{"resources":{"auth0":{"id":"auth0","name":"auth0","fields":{"action":{"name":"action","type":"\u001bauth0.action","title":"Auth0 action","desc":"Piece of custom Node.js logic that Auth0 runs during an authentication or management flow, such as login, machine-to-machine token issuance, or user registration. Select an action by its `name`. `supportedTriggers` identifies which flow(s) the action can bind to, `status` and `deployed` report whether the current version is live, and `code` is the action's source, useful for spotting hardcoded secrets or unreviewed logic running inline in the authentication path. `secrets` lists the names of configured secrets without exposing their values.","provider":"go.mondoo.com/mql/providers/auth0","is_implicit_resource":true,"maturity":"experimental"},"actions":{"name":"actions","type":"\u0019\u001bauth0.action","title":"Actions that run custom logic during authentication and other flows","provider":"go.mondoo.com/mql/providers/auth0"},"attackProtection":{"name":"attackProtection","type":"\u001bauth0.attackProtection","title":"Auth0 attack protection","desc":"Tenant-wide defenses against credential attacks: brute-force login attempts, suspicious traffic from a small number of IPs hitting many accounts, and logins with passwords known to be exposed in third-party breaches. Each defense is flattened onto this resource with a disambiguating prefix (`bruteForce*`, `suspiciousIpThrottling*`, `breachedPasswordDetection*`) since all three are singleton configuration blocks scoped to the tenant, not independently addressable records. A tenant with `breachedPasswordDetectionEnabled` false, or `bruteForceEnabled` false, accepts logins Auth0 would otherwise have blocked or flagged.","provider":"go.mondoo.com/mql/providers/auth0","is_implicit_resource":true,"maturity":"experimental"},"client":{"name":"client","type":"\u001bauth0.client","title":"Auth0 application","desc":"OAuth 2.0/OIDC client (an \"Application\" in the Auth0 dashboard) registered in the tenant, identified by its `id` (the Auth0 `client_id`). Covers the settings that govern how the application authenticates and what it is permitted to do: `grantTypes` lists the OAuth grants it may use, `tokenEndpointAuthMethod` and the refresh-token fields describe its credential and token-rotation posture, and `callbacks`/`allowedOrigins`/ `webOrigins` bound where it may redirect users and make cross-origin calls from. A public client with `implicit` in `grantTypes`, a wildcard callback URL, or refresh tokens that never rotate are common findings.","provider":"go.mondoo.com/mql/providers/auth0","is_implicit_resource":true,"maturity":"experimental"},"clientGrant":{"name":"clientGrant","type":"\u001bauth0.clientGrant","title":"Auth0 client grant","desc":"Machine-to-machine authorization that permits an application to obtain access tokens for an API through the client-credentials grant. `client` resolves the application the grant is issued to, `audience` is the API identifier the grant targets (resolvable through resourceServer), and `scopes` lists the permissions the application is granted, unless allowAllScopes is set, in which case every scope the API defines is granted. `organizationUsage` and `allowAnyOrganization` govern whether the grant may be used in an organization context. An overly broad set of scopes on a machine-to-machine grant is a common finding.","provider":"go.mondoo.com/mql/providers/auth0","is_implicit_resource":true,"maturity":"experimental"},"clientGrants":{"name":"clientGrants","type":"\u0019\u001bauth0.clientGrant","title":"Machine-to-machine grants authorizing applications to call APIs","provider":"go.mondoo.com/mql/providers/auth0"},"clients":{"name":"clients","type":"\u0019\u001bauth0.client","title":"Applications (OAuth/OIDC clients) registered in the tenant","provider":"go.mondoo.com/mql/providers/auth0"},"connection":{"name":"connection","type":"\u001bauth0.connection","title":"Auth0 identity connection","desc":"Identity source available to applications in the tenant: a database connection (username/password, stored and verified by Auth0), a social connection (Google, GitHub, and so on), or an enterprise connection (SAML, OIDC, Active Directory/LDAP, Azure AD). The `strategy` field selects the connection kind. For database connections, `passwordPolicy` and the `passwordHistory*`/`passwordDictionaryEnabled` fields describe the credential strength Auth0 enforces at signup and password reset, and `mfaActive` reports whether multi-factor authentication is required for logins through this connection. `enabledClients` resolves the applications permitted to authenticate against it.","provider":"go.mondoo.com/mql/providers/auth0","is_implicit_resource":true,"maturity":"experimental"},"connections":{"name":"connections","type":"\u0019\u001bauth0.connection","title":"Identity connections (database, social, and enterprise) available to applications","provider":"go.mondoo.com/mql/providers/auth0"},"guardian":{"name":"guardian","type":"\u001bauth0.guardian","title":"Auth0 multi-factor authentication policy","desc":"Tenant-wide multi-factor authentication (MFA) configuration: the enrollment `policy` that decides when users are challenged for a second factor, and which authentication factors are enabled for the tenant. `policy` is one of never (MFA off), all-applications (every login requires MFA), or confidence-score (adaptive MFA that challenges only risky logins). The per-factor flags (otpEnabled, webAuthnPlatformEnabled, webAuthnRoamingEnabled, pushEnabled, duoEnabled, phoneEnabled, emailEnabled, recoveryCodeEnabled) report which factor types end users may enroll, and the webAuthn*UserVerification fields report how strictly the WebAuthn factors verify the user. A tenant with `policy` never, or one that offers only the phishable phoneEnabled/emailEnabled factors, is a common finding.","provider":"go.mondoo.com/mql/providers/auth0","is_implicit_resource":true,"maturity":"experimental"},"logStream":{"name":"logStream","type":"\u001bauth0.logStream","title":"Auth0 log stream","desc":"Connection that exports tenant log events to an external destination such as AWS EventBridge, Datadog, Splunk, or a generic HTTP endpoint. Select a stream by its `name`. `type` identifies the destination kind, `sink` carries the destination-specific configuration (endpoint URLs, region, API keys are redacted), and `status` reports whether delivery is active, paused, or has been suspended by Auth0 