short_message": "Starting process http://dsf.dev/bpe/Process/helloWorld|2.0 at 2026-01-14T12:43:10+01:00 [task: https://fhir/fhir/Task/c8e6bcd1-2d1f-4e83-9ebe-fe9e47001771, requester: webbrowser.test.user@invalid, business-key: ee2b9d8b-ea9b-4b0f-85f0-4ce36fda5520, message: helloWorld]",
+    "timestamp": 1768390990.5990896,
+    "level": 6,
+    "_logger": "dev.dsf.bpe.v2.listener.StartListener",
+    "_thread": "pool-2-thread-1",
+    "_dsf.plugin.api": "2",
+    "_dsf.plugin.jar": "process/dsf-process-hello-world-2.0.0.0-SNAPSHOT.jar",
+    "_dsf.plugin.name": "dsf-process-hello-world",
+    "_dsf.plugin.version": "2.0.0.0",
+    "_dsf.process": "http://dsf.dev/bpe/Process/helloWorld|2.0",
+    "_dsf.process.activityId": "StartEvent_1",
+    "_dsf.process.businessKey": "ee2b9d8b-ea9b-4b0f-85f0-4ce36fda5520",
+    "_dsf.process.definitionId": "dsfdev_helloWorld:1:28f93392-f13b-11f0-92c1-5ed660dabcfa",
+    "_dsf.process.definitionKey": "dsfdev_helloWorld",
+    "_dsf.process.instanceId": "33ac9516-f13e-11f0-b349-ca0141535fb3",
+    "_dsf.process.requester.start": "webbrowser.test.user@invalid",
+    "_dsf.process.task.start": "https://fhir/fhir/Task/c8e6bcd1-2d1f-4e83-9ebe-fe9e47001771"
+}
+{
+    "version": "1.1",
+    "host": "bfc8c2c136fd",
+    "short_message": "Hello World from organization with identifier 'webbrowser.test.user@invalid'",
+    "timestamp": 1768390990.6061802,
+    "level": 6,
+    "_logger": "dev.dsf.bpe.service.HelloWorld",
+    "_thread": "pool-2-thread-1",
+    "_dsf.plugin.api": "2",
+    "_dsf.plugin.jar": "process/dsf-process-hello-world-2.0.0.0-SNAPSHOT.jar",
+    "_dsf.plugin.name": "dsf-process-hello-world",
+    "_dsf.plugin.version": "2.0.0.0",
+    "_dsf.process": "http://dsf.dev/bpe/Process/helloWorld|2.0",
+    "_dsf.process.activityId": "helloWorldTask",
+    "_dsf.process.activityName": "Hello World",
+    "_dsf.process.businessKey": "ee2b9d8b-ea9b-4b0f-85f0-4ce36fda5520",
+    "_dsf.process.definitionId": "dsfdev_helloWorld:1:28f93392-f13b-11f0-92c1-5ed660dabcfa",
+    "_dsf.process.definitionKey": "dsfdev_helloWorld",
+    "_dsf.process.instanceId": "33ac9516-f13e-11f0-b349-ca0141535fb3",
+    "_dsf.process.requester.start": "webbrowser.test.user@invalid",
+    "_dsf.process.task.start": "https://fhir/fhir/Task/c8e6bcd1-2d1f-4e83-9ebe-fe9e47001771"
+}
+```
+
+@tab:active JSON_LOGSTASH
+
+```json :no-line-numbers
+{
+    "@version": 1,
+    "source_host": "c3d9798e2b31",
+    "message": "Artifact: dsf-bpe-server-jetty, version: 2.0.1, build: 2025-11-26T20:24:46+01:00, branch: main, commit: 77ac1d45a35fae8666d531953572ab6c51a58685",
+    "thread_name": "main",
+    "@timestamp": "2026-01-14T12:44:25.462+0100",
+    "level": "INFO",
+    "logger_name": "dev.dsf.common.buildinfo.BuildInfoReaderImpl"
+}
+{
+    "exception": {
+        "exception_class": "org.springframework.beans.factory.BeanCreationException",
+        "exception_message": "Error creating bean with name 'fhirClientConnectionsConfig' defined in URL [jar:file:/opt/bpe/lib/dsf-bpe-server-2.0.1.jar!/dev/dsf/bpe/spring/config/FhirClientConnectionsConfig.class]: Error creating bean with name 'fhirClientConfigs' defined in dev.dsf.bpe.spring.config.FhirClientConnectionsConfig: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher",
+        "stacktrace": "org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'fhirClientConnectionsConfig' defined in URL [jar:file:/opt/bpe/lib/dsf-bpe-server-2.0.1.jar!/dev/dsf/bpe/spring/config/FhirClientConnectionsConfig.class]: Error creating bean with name 'fhirClientConfigs' defined in dev.dsf.bpe.spring.config.FhirClientConnectionsConfig: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1826)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:607)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.instantiateSingleton(DefaultListableBeanFactory.java:1228)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingleton(DefaultListableBeanFactory.java:1194)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:1130)\n\tat org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:990)\n\tat org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:627)\n\tat org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:394)\n\tat org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:274)\n\tat org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:126)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.callContextInitialized(ServletContextHandler.java:1614)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.contextInitialized(ServletContextHandler.java:501)\n\tat org.eclipse.jetty.ee10.servlet.ServletHandler.initialize(ServletHandler.java:675)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.startContext(ServletContextHandler.java:1348)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startWebapp(WebAppContext.java:1429)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startContext(WebAppContext.java:1387)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.lambda$doStart$0(ServletContextHandler.java:1066)\n\tat org.eclipse.jetty.server.handler.ContextHandler$ScopedContext.call(ContextHandler.java:1636)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.doStart(ServletContextHandler.java:1063)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.doStart(WebAppContext.java:520)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:170)\n\tat org.eclipse.jetty.server.Server.start(Server.java:689)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:121)\n\tat org.eclipse.jetty.server.Handler$Abstract.doStart(Handler.java:545)\n\tat org.eclipse.jetty.server.Server.doStart(Server.java:630)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat dev.dsf.common.jetty.JettyServer.start(JettyServer.java:374)\n\tat dev.dsf.bpe.BpeJettyServer.main(BpeJettyServer.java:56)\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'fhirClientConfigs' defined in dev.dsf.bpe.spring.config.FhirClientConnectionsConfig: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.fhirClientConfigs(<generated>)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.afterPropertiesSet(FhirClientConnectionsConfig.java:138)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1873)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1822)\n\t... 33 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.bpe.api.config.FhirClientConfigs]: Circular reference involving containing bean 'fhirClientConnectionsConfig' - consider declaring the factory method as static for independence from its containing instance. Factory method 'fhirClientConfigs' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 48 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'clientProvider' defined in dev.dsf.bpe.spring.config.DsfClientConfig: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.createDsfConfig(FhirClientConnectionsConfig.java:129)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig.fhirClientConfigs(FhirClientConnectionsConfig.java:105)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.CGLIB$fhirClientConfigs$2(<generated>)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.bpe.spring.config.FhirClientConnectionsConfig$$SpringCGLIB$$0.fhirClientConfigs(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 51 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.bpe.client.dsf.ClientProvider]: Factory method 'clientProvider' threw exception with message: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 73 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'getDsfClientKeyStore' defined in dev.dsf.bpe.spring.config.PropertiesConfig: Failed to instantiate [java.security.KeyStore]: Factory method 'getDsfClientKeyStore' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:645)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:357)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:212)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:431)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.bpe.spring.config.PropertiesConfig$$SpringCGLIB$$0.getDsfClientKeyStore(<generated>)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig.clientProvider(DsfClientConfig.java:93)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.CGLIB$clientProvider$1(<generated>)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.bpe.spring.config.DsfClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.ja…"
+    },
+    "@version": 1,
+    "source_host": "ff514e221e2f",
+    "message": "Context initialization failed",
+    "thread_name": "main",
+    "@timestamp": "2026-01-14T12:44:55.089+0100",
+    "level": "ERROR",
+    "logger_name": "org.springframework.web.context.ContextLoader"
+}
+{
+    "mdc": {
+        "dsf.plugin.api": "2",
+        "dsf.plugin.jar": "process/dsf-process-hello-world-2.0.0.0-SNAPSHOT.jar",
+        "dsf.plugin.name": "dsf-process-hello-world",
+        "dsf.plugin.version": "2.0.0.0",
+        "dsf.process": "http://dsf.dev/bpe/Process/helloWorld|2.0",
+        "dsf.process.activityId": "StartEvent_1",
+        "dsf.process.businessKey": "03976b9d-8390-4891-968e-606092e49a9f",
+        "dsf.process.definitionId": "dsfdev_helloWorld:1:28f93392-f13b-11f0-92c1-5ed660dabcfa",
+        "dsf.process.definitionKey": "dsfdev_helloWorld",
+        "dsf.process.instanceId": "94b6ce54-f13e-11f0-8382-f2c6c2fdda86",
+        "dsf.process.requester.start": "webbrowser.test.user@invalid",
+        "dsf.process.task.start": "https://fhir/fhir/Task/92b09db8-ffc5-4d32-982a-0212a69fb6e4"
+    },
+    "@version": 1,
+    "source_host": "45bbbf8076b6",
+    "message": "Starting process http://dsf.dev/bpe/Process/helloWorld|2.0 at 2026-01-14T12:45:53+01:00 [task: https://fhir/fhir/Task/92b09db8-ffc5-4d32-982a-0212a69fb6e4, requester: webbrowser.test.user@invalid, business-key: 03976b9d-8390-4891-968e-606092e49a9f, message: helloWorld]",
+    "thread_name": "pool-2-thread-1",
+    "@timestamp": "2026-01-14T12:45:53.399+0100",
+    "level": "INFO",
+    "logger_name": "dev.dsf.bpe.v2.listener.StartListener"
+}
+{
+    "mdc": {
+        "dsf.plugin.api": "2",
+        "dsf.plugin.jar": "process/dsf-process-hello-world-2.0.0.0-SNAPSHOT.jar",
+        "dsf.plugin.name": "dsf-process-hello-world",
+        "dsf.plugin.version": "2.0.0.0",
+        "dsf.process": "http://dsf.dev/bpe/Process/helloWorld|2.0",
+        "dsf.process.activityId": "helloWorldTask",
+        "dsf.process.activityName": "Hello World",
+        "dsf.process.businessKey": "03976b9d-8390-4891-968e-606092e49a9f",
+        "dsf.process.definitionId": "dsfdev_helloWorld:1:28f93392-f13b-11f0-92c1-5ed660dabcfa",
+        "dsf.process.definitionKey": "dsfdev_helloWorld",
+        "dsf.process.instanceId": "94b6ce54-f13e-11f0-8382-f2c6c2fdda86",
+        "dsf.process.requester.start": "webbrowser.test.user@invalid",
+        "dsf.process.task.start": "https://fhir/fhir/Task/92b09db8-ffc5-4d32-982a-0212a69fb6e4"
+    },
+    "@version": 1,
+    "source_host": "45bbbf8076b6",
+    "message": "Hello World from organization with identifier 'webbrowser.test.user@invalid'",
+    "thread_name": "pool-2-thread-1",
+    "@timestamp": "2026-01-14T12:45:53.406+0100",
+    "level": "INFO",
+    "logger_name": "dev.dsf.bpe.service.HelloWorld"
+}
+```
+
+:::
+
+### Data Logger
+The file, *stdout* and *stderr* outputs for the **Data Logger** can be enabled or disabled using the environment variables [`DEV_DSF_LOG_DATA_FILE_ENABLED`](./configuration.md#dev-dsf-log-data-file-enabled), [`DEV_DSF_LOG_DATA_CONSOLE_OUT_ENABLED`](./configuration.md#dev-dsf-log-data-console-out-enabled) and [`DEV_DSF_LOG_DATA_CONSOLE_ERR_ENABLED`](./configuration.md#dev-dsf-log-data-console-err-enabled).
+
+All data messages are logged with the same severity level (DEBUG). Data messages are not included in the Standard Application Logger output. API v2 Process Plugins can use the data logger via the `dev.dsf.bpe.v2.service.DataLogger` interface to produce messages.
+
+#### Output Style
+Multiple styles are supported for the **Data Logger** file, *stdout* and *stderr* outputs. All structured logging JSON styles include additional infos (Mapped Diagnostic Context) about the executing process plugin and process instance. The output style can be configured using the environment variables [`DEV_DSF_LOG_DATA_FILE_STYLE`](./configuration.md#dev-dsf-log-data-file-style), [`DEV_DSF_LOG_DATA_CONSOLE_OUT_STYLE`](./configuration.md#dev-dsf-log-data-console-out-style) and [`DEV_DSF_LOG_DATA_CONSOLE_ERR_STYLE`](./configuration.md#dev-dsf-log-data-console-err-style).
+* **TEXT** a minimal text format.
+* **TEXT_MDC** text format with additional infos (Mapped Diagnostic Context) about the requesting user.
+* **JSON_ECS** follows the Elastic Common Schema (ECS) reference.
+* **JSON_GCP** uses the Google Cloud Platform structured logging model with additional `_thread`, `_logger` and `_exception` fields.
+* **JSON_GELF** follows the Graylog Extended Log Format (GELF) payload specification with added `_thread` and `_logger` fields.
+* **JSON_LOGSTASH** uses the Logstash json_event pattern for log4j.
+
+::: code-tabs#shell
+
+@tab TEXT
+
+```text :no-line-numbers
+2026-01-14 13:25:20,030 Completed QuestionnaireResponse: {"resourceType":"QuestionnaireResponse","id":"e4dd7038-eef1-4b03-8249-21eb8f9f8309","meta":{"versionId":"2","lastUpdated":"2026-01-14T13:25:19.800+01:00","profile":["http://dsf.dev/fhir/StructureDefinition/questionnaire-response"]},"extension":[{"url":"http://dsf.dev/fhir/StructureDefinition/extension-questionnaire-authorization","extension":[{"url":"practitioner-role","valueCoding":{"system":"http://dsf.dev/fhir/CodeSystem/practitioner-role","code":"DIC_USER"}}]}],"questionnaire":"http://dsf.dev/fhir/Questionnaire/hello-user|2.0","status":"completed","authored":"2026-01-14T12:25:19.707Z","author":{"type":"Practitioner","identifier":{"system":"http://dsf.dev/sid/practitioner-identifier","value":"webbrowser.test.user@invalid"}},"item":[{"linkId":"business-key","text":"The business-key of the process execution","answer":[{"valueString":"a8e436f4-d86d-4f24-a794-236d62645ab8"}]},{"linkId":"user-task-id","text":"The user-task-id of the process execution","answer":[{"valueString":"ec4da6fd-f143-11f0-80e8-9ae86e84a87b"}]},{"linkId":"display-example","text":"Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet."},{"linkId":"string-example","text":"Add a string to test the string type","answer":[{"valueString":"Placeholder.."}]},{"linkId":"text-example","text":"Add a text to test the text type","answer":[{"valueString":"Placeholder.."}]}]}
+```
+
+@tab TEXT_MDC
+
+```text :no-line-numbers
+2026-01-14 13:26:21,587 {dsf.plugin.api=2, dsf.plugin.jar=process/dsf-process-hello-world-2.0.0.0-SNAPSHOT.jar, dsf.plugin.name=dsf-process-hello-world, dsf.plugin.version=2.0.0.0, dsf.process=http://dsf.dev/bpe/Process/helloUser|2.0, dsf.process.activityId=logUserTaskRespose, dsf.process.activityName=log user task respose, dsf.process.businessKey=bbc5b6d5-7c64-4181-b0c6-82f656883229, dsf.process.definitionId=dsfdev_helloUser:1:28feb1d6-f13b-11f0-92c1-5ed660dabcfa, dsf.process.definitionKey=dsfdev_helloUser, dsf.process.instanceId=35e4749a-f144-11f0-b0d1-bab98b35e98d, dsf.process.requester.start=webbrowser.test.user@invalid, dsf.process.task.start=https://fhir/fhir/Task/eb91b3c1-b635-4ab7-8ba6-00328584b495} Completed QuestionnaireResponse: {"resourceType":"QuestionnaireResponse","id":"38cae383-828b-4acb-b427-c3c3cff23718","meta":{"versionId":"2","lastUpdated":"2026-01-14T13:26:21.436+01:00","profile":["http://dsf.dev/fhir/StructureDefinition/questionnaire-response"]},"extension":[{"url":"http://dsf.dev/fhir/StructureDefinition/extension-questionnaire-authorization","extension":[{"url":"practitioner-role","valueCoding":{"system":"http://dsf.dev/fhir/CodeSystem/practitioner-role","code":"DIC_USER"}}]}],"questionnaire":"http://dsf.dev/fhir/Questionnaire/hello-user|2.0","status":"completed","authored":"2026-01-14T12:26:21.328Z","author":{"type":"Practitioner","identifier":{"system":"http://dsf.dev/sid/practitioner-identifier","value":"webbrowser.test.user@invalid"}},"item":[{"linkId":"business-key","text":"The business-key of the process execution","answer":[{"valueString":"bbc5b6d5-7c64-4181-b0c6-82f656883229"}]},{"linkId":"user-task-id","text":"The user-task-id of the process execution","answer":[{"valueString":"35ec8af3-f144-11f0-b0d1-bab98b35e98d"}]},{"linkId":"display-example","text":"Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet."},{"linkId":"string-example","text":"Add a string to test the string type","answer":[{"valueString":"Placeholder.."}]},{"linkId":"text-example","text":"Add a text to test the text type","answer":[{"valueString":"Placeholder.."}]}]}
+```
+
+@tab JSON_ECS
+
+```json :no-line-numbers
+{
+    "@timestamp": "2026-01-14T12:34:21.464Z",
+    "ecs.version": "1.2.0",
+    "log.level": "DEBUG",
+    "message": "Completed QuestionnaireResponse: {\"resourceType\":\"QuestionnaireResponse\",\"id\":\"043a9d98-11b5-4445-accd-efb88441814b\",\"meta\":{\"versionId\":\"2\",\"lastUpdated\":\"2026-01-14T13:34:21.314+01:00\",\"profile\":[\"http://dsf.dev/fhir/StructureDefinition/questionnaire-response\"]},\"extension\":[{\"url\":\"http://dsf.dev/fhir/StructureDefinition/extension-questionnaire-authorization\",\"extension\":[{\"url\":\"practitioner-role\",\"valueCoding\":{\"system\":\"http://dsf.dev/fhir/CodeSystem/practitioner-role\",\"code\":\"DIC_USER\"}}]}],\"questionnaire\":\"http://dsf.dev/fhir/Questionnaire/hello-user|2.0\",\"status\":\"completed\",\"authored\":\"2026-01-14T12:34:21.220Z\",\"author\":{\"type\":\"Practitioner\",\"identifier\":{\"system\":\"http://dsf.dev/sid/practitioner-identifier\",\"value\":\"webbrowser.test.user@invalid\"}},\"item\":[{\"linkId\":\"business-key\",\"text\":\"The business-key of the process execution\",\"answer\":[{\"valueString\":\"9f871bb0-ead8-4172-8ebf-b6614b90c33c\"}]},{\"linkId\":\"user-task-id\",\"text\":\"The user-task-id of the process execution\",\"answer\":[{\"valueString\":\"55ea6fce-f145-11f0-a290-be1b81df4ab5\"}]},{\"linkId\":\"display-example\",\"text\":\"Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.\"},{\"linkId\":\"string-example\",\"text\":\"Add a string to test the string type\",\"answer\":[{\"valueString\":\"Placeholder..\"}]},{\"linkId\":\"text-example\",\"text\":\"Add a text to test the text type\",\"answer\":[{\"valueString\":\"Placeholder..\"}]}]}",
+    "process.thread.name": "pool-3-thread-1",
+    "log.logger": "dsf-data-logger",
+    "dsf.plugin.api": "2",
+    "dsf.plugin.jar": "process/dsf-process-hello-world-2.0.0.0-SNAPSHOT.jar",
+    "dsf.plugin.name": "dsf-process-hello-world",
+    "dsf.plugin.version": "2.0.0.0",
+    "dsf.process": "http://dsf.dev/bpe/Process/helloUser|2.0",
+    "dsf.process.activityId": "logUserTaskRespose",
+    "dsf.process.activityName": "log user task respose",
+    "dsf.process.businessKey": "9f871bb0-ead8-4172-8ebf-b6614b90c33c",
+    "dsf.process.definitionId": "dsfdev_helloUser:1:57f9bd33-f144-11f0-a290-be1b81df4ab5",
+    "dsf.process.definitionKey": "dsfdev_helloUser",
+    "dsf.process.instanceId": "55e602f5-f145-11f0-a290-be1b81df4ab5",
+    "dsf.process.requester.start": "webbrowser.test.user@invalid",
+    "dsf.process.task.start": "https://fhir/fhir/Task/776fb9fa-67cb-490c-929b-c9a010c3639e"
+}
+```
+
+@tab JSON_GCP
+
+```json :no-line-numbers
+{
+    "timestampSeconds": 1768394122,
+    "timestampNanos": 561090136,
+    "severity": "DEBUG",
+    "message": "Completed QuestionnaireResponse: {\"resourceType\":\"QuestionnaireResponse\",\"id\":\"5bb1f439-93f9-4d73-9574-2d710a64d0fb\",\"meta\":{\"versionId\":\"2\",\"lastUpdated\":\"2026-01-14T13:35:22.381+01:00\",\"profile\":[\"http://dsf.dev/fhir/StructureDefinition/questionnaire-response\"]},\"extension\":[{\"url\":\"http://dsf.dev/fhir/StructureDefinition/extension-questionnaire-authorization\",\"extension\":[{\"url\":\"practitioner-role\",\"valueCoding\":{\"system\":\"http://dsf.dev/fhir/CodeSystem/practitioner-role\",\"code\":\"DIC_USER\"}}]}],\"questionnaire\":\"http://dsf.dev/fhir/Questionnaire/hello-user|2.0\",\"status\":\"completed\",\"authored\":\"2026-01-14T12:35:22.286Z\",\"author\":{\"type\":\"Practitioner\",\"identifier\":{\"system\":\"http://dsf.dev/sid/practitioner-identifier\",\"value\":\"webbrowser.test.user@invalid\"}},\"item\":[{\"linkId\":\"business-key\",\"text\":\"The business-key of the process execution\",\"answer\":[{\"valueString\":\"23f23222-810f-40d2-b228-63dc65efedbf\"}]},{\"linkId\":\"user-task-id\",\"text\":\"The user-task-id of the process execution\",\"answer\":[{\"valueString\":\"79ccfcd6-f145-11f0-b859-02f958cc3f48\"}]},{\"linkId\":\"display-example\",\"text\":\"Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.\"},{\"linkId\":\"string-example\",\"text\":\"Add a string to test the string type\",\"answer\":[{\"valueString\":\"Placeholder..\"}]},{\"linkId\":\"text-example\",\"text\":\"Add a text to test the text type\",\"answer\":[{\"valueString\":\"Placeholder..\"}]}]}",
+    "logging.googleapis.com/labels": {
+        "dsf.plugin.api": "2",
+        "dsf.plugin.jar": "process/dsf-process-hello-world-2.0.0.0-SNAPSHOT.jar",
+        "dsf.plugin.name": "dsf-process-hello-world",
+        "dsf.plugin.version": "2.0.0.0",
+        "dsf.process": "http://dsf.dev/bpe/Process/helloUser|2.0",
+        "dsf.process.activityId": "logUserTaskRespose",
+        "dsf.process.activityName": "log user task respose",
+        "dsf.process.businessKey": "23f23222-810f-40d2-b228-63dc65efedbf",
+        "dsf.process.definitionId": "dsfdev_helloUser:1:57f9bd33-f144-11f0-a290-be1b81df4ab5",
+        "dsf.process.definitionKey": "dsfdev_helloUser",
+        "dsf.process.instanceId": "79c6bb3d-f145-11f0-b859-02f958cc3f48",
+        "dsf.process.requester.start": "webbrowser.test.user@invalid",
+        "dsf.process.task.start": "https://fhir/fhir/Task/8f86cc34-feec-4c27-bb0f-ca3c42ed8c7c"
+    },
+    "logging.googleapis.com/sourceLocation": {
+        "function": "dev.dsf.bpe.v2.service.DataLoggerImpl.log"
+    },
+    "logging.googleapis.com/trace_sampled": true,
+    "thread": "pool-3-thread-1",
+    "logger": "dsf-data-logger"
+}
+```
+
+@tab JSON_GELF
+
+```json :no-line-numbers
+{
+    "version": "1.1",
+    "host": "186cf01dc749",
+    "short_message": "Completed QuestionnaireResponse: {\"resourceType\":\"QuestionnaireResponse\",\"id\":\"74c53749-9179-4b64-867e-87ffb1c2571c\",\"meta\":{\"versionId\":\"2\",\"lastUpdated\":\"2026-01-14T13:36:35.220+01:00\",\"profile\":[\"http://dsf.dev/fhir/StructureDefinition/questionnaire-response\"]},\"extension\":[{\"url\":\"http://dsf.dev/fhir/StructureDefinition/extension-questionnaire-authorization\",\"extension\":[{\"url\":\"practitioner-role\",\"valueCoding\":{\"system\":\"http://dsf.dev/fhir/CodeSystem/practitioner-role\",\"code\":\"DIC_USER\"}}]}],\"questionnaire\":\"http://dsf.dev/fhir/Questionnaire/hello-user|2.0\",\"status\":\"completed\",\"authored\":\"2026-01-14T12:36:35.136Z\",\"author\":{\"type\":\"Practitioner\",\"identifier\":{\"system\":\"http://dsf.dev/sid/practitioner-identifier\",\"value\":\"webbrowser.test.user@invalid\"}},\"item\":[{\"linkId\":\"business-key\",\"text\":\"The business-key of the process execution\",\"answer\":[{\"valueString\":\"22fbbf3d-a172-46fc-81a2-f65df7a2a13f\"}]},{\"linkId\":\"user-task-id\",\"text\":\"The user-task-id of the process execution\",\"answer\":[{\"valueString\":\"9b16de91-f145-11f0-b9cc-7e27fa327b95\"}]},{\"linkId\":\"display-example\",\"text\":\"Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.\"},{\"linkId\":\"string-example\",\"text\":\"Add a string to test the string type\",\"answer\":[{\"valueString\":\"Placeholder..\"}]},{\"linkId\":\"text-example\",\"text\":\"Add a text to test the text type\",\"answer\":[{\"valueString\":\"Placeholder..\"}]}]}",
+    "timestamp": 1768394195.3648491,
+    "level": 7,
+    "_logger": "dsf-data-logger",
+    "_thread": "pool-3-thread-1",
+    "_dsf.plugin.api": "2",
+    "_dsf.plugin.jar": "process/dsf-process-hello-world-2.0.0.0-SNAPSHOT.jar",
+    "_dsf.plugin.name": "dsf-process-hello-world",
+    "_dsf.plugin.version": "2.0.0.0",
+    "_dsf.process": "http://dsf.dev/bpe/Process/helloUser|2.0",
+    "_dsf.process.activityId": "logUserTaskRespose",
+    "_dsf.process.activityName": "log user task respose",
+    "_dsf.process.businessKey": "22fbbf3d-a172-46fc-81a2-f65df7a2a13f",
+    "_dsf.process.definitionId": "dsfdev_helloUser:1:57f9bd33-f144-11f0-a290-be1b81df4ab5",
+    "_dsf.process.definitionKey": "dsfdev_helloUser",
+    "_dsf.process.instanceId": "9b0ea128-f145-11f0-b9cc-7e27fa327b95",
+    "_dsf.process.requester.start": "webbrowser.test.user@invalid",
+    "_dsf.process.task.start": "https://fhir/fhir/Task/4664a61d-2be7-4bd8-a8a6-184b7bc611f7"
+}
+```
+
+@tab:active JSON_LOGSTASH
+
+```json :no-line-numbers
+{
+    "mdc": {
+        "dsf.plugin.api": "2",
+        "dsf.plugin.jar": "process/dsf-process-hello-world-2.0.0.0-SNAPSHOT.jar",
+        "dsf.plugin.name": "dsf-process-hello-world",
+        "dsf.plugin.version": "2.0.0.0",
+        "dsf.process": "http://dsf.dev/bpe/Process/helloUser|2.0",
+        "dsf.process.activityId": "logUserTaskRespose",
+        "dsf.process.activityName": "log user task respose",
+        "dsf.process.businessKey": "bd9f6814-6cb3-4ddf-8389-05b9ae9658c4",
+        "dsf.process.definitionId": "dsfdev_helloUser:1:57f9bd33-f144-11f0-a290-be1b81df4ab5",
+        "dsf.process.definitionKey": "dsfdev_helloUser",
+        "dsf.process.instanceId": "ceb018e9-f145-11f0-9e55-9efb3a5fd65d",
+        "dsf.process.requester.start": "webbrowser.test.user@invalid",
+        "dsf.process.task.start": "https://fhir/fhir/Task/d5bd4243-a87b-4445-8a34-36ddec7ac648"
+    },
+    "@version": 1,
+    "source_host": "59d5d46e125a",
+    "message": "Completed QuestionnaireResponse: {\"resourceType\":\"QuestionnaireResponse\",\"id\":\"2dfbf9d0-1c2f-44f0-9f94-4099280a6bde\",\"meta\":{\"versionId\":\"2\",\"lastUpdated\":\"2026-01-14T13:37:48.172+01:00\",\"profile\":[\"http://dsf.dev/fhir/StructureDefinition/questionnaire-response\"]},\"extension\":[{\"url\":\"http://dsf.dev/fhir/StructureDefinition/extension-questionnaire-authorization\",\"extension\":[{\"url\":\"practitioner-role\",\"valueCoding\":{\"system\":\"http://dsf.dev/fhir/CodeSystem/practitioner-role\",\"code\":\"DIC_USER\"}}]}],\"questionnaire\":\"http://dsf.dev/fhir/Questionnaire/hello-user|2.0\",\"status\":\"completed\",\"authored\":\"2026-01-14T12:37:48.078Z\",\"author\":{\"type\":\"Practitioner\",\"identifier\":{\"system\":\"http://dsf.dev/sid/practitioner-identifier\",\"value\":\"webbrowser.test.user@invalid\"}},\"item\":[{\"linkId\":\"business-key\",\"text\":\"The business-key of the process execution\",\"answer\":[{\"valueString\":\"bd9f6814-6cb3-4ddf-8389-05b9ae9658c4\"}]},{\"linkId\":\"user-task-id\",\"text\":\"The user-task-id of the process execution\",\"answer\":[{\"valueString\":\"ceb76bf2-f145-11f0-9e55-9efb3a5fd65d\"}]},{\"linkId\":\"display-example\",\"text\":\"Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.\"},{\"linkId\":\"string-example\",\"text\":\"Add a string to test the string type\",\"answer\":[{\"valueString\":\"Placeholder..\"}]},{\"linkId\":\"text-example\",\"text\":\"Add a text to test the text type\",\"answer\":[{\"valueString\":\"Placeholder..\"}]}]}",
+    "thread_name": "pool-3-thread-1",
+    "@timestamp": "2026-01-14T13:37:48.325+0100",
+    "level": "DEBUG",
+    "logger_name": "dsf-data-logger"
+}
+```
+
+:::
+
+### Custom Logging Config
+A fully custom log4j2 xml logging config can be set via the environment variable [`DEV_DSF_LOG_CONFIG`](./configuration.md#dev-dsf-log-config).
diff --git a/docs/src/operations/v2.0.2/bpe/oidc.md b/docs/src/operations/v2.0.2/bpe/oidc.md
new file mode 100644
index 000000000..b0c6a6458
--- /dev/null
+++ b/docs/src/operations/v2.0.2/bpe/oidc.md
@@ -0,0 +1,56 @@
+---
+title: OpenID Connect
+icon: config
+---
+
+## Overview
+Access to the DSF BPE server user interface can be configured via [access control roles](access-control). By default users are only authenticated using X.509 client certificates, but authentication for local users via OAuth 2.0 OpenID Connect can also be enabled.
+
+The DSF BPE server supports [Authorization Code Flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth) for the user interface. [Back-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html) is also supported.
+
+
+::: tip BPE Reverse Proxy
+The DSF BPE reverse proxy requires client certificates by default. To use OpenID Connect authentication the configuration parameter [SSL_VERIFY_CLIENT](../bpe-reverse-proxy/configuration.html#ssl-verify-client) needs to be set to `optional`.
+:::
+
+
+## Authorization Code Flow
+
+To enable authentication via OpenID Connect authorization code flow, set the configuration parameter [DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW](configuration#dev-dsf-server-auth-oidc-authorization-code-flow) to `true` and specify the following parameters:
+
+- [DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL](configuration#dev-dsf-server-auth-oidc-provider-realm-base-url)
+- [DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID](configuration#dev-dsf-server-auth-oidc-client-id)
+- [DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET](configuration#dev-dsf-server-auth-oidc-client-secret)
+
+Optionally, back channel logout can be enabled by setting [DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT](configuration#dev-dsf-server-auth-oidc-back-channel-logout) to `true`. The DSF BPE server accepts logout tokens at [DEV_DSF_BPE_SERVER_BASE_URL](configuration#dev-dsf-bpe-server-base-url) + `/back-channel-logout`. The path can be modified via [DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT_PATH](configuration#dev-dsf-server-auth-oidc-back-channel-logout-path).
+
+## Additional ODIC Configuration Parameter
+
+A number of additional `DEV_DSF_SERVER_AUTH_OIDC ...` configuration parameter are specify on the DSF BPE server [configuration parameter page](configuration).
+
+For example the configuration parameter [DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS](configuration#dev-dsf-server-auth-oidc-provider-client-trust-server-certificate-cas) can be used to specify a PEM encoded file with trusted root certificates to be used when accessing the OpenID Connect provider. If not specify the JVM default trusted root certificates are used for this connection.
+
+
+## Example
+```yaml
+services:
+  app:
+    image: ghcr.io/datasharingframework/bpe:1.5.2
+    # ...
+    secrets:
+      - keycloak_root_ca.pem
+      # ...
+    environment:
+      # ...
+      DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW: 'true'
+      DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT: 'true'
+      DEV_DSF_SERVER_AUTH_OIDC_BEARER_TOKEN: 'true'
+      DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL: https://keycloak.test.org/realms/dsf
+      DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS: /run/secrets/keycloak_root_ca.pem
+      DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID: dsf-bpe
+      DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET: n9bCMtjugv3Y_.szktXyQ2RH5se+J%o3
+    # ...
+secrets:
+  keycloak_root_ca.pem:
+    file: ./secrets/keycloak_root_ca.pem
+```
\ No newline at end of file
diff --git a/docs/src/operations/v2.0.2/fhir-reverse-proxy/README.md b/docs/src/operations/v2.0.2/fhir-reverse-proxy/README.md
new file mode 100644
index 000000000..d88afe12a
--- /dev/null
+++ b/docs/src/operations/v2.0.2/fhir-reverse-proxy/README.md
@@ -0,0 +1,6 @@
+---
+title: FHIR Reverse Proxy
+icon: module
+---
+## Overview
+- [Configuration Parameters](configuration)
diff --git a/docs/src/operations/v2.0.2/fhir-reverse-proxy/configuration.md b/docs/src/operations/v2.0.2/fhir-reverse-proxy/configuration.md
new file mode 100644
index 000000000..5c7a1cb30
--- /dev/null
+++ b/docs/src/operations/v2.0.2/fhir-reverse-proxy/configuration.md
@@ -0,0 +1,116 @@
+---
