JailExemption

A time-boxed waiver of the jail policy that applies to one repository. It applies after aggregation: the verdict still reports the observed value, the threshold, that the rule would have breached, and which exemption suppressed it. Removing the document deactivates the exemption; the record of what was waived, by whom and why is kept.

apiVersion	vulnetix.com/v1
kind	JailExemption
Group	Scanners and gates
Status	Served. The config engine plans and applies it.
Objects per tenant	many, keyed by metadata.name
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists JailExemption in its kinds. See Management tokens.
Applied after	JailPolicy (deleted before them)
Terraform resource	vulnetix_jail_exemption, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.157.0 and later.
Pinned schema	v1.15.0/JailExemption.schema.json
Newest schema	latest/JailExemption.schema.json
First released in	v1.1.0
Print the built-in copy	vulnetix config schema JailExemption

Minimal

Only the fields the kind requires. From examples/JailExemption/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/JailExemption.schema.json
apiVersion: vulnetix.com/v1
kind: JailExemption
metadata:
  name: payments-moment-migration
spec:
  repository: acme/payments-api
  reason: Migration to date-fns is scheduled for the Q1 release train.

HCL (resource vulnetix_jail_exemption)

# Only the arguments the kind requires. From config-schemas examples/JailExemption/minimal.yaml.

resource "vulnetix_jail_exemption" "payments_moment_migration" {
  name       = "payments-moment-migration"
  reason     = "Migration to date-fns is scheduled for the Q1 release train."
  repository = "acme/payments-api"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/JailExemption.schema.json
apiVersion: vulnetix.com/v1
kind: JailExemption
metadata:
  name: payments-moment-migration
spec:
  repository: acme/payments-api
  reason: Migration to date-fns is scheduled for the Q1 release train.
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/JailExemption/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/JailExemption.schema.json
apiVersion: vulnetix.com/v1
kind: JailExemption
metadata:
  name: payments-moment-migration
  labels:
    team: payments
  annotations:
    ticket: https://tracker.example.com/PAY-1432
spec:
  repository: acme/payments-api
  rule: Off moment.js
  reason: Migration to date-fns is scheduled for the Q1 release train.
  expires: 2026-12-31T17:00:00Z

HCL (resource vulnetix_jail_exemption)

# Every argument the kind supports. From config-schemas examples/JailExemption/advanced.yaml.

resource "vulnetix_jail_exemption" "payments_moment_migration" {
  name       = "payments-moment-migration"
  expires    = "2026-12-31T17:00:00Z"
  reason     = "Migration to date-fns is scheduled for the Q1 release train."
  repository = "acme/payments-api"
  rule       = "Off moment.js"
  labels = {
    team = "payments"
  }
  annotations = {
    ticket = "https://tracker.example.com/PAY-1432"
  }
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/JailExemption.schema.json
apiVersion: vulnetix.com/v1
kind: JailExemption
metadata:
  name: payments-moment-migration
  labels:
    team: payments
  annotations:
    ticket: https://tracker.example.com/PAY-1432
spec:
  repository: acme/payments-api
  rule: Off moment.js
  reason: Migration to date-fns is scheduled for the Q1 release train.
  expires: 2026-12-31T17:00:00Z
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Description
apiVersion	string	yes		exactly vulnetix.com/v1	The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly JailExemption	Always JailExemption.
metadata	object	yes		no other keys
metadata.name	string	yes		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$	Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys
spec.repository	string	yes		pattern ^[^\s/]+(/[^\s/]+)+$	The repository waived. The exemption attaches to the jail policy in force for it: its per-repository policy, or the tenant default. Apply fails when no policy applies.
spec.rule	string	no		length 1 to any	The label of the rule waived, in the policy in force for the repository. Leave it out to waive every rule in that policy.
spec.reason	string	yes		pattern \S[\s\S]{6,}\S; length 8 to any	Why. At least 8 characters once trimmed: an exemption with no explanation cannot be told apart from the policy having been weakened.
spec.expires	string	no		format date-time, or format date	When the exemption lapses. Left out, it lapses 30 days after it is applied. The server caps it at 365 days after apply: a permanent waiver is a policy change and belongs in the JailPolicy.

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Order. Applied after JailPolicy, so a document that refers to one by metadata.name can be in the same apply. Deleted before them.
• Status. Applied, Unchanged or Deleted, with no other status fields. The phases the engine reports are explained under status phases.

How apply treats it

• An exemption is a record of a decision, so apply never edits one. A changed document retires the old exemption and creates a new one; removing the document retires it. The retired row keeps what was waived, by whom and why. approvedBy is the principal applying.
• The objects of this kind are the tenant’s active exemptions. The table has no name column, so metadata.name is kept on the ownership record. An exemption made in the console gets a name derived from its fields, so export can address it and applying that document adopts it.
• Applied after the JailPolicy it waives.

Terraform and OpenTofu

The resource is vulnetix_jail_exemption in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_jail_exemption.

Import an object that already exists by its name:

# Import an existing JailExemption by its name (metadata.name).
terraform import vulnetix_jail_exemption.payments_moment_migration payments-moment-migration

Install, authentication and how state is read: Terraform and OpenTofu.

More examples

examples/JailExemption/payments-migration.yaml from Vulnetix/config-schemas:

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/JailExemption.schema.json
apiVersion: vulnetix.com/v1
kind: JailExemption
metadata:
  name: payments-moment-migration
  annotations:
    ticket: https://tracker.example.com/PAY-1432
spec:
  repository: acme/payments-api
  rule: Off moment.js
  reason: Migration to date-fns is scheduled for the Q1 release train.
  expires: 2026-12-31

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.