after repeated failures. An absent or non-active stream means tenant authentication events are not being shipped to a SIEM or audit pipeline.","provider":"go.mondoo.com/mql/providers/auth0","is_implicit_resource":true,"maturity":"experimental"},"logStreams":{"name":"logStreams","type":"\u0019\u001bauth0.logStream","title":"Log streams that export tenant events to external destinations","provider":"go.mondoo.com/mql/providers/auth0"},"organization":{"name":"organization","type":"\u001bauth0.organization","title":"Auth0 organization","desc":"Organization used for B2B multi-tenancy, grouping members and the identity connections they authenticate through, selected by its `name`. `connections` resolves the identity connections enabled for the organization, `members` resolves the users who belong to it, and `metadata` carries the custom key/value pairs attached to the organization. `displayName` and `brandingLogoUrl` cover how the organization is presented on its login page.","provider":"go.mondoo.com/mql/providers/auth0","is_implicit_resource":true,"maturity":"experimental"},"organizations":{"name":"organizations","type":"\u0019\u001bauth0.organization","title":"Organizations used for B2B multi-tenancy","provider":"go.mondoo.com/mql/providers/auth0"},"resourceServer":{"name":"resourceServer","type":"\u001bauth0.resourceServer","title":"Auth0 API","desc":"API (resource server) registered in the tenant that applications request access tokens for, selected by its `identifier` (the API audience, for example https://api.example.com). `signingAlgorithm` is the algorithm used to sign issued access tokens (RS256 uses asymmetric keys, HS256 a shared symmetric secret), `tokenLifetime` bounds how long an access token stays valid, and `enforcePolicies` reports whether role-based access control (RBAC) gates the scopes a token may carry. `allowOfflineAccess` controls whether refresh tokens may be issued for the API, `scopes` lists the permissions the API defines, and the proofOfPossession fields report whether sender-constrained tokens are required. An API with enforcePolicies off, HS256 signing, or an unusually long tokenLifetime is a common finding.","provider":"go.mondoo.com/mql/providers/auth0","is_implicit_resource":true,"maturity":"experimental"},"resourceServers":{"name":"resourceServers","type":"\u0019\u001bauth0.resourceServer","title":"APIs (resource servers) applications request access tokens for","provider":"go.mondoo.com/mql/providers/auth0"},"role":{"name":"role","type":"\u001bauth0.role","title":"Auth0 role","desc":"Named collection of permissions that can be assigned to users or, through an application's client-credentials grant, to machine clients. Select a role by its `name`. The `permissions` field lists the resource-server scopes the role grants, and `users` lists the accounts currently holding it, letting you audit membership in high-privilege roles directly.","provider":"go.mondoo.com/mql/providers/auth0","is_implicit_resource":true,"maturity":"experimental"},"roles":{"name":"roles","type":"\u0019\u001bauth0.role","title":"Administrative and application roles defined in the tenant","provider":"go.mondoo.com/mql/providers/auth0"},"tenant":{"name":"tenant","type":"\u001bauth0.tenant","title":"Auth0 tenant settings","desc":"Tenant-wide configuration that applies across every application and connection in the Auth0 tenant. `sessionLifetime` and `idleSessionLifetime` bound how long an authenticated session and an idle session may last before re-authentication is required, `allowedLogoutUrls` is the allowlist end-user logout redirects are validated against, and `flags` carries the full set of tenant feature flags returned by the API.","provider":"go.mondoo.com/mql/providers/auth0","is_implicit_resource":true,"maturity":"experimental"},"user":{"name":"user","type":"\u001bauth0.user","title":"Auth0 user","desc":"Individual account held in one of the tenant's database connections and selected by its `id` (the Auth0 `user_id`, for example `auth0|507f1f77bcf86cd799439011`). The lifecycle fields (`blocked`, `lastLogin`, `loginsCount`) surface dormant or locked-out accounts, `multifactor` lists which MFA factor types the user has enrolled, and `identities` shows every linked social or enterprise account merged into this profile. `roles` resolves the administrative and application roles granted to the user.","provider":"go.mondoo.com/mql/providers/auth0","is_implicit_resource":true,"maturity":"experimental"},"users":{"name":"users","type":"\u0019\u001bauth0.user","title":"Users held in the tenant's database connections","provider":"go.mondoo.com/mql/providers/auth0"}},"title":"Auth0 tenant","desc":"Namespace for the identity resources reachable through an Auth0 tenant's Management API: applications, identity connections, users, roles, actions, and log streams. Query auth0.tenant for tenant-wide session and flag settings, and auth0.attackProtection for the brute-force, suspicious-IP, and breached-password defenses that apply across the whole tenant.","min_provider_version":"13.0.0","provider":"go.mondoo.com/mql/providers/auth0","maturity":"experimental"},"auth0.action":{"id":"auth0.action","name":"auth0.action","fields":{"code":{"name":"code","type":"\u0007","is_mandatory":true,"title":"Action source code","provider":"go.mondoo.com/mql/providers/auth0"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Timestamp when the action was created","provider":"go.mondoo.com/mql/providers/auth0"},"dependencies":{"name":"dependencies","type":"\u0019\n","is_mandatory":true,"title":"npm package dependencies declared by the action","desc":"Each entry is a dict with keys name, version, and registryUrl.","provider":"go.mondoo.com/mql/providers/auth0"},"deployed":{"name":"deployed","type":"\u0004","is_mandatory":true,"title":"Whether the current version of the action is deployed to its trigger(s)","provider":"go.mondoo.com/mql/providers/auth0"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Action ID","provider":"go.mondoo.com/mql/providers/auth0"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Action name","provider":"go.mondoo.com/mql/providers/auth0"},"runtime":{"name":"runtime","type":"\u0007","is_mandatory":true,"title":"Runtime the action executes in, for example node18 or node22","provider":"go.mondoo.com/mql/providers/auth0"},"secrets":{"name":"secrets","type":"\u0019\n","is_mandatory":true,"title":"Names of secrets configured for the action","desc":"Each entry is a dict with