+title: Configuration Parameters
+icon: config
+---
+
+### APP_SERVER_IP
+- **Required:** Yes
+- **Description:** Hostname or IP-Address of the DSF FHIR server application container, the reverse proxy target
+- **Example:** `app`, `172.28.1.3`
+
+
+### HTTPS_SERVER_NAME_PORT
+- **Required:** Yes
+- **Description:** External FQDN of your DSF FHIR server with port, typically `443`
+- **Example:** `my-external.fqdn:443`
+
+
+### PROXY_PASS_CONNECTION_TIMEOUT_HTTP
+- **Required:** No
+- **Description:** Connection timeout (seconds) for reverse proxy to app server http connection, time the proxy waits for a connection to be established
+- **Default:** `30` seconds
+
+
+### PROXY_PASS_CONNECTION_TIMEOUT_WS
+- **Required:** No
+- **Description:** Connection timeout (seconds) for reverse proxy to app server ws connection, time the proxy waits for a connection to be established
+- **Default:** `30` seconds
+
+
+### PROXY_PASS_TIMEOUT_HTTP
+- **Required:** No
+- **Description:** Timeout (seconds) for reverse proxy to app server http connection, time the proxy waits for a reply
+- **Default:** `60` seconds
+
+
+### PROXY_PASS_TIMEOUT_WS
+- **Required:** No
+- **Description:** Timeout (seconds) for reverse proxy to app server ws connection, time the proxy waits for a reply
+- **Default:** `60` seconds
+
+
+### SERVER_CONTEXT_PATH
+- **Required:** No
+- **Description:** Reverse proxy context path that delegates to the app server, `/` character at start, no `/` character at end, use `''` (empty string) to configure root as context path
+- **Default:** `/fhir`
+
+
+### SSL_CA_CERTIFICATE_FILE
+- **Required:** No
+- **Description:** Certificate chain file including all issuing, intermediate and root certificates used to validate client certificates, PEM encoded, sets the apache httpd parameter `SSLCACertificateFile`; not used by default, overrides *SSL_CA_CERTIFICATE_PATH* if not empty
+
+
+### SSL_CA_CERTIFICATE_PATH
+- **Required:** No
+- **Description:** Folder with trusted full CA chains for validating client certificates
+- **Recommendation:** Override default folder content via bind mount or add *.crt files to default folder via bind mount
+- **Default:** `ca/client_ca_chains`
+
+
+### SSL_CA_DN_REQUEST_FILE
+- **Required:** No
+- **Description:** File containing all signing certificates excepted, will be used to specify the `Acceptable client certificate CA names` send to the client, during TLS handshake, sets the apache httpd parameter `SSLCADNRequestFile`; if omitted all entries from *SSL_CA_CERTIFICATE_FILE* are used; not used by default, overrides *SSL_CA_DN_REQUEST_PATH* if not empty
+
+
+### SSL_CA_DN_REQUEST_PATH
+- **Required:** No
+- **Description:**  Folder with trusted client certificate issuing CAs, modifies the "Acceptable client certificate CA names" send to the client, uses all from *SSL_CA_CERTIFICATE_FILE* or *SSL_CA_CERTIFICATE_PATH* if not set or empty
+- **Recommendation:** Override default folder content via bind mount or add *.crt files to default folder via bind mount
+- **Default:** `ca/client_issuing_cas`
+
+
+### SSL_CERTIFICATE_CHAIN_FILE
+- **Required:** No
+- **Description:** Certificate chain file, PEM encoded, must contain all certificates between the server certificate and the root ca certificate (excluding the root ca certificate), sets the apache httpd parameter `SSLCertificateChainFile`; can be omitted if either no chain is needed (self signed server certificate) or the file specified via *SSL_CERTIFICATE_FILE* contains the certificate chain
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/ssl_certificate_chain_file.pem`
+
+
+### SSL_CERTIFICATE_CHAIN_FILE
+- **Required:** No
+- **Description:** Certificate chain file, PEM encoded, must contain all certificates between the server certificate and the root ca certificate (excluding the root ca certificate), sets the apache httpd parameter `SSLCertificateChainFile`; can be omitted if either no chain is needed (self signed server certificate) or the file specified via *SSL_CERTIFICATE_FILE* contains the certificate chain
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/ssl_certificate_chain_file.pem`
+
+
+### SSL_CERTIFICATE_FILE
+- **Required:** Yes
+- **Description:** Server certificate file, PEM encoded, sets the apache httpd parameter `SSLCertificateFile`, may contain all certificates between the server certificate and the root ca certificate (excluding the root ca certificate). Omit *SSL_CERTIFICATE_CHAIN_FILE* if chain included
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/ssl_certificate_file.pem`
+
+
+### SSL_CERTIFICATE_KEY_FILE
+- **Required:** Yes
+- **Description:** Server certificate private key file, PEM encoded, unencrypted, sets the apache httpd parameter `SSLCertificateKeyFile`
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/ssl_certificate_key_file.pem`
+
+
+### SSL_EXPECTED_CLIENT_S_DN_C_VALUES
+- **Required:** No
+- **Description:** Expected client certificate subject DN country `C` values, must be a comma-separated list of strings in single quotation marks, e.g. `'DE', 'FR'`. If a client certificate with a not configured subject country `C` value is used, the server answers with a `403 Forbidden` status code
+- **Default:** `'DE'`
+
+
+### SSL_EXPECTED_CLIENT_I_DN_CN_VALUES
+- **Required:** No
+- **Description:** Expected client certificate issuer DN common-name `CN` values, must be a comma-separated list of strings in single quotation marks. If a client certificate from a not configured issuing ca common-name is used, the server answers with a `403 Forbidden` status code
+- **Default:** `'GEANT TLS ECC 1', 'HARICA OV TLS ECC', 'GEANT TLS RSA 1', 'HARICA OV TLS RSA', 'GEANT S/MIME ECC 1', 'HARICA Client Authentication ECC', 'HARICA S/MIME ECC', 'GEANT S/MIME RSA 1', 'HARICA Client Authentication RSA', 'HARICA S/MIME RSA', 'DFN-Verein Global Issuing CA', 'Fraunhofer User CA - G02', 'D-TRUST SSL Class 3 CA 1 2009', 'Sectigo RSA Organization Validation Secure Server CA', 'GEANT OV RSA CA 4', 'GEANT Personal CA 4', 'GEANT eScience Personal CA 4', 'Sectigo ECC Organization Validation Secure Server CA', 'GEANT OV ECC CA 4', 'GEANT Personal ECC CA 4', 'GEANT eScience Personal ECC CA 4', 'D-TRUST Limited Basic CA 1-2 2019', 'D-TRUST Limited Basic CA 1-3 2019'`
+
+
+### SSL_VERIFY_CLIENT
+- **Required:** No
+- **Description:** Modifies the apache mod_ssl config parameter `SSLVerifyClient`
+- **Recommendation:** Set to `optional` when using OIDC authentication
+- **Default:** `require`
\ No newline at end of file
diff --git a/docs/src/operations/v2.0.2/fhir/README.md b/docs/src/operations/v2.0.2/fhir/README.md
new file mode 100644
index 000000000..8c2f253e5
--- /dev/null
+++ b/docs/src/operations/v2.0.2/fhir/README.md
@@ -0,0 +1,9 @@
+---
+title: FHIR Server
+icon: module
+---
+## Overview
+- [Configuration Parameters](configuration)
+- [Access Control](access-control)
+- [OpenID Connect](oidc)
+- [Logging](logging)
\ No newline at end of file
diff --git a/docs/src/operations/v2.0.2/fhir/access-control.md b/docs/src/operations/v2.0.2/fhir/access-control.md
new file mode 100644
index 000000000..3447e3dc6
--- /dev/null
+++ b/docs/src/operations/v2.0.2/fhir/access-control.md
@@ -0,0 +1,146 @@
+---
+title: Access Control
+icon: config
+---
+
+## Overview
+
+The DSF FHIR server implements a subset of the FHIR R4 [REST API](http://hl7.org/fhir/R4/http.html). When accessing the API with a web browser a limited graphical user interface is shown. Without any additional configuration the API and user interface is only accessible with the X.509 client certificate configured for the organization via the client certificate configuration parameter  [DEV_DSF_FHIR_CLIENT_CERTIFICATE](configuration##dev-dsf-fhir-client-certificate) or the manual override option [DEV_DSF_FHIR_SERVER_ORGANIZATION_THUMBPRINT](configuration#dev-dsf-fhir-server-organization-thumbprint).
+
+::: tip OpenID Connect
+To enable OpenID Connect authentication of local user, see the DSF FHIR server OpenID Connect [configuration page](oidc).
+:::
+
+Access to the API and user interface can be enabled for additional client certificates and local users authenticating via OAuth 2.0 OpenID Connect. Access can be configured for so called roles, with all roles specified using the configuration parameter [DEV_DSF_FHIR_SERVER_ROLECONFIG](configuration#dev-dsf-fhir-server-roleconfig). The value for this environment variable is specified as YAML using the block scalar `|`.
+
+The listing below shows a minimal configuration to enable read access for all resources for a specific client-certificate:
+
+```yaml
+      DEV_DSF_FHIR_SERVER_ROLECONFIG: |
+        - example_read_only_role:
+            thumbprint: 00474993fa261b0225f93c5a66aa6fcc... [a-f0-9]{128}
+            dsf-role:
+              - READ
+              - SEARCH
+              - HISTORY
+```
+
+The list of user roles above contains a single rule-entry `example_read_only_role`, matching the user via a client certificate SHA-512 thumbprint and assigning three DSF roles. Any string can be used as the name for the rule-entry.
+
+With DSF 2, you can now restrict the granted priviledges to specific resource types. If you want to restrict the rule-entry `example_read_only_role` to Organization resources, you can specify the resource type per dsf-role ("action"):
+
+```yaml
+      DEV_DSF_FHIR_SERVER_ROLECONFIG: |
+        - example_read_only_organization_role:
+            thumbprint: 00474993fa261b0225f93c5a66aa6fcc... [a-f0-9]{128}
+            dsf-role:
+              - READ: [Organization]
+              - SEARCH: [Organization]
+              - HISTORY: [Organization]
+```
+
+::: tip Certificate Thumbprints
+SHA-512 certificate thumbprints in HEX form `[a-f0-9]{128}` can be calculated using:
+```sh
+certtool --fingerprint --hash=sha512 --infile=certificate.pem
+```
+:::
+
+Multiple user roles can be specified and all matching roles will be applied to an authenticated users. Use an empty string `""` or a single block scalar `|` character as the value for the configuration parameter [DEV_DSF_FHIR_SERVER_ROLECONFIG](configuration#dev-dsf-fhir-server-roleconfig) if no roles should be configured.
+
+## Matching Users
+
+To apply roles, users can be matched via the `thumbprint`, `email`, `token-role` or `token-group` properties. A single value or a list of values can be specified.
+
+#### thumbprint
+
+The property `thumbprint` can used to specify one or multiple SHA-512 certificate thumbprints. Roles from this rule are applied to the authenticating user if the certificate matches one of the specified thumbprints.
+
+#### email
+
+Using the property `email` users can be matched against e-mail addresses specified in X.509 client certificates and in OpenID Connect access tokens. Values will be matched against e-mail addresses specified in the subject DN (via PKCS#9 extension 1.2.840.113549.1.9.1) and RFC-822 Name entries of the Subject Alternative Name field. If the user authenticates via OpenID Connect, the `email` [claim](https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) from the access token will be matched against the property values.
+
+#### token-role and token-group
+
+With the properties `token-role` and `token-group` role and group names can be specified to match against role and group claims within OAuth 2.0 access tokens.
+
+
+## DSF and Practitioner Roles
+
+Two types of roles can be applied to matched users. 
+
+#### dsf-role
+
+DSF roles specified via the `dsf-role` property define general access to the REST API and user interface. Allowed values are:
+
+`CREATE`, `READ`, `UPDATE`, `DELETE`, `SEARCH`, `HISTORY`, `PERMANENT_DELETE` and `WEBSOCKET`.
+
+
+#### practitioner-role
+
+In order to allow users to start processes, the property `practitioner-role` can be used to assign codes from FHIR [CodeSystem](http://hl7.org/fhir/R4/codesystem.html) resources. Codes are specified in the form `system-url|code`.
+If the uses has a code specified here that match with a `requester` extension within the process plugin's [ActivityDefinition](http://hl7.org/fhir/R4/activitydefinition.html) resource, the user can start the process if he also has the `dsf-role` `CREATE`.
+
+Process plugins can define and use their own code-systems. However, the DSF specifies a standard set of practitioner roles within the CodeSystem `http://dsf.dev/fhir/CodeSystem/practitioner-role`:
+
+`UAC_USER`, `COS_USER`, `CRR_USER`, `DIC_USER`, `DMS_USER`, `DTS_USER`, `HRP_USER`, `TTP_USER`, `AMS_USER`, `ASP_USER`, `SPR_USER`, `TSP_USER`, `PPH_USER`, `BIO_USER`, and `DSF_ADMIN`.
+
+
+## Examples
+
+The first example defines a group of DSF administrators. Two client certificates match against this role:
+
+```yaml
+      DEV_DSF_FHIR_SERVER_ROLECONFIG: |
+        - certificate-admins:
+            thumbprint: 
+              - afb68b1d9d47e691b8b3d50fd9848467cada8b1c76f5f4b45f00c9f8432d505361a3ee27805f4aa06799d9ac8dace94b3f1942fce44d84866961259b13be825d
+              - 2441bfddcad97eeb83c8c31fe181b90652787b8b59bf4e569219da7db4429e389479cb7c4a2f311e34217357d594ecad7d58ccfeef2a9e93c6fcf8d98897d88c
+            dsf-role:
+              - CREATE
+              - READ
+              - UPDATE
+              - DELETE
+              - SEARCH
+              - HISTORY
+            practitioner-role:
+              - http://dsf.dev/fhir/CodeSystem/practitioner-role|DSF_ADMIN
+
+```
+
+
+The second example defines an administrator group consisting of all users with the OAuth role admin plus two additional administrators identified by their client-certificate thumbprints. These administrators may perform the basic DSF tasks: starting and continuing of new process instances (by creating tasks and answering QuestionnaireResponses) and reading all resources on the DSF FHIR server.
+
+```yaml
+      DEV_DSF_FHIR_SERVER_ROLECONFIG: |
+        - example_minimal_admin:
+            thumbprint:
+              - 0123...cdef
+              - abcd...6789
+            token-role: admin
+            dsf-role:
+              - CREATE: [Task]
+              - READ
+              - UPDATE: [QuestionnaireResponse]
+              - SEARCH
+              - HISTORY
+            practitioner-role:
+              - http://dsf.dev/fhir/CodeSystem/practitioner-role|DSF_ADMIN
+
+```
+
+
+The third example allows read-only access, restricted to QuestionnaireResponse resources only. Two e-mail addresses are used to match this role. E-mail addresses from X.509 client certificates and OAuth 2.0 access tokens are matched:
+
+```yaml
+      DEV_DSF_FHIR_SERVER_ROLECONFIG: |
+        - read-only:
+            email:
+              - first.user@test.org
+              - second.user@test.org
+            dsf-role:
+              - READ: [QuestionnaireResponse]
+              - UPDATE: [QuestionnaireResponse]
+              - SEARCH: [QuestionnaireResponse]
+              - HISTORY: [QuestionnaireResponse]
+```
diff --git a/docs/src/operations/v2.0.2/fhir/configuration.md b/docs/src/operations/v2.0.2/fhir/configuration.md
new file mode 100644
index 000000000..4c0760acb
--- /dev/null
+++ b/docs/src/operations/v2.0.2/fhir/configuration.md
@@ -0,0 +1,551 @@
+---
+title: Configuration Parameters
+icon: config
+---
+
+### DEV_DSF_FHIR_CLIENT_CERTIFICATE
+- **Property:** dev.dsf.fhir.client.certificate
+- **Required:** Yes
+- **Description:** PEM encoded file with local client certificate for https connections to remote DSF FHIR servers
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/app_client_certificate.pem`
+
+
+### DEV_DSF_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY
+- **Property:** dev.dsf.fhir.client.certificate.private.key
+- **Required:** Yes
+- **Description:** Private key corresponding to the local client certificate as PEM encoded file. Use *DEV_DSF_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD* or *DEV_DSF_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE* if private key is encrypted
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/app_client_certificate_private_key.pem`
+
+
+### DEV_DSF_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD or DEV_DSF_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE
+- **Property:** dev.dsf.fhir.client.certificate.private.key.password
+- **Required:** No
+- **Description:** Password to decrypt the local client certificate encrypted private key
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE*
+- **Example:** `/run/secrets/app_client_certificate_private_key.pem.password`
+
+
+### DEV_DSF_FHIR_CLIENT_TIMEOUT_CONNECT
+- **Property:** dev.dsf.fhir.client.timeout.connect
+- **Required:** No
+- **Description:** Timeout until a connection is established between this DSF FHIR server and a remote DSF FHIR server
+- **Recommendation:** Change default value only if timeout exceptions occur
+- **Default:** `PT2S`
+
+
+### DEV_DSF_FHIR_CLIENT_TIMEOUT_READ
+- **Property:** dev.dsf.fhir.client.timeout.read
+- **Required:** No
+- **Description:** Timeout until a reading a resource from a remote DSF FHIR server is aborted
+- **Recommendation:** Change default value only if timeout exceptions occur
+- **Default:** `PT10S`
+
+
+### DEV_DSF_FHIR_CLIENT_TRUST_SERVER_CERTIFICATE_CAS
+- **Property:** dev.dsf.fhir.client.trust.server.certificate.cas
+- **Required:** No
+- **Description:** Folder with PEM encoded files (*.crt, *.pem) or a single PEM encoded file with one or more trusted root certificates to validate server certificates for https connections to remote DSF FHIR servers
+- **Recommendation:** Add file to default folder via bind mount or use docker secret file to configure
+- **Example:** `/run/secrets/app_client_trust_certificates.pem`
+- **Default:** `ca/server_root_cas`
+
+
+### DEV_DSF_FHIR_CLIENT_VERBOSE
+- **Property:** dev.dsf.fhir.client.verbose
+- **Required:** No
+- **Description:** To enable verbose logging of requests to and replies from remote DSF FHIR servers, set to `true`
+- **Default:** `false`
+
+
+### DEV_DSF_FHIR_DB_LIQUIBASE_FORCEUNLOCK
+- **Property:** dev.dsf.fhir.db.liquibase.forceUnlock
+- **Required:** No
+- **Description:** To force liquibase to unlock the migration lock set to `true`
+- **Recommendation:** Only use this option temporarily to unlock a stuck DB migration step
+- **Default:** `false`
+
+
+### DEV_DSF_FHIR_DB_LIQUIBASE_LOCKWAITTIME
+- **Property:** dev.dsf.fhir.db.liquibase.lockWaitTime
+- **Required:** No
+- **Description:** Liquibase change lock wait time in minutes, default 2 minutes
+- **Default:** `2`
+
+
+### DEV_DSF_FHIR_DB_LIQUIBASE_PASSWORD or DEV_DSF_FHIR_DB_LIQUIBASE_PASSWORD_FILE
+- **Property:** dev.dsf.fhir.db.liquibase.password
+- **Required:** Yes
+- **Description:** Password to access the database from the DSF FHIR server to execute database migrations
+- **Recommendation:** Use docker secret file to configure by using *DEV_DSF_FHIR_DB_LIQUIBASE_PASSWORD_FILE*
+- **Example:** `/run/secrets/db_liquibase.password`
+
+
+### DEV_DSF_FHIR_DB_LIQUIBASE_USERNAME
+- **Property:** dev.dsf.fhir.db.liquibase.username
+- **Required:** No
+- **Description:** Username to access the database from the DSF FHIR server to execute database migrations
+- **Default:** `liquibase_user`
+
+
+### DEV_DSF_FHIR_DB_URL
+- **Property:** dev.dsf.fhir.db.url
+- **Required:** Yes
+- **Description:** Address of the database used for the DSF FHIR server
+- **Recommendation:** Change only if you don't use the provided docker-compose from the installation guide or made changes to the database settings/networking in the docker-compose
+- **Example:** `jdbc:postgresql://db/fhir`
+
+
+### DEV_DSF_FHIR_DB_USER_GROUP
+- **Property:** dev.dsf.fhir.db.user.group
+- **Required:** No
+- **Description:** Name of the user group to access the database from the DSF FHIR server
+- **Default:** `fhir_users`
+
+
+### DEV_DSF_FHIR_DB_USER_PASSWORD or DEV_DSF_FHIR_DB_USER_PASSWORD_FILE
+- **Property:** dev.dsf.fhir.db.user.password
+- **Required:** Yes
+- **Description:** Password to access the database from the DSF FHIR server
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_FHIR_DB_USER_PASSWORD_FILE*
+- **Example:** `/run/secrets/db_user.password`
+
+
+### DEV_DSF_FHIR_DB_USER_PERMANENT_DELETE_GROUP
+- **Property:** dev.dsf.fhir.db.user.permanent.delete.group
+- **Required:** No
+- **Description:** Name of the user group to access the database from the DSF FHIR server for permanent deletes
+- **Default:** `fhir_permanent_delete_users`
+
+
+### DEV_DSF_FHIR_DB_USER_PERMANENT_DELETE_PASSWORD or DEV_DSF_FHIR_DB_USER_PERMANENT_DELETE_PASSWORD_FILE
+- **Property:** dev.dsf.fhir.db.user.permanent.delete.password
+- **Required:** Yes
+- **Description:** Password to access the database from the DSF FHIR server for permanent deletes
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_FHIR_DB_USER_PERMANENT_DELETE_PASSWORD_FILE*
+- **Example:** `/run/secrets/db_user_permanent_delete.password`
+
+
+### DEV_DSF_FHIR_DB_USER_PERMANENT_DELETE_USERNAME
+- **Property:** dev.dsf.fhir.db.user.permanent.delete.username
+- **Required:** No
+- **Description:** Username to access the database from the DSF FHIR server for permanent deletes
+- **Recommendation:** Use a different user then *DEV_DSF_FHIR_DB_USER_USERNAME*
+- **Default:** `fhir_server_permanent_delete_user`
+
+
+### DEV_DSF_FHIR_DB_USER_USERNAME
+- **Property:** dev.dsf.fhir.db.user.username
+- **Required:** No
+- **Description:** Username to access the database from the DSF FHIR server
+- **Default:** `fhir_server_user`
+
+
+### DEV_DSF_FHIR_DEBUG_LOG_MESSAGE_CURRENTUSER
+- **Property:** dev.dsf.fhir.debug.log.message.currentUser
+- **Required:** No
+- **Description:** To enable logging of the currently requesting user set to `true`
+- **Recommendation:** This debug function should only be activated during development; WARNING: Confidential information may be leaked via the debug log!
+- **Default:** `false`
+
+
+### DEV_DSF_FHIR_DEBUG_LOG_MESSAGE_DBSTATEMENT
+- **Property:** dev.dsf.fhir.debug.log.message.dbStatement
+- **Required:** No
+- **Description:** To enable logging of DB queries set to `true`
+- **Recommendation:** This debug function should only be activated during development; WARNING: Confidential information may be leaked via the debug log!
+- **Default:** `false`
+
+
+### DEV_DSF_FHIR_DEBUG_LOG_MESSAGE_WEBSERVICEREQUEST
+- **Property:** dev.dsf.fhir.debug.log.message.webserviceRequest
+- **Required:** No
+- **Description:** To enable logging of webservices requests set to `true`
+- **Recommendation:** This debug function should only be activated during development; WARNING: Confidential information may be leaked via the debug log!
+- **Default:** `false`
+
+
+### DEV_DSF_FHIR_SERVER_BASE_URL
+- **Property:** dev.dsf.fhir.server.base.url
+- **Required:** Yes
+- **Description:** Base address of this DSF FHIR server to read/store fhir resources
+- **Example:** `https://foo.bar/fhir`
+
+
+### DEV_DSF_FHIR_SERVER_INIT_BUNDLE
+- **Property:** dev.dsf.fhir.server.init.bundle
+- **Required:** No
+- **Description:** Fhir bundle containing the initial Allow-List, loaded on startup of the DSF FHIR server
+- **Recommendation:** Change only if you don't use the provided files from the installation guide, have local changes in the Allow-List or received an Allow-List from another source
+- **Default:** `conf/bundle.xml`
+
+
+### DEV_DSF_FHIR_SERVER_ORGANIZATION_IDENTIFIER_VALUE
+- **Property:** dev.dsf.fhir.server.organization.identifier.value
+- **Required:** Yes
+- **Description:** Local identifier value used in the Allow-List
+- **Recommendation:** By convention: The shortest possible FQDN that resolve the homepage of the organization
+- **Example:** `hospital.com`
+
+
+### DEV_DSF_FHIR_SERVER_ORGANIZATION_THUMBPRINT
+- **Property:** dev.dsf.fhir.server.organization.thumbprint
+- **Required:** No
+- **Description:** The SHA-512 thumbprint of the local organization client certificate; will be calculated on startup based on the client certificate specified via *DEV_DSF_FHIR_CLIENT_CERTIFICATE*
+- **Recommendation:** Do not specify this variable when using the same client certificate for the FHIR and BPE server; the thumbprint can be calculated via `certtool --fingerprint --hash=sha512 --infile=client_certificate.pem`
+
+
+### DEV_DSF_FHIR_SERVER_PAGE_COUNT
+- **Property:** dev.dsf.fhir.server.page.count
+- **Required:** No
+- **Description:** Page size returned by the DSF FHIR server when reading/searching fhir resources
+- **Default:** `20`
+
+
+### DEV_DSF_FHIR_SERVER_ROLECONFIG
+- **Property:** dev.dsf.fhir.server.roleConfig
+- **Required:** No
+- **Description:** Role config YAML as defined in [FHIR Server: Access Control](access-control)
+
+
+### DEV_DSF_FHIR_SERVER_STATIC_RESOURCE_CACHE
+- **Property:** dev.dsf.fhir.server.static.resource.cache
+- **Required:** No
+- **Description:** To disable static resource caching, set to `false`
+- **Recommendation:** Only set to `false` for development
+- **Default:** `true`
+
+
+### DEV_DSF_FHIR_SERVER_UI_THEME
+- **Property:** dev.dsf.fhir.server.ui.theme
+- **Required:** No
+- **Description:** UI theme parameter, adds a color indicator to the ui to distinguish `dev`, `test` and `prod` environments if configured; supported values: `dev`, `test` and `prod`
+
+
+### DEV_DSF_LOG_AUDIT_CONSOLE_ERR_ENABLED
+- **Property:** dev.dsf.log.audit.console.err.enabled
+- **Required:** No
+- **Description:** Set to `true` to enable console err output of the audit logger
+- **Default:** `false`
+
+
+### DEV_DSF_LOG_AUDIT_CONSOLE_ERR_STYLE
+- **Property:** dev.dsf.log.audit.console.err.style
+- **Required:** No
+- **Description:** Audit logger console err style, one of: `JSON_ECS`, `JSON_GCP`, `JSON_GELF`, `JSON_LOGSTASH`, `TEXT_MDC`, `TEXT`
+- **Default:** `STYLE_TEXT`
+
+
+### DEV_DSF_LOG_AUDIT_CONSOLE_OUT_ENABLED
+- **Property:** dev.dsf.log.audit.console.out.enabled
+- **Required:** No
+- **Description:** Set to `true` to enable console out output of the audit logger
+- **Default:** `false`
+
+
+### DEV_DSF_LOG_AUDIT_CONSOLE_OUT_STYLE
+- **Property:** dev.dsf.log.audit.console.out.style
+- **Required:** No
+- **Description:** Audit logger console out style, one of: `JSON_ECS`, `JSON_GCP`, `JSON_GELF`, `JSON_LOGSTASH`, `TEXT_MDC`, `TEXT`
+- **Default:** `STYLE_TEXT`
+
+
+### DEV_DSF_LOG_AUDIT_FILE_ENABLED
+- **Property:** dev.dsf.log.audit.file.enabled
+- **Required:** No
+- **Description:** Set to `false` to disable log file output of the audit logger
+- **Default:** `true`
+
+
+### DEV_DSF_LOG_AUDIT_FILE_STYLE
+- **Property:** dev.dsf.log.audit.file.style
+- **Required:** No
+- **Description:** Audit logger file style, one of: `JSON_ECS`, `JSON_GCP`, `JSON_GELF`, `JSON_LOGSTASH`, `TEXT_MDC`, `TEXT`
+- **Default:** `TEXT_MDC`
+
+
+### DEV_DSF_LOG_CONFIG
+- **Property:** dev.dsf.log.config
+- **Required:** No
+- **Description:** Location of a log4j configuration xml file; if file is readable, overrides configuration specified via *DEV_DSF_LOG_...* parameters
+- **Default:** `conf/log4j2.xml`
+
+
+### DEV_DSF_LOG_CONSOLE_ERR_ENABLED
+- **Property:** dev.dsf.log.console.err.enabled
+- **Required:** No
+- **Description:** Set to `true` to enable console err output of the standard logger
+- **Default:** `false`
+
+
+### DEV_DSF_LOG_CONSOLE_ERR_LEVEL
+- **Property:** dev.dsf.log.console.err.level
+- **Required:** No
+- **Description:** Standard logger console err output level, one of: `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`
+- **Default:** `INFO`
+
+
+### DEV_DSF_LOG_CONSOLE_ERR_STYLE
+- **Property:** dev.dsf.log.console.err.style
+- **Required:** No
+- **Description:** Standard logger console err output style, one of: `JSON_ECS`, `JSON_GCP`, `JSON_GELF`, `JSON_LOGSTASH`, `TEXT_MDC`, `TEXT`, `TEXT_COLOR_MDC`, `TEXT_COLOR`
+- **Default:** `TEXT_COLOR`
+
+
+### DEV_DSF_LOG_CONSOLE_OUT_ENABLED
+- **Property:** dev.dsf.log.console.out.enabled
+- **Required:** No
+- **Description:** Set to `false` to disable console out output of the standard logger
+- **Default:** `true`
+
+
+### DEV_DSF_LOG_CONSOLE_OUT_LEVEL
+- **Property:** dev.dsf.log.console.out.level
+- **Required:** No
+- **Description:** Standard logger console out output level, one of: `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`
+- **Default:** `INFO`
+
+
+### DEV_DSF_LOG_CONSOLE_OUT_STYLE
+- **Property:** dev.dsf.log.console.out.style
+- **Required:** No
+- **Description:** Standard logger console out output style, one of: `JSON_ECS`, `JSON_GCP`, `JSON_GELF`, `JSON_LOGSTASH`, `TEXT_MDC`, `TEXT`, `TEXT_COLOR_MDC`, `TEXT_COLOR`
+- **Default:** `TEXT_COLOR`
+
+
+### DEV_DSF_LOG_FILE_ENABLED
+- **Property:** dev.dsf.log.file.enabled
+- **Required:** No
+- **Description:** Set to `false` to disable log file output of the standard logger
+- **Default:** `true`
+
+
+### DEV_DSF_LOG_FILE_LEVEL
+- **Property:** dev.dsf.log.file.level
+- **Required:** No
+- **Description:** Standard logger log file output level, one of: `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`
+- **Default:** `DEBUG`
+
+
+### DEV_DSF_LOG_FILE_STYLE
+- **Property:** dev.dsf.log.file.style
+- **Required:** No
+- **Description:** Standard logger log file output style, one of: `JSON_ECS`, `JSON_GCP`, `JSON_GELF`, `JSON_LOGSTASH`, `TEXT_MDC`, `TEXT`
+- **Default:** `TEXT_MDC`
+
+
+### DEV_DSF_PROXY_NOPROXY
+- **Property:** dev.dsf.proxy.noProxy
+- **Required:** No
+- **Description:** Forward proxy no-proxy list, entries will match exactly or against (one level) sub-domains, if no port is specified - all ports are matched; comma or space separated list, YAML block scalars supported
+- **Example:** `foo.bar, test.com:8080`
+
+
+### DEV_DSF_PROXY_PASSWORD or DEV_DSF_PROXY_PASSWORD_FILE
+- **Property:** dev.dsf.proxy.password
+- **Required:** No
+- **Description:** Forward Proxy password
+- **Recommendation:** Configure password if proxy requires authentication, use docker secret file to configure using *DEV_DSF_PROXY_PASSWORD_FILE*
+
+
+### DEV_DSF_PROXY_URL
+- **Property:** dev.dsf.proxy.url
+- **Required:** No
+- **Description:** Forward (http/https) proxy url, use *DEV_DSF_BPE_PROXY_NOPROXY* to list domains that do not require a forward proxy
+- **Example:** `http://proxy.foo:8080`
+
+
+### DEV_DSF_PROXY_USERNAME
+- **Property:** dev.dsf.proxy.username
+- **Required:** No
+- **Description:** Forward proxy username
+- **Recommendation:** Configure username if proxy requires authentication
+
+
+### DEV_DSF_SERVER_API_HOST
+- **Property:** dev.dsf.server.api.host
+- **Required:** No
+- **Description:** API connector host, default in docker image: `0.0.0.0`
+- **Default:** `127.0.0.1`
+
+
+### DEV_DSF_SERVER_API_PORT
+- **Property:** dev.dsf.server.api.port
+- **Required:** No
+- **Description:** API connector port, default in docker image: `8080`
+
+
+### DEV_DSF_SERVER_AUTH_CLIENT_CERTIFICATE_HEADER
+- **Property:** dev.dsf.server.auth.client.certificate.header
+- **Required:** No
+- **Description:** Name of HTTP header with client certificate from reverse proxy
+- **Default:** `X-ClientCert`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW
+- **Property:** dev.dsf.server.auth.oidc.authorization.code.flow
+- **Required:** No
+- **Description:** Set to `true` to enable OIDC authorization code flow
+- **Recommendation:** Requires *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL*, *DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID* and *DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET* or *DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE* to be specified
+- **Default:** `false`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT
+- **Property:** dev.dsf.server.auth.oidc.back.channel.logout
+- **Required:** No
+- **Description:** Set to `true` to enable OIDC back-channel logout
+- **Recommendation:** Requires *DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW* to be set to `true` (enabled), *DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID* and *DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT_PATH* to be specified
