diff --git a/controller/config/config.go b/controller/config/config.go
index 94706827f..0ef2bb91c 100644
--- a/controller/config/config.go
+++ b/controller/config/config.go
@@ -58,6 +58,7 @@ type Api struct {
 	Identity              identity.Identity
 	IdentityConfig        identity.IdentityConfig
 	IdentityCaPem         []byte
+	HttpTimeouts          HttpTimeouts
 }
 
 type Config struct {
@@ -72,6 +73,13 @@ type Config struct {
 	caPemsOnce         sync.Once
 }
 
+type HttpTimeouts struct {
+	ReadTimeoutDuration       time.Duration
+	ReadHeaderTimeoutDuration time.Duration
+	WriteTimeoutDuration      time.Duration
+	IdleTimeoutsDuration      time.Duration
+}
+
 func (c *Config) SessionTimeoutDuration() time.Duration {
 	return c.Api.SessionTimeoutSeconds
 }
@@ -206,6 +214,10 @@ func (c *Config) loadApiSection(edgeConfigMap map[interface{}]interface{}) error
 			return fmt.Errorf("error loading Edge API Identity: %s", err)
 		}
 
+		if err = c.loadHttpTimeouts(submap); err != nil {
+			return fmt.Errorf("error loading Edge API Http Timeouts: %s", err)
+		}
+
 	} else {
 		return errors.New("required configuration section [edge.api] missing")
 	}
@@ -343,6 +355,67 @@ func (c *Config) loadEnrollmentSection(edgeConfigMap map[interface{}]interface{}
 	return nil
 }
 
+func (c *Config) loadHttpTimeouts(apiSubMap map[interface{}]interface{}) error {
+	c.Api.HttpTimeouts = HttpTimeouts{
+		ReadTimeoutDuration:       5 * time.Second,
+		ReadHeaderTimeoutDuration: 0,
+		WriteTimeoutDuration:      10 * time.Second,
+		IdleTimeoutsDuration:      5 * time.Second,
+	}
+
+	if value, found := apiSubMap["httpTimeouts"]; found && value != nil {
+		httpTimeoutsSubMap := value.(map[interface{}]interface{})
+
+		if value, found := httpTimeoutsSubMap["readTimeoutMs"]; found {
+			readTimeoutMs := value.(int)
+			if readTimeoutMs < 0 {
+				readTimeoutMs = 0
+			}
+			c.Api.HttpTimeouts.ReadTimeoutDuration = time.Duration(readTimeoutMs) * time.Millisecond
+		} else {
+			pfxlog.Logger().Warnf("[edge.api.httpTimeouts.readTimeoutMs] defaulted to %v", c.Api.HttpTimeouts.ReadTimeoutDuration.Milliseconds())
+		}
+
+		if value, found := httpTimeoutsSubMap["readHeaderTimeoutMs"]; found {
+			readHeaderTimeoutMs := value.(int)
+			if readHeaderTimeoutMs < 0 {
+				readHeaderTimeoutMs = 0
+			}
+
+			c.Api.HttpTimeouts.ReadHeaderTimeoutDuration = time.Duration(readHeaderTimeoutMs) * time.Millisecond
+		} else {
+			pfxlog.Logger().Warnf("[edge.api.httpTimeouts.readHeaderTimeoutMs] defaulted to %v", c.Api.HttpTimeouts.ReadHeaderTimeoutDuration.Milliseconds())
+		}
+
+		if value, found := httpTimeoutsSubMap["writeTimeoutMs"]; found {
+			writeTimeoutMs := value.(int)
+			if writeTimeoutMs < 0 {
+				writeTimeoutMs = 0
+			}
+
+			c.Api.HttpTimeouts.WriteTimeoutDuration = time.Duration(writeTimeoutMs) * time.Millisecond
+		} else {
+			pfxlog.Logger().Warnf("[edge.api.httpTimeouts.writeTimeoutMs] defaulted to %v", c.Api.HttpTimeouts.ReadHeaderTimeoutDuration.Milliseconds())
+		}
+
+		if value, found := httpTimeoutsSubMap["idleTimeoutMs"]; found {
+			idleTimeoutMs := value.(int)
+			if idleTimeoutMs < 0 {
+				idleTimeoutMs = 0
+			}
+
+			c.Api.HttpTimeouts.IdleTimeoutsDuration = time.Duration(idleTimeoutMs) * time.Millisecond
+		} else {
+			pfxlog.Logger().Warnf("[edge.api.httpTimeouts.idleTimeoutMs] defaulted to %v", c.Api.HttpTimeouts.ReadHeaderTimeoutDuration.Milliseconds())
+		}
+
+	} else {
+		pfxlog.Logger().Warn("using default edge.api.httpTimeouts, no config section found")
+	}
+
+	return nil
+}
+
 func LoadFromMap(cfgmap map[interface{}]interface{}) (*Config, error) {
 	edgeConfig := &Config{
 		Enabled: false,
diff --git a/controller/server/api_server.go b/controller/server/api_server.go
index e8c5f6b18..dc29134dc 100644
--- a/controller/server/api_server.go
+++ b/controller/server/api_server.go
@@ -26,7 +26,6 @@ import (
 	"io"
 	"log"
 	"net/http"
-	"time"
 )
 
 type apiServer struct {
@@ -39,18 +38,20 @@ func newApiServer(c *config.Config, r http.Handler) *apiServer {
 	logWriter := pfxlog.Logger().Writer()
 
 	tlsConfig := c.Api.Identity.ServerTLSConfig()
+
 	tlsConfig.ClientAuth = tls.RequestClientCert
 
 	return &apiServer{
 		logWriter: logWriter,
 		httpServer: &http.Server{
-			Addr:         c.Api.Listener,
-			WriteTimeout: time.Second * 10,
-			ReadTimeout:  time.Second * 5,
-			IdleTimeout:  time.Second * 5,
-			Handler:      r,
-			TLSConfig:    tlsConfig,
-			ErrorLog:     log.New(logWriter, "", 0),
+			Addr:              c.Api.Listener,
+			WriteTimeout:      c.Api.HttpTimeouts.WriteTimeoutDuration,
+			ReadTimeout:       c.Api.HttpTimeouts.ReadTimeoutDuration,
+			ReadHeaderTimeout: c.Api.HttpTimeouts.ReadHeaderTimeoutDuration,
+			IdleTimeout:       c.Api.HttpTimeouts.IdleTimeoutsDuration,
+			Handler:           r,
+			TLSConfig:         tlsConfig,
+			ErrorLog:          log.New(logWriter, "", 0),
 		},
 	}
 }