the secret name. Values are never returned by the API.","provider":"go.mondoo.com/mql/providers/auth0"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Deployment status of the action's current version","desc":"One of pending, building, packaged, built, retrying, or failed.","provider":"go.mondoo.com/mql/providers/auth0"},"supportedTriggers":{"name":"supportedTriggers","type":"\u0019\n","is_mandatory":true,"title":"Trigger(s) the action is bound to","desc":"Each entry is a dict with keys id (post-login, credentials-exchange, pre-user-registration, and so on) and version.","provider":"go.mondoo.com/mql/providers/auth0"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Timestamp when the action was last updated","provider":"go.mondoo.com/mql/providers/auth0"}},"title":"Auth0 action","desc":"Piece of custom Node.js logic that Auth0 runs during an authentication or management flow, such as login, machine-to-machine token issuance, or user registration. Select an action by its `name`. `supportedTriggers` identifies which flow(s) the action can bind to, `status` and `deployed` report whether the current version is live, and `code` is the action's source, useful for spotting hardcoded secrets or unreviewed logic running inline in the authentication path. `secrets` lists the names of configured secrets without exposing their values.","min_provider_version":"13.0.0","defaults":"name status","provider":"go.mondoo.com/mql/providers/auth0","maturity":"experimental"},"auth0.attackProtection":{"id":"auth0.attackProtection","name":"auth0.attackProtection","fields":{"breachedPasswordDetectionAdminNotificationFrequency":{"name":"breachedPasswordDetectionAdminNotificationFrequency","type":"\u0019\u0007","is_mandatory":true,"title":"How often admin notification digest emails are sent","desc":"One of immediately, daily, weekly, or monthly.","provider":"go.mondoo.com/mql/providers/auth0"},"breachedPasswordDetectionEnabled":{"name":"breachedPasswordDetectionEnabled","type":"\u0004","is_mandatory":true,"title":"Whether breached-password detection is enabled","provider":"go.mondoo.com/mql/providers/auth0"},"breachedPasswordDetectionMethod":{"name":"breachedPasswordDetectionMethod","type":"\u0007","is_mandatory":true,"title":"Breached-password detection method","desc":"One of standard (checks at login/signup) or enhanced (also checks continuously against new breaches).","provider":"go.mondoo.com/mql/providers/auth0"},"breachedPasswordDetectionShields":{"name":"breachedPasswordDetectionShields","type":"\u0019\u0007","is_mandatory":true,"title":"Actions (\"shields\") on detection","desc":"Any of block, user_notification, and admin_notification.","provider":"go.mondoo.com/mql/providers/auth0"},"bruteForceAllowlist":{"name":"bruteForceAllowlist","type":"\u0019\u0007","is_mandatory":true,"title":"IP addresses exempted from brute-force lockout","provider":"go.mondoo.com/mql/providers/auth0"},"bruteForceEnabled":{"name":"bruteForceEnabled","type":"\u0004","is_mandatory":true,"title":"Whether brute-force protection is enabled","provider":"go.mondoo.com/mql/providers/auth0"},"bruteForceMaxAttempts":{"name":"bruteForceMaxAttempts","type":"\u0005","is_mandatory":true,"title":"Number of failed attempts before a lockout is triggered","provider":"go.mondoo.com/mql/providers/auth0"},"bruteForceMode":{"name":"bruteForceMode","type":"\u0007","is_mandatory":true,"title":"Brute-force lockout mode","desc":"One of count_per_identifier_and_ip (username+IP pair, the default) or count_per_identifier (username alone).","provider":"go.mondoo.com/mql/providers/auth0"},"suspiciousIpThrottlingAllowlist":{"name":"suspiciousIpThrottlingAllowlist","type":"\u0019\u0007","is_mandatory":true,"title":"IP addresses exempted from suspicious-IP throttling","provider":"go.mondoo.com/mql/providers/auth0"},"suspiciousIpThrottlingEnabled":{"name":"suspiciousIpThrottlingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether suspicious-IP throttling is enabled","provider":"go.mondoo.com/mql/providers/auth0"},"suspiciousIpThrottlingPreLoginMaxAttempts":{"name":"suspiciousIpThrottlingPreLoginMaxAttempts","type":"\u0005","is_mandatory":true,"title":"Maximum sign-in attempts allowed per interval before throttling on the pre-login stage","provider":"go.mondoo.com/mql/providers/auth0"},"suspiciousIpThrottlingPreRegistrationMaxAttempts":{"name":"suspiciousIpThrottlingPreRegistrationMaxAttempts","type":"\u0005","is_mandatory":true,"title":"Maximum sign-up attempts allowed per interval before throttling on the pre-registration stage","provider":"go.mondoo.com/mql/providers/auth0"}},"title":"Auth0 attack protection","desc":"Tenant-wide defenses against credential attacks: brute-force login attempts, suspicious traffic from a small number of IPs hitting many accounts, and logins with passwords known to be exposed in third-party breaches. Each defense is flattened onto this resource with a disambiguating prefix (`bruteForce*`, `suspiciousIpThrottling*`, `breachedPasswordDetection*`) since all three are singleton configuration blocks scoped to the tenant, not independently addressable records. A tenant with `breachedPasswordDetectionEnabled` false, or `bruteForceEnabled` false, accepts logins Auth0 would otherwise have blocked or flagged.","min_provider_version":"13.0.0","defaults":"bruteForceEnabled breachedPasswordDetectionEnabled","provider":"go.mondoo.com/mql/providers/auth0","maturity":"experimental"},"auth0.client":{"id":"auth0.client","name":"auth0.client","fields":{"allowedLogoutUrls":{"name":"allowedLogoutUrls","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed URLs to redirect to after logout","provider":"go.mondoo.com/mql/providers/auth0"},"allowedOrigins":{"name":"allowedOrigins","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed origins for cross-origin (CORS) authentication requests","provider":"go.mondoo.com/mql/providers/auth0"},"appType":{"name":"appType","type":"\u0007","is_mandatory":true,"title":"Application type","desc":"One of native, spa (single-page app), regular_web, or non_interactive (machine-to-machine).","provider":"go.mondoo.com/mql/providers/auth0"},"authenticationMethods":{"name":"authenticationMethods","type":"\u0019\u0007","is_mandatory":true,"title":"Advanced client-authentication methods configured","desc":"Any of private_key_jwt, tls_client_auth (CA-based mutual TLS), and self_signed_tls_client_auth (self-signed mutual TLS). Empty when the application authenticates with a client secret or