+- **Default:** `false`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT_PATH
+- **Property:** dev.dsf.server.auth.oidc.back.channel.logout.path
+- **Required:** No
+- **Description:** Path called by the OIDC provide to request back-channel logout
+- **Default:** `/back-channel-logout`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_BEARER_TOKEN
+- **Property:** dev.dsf.server.auth.oidc.bearer.token
+- **Required:** No
+- **Description:** Set to `true` to enable OIDC bearer token authentication
+- **Recommendation:** Requires *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL* to be specified
+- **Default:** `false`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_BEARER_TOKEN_AUDIENCE
+- **Property:** dev.dsf.server.auth.oidc.bearer.token.audience
+- **Required:** No
+- **Description:** Audience (aud) value to verify before accepting OIDC bearer tokens, uses value from `DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID` by default, set blank string e.g. `''` to disable
+- **Recommendation:** Requires *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL* to be specified and *DEV_DSF_SERVER_AUTH_OIDC_BEARER_TOKEN* set tor `true`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID
+- **Property:** dev.dsf.server.auth.oidc.client.id
+- **Required:** No
+- **Description:** OIDC provider client_id, must be specified if *DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW* is enabled
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET or DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE
+- **Property:** dev.dsf.server.auth.oidc.client.secret
+- **Required:** No
+- **Description:** OIDC provider client_secret, must be specified if *DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW* is enabled
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE
+- **Property:** dev.dsf.server.auth.oidc.provider.client.certificate
+- **Required:** No
+- **Description:** PEM encoded file with client certificate for https connections to the OIDC provider
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/oidc_provider_client_certificate.pem`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY
+- **Property:** dev.dsf.server.auth.oidc.provider.client.certificate.private.key
+- **Required:** No
+- **Description:** Private key corresponding to the client certificate for the OIDC provider as PEM encoded file. Use *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD* or *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE* if private key is encrypted
+- **Recommendation:** Use docker secret file to configure
+- **Example:** `/run/secrets/oidc_provider_client_certificate_private_key.pem`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD or DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE
+- **Property:** dev.dsf.server.auth.oidc.provider.client.certificate.private.key.password
+- **Required:** No
+- **Description:** Password to decrypt the client certificate for the OIDC provider encrypted private key
+- **Recommendation:** Use docker secret file to configure using *DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE*
+- **Example:** `/run/secrets/oidc_provider_client_certificate_private_key.pem.password`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TIMEOUT_CONNECT
+- **Property:** dev.dsf.server.auth.oidc.provider.client.timeout.connect
+- **Required:** No
+- **Description:** OIDC provider client connect timeout
+- **Default:** `PT5S`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TIMEOUT_READ
+- **Property:** dev.dsf.server.auth.oidc.provider.client.timeout.read
+- **Required:** No
+- **Description:** OIDC provider client read timeout
+- **Default:** `PT30S`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS
+- **Property:** dev.dsf.server.auth.oidc.provider.client.trust.server.certificate.cas
+- **Required:** No
+- **Description:** Folder with PEM encoded files (*.crt, *.pem) or a single PEM encoded file with one or more trusted root certificates to validate server certificates for https connections to the OIDC provider
+- **Recommendation:** Add file to default folder via bind mount or use docker secret file to configure
+- **Example:** `/run/secrets/oidc_provider_trust_certificates.pem`
+- **Default:** `ca/server_root_cas`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_DISCOVERY_PATH
+- **Property:** dev.dsf.server.auth.oidc.provider.discovery.path
+- **Required:** No
+- **Description:** OIDC provider discovery path
+- **Default:** `/.well-known/openid-configuration`
+
+
+### DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL
+- **Property:** dev.dsf.server.auth.oidc.provider.realm.base.url
+- **Required:** No
+- **Description:** OIDC provider realm base url
+- **Example:** `https://keycloak.test.com:8443/realms/example-realm-name`
+
+
+### DEV_DSF_SERVER_AUTH_TRUST_CLIENT_CERTIFICATE_CAS
+- **Property:** dev.dsf.server.auth.trust.client.certificate.cas
+- **Required:** No
+- **Description:** Folder with PEM encoded files (*.crt, *.pem) or a single PEM encoded file with one or more trusted full CA chains to validate client certificates for https connections from local and remote clients
+- **Recommendation:** Add file to default folder via bind mount or use docker secret file to configure
+- **Example:** `/run/secrets/app_client_trust_certificates.pem`
+- **Default:** `ca/client_ca_chains`
+
+
+### DEV_DSF_SERVER_CERTIFICATE
+- **Property:** dev.dsf.server.certificate
+- **Required:** No
+- **Description:** Server certificate file for testing
+- **Recommendation:** Only specify For testing when terminating TLS in jetty server
+
+
+### DEV_DSF_SERVER_CERTIFICATE_CHAIN
+- **Property:** dev.dsf.server.certificate.chain
+- **Required:** No
+- **Description:** Server certificate chain file for testing
+- **Recommendation:** Only specify For testing when terminating TLS in jetty server
+
+
+### DEV_DSF_SERVER_CERTIFICATE_KEY
+- **Property:** dev.dsf.server.certificate.key
+- **Required:** No
+- **Description:** Server certificate private key file for testing
+- **Recommendation:** Only specify For testing when terminating TLS in jetty server
+
+
+### DEV_DSF_SERVER_CERTIFICATE_KEY_PASSWORD or DEV_DSF_SERVER_CERTIFICATE_KEY_PASSWORD_FILE
+- **Property:** dev.dsf.server.certificate.key.password
+- **Required:** No
+- **Description:** Server certificate private key file password for testing
+- **Recommendation:** Only specify For testing when terminating TLS in jetty server
+
+
+### DEV_DSF_SERVER_CONTEXT_PATH
+- **Property:** dev.dsf.server.context.path
+- **Required:** No
+- **Description:** Web application context path, default in `bpe` docker image: `/bpe`, default in `fhir` docker image: `/fhir`
+- **Recommendation:** Only modify for testing
+
+
+### DEV_DSF_SERVER_STATUS_HOST
+- **Property:** dev.dsf.server.status.host
+- **Required:** No
+- **Description:** Status connector host
+- **Default:** `127.0.0.1`
+
+
+### DEV_DSF_SERVER_STATUS_PORT
+- **Property:** dev.dsf.server.status.port
+- **Required:** No
+- **Description:** Status connector port, default in docker image: `10000`
\ No newline at end of file
diff --git a/docs/src/operations/v2.0.2/fhir/logging.md b/docs/src/operations/v2.0.2/fhir/logging.md
new file mode 100644
index 000000000..eb9c0cf2b
--- /dev/null
+++ b/docs/src/operations/v2.0.2/fhir/logging.md
@@ -0,0 +1,704 @@
+---
+title: Logging
+icon: config
+---
+
+The DSF FHIR Server provides a **Standard Application Logger** and a dedicated **Audit Logger** for compliance-relevant access events. Both mechanisms can output there messages to standard output (stdout), standard error (stderr) and dedicated log files.
+
+By default the **Standard Application Logger** is configured to output with min. level `INFO` and format `TEXT_COLOR` to *stdout* as well as min. level `DEBUG` and format `TEXT_MDC` to a dedicated log file. In addition the **Audit Logger** is enabled by default to log with format `TEXT_MDC` to a dedicated log file.
+
+### Standard Application Logger
+The file, *stdout* and *stderr* outputs for the **Standard Application Logger** can be enabled or disabled using the environment variables [`DEV_DSF_LOG_FILE_ENABLED`](./configuration.md#dev-dsf-log-file-enabled), [`DEV_DSF_LOG_CONSOLE_OUT_ENABLED`](./configuration.md#dev-dsf-log-console-out-enabled) and [`DEV_DSF_LOG_CONSOLE_ERR_ENABLED`](./configuration.md#dev-dsf-log-console-err-enabled).
+
+#### Output Level
+Log messages are grouped by severity (low to high): `TRACE`, `DEBUG`, `INFO`, `WARN`, `ERROR`. A minimal log level can be configured for the file, *stdout* and *stderr* outputs using the environment variables [`DEV_DSF_LOG_FILE_LEVEL`](./configuration.md#dev-dsf-log-file-level), [`DEV_DSF_LOG_CONSOLE_OUT_LEVEL`](./configuration.md#dev-dsf-log-console-out-level) and [`DEV_DSF_LOG_CONSOLE_ERR_LEVEL`](./configuration.md#dev-dsf-log-console-err-level).
+
+#### Output Style
+Multiple styles are supported for the **Standard Application Logger** file, *stdout* and *stderr* outputs. All structured logging JSON styles include additional infos (Mapped Diagnostic Context) about the requesting user. The output style can be configured using the environment variables [`DEV_DSF_LOG_FILE_STYLE`](./configuration.md#dev-dsf-log-file-style), [`DEV_DSF_LOG_CONSOLE_OUT_STYLE`](./configuration.md#dev-dsf-log-console-out-style) and [`DEV_DSF_LOG_CONSOLE_ERR_STYLE`](./configuration.md#dev-dsf-log-console-err-style). The **TEXT_COLOR** and **TEXT_COLOR_MDC** styles are not supported for the file output.
+* **TEXT** a minimal text format.
+* **TEXT_COLOR** a minimal text format with ANSI escape sequences to colorize WARN and ERROR messages. Not supported for the file output.
+* **TEXT_MDC** text format with additional infos (Mapped Diagnostic Context) about the requesting user.
+* **TEXT_COLOR_MDC** text format with additional infos (Mapped Diagnostic Context) about the requesting user and ANSI escape sequences to colorize WARN and ERROR events. Not supported for the file output.
+* **JSON_ECS** follows the Elastic Common Schema (ECS) reference.
+* **JSON_GCP** uses the Google Cloud Platform structured logging model with additional `_thread`, `_logger` and `_exception` fields.
+* **JSON_GELF** follows the Graylog Extended Log Format (GELF) payload specification with added `_thread` and `_logger` fields.
+* **JSON_LOGSTASH** uses the Logstash json_event pattern for log4j.
+
+::: code-tabs#shell
+
+@tab TEXT
+
+```text :no-line-numbers
+2026-01-13 15:57:57,567 [main] INFO  dev.dsf.common.buildinfo.BuildInfoReaderImpl - Artifact: dsf-fhir-server-jetty, version: 2.0.1, build: 2025-11-26T20:24:47+01:00, branch: main, commit: 77ac1d45a35fae8666d531953572ab6c51a58685
+2026-01-13 16:03:28,524 [main] ERROR org.springframework.web.context.ContextLoader - Context initialization failed
+org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'activityDefinitionAuthorizationRule' defined in dev.dsf.fhir.spring.config.AuthorizationConfig: Failed to instantiate [dev.dsf.fhir.authorization.AuthorizationRule]: Factory method 'activityDefinitionAuthorizationRule' threw exception with message: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)
+	at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)
+	at org.springframework.beans.factory.support.DefaultListableBeanFactory.instantiateSingleton(DefaultListableBeanFactory.java:1228)
+	at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingleton(DefaultListableBeanFactory.java:1194)
+	at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:1130)
+	at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:990)
+	at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:627)
+	at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:394)
+	at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:274)
+	at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:126)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.callContextInitialized(ServletContextHandler.java:1614)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.contextInitialized(ServletContextHandler.java:501)
+	at org.eclipse.jetty.ee10.servlet.ServletHandler.initialize(ServletHandler.java:675)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.startContext(ServletContextHandler.java:1348)
+	at org.eclipse.jetty.ee10.webapp.WebAppContext.startWebapp(WebAppContext.java:1429)
+	at org.eclipse.jetty.ee10.webapp.WebAppContext.startContext(WebAppContext.java:1387)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.lambda$doStart$0(ServletContextHandler.java:1066)
+	at org.eclipse.jetty.server.handler.ContextHandler$ScopedContext.call(ContextHandler.java:1636)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.doStart(ServletContextHandler.java:1063)
+	at org.eclipse.jetty.ee10.webapp.WebAppContext.doStart(WebAppContext.java:520)
+	at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)
+	at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:170)
+	at org.eclipse.jetty.server.Server.start(Server.java:689)
+	at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:121)
+	at org.eclipse.jetty.server.Handler$Abstract.doStart(Handler.java:545)
+	at org.eclipse.jetty.server.Server.doStart(Server.java:630)
+	at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)
+	at dev.dsf.common.jetty.JettyServer.start(JettyServer.java:374)
+	at dev.dsf.fhir.FhirJettyServer.main(FhirJettyServer.java:56)
+Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.authorization.AuthorizationRule]: Factory method 'activityDefinitionAuthorizationRule' threw exception with message: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)
+	... 36 more
+Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)
+	at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)
+	at dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.referenceResolver(<generated>)
+	at dev.dsf.fhir.spring.config.AuthorizationConfig.activityDefinitionAuthorizationRule(AuthorizationConfig.java:123)
+	at dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$0.CGLIB$activityDefinitionAuthorizationRule$2(<generated>)
+	at dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)
+	at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)
+	at dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$0.activityDefinitionAuthorizationRule(<generated>)
+	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:565)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)
+	... 39 more
+Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)
+	... 60 more
+Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)
+	at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)
+	at dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)
+	at dev.dsf.fhir.spring.config.ReferenceConfig.referenceResolver(ReferenceConfig.java:54)
+	at dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.CGLIB$referenceResolver$1(<generated>)
+	at dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)
+	at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)
+	at dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.referenceResolver(<generated>)
+	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:565)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)
+	... 63 more
+Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)
+	... 84 more
+Caused by: java.lang.RuntimeException: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at dev.dsf.fhir.spring.config.ClientConfig.clientProvider(ClientConfig.java:92)
+	at dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.CGLIB$clientProvider$1(<generated>)
+	at dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)
+	at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)
+	at dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)
+	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:565)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)
+	... 87 more
+Caused by: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:435)
+	at de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:398)
+	at dev.dsf.fhir.spring.config.ClientConfig.createKeyStore(ClientConfig.java:111)
+	at dev.dsf.fhir.spring.config.ClientConfig.clientProvider(ClientConfig.java:79)
+	... 95 more
+Caused by: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo.decryptPrivateKeyInfo(Unknown Source)
+	at de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:430)
+	... 98 more
+Caused by: org.bouncycastle.crypto.io.InvalidCipherTextIOException: Error finalising cipher
+	at org.bouncycastle.jcajce.io.CipherInputStream.finaliseCipher(Unknown Source)
+	at org.bouncycastle.jcajce.io.CipherInputStream.nextChunk(Unknown Source)
+	at org.bouncycastle.jcajce.io.CipherInputStream.read(Unknown Source)
+	at org.bouncycastle.util.io.Streams.pipeAll(Unknown Source)
+	at org.bouncycastle.util.io.Streams.pipeAll(Unknown Source)
+	at org.bouncycastle.util.io.Streams.readAll(Unknown Source)
+	... 100 more
+Caused by: javax.crypto.BadPaddingException: pad block corrupted
+	at org.bouncycastle.jcajce.provider.symmetric.util.BaseBlockCipher$BufferedGenericBlockCipher.doFinal(Unknown Source)
+	at org.bouncycastle.jcajce.provider.symmetric.util.BaseBlockCipher.engineDoFinal(Unknown Source)
+	at java.base/javax.crypto.Cipher.doFinal(Cipher.java:2139)
+	... 106 more
+2026-01-13 16:09:55,478 [jetty-server-95] INFO  dev.dsf.fhir.authorization.AbstractMetaTagAuthorizationRule - Read of Organization/6d40351b-2237-486f-8fa0-6bed0ca08e72/_history/3 authorized for identity 'Test_Organization/webbrowser.test.user@invalid', matching access tag {ALL}
+```
+
+@tab TEXT_MDC
+
+```text :no-line-numbers
+2026-01-13 16:11:47,115 [main] INFO  dev.dsf.common.buildinfo.BuildInfoReaderImpl - Artifact: dsf-fhir-server-jetty, version: 2.0.1, build: 2025-11-26T20:24:47+01:00, branch: main, commit: 77ac1d45a35fae8666d531953572ab6c51a58685
+2026-01-13 16:12:36,611 [main] ERROR org.springframework.web.context.ContextLoader - Context initialization failed
+org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'activityDefinitionAuthorizationRule' defined in dev.dsf.fhir.spring.config.AuthorizationConfig: Failed to instantiate [dev.dsf.fhir.authorization.AuthorizationRule]: Factory method 'activityDefinitionAuthorizationRule' threw exception with message: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)
+	at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)
+	at org.springframework.beans.factory.support.DefaultListableBeanFactory.instantiateSingleton(DefaultListableBeanFactory.java:1228)
+	at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingleton(DefaultListableBeanFactory.java:1194)
+	at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:1130)
+	at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:990)
+	at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:627)
+	at org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:394)
+	at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:274)
+	at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:126)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.callContextInitialized(ServletContextHandler.java:1614)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.contextInitialized(ServletContextHandler.java:501)
+	at org.eclipse.jetty.ee10.servlet.ServletHandler.initialize(ServletHandler.java:675)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.startContext(ServletContextHandler.java:1348)
+	at org.eclipse.jetty.ee10.webapp.WebAppContext.startWebapp(WebAppContext.java:1429)
+	at org.eclipse.jetty.ee10.webapp.WebAppContext.startContext(WebAppContext.java:1387)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.lambda$doStart$0(ServletContextHandler.java:1066)
+	at org.eclipse.jetty.server.handler.ContextHandler$ScopedContext.call(ContextHandler.java:1636)
+	at org.eclipse.jetty.ee10.servlet.ServletContextHandler.doStart(ServletContextHandler.java:1063)
+	at org.eclipse.jetty.ee10.webapp.WebAppContext.doStart(WebAppContext.java:520)
+	at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)
+	at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:170)
+	at org.eclipse.jetty.server.Server.start(Server.java:689)
+	at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:121)
+	at org.eclipse.jetty.server.Handler$Abstract.doStart(Handler.java:545)
+	at org.eclipse.jetty.server.Server.doStart(Server.java:630)
+	at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)
+	at dev.dsf.common.jetty.JettyServer.start(JettyServer.java:374)
+	at dev.dsf.fhir.FhirJettyServer.main(FhirJettyServer.java:56)
+Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.authorization.AuthorizationRule]: Factory method 'activityDefinitionAuthorizationRule' threw exception with message: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)
+	... 36 more
+Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)
+	at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)
+	at dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.referenceResolver(<generated>)
+	at dev.dsf.fhir.spring.config.AuthorizationConfig.activityDefinitionAuthorizationRule(AuthorizationConfig.java:123)
+	at dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$0.CGLIB$activityDefinitionAuthorizationRule$2(<generated>)
+	at dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)
+	at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)
+	at dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$0.activityDefinitionAuthorizationRule(<generated>)
+	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:565)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)
+	... 39 more
+Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)
+	... 60 more
+Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)
+	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)
+	at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)
+	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)
+	at dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)
+	at dev.dsf.fhir.spring.config.ReferenceConfig.referenceResolver(ReferenceConfig.java:54)
+	at dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.CGLIB$referenceResolver$1(<generated>)
+	at dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)
+	at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)
+	at dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.referenceResolver(<generated>)
+	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:565)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)
+	... 63 more
+Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)
+	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)
+	... 84 more
+Caused by: java.lang.RuntimeException: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at dev.dsf.fhir.spring.config.ClientConfig.clientProvider(ClientConfig.java:92)
+	at dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.CGLIB$clientProvider$1(<generated>)
+	at dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)
+	at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)
+	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)
+	at dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)
+	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
+	at java.base/java.lang.reflect.Method.invoke(Method.java:565)
+	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)
+	... 87 more
+Caused by: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:435)
+	at de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:398)
+	at dev.dsf.fhir.spring.config.ClientConfig.createKeyStore(ClientConfig.java:111)
+	at dev.dsf.fhir.spring.config.ClientConfig.clientProvider(ClientConfig.java:79)
+	... 95 more
+Caused by: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher
+	at org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo.decryptPrivateKeyInfo(Unknown Source)
+	at de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:430)
+	... 98 more
+Caused by: org.bouncycastle.crypto.io.InvalidCipherTextIOException: Error finalising cipher
+	at org.bouncycastle.jcajce.io.CipherInputStream.finaliseCipher(Unknown Source)
+	at org.bouncycastle.jcajce.io.CipherInputStream.nextChunk(Unknown Source)
+	at org.bouncycastle.jcajce.io.CipherInputStream.read(Unknown Source)
+	at org.bouncycastle.util.io.Streams.pipeAll(Unknown Source)
+	at org.bouncycastle.util.io.Streams.pipeAll(Unknown Source)
+	at org.bouncycastle.util.io.Streams.readAll(Unknown Source)
+	... 100 more
+Caused by: javax.crypto.BadPaddingException: pad block corrupted
+	at org.bouncycastle.jcajce.provider.symmetric.util.BaseBlockCipher$BufferedGenericBlockCipher.doFinal(Unknown Source)
+	at org.bouncycastle.jcajce.provider.symmetric.util.BaseBlockCipher.engineDoFinal(Unknown Source)
+	at java.base/javax.crypto.Cipher.doFinal(Cipher.java:2139)
+	... 106 more
+2026-01-13 16:13:25,589 [jetty-server-94] INFO  dev.dsf.fhir.authorization.AbstractMetaTagAuthorizationRule - {dsf.user.endpoint.identifier=fhir, dsf.user.name=Test_Organization/webbrowser.test.user@invalid, dsf.user.organization.identifier=Test_Organization, dsf.user.practitioner.dn=CN=Webbrowser Test User,O=DSF,C=DE, dsf.user.practitioner.identifier=webbrowser.test.user@invalid, dsf.user.practitioner.roles=[http://dsf.dev/fhir/CodeSystem/practitioner-role|DSF_ADMIN], dsf.user.practitioner.thumbprint=a8874b56a7442fae17f27acc8f91a6b8f531c1855c9c7070ce04baf3a3ba17cc5cc337ba7cbd9cbb1a24d331ce99d2eb71c1368de1ae4b142084c696991214e7, dsf.user.roles=[HISTORY, READ, CREATE, UPDATE, SEARCH]} - Read of Organization/6d40351b-2237-486f-8fa0-6bed0ca08e72/_history/5 authorized for identity 'Test_Organization/webbrowser.test.user@invalid', matching access tag {ALL}
+```
+
+@tab JSON_ECS
+
+```json :no-line-numbers
+{
+    "@timestamp": "2026-01-12T12:54:35.653Z",
+    "ecs.version": "1.2.0",
+    "log.level": "INFO",
+    "message": "Artifact: dsf-fhir-server-jetty, version: 2.0.1, build: 2025-11-26T20:24:47+01:00, branch: main, commit: 77ac1d45a35fae8666d531953572ab6c51a58685",
+    "process.thread.name": "main",
+    "log.logger": "dev.dsf.common.buildinfo.BuildInfoReaderImpl"
+}
+{
+    "@timestamp": "2026-01-12T12:54:36.931Z",
+    "ecs.version": "1.2.0",
+    "log.level": "ERROR",
+    "message": "Context initialization failed",
+    "process.thread.name": "main",
+    "log.logger": "org.springframework.web.context.ContextLoader",
+    "error.type": "org.springframework.beans.factory.BeanCreationException",
+    "error.message": "Error creating bean with name 'activityDefinitionAuthorizationRule' defined in dev.dsf.fhir.spring.config.AuthorizationConfig: Failed to instantiate [dev.dsf.fhir.authorization.AuthorizationRule]: Factory method 'activityDefinitionAuthorizationRule' threw exception with message: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher",
+    "error.stack_trace": "org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'activityDefinitionAuthorizationRule' defined in dev.dsf.fhir.spring.config.AuthorizationConfig: Failed to instantiate [dev.dsf.fhir.authorization.AuthorizationRule]: Factory method 'activityDefinitionAuthorizationRule' threw exception with message: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.instantiateSingleton(DefaultListableBeanFactory.java:1228)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingleton(DefaultListableBeanFactory.java:1194)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:1130)\n\tat org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:990)\n\tat org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:627)\n\tat org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:394)\n\tat org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:274)\n\tat org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:126)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.callContextInitialized(ServletContextHandler.java:1614)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.contextInitialized(ServletContextHandler.java:501)\n\tat org.eclipse.jetty.ee10.servlet.ServletHandler.initialize(ServletHandler.java:675)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.startContext(ServletContextHandler.java:1348)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startWebapp(WebAppContext.java:1429)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startContext(WebAppContext.java:1387)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.lambda$doStart$0(ServletContextHandler.java:1066)\n\tat org.eclipse.jetty.server.handler.ContextHandler$ScopedContext.call(ContextHandler.java:1636)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.doStart(ServletContextHandler.java:1063)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.doStart(WebAppContext.java:520)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:170)\n\tat org.eclipse.jetty.server.Server.start(Server.java:689)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:121)\n\tat org.eclipse.jetty.server.Handler$Abstract.doStart(Handler.java:545)\n\tat org.eclipse.jetty.server.Server.doStart(Server.java:630)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat dev.dsf.common.jetty.JettyServer.start(JettyServer.java:374)\n\tat dev.dsf.fhir.FhirJettyServer.main(FhirJettyServer.java:56)\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.authorization.AuthorizationRule]: Factory method 'activityDefinitionAuthorizationRule' threw exception with message: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 36 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.referenceResolver(<generated>)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig.activityDefinitionAuthorizationRule(AuthorizationConfig.java:123)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$0.CGLIB$activityDefinitionAuthorizationRule$2(<generated>)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$0.activityDefinitionAuthorizationRule(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 39 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 60 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig.referenceResolver(ReferenceConfig.java:54)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.CGLIB$referenceResolver$1(<generated>)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.referenceResolver(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 63 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 84 more\nCaused by: java.lang.RuntimeException: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat dev.dsf.fhir.spring.config.ClientConfig.clientProvider(ClientConfig.java:92)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.CGLIB$clientProvider$1(<generated>)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 87 more\nCaused by: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:435)\n\tat de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:398)\n\tat dev.dsf.fhir.spring.config.ClientConfig.createKeyStore(ClientConfig.java:111)\n\tat dev.dsf.fhir.spring.config.ClientConfig.clientProvider(ClientConfig.java:79)\n\t... 95 more\nCaused by: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo.decryptPrivateKeyInfo(Unknown Source)\n\tat de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:430)\n\t... 98 more\nCaused by: org.bouncycastle.crypto.io.InvalidCipherTextIOException: Error finalising cipher\n\tat org.bouncycastle.jcajce.io.CipherInputStream.finaliseCipher(Unknown Source)\n\tat org.bouncycastle.jcajce.io.CipherInputStream.nextChunk(Unknown Source)\n\tat org.bouncycastle.jcajce.io.CipherInputStream.read(Unknown Source)\n\tat org.bouncycastle.util.io.Streams.pipeAll(Unknown Source)\n\tat org.bounc…"
+}
+{
+    "@timestamp": "2026-01-12T13:27:49.008Z",
+    "ecs.version": "1.2.0",
+    "log.level": "INFO",
+    "message": "Read of Organization/90500752-381a-46fa-858f-14d6d5b11627/_history/4 authorized for identity 'Test_Organization/webbrowser.test.user@invalid', matching access tag {ALL}",
+    "process.thread.name": "jetty-server-83",
+    "log.logger": "dev.dsf.fhir.authorization.AbstractMetaTagAuthorizationRule",
+    "dsf.user.endpoint.identifier": "fhir",
+    "dsf.user.name": "Test_Organization/webbrowser.test.user@invalid",
+    "dsf.user.organization.identifier": "Test_Organization",
+    "dsf.user.practitioner.dn": "CN=Webbrowser Test User,O=DSF,C=DE",
