{"resources":{"neon":{"id":"neon","name":"neon","fields":{"apiKey":{"name":"apiKey","type":"\u001bneon.apiKey","title":"Neon API Key","desc":"A key that authenticates against the Neon API with the rights of the account or organization that issued it. The `lastUsedAt` and `lastUsedFromAddr` fields show when and from where the key last authenticated, which is what distinguishes a key still in service from one left behind. Neon does not expire keys, so an unused key keeps working until it is revoked.","is_private":true,"provider":"go.mondoo.com/mql/providers/neon","is_implicit_resource":true},"apiKeys":{"name":"apiKeys","type":"\u0019\u001bneon.apiKey","title":"API keys owned by the authenticated account","provider":"go.mondoo.com/mql/providers/neon"},"branch":{"name":"branch","type":"\u001bneon.branch","title":"Neon Branch","desc":"A branch of a Neon project, holding its own copy of the data and its own roles and databases. Query `protected` for whether the branch is guarded against deletion and reset and covered by the project's allowed-address list, `default` for whether it is the branch applications connect to by default, and `restrictedActions` for what the branch currently refuses. A branch created from production data carries that data at full fidelity, so a long-lived unprotected branch is a second copy of production with weaker controls. Select a branch with `neon.projects.branches.where(name == \"main\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/neon","is_implicit_resource":true},"currentUser":{"name":"currentUser","type":"\u001bneon.user","title":"Authenticated Neon account behind the API key","provider":"go.mondoo.com/mql/providers/neon"},"database":{"name":"database","type":"\u001bneon.database","title":"Database on a Neon branch","desc":"A Postgres database on a branch, together with the role that owns it. The owning role holds full rights over the database, so `owner` is where a review of who can read a database starts.","is_private":true,"provider":"go.mondoo.com/mql/providers/neon","is_implicit_resource":true},"endpoint":{"name":"endpoint","type":"\u001bneon.endpoint","title":"Compute endpoint of a Neon branch","desc":"The compute that serves connections to a branch, and the network surface clients reach it on. Query `disabled` for whether the endpoint refuses connections outright, `passwordlessAccess` for whether a client may connect without presenting a password, `poolerEnabled` and `poolerMode` for connection pooling, and the autoscaling and suspend-timeout fields for how the compute behaves under load and at rest. Select an endpoint with `neon.projects.endpoints.where(type == \"read_write\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/neon","is_implicit_resource":true},"organization":{"name":"organization","type":"\u001bneon.organization","title":"Neon Organization","desc":"A Neon organization and the posture that applies to every project under it. The `members` field lists the roster with each member's role, `apiKeys` covers the organization-scoped keys with when each was last used and from where, and `allowHipaaProjects` reports whether projects may be marked as handling regulated health data. Select an organization with `neon.organizations.where(name == \"acme\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/neon","is_implicit_resource":true},"organizations":{"name":"organizations","type":"\u0019\u001bneon.organization","title":"Organizations the API key can access","provider":"go.mondoo.com/mql/providers/neon"},"project":{"name":"project","type":"\u001bneon.project","title":"Neon Project","desc":"A Neon project and the controls that govern who can reach its data. Query `blockPublicConnections` and `allowedIps` for network exposure of the project's compute endpoints, `blockVpcConnections` for private connectivity, `storePasswords` for whether Neon retains role passwords, `hipaa` for regulated-data handling, `historyRetentionSeconds` for how far back a branch can be restored, and `enableLogicalReplication` for whether data can be streamed out to another system. The `branches`, `endpoints`, `permissions`, and `jwksEndpoints` fields cover what runs in the project and who can reach it. Select a project with `neon.projects.where(name == \"production\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/neon","is_implicit_resource":true},"projects":{"name":"projects","type":"\u0019\u001bneon.project","title":"Projects across every accessible organization","provider":"go.mondoo.com/mql/providers/neon"},"role":{"name":"role","type":"\u001bneon.role","title":"Postgres role on a Neon branch","desc":"A database role defined on a branch. The `protected` field reports whether Neon maintains the role for its own