is a public client. See tokenEndpointAuthMethod for the client-secret posture.","provider":"go.mondoo.com/mql/providers/auth0"},"callbacks":{"name":"callbacks","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed callback (redirect) URLs after authentication","provider":"go.mondoo.com/mql/providers/auth0"},"clientMetadata":{"name":"clientMetadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Free-form metadata attached to the application","provider":"go.mondoo.com/mql/providers/auth0"},"crossOriginAuth":{"name":"crossOriginAuth","type":"\u0004","is_mandatory":true,"title":"Whether cross-origin authentication is enabled for this application","provider":"go.mondoo.com/mql/providers/auth0"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Application description","provider":"go.mondoo.com/mql/providers/auth0"},"enabledConnections":{"name":"enabledConnections","type":"\u0019\u001bauth0.connection","title":"Identity connections this application is enabled on","provider":"go.mondoo.com/mql/providers/auth0"},"grantTypes":{"name":"grantTypes","type":"\u0019\u0007","is_mandatory":true,"title":"OAuth 2.0 grant types the application is permitted to use","desc":"Common values: authorization_code, implicit, refresh_token, client_credentials, password, and the device and passwordless variants. implicit is legacy; client_credentials should be reserved for non_interactive applications.","provider":"go.mondoo.com/mql/providers/auth0"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Client ID (Auth0's identifier for the application)","provider":"go.mondoo.com/mql/providers/auth0"},"initiateLoginUri":{"name":"initiateLoginUri","type":"\u0007","is_mandatory":true,"title":"URI Auth0 redirects to in order to initiate a login for this application","provider":"go.mondoo.com/mql/providers/auth0"},"isFirstParty":{"name":"isFirstParty","type":"\u0004","is_mandatory":true,"title":"Whether this application is a \"first party\" application","provider":"go.mondoo.com/mql/providers/auth0"},"jwtConfiguration":{"name":"jwtConfiguration","type":"\n","is_mandatory":true,"title":"Signing algorithm and lifetime for ID tokens","desc":"Keys: alg (RS256 or HS256, where HS256 shares a symmetric secret) and lifetimeInSeconds.","provider":"go.mondoo.com/mql/providers/auth0"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Application name","provider":"go.mondoo.com/mql/providers/auth0"},"oidcConformant":{"name":"oidcConformant","type":"\u0004","is_mandatory":true,"title":"Whether the application uses the OIDC-conformant pipeline","provider":"go.mondoo.com/mql/providers/auth0"},"refreshTokenExpirationType":{"name":"refreshTokenExpirationType","type":"\u0007","is_mandatory":true,"title":"Refresh token expiration behavior","desc":"One of expiring (tokens have an absolute and inactivity lifetime) or non-expiring (tokens never expire on their own).","provider":"go.mondoo.com/mql/providers/auth0"},"refreshTokenIdleLifetime":{"name":"refreshTokenIdleLifetime","type":"\u0005","is_mandatory":true,"title":"Inactivity lifetime in seconds before an unused refresh token expires","provider":"go.mondoo.com/mql/providers/auth0"},"refreshTokenLeeway":{"name":"refreshTokenLeeway","type":"\u0005","is_mandatory":true,"title":"Grace period in seconds a rotated-out refresh token remains usable","provider":"go.mondoo.com/mql/providers/auth0"},"refreshTokenLifetime":{"name":"refreshTokenLifetime","type":"\u0005","is_mandatory":true,"title":"Absolute refresh token lifetime in seconds, when expiring","provider":"go.mondoo.com/mql/providers/auth0"},"refreshTokenRotationType":{"name":"refreshTokenRotationType","type":"\u0007","is_mandatory":true,"title":"Whether refresh tokens rotate on use","desc":"One of rotating (a new refresh token is issued and the previous one invalidated on each use) or non-rotating (the same refresh token is reused until it expires). Rotating is the hardened setting.","provider":"go.mondoo.com/mql/providers/auth0"},"ssoDisabled":{"name":"ssoDisabled","type":"\u0004","is_mandatory":true,"title":"Whether single sign-on is disabled for this application","provider":"go.mondoo.com/mql/providers/auth0"},"tokenEndpointAuthMethod":{"name":"tokenEndpointAuthMethod","type":"\u0007","is_mandatory":true,"title":"How the application authenticates to the token endpoint","desc":"One of none (public client, e.g. SPA or native), client_secret_post, or client_secret_basic.","provider":"go.mondoo.com/mql/providers/auth0"},"webOrigins":{"name":"webOrigins","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed origins for web-message (silent authentication) responses","provider":"go.mondoo.com/mql/providers/auth0"}},"title":"Auth0 application","desc":"OAuth 2.0/OIDC client (an \"Application\" in the Auth0 dashboard) registered in the tenant, identified by its `id` (the Auth0 `client_id`). Covers the settings that govern how the application authenticates and what it is permitted to do: `grantTypes` lists the OAuth grants it may use, `tokenEndpointAuthMethod` and the refresh-token fields describe its credential and token-rotation posture, and `callbacks`/`allowedOrigins`/ `webOrigins` bound where it may redirect users and make cross-origin calls from. A public client with `implicit` in `grantTypes`, a wildcard callback URL, or refresh tokens that never rotate are common findings.","min_provider_version":"13.0.0","defaults":"name appType","provider":"go.mondoo.com/mql/providers/auth0","maturity":"experimental"},"auth0.clientGrant":{"id":"auth0.clientGrant","name":"auth0.clientGrant","fields":{"allowAllScopes":{"name":"allowAllScopes","type":"\u0004","is_mandatory":true,"title":"Whether every scope defined by the API is granted","provider":"go.mondoo.com/mql/providers/auth0"},"allowAnyOrganization":{"name":"allowAnyOrganization","type":"\u0004","is_mandatory":true,"title":"Whether the grant may be used with any organization","provider":"go.mondoo.com/mql/providers/auth0"},"audience":{"name":"audience","type":"\u0007","is_mandatory":true,"title":"API identifier (audience) the grant targets","desc":"Matches the identifier of an auth0.resourceServer. Use resourceServer to resolve the API.","provider":"go.mondoo.com/mql/providers/auth0"},"client":{"name":"client","type":"\u001bauth0.client","title":"Application the grant authorizes","provider":"go.mondoo.com/mql/providers/auth0"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Client grant ID","provider":"go.mondoo.com/mql/providers/auth0"},"organizationUsage":{"name":"organizationUsage","type":"\u0007","is_mandatory":true,"title":"Whether