+    "dsf.user.practitioner.identifier": "webbrowser.test.user@invalid",
+    "dsf.user.practitioner.roles": "[http://dsf.dev/fhir/CodeSystem/practitioner-role|DSF_ADMIN]",
+    "dsf.user.practitioner.thumbprint": "a8874b56a7442fae17f27acc8f91a6b8f531c1855c9c7070ce04baf3a3ba17cc5cc337ba7cbd9cbb1a24d331ce99d2eb71c1368de1ae4b142084c696991214e7",
+    "dsf.user.roles": "[UPDATE, READ, CREATE, HISTORY, SEARCH]"
+}
+```
+
+@tab JSON_GCP
+
+```json :no-line-numbers
+{
+    "timestampSeconds": 1768222644,
+    "timestampNanos": 461746234,
+    "severity": "INFO",
+    "message": "Artifact: dsf-fhir-server-jetty, version: 2.0.1, build: 2025-11-26T20:24:47+01:00, branch: main, commit: 77ac1d45a35fae8666d531953572ab6c51a58685",
+    "logging.googleapis.com/sourceLocation": {
+        "function": "dev.dsf.common.buildinfo.BuildInfoReaderImpl.logBuildInfo"
+    },
+    "logging.googleapis.com/trace_sampled": true,
+    "thread": "main",
+    "logger": "dev.dsf.common.buildinfo.BuildInfoReaderImpl"
+}
+{
+    "timestampSeconds": 1768222645,
+    "timestampNanos": 738845490,
+    "severity": "ERROR",
+    "message": "Context initialization failed\norg.springframework.beans.factory.BeanCreationException: Error creating bean with name 'activityDefinitionAuthorizationRule' defined in dev.dsf.fhir.spring.config.AuthorizationConfig: Failed to instantiate [dev.dsf.fhir.authorization.AuthorizationRule]: Factory method 'activityDefinitionAuthorizationRule' threw exception with message: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.instantiateSingleton(DefaultListableBeanFactory.java:1228)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingleton(DefaultListableBeanFactory.java:1194)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:1130)\n\tat org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:990)\n\tat org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:627)\n\tat org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:394)\n\tat org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:274)\n\tat org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:126)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.callContextInitialized(ServletContextHandler.java:1614)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.contextInitialized(ServletContextHandler.java:501)\n\tat org.eclipse.jetty.ee10.servlet.ServletHandler.initialize(ServletHandler.java:675)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.startContext(ServletContextHandler.java:1348)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startWebapp(WebAppContext.java:1429)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startContext(WebAppContext.java:1387)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.lambda$doStart$0(ServletContextHandler.java:1066)\n\tat org.eclipse.jetty.server.handler.ContextHandler$ScopedContext.call(ContextHandler.java:1636)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.doStart(ServletContextHandler.java:1063)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.doStart(WebAppContext.java:520)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:170)\n\tat org.eclipse.jetty.server.Server.start(Server.java:689)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:121)\n\tat org.eclipse.jetty.server.Handler$Abstract.doStart(Handler.java:545)\n\tat org.eclipse.jetty.server.Server.doStart(Server.java:630)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat dev.dsf.common.jetty.JettyServer.start(JettyServer.java:374)\n\tat dev.dsf.fhir.FhirJettyServer.main(FhirJettyServer.java:56)\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.authorization.AuthorizationRule]: Factory method 'activityDefinitionAuthorizationRule' threw exception with message: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 36 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.referenceResolver(<generated>)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig.activityDefinitionAuthorizationRule(AuthorizationConfig.java:123)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$0.CGLIB$activityDefinitionAuthorizationRule$2(<generated>)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$0.activityDefinitionAuthorizationRule(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 39 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 60 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig.referenceResolver(ReferenceConfig.java:54)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.CGLIB$referenceResolver$1(<generated>)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.referenceResolver(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 63 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 84 more\nCaused by: java.lang.RuntimeException: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat dev.dsf.fhir.spring.config.ClientConfig.clientProvider(ClientConfig.java:92)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.CGLIB$clientProvider$1(<generated>)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 87 more\nCaused by: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:435)\n\tat de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:398)\n\tat dev.dsf.fhir.spring.config.ClientConfig.createKeyStore(ClientConfig.java:111)\n\tat dev.dsf.fhir.spring.config.ClientConfig.clientProvider(ClientConfig.java:79)\n\t... 95 more\nCaused by: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo.decryptPrivateKeyInfo(Unknown Source)\n\tat de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:430)\n\t... 98 more\nCaused by: org.bouncycastle.crypto.io.InvalidCipherTextIOException: Error finalising cipher\n\tat org.bouncycastle.jcajce.io.CipherInputStream.finaliseCipher(Unknown Source)\n\tat org.bouncycastle.jcajce.io.CipherInputStream.nextChunk(Unknown Source)\n\tat org.bouncycastle.jcajce.io.CipherInputStream.read(Unknown Source)\n\tat org.bouncycastle.util.io.Streams.pipeAll…",
+    "logging.googleapis.com/sourceLocation": {
+        "function": "org.springframework.web.context.ContextLoader.initWebApplicationContext"
+    },
+    "logging.googleapis.com/trace_sampled": true,
+    "exception": "org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'activityDefinitionAuthorizationRule' defined in dev.dsf.fhir.spring.config.AuthorizationConfig: Failed to instantiate [dev.dsf.fhir.authorization.AuthorizationRule]: Factory method 'activityDefinitionAuthorizationRule' threw exception with message: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.instantiateSingleton(DefaultListableBeanFactory.java:1228)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingleton(DefaultListableBeanFactory.java:1194)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:1130)\n\tat org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:990)\n\tat org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:627)\n\tat org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:394)\n\tat org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:274)\n\tat org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:126)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.callContextInitialized(ServletContextHandler.java:1614)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.contextInitialized(ServletContextHandler.java:501)\n\tat org.eclipse.jetty.ee10.servlet.ServletHandler.initialize(ServletHandler.java:675)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.startContext(ServletContextHandler.java:1348)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startWebapp(WebAppContext.java:1429)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startContext(WebAppContext.java:1387)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.lambda$doStart$0(ServletContextHandler.java:1066)\n\tat org.eclipse.jetty.server.handler.ContextHandler$ScopedContext.call(ContextHandler.java:1636)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.doStart(ServletContextHandler.java:1063)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.doStart(WebAppContext.java:520)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:170)\n\tat org.eclipse.jetty.server.Server.start(Server.java:689)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:121)\n\tat org.eclipse.jetty.server.Handler$Abstract.doStart(Handler.java:545)\n\tat org.eclipse.jetty.server.Server.doStart(Server.java:630)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat dev.dsf.common.jetty.JettyServer.start(JettyServer.java:374)\n\tat dev.dsf.fhir.FhirJettyServer.main(FhirJettyServer.java:56)\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.authorization.AuthorizationRule]: Factory method 'activityDefinitionAuthorizationRule' threw exception with message: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 36 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.referenceResolver(<generated>)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig.activityDefinitionAuthorizationRule(AuthorizationConfig.java:123)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$0.CGLIB$activityDefinitionAuthorizationRule$2(<generated>)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$0.activityDefinitionAuthorizationRule(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 39 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 60 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig.referenceResolver(ReferenceConfig.java:54)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.CGLIB$referenceResolver$1(<generated>)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.referenceResolver(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 63 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 84 more\nCaused by: java.lang.RuntimeException: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat dev.dsf.fhir.spring.config.ClientConfig.clientProvider(ClientConfig.java:92)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.CGLIB$clientProvider$1(<generated>)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 87 more\nCaused by: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:435)\n\tat de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:398)\n\tat dev.dsf.fhir.spring.config.ClientConfig.createKeyStore(ClientConfig.java:111)\n\tat dev.dsf.fhir.spring.config.ClientConfig.clientProvider(ClientConfig.java:79)\n\t... 95 more\nCaused by: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo.decryptPrivateKeyInfo(Unknown Source)\n\tat de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:430)\n\t... 98 more\nCaused by: org.bouncycastle.crypto.io.InvalidCipherTextIOException: Error finalising cipher\n\tat org.bouncycastle.jcajce.io.CipherInputStream.finaliseCipher(Unknown Source)\n\tat org.bouncycastle.jcajce.io.CipherInputStream.nextChunk(Unknown Source)\n\tat org.bouncycastle.jcajce.io.CipherInputStream.read(Unknown Source)\n\tat org.bouncycastle.util.io.Streams.pipeAll(Unknown Source)\n\tat org.bounc…",
+    "thread": "main",
+    "logger": "org.springframework.web.context.ContextLoader"
+}
+{
+    "timestampSeconds": 1768225245,
+    "timestampNanos": 847212542,
+    "severity": "INFO",
+    "message": "Read of Organization/90500752-381a-46fa-858f-14d6d5b11627/_history/5 authorized for identity 'Test_Organization/webbrowser.test.user@invalid', matching access tag {ALL}",
+    "logging.googleapis.com/labels": {
+        "dsf.user.endpoint.identifier": "fhir",
+        "dsf.user.name": "Test_Organization/webbrowser.test.user@invalid",
+        "dsf.user.organization.identifier": "Test_Organization",
+        "dsf.user.practitioner.dn": "CN=Webbrowser Test User,O=DSF,C=DE",
+        "dsf.user.practitioner.identifier": "webbrowser.test.user@invalid",
+        "dsf.user.practitioner.roles": "[http://dsf.dev/fhir/CodeSystem/practitioner-role|DSF_ADMIN]",
+        "dsf.user.practitioner.thumbprint": "a8874b56a7442fae17f27acc8f91a6b8f531c1855c9c7070ce04baf3a3ba17cc5cc337ba7cbd9cbb1a24d331ce99d2eb71c1368de1ae4b142084c696991214e7",
+        "dsf.user.roles": "[UPDATE, READ, HISTORY, CREATE, SEARCH]"
+    },
+    "logging.googleapis.com/sourceLocation": {
+        "function": "dev.dsf.fhir.authorization.AbstractMetaTagAuthorizationRule.reasonReadAllowed"
+    },
+    "logging.googleapis.com/trace_sampled": true,
+    "thread": "jetty-server-63",
+    "logger": "dev.dsf.fhir.authorization.AbstractMetaTagAuthorizationRule"
+}
+```
+
+@tab JSON_GELF
+
+```json :no-line-numbers
+{
+    "version": "1.1",
+    "host": "46e6824590a7",
+    "short_message": "Artifact: dsf-fhir-server-jetty, version: 2.0.1, build: 2025-11-26T20:24:47+01:00, branch: main, commit: 77ac1d45a35fae8666d531953572ab6c51a58685",
+    "timestamp": 1768224184.7015762,
+    "level": 6,
+    "_logger": "dev.dsf.common.buildinfo.BuildInfoReaderImpl",
+    "_thread": "main"
+}
+{
+    "version": "1.1",
+    "host": "46e6824590a7",
+    "short_message": "Context initialization failed",
+    "full_message": "org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'activityDefinitionAuthorizationRule' defined in dev.dsf.fhir.spring.config.AuthorizationConfig: Failed to instantiate [dev.dsf.fhir.authorization.AuthorizationRule]: Factory method 'activityDefinitionAuthorizationRule' threw exception with message: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.instantiateSingleton(DefaultListableBeanFactory.java:1228)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingleton(DefaultListableBeanFactory.java:1194)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:1130)\n\tat org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:990)\n\tat org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:627)\n\tat org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:394)\n\tat org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:274)\n\tat org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:126)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.callContextInitialized(ServletContextHandler.java:1614)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.contextInitialized(ServletContextHandler.java:501)\n\tat org.eclipse.jetty.ee10.servlet.ServletHandler.initialize(ServletHandler.java:675)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.startContext(ServletContextHandler.java:1348)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startWebapp(WebAppContext.java:1429)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startContext(WebAppContext.java:1387)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.lambda$doStart$0(ServletContextHandler.java:1066)\n\tat org.eclipse.jetty.server.handler.ContextHandler$ScopedContext.call(ContextHandler.java:1636)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.doStart(ServletContextHandler.java:1063)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.doStart(WebAppContext.java:520)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:170)\n\tat org.eclipse.jetty.server.Server.start(Server.java:689)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:121)\n\tat org.eclipse.jetty.server.Handler$Abstract.doStart(Handler.java:545)\n\tat org.eclipse.jetty.server.Server.doStart(Server.java:630)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat dev.dsf.common.jetty.JettyServer.start(JettyServer.java:374)\n\tat dev.dsf.fhir.FhirJettyServer.main(FhirJettyServer.java:56)\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.authorization.AuthorizationRule]: Factory method 'activityDefinitionAuthorizationRule' threw exception with message: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 36 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.referenceResolver(<generated>)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig.activityDefinitionAuthorizationRule(AuthorizationConfig.java:123)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$0.CGLIB$activityDefinitionAuthorizationRule$2(<generated>)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$0.activityDefinitionAuthorizationRule(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 39 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 60 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig.referenceResolver(ReferenceConfig.java:54)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.CGLIB$referenceResolver$0(<generated>)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.referenceResolver(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 63 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 84 more\nCaused by: java.lang.RuntimeException: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat dev.dsf.fhir.spring.config.ClientConfig.clientProvider(ClientConfig.java:92)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.CGLIB$clientProvider$1(<generated>)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 87 more\nCaused by: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:435)\n\tat de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:398)\n\tat dev.dsf.fhir.spring.config.ClientConfig.createKeyStore(ClientConfig.java:111)\n\tat dev.dsf.fhir.spring.config.ClientConfig.clientProvider(ClientConfig.java:79)\n\t... 95 more\nCaused by: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo.decryptPrivateKeyInfo(Unknown Source)\n\tat de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:430)\n\t... 98 more\nCaused by: org.bouncycastle.crypto.io.InvalidCipherTextIOException: Error finalising cipher\n\tat org.bouncycastle.jcajce.io.CipherInputStream.finaliseCipher(Unknown Source)\n\tat org.bouncycastle.jcajce.io.CipherInputStream.nextChunk(Unknown Source)\n\tat org.bouncycastle.jcajce.io.CipherInputStream.read(Unknown Source)\n\tat org.bouncycastle.util.io.Streams.pipeAll(Unknown Source)\n\tat org.bounc…",
+    "timestamp": 1768224186.0572188,
+    "level": 3,
+    "_logger": "org.springframework.web.context.ContextLoader",
+    "_thread": "main"
+}
+{
+    "version": "1.1",
+    "host": "f169cdb63fde",
+    "short_message": "Read of Organization/90500752-381a-46fa-858f-14d6d5b11627/_history/6 authorized for identity 'Test_Organization/webbrowser.test.user@invalid', matching access tag {ALL}",
+    "timestamp": 1768225406.81688,
+    "level": 6,
+    "_logger": "dev.dsf.fhir.authorization.AbstractMetaTagAuthorizationRule",
+    "_thread": "jetty-server-89",
+    "_dsf.user.endpoint.identifier": "fhir",
+    "_dsf.user.name": "Test_Organization/webbrowser.test.user@invalid",
+    "_dsf.user.organization.identifier": "Test_Organization",
+    "_dsf.user.practitioner.dn": "CN=Webbrowser Test User,O=DSF,C=DE",
+    "_dsf.user.practitioner.identifier": "webbrowser.test.user@invalid",
+    "_dsf.user.practitioner.roles": "[http://dsf.dev/fhir/CodeSystem/practitioner-role|DSF_ADMIN]",
+    "_dsf.user.practitioner.thumbprint": "a8874b56a7442fae17f27acc8f91a6b8f531c1855c9c7070ce04baf3a3ba17cc5cc337ba7cbd9cbb1a24d331ce99d2eb71c1368de1ae4b142084c696991214e7",
+    "_dsf.user.roles": "[CREATE, SEARCH, READ, UPDATE, HISTORY]"
+}
+```
+
+@tab:active JSON_LOGSTASH
+
+```json :no-line-numbers
+{
+    "@version": 1,
+    "source_host": "da524e19dd3e",
+    "message": "Artifact: dsf-fhir-server-jetty, version: 2.0.1, build: 2025-11-26T20:24:47+01:00, branch: main, commit: 77ac1d45a35fae8666d531953572ab6c51a58685",
+    "thread_name": "main",
+    "@timestamp": "2026-01-12T14:24:17.152+0100",
+    "level": "INFO",
+    "logger_name": "dev.dsf.common.buildinfo.BuildInfoReaderImpl"
+}
+{
+    "exception": {
+        "exception_class": "org.springframework.beans.factory.BeanCreationException",
+        "exception_message": "Error creating bean with name 'activityDefinitionAuthorizationRule' defined in dev.dsf.fhir.spring.config.AuthorizationConfig: Failed to instantiate [dev.dsf.fhir.authorization.AuthorizationRule]: Factory method 'activityDefinitionAuthorizationRule' threw exception with message: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher",
+        "stacktrace": "org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'activityDefinitionAuthorizationRule' defined in dev.dsf.fhir.spring.config.AuthorizationConfig: Failed to instantiate [dev.dsf.fhir.authorization.AuthorizationRule]: Factory method 'activityDefinitionAuthorizationRule' threw exception with message: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.instantiateSingleton(DefaultListableBeanFactory.java:1228)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingleton(DefaultListableBeanFactory.java:1194)\n\tat org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:1130)\n\tat org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:990)\n\tat org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:627)\n\tat org.springframework.web.context.ContextLoader.configureAndRefreshWebApplicationContext(ContextLoader.java:394)\n\tat org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:274)\n\tat org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:126)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.callContextInitialized(ServletContextHandler.java:1614)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.contextInitialized(ServletContextHandler.java:501)\n\tat org.eclipse.jetty.ee10.servlet.ServletHandler.initialize(ServletHandler.java:675)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.startContext(ServletContextHandler.java:1348)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startWebapp(WebAppContext.java:1429)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.startContext(WebAppContext.java:1387)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.lambda$doStart$0(ServletContextHandler.java:1066)\n\tat org.eclipse.jetty.server.handler.ContextHandler$ScopedContext.call(ContextHandler.java:1636)\n\tat org.eclipse.jetty.ee10.servlet.ServletContextHandler.doStart(ServletContextHandler.java:1063)\n\tat org.eclipse.jetty.ee10.webapp.WebAppContext.doStart(WebAppContext.java:520)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:170)\n\tat org.eclipse.jetty.server.Server.start(Server.java:689)\n\tat org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:121)\n\tat org.eclipse.jetty.server.Handler$Abstract.doStart(Handler.java:545)\n\tat org.eclipse.jetty.server.Server.doStart(Server.java:630)\n\tat org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:92)\n\tat dev.dsf.common.jetty.JettyServer.start(JettyServer.java:374)\n\tat dev.dsf.fhir.FhirJettyServer.main(FhirJettyServer.java:56)\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.authorization.AuthorizationRule]: Factory method 'activityDefinitionAuthorizationRule' threw exception with message: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 36 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'referenceResolver' defined in dev.dsf.fhir.spring.config.ReferenceConfig: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.referenceResolver(<generated>)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig.activityDefinitionAuthorizationRule(AuthorizationConfig.java:123)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$0.CGLIB$activityDefinitionAuthorizationRule$2(<generated>)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.fhir.spring.config.AuthorizationConfig$$SpringCGLIB$$0.activityDefinitionAuthorizationRule(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 39 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.service.ReferenceResolver]: Factory method 'referenceResolver' threw exception with message: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 60 more\nCaused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'clientProvider' defined in dev.dsf.fhir.spring.config.ClientConfig: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:657)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:489)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1375)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1205)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:569)\n\tat org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:529)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:339)\n\tat org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:373)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:337)\n\tat org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.resolveBeanReference(ConfigurationClassEnhancer.java:432)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:403)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig.referenceResolver(ReferenceConfig.java:54)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.CGLIB$referenceResolver$1(<generated>)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.fhir.spring.config.ReferenceConfig$$SpringCGLIB$$0.referenceResolver(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 63 more\nCaused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [dev.dsf.fhir.client.ClientProvider]: Factory method 'clientProvider' threw exception with message: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:200)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiateWithFactoryMethod(SimpleInstantiationStrategy.java:89)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:169)\n\tat org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653)\n\t... 84 more\nCaused by: java.lang.RuntimeException: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat dev.dsf.fhir.spring.config.ClientConfig.clientProvider(ClientConfig.java:92)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.CGLIB$clientProvider$1(<generated>)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$FastClass$$1.invoke(<generated>)\n\tat org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:258)\n\tat org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:400)\n\tat dev.dsf.fhir.spring.config.ClientConfig$$SpringCGLIB$$0.clientProvider(<generated>)\n\tat java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)\n\tat java.base/java.lang.reflect.Method.invoke(Method.java:565)\n\tat org.springframework.beans.factory.support.SimpleInstantiationStrategy.lambda$instantiate$0(SimpleInstantiationStrategy.java:172)\n\t... 87 more\nCaused by: java.io.IOException: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:435)\n\tat de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:398)\n\tat dev.dsf.fhir.spring.config.ClientConfig.createKeyStore(ClientConfig.java:111)\n\tat dev.dsf.fhir.spring.config.ClientConfig.clientProvider(ClientConfig.java:79)\n\t... 95 more\nCaused by: org.bouncycastle.pkcs.PKCSException: unable to read encrypted data: Error finalising cipher\n\tat org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo.decryptPrivateKeyInfo(Unknown Source)\n\tat de.hsheilbronn.mi.utils.crypto.io.PemReader.readPrivateKey(PemReader.java:430)\n\t... 98 more\nCaused by: org.bouncycastle.crypto.io.InvalidCipherTextIOException: Error finalising cipher\n\tat org.bouncycastle.jcajce.io.CipherInputStream.finaliseCipher(Unknown Source)\n\tat org.bouncycastle.jcajce.io.CipherInputStream.nextChunk(Unknown Source)\n\tat org.bouncycastle.jcajce.io.CipherInputStream.read(Unknown Source)\n\tat org.bouncycastle.util.io.Streams.pipeAll(Unknown Source)\n\tat org.bounc…"
+    },
+    "@version": 1,
+    "source_host": "da524e19dd3e",
+    "message": "Context initialization failed",
+    "thread_name": "main",
+    "@timestamp": "2026-01-12T14:24:18.486+0100",
+    "level": "ERROR",
+    "logger_name": "org.springframework.web.context.ContextLoader"
+}
+{
+    "mdc": {
+        "dsf.user.endpoint.identifier": "fhir",
+        "dsf.user.name": "Test_Organization/webbrowser.test.user@invalid",
+        "dsf.user.organization.identifier": "Test_Organization",
+        "dsf.user.practitioner.dn": "CN=Webbrowser Test User,O=DSF,C=DE",
+        "dsf.user.practitioner.identifier": "webbrowser.test.user@invalid",
+        "dsf.user.practitioner.roles": "[http://dsf.dev/fhir/CodeSystem/practitioner-role|DSF_ADMIN]",
+        "dsf.user.practitioner.thumbprint": "a8874b56a7442fae17f27acc8f91a6b8f531c1855c9c7070ce04baf3a3ba17cc5cc337ba7cbd9cbb1a24d331ce99d2eb71c1368de1ae4b142084c696991214e7",
+        "dsf.user.roles": "[UPDATE, READ, CREATE, HISTORY, SEARCH]"
+    },
+    "@version": 1,
+    "source_host": "4bc83d5bca72",
+    "message": "Read of Organization/90500752-381a-46fa-858f-14d6d5b11627/_history/7 authorized for identity 'Test_Organization/webbrowser.test.user@invalid', matching access tag {ALL}",
+    "thread_name": "jetty-server-89",
+    "@timestamp": "2026-01-12T14:44:52.948+0100",
+    "level": "INFO",
+    "logger_name": "dev.dsf.fhir.authorization.AbstractMetaTagAuthorizationRule"
+}
+```
+
+:::
+
+### Audit Logger
+The file, *stdout* and *stderr* outputs for the **Audit Logger** can be enabled or disabled using the environment variables [`DEV_DSF_LOG_AUDIT_FILE_ENABLED`](./configuration.md#dev-dsf-log-audit-file-enabled), [`DEV_DSF_LOG_AUDIT_CONSOLE_OUT_ENABLED`](./configuration.md#dev-dsf-log-audit-console-out-enabled) and [`DEV_DSF_LOG_AUDIT_CONSOLE_ERR_ENABLED`](./configuration.md#dev-dsf-log-audit-console-err-enabled).
+
+All audit messages are logged with the same severity level (INFO). Audit messages are not included in the Standard Application Logger output.
+
+#### Output Style
+Multiple styles are supported for the **Audit Logger** file, *stdout* and *stderr* outputs. All structured logging JSON styles include additional infos (Mapped Diagnostic Context) about the requesting user. The output style can be configured using the environment variables [`DEV_DSF_LOG_AUDIT_FILE_STYLE`](./configuration.md#dev-dsf-log-audit-file-style), [`DEV_DSF_LOG_AUDIT_CONSOLE_OUT_STYLE`](./configuration.md#dev-dsf-log-audit-console-out-style) and [`DEV_DSF_LOG_AUDIT_CONSOLE_ERR_STYLE`](./configuration.md#dev-dsf-log-audit-console-err-style).
+* **TEXT** a minimal text format.
+* **TEXT_MDC** text format with additional infos (Mapped Diagnostic Context) about the requesting user.
+* **JSON_ECS** follows the Elastic Common Schema (ECS) reference.
+* **JSON_GCP** uses the Google Cloud Platform structured logging model with additional `_thread`, `_logger` and `_exception` fields.
+* **JSON_GELF** follows the Graylog Extended Log Format (GELF) payload specification with added `_thread` and `_logger` fields.
+* **JSON_LOGSTASH** uses the Logstash json_event pattern for log4j.
+
+::: code-tabs#shell
+
+@tab TEXT
+
+```text :no-line-numbers
+2026-01-14 13:05:15,281 Read of Organization/6d40351b-2237-486f-8fa0-6bed0ca08e72/_history/6 allowed for identity 'Test_Organization/webbrowser.test.user@invalid', reason: Identity has role READ [Organization], matching access tag {ALL}
+2026-01-14 13:05:15,281 Read of Organization/6d40351b-2237-486f-8fa0-6bed0ca08e72/_history/6 for identity 'Test_Organization/webbrowser.test.user@invalid' successful, status: 200 OK
+```
+
+@tab TEXT_MDC
+
+```text :no-line-numbers
+2026-01-14 13:06:58,279 {dsf.user.endpoint.identifier=fhir, dsf.user.name=Test_Organization/webbrowser.test.user@invalid, dsf.user.organization.identifier=Test_Organization, dsf.user.practitioner.dn=CN=Webbrowser Test User,O=DSF,C=DE, dsf.user.practitioner.identifier=webbrowser.test.user@invalid, dsf.user.practitioner.roles=[http://dsf.dev/fhir/CodeSystem/practitioner-role|DSF_ADMIN], dsf.user.practitioner.thumbprint=a8874b56a7442fae17f27acc8f91a6b8f531c1855c9c7070ce04baf3a3ba17cc5cc337ba7cbd9cbb1a24d331ce99d2eb71c1368de1ae4b142084c696991214e7, dsf.user.roles=[HISTORY, READ, CREATE, UPDATE, SEARCH]} Read of Organization/6d40351b-2237-486f-8fa0-6bed0ca08e72/_history/7 allowed for identity 'Test_Organization/webbrowser.test.user@invalid', reason: Identity has role READ [Organization], matching access tag {ALL}
+2026-01-14 13:06:58,281 {dsf.user.endpoint.identifier=fhir, dsf.user.name=Test_Organization/webbrowser.test.user@invalid, dsf.user.organization.identifier=Test_Organization, dsf.user.practitioner.dn=CN=Webbrowser Test User,O=DSF,C=DE, dsf.user.practitioner.identifier=webbrowser.test.user@invalid, dsf.user.practitioner.roles=[http://dsf.dev/fhir/CodeSystem/practitioner-role|DSF_ADMIN], dsf.user.practitioner.thumbprint=a8874b56a7442fae17f27acc8f91a6b8f531c1855c9c7070ce04baf3a3ba17cc5cc337ba7cbd9cbb1a24d331ce99d2eb71c1368de1ae4b142084c696991214e7, dsf.user.roles=[HISTORY, READ, CREATE, UPDATE, SEARCH]} Read of Organization/6d40351b-2237-486f-8fa0-6bed0ca08e72/_history/7 for identity 'Test_Organization/webbrowser.test.user@invalid' successful, status: 200 OK
