Kind catalogue

Every config kind with a released schema, grouped by the part of Vulnetix it configures. All of them use apiVersion: vulnetix.com/v1. This page lists the 59 kinds in config-schemas v1.18.0.

Status	Meaning	Kinds
Served	The config engine plans, applies and exports it.	57
Validate only	The server stores nothing for it. Validating and planning check a document; apply sends nothing.	2
Schema only	The schema is released and the engine does not serve it yet.	0
Planned	No schema yet.	0

Each kind’s page has its fields, a Minimal and an Advanced sample in YAML, HCL and CLI, its rules, how apply treats it, and its Terraform resource. To apply any of them, see Apply; to manage them with Terraform or OpenTofu, see Terraform and OpenTofu. Release history: Schema releases.

Org

Who the organization is, who is in it, and how it is told things.

Kind	Objects	Status	Terraform	What it declares
Organization	one	Served	vulnetix_organization	The organisation’s own settings: its display name, its company email domains and whether Drift protection is on.
Member	many	Served	vulnetix_member	A person in the organisation, by email address, with their role.
ServiceAccount	many	Served	vulnetix_service_account	A credential for CI that is not a person.
NotificationDefaults	one	Served	vulnetix_notification_defaults	The organisation’s default browser push notifications: which events are pushed to a person who has not chosen for themselves.

Vault

Secrets the organization keeps for its other settings.

Kind	Objects	Status	Terraform	What it declares
VaultEntry	many	Served	vulnetix_vault_entry	One secret in the tenant’s vault: an AI provider key, an environment variable for Pix sandboxes and Belai hosts, or a provider management key.

Integrations

Connections to GitHub, other forges, messaging services, Wiz and your own package and container registries.

Kind	Objects	Status	Terraform	What it declares
GitHubInstallation	many	Served	vulnetix_git_hub_installation	Adopts an installation of the Vulnetix GitHub App on github.com, so that configuration as code can name it and depend on it.
ForgeConnection	many	Served	vulnetix_forge_connection	How the Software Factory reaches a git forge other than github.com: a bot account’s access token on Gitea, Forgejo or GitLab (or GitHub Enterprise Server).
MessagingConnection	many	Served	vulnetix_messaging_connection	One destination the messaging centre can send to: a Slack channel, a Microsoft Teams workflow, a Discord or Google Chat incoming webhook, a Jira site.
MessagingRoute	many	Served	vulnetix_messaging_route	A messaging workflow: which events go to which messaging connections, filtered how, rendered with which template, and how often.
MessagingTemplate	many	Served	vulnetix_messaging_template	An organisation’s own message template, which a MessagingRoute uses instead of the system template for the event type.
WizConnection	one	Served	vulnetix_wiz_connection	The Wiz service account the tenant authorised.
RegistryConnection	many	Served	vulnetix_registry_connection	A private package or container registry that Vulnetix scans may read, and how to authenticate to it: an npm registry, a PyPI index, a Maven repository or an OCI registry.

Repo scope

Which organizations and repositories the Software Factory works on, and how.

Kind	Objects	Status	Terraform	What it declares
FactoryManagedOrg	many	Served	vulnetix_factory_managed_org	An organisation or user account the Software Factory manages: the switch on the Factory organisations page.
RepositorySettings	many	Served	vulnetix_repository_settings	The Software Factory’s controls for one repository: the settings panel of the Factory repositories page.

Scanners and gates

What a scan must pass, and what it checks.

Kind	Objects	Status	Terraform	What it declares
QualityGate	one	Served	vulnetix_quality_gate	The tenant’s quality gate: the checks every vulnetix scan in CI must pass.
JailPolicy	many	Served	vulnetix_jail_policy	A jail policy: the ordered rules vulnetix jail evaluates for a repository over everything ever reported for it (vulnerabilities past their SLA.
JailExemption	many	Served	vulnetix_jail_exemption	A time-boxed waiver of the jail policy that applies to one repository.
LicensePolicy	many	Validate only	none	A licence policy: which licence categories produce findings and at what severity, how unresolved licences and dependency scopes are treated, and per-project overrides.
LicenseExceptions	one	Validate only	none	Recorded, attributed exceptions to the licence policy: a licence exempted everywhere (blanket) or one package exempted, each with who approved it, why, and until when.
ScannerProfile	one	Served	vulnetix_scanner_profile	Which scanners the Software Factory runs, the SLSA level its builds must reach, and the evidence it keeps.