organizations may be used with the client-credentials exchange","desc":"One of deny, allow, or require. Defaults to deny.","provider":"go.mondoo.com/mql/providers/auth0"},"resourceServer":{"name":"resourceServer","type":"\u001bauth0.resourceServer","title":"API the grant targets","provider":"go.mondoo.com/mql/providers/auth0"},"scopes":{"name":"scopes","type":"\u0019\u0007","is_mandatory":true,"title":"Permissions (scopes) granted to the application","provider":"go.mondoo.com/mql/providers/auth0"},"subjectType":{"name":"subjectType","type":"\u0007","is_mandatory":true,"title":"Subject type for the grant","desc":"One of client or user. Defaults to client.","provider":"go.mondoo.com/mql/providers/auth0"}},"title":"Auth0 client grant","desc":"Machine-to-machine authorization that permits an application to obtain access tokens for an API through the client-credentials grant. `client` resolves the application the grant is issued to, `audience` is the API identifier the grant targets (resolvable through resourceServer), and `scopes` lists the permissions the application is granted, unless allowAllScopes is set, in which case every scope the API defines is granted. `organizationUsage` and `allowAnyOrganization` govern whether the grant may be used in an organization context. An overly broad set of scopes on a machine-to-machine grant is a common finding.","min_provider_version":"13.0.0","defaults":"audience","provider":"go.mondoo.com/mql/providers/auth0","maturity":"experimental"},"auth0.connection":{"id":"auth0.connection","name":"auth0.connection","fields":{"bruteForceProtection":{"name":"bruteForceProtection","type":"\u0004","is_mandatory":true,"title":"Legacy per-connection brute-force protection flag","desc":"Deprecated in favor of the tenant-wide brute-force protection exposed through auth0.attackProtection, which supersedes this per-connection setting for database connections.","provider":"go.mondoo.com/mql/providers/auth0","maturity":"deprecated"},"disableSignup":{"name":"disableSignup","type":"\u0004","is_mandatory":true,"title":"Whether new-user signup is disabled on this connection","provider":"go.mondoo.com/mql/providers/auth0"},"enabledClients":{"name":"enabledClients","type":"\u0019\u001bauth0.client","title":"Applications enabled on this connection","provider":"go.mondoo.com/mql/providers/auth0"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Connection ID","provider":"go.mondoo.com/mql/providers/auth0"},"isDomainConnection":{"name":"isDomainConnection","type":"\u0004","is_mandatory":true,"title":"Whether this is the tenant's default (domain) connection","provider":"go.mondoo.com/mql/providers/auth0"},"mfaActive":{"name":"mfaActive","type":"\u0004","is_mandatory":true,"title":"Whether multi-factor authentication is active for logins through this connection","provider":"go.mondoo.com/mql/providers/auth0"},"mfaReturnEnrollSettings":{"name":"mfaReturnEnrollSettings","type":"\u0004","is_mandatory":true,"title":"Whether MFA enrollment settings are returned during authentication","provider":"go.mondoo.com/mql/providers/auth0"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Connection name","provider":"go.mondoo.com/mql/providers/auth0"},"options":{"name":"options","type":"\n","is_mandatory":true,"title":"Raw options payload for this connection","desc":"Strategy-specific settings (SAML certs, AD/LDAP binds, social app keys) not promoted to a typed field.","provider":"go.mondoo.com/mql/providers/auth0"},"passwordDictionaryEnabled":{"name":"passwordDictionaryEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Auth0 rejects passwords found in a breach-credential dictionary","provider":"go.mondoo.com/mql/providers/auth0"},"passwordHistoryEnabled":{"name":"passwordHistoryEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Auth0 rejects passwords that reuse a user's recent password history","provider":"go.mondoo.com/mql/providers/auth0"},"passwordHistorySize":{"name":"passwordHistorySize","type":"\u0005","is_mandatory":true,"title":"Number of previous passwords checked when password history is enabled","provider":"go.mondoo.com/mql/providers/auth0"},"passwordNoPersonalInfo":{"name":"passwordNoPersonalInfo","type":"\u0004","is_mandatory":true,"title":"Whether Auth0 rejects passwords containing the user's personal information","provider":"go.mondoo.com/mql/providers/auth0"},"passwordPolicy":{"name":"passwordPolicy","type":"\u0007","is_mandatory":true,"title":"Password strength policy for a database connection","desc":"One of none, low, fair, good, or excellent. Empty for non-database (social or enterprise) connections.","provider":"go.mondoo.com/mql/providers/auth0"},"requiresUsername":{"name":"requiresUsername","type":"\u0004","is_mandatory":true,"title":"Whether login on this connection requires a username in addition to email","provider":"go.mondoo.com/mql/providers/auth0"},"strategy":{"name":"strategy","type":"\u0007","is_mandatory":true,"title":"Connection strategy","desc":"Identifies the connection kind, for example auth0 (database), google-oauth2, github, samlp, oidc, waad (Azure AD), or ad (Active Directory/LDAP).","provider":"go.mondoo.com/mql/providers/auth0"}},"title":"Auth0 identity connection","desc":"Identity source available to applications in the tenant: a database connection (username/password, stored and verified by Auth0), a social connection (Google, GitHub, and so on), or an enterprise connection (SAML, OIDC, Active Directory/LDAP, Azure AD). The `strategy` field selects the connection kind. For database connections, `passwordPolicy` and the `passwordHistory*`/`passwordDictionaryEnabled` fields describe the credential strength Auth0 enforces at signup and password reset, and `mfaActive` reports whether multi-factor authentication is required for logins through this connection. `enabledClients` resolves the applications permitted to authenticate against it.","min_provider_version":"13.0.0","defaults":"name strategy","provider":"go.mondoo.com/mql/providers/auth0","maturity":"experimental"},"auth0.guardian":{"id":"auth0.guardian","name":"auth0.guardian","fields":{"duoEnabled":{"name":"duoEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Cisco Duo MFA is enabled","provider":"go.mondoo.com/mql/providers/auth0"},"emailEnabled":{"name":"emailEnabled","type":"\u0004","is_mandatory":true,"title":"Whether email one-time code MFA is