+```
+
+@tab JSON_ECS
+
+```json :no-line-numbers
+{
+    "@timestamp": "2026-01-14T12:10:18.467Z",
+    "ecs.version": "1.2.0",
+    "log.level": "INFO",
+    "message": "Read of Organization/6d40351b-2237-486f-8fa0-6bed0ca08e72/_history/8 allowed for identity 'Test_Organization/webbrowser.test.user@invalid', reason: Identity has role READ [Organization], matching access tag {ALL}",
+    "process.thread.name": "jetty-server-84",
+    "log.logger": "dsf-audit-logger",
+    "dsf.user.endpoint.identifier": "fhir",
+    "dsf.user.name": "Test_Organization/webbrowser.test.user@invalid",
+    "dsf.user.organization.identifier": "Test_Organization",
+    "dsf.user.practitioner.dn": "CN=Webbrowser Test User,O=DSF,C=DE",
+    "dsf.user.practitioner.identifier": "webbrowser.test.user@invalid",
+    "dsf.user.practitioner.roles": "[http://dsf.dev/fhir/CodeSystem/practitioner-role|DSF_ADMIN]",
+    "dsf.user.practitioner.thumbprint": "a8874b56a7442fae17f27acc8f91a6b8f531c1855c9c7070ce04baf3a3ba17cc5cc337ba7cbd9cbb1a24d331ce99d2eb71c1368de1ae4b142084c696991214e7",
+    "dsf.user.roles": "[UPDATE, READ, CREATE, HISTORY, SEARCH]"
+}
+{
+    "@timestamp": "2026-01-14T12:10:18.470Z",
+    "ecs.version": "1.2.0",
+    "log.level": "INFO",
+    "message": "Read of Organization/6d40351b-2237-486f-8fa0-6bed0ca08e72/_history/8 for identity 'Test_Organization/webbrowser.test.user@invalid' successful, status: 200 OK",
+    "process.thread.name": "jetty-server-84",
+    "log.logger": "dsf-audit-logger",
+    "dsf.user.endpoint.identifier": "fhir",
+    "dsf.user.name": "Test_Organization/webbrowser.test.user@invalid",
+    "dsf.user.organization.identifier": "Test_Organization",
+    "dsf.user.practitioner.dn": "CN=Webbrowser Test User,O=DSF,C=DE",
+    "dsf.user.practitioner.identifier": "webbrowser.test.user@invalid",
+    "dsf.user.practitioner.roles": "[http://dsf.dev/fhir/CodeSystem/practitioner-role|DSF_ADMIN]",
+    "dsf.user.practitioner.thumbprint": "a8874b56a7442fae17f27acc8f91a6b8f531c1855c9c7070ce04baf3a3ba17cc5cc337ba7cbd9cbb1a24d331ce99d2eb71c1368de1ae4b142084c696991214e7",
+    "dsf.user.roles": "[UPDATE, READ, CREATE, HISTORY, SEARCH]"
+}
+```
+
+@tab JSON_GCP
+
+```json :no-line-numbers
+{
+    "timestampSeconds": 1768392701,
+    "timestampNanos": 247233466,
+    "severity": "INFO",
+    "message": "Read of Organization/6d40351b-2237-486f-8fa0-6bed0ca08e72/_history/9 allowed for identity 'Test_Organization/webbrowser.test.user@invalid', reason: Identity has role READ [Organization], matching access tag {ALL}",
+    "logging.googleapis.com/labels": {
+        "dsf.user.endpoint.identifier": "fhir",
+        "dsf.user.name": "Test_Organization/webbrowser.test.user@invalid",
+        "dsf.user.organization.identifier": "Test_Organization",
+        "dsf.user.practitioner.dn": "CN=Webbrowser Test User,O=DSF,C=DE",
+        "dsf.user.practitioner.identifier": "webbrowser.test.user@invalid",
+        "dsf.user.practitioner.roles": "[http://dsf.dev/fhir/CodeSystem/practitioner-role|DSF_ADMIN]",
+        "dsf.user.practitioner.thumbprint": "a8874b56a7442fae17f27acc8f91a6b8f531c1855c9c7070ce04baf3a3ba17cc5cc337ba7cbd9cbb1a24d331ce99d2eb71c1368de1ae4b142084c696991214e7",
+        "dsf.user.roles": "[UPDATE, CREATE, SEARCH, READ, HISTORY]"
+    },
+    "logging.googleapis.com/sourceLocation": {
+        "function": "dev.dsf.fhir.webservice.secure.AbstractResourceServiceSecure.checkRead"
+    },
+    "logging.googleapis.com/trace_sampled": true,
+    "thread": "jetty-server-76",
+    "logger": "dsf-audit-logger"
+}
+{
+    "timestampSeconds": 1768392701,
+    "timestampNanos": 249559501,
+    "severity": "INFO",
+    "message": "Read of Organization/6d40351b-2237-486f-8fa0-6bed0ca08e72/_history/9 for identity 'Test_Organization/webbrowser.test.user@invalid' successful, status: 200 OK",
+    "logging.googleapis.com/labels": {
+        "dsf.user.endpoint.identifier": "fhir",
+        "dsf.user.name": "Test_Organization/webbrowser.test.user@invalid",
+        "dsf.user.organization.identifier": "Test_Organization",
+        "dsf.user.practitioner.dn": "CN=Webbrowser Test User,O=DSF,C=DE",
+        "dsf.user.practitioner.identifier": "webbrowser.test.user@invalid",
+        "dsf.user.practitioner.roles": "[http://dsf.dev/fhir/CodeSystem/practitioner-role|DSF_ADMIN]",
+        "dsf.user.practitioner.thumbprint": "a8874b56a7442fae17f27acc8f91a6b8f531c1855c9c7070ce04baf3a3ba17cc5cc337ba7cbd9cbb1a24d331ce99d2eb71c1368de1ae4b142084c696991214e7",
+        "dsf.user.roles": "[UPDATE, CREATE, SEARCH, READ, HISTORY]"
+    },
+    "logging.googleapis.com/sourceLocation": {
+        "function": "dev.dsf.fhir.webservice.secure.AbstractResourceServiceSecure.lambda$checkRead$1"
+    },
+    "logging.googleapis.com/trace_sampled": true,
+    "thread": "jetty-server-76",
+    "logger": "dsf-audit-logger"
+}
+```
+
+@tab JSON_GELF
+
+```json :no-line-numbers
+{
+    "version": "1.1",
+    "host": "5061409e4b61",
+    "short_message": "Read of Organization/6d40351b-2237-486f-8fa0-6bed0ca08e72/_history/10 allowed for identity 'Test_Organization/webbrowser.test.user@invalid', reason: Identity has role READ [Organization], matching access tag {ALL}",
+    "timestamp": 1768393090.890408,
+    "level": 6,
+    "_logger": "dsf-audit-logger",
+    "_thread": "jetty-server-63",
+    "_dsf.user.endpoint.identifier": "fhir",
+    "_dsf.user.name": "Test_Organization/webbrowser.test.user@invalid",
+    "_dsf.user.organization.identifier": "Test_Organization",
+    "_dsf.user.practitioner.dn": "CN=Webbrowser Test User,O=DSF,C=DE",
+    "_dsf.user.practitioner.identifier": "webbrowser.test.user@invalid",
+    "_dsf.user.practitioner.roles": "[http://dsf.dev/fhir/CodeSystem/practitioner-role|DSF_ADMIN]",
+    "_dsf.user.practitioner.thumbprint": "a8874b56a7442fae17f27acc8f91a6b8f531c1855c9c7070ce04baf3a3ba17cc5cc337ba7cbd9cbb1a24d331ce99d2eb71c1368de1ae4b142084c696991214e7",
+    "_dsf.user.roles": "[CREATE, SEARCH, HISTORY, READ, UPDATE]"
+}
+{
+    "version": "1.1",
+    "host": "5061409e4b61",
+    "short_message": "Read of Organization/6d40351b-2237-486f-8fa0-6bed0ca08e72/_history/10 for identity 'Test_Organization/webbrowser.test.user@invalid' successful, status: 200 OK",
+    "timestamp": 1768393090.8934536,
+    "level": 6,
+    "_logger": "dsf-audit-logger",
+    "_thread": "jetty-server-63",
+    "_dsf.user.endpoint.identifier": "fhir",
+    "_dsf.user.name": "Test_Organization/webbrowser.test.user@invalid",
+    "_dsf.user.organization.identifier": "Test_Organization",
+    "_dsf.user.practitioner.dn": "CN=Webbrowser Test User,O=DSF,C=DE",
+    "_dsf.user.practitioner.identifier": "webbrowser.test.user@invalid",
+    "_dsf.user.practitioner.roles": "[http://dsf.dev/fhir/CodeSystem/practitioner-role|DSF_ADMIN]",
+    "_dsf.user.practitioner.thumbprint": "a8874b56a7442fae17f27acc8f91a6b8f531c1855c9c7070ce04baf3a3ba17cc5cc337ba7cbd9cbb1a24d331ce99d2eb71c1368de1ae4b142084c696991214e7",
+    "_dsf.user.roles": "[CREATE, SEARCH, HISTORY, READ, UPDATE]"
+}
+```
+
+@tab:active JSON_LOGSTASH
+
+```json :no-line-numbers
+{
+    "mdc": {
+        "dsf.user.endpoint.identifier": "fhir",
+        "dsf.user.name": "Test_Organization/webbrowser.test.user@invalid",
+        "dsf.user.organization.identifier": "Test_Organization",
+        "dsf.user.practitioner.dn": "CN=Webbrowser Test User,O=DSF,C=DE",
+        "dsf.user.practitioner.identifier": "webbrowser.test.user@invalid",
+        "dsf.user.practitioner.roles": "[http://dsf.dev/fhir/CodeSystem/practitioner-role|DSF_ADMIN]",
+        "dsf.user.practitioner.thumbprint": "a8874b56a7442fae17f27acc8f91a6b8f531c1855c9c7070ce04baf3a3ba17cc5cc337ba7cbd9cbb1a24d331ce99d2eb71c1368de1ae4b142084c696991214e7",
+        "dsf.user.roles": "[UPDATE, READ, HISTORY, CREATE, SEARCH]"
+    },
+    "@version": 1,
+    "source_host": "df1d729560c0",
+    "message": "Read of Organization/6d40351b-2237-486f-8fa0-6bed0ca08e72/_history/11 allowed for identity 'Test_Organization/webbrowser.test.user@invalid', reason: Identity has role READ [Organization], matching access tag {ALL}",
+    "thread_name": "jetty-server-89",
+    "@timestamp": "2026-01-14T13:19:02.403+0100",
+    "level": "INFO",
+    "logger_name": "dsf-audit-logger"
+}
+{
+    "mdc": {
+        "dsf.user.endpoint.identifier": "fhir",
+        "dsf.user.name": "Test_Organization/webbrowser.test.user@invalid",
+        "dsf.user.organization.identifier": "Test_Organization",
+        "dsf.user.practitioner.dn": "CN=Webbrowser Test User,O=DSF,C=DE",
+        "dsf.user.practitioner.identifier": "webbrowser.test.user@invalid",
+        "dsf.user.practitioner.roles": "[http://dsf.dev/fhir/CodeSystem/practitioner-role|DSF_ADMIN]",
+        "dsf.user.practitioner.thumbprint": "a8874b56a7442fae17f27acc8f91a6b8f531c1855c9c7070ce04baf3a3ba17cc5cc337ba7cbd9cbb1a24d331ce99d2eb71c1368de1ae4b142084c696991214e7",
+        "dsf.user.roles": "[UPDATE, READ, HISTORY, CREATE, SEARCH]"
+    },
+    "@version": 1,
+    "source_host": "df1d729560c0",
+    "message": "Read of Organization/6d40351b-2237-486f-8fa0-6bed0ca08e72/_history/11 for identity 'Test_Organization/webbrowser.test.user@invalid' successful, status: 200 OK",
+    "thread_name": "jetty-server-89",
+    "@timestamp": "2026-01-14T13:19:02.406+0100",
+    "level": "INFO",
+    "logger_name": "dsf-audit-logger"
+}
+```
+
+:::
+
+### Custom Logging Config
+A fully custom log4j2 xml logging config can be set via the environment variable [`DEV_DSF_LOG_CONFIG`](./configuration.md#dev-dsf-log-config).
diff --git a/docs/src/operations/v2.0.2/fhir/oidc.md b/docs/src/operations/v2.0.2/fhir/oidc.md
new file mode 100644
index 000000000..519c6625f
--- /dev/null
+++ b/docs/src/operations/v2.0.2/fhir/oidc.md
@@ -0,0 +1,63 @@
+---
+title: OpenID Connect
+icon: config
+---
+
+## Overview
+Access to the DSF FHIR server REST API and user interface can be configured via [access control roles](access-control). By default users are only authenticated using X.509 client certificates, but authentication for local users via OAuth 2.0 OpenID Connect can also be enabled.
+
+The DSF FHIR server supports [Authorization Code Flow](https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth) for the user interface as well as [Bearer Token Authentication](https://datatracker.ietf.org/doc/html/rfc6750) for the REST API. [Back-Channel Logout](https://openid.net/specs/openid-connect-backchannel-1_0.html) is also supported.
+
+
+::: tip FHIR Reverse Proxy
+The DSF FHIR reverse proxy requires client certificates by default. To use OpenID Connect authentication the configuration parameter [SSL_VERIFY_CLIENT](../fhir-reverse-proxy/configuration.html#ssl-verify-client) needs to be set to `optional`.
+:::
+
+
+## Authorization Code Flow
+
+To enable authentication via OpenID Connect authorization code flow, set the configuration parameter [DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW](configuration#dev-dsf-server-auth-oidc-authorization-code-flow) to `true` and specify the following parameters:
+
+- [DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL](configuration#dev-dsf-server-auth-oidc-provider-realm-base-url)
+- [DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID](configuration#dev-dsf-server-auth-oidc-client-id)
+- [DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET](configuration#dev-dsf-server-auth-oidc-client-secret)
+
+Optionally, back channel logout can be enabled by setting [DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT](configuration#dev-dsf-server-auth-oidc-back-channel-logout) to `true`. The DSF FHIR server accepts logout tokens at [DEV_DSF_FHIR_SERVER_BASE_URL](configuration#dev-dsf-fhir-server-base-url) + `/back-channel-logout`. The path can be modified via [DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT_PATH](configuration#dev-dsf-server-auth-oidc-back-channel-logout-path).
+
+
+## Bearer Token Authentication
+
+To enable bearer token authentication, set the configuration parameter [DEV_DSF_SERVER_AUTH_OIDC_BEARER_TOKEN](configuration#dev-dsf-server-auth-oidc-bearer-token) to `true` and specify the following parameter:
+- [DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL](configuration#dev-dsf-server-auth-oidc-provider-realm-base-url)
+
+
+## Additional ODIC Configuration Parameter
+
+A number of additional `DEV_DSF_SERVER_AUTH_OIDC ...` configuration parameter are specify on the DSF FHIR server [configuration parameter page](configuration).
+
+For example the configuration parameter [DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS](configuration#dev-dsf-server-auth-oidc-provider-client-trust-server-certificate-cas) can be used to specify a PEM encoded file with trusted root certificates to be used when accessing the OpenID Connect provider. If not specify the JVM default trusted root certificates are used for this connection.
+
+
+## Example
+```yaml
+services:
+  app:
+    image: ghcr.io/datasharingframework/fhir:1.5.2
+    # ...
+    secrets:
+      - keycloak_root_ca.pem
+      # ...
+    environment:
+      # ...
+      DEV_DSF_SERVER_AUTH_OIDC_AUTHORIZATION_CODE_FLOW: 'true'
+      DEV_DSF_SERVER_AUTH_OIDC_BACK_CHANNEL_LOGOUT: 'true'
+      DEV_DSF_SERVER_AUTH_OIDC_BEARER_TOKEN: 'true'
+      DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_REALM_BASE_URL: https://keycloak.test.org/realms/dsf
+      DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS: /run/secrets/keycloak_root_ca.pem
+      DEV_DSF_SERVER_AUTH_OIDC_CLIENT_ID: dsf-fhir
+      DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET: n9bCMtjugv3Y_.szktXyQ2RH5se+J%o3
+    # ...
+secrets:
+  keycloak_root_ca.pem:
+    file: ./secrets/keycloak_root_ca.pem
+```
\ No newline at end of file
diff --git a/docs/src/operations/v2.0.2/index.md b/docs/src/operations/v2.0.2/index.md
new file mode 100644
index 000000000..fb1ede9a7
--- /dev/null
+++ b/docs/src/operations/v2.0.2/index.md
@@ -0,0 +1,23 @@
+---
+title: DSF 2.0.2
+icon: guide
+---
+
+Data Sharing Framework 2.x is the new upcoming release of the Data Sharing Framework.
+
+
+# System Administrators
+
+- [Install DSF 2.0.2](install)
+- [Upgrade from DSF 1.9.0](upgrade-from-1)
+
+
+## New features
+- See [Release Notes](https://github.com/datasharingframework/dsf/releases/tag/v2.0.2)
+
+<!--
+This breaks the page with a 
+Hydration completed but contains mismatches.
+error
+<releas-notes  path="release-notes.md" />
+-->
diff --git a/docs/src/operations/v2.0.2/install-plugins.md b/docs/src/operations/v2.0.2/install-plugins.md
new file mode 100644
index 000000000..be61ca4a8
--- /dev/null
+++ b/docs/src/operations/v2.0.2/install-plugins.md
@@ -0,0 +1,78 @@
+---
+title: Install Plugins
+icon: plugin
+---
+
+
+## **Overview**
+- You can find an overview of compatable process plugins below (last updated 2026-01-19).
+
+
+| Process Plugin | released for test | released for production |
+| -------------- | ----------------- | ----------------------- |
+| [Ping-Pong](https://github.com/datasharingframework/dsf-process-ping-pong/releases) | [v1.0.1.0](https://github.com/datasharingframework/dsf-process-ping-pong/releases/tag/v1.0.1.0) & [v2.0.0.2](https://github.com/datasharingframework/dsf-process-ping-pong/releases/tag/v2.0.0.2) | [v1.0.1.0](https://github.com/datasharingframework/dsf-process-ping-pong/releases/tag/v1.0.1.0) & [v2.0.0.2](https://github.com/datasharingframework/dsf-process-ping-pong/releases/tag/v2.0.0.2) |
+| [Allow-List](https://github.com/datasharingframework/dsf-process-allow-list/releases) | [v1.0.0.1](https://github.com/datasharingframework/dsf-process-allow-list/releases/tag/v1.0.0.1) | [v1.0.0.1](https://github.com/datasharingframework/dsf-process-allow-list/releases/tag/v1.0.0.1) |
+| [MII Process Feasibility](https://github.com/medizininformatik-initiative/mii-process-feasibility/releases) | [v1.0.0.11](https://github.com/medizininformatik-initiative/mii-process-feasibility/releases/tag/v1.0.0.11) | [v1.0.0.11](https://github.com/medizininformatik-initiative/mii-process-feasibility/releases/tag/v1.0.0.11) |
+| [MII Process Report](https://github.com/medizininformatik-initiative/mii-process-report/releases) | [v1.2.0.1](https://github.com/medizininformatik-initiative/mii-process-report/releases/tag/v1.2.0.1) | [v1.2.0.1](https://github.com/medizininformatik-initiative/mii-process-report/releases/tag/v1.2.0.1) |
+| [MII Process Data Transfer](https://github.com/medizininformatik-initiative/mii-process-data-transfer/releases) | [v1.1.0.1](https://github.com/medizininformatik-initiative/mii-process-data-transfer/releases/tag/v1.1.0.1) | [v1.1.0.1](https://github.com/medizininformatik-initiative/mii-process-data-transfer/releases/tag/v1.1.0.1) |
+| [MII Process Data Sharing](https://github.com/medizininformatik-initiative/mii-process-data-sharing/releases) | [v1.1.0.0](https://github.com/medizininformatik-initiative/mii-process-data-sharing/releases/tag/v1.1.0.0) | [v1.1.0.0](https://github.com/medizininformatik-initiative/mii-process-data-sharing/releases/tag/v1.1.0.0) |
+| [NUM Dashboard Report](https://github.com/medizininformatik-initiative/dsf-plugin-numdashboard/releases) [Note](#num-dashboard-report-on-dsf-2) | [v1.1.0.0](https://github.com/medizininformatik-initiative/dsf-plugin-numdashboard/releases/tag/v1.1.0.0) | [v1.1.0.0](https://github.com/medizininformatik-initiative/dsf-plugin-numdashboard/releases/tag/v1.1.0.0) |
+
+- Deploying the process plugin to the DSF involves copy the process jar-file and configuring environment variable for the business process engine (BPE).
+
+
+### Prerequisites
+- A DSF installation of version 2.0.0 or higher. An installation guide can be found [here](https://dsf.dev/operations/latest/install.html).
+
+### Deployment
+- Add the process jar-file to the DSF BPE folder `/opt/bpe/process`: 
+```
+wget (your jar-file download link)
+```
+
+For example:
+```
+ wget https://github.com/medizininformatik-initiative/mii-process-data-sharing/releases/download/v1.1.0.0/mii-process-data-sharing-1.1.0.0.jar
+```
+
+- Make sure the process is readable by the bpe user or group, for example by executing:
+```
+sudo chmod 440 (your jar-file name.jar)
+sudo chown root:bpe (your jar-file name.jar)
+```
+For example:
+```
+sudo chmod 440 mii-process-data-sharing-1.1.0.0.jar
+sudo chown root:bpe mii-process-data-sharing-1.1.0.0.jar
+```
+
+- Modify the process exclude config in `/opt/bpe/docker-compose.yml`
+- **Reminder:** Update/verify required configurations in `docker-compose.yml`
+
+
+### NUM Dashboard Report on DSF 2
+The NUM Dashboard Report Plugin is now fully compabile with DSF 2.0.2 and above. If you implemented the workaround for DSF 2.0.1 and below, you can remove it:
+
+
+1. Remove the file with the name `api-v1-allowed-bpe-classes.list`
+
+
+2. Edit the `docker-compose.yml` file and remove the following volume and environment variable:
+
+```yaml
+...
+  app:
+    image: ghcr.io/datasharingframework/bpe:2.0.2
+...
+    volumes:
+...
+      - type: bind
+        source: api-v1-allowed-bpe-classes.list
+        target: /api-v1-allowed-bpe-classes.list
+...
+    environment:
+      DEV_DSF_BPE_PROCESS_API_ALLOWED_BPE_CLASSES: "{v1: '/api-v1-allowed-bpe-classes.list'}"
+...
+```
+
+3. Restart the application container with `docker compose up -d && docker compose logs -f`.
diff --git a/docs/src/operations/v2.0.2/install.md b/docs/src/operations/v2.0.2/install.md
new file mode 100644
index 000000000..6f4129a3f
--- /dev/null
+++ b/docs/src/operations/v2.0.2/install.md
@@ -0,0 +1,228 @@
+---
+title: Install DSF 2.0.2
+icon: install
+---
+
+In the following installation manual we will show you how you can install your own DSF instance to be part of an already existing DSF network.
+
+
+## Prerequisites
+### Virtual Machines
+* DSF FHIR VM: min. 4 GB RAM, 4 vCPU, 100 GB HDD
+* DSF BPE VM: min. 8 GB RAM, 4 vCPU, 20 GB HDD
+
+If you plan to transfer a lot of large files, we recommend a larger FHIR VM disk for temporary storage (if your largest file to transfer is 200GB in size, we recommend a disk with a size of at least 1TB).
+
+Please make sure to use a CPU with a modern instruction set with crypto acceleration enabled. We saw large performance drops on systems with inadequate hardware.
+
+### Docker / Docker-Compose
+Both VMs need latest docker and docker compose. For the latest install guide see https://docs.docker.com/engine/install. 
+
+```
+sudo apt-get update
+sudo apt-get install apt-transport-https ca-certificates curl gnupg lsb-release
+curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg
+echo "deb [arch=amd64 signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+sudo apt-get update
+sudo apt-get install docker-ce docker-ce-cli containerd.io docker-compose-plugin
+sudo systemctl enable docker.service
+sudo systemctl enable containerd.service
+```
+
+The current version of docker compose is installed with the current docker version.
+
+### Client/Server Certificates
+Two Certificates from a list of allowed certificate authorities (see [details about certificates](root-certificates.html)) are needed:
+* Certificate _A_: Server Certificate  - `TLS Web Server Authentication`
+* Certificate _B_: Client Certificate  - `TLS Web Client Authentication`
+
+If you use GÉANT TCS certificates, then they are configured by default with the necessary *X509v3 Extended Key Usage*s until the end of February 2026: `TLS Web Server Authentication, TLS Web Client Authentication`.
+
+For further details on supported Root Certificate Authorities click [here](root-certificates.html#list-of-default-trusted-certificate-authorities)
+
+
+### Network setup / Network access
+
+* The DSF FHIR server needs to be accessible via the internet and able to access the internet without TLS interception.
+* The BPE FHIR server should only be accessible by the internal network and able to access your DSF FHIR server via its external FQDN and the internet without TLS interception.
+
+Here is a quick overview of the expected network setup.
+
+| Source                        | Target                        | Port | Protocol               |
+| ----------------------------- | ----------------------------- | ---- | ---------------------- |
+| DSF BPE (local)               | DSF FHIR (local)              | 443  | https, wss             |
+| DSF BPE (local)               | DSF FHIR (other DSF communication partners)	| 443  | https                  |
+| DSF FHIR (local)              | DSF FHIR (other DSF communication partners)	| 443  | https (HTTP HEAD only) |
+| DSF BPE (other DSF communication partners)  | DSF FHIR (local)              | 443  | https                  |
+| DSF FHIR (other DSF communication partners) | DSF FHIR (local)              | 443  | https (HTTP HEAD only) |
+
+ Connections to services that are used by process plugins (e.g. a fTTP, a terminology server, simplifier.net or a local FHIR server) are not listed. Please refer to the respective process plugin documentation pages for more information.
+
+
+
+## Setup
+### Prepare Certificates
+1. Server Certificate (certificate _A_)  
+    _This certificate will be used as the DSF FHIR servers server certificate (ssl_certificate_file.pem, ssl_certificate_key_file.pem)_
+    * Store PEM encoded certificate as `ssl_certificate_file.pem`
+    * Store unencrypted, PEM encoded private-key as `ssl_certificate_key_file.pem`
+    * Store PEM encoded certificate chain (all intermediate CAs between the server and the root certificate, excluding root) as `ssl_certificate_chain_file.pem`
+
+1. Client Certificate (Certificate _B_)  
+    _This certificate will be used as the DSF BPE servers client certificate (client_certificate.pem, client_certificate_private_key.pem) as well as the DSF FHIR servers client certificate (client_certificate.pem, client_certificate_private_key.pem)_
+    * Store PEM encoded certificate as `client_certificate.pem`
+    * Store encrypted or not encrypted, PEM encoded private-key as `client_certificate_private_key.pem`
+
+### DSF FHIR Server
+1. Add Group/User  
+    Add group and user used by the DSF FHIR java application. Ubuntu compatible commands below:
+    ```
+    sudo groupadd --gid 2101 fhir
+    sudo useradd --system --no-create-home --uid 2101 --gid 2101 fhir
+    ```
+
+1. Download and Extract Config Files  
+    Download and unpack the prepared DSF FHIR server config files and folder structure:
+    ```
+    cd /opt
+    wget https://dsf.dev/download/dsf_fhir_2_0_2.tar.gz
+    sudo tar --same-owner -zxvf dsf_fhir_2_0_2.tar.gz
+    ```
+    _The `tar` command will unpack the config files at `/opt/fhir` assuming you changed into the `/opt` directory._
+
+1. Verify that the `fhir` system user or group can write into the following folder
+   * `/opt/fhir/log`
+
+1. Add certificates and keys
+    * Add the server certificate (certificate _A_), the corresponding private-key and the certificate chain (one file with all intermediate certificates, excluding the root CA) to **/opt/fhir/secrets/**
+        * ssl_certificate_file.pem (chmod: 440, chown: root:4101, 4101 is the user of the fhir proxy)
+        * ssl_certificate_key_file.pem (chmod: 440, chown: root:4101)
+        * ssl_certificate_chain_file.pem  (chmod: 444, chown: root:fhir)
+    * Add the client certificate (Certificate _B_) and the corresponding private-key to **/opt/fhir/secrets/**
+        * client_certificate.pem (chmod: 440, chown: root:fhir)
+        * client_certificate_private_key.pem (chmod: 440, chown: root:fhir)
+    * If the private key is encrypted, add a password file with the password as the only content to **/opt/fhir/secrets/client_certificate_private_key.pem.password**
+    * If the private key is not encrypted, remove the corresponding docker secret lines from the `docker-compose.yml` file
+        ```
+        L37:      - app_client_certificate_private_key.pem.password
+        ...
+        L50:      DEV_DSF_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE: /run/secrets/app_client_certificate_private_key.pem.password
+        ...
+        L108:  app_client_certificate_private_key.pem.password:
+        L109:    file: ./secrets/client_certificate_private_key.pem.password
+        ```
+
+    ::: tip How to chmod / chown
+    For the example *ssl_certificate_file.pem (chmod: 440, chown: root:4101)* you must:
+
+    1. Set the file content as requested
+    2. Change the file permissions to 440 (allow read access to the owner of the file and the group the file belongs to, deny write access to everybody and deny read for other users):
+    `chmod 440 /opt/fhir/secrets/ssl_certificate_file.pem`
+    3. Change the owner of the file to the user root and the group the file belongs to to the id 4101:
+    `chown fhir:docker /opt/fhir/secrets/ssl_certificate_file.pem`
+
+    :::
+
+1. Modify database passwords
+    * **/opt/fhir/secrets/db_liquibase.password**
+        * Generate a random password (min. 32 characters recommended) and replace the content of the file.
+    * **/opt/fhir/secrets/db_user.password**
+        * Generate a random password (min. 16 characters recommended) and replace the content of the file.
+    * **/opt/fhir/secrets/db_user_permanent_delete.password**
+        * Generate a random password (min. 16 characters recommended) and replace the content of the file.
+
+1. Modify the docker-compose.yml file and set environment variables to the appropriate values
+    * **services -> proxy -> environment:**
+        * **HTTPS_SERVER_NAME_PORT**: `dsf.todo.organization.com:443`
+            Set your FHIR servers external FQDN, e.g. `https://foo.bar.de` -> `foo.bar.de:443`
+        * For additional environment variables, see the FHIR Reverse Proxy [Configuration Parameters](fhir-reverse-proxy/configuration) page.
+    * **services -> app -> environment:**
+        * **DEV_DSF_FHIR_SERVER_ORGANIZATION_IDENTIFIER_VALUE**: `todo.organization.com`  
+            Set your Organizations DSF identifier, aka the shortest FQDN that resolves to the main homepage of the organization, e.g. `hs-heilbronn.de`
+        * **DEV_DSF_FHIR_SERVER_BASE_URL**: `https://dsf.todo.organization.com/fhir`  
+            Set your FHIR servers external FQDN, e.g. `foo.bar.de` -> `https://foo.bar.de/fhir`
+        * **DEV_DSF_FHIR_SERVER_ROLECONFIG**: `|`
+            (Optional) You can add other client certificates (e.g. personal certificates from admins) to your DSF instance. For additional information, see the FHIR server [Access Control](fhir/access-control) page.
+            
+        * For additional environment variables, see the FHIR server [Configuration Parameters](fhir/configuration) page.
+
+1. Start the DSF FHIR Server  
+    Start using: `docker compose up -d && docker compose logs -f` (Ctrl-C will close log, but not stop container)
+
+### DSF BPE Server
+1. Add Group/User  
+    Add group and user used by the DSF BPE java application. Ubuntu compatible commands below:
+    ```
+    sudo groupadd --gid 2202 bpe
+    sudo useradd --system --no-create-home --uid 2202 --gid 2202 bpe
+    ```
+1. Download and Extract Config Files  
+    Download and extract prepared DSF BPE server config files and folder structure:  
+    ```
+    cd /opt
+    wget https://dsf.dev/download/dsf_bpe_2_0_2.tar.gz
+    sudo tar --same-owner -zxvf dsf_bpe_2_0_2.tar.gz
+    ```
+    _The `tar` command will unpack the config files at `/opt/bpe` assuming you changed into the `/opt` directory._
+
+1. Verify that the `bpe` system user or group can write into the following folders
+   * `/opt/bpe/log`
+
+1. Add certificates and keys
+    * Add the client certificate (Certificate _B_) and the corresponding private-key to **/opt/bpe/secrets/**
+        * client_certificate.pem (chmod: 440 chown: root:bpe)
+        * client_certificate_private_key.pem (chmod: 440 chown: root:bpe)
+    * If the private key is encrypted, add a password file with the password as the only content to **/opt/bpe/secrets/client_certificate_private_key.pem.password**
+    * If the private key is not encrypted, remove the corresponding docker secret lines from the `docker-compose.yml` file
+        ```
+        L11:      - app_client_certificate_private_key.pem.password
+        ...
+        L31:      DEV_DSF_BPE_FHIR_CLIENT_CERTIFICATE_PRIVATE_KEY_PASSWORD_FILE: /run/secrets/app_client_certificate_private_key.pem.password
+        ...
+        L82:  app_client_certificate_private_key.pem.password:
+        L83:    file: ./secrets/client_certificate_private_key.pem.password
+        ```
+1. Modify database passwords
+    * **/opt/bpe/secrets/db_liquibase.password**
+        * Generate a random password (min. 32 characters recommended) and replace the content of the file.
+    * **/opt/bpe/secrets/db_user.password**
+        * Generate a random password (min. 16 characters recommended) and replace the content of the file.
+    * **/opt/bpe/secrets/db_user_camunda.password**
+        * Generate a random password (min. 16 characters recommended) and replace the content of the file.
+
+1. Modify the docker-compose.yml file and set environment variables to the appropriate values
+    * **services -> app -> environment:**
+        * **DEV_DSF_BPE_FHIR_SERVER_BASE_URL**: `https://dsf.todo.organization.com/fhir`  
+            Set your FHIR servers external FQDN, e.g. `foo.bar.de` -> `https://foo.bar.de/fhir`
+            
+        * For additional environment variables, see the BPE server [Configuration Parameters](bpe/configuration) page.
+
+1. Start the DSF BPE Server (without process plugins)  
+    Start using: `docker compose up -d && docker compose logs -f` (Ctrl-C will close log, but not stop container)
+
+1. Verify DSF BPE Startup  
+    * Check that the BPE was able to download new Task resources from the DSF FHIR server during startup.
+    * Check that the BPE was able to download a Subscription resource from the DSF FHIR server during startup.
