Overview

Platform IaC is Vulnetix configuration written as YAML documents, kept in a repository and checked like code. Every document has the same shape: apiVersion: vulnetix.com/v1, a kind, metadata and a spec. Each kind has a published JSON Schema, a page here with its fields and samples, and, where the engine stores it, a Terraform resource.

apiVersion: vulnetix.com/v1
kind: QualityGate
metadata:
  name: default
spec:
  severity: high
  blockMalware: true

What exists

Piece	What it does	Page
Kinds	Every kind in config-schemas (the catalogue says which release), from the quality gate and jail policy to the organization’s members, the Software Factory, TEA, SIEM and cloud connections. Each page has the fields, rules, Minimal and Advanced samples in YAML, HCL and CLI, and how apply treats it.	Kind catalogue
Config engine	The server side that plans, applies and exports every kind, records who manages each object, and reports status. All kinds are served except LicensePolicy and LicenseExceptions, which are validate only.	Engine, Config API
CLI	vulnetix config validate, kinds and schema work offline; plan, apply and export use the engine.	Validate, Plan, Apply, Export
CEL	A when or selector expression on jail rules, risk rules, suppressions, package list entries, AI guardrails and detection rule feeds.	CEL rule expressions
Terraform and OpenTofu	The vulnetix/resolve provider, one resource per kind, published on the Terraform registry (OpenTofu registry listing is pending), and two AWS modules, released and installed by Git source.	Terraform and OpenTofu
GitHub Actions	Plan on pull requests, apply on the default branch.	config-plan, config-apply
Schemas	Signed JSON Schemas, with pinned and latest URLs.	Schema releases

Three ways to apply a document

Way	Use it when	Credential
vulnetix config apply	You keep documents in .vulnetix/config or pipe them in; a person or CI applies them.	A vmt_ config management token, or an owner or admin login
The config-apply workflow node and the GitHub Actions	A config repository should manage the tenant on every push to its default branch, with an approval.	The same token
Terraform or OpenTofu	The rest of your infrastructure is already Terraform.	The same token

All three go through the same engine, so a document gives the same result in each, and each records its own manager. --prune deletes only objects its own manager owns.

Find the page for your task

I want to	Read
See every kind	Kind catalogue
Write a quality gate document and check it in CI	Quickstart
Know what metadata.name and metadata.org mean	Documents
Write a when condition	CEL rule expressions
Manage settings with Terraform	Terraform and OpenTofu
Pull VEX documents in as suppressions	VEX documents as suppression rules
Get completion and errors in my editor	Editor setup
Check a schema file was published by Vulnetix	Verify a release
Know whether a schema update can break my files	Compatibility
Set the org quality gate from a script	Imperative commands
Keep AI firewall policy in a repository	AiFirewallPolicy
See what is not available yet	Roadmap

Platform IaC in each product

Every other product segment ends with a short Platform IaC section that links the kinds of that product.