Prioritisation

How open findings are ranked, how the CISA SSVC decision is made, and how fast findings must be fixed.

Kind	Objects	Status	Terraform	What it declares
RiskStrategy	many	Served	vulnetix_risk_strategy	A risk prioritisation strategy: an ordered list of rules that puts every open finding in a priority tier.
RemediationPolicy	one	Served	vulnetix_remediation_policy	The tenant’s remediation policy (triage policy in the console): the remediation window per severity band, the triage threshold.
SsvcPolicy	one	Served	vulnetix_ssvc_policy	How the tenant makes its CISA SSVC decision (https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc) for a finding: Track, Track*, Attend or Act.

Suppression

Findings that are known not to matter, and the VEX documents that say so.

Kind	Objects	Status	Terraform	What it declares
Suppression	many	Served	vulnetix_suppression	A suppression rule: findings that match its scope are suppressed, now and in every later scan, until it expires.
VexSource	many	Served	vulnetix_vex_source	VEX documents read back as suppression rules.

Campaigns

Time-boxed remediation work across repositories.

Kind	Objects	Status	Terraform	What it declares
Campaign	many	Served	vulnetix_campaign	A remediation campaign: a named, time-boxed push to drive a chosen set of vulnerabilities, dependencies or repositories to a defined done state.

Package firewall

What the package firewall lets through.

Kind	Objects	Status	Terraform	What it declares
PackageFirewallPolicy	one	Served	vulnetix_package_firewall_policy	The tenant’s package firewall policy: what the registry proxy refuses to serve, the posture it enforces in, per-ecosystem posture overrides.
PackageList	many	Served	vulnetix_package_list	Entries for the tenant’s package firewall allow list or deny list.

AI firewall

What the AI firewall lets models and agents do.

Kind	Objects	Status	Terraform	What it declares
AiFirewallPolicy	one	Served	vulnetix_ai_firewall_policy	The tenant’s AI Firewall policy: which providers and models its agents may use, the guardrails the gateway applies to every request, the hold for review setting.
AiProvider	many	Served	vulnetix_ai_provider	A custom AI Firewall provider owned by the tenant: a model server the gateway forwards to, beside the built-in catalogue.
AiGovernanceList	many	Served	vulnetix_ai_governance_list	An allow or deny list of AI tools, MCP servers, skills or clients, stored as AI Firewall guardrails: one guardrail row per pattern, of rule type _.

Malware

Indicators of compromise the organization manages.

Kind	Objects	Status	Terraform	What it declares
MalwareIoc	many	Served	vulnetix_malware_ioc	An indicator of compromise the tenant manages itself, beside the ones its malware scans found.

Factory

Software Factory settings, workflows, triggers, schedules and budgets.

Kind	Objects	Status	Terraform	What it declares
FactorySettings	one	Served	vulnetix_factory_settings	The Software Factory settings document: the tenant-wide factory settings the console’s Settings page edits.
FactoryWorkflow	many	Served	vulnetix_factory_workflow	A Software Factory workflow: the graph of steps a run walks, from a trigger through scans, decisions, crews, gates and people to its outputs.
FactoryTrigger	many	Served	vulnetix_factory_trigger	Something that starts a Software Factory workflow: a GitHub webhook event, a finding, an issue label, a kanban card move, a firewall sighting, or a person pressing Run.
FactorySchedule	many	Served	vulnetix_factory_schedule	A cron schedule that starts a Software Factory workflow: a cron trigger node in the workflow’s graph whose id is metadata.name (at most 40 characters).
FactoryBudget	many	Served	vulnetix_factory_budget	A Software Factory budget: a limit on the tokens or calls the factory spends, for the whole factory, one GitHub organisation, one repository, one workflow or one step.

AI libraries

Belai agents, crews and library items.

Kind	Objects	Status	Terraform	What it declares
AgentProfile	many	Served	vulnetix_agent_profile	An agent of the organisation’s Belai library: the markdown agent definition Belai writes, and the files the agent uses beside it.
Crew	many	Served	vulnetix_crew	A crew of the organisation’s Belai library: a named set of worker agents a host runs together.
LibraryItem	many	Served	vulnetix_library_item	One item of the organisation’s Belai library that is not an agent or a crew: a skill (an Agent Skills SKILL.md), prompt, command, process, MCP server, repo, budget set.