+    * Check that the BPE was able to connect to the websocket endpoint of the DSF FHIR server during startup.
+
+    If you need to debug the TLS connection to your DSF FHIR server use for example:  
+    `docker run -it --rm alpine/openssl s_client your-fhir-server.fqdn:443`  
+    The command above should print the server certificate of your DSF FHIR server (certificate _A_) and end with a message like `[...]tlsv13 alert certificate required[...]`
+
+
+### Logs
+By default, we will log both to the console (collected by docker) and to files in the log directory, so you can use `docker compose logs -f` in `/opt/bpe` and `/opt/fhir` to view informational, warning and error logs. If you encounter any error and the reported information is not detailed enough, you can also check the logs in the `/opt/fhir/log` and `/opt/bpe/log` directories with debugging logs. There, you will also find older log files. If you have any questions and can't resolve them by yourself please always include the latest logs from `/opt/fhir/log` and `/opt/bpe/log` in your support request.
+
+On a successful BPE start, you should see the following entries in your BPE log:
+
+```
+INFO Grizzly(1) -  INFO Grizzly(1) - ClientEndpoint.onOpen(37) | Websocket open, session SOME_RANDOM_UUID1
+INFO Grizzly(1) -  INFO Grizzly(1) - ClientEndpoint.onOpen(37) | Websocket open, session SOME_RANDOM_UUID2
+```
+
+### On-Boarding
+Please visit the on boarding website of your network for more information.
+
+::: tip Ideas for improvement?
+Have you found an error or is something unclear to you? Then please feel free to write to us at <a href="mailto:dsf-gecko@hs-heilbronn.de">dsf-gecko@hs-heilbronn.de</a>. Thank you very much!
+:::
\ No newline at end of file
diff --git a/docs/src/operations/v2.0.2/passwords-secrets.md b/docs/src/operations/v2.0.2/passwords-secrets.md
new file mode 100644
index 000000000..62bb2ef1f
--- /dev/null
+++ b/docs/src/operations/v2.0.2/passwords-secrets.md
@@ -0,0 +1,33 @@
+---
+title: Passwords and Secrets
+icon: safe
+---
+
+Environment variables ending in `_PASSWORD` or `_SECRET` can be configured using plain-text files. To achieve this, environment variable should be defined with `_FILE` appended to the name with the value defined as the location of the file. For all variables ending in `_PASSWORD_FILE` or `_SECRET_FILE` the DSF FHIR and DSF BPE applications will read the content of the fist line of the referenced file and dynamically define the corresponding `_PASSWORD` or `_SECRET` environment variables with the read values.
+
+### Example Environment Variables
+- **DEV_DSF_BPE_DB_USER_PASSWORD_FILE**: If set to `/run/secrets/db_user_password`, the application will read the contents of the `/run/secrets/db_user_password` file and set the `DEV_DSF_BPE_DB_USER_PASSWORD` environment variable with the content from that file.
+- **DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE**: If set to `/run/secrets/oidc_client_secret`, the application will read the contents of the referenced file and set the `DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET` environment variable accordingly.
+
+### Docker Secrets
+
+It is recommended to use [docker secrets](https://docs.docker.com/compose/how-tos/use-secrets) as files for these environment variables. Docker secrets are mounted as files in `/run/secrets/<secret_name>` inside the container.
+
+#### Example docker-compose
+```yaml
+services:
+  app:
+    image: ghcr.io/datasharingframework/fhir
+    secrets:
+      - db_user_password
+      - oidc_client_secret
+    environment:
+      DEV_DSF_BPE_DB_USER_PASSWORD_FILE: /run/secrets/db_user_password
+      DEV_DSF_SERVER_AUTH_OIDC_CLIENT_SECRET_FILE: /run/secrets/oidc_client_secret
+
+secrets:
+  db_user_password:
+    file: ./secrets/db_user.password
+  api_key:
+    file: ./secrets/oidc_client.secret
+```
\ No newline at end of file
diff --git a/docs/src/operations/v2.0.2/release-notes.md b/docs/src/operations/v2.0.2/release-notes.md
new file mode 100644
index 000000000..2647e97af
--- /dev/null
+++ b/docs/src/operations/v2.0.2/release-notes.md
@@ -0,0 +1,11 @@
+---
+title: Release Notes (v2.0.2)
+icon: note
+---
+
+## [Release Notes for v2.0.2](https://github.com/datasharingframework/dsf/releases/tag/v2.0.2)
+
+::: tip Release Notes
+You can access all release notes on our [GitHub](https://github.com/datasharingframework/dsf/releases).
+:::
+
diff --git a/docs/src/operations/v2.0.2/root-certificates.md b/docs/src/operations/v2.0.2/root-certificates.md
new file mode 100644
index 000000000..a03719a56
--- /dev/null
+++ b/docs/src/operations/v2.0.2/root-certificates.md
@@ -0,0 +1,234 @@
+---
+title: Trusted Certificates
+icon: safe
+---
+
+A number of trusted certificate authorities (CAs) are included in the DSF docker images [fhir_proxy](https://github.com/datasharingframework/dsf/pkgs/container/fhir_proxy), [fhir](https://github.com/datasharingframework/dsf/pkgs/container/fhir), [bpe_proxy](https://github.com/datasharingframework/dsf/pkgs/container/bpe_proxy) and [bpe](https://github.com/datasharingframework/dsf/pkgs/container/bpe) by default. Root and intermediate certificates as well as the configured usage of issuing CAs as either **server**, **client** oder **server and client** CA are listed at the end.
+
+:::info
+Please ensure that you are using an organization-validated certificate (OV). We check for the presence of certain elements in the FHIR proxy. These are not set for domain-validated (DV) certificates. DV-validated certificates cannot be used in the standard setup.
+:::
+
+## Extending or Replacing Trusted Certificate Authorities
+X.509 certificates of default trusted CAs are stored as individual .pem files containing one certificate each in the docker images and can be replaced by either using docker [bind mounts](https://docs.docker.com/engine/storage/bind-mounts) or configuring appropriate environment variables with different targets.
+
+### FHIR Reverse Proxy
+Defaults are configured for the list of issuing, intermediate and root CAs used for validating client certificates (Apache httpd mod_ssl configuration option [SSLCACertificatePath](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcacertificatepath)) as well as the CA Certificates for defining acceptable CA names (option [SSLCADNRequestPath](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcadnrequestpath)). The default values of the following environment variables point to folders containing .pem files with one file per trusted CA:
+* [SSL_CA_CERTIFICATE_PATH](fhir-reverse-proxy/configuration.html#ssl-ca-certificate-path)
+  Default Value: `ca/client_ca_chains`
+* [SSL_CA_DN_REQUEST_PATH](fhir-reverse-proxy/configuration.html#ssl-ca-dn-request-path)
+  Default Value: `ca/client_issuing_cas`
+
+Use docker bind mounts to replace all default files or add additional CAs to the folders.
+
+**Note:** Default file location are relative to the docker image work directory `/usr/local/apache2`.
+**Also Note:** Using non default .pem files for the environment variables above may require also modifying the default values of the environment variables [SSL_EXPECTED_CLIENT_S_DN_C_VALUES](fhir-reverse-proxy/configuration.html#ssl-expected-client-s-dn-c-values) and [SSL_EXPECTED_CLIENT_I_DN_CN_VALUES](fhir-reverse-proxy/configuration.html#ssl-expected-client-i-dn-cn-values).
+
+### FHIR Server
+Defaults are configured for the list of issuing, intermediate and root CAs used for validating client certificates as well as root CAs used for validating server certificates of remote DSF FHIR servers and the OIDC provider when using [OpenID Connect](fhir/oidc.html) for authenticating local users.
+
+**Note:** Default file location are relative to the docker image work directory `/opt/fhir`.
+
+You can add an additional certificate authority (e.g., your hospital CA) for 
+
+- server certificates by creating a bind-mount of the CA file into the `/opt/fhir/ca/server_root_cas/` directory
+- client certificates by creating bind-mounts of the intermediate CA files and their root CA file into the `/opt/fhir/ca/client_ca_chains/` directory.
+
+See the [BPE Server configuration](#bpe-server) for an example.
+
+If you can't override the default configuration with bind-mounts, you can use the following environment variables to configure non default .pem file directories or .pem file:
+* [DEV_DSF_SERVER_AUTH_TRUST_CLIENT_CERTIFICATE_CAS](fhir/configuration.html#dev-dsf-server-auth-trust-client-certificate-cas)
+  Default Value: [ca/client_ca_chains](/download/1.9.0/client_cert_ca_chains.pem)
+* [DEV_DSF_FHIR_CLIENT_TRUST_SERVER_CERTIFICATE_CAS](fhir/configuration.html#dev-dsf-fhir-client-trust-server-certificate-cas)
+  Default Value: [ca/server_root_cas](/download/1.9.0/server_cert_root_cas.pem)
+* [DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS](fhir/configuration.html#dev-dsf-server-auth-oidc-provider-client-trust-server-certificate-cas)
+  Default Value: [ca/server_root_cas](/download/1.9.0/server_cert_root_cas.pem)
+
+### BPE Reverse Proxy
+Defaults are configured for the list of issuing, intermediate and root CAs used for validating client certificates (Apache httpd mod_ssl configuration option [SSLCACertificatePath](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcacertificatepath)) as well as the CA Certificates for defining acceptable CA names (option [SSLCADNRequestPath](https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslcadnrequestpath)). The default values of the following environment variables point to folders containing .pem files with one file per trusted CA:
+* [SSL_CA_CERTIFICATE_PATH](bpe-reverse-proxy/configuration.html#ssl-ca-certificate-path)
+  Default Value: `ca/client_ca_chains`
+* [SSL_CA_DN_REQUEST_PATH](bpe-reverse-proxy/configuration.html#ssl-ca-dn-request-path)
+  Default Value: `ca/client_issuing_cas`
+
+Use docker bind mounts to replace all default files or add additional CAs to the folders.
+
+**Note:** Default file location are relative to the docker image work directory `/usr/local/apache2`.
+**Also Note:** Using non default .pem files for the environment variables above may require also modifying the default values of the environment variables [SSL_EXPECTED_CLIENT_S_DN_C_VALUES](bpe-reverse-proxy/configuration.html#ssl-expected-client-s-dn-c-values) and [SSL_EXPECTED_CLIENT_I_DN_CN_VALUES](bpe-reverse-proxy/configuration.html#ssl-expected-client-i-dn-cn-values).
+
+### BPE Server
+Defaults are configured for the list of issuing, intermediate and root CAs used for validating client certificates as well as root CAs used for validating server certificates of local and remote DSF FHIR servers, the local mail server (if configured and SMTP over TLS required) and the OIDC provider when using [OpenID Connect](fhir/oidc.html) for authenticating local users.
+
+**Note:** Default file location are relative to the docker image work directory `/opt/bpe`.
+
+You can add an additional certificate authority (e.g., your hospital CA) for 
+
+- server certificates by creating a bind-mount of the CA file into the `/opt/bpe/ca/server_root_cas/` directory
+- client certificates by creating bind-mounts of the intermediate CA files and their root CA file into the `/opt/bpe/ca/client_ca_chains/` directory.
+
+If you have an additional certificate authority (e.g., your hospital CA) as `hospital-root-ca.pem` in your `/opt/bpe/secrets` directory, you can add it by adding the following entry in your docker-compose.yml file:
+
+```diff
+services:
+  app:
+...
+    volumes:
++      - type: bind
++        source: ./secrets/hospital-root-ca.pem
++        target: /opt/bpe/ca/server_root_cas/hospital-root-ca.pem
++        read_only: true
+```
+
+Use the following environment variable to configure non default .pem files or override the existing files using docker bind mounts:
+* [DEV_DSF_SERVER_AUTH_TRUST_CLIENT_CERTIFICATE_CAS](bpe/configuration.html#dev-dsf-server-auth-trust-client-certificate-cas)
+  Default Value: [ca/client_ca_chains](/download/1.9.0/client_cert_ca_chains.pem)
+* [DEV_DSF_BPE_FHIR_CLIENT_TRUST_SERVER_CERTIFICATE_CAS](bpe/configuration.html#dev-dsf-bpe-fhir-client-trust-server-certificate-cas)
+  Default Value: [ca/server_root_cas](/download/1.9.0/server_cert_root_cas.pem)
+  [DEV_DSF_BPE_MAIL_TRUST_SERVER_CERTIFICATE_CAS](bpe/configuration.html#dev-dsf-bpe-mail-trust-server-certificate-cas)
+  Default Value: [ca/server_root_cas](/download/1.9.0/server_cert_root_cas.pem)
+* [DEV_DSF_SERVER_AUTH_OIDC_PROVIDER_CLIENT_TRUST_SERVER_CERTIFICATE_CAS](bpe/configuration.html#dev-dsf-server-auth-oidc-provider-client-trust-server-certificate-cas)
+  Default Value: [ca/server_root_cas](/download/1.9.0/server_cert_root_cas.pem)
+
+## List of Default Trusted Certificate Authorities
+If not mentioned explicitly, issuing CAs listed will sign X.509 certificates with [Extended Key Usage](https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.12) entries `TLS WWW server authentication` and `TLS WWW client authentication`.
+
+* Root CA: **HARICA TLS ECC Root CA 2021**
+  Info: https://crt.sh/?caid=202185
+  X509 Certificate: https://crt.sh/?id=4147045948
+  Not after: Feb 13 11:01:09 2045 GMT
+  * Issuing CA: **GEANT TLS ECC 1**
+    Info: https://crt.sh/?caid=390050
+    X509 Certificate: https://crt.sh/?id=16099180990
+    Not after: Dec 31 11:14:20 2039 GMT
+  * Issuing CA: **HARICA OV TLS ECC**
+    Info: https://crt.sh/?caid=207661
+    X509 Certificate: https://crt.sh/?id=4442848530
+    Not after: Mar 15 09:33:51 2036 GMT
+* Root CA: **HARICA TLS RSA Root CA 2021**
+  Info: https://crt.sh/?caid=202184
+  X509 Certificate: https://crt.sh/?id=4147041876
+  Not after: Feb 13 10:55:37 2045 GMT
+  * Issuing CA: **GEANT TLS RSA 1**
+    Info: https://crt.sh/?caid=390054
+    X509 Certificate: https://crt.sh/?id=16099180997
+    Not after: Dec 31 11:14:59 2039 GMT
+  * Issuing CA: **HARICA OV TLS RSA**
+    Info: https://crt.sh/?caid=207660
+    X509 Certificate: https://crt.sh/?id=4442848529
+    Not after: Mar 15 09:34:16 2036 GMT
+* Root CA: **HARICA Client ECC Root CA 2021**
+  Info: https://crt.sh/?caid=202189
+  X509 Certificate: https://crt.sh/?id=4147052292
+  Not after: Feb 13 11:03:33 2045 GMT
+  * Issuing CA: **GEANT S/MIME ECC 1** [client/smime certificates only]
+    Info: https://crt.sh/?caid=390048
+    X509 Certificate: https://crt.sh/?id=16099180988
+    Not after: Dec 31 11:11:39 2039 GMT
+  * Issuing CA: **HARICA S/MIME ECC** [client/smime certificates only]
+    Info: https://crt.sh/?caid=207659
+    X509 Certificate: https://crt.sh/?id=4442848523
+    Not after: Mar 15 09:36:57 2036 GMT
+  * Issuing CA: **HARICA Client Authentication ECC** [client certificates only]
+    Info: https://crt.sh/?caid=207671
+    X509 Certificate: https://crt.sh/?id=4442848518
+    Not after: Mar 15 09:17:38 2036 GMT
+* Root CA: **HARICA Client RSA Root CA 2021**
+  Info: https://crt.sh/?caid=202188
+  X509 Certificate: https://crt.sh/?id=4147049674
+  Not after: Feb 13 10:58:45 2045 GMT
+  * Issuing CA: **GEANT S/MIME RSA 1** [client/smime certificates only]
+    Info: https://crt.sh/?caid=390049
+    X509 Certificate: https://crt.sh/?id=16099180989
+    Not after: Dec 31 11:13:07 2039 GMT
+  * Issuing CA: **HARICA S/MIME RSA** [client/smime certificates only]
+    Info: https://crt.sh/?caid=207658
+    X509 Certificate: https://crt.sh/?id=4442848517
+    Not after: Mar 15 09:37:37 2036 GMT
+  * Issuing CA: **HARICA Client Authentication RSA** [client certificates only]
+    Info: https://crt.sh/?caid=207670
+    X509 Certificate: https://crt.sh/?id=4442848531
+    Not after: Mar 15 09:19:36 2036 GMT
+* Root CA: **T-TeleSec GlobalRoot Class 2** [will be removed in a future release, incl. derived CAs]
+  Info: https://crt.sh/?caid=6068
+  X509 Certificate: https://crt.sh/?id=8733622
+  Not after: Oct 1 23:59:59 2033 GMT
+  * Intermediate Root CA: **DFN-Verein Certification Authority 2**
+    Info: https://crt.sh/?caid=22818
+    X509 Certificate: https://crt.sh/?id=23908438
+    Not after: Feb 22 23:59:59 2031 GMT
+   * Issuing CA: **DFN-Verein Global Issuing CA** [existing, still valid client certificates, no new certificates]
+     Info: https://crt.sh/?caid=23770
+     X509 Certificate: https://crt.sh/?id=25484751
+     Not after: Feb 22 23:59:59 2031 GMT
+   * Issuing CA: **Fraunhofer User CA - G02** [existing, still valid client certificates, no new certificates]
+     Info: https://crt.sh/?caid=23772
+     X509 Certificate: https://crt.sh/?id=25484789
+     Not after: Feb 22 23:59:59 2031 GMT
+* Root CA: **D-TRUST Root Class 3 CA 2 2009**
+  Info: https://crt.sh/?caid=712
+  X509 Certificate: https://crt.sh/?id=133226
+  Not after: Nov 5 08:35:58 2029 GMT
+   * Issuing CA: **D-TRUST SSL Class 3 CA 1 2009** [server certificates via TMF e.V.]
+     Info: https://crt.sh/?caid=713
+     X509 Certificate: https://crt.sh/?id=133227
+     Not after: Nov 5 08:35:58 2029 GMT
+* Root CA: **D-TRUST BR Root CA 1 2020 (ECC)**, optionally crosssigned by D-TRUST Root Class 3 CA 2 2009 [server only]
+  Info: https://crt.sh/?caid=192951
+  X509 Certificate: https://crt.sh/?id=3699642382 and https://crt.sh/?id=19754747817
+  Not after: Feb 11 09:44:59 2035
+* Root CA: **D-TRUST BR Root CA 2 2023 (RSA)**, optionally crosssigned by D-TRUST Root Class 3 CA 2 2009 [server only]
+  Info: https://crt.sh/?caid=266681
+  X509 Certificate: https://crt.sh/?id=9609658147 and https://crt.sh/?id=19754898942
+  Not after: May  9 08:56:30 2038 GMT
+
+* Root CA: **USERTrust ECC Certification Authority** [will be removed in a future release, incl. derived CAs]
+  Info: https://crt.sh/?caid=1390
+  X509 Certificate: https://crt.sh/?id=2841410
+  Not after: Jan 18 23:59:59 2038 GMT
+  * Issuing CA: **Sectigo ECC Organization Validation Secure Server CA**
+    Info: https://crt.sh/?caid=105483
+    X509 Certificate: https://crt.sh/?id=924467859
+    Not after: Dec 31 23:59:59 2030 GMT
+  * Issuing CA: **GEANT OV ECC CA 4**
+    Info: https://crt.sh/?caid=160140
+    X509 Certificate: https://crt.sh/?id=2475254970
+  * Issuing CA: **GEANT Personal ECC CA 4** [client/smime certificates only]
+    Info: https://crt.sh/?caid=160136
+    X509 Certificate: https://crt.sh/?id=2475254903
+    Not after: May 1 23:59:59 2033 GMT
+  * Issuing CA: **GEANT eScience Personal ECC CA 4** [client/smime certificates only]
+    Info: https://crt.sh/?caid=160138
+    X509 Certificate: https://crt.sh/?id=2475254888
+    Not after: May 1 23:59:59 2033 GMT
+* Root CA: **USERTrust RSA Certification Authority** [will be removed in a future release, incl. derived CAs]
+  Info: https://crt.sh/?caid=1167
+  X509 Certificate: https://crt.sh/?id=1199354
+  Not after: Jan 18 23:59:59 2038 GMT
+  * Issuing CA: **Sectigo RSA Organization Validation Secure Server CA**
+    Info: https://crt.sh/?caid=105487
+    X509 Certificate: https://crt.sh/?id=924467857
+    Not after: Dec 31 23:59:59 2030 GMT
+  * Issuing CA: **GEANT OV RSA CA 4**
+    Info: https://crt.sh/?caid=160137
+    X509 Certificate: https://crt.sh/?id=2475254782
+    Not after: May 1 23:59:59 2033 GMT
+  * Issuing CA: **GEANT Personal CA 4** [client/smime certificates only]
+    Info: https://crt.sh/?caid=160144
+    X509 Certificate: https://crt.sh/?id=2475255043
+    Not after: May 1 23:59:59 2033 GMT
+  * Issuing CA: **GEANT eScience Personal CA 4** [client/smime certificates only]
+    Info: https://crt.sh/?caid=160134
+    X509 Certificate: https://crt.sh/?id=2475253350
+    Not after: May 1 23:59:59 2033 GMT
+* Root CA: **D-TRUST Limited Basic Root CA 1 2019**
+  X509 Certificate: https://www.d-trust.net/cgi-bin/D-TRUST_Limited_Basic_Root_CA_1_2019.crt
+  Not after: Jun 19 08:15:51 2034 GMT
+  * Issuing CA: **D-TRUST Limited Basic CA 1-2 2019** [client certificates via TMF e.V.]
+    X509 Certificate: https://www.d-trust.net/cgi-bin/D-TRUST_Limited_Basic_CA_1-2_2019.crt
+    Not after: Jun 19 08:15:51 2034 GMT
+  * Issuing CA: **D-TRUST Limited Basic CA 1-3 2019** [client certificates via TMF e.V.]
+    X509 Certificate: https://www.d-trust.net/cgi-bin/D-TRUST_Limited_Basic_CA_1-3_2019.crt
+    Not after: Jun 19 08:15:51 2034 GMT
+
+
+
diff --git a/docs/src/operations/v2.0.2/upgrade-from-1.md b/docs/src/operations/v2.0.2/upgrade-from-1.md
new file mode 100644
index 000000000..705f79b34
--- /dev/null
+++ b/docs/src/operations/v2.0.2/upgrade-from-1.md
@@ -0,0 +1,214 @@
+---
+title: Upgrade from DSF 1.9.0
+icon: update
+---
+
+Upgrading the DSF from 1.9.0 to 2.0.2 involves modifying the docker-compose.yml files and recreating the containers. 
+
+::: warning Update to DSF 1.9.0 first
+When upgrading from DSF version < 1.9.0 it is important to migrate to [DSF 1.9.0 first](../v1.9.0/upgrade-from-1).
+:::
+
+For DSF 2, we refined the [system requirements](install.md#prerequisites). If your current DSF 1 setup works, it should also work with DSF 2. As DSF 2 is designed to support large file transfers, you might need to increase the storage on the DSF FHIR Server instance.
+
+::: info Non-standard configuration changes
+
+Most non-standard configuration changes working in DSF 1 will continue to work in DSF 2. If you have set custom timeout options in the DSF configuration (starting with `DEV_DSF_...`) please change them to the ISO 8601 standard. `120000` (Milliseconds) must be changed to `PT2M`. The configuration options for process plugins (e.g., starting with `DE_...`) remain unchanged.
+
+- You can now use more advanced [logging options](./fhir/logging.md).
+- If you use your own certificate authority, the [configuration](root-certificates.md) will be easier.
+- More granular control in [access control / role config settings](./fhir/access-control.md).
+:::
+
+We recommend upgrading the PostgreSQL DBMS from version 15 to version 18. At present, it is possible to use PostgreSQL version 15, but we exclusively support PostgreSQL version 18 and test the DSF solely with version 18.
+The DBMS upgrade is described below in the update instructions.
+
+DSF 2 was designed to run DSF 1 (APIv1) process plugins, but due to stricter validation rules in DSF 2 we strongly recommend using the latest compatible plugin versions. Updates within the same major and minor version (e.g., from 1.2.3.4 to 1.2.9.9) are generally safe. An overview of the recommended MII/NUM versions can be found [here](./install-plugins.md).
+
+## Modify DSF FHIR Server Setup
+1. Preparation / Backup
+    * We recommend to create a backup of the `/opt/fhir` directory before proceeding with the upgrade.  
+    For example using: `sudo cp -rp /opt/fhir /opt/fhir_backup_pre_2.0.2_upgrade`
+
+2. Modify the DSF FHIR docker-compose.yml file, replace the version number with 2.0.2.
+```diff
+ version: '3.8'
+ services:
+   proxy:
+-    image: ghcr.io/datasharingframework/fhir_proxy:1.9.0
++    image: ghcr.io/datasharingframework/fhir_proxy:2.0.2
+     restart: on-failure
+...
+   app:
+-    image: ghcr.io/datasharingframework/fhir:1.9.0
++    image: ghcr.io/datasharingframework/fhir:2.0.2
+     restart: on-failure
+...
+     environment:
+-      DEV_DSF_FHIR_SERVER_ORGANIZATION_THUMBPRINT: f4344032fe77bffb...
+...
+ 
+```
+The environment variable `DEV_DSF_FHIR_SERVER_ORGANIZATION_THUMBPRINT` does not need to be specified starting version 2.0.0. The thumbprint is now calculated based on the client certificate specified via `DEV_DSF_FHIR_CLIENT_CERTIFICATE`.
+
+
+3. Upgrade the DSF FHIR containers  
+    From `/opt/fhir` execute  
+    ```
+    docker compose up -d && docker compose logs -f
+    ```
+
+## Modify DSF BPE Server Setup
+1. Preparation / Backup
+    * We recommend to create a backup of the `/opt/bpe` directory before proceeding with the upgrade.  
+    For example using: `sudo cp -rp /opt/bpe /opt/bpe_backup_pre_2.0.2_upgrade`
+
+2. Modify the DSF BPE docker-compose.yml file, replace the version number with 2.0.2.
+```diff
+ version: '3.8'
+ services:
+   app:
+-    image: ghcr.io/datasharingframework/bpe:1.9.0
++    image: ghcr.io/datasharingframework/bpe:2.0.2
+     restart: on-failure
+...
+     environment:
+-      DEV_DSF_BPE_DB_USER_CAMUNDA_PASSWORD_FILE: /run/secrets/db_user_camunda.password
++      DEV_DSF_BPE_DB_USER_ENGINE_PASSWORD_FILE: /run/secrets/db_user_camunda.password
+...
+ 
+```
+
+3. Upgrade the DSF BPE containers  
+    From `/opt/bpe` execute  
+    ```
+    docker compose up -d && docker compose logs -f
+    ```
+
+5. Verify your upgrade:
+    * Verify the DSF FHIR server is running in version 2.0.2. The log should contain a message:  
+        `INFO main - BuildInfoReaderImpl.logBuildInfo(137) | Artifact: dsf-fhir-server-jetty, version: 2.0.2, [...]`
+    * Verify the DSF FHIR server started without errors
+    * Verify the DSF FHIR server is accessible via https, for example by browsing to https://your-dsf-endpoint.de/fhir/ (authentication with your client-certificate)
+    * Verify the DSF BPE server is running in version 2.0.2. The log should contain a message:  
+        `INFO main - BuildInfoReaderImpl.logBuildInfo(137) | Artifact: dsf-bpe-server-jetty, version: 2.0.2, [...]`
+    * Verify the DSF BPE server started without errors
+    * Verify your install with a ping/pong test  
+
+
+## Upgrade PostgreSQL from 15 to 18
+To upgrade your DSF databases, you have to stop the application, dump your database, recreate the bind mount directory, update the version, start it, restore the backup and start the application again.
+
+### On the DSF FHIR Server
+
+1. Stop the application
+    From `/opt/fhir` execute
+    ```
+    docker compose down app
+    ```
+2. Dump the database
+    From `/opt/fhir` execute
+    ```
+    docker compose exec db pg_dumpall -U liquibase_user > dump.sql
+    ```
+3. Stop the database
+    From `/opt/fhir` execute
+    ```
+    docker compose down db
+    ```
+4. Recreate the database bind mount directory
+    From `/opt/fhir` execute
+    ```
+    mv postgres-data postgres-data-psql-15
+    mkdir postgres-data
+    ```
+5. Update the version and change the bind mount target to respect the [PostgreSQL best practices](https://github.com/docker-library/postgres/pull/1259) in `/opt/fhir/docker-compose.yml`
+    ```diff
+    db:
+    -    image: postgres:15
+    +    image: postgres:18
+         restart: always
+         healthcheck:
+             test: ["CMD-SHELL", "pg_isready -U liquibase_user -d fhir"]
+             interval: 10s
+             timeout: 5s
+             retries: 5
+         volumes:
+         - type: bind
+           source: ./postgres-data
+    -      target: /var/lib/postgresql/data
+    +      target: /var/lib/postgresql  
+    ```
+6. Start the new database
+    From `/opt/fhir` execute
+    ```
+    docker compose up -d db
+    ```
+7. Restore the database dump
+    From `/opt/fhir` execute
+    ```
+    cat dump.sql | docker compose exec -T db psql -U liquibase_user fhir
+    ```
+8. Start the application
+    From `/opt/fhir` execute
+    ```
+    docker compose up -d && docker compose logs -f app
+    ```
+
+### On the DSF BPE Server
+
+1. Stop the application
+    From `/opt/bpe` execute
+    ```
+    docker compose down app
+    ```
+2. Dump the database
+    From `/opt/bpe` execute
+    ```
+    docker compose exec db pg_dumpall -U liquibase_user > dump.sql
+    ```
+3. Stop the database
+    From `/opt/bpe` execute
+    ```
+    docker compose down db
+    ```
+4. Recreate the database bind mount directory
+    From `/opt/bpe` execute
+    ```
+    mv postgres-data postgres-data-psql-15
+    mkdir postgres-data
+    ```
+5. Update the version and change the bind mount target to respect the [PostgreSQL best practices](https://github.com/docker-library/postgres/pull/1259) in `/opt/bpe/docker-compose.yml`
+    ```diff
+    db:
+    -    image: postgres:15
+    +    image: postgres:18
+         restart: always
+         healthcheck:
+             test: ["CMD-SHELL", "pg_isready -U liquibase_user -d bpe"]
+             interval: 10s
+             timeout: 5s
+             retries: 5
+         volumes:
+         - type: bind
+           source: ./postgres-data
+    -      target: /var/lib/postgresql/data
+    +      target: /var/lib/postgresql  
+    ```
+6. Start the new database
+    From `/opt/bpe` execute
+    ```
+    docker compose up -d db
+    ```
+7. Restore the database dump
+    From `/opt/bpe` execute
+    ```
+    cat dump.sql | docker compose exec -T db psql -U liquibase_user bpe
+    ```
+8. Start the application
+    From `/opt/bpe` execute
+    ```
+    docker compose up -d && docker compose logs -f app
+    ```
+
+Once you have ensured that DSF is working successfully with the new database, you can remove the dump.sql file and the postgres-data-psql-15 directory. As a precaution, we recommend keeping the postgres-data-psql-15 directory for some time.
diff --git a/docs/src/operations/v2.0.2/upgrade-from-2.md b/docs/src/operations/v2.0.2/upgrade-from-2.md
new file mode 100644
index 000000000..48b521a6e
--- /dev/null
+++ b/docs/src/operations/v2.0.2/upgrade-from-2.md
@@ -0,0 +1,76 @@
+---
+title: Upgrade from DSF 2.0.1
+icon: update
+---
+
+Upgrading the DSF from 2.0.1 to 2.0.2 involves modifying the image versions in the docker-compose.yml files and recreating the containers. 
+
+
+DSF 2 was designed to run DSF 1 (APIv1) process plugins, but due to stricter validation rules in DSF 2 we strongly recommend using the latest compatible plugin versions. Updates within the same major and minor version (e.g., from 1.2.3.4 to 1.2.9.9) are generally safe. An overview of the recommended MII/NUM versions can be found [here](./install-plugins.md).
+
+If you have installed the NUM Dashboard Process Plugin, you can [remove the workaround](./install-plugins.md).
+
+## Modify DSF FHIR Server Setup
+1. Preparation / Backup
+    * We recommend to create a backup of the `/opt/fhir` directory before proceeding with the upgrade.  
+    For example using: `sudo cp -rp /opt/fhir /opt/fhir_backup_pre_2.0.2_upgrade`
+
+2. Modify the DSF FHIR docker-compose.yml file, replace the version number with 2.0.2.
+```diff
+ version: '3.8'
+ services:
+   proxy:
+-    image: ghcr.io/datasharingframework/fhir_proxy:2.0.1
++    image: ghcr.io/datasharingframework/fhir_proxy:2.0.2
+     restart: on-failure
+...
+   app:
+-    image: ghcr.io/datasharingframework/fhir:2.0.1
++    image: ghcr.io/datasharingframework/fhir:2.0.2
+     restart: on-failure
+...
+
+```
+
+
+
+3. Upgrade the DSF FHIR containers  
+    From `/opt/fhir` execute  
+    ```
+    docker compose up -d && docker compose logs -f
+    ```
+
+## Modify DSF BPE Server Setup
+1. Preparation / Backup
+    * We recommend to create a backup of the `/opt/bpe` directory before proceeding with the upgrade.  
+    For example using: `sudo cp -rp /opt/bpe /opt/bpe_backup_pre_2.0.2_upgrade`
+
+2. Modify the DSF BPE docker-compose.yml file, replace the version number with 2.0.2.
+```diff
+ version: '3.8'
+ services:
+   app:
+-    image: ghcr.io/datasharingframework/bpe:2.0.1
++    image: ghcr.io/datasharingframework/bpe:2.0.2
+     restart: on-failure
+...
+
+ 
+```
+
+3. Upgrade the DSF BPE containers  
+    From `/opt/bpe` execute  
+    ```
+    docker compose up -d && docker compose logs -f
+    ```
+
+5. Verify your upgrade:
+    * Verify the DSF FHIR server is running in version 2.0.2. The log should contain a message:  
+        `INFO main - BuildInfoReaderImpl.logBuildInfo(137) | Artifact: dsf-fhir-server-jetty, version: 2.0.2, [...]`
+    * Verify the DSF FHIR server started without errors
+    * Verify the DSF FHIR server is accessible via https, for example by browsing to https://your-dsf-endpoint.de/fhir/ (authentication with your client-certificate)
+    * Verify the DSF BPE server is running in version 2.0.2. The log should contain a message:  
+        `INFO main - BuildInfoReaderImpl.logBuildInfo(137) | Artifact: dsf-bpe-server-jetty, version: 2.0.2, [...]`
+    * Verify the DSF BPE server started without errors
+    * Verify your install with a ping/pong test  
+

