TeaProduct

A product the tenant publishes through the Transparency Exchange API (TEA): the top of the product, release, collection and artifact tree that TEA consumers read. The product itself is config. Its releases, their collections and the artifacts in them are published by CI pipelines as software ships, so they are not declared here. The server assigns the product’s UUID and TEI and reports them in status. Who may read the product is declared with a TeaAccessPolicy; until one exists the product is private. Removing the document deletes the product while no release has been published under it. Once CI has published a release, the product and its releases stay, and only the config management of the product ends.

apiVersion	vulnetix.com/v1
kind	TeaProduct
Group	TEA
Status	Served. The config engine plans and applies it.
Objects per tenant	many, keyed by metadata.name
Token and role	An owner or admin session, or a vmt_ config management token with the owner or admin role that lists TeaProduct in its kinds. See Management tokens.
Terraform resource	vulnetix_tea_product, imported by name (see Terraform and OpenTofu)
CLI	vulnetix config apply, CLI v3.168.0 and later.
Pinned schema	v1.15.0/TeaProduct.schema.json
Newest schema	latest/TeaProduct.schema.json
First released in	v1.6.0
Print the built-in copy	vulnetix config schema TeaProduct

Minimal

Only the fields the kind requires. From examples/TeaProduct/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/TeaProduct.schema.json
apiVersion: vulnetix.com/v1
kind: TeaProduct
metadata:
  name: acme-payments
spec:
  name: Acme Payments

HCL (resource vulnetix_tea_product)

# Only the arguments the kind requires. From config-schemas examples/TeaProduct/minimal.yaml.

resource "vulnetix_tea_product" "acme_payments" {
  name         = "acme-payments"
  product_name = "Acme Payments"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/TeaProduct.schema.json
apiVersion: vulnetix.com/v1
kind: TeaProduct
metadata:
  name: acme-payments
spec:
  name: Acme Payments
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/TeaProduct/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/TeaProduct.schema.json
apiVersion: vulnetix.com/v1
kind: TeaProduct
metadata:
  name: acme-payments
  labels:
    team: payments
  annotations:
    note: Releases are published by the payments-api release workflow.
spec:
  name: Acme Payments
  identifiers:
    - idType: PURL
      idValue: pkg:github/acme/payments-api
    - idType: CPE
      idValue: cpe:2.3:a:acme:payments:*:*:*:*:*:*:*:*

HCL (resource vulnetix_tea_product)

# Every argument the kind supports. From config-schemas examples/TeaProduct/advanced.yaml.

resource "vulnetix_tea_product" "acme_payments" {
  name = "acme-payments"
  identifiers = [
    {
      id_type  = "PURL"
      id_value = "pkg:github/acme/payments-api"
    },
    {
      id_type  = "CPE"
      id_value = "cpe:2.3:a:acme:payments:*:*:*:*:*:*:*:*"
    },
  ]
  product_name = "Acme Payments"
  labels = {
    team = "payments"
  }
  annotations = {
    note = "Releases are published by the payments-api release workflow."
  }
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/TeaProduct.schema.json
apiVersion: vulnetix.com/v1
kind: TeaProduct
metadata:
  name: acme-payments
  labels:
    team: payments
  annotations:
    note: Releases are published by the payments-api release workflow.
spec:
  name: Acme Payments
  identifiers:
    - idType: PURL
      idValue: pkg:github/acme/payments-api
    - idType: CPE
      idValue: cpe:2.3:a:acme:payments:*:*:*:*:*:*:*:*
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Default	Allowed values	Description
apiVersion	string	yes		exactly vulnetix.com/v1	The document format version. Every kind in this release is vulnetix.com/v1.
kind	string	yes		exactly TeaProduct	Always TeaProduct.
metadata	object	yes		no other keys
metadata.name	string	yes		pattern ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
metadata.org	string	no		format uuid	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
metadata.labels	object	no		map of string to string (length 0 to 256); keys match ^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$	Free key/value labels. Stored with the object, never interpreted by the server.
metadata.annotations	object	no		map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
spec	object	yes		no other keys
spec.name	string	yes		pattern ^\S(.*\S)?$; length 1 to 256	The product name TEA consumers see, such as Acme Payments. Unique among the tenant’s products. The first time a name is published the server derives the product’s UUID from it, so a CI pipeline that publishes releases under the same product name writes to this product. Changing the name later keeps the UUID.
spec.identifiers	array of object	no		items unique	Identifiers for the product besides its TEI, in the order consumers see them. The server assigns the TEI (urn:tei:uuid::) itself because it names this server’s authority over the product, so it is reported in status and cannot be declared.
spec.identifiers[].idType	string	yes		PURL, CPE, COMPLIANCE_DOCUMENT	PURL: a package URL. CPE: a CPE 2.3 name. COMPLIANCE_DOCUMENT: a compliance document type the TEA specification names.
spec.identifiers[].idValue	string	yes		length 1 to 1024	The identifier itself.

Applying this kind

• Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
• Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
• Status. Applied, Unchanged or Deleted, with no other status fields. The phases the engine reports are explained under status phases.

How apply treats it

Through the publisher API’s validators and writers. The uuid is derived from the name as the publisher API derives it, so an object CI already created is adopted. Releases and artifacts stay runtime data that CI publishes: an object with published releases is let go on delete, never deleted. See TEA.

Terraform and OpenTofu

The resource is vulnetix_tea_product in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_tea_product.

Import an object that already exists by its name:

# Import an existing TeaProduct by its name (metadata.name).
terraform import vulnetix_tea_product.acme_payments acme-payments

Install, authentication and how state is read: Terraform and OpenTofu.

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.