enabled","provider":"go.mondoo.com/mql/providers/auth0"},"otpEnabled":{"name":"otpEnabled","type":"\u0004","is_mandatory":true,"title":"Whether one-time password (authenticator app) MFA is enabled","provider":"go.mondoo.com/mql/providers/auth0"},"phoneEnabled":{"name":"phoneEnabled","type":"\u0004","is_mandatory":true,"title":"Whether phone (SMS or voice) MFA is enabled","provider":"go.mondoo.com/mql/providers/auth0"},"policy":{"name":"policy","type":"\u0007","is_mandatory":true,"title":"MFA enrollment policy","desc":"One of never (MFA is not required), all-applications (MFA required for every login), or confidence-score (adaptive MFA that challenges only logins Auth0 scores as risky).","provider":"go.mondoo.com/mql/providers/auth0"},"pushEnabled":{"name":"pushEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Auth0 Guardian push-notification MFA is enabled","provider":"go.mondoo.com/mql/providers/auth0"},"recoveryCodeEnabled":{"name":"recoveryCodeEnabled","type":"\u0004","is_mandatory":true,"title":"Whether recovery codes are enabled as an MFA fallback","provider":"go.mondoo.com/mql/providers/auth0"},"webAuthnPlatformEnabled":{"name":"webAuthnPlatformEnabled","type":"\u0004","is_mandatory":true,"title":"Whether WebAuthn with device biometrics (platform authenticator) MFA is enabled","provider":"go.mondoo.com/mql/providers/auth0"},"webAuthnPlatformUserVerification":{"name":"webAuthnPlatformUserVerification","type":"\u0007","is_mandatory":true,"title":"User-verification requirement for the platform WebAuthn factor","desc":"One of required, preferred, or discouraged. Empty when the platform WebAuthn factor is not configured.","provider":"go.mondoo.com/mql/providers/auth0"},"webAuthnRoamingEnabled":{"name":"webAuthnRoamingEnabled","type":"\u0004","is_mandatory":true,"title":"Whether WebAuthn with a security key (roaming authenticator) MFA is enabled","provider":"go.mondoo.com/mql/providers/auth0"},"webAuthnRoamingUserVerification":{"name":"webAuthnRoamingUserVerification","type":"\u0007","is_mandatory":true,"title":"User-verification requirement for the roaming WebAuthn factor","desc":"One of required, preferred, or discouraged. Empty when the roaming WebAuthn factor is not configured.","provider":"go.mondoo.com/mql/providers/auth0"}},"title":"Auth0 multi-factor authentication policy","desc":"Tenant-wide multi-factor authentication (MFA) configuration: the enrollment `policy` that decides when users are challenged for a second factor, and which authentication factors are enabled for the tenant. `policy` is one of never (MFA off), all-applications (every login requires MFA), or confidence-score (adaptive MFA that challenges only risky logins). The per-factor flags (otpEnabled, webAuthnPlatformEnabled, webAuthnRoamingEnabled, pushEnabled, duoEnabled, phoneEnabled, emailEnabled, recoveryCodeEnabled) report which factor types end users may enroll, and the webAuthn*UserVerification fields report how strictly the WebAuthn factors verify the user. A tenant with `policy` never, or one that offers only the phishable phoneEnabled/emailEnabled factors, is a common finding.","min_provider_version":"13.0.0","defaults":"policy","provider":"go.mondoo.com/mql/providers/auth0","maturity":"experimental"},"auth0.logStream":{"id":"auth0.logStream","name":"auth0.logStream","fields":{"filters":{"name":"filters","type":"\u0019\n","is_mandatory":true,"title":"Event categories streamed","desc":"For example login or failed_login. Empty means all categories.","provider":"go.mondoo.com/mql/providers/auth0"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Log stream ID","provider":"go.mondoo.com/mql/providers/auth0"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Log stream name","provider":"go.mondoo.com/mql/providers/auth0"},"sink":{"name":"sink","type":"\n","is_mandatory":true,"title":"Destination-specific configuration","desc":"Shape depends on type: http (httpEndpoint, httpContentFormat), datadog (datadogRegion, key redacted), splunk (splunkDomain, splunkPort), or eventbridge (awsAccountId, awsRegion).","provider":"go.mondoo.com/mql/providers/auth0"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Delivery status","desc":"One of active, paused, or suspended (Auth0 disabled the stream after repeated delivery failures).","provider":"go.mondoo.com/mql/providers/auth0"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Destination type","desc":"For example http, eventbridge, eventgrid, datadog, splunk, sumo, mixpanel, or segment.","provider":"go.mondoo.com/mql/providers/auth0"}},"title":"Auth0 log stream","desc":"Connection that exports tenant log events to an external destination such as AWS EventBridge, Datadog, Splunk, or a generic HTTP endpoint. Select a stream by its `name`. `type` identifies the destination kind, `sink` carries the destination-specific configuration (endpoint URLs, region, API keys are redacted), and `status` reports whether delivery is active, paused, or has been suspended by Auth0 after repeated failures. An absent or non-active stream means tenant authentication events are not being shipped to a SIEM or audit pipeline.","min_provider_version":"13.0.0","defaults":"name type status","provider":"go.mondoo.com/mql/providers/auth0","maturity":"experimental"},"auth0.organization":{"id":"auth0.organization","name":"auth0.organization","fields":{"brandingLogoUrl":{"name":"brandingLogoUrl","type":"\u0007","is_mandatory":true,"title":"URL of the logo shown on the organization's login page","provider":"go.mondoo.com/mql/providers/auth0"},"connections":{"name":"connections","type":"\u0019\u001bauth0.connection","title":"Identity connections enabled for the organization","provider":"go.mondoo.com/mql/providers/auth0"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Human-readable display name","provider":"go.mondoo.com/mql/providers/auth0"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Organization ID","provider":"go.mondoo.com/mql/providers/auth0"},"members":{"name":"members","type":"\u0019\u001bauth0.user","title":"Users who are members of the organization","provider":"go.mondoo.com/mql/providers/auth0"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Custom metadata attached to the organization","provider":"go.mondoo.com/mql/providers/auth0"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Organization name (unique handle)","provider":"go.mondoo.com/mql/providers/auth0"}},"title":"Auth0 organization","desc":"Organization used for B2B multi-tenancy, grouping members and the identity connections