From c640db4d8757b310f1cd3659deea379df22cf21f Mon Sep 17 00:00:00 2001
From: Simon Schweizer <simon@schwzr.de>
Date: Tue, 10 Feb 2026 12:38:43 +0100
Subject: [PATCH 2/5] removed 1.9.0 as stable version

---
 docs/src/operations/old-versions.md | 8 +++++++-
 docs/src/operations/v1.9.0/index.md | 2 +-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/docs/src/operations/old-versions.md b/docs/src/operations/old-versions.md
index c4c735811..3eb0c9dfc 100644
--- a/docs/src/operations/old-versions.md
+++ b/docs/src/operations/old-versions.md
@@ -1,8 +1,14 @@
 ---
-title: Old versions
+title: Old Versions
 icon: launch
 ---
 
+## DSF v2
+
+- [2.0.1](./v2.0.1/)
+- [2.0.0](./v2.0.0/)
+
+
 ## DSF v1
 
 - [1.9.0](./v1.9.0/)
diff --git a/docs/src/operations/v1.9.0/index.md b/docs/src/operations/v1.9.0/index.md
index ca25dc519..39828c77c 100644
--- a/docs/src/operations/v1.9.0/index.md
+++ b/docs/src/operations/v1.9.0/index.md
@@ -3,7 +3,7 @@ title: DSF 1.9.0
 icon: guide
 ---
 
-Data Sharing Framework 1.x is the current major release of the Data Sharing Framework.
+Data Sharing Framework 1.x is the latest release of major version 1 of the Data Sharing Framework.
 
 # System Administrators
 

From 9bae33cb7905bcad3775da0dcdee99dcd67aea96 Mon Sep 17 00:00:00 2001
From: Hauke Hund <hauke.hund@hs-heilbronn.de>
Date: Tue, 10 Feb 2026 15:41:50 +0100
Subject: [PATCH 3/5] 2.0.2 tar.gz files, new config parameters and parameter
 fix