features rather than an operator having created it. Role passwords are not exposed, though a project with `storePasswords` enabled holds them in a form the API can return.","is_private":true,"provider":"go.mondoo.com/mql/providers/neon","is_implicit_resource":true},"user":{"name":"user","type":"\u001bneon.user","title":"Neon User","desc":"The authenticated Neon account behind the API key, including its email, display name, plan, and the identity providers it can sign in with. Use it to attribute a scan to a principal and to confirm which account the key belongs to.","is_private":true,"provider":"go.mondoo.com/mql/providers/neon","is_implicit_resource":true},"vpcEndpoint":{"name":"vpcEndpoint","type":"\u001bneon.vpcEndpoint","title":"Private connectivity endpoint of a Neon project","desc":"A VPC endpoint attached to a project so connections can arrive over private connectivity rather than the public internet. It is what `blockPublicConnections` on the project is set alongside.","is_private":true,"provider":"go.mondoo.com/mql/providers/neon","is_implicit_resource":true}},"title":"Neon","desc":"Neon account posture across every organization and project the API key can reach. The `organizations` field enumerates those organizations with their members and API keys, `projects` flattens every project across them, `apiKeys` lists the keys owned by the authenticated account, and `currentUser` identifies the principal the key belongs to.","min_provider_version":"13.0.0","provider":"go.mondoo.com/mql/providers/neon"},"neon.apiKey":{"id":"neon.apiKey","name":"neon.apiKey","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the key was created","provider":"go.mondoo.com/mql/providers/neon"},"createdByName":{"name":"createdByName","type":"\u0007","is_mandatory":true,"title":"Display name of the account that created the key","provider":"go.mondoo.com/mql/providers/neon"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique key identifier","provider":"go.mondoo.com/mql/providers/neon"},"lastUsedAt":{"name":"lastUsedAt","type":"\t","is_mandatory":true,"title":"Time the key last authenticated, or null when it never has","provider":"go.mondoo.com/mql/providers/neon"},"lastUsedFromAddr":{"name":"lastUsedFromAddr","type":"\u0007","is_mandatory":true,"title":"Address the key last authenticated from, or null when it never has","provider":"go.mondoo.com/mql/providers/neon"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Human-readable key name","provider":"go.mondoo.com/mql/providers/neon"}},"title":"Neon API Key","desc":"A key that authenticates against the Neon API with the rights of the account or organization that issued it. The `lastUsedAt` and `lastUsedFromAddr` fields show when and from where the key last authenticated, which is what distinguishes a key still in service from one left behind. Neon does not expire keys, so an unused key keeps working until it is revoked.","private":true,"min_provider_version":"13.0.0","defaults":"name lastUsedAt","provider":"go.mondoo.com/mql/providers/neon"},"neon.branch":{"id":"neon.branch","name":"neon.branch","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the branch was created","provider":"go.mondoo.com/mql/providers/neon"},"currentState":{"name":"currentState","type":"\u0007","is_mandatory":true,"title":"Lifecycle state of the branch, for example init, ready, or archived","desc":"An archived branch has been moved to cold storage after a period of inactivity and is restored on the next connection.","provider":"go.mondoo.com/mql/providers/neon"},"databases":{"name":"databases","type":"\u0019\u001bneon.database","title":"Databases defined on the branch","provider":"go.mondoo.com/mql/providers/neon"},"default":{"name":"default","type":"\u0004","is_mandatory":true,"title":"Whether the branch is the project's default branch","provider":"go.mondoo.com/mql/providers/neon"},"endpoints":{"name":"endpoints","type":"\u0019\u001bneon.endpoint","title":"Compute endpoints attached to the branch","provider":"go.mondoo.com/mql/providers/neon"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Time the branch is scheduled to expire and be deleted, or null when it has no expiry","provider":"go.mondoo.com/mql/providers/neon"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique branch identifier","provider":"go.mondoo.com/mql/providers/neon"},"initSource":{"name":"initSource","type":"\u0007","is_mandatory":true,"title":"Source the branch was initialized from, either parent-data or schema-only","desc":"A branch initialized from parent-data carries the parent's rows. A branch initialized from schema-only carries the structure without the data.","provider":"go.mondoo.com/mql/providers/neon"},"lastResetAt":{"name":"lastResetAt","