they authenticate through, selected by its `name`. `connections` resolves the identity connections enabled for the organization, `members` resolves the users who belong to it, and `metadata` carries the custom key/value pairs attached to the organization. `displayName` and `brandingLogoUrl` cover how the organization is presented on its login page.","min_provider_version":"13.0.0","defaults":"name displayName","provider":"go.mondoo.com/mql/providers/auth0","maturity":"experimental"},"auth0.resourceServer":{"id":"auth0.resourceServer","name":"auth0.resourceServer","fields":{"allowOfflineAccess":{"name":"allowOfflineAccess","type":"\u0004","is_mandatory":true,"title":"Whether refresh tokens (offline access) may be issued for this API","provider":"go.mondoo.com/mql/providers/auth0"},"enforcePolicies":{"name":"enforcePolicies","type":"\u0004","is_mandatory":true,"title":"Whether role-based access control (RBAC) policies are enforced","provider":"go.mondoo.com/mql/providers/auth0"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Resource server ID","provider":"go.mondoo.com/mql/providers/auth0"},"identifier":{"name":"identifier","type":"\u0007","is_mandatory":true,"title":"API identifier (audience)","desc":"The unique audience value applications request access tokens for, for example https://api.example.com. This is the API's stable selection key.","provider":"go.mondoo.com/mql/providers/auth0"},"isSystem":{"name":"isSystem","type":"\u0004","is_mandatory":true,"title":"Whether this is an Auth0 system-managed resource server","provider":"go.mondoo.com/mql/providers/auth0"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Resource server name","provider":"go.mondoo.com/mql/providers/auth0"},"proofOfPossessionMechanism":{"name":"proofOfPossessionMechanism","type":"\u0007","is_mandatory":true,"title":"Proof-of-possession mechanism required for access tokens","desc":"One of mtls or dpop. Empty when proof-of-possession is not required.","provider":"go.mondoo.com/mql/providers/auth0"},"proofOfPossessionRequired":{"name":"proofOfPossessionRequired","type":"\u0004","is_mandatory":true,"title":"Whether proof-of-possession is required for access tokens","provider":"go.mondoo.com/mql/providers/auth0"},"proofOfPossessionRequiredFor":{"name":"proofOfPossessionRequiredFor","type":"\u0007","is_mandatory":true,"title":"Which client types must use proof-of-possession","desc":"One of all_clients or public_clients. Empty when proof-of-possession is not required.","provider":"go.mondoo.com/mql/providers/auth0"},"scopes":{"name":"scopes","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Scopes (permissions) defined by the API","desc":"Keyed by scope value (for example read:users), with the scope description as the value.","provider":"go.mondoo.com/mql/providers/auth0"},"signingAlgorithm":{"name":"signingAlgorithm","type":"\u0007","is_mandatory":true,"title":"Algorithm used to sign issued access tokens","desc":"One of RS256 (asymmetric, the hardened default) or HS256 (a shared symmetric secret). PS256 is available as an add-on.","provider":"go.mondoo.com/mql/providers/auth0"},"skipConsentForVerifiableFirstPartyClients":{"name":"skipConsentForVerifiableFirstPartyClients","type":"\u0004","is_mandatory":true,"title":"Whether consent is skipped for verifiable first-party applications","provider":"go.mondoo.com/mql/providers/auth0"},"tokenDialect":{"name":"tokenDialect","type":"\u0007","is_mandatory":true,"title":"Access token dialect","desc":"One of access_token, rfc9068_profile, access_token_authz, or rfc9068_profile_authz. The authz dialects embed RBAC permission claims.","provider":"go.mondoo.com/mql/providers/auth0"},"tokenLifetime":{"name":"tokenLifetime","type":"\u0005","is_mandatory":true,"title":"Access token lifetime in seconds","provider":"go.mondoo.com/mql/providers/auth0"},"tokenLifetimeForWeb":{"name":"tokenLifetimeForWeb","type":"\u0005","is_mandatory":true,"title":"Access token lifetime in seconds for browser-based flows","provider":"go.mondoo.com/mql/providers/auth0"}},"init":{"args":[{"name":"id","type":"\u0007"}]},"title":"Auth0 API","desc":"API (resource server) registered in the tenant that applications request access tokens for, selected by its `identifier` (the API audience, for example https://api.example.com). `signingAlgorithm` is the algorithm used to sign issued access tokens (RS256 uses asymmetric keys, HS256 a shared symmetric secret), `tokenLifetime` bounds how long an access token stays valid, and `enforcePolicies` reports whether role-based access control (RBAC) gates the scopes a token may carry. `allowOfflineAccess` controls whether refresh tokens may be issued for the API, `scopes` lists the permissions the API defines, and the proofOfPossession fields report whether sender-constrained tokens are required. An API with enforcePolicies off, HS256 signing, or an unusually long tokenLifetime is a common finding.","min_provider_version":"13.0.0","defaults":"name identifier","provider":"go.mondoo.com/mql/providers/auth0","maturity":"experimental"},"auth0.role":{"id":"auth0.role","name":"auth0.role","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Role description","provider":"go.mondoo.com/mql/providers/auth0"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Role ID","provider":"go.mondoo.com/mql/providers/auth0"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Role name","provider":"go.mondoo.com/mql/providers/auth0"},"permissions":{"name":"permissions","type":"\u0019\n","title":"Permissions granted by the role","desc":"One entry per permission, each a dict with keys permissionName, resourceServerIdentifier, resourceServerName, and description.","provider":"go.mondoo.com/mql/providers/auth0"},"users":{"name":"users","type":"\u0019\u001bauth0.user","title":"Users currently assigned this role","provider":"go.mondoo.com/mql/providers/auth0"}},"title":"Auth0 role","desc":"Named collection of permissions that can be assigned to users or, through an application's client-credentials grant, to machine clients. Select a role by its `name`. The `permissions` field lists the resource-server scopes the role grants, and `users` lists the accounts currently holding it, letting you audit membership in high-privilege roles directly.","min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/providers/auth0","maturity":"experimental"},"auth0.tenant":{"id":"auth0.tenant","name":"auth0.tenant","fields":{"allowedLogoutUrls":{"name":"allowedLogoutUrls","type":"\u0019\u0007","is_mandatory":true,"title":"Logout