---
 .../public/download/dsf_bpe_2_0_2.tar.gz      | Bin 0 -> 1634 bytes
 .../public/download/dsf_fhir_2_0_2.tar.gz     | Bin 0 -> 1853 bytes
 .../operations/v2.0.2/bpe/configuration.md    |  25 +++++++++++-------
 .../operations/v2.0.2/fhir/configuration.md   |   7 +++++
 4 files changed, 23 insertions(+), 9 deletions(-)
 create mode 100644 docs/src/.vuepress/public/download/dsf_bpe_2_0_2.tar.gz
 create mode 100644 docs/src/.vuepress/public/download/dsf_fhir_2_0_2.tar.gz

diff --git a/docs/src/.vuepress/public/download/dsf_bpe_2_0_2.tar.gz b/docs/src/.vuepress/public/download/dsf_bpe_2_0_2.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..a8718bf5a47c031bdeb4d7796b11d19082ce08ad
GIT binary patch
literal 1634
zcmV-o2A%mIiwFP!000001MOQ|Q`<Nc=9yn{hJ9&ga`7b&j30I;A*Ri23TYD9+w6E8
zTS>GymMhCpcKYM@$hi=VlMogtOZB~&TGG+cxqOn2(_u`id(R9Fad>!`JrVh5_P1{7
zHKT6S>WBKCrfa5I-vjHp6_ZF4;c<XH&Y0NLZ(IBS6hriX!2C<X%RZaNEFqPfY525r
zNC($z_x!$iT85SPzj;`<_CR}DHHz_r`#&N4iuxq6_W`^(mJa|r^~S`8@x<p9%Bq1U
zykz2W8jVNXo04nBFRK_hwo%b4MmB;IX+~iKi^?O9hAAi6`-J$Mh-4-fpbWv#4e6JZ
z4n2&t*h>-=7Ob|WsL|R6mqcS46%0hxT|cBG60T3Upd;#g0{fBamM(70>6Lt5lAA|#
zzpKd=3)3lCS*^H1E5VRP3r*1?Eag7FtW;yp(D2E!1r0bRXu>Lsg*5NI4xD&_%cAhc
z2EkMEuvtPjUO&Ta;}$8t=TFFbIk(Lux}uy#Q?%Q{41+&xa8k~&Uz6~VM)UVA=fZ9E
zPuynLaa&FIyw|be?_lWL$U<U_5%ndstJPpAXDA-hX@5R%HyeG&?Kb-TU(b3i_oUr%
zP%)lH)p_hyH-%hYhrZL>CaWkwi^MpmAKIr|HQNx?t3ppcwtMbzr|p~$++(LVXrHu?
z8-u*Oty%B@k#4uwzL3vfoZlZLeoY4LIMqfw?V5{o6@G%jS?dgvnD}&b17boz#sH)|
z1UAb4?K6&n7PBZoas$*Cq^=-Yk?^IMduu`eUZ9J!(97a>B1D|XXiY{H!2(uceC$Q^
zA5TygRd8pmjwY1n6q~X@>a{Ap+dDgU`hC~=?YMK^a#|o5kgtB21_b7GK$1ee@*{2d
zw(JL}RzR-YG)5{XjWA@_9h!)5dPU2r<ORWEp1Iwqznar<h1-BP3`tT#BQ14;I7~5w
z0Z$UC?3OKie<nL3LT(r<tT^=WyfLSlfW-J`g0!}}N63-E@XltmAO%}L+PLFPh!=_p
z(vg3;kSMUL4SyaSe`=NcADvF;paci;*rkbN)Eg+D!;&DfgoJVcNID09%>~d%U_f}G
z4Z60lzMxaWQj}{g-e9P5iVA}Dn9X3myt3SE?-MPWy&BSC^_CiUW!vsqfAFE_^dC)?
zO97JI?3~5&eOgT$7PP%N03LWk*k9>a*kdMOM8nLS+ZL4P@wKD#Y`=!GH;%u@@3XVk
z8mcZ9wU*W&#*GgZT0rJIlJ8?@TCvV*z|2F%{@&;0w~FkXxyn7yPz}iL|Fip^eptI#
z2PnAzn{~~6;roBg!b>WGwf)}c{cm}Cf5s}%tp0Q7-d{6JV^jUd()3qW|9PXh^?x7l
zl)k`YREvygMCA$YiDF`R|JN+tQ2u`j-1`5*3scf3;^~QCcmErPsq+6taO?jrp0x0$
z^<4Y^ZvNNIn)3fkV5QFZY$t%s|JE-4M=1V(5lH_pE@{s-NA{7&vUd3XXUJEt%l~gQ
zK34tTa~iErPDOlu;)O~F*Vcdk(@o9F-~Vd(P~ZPv0H0<x=xZt_FeVY<o*)6-7IXFs
zD`-&u894FTltck`pVFuTrUCxM<DM@FPxkYrv!W4ty<kMXShgIve&qgsBM7pRQvxH#
zvoe0O>&&b8@Xnu1SzrT(U<rq@>&OP_P1`Uu<2^31xV9!IKF(TTr6rpNMx0HdRUY)t
z`vbrkKQ?;p;|9EIot(Ze5SOoYtr0!%RmNVZv=_mU0Ev8l6QfTaBKMBbPNbrlUzcyC
zar`awqM@mnt&)x)V&YbX5;|hauJT_^P@JrL&x~^Sw**p;5WSgzu9r-`bYzr{%=dGL
zF)=~!tSFL{098n&K^H0~K%?wKP2x>)HQo)RiJWsb&7yexy_4vFj8*<GO!X(2qk#YK
zp8qU8$N!e8)n6I^zfladmgaW!&*yrx(Kp@JkvrAvxC!W5<ffL%-Pp6NYwbzmK;iWv
zm;ZP6?5CPzYyO-0^Iy%>HI@G_fh_-<UDIuJyE6OFWzKh1&i^PV$p8Ea{6EjJHUDe1
z{Qh4zU)%3L-zf6=@0@<nPfbMwKMLl*0)5v11F(DjUo-T>S62U1P*6}%P*6}%P*6}%
gP*6}%P*6}%P*6}%P*6}%P<X}o7sKIW=KxRu0NZ#~SO5S3

literal 0
HcmV?d00001

diff --git a/docs/src/.vuepress/public/download/dsf_fhir_2_0_2.tar.gz b/docs/src/.vuepress/public/download/dsf_fhir_2_0_2.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..1317ce59a841bd50b6a4254cc6ca67dcd79bf065
GIT binary patch
literal 1853
zcmV-D2g3LtiwFP!000001MON{Z{kK2&U1dn(e`Cm;$j1atsg3p;B2gtK!I%4R+VM!
z0j4n?cWlU}>W}Z4;Sw-5mo%GhcjuELV|(VznR7oAk0z9t&pt0SM5ED=S48?Mf9r-`
ztJEvCdP6_cbj_$}XJCA0z9eRG;&Om9&RDW<+@bgXQ;dZEedgU0Ui8>BVlgQ_PJ<U+
zLnydj+tK^#+R*E1{nzmJ473;JA_w2N{$s-D)FZKZ4iItn=~4Uupi_5DOc+l*UZSk*
zyNMf5Tu#IBh`Uqr!1#Sxn2xiUQz>bsik!%akY{273yUL{1~X3N^N8^zUeE^k4oK(@
z0|Fz)VUi>f6n~J{80Y(x6EBI^LyPcUGv8~=`y$k8RTKZ@eM~$~p6C`KjswRdJfS1%
zxe0MbG$5sjOmhd^lgGn@yopQ0?O`OGQ_jLE36s_8gI`UsW}HQ&d_j0X!{zg4x9jw+
z-bbtF*j*FcC|bVg_uI~;)f?DX_GNQmIahYuGNH_8VR^Z+@`3%NDg0>tatxJ>O{Xbc
zUN`OAV`!yhvsT-n)9OGR5s!`@A(;^H*%U{D8~V~1fQ|4mjiJ@Qf~#x02f`EyUlX_<
z47&Z5;BK2YmecL@1}6CNsFX0Dl^7qpA^pouC<{v%yQEdf=^;skg>Klz2z8Z^(3cN<
z65-F-Vd2vNp%uKr%V`d9gz4`XsXufA`sa)eT@1F78^=h^-+VhmQRKdGBEqL`h=%9*
zBp^u!3EYL_1yl^#P}P=+XAePlrt_tRJY)DaCvz6eretH^$zy~f9nx^cDawY;xQ7o*
z<$#UXPf?6xf`TlwD3MZLzdgb2TGmGgZOak1<+LuGyI$LbKm4I*Vv<Y7sI5N(vt0Iv
za)q2pZTqJ?`=Z%L<7@W&KX-bqET7n?&>c3=q7M<v(tkD`t9R49wQdJa%W7MLgIpeE
zKU*tZwrxRvBQ&I_9<;Rs<eYBL{<w@?N0H94(G!;0E2UE{Jv-oS#wMUXQbR%;!EKA%
zWsK|eJ~VIbUz-EFbL-eG+yL^9&p$TXcgSUC%-a)hg)zd62L}Uf7BAA|rN_v$Ec_%d
z>@M6Vn-9(~$$Kmu(eaEggpn|CgMdAN>tWdui+jQCoegv9!UGu=hnzhiizq|rS^WX#
zPg@oW3!>BmVa0I)w;_^>Hxt2NLEBAacJRr3@8)`)wsqOLy|O=;@b^&}Lp&I|SS0Vs
zApTI0@`qdbV-;#l{r%n?F(Gb{OuPy4?pG8O9BRUEZ!T|I#s0O`ZoetOn`rFNm=o83
zgyJ2ngN}4;DEc6D@#gm>1&SNsb2l(S*H-mZLZ^hykg&0Of>zHdatOvVqV{TkMUfzP
z<M-Uf&`pQsr-*xM6z_KWgAZs1&yK%q0wQ3VDUqeev@T3oXM<gv*ffD7v-<hQxV&O+
zK||aLkseX{?W^aGBbKTF_ZM}?k=!i=GbNHuEKh^!WSBcUoiYz5yS<e5<j6&ln3M9d
ziRPxq<8sZhL^BfOiOKA_D{V+;(`i;ARQz7Lj`?5ry9(Qo)%8{sfBDludC0Rk@6j8z
zopZp9^S^4NZoKmOU&MlYn)tcnzS8p_ssELyf2K8rf(^qs;rzFv*DLD$_cgGk|DM%s
z-B_jM)64EuD7cn?{#!wJPy2t}XsGkw*T4<)MWgmWlL?GTNU%#IK0Fl!=b4q6IIrad
zn?FqHIDAUO5>zXIB_MY_Y&zoebV-&qL$7Dd$S=LtB=TvTpErG97BI1F8P_c@C)n{~
zKP-={;jK5BGT#I=$^uSj51|P{zh+I>^mn-FyxLo^(3jmaY`m5WifU&Ht>U0}hdnE<
zeckNYmrZ!vy1IS0LvXuT&LNAl<v4hY9rNa!7=~D85fUz2d3mTRHc$Za$qQya4af5S
zT>)4mT4Of=IzqKB&Rug`i+ycE4wK7Lu!uw9?F{wi@y7^l=v}@tmQ3erp|aFMcHJ!a
zxRh^B)WP98Hiz`q7Ckpa>BGi8PpFT@0#|}j>2K?&LOR}ob<yl;ve+eRGGxgU3k5Xq
zDVvLv7LHY1#6oERNKQ2N3!!ZPi%;-@JvP3q)(W*oLD#-7=(@Jj8A~SHT8;~VOvFN@
zE2d*W!xSesu{*{6xQ{T4#j1;iR_*bB9o`fUU@QM;#`=H1Mn?XxX?5eN{xkGc{x@ok
z+837pzfugemgcnepYHUFX20sR-aAvhjzxg3h0e^VVmfvW<3W1~Gf?;fk@o+sqV0v&
zIOzY?diwj1TH{Nr|G!d5|G&D{dye=_0p0&jIDJ<+{WpRv|Ics1p0~!~{GaOoE1K3Y
zl>fg5cKp9v6}qpY?pxKMnp9Ol_^Pq`y5@6!11!(~8+-hJ_xs<P_S)zF->Cm9C@3f>
rC@3f>C@3f>C@3f>C@3f>C@3f>C@3f>C@3f>{J-%JNL4*}08jt`V#Kmt

literal 0
HcmV?d00001

diff --git a/docs/src/operations/v2.0.2/bpe/configuration.md b/docs/src/operations/v2.0.2/bpe/configuration.md
index aceeb51aa..424d91e06 100644
--- a/docs/src/operations/v2.0.2/bpe/configuration.md
+++ b/docs/src/operations/v2.0.2/bpe/configuration.md
@@ -171,7 +171,7 @@ icon: config
 - **Required:** No
 - **Description:** FHIR server connections YAML config for v2 process plugins
 
-<!-- see https://github.com/datasharingframework/dsf/issues/411
+
 ### DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG_DEFAULT_ENABLE_DEBUG_LOGGING
 - **Property:** dev.dsf.bpe.fhir.client.connections.config.default.enable.debug.logging
 - **Required:** No
@@ -180,14 +180,6 @@ icon: config
 - **Default:** `false`
 
 
-### DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG_DEFAULT_ENABLE_DEBUG_LOGGING
-- **Property:** dev.dsf.bpe.fhir.client.connections.config.default.enable.debug.logging
-- **Required:** No
-- **Description:** FHIR server connections YAML: Default value for properties `oidc-auth.verify-authorized-party`
-- **Recommendation:** To disable verification of the authorized party (aud) claim by default set to `false`
-- **Default:** `true`
--->
-
 ### DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG_DEFAULT_OIDC_DISCOVERY_PATH
 - **Property:** dev.dsf.bpe.fhir.client.connections.config.default.oidc.discovery.path
 - **Required:** No
@@ -195,6 +187,14 @@ icon: config
 - **Default:** `/.well-known/openid-configuration`
 
 
+### DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG_DEFAULT_OIDC_VERIFY_AUTHORIZED_PARTY
+- **Property:** dev.dsf.bpe.fhir.client.connections.config.default.oidc.verify.authorized.party
+- **Required:** No
+- **Description:** FHIR server connections YAML: Default value for properties `oidc-auth.verify-authorized-party`
+- **Recommendation:** To disable verification of the authorized party (aud) claim by default set to `false`
+- **Default:** `true`
+
+
 ### DEV_DSF_BPE_FHIR_CLIENT_CONNECTIONS_CONFIG_DEFAULT_TEST_CONNECTION_ON_STARTUP
 - **Property:** dev.dsf.bpe.fhir.client.connections.config.default.test.connection.on.startup
 - **Required:** No
@@ -747,6 +747,13 @@ icon: config
 - **Default:** `TEXT_MDC`
 
 
+### DEV_DSF_LOG_MIN_LEVEL_LOGGERS
+- **Property:** dev.dsf.log.min.level.loggers
+- **Required:** No
+- **Description:** List of logger names that are enabled to produce log output with the minimal configured log level from `DEV_DSF_LOG_CONSOLE_OUT_LEVEL`, `DEV_DSF_LOG_CONSOLE_ERR_LEVEL` and `DEV_DSF_LOG_FILE_LEVEL`
+- **Default:** `dev.dsf, de.medizininformatik_initiative.processes.common`
+
+
 ### DEV_DSF_PROXY_NOPROXY
 - **Property:** dev.dsf.proxy.noProxy
 - **Required:** No
diff --git a/docs/src/operations/v2.0.2/fhir/configuration.md b/docs/src/operations/v2.0.2/fhir/configuration.md
index 4c0760acb..e21529766 100644
--- a/docs/src/operations/v2.0.2/fhir/configuration.md
+++ b/docs/src/operations/v2.0.2/fhir/configuration.md
@@ -335,6 +335,13 @@ icon: config
 - **Default:** `TEXT_MDC`
 
 
+### DEV_DSF_LOG_MIN_LEVEL_LOGGERS
+- **Property:** dev.dsf.log.min.level.loggers
+- **Required:** No
+- **Description:** List of logger names that are enabled to produce log output with the minimal configured log level from `DEV_DSF_LOG_CONSOLE_OUT_LEVEL`, `DEV_DSF_LOG_CONSOLE_ERR_LEVEL` and `DEV_DSF_LOG_FILE_LEVEL`
+- **Default:** `dev.dsf`
+
+
 ### DEV_DSF_PROXY_NOPROXY
 - **Property:** dev.dsf.proxy.noProxy
 - **Required:** No

From 1592dca829de5c48ea4a3faa3d2445107e09fedb Mon Sep 17 00:00:00 2001
From: Hauke Hund <hauke.hund@hs-heilbronn.de>
Date: Tue, 10 Feb 2026 15:56:27 +0100
Subject: [PATCH 4/5] added DFN Community PKI certs, some annotation mods

---
 .../operations/v2.0.2/root-certificates.md    | 48 ++++++++++++-------
 1 file changed, 30 insertions(+), 18 deletions(-)

diff --git a/docs/src/operations/v2.0.2/root-certificates.md b/docs/src/operations/v2.0.2/root-certificates.md
index a03719a56..d2788e27e 100644
--- a/docs/src/operations/v2.0.2/root-certificates.md
+++ b/docs/src/operations/v2.0.2/root-certificates.md
@@ -116,15 +116,15 @@ If not mentioned explicitly, issuing CAs listed will sign X.509 certificates wit
     Info: https://crt.sh/?caid=207660
     X509 Certificate: https://crt.sh/?id=4442848529
     Not after: Mar 15 09:34:16 2036 GMT
-* Root CA: **HARICA Client ECC Root CA 2021**
+* Root CA: **HARICA Client ECC Root CA 2021** [client certificates only]
   Info: https://crt.sh/?caid=202189
   X509 Certificate: https://crt.sh/?id=4147052292
   Not after: Feb 13 11:03:33 2045 GMT
-  * Issuing CA: **GEANT S/MIME ECC 1** [client/smime certificates only]
+  * Issuing CA: **GEANT S/MIME ECC 1** [client certificates only]
     Info: https://crt.sh/?caid=390048
     X509 Certificate: https://crt.sh/?id=16099180988
     Not after: Dec 31 11:11:39 2039 GMT
-  * Issuing CA: **HARICA S/MIME ECC** [client/smime certificates only]
+  * Issuing CA: **HARICA S/MIME ECC** [client certificates only]
     Info: https://crt.sh/?caid=207659
     X509 Certificate: https://crt.sh/?id=4442848523
     Not after: Mar 15 09:36:57 2036 GMT
@@ -132,15 +132,15 @@ If not mentioned explicitly, issuing CAs listed will sign X.509 certificates wit
     Info: https://crt.sh/?caid=207671
     X509 Certificate: https://crt.sh/?id=4442848518
     Not after: Mar 15 09:17:38 2036 GMT
-* Root CA: **HARICA Client RSA Root CA 2021**
+* Root CA: **HARICA Client RSA Root CA 2021** [client certificates only]
   Info: https://crt.sh/?caid=202188
   X509 Certificate: https://crt.sh/?id=4147049674
   Not after: Feb 13 10:58:45 2045 GMT
-  * Issuing CA: **GEANT S/MIME RSA 1** [client/smime certificates only]
+  * Issuing CA: **GEANT S/MIME RSA 1** [client certificates only]
     Info: https://crt.sh/?caid=390049
     X509 Certificate: https://crt.sh/?id=16099180989
     Not after: Dec 31 11:13:07 2039 GMT
-  * Issuing CA: **HARICA S/MIME RSA** [client/smime certificates only]
+  * Issuing CA: **HARICA S/MIME RSA** [client certificates only]
     Info: https://crt.sh/?caid=207658
     X509 Certificate: https://crt.sh/?id=4442848517
     Not after: Mar 15 09:37:37 2036 GMT
@@ -148,19 +148,19 @@ If not mentioned explicitly, issuing CAs listed will sign X.509 certificates wit
     Info: https://crt.sh/?caid=207670
     X509 Certificate: https://crt.sh/?id=4442848531
     Not after: Mar 15 09:19:36 2036 GMT
-* Root CA: **T-TeleSec GlobalRoot Class 2** [will be removed in a future release, incl. derived CAs]
+* Root CA: **T-TeleSec GlobalRoot Class 2** [client certificates only, will be removed in a future release, incl. derived CAs]
   Info: https://crt.sh/?caid=6068
   X509 Certificate: https://crt.sh/?id=8733622
   Not after: Oct 1 23:59:59 2033 GMT
-  * Intermediate Root CA: **DFN-Verein Certification Authority 2**
+  * Intermediate Root CA: **DFN-Verein Certification Authority 2** [client certificates only, will be removed in a future release, incl. derived CAs]
     Info: https://crt.sh/?caid=22818
     X509 Certificate: https://crt.sh/?id=23908438
     Not after: Feb 22 23:59:59 2031 GMT
-   * Issuing CA: **DFN-Verein Global Issuing CA** [existing, still valid client certificates, no new certificates]
+   * Issuing CA: **DFN-Verein Global Issuing CA** [client certificates only, no new certificates]
      Info: https://crt.sh/?caid=23770
      X509 Certificate: https://crt.sh/?id=25484751
      Not after: Feb 22 23:59:59 2031 GMT
-   * Issuing CA: **Fraunhofer User CA - G02** [existing, still valid client certificates, no new certificates]
+   * Issuing CA: **Fraunhofer User CA - G02** [client certificates only, no new certificates]
      Info: https://crt.sh/?caid=23772
      X509 Certificate: https://crt.sh/?id=25484789
      Not after: Feb 22 23:59:59 2031 GMT
@@ -192,11 +192,11 @@ If not mentioned explicitly, issuing CAs listed will sign X.509 certificates wit
   * Issuing CA: **GEANT OV ECC CA 4**
     Info: https://crt.sh/?caid=160140
     X509 Certificate: https://crt.sh/?id=2475254970
-  * Issuing CA: **GEANT Personal ECC CA 4** [client/smime certificates only]
+  * Issuing CA: **GEANT Personal ECC CA 4** [client certificates only]
     Info: https://crt.sh/?caid=160136
     X509 Certificate: https://crt.sh/?id=2475254903
     Not after: May 1 23:59:59 2033 GMT
-  * Issuing CA: **GEANT eScience Personal ECC CA 4** [client/smime certificates only]
+  * Issuing CA: **GEANT eScience Personal ECC CA 4** [client certificates only]
     Info: https://crt.sh/?caid=160138
     X509 Certificate: https://crt.sh/?id=2475254888
     Not after: May 1 23:59:59 2033 GMT
@@ -212,15 +212,15 @@ If not mentioned explicitly, issuing CAs listed will sign X.509 certificates wit
     Info: https://crt.sh/?caid=160137
     X509 Certificate: https://crt.sh/?id=2475254782
     Not after: May 1 23:59:59 2033 GMT
-  * Issuing CA: **GEANT Personal CA 4** [client/smime certificates only]
+  * Issuing CA: **GEANT Personal CA 4** [client certificates only]
     Info: https://crt.sh/?caid=160144
     X509 Certificate: https://crt.sh/?id=2475255043
     Not after: May 1 23:59:59 2033 GMT
-  * Issuing CA: **GEANT eScience Personal CA 4** [client/smime certificates only]
+  * Issuing CA: **GEANT eScience Personal CA 4** [client certificates only]
     Info: https://crt.sh/?caid=160134
     X509 Certificate: https://crt.sh/?id=2475253350
     Not after: May 1 23:59:59 2033 GMT
-* Root CA: **D-TRUST Limited Basic Root CA 1 2019**
+* Root CA: **D-TRUST Limited Basic Root CA 1 2019** [client certificates only]
   X509 Certificate: https://www.d-trust.net/cgi-bin/D-TRUST_Limited_Basic_Root_CA_1_2019.crt
   Not after: Jun 19 08:15:51 2034 GMT
   * Issuing CA: **D-TRUST Limited Basic CA 1-2 2019** [client certificates via TMF e.V.]
@@ -229,6 +229,18 @@ If not mentioned explicitly, issuing CAs listed will sign X.509 certificates wit
   * Issuing CA: **D-TRUST Limited Basic CA 1-3 2019** [client certificates via TMF e.V.]
     X509 Certificate: https://www.d-trust.net/cgi-bin/D-TRUST_Limited_Basic_CA_1-3_2019.crt
     Not after: Jun 19 08:15:51 2034 GMT
-
-
-
+* Root CA: **DFN-Verein Community Root CA 2022** [client certificates only]
+  X509 Certificate: https://doku.tid.dfn.de/_media/de:dfnpki:ca:dfn-verein_community_root_ca_2022.pem
+  Not after: Jan 21 14:08:41 2042 GMT
+  * Issuing CA: **DFN-Verein Community Issuing CA 2022** [client certificates only]
+    X509 Certificate: https://doku.tid.dfn.de/_media/de:dfnpki:ca:dfn-verein_community_issuing_ca_2022.pem
+    Not after: Jan 21 14:08:41 2042 GMT
+  * Issuing CA: **Fraunhofer Service CA 2022** [client certificates only]
+    X509 Certificate: https://doku.tid.dfn.de/_media/de:dfnpki:ca:fraunhofer_service_ca_2022.pem
+    Not after: Jan 21 14:08:41 2042 GMT
+  * Issuing CA: **Fraunhofer User CA 2022** [client certificates only]
+    X509 Certificate: https://doku.tid.dfn.de/_media/de:dfnpki:ca:fraunhofer_user_ca_2022.pem
+    Not after: Jan 21 14:08:41 2042 GMT
+  * Issuing CA: **MPG Community CA** [client certificates only]
+    X509 Certificate: https://doku.tid.dfn.de/_media/de:dfnpki:ca:mpg_community_ca.pem
+    Not after: Jan 21 14:08:41 2042 GMT

From 4b3a36599644feb1c82c4c473508e0f21ea11da5 Mon Sep 17 00:00:00 2001
From: Simon Schweizer <simon@schwzr.de>
Date: Tue, 10 Feb 2026 16:03:34 +0100
Subject: [PATCH 5/5] added release notes

---
 docs/src/.vuepress/theme.ts                 |  8 +--
 docs/src/operations/v2.0.2/release-notes.md | 76 ++++++++++++++++++---
 2 files changed, 70 insertions(+), 14 deletions(-)

diff --git a/docs/src/.vuepress/theme.ts b/docs/src/.vuepress/theme.ts
index c69747292..cb6b474c2 100644
--- a/docs/src/.vuepress/theme.ts
+++ b/docs/src/.vuepress/theme.ts
@@ -38,12 +38,8 @@ export default hopeTheme({
           text: "Operations",
           icon: "launch",
           prefix: "/operations/",
-          children: [{
-            text: "Stable version - 1.9.0",
-            link: "v1.9.0/readme.md",
-            icon: "launch"
-          }, {
-            text: "Current version - 2.0.2",
+          children: [ {
+            text: "Current Version - 2.0.2",
             link: "get-started.md",
             icon: "launch"
           }, "old-versions.md"],
diff --git a/docs/src/operations/v2.0.2/release-notes.md b/docs/src/operations/v2.0.2/release-notes.md
index 2647e97af..39b840688 100644
--- a/docs/src/operations/v2.0.2/release-notes.md
+++ b/docs/src/operations/v2.0.2/release-notes.md
@@ -1,11 +1,71 @@
----
-title: Release Notes (v2.0.2)
-icon: note
----
+---
+title: Release Notes (v2.0.2)
+icon: note
+---
+
+## [Release Notes for v2.0.2](https://github.com/datasharingframework/dsf/releases/tag/v2.0.2)
+
+::: tip Release Notes
+You can access all release notes on our [GitHub](https://github.com/datasharingframework/dsf/releases).
+:::
+
+### 2.0.2 - Maintenance Release
+General remarks:
 
-## [Release Notes for v2.0.2](https://github.com/datasharingframework/dsf/releases/tag/v2.0.2)
+- This is an update for DSF 2.0.0 / 2.0.1.
+- To Update from an existing 1.x installation, please see the [1.x -> 2.0.2 Upgrade Guide](https://dsf.dev/operations/v2.0.2/upgrade-from-1.html). 
+- To Update from an existing 2.x installation, please see the [2.x -> 2.0.2 Upgrade Guide](https://dsf.dev/operations/v2.0.2/upgrade-from-2.html). 
+- For a fresh deployment, follow the [installation instructions](https://dsf.dev/operations/v2.0.2/install.html).
+- With this release a number of bugs were fixed.
 
-::: tip Release Notes
-You can access all release notes on our [GitHub](https://github.com/datasharingframework/dsf/releases).
-:::
+Bug Fixes:
+- The property key `dev.dsf.bpe.fhir.client.connections.config.default.enable.debug.logging` was used for unrelated configuration values to specify the default EnableDebugLogging value for FHIR client connections and the default OidcVerifyAuthorizedParty value for OIDC Client-Credentials-Flow connections. A new property key `dev.dsf.bpe.fhir.client.connections.config.default.oidc.verify.authorized.party` was added.
+- A NoClassDefFoundError was throw when executing the [num-process-dashboard-report](https://github.com/medizininformatik-initiative/dsf-plugin-numdashboard) process plugin in Version 1.0.0.0 and 1.1.0.0. Additional packages were added to the API v1 class allow list file.
+- A process instance waiting for a timer event crashed on continuation if the process plugin was removed. The crash resulted in Task resources remaining in status `in-progress`. Additional error handling was implemented to update Task to a status `failed`.
+- No debug log output was generated for code from the [mii-processes-common](https://github.com/medizininformatik-initiative/mii-processes-common) module used in some medical informatics initiative process plugins. A new config property `dev.dsf.log.min.level.loggers` with default value was added to restore the DSF 1.x behavior.
+- The API v2 `setJsonVariable()` mechanism was unable to serialize date/time objects from the `java.time` package. The `ObjectMapper` configuration was fixed and the `JavaTimeModule` added.
 
+Docker images for this release can be accessed via the GitHub Docker registry - ghcr.io:
+* **bpe**: [ghcr.io/datasharingframework/bpe:2.0.2](https://github.com/orgs/datasharingframework/packages/container/bpe/679531729?tag=2.0.2)
+* **bpe_proxy**: [ghcr.io/datasharingframework/bpe_proxy:2.0.2](https://github.com/orgs/datasharingframework/packages/container/bpe_proxy/679491992?tag=2.0.2)
+* **fhir**: [ghcr.io/datasharingframework/fhir:2.0.2](https://github.com/orgs/datasharingframework/packages/container/fhir/679512827?tag=2.0.2)
+* **fhir_proxy**: [ghcr.io/datasharingframework/fhir_proxy:2.0.2](https://github.com/orgs/datasharingframework/packages/container/fhir_proxy/679488712?tag=2.0.2)
+
+Process Plugin API v1 on Maven Central:
+```xml
+<dependency>
+    <groupId>dev.dsf</groupId>
+    <artifactId>dsf-bpe-process-api-v1</artifactId>
+    <version>2.0.2</version>
+</dependency>
+```
+Process Plugin API v2 on Maven Central:
+```xml
+<dependency>
+    <groupId>dev.dsf</groupId>
+    <artifactId>dsf-bpe-process-api-v2</artifactId>
+    <version>2.0.2</version>
+</dependency>
+```
+DSF Maven Plugin on Maven Central:
+```xml
+<plugin>
+    <groupId>dev.dsf</groupId>
+    <artifactId>dsf-maven-plugin</artifactId>
+    <version>2.0.2</version>
+</plugin>
+```
+
+Issues closed:
+- API v2 Variables Fails to Serialize java.time Types [#428](https://github.com/datasharingframework/dsf/issues/428)
+- Incomplete Debug Logging for MII Process Plugins [#425](https://github.com/datasharingframework/dsf/issues/425)
+- Add DFN Community-PKI as Trusted Client CA [#423](https://github.com/datasharingframework/dsf/issues/423)
+- Crash on Timer Continuation After Process Plugin Removal Leaves Task In-Progress [#421](https://github.com/datasharingframework/dsf/issues/421)
+- Remove Duplicated Thumbprint Calculations [#419](https://github.com/datasharingframework/dsf/issues/419)
+- Upgrade Dependencies [#417](https://github.com/datasharingframework/dsf/issues/417)
+- NoClassDefFoundError While Executing Plugin num-process-dashboard-report [#415](https://github.com/datasharingframework/dsf/issues/415)
+- Start New Development Cycle [#412](https://github.com/datasharingframework/dsf/issues/412)
+- Property dev.dsf.bpe.fhir.client.connections.config.default.enable.debug.logging Used for Unrelated Configuration Values [#411](https://github.com/datasharingframework/dsf/issues/411)
+
+This release contains contributions from [@EmteZogaf](https://github.com/EmteZogaf), [@hhund](https://github.com/hhund), [@jaboehri](https://github.com/jaboehri), [@schwzr](https://github.com/schwzr) and [@wetret](https://github.com/wetret).
+