Pix

Pix sandbox launch settings and egress.

Kind	Objects	Status	Terraform	What it declares
SandboxLaunchProfile	many	Served	vulnetix_sandbox_launch_profile	The launch configuration of one Pix sandbox: what the next launch or relaunch of the sandbox installs and how Belai runs on it.
SandboxEgressPolicy	many	Served	vulnetix_sandbox_egress_policy	The outbound network policy of one Pix sandbox: its egress mode and the hostnames allowed or denied, the same two things the console’s egress page sets.

TEA

Products, components and collections published through the Transparency Exchange API.

Kind	Objects	Status	Terraform	What it declares
TeaProduct	many	Served	vulnetix_tea_product	A product the tenant publishes through the Transparency Exchange API (TEA): the top of the product, release, collection and artifact tree that TEA consumers read.
TeaComponent	many	Served	vulnetix_tea_component	A component the tenant publishes through the Transparency Exchange API (TEA): a part a product is assembled from, such as a service, a library or an installer.
TeaCollection	many	Served	vulnetix_tea_collection	The collection of one published release: the versioned set of artifacts (SBOMs, VEX documents, attestations) TEA serves for it.
TeaAccessPolicy	many	Served	vulnetix_tea_access_policy	Who may read one published TEA object: a product, a component or a release’s collection.
TeaPublicationTarget	many	Served	vulnetix_tea_publication_target	A remote TEA server the tenant is willing to mirror published objects to, registered once so it can be reviewed, rather than named by URL in each access policy.

SIEM

Guardian searches, detection rules, alerts, reports and log sources.

Kind	Objects	Status	Terraform	What it declares
SavedSearch	many	Served	vulnetix_saved_search	A Guardian saved search.
DetectionRule	many	Served	vulnetix_detection_rule	A Guardian alert rule: a detection run on a schedule over the tenant’s logs, raising alerts.
AlertTrigger	many	Served	vulnetix_alert_trigger	A Guardian trigger: run a SavedSearch or a DetectionRule on a schedule and, when its rows pass the levers, start a Software Factory workflow.
ScheduledReport	many	Served	vulnetix_scheduled_report	A Guardian scheduled send: run a SavedSearch on a calendar and send its rows to messaging connections or email.
LogSource	many	Served	vulnetix_log_source	A way logs reach Guardian, backed by a Guardian ingest token of the same type.

Cloud

How Vulnetix reaches an AWS estate and what it reads there.

Kind	Objects	Status	Terraform	What it declares
AwsConnection	one	Served	vulnetix_aws_connection	How Vulnetix reaches the tenant’s AWS estate.
AwsAccount	many	Served	vulnetix_aws_account	One AWS account the AwsConnection reaches, keyed on its account id within the tenant (two tenants may connect the same account).
CloudSensors	many	Served	vulnetix_cloud_sensors	Which AWS-native sources and Vulnetix passes are read, for one account or for every account.

API inventory

Where OpenAPI and Swagger descriptions are read from.

Kind	Objects	Status	Terraform	What it declares
ApiSpecSource	many	Served	vulnetix_api_spec_source	Where Vulnetix finds an organisation’s OpenAPI and Swagger descriptions.

Virtual patching

Published rule feeds and the configuration runtime sensors enroll with.

Kind	Objects	Status	Terraform	What it declares
DetectionRuleFeed	many	Served	vulnetix_detection_rule_feed	A curated feed of virtual patches, countermeasures and catalogue rules, published to a public URL for IDS, IPS, WAF.
RuntimeSensorPolicy	many	Served	vulnetix_runtime_sensor_policy	The configuration runtime sensors enroll with and keep pulling: mode, hold, rule feeds, forwarding and tamper protection, and which people or MDM systems it applies to.

Compliance

Compliance obligations measured on a cadence: report frameworks, SLSA, NIST SSDF and a cryptography policy.

Kind	Objects	Status	Terraform	What it declares
ComplianceTarget	many	Served	vulnetix_compliance_target	A compliance obligation the organisation holds itself to, and how often Vulnetix measures it.