redirect URLs allowed for this tenant","desc":"End-user logout redirects (`returnTo` on the logout endpoint) that are not scoped to a specific application must match an entry in this list.","provider":"go.mondoo.com/mql/providers/auth0"},"defaultAudience":{"name":"defaultAudience","type":"\u0007","is_mandatory":true,"title":"Default audience for API authorization requests that omit one","provider":"go.mondoo.com/mql/providers/auth0"},"defaultDirectory":{"name":"defaultDirectory","type":"\u0007","is_mandatory":true,"title":"Default directory (database connection) used for username/password logins","provider":"go.mondoo.com/mql/providers/auth0"},"enabledLocales":{"name":"enabledLocales","type":"\u0019\u0007","is_mandatory":true,"title":"Locales enabled for Universal Login","provider":"go.mondoo.com/mql/providers/auth0"},"flags":{"name":"flags","type":"\n","is_mandatory":true,"title":"Tenant feature flags","desc":"Raw flag payload as returned by the API, keyed by flag name (for example enableApisSection, changePwdFlowV1, disableClickjackProtectionHeaders).","provider":"go.mondoo.com/mql/providers/auth0"},"friendlyName":{"name":"friendlyName","type":"\u0007","is_mandatory":true,"title":"Tenant display name","provider":"go.mondoo.com/mql/providers/auth0"},"idleSessionLifetime":{"name":"idleSessionLifetime","type":"\u0006","is_mandatory":true,"title":"Idle session lifetime in hours before re-authentication is required","provider":"go.mondoo.com/mql/providers/auth0"},"pictureUrl":{"name":"pictureUrl","type":"\u0007","is_mandatory":true,"title":"URL of the tenant logo","provider":"go.mondoo.com/mql/providers/auth0"},"sessionLifetime":{"name":"sessionLifetime","type":"\u0006","is_mandatory":true,"title":"Authenticated session lifetime in hours","provider":"go.mondoo.com/mql/providers/auth0"},"supportEmail":{"name":"supportEmail","type":"\u0007","is_mandatory":true,"title":"Support contact email shown to end users","provider":"go.mondoo.com/mql/providers/auth0"},"supportUrl":{"name":"supportUrl","type":"\u0007","is_mandatory":true,"title":"Support URL shown to end users","provider":"go.mondoo.com/mql/providers/auth0"}},"title":"Auth0 tenant settings","desc":"Tenant-wide configuration that applies across every application and connection in the Auth0 tenant. `sessionLifetime` and `idleSessionLifetime` bound how long an authenticated session and an idle session may last before re-authentication is required, `allowedLogoutUrls` is the allowlist end-user logout redirects are validated against, and `flags` carries the full set of tenant feature flags returned by the API.","min_provider_version":"13.0.0","defaults":"friendlyName","provider":"go.mondoo.com/mql/providers/auth0","maturity":"experimental"},"auth0.user":{"id":"auth0.user","name":"auth0.user","fields":{"appMetadata":{"name":"appMetadata","type":"\n","is_mandatory":true,"title":"Application-controlled metadata not editable by the user","provider":"go.mondoo.com/mql/providers/auth0"},"blocked":{"name":"blocked","type":"\u0004","is_mandatory":true,"title":"Whether the account is blocked","provider":"go.mondoo.com/mql/providers/auth0"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Timestamp when the account was created","provider":"go.mondoo.com/mql/providers/auth0"},"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"Primary email address","provider":"go.mondoo.com/mql/providers/auth0"},"emailVerified":{"name":"emailVerified","type":"\u0004","is_mandatory":true,"title":"Whether the primary email address has been verified","provider":"go.mondoo.com/mql/providers/auth0"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"User ID","provider":"go.mondoo.com/mql/providers/auth0"},"identities":{"name":"identities","type":"\u0019\n","is_mandatory":true,"title":"Linked identities merged into this profile","desc":"Each entry is a dict with keys connection, provider, userId, isSocial, and profileData.","provider":"go.mondoo.com/mql/providers/auth0"},"lastIp":{"name":"lastIp","type":"\u0007","is_mandatory":true,"title":"IP address of the user's last login","provider":"go.mondoo.com/mql/providers/auth0"},"lastLogin":{"name":"lastLogin","type":"\t","is_mandatory":true,"title":"Timestamp of the user's last login","provider":"go.mondoo.com/mql/providers/auth0"},"loginsCount":{"name":"loginsCount","type":"\u0005","is_mandatory":true,"title":"Total number of successful logins","provider":"go.mondoo.com/mql/providers/auth0"},"multifactor":{"name":"multifactor","type":"\u0019\u0007","is_mandatory":true,"title":"MFA factor types enrolled","desc":"For example guardian, sms, or email. Empty means no MFA factor enrolled.","provider":"go.mondoo.com/mql/providers/auth0"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Full name","provider":"go.mondoo.com/mql/providers/auth0"},"phoneNumber":{"name":"phoneNumber","type":"\u0007","is_mandatory":true,"title":"Phone number, for passwordless/SMS connections","provider":"go.mondoo.com/mql/providers/auth0"},"phoneVerified":{"name":"phoneVerified","type":"\u0004","is_mandatory":true,"title":"Whether the phone number has been verified","provider":"go.mondoo.com/mql/providers/auth0"},"roles":{"name":"roles","type":"\u0019\u001bauth0.role","title":"Roles assigned to the user","provider":"go.mondoo.com/mql/providers/auth0"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Timestamp when the account was last updated","provider":"go.mondoo.com/mql/providers/auth0"},"userMetadata":{"name":"userMetadata","type":"\n","is_mandatory":true,"title":"User-editable profile metadata","provider":"go.mondoo.com/mql/providers/auth0"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Username, for connections that require one","provider":"go.mondoo.com/mql/providers/auth0"}},"init":{"args":[{"name":"id","type":"\u0007"}]},"title":"Auth0 user","desc":"Individual account held in one of the tenant's database connections and selected by its `id` (the Auth0 `user_id`, for example `auth0|507f1f77bcf86cd799439011`). The lifecycle fields (`blocked`, `lastLogin`, `loginsCount`) surface dormant or locked-out accounts, `multifactor` lists which MFA factor types the user has enrolled, and `identities` shows every linked social or enterprise account merged into this profile. `roles` resolves the administrative and application roles granted to the user.","min_provider_version":"13.0.0","defaults":"email","provider":"go.mondoo.com/mql/providers/auth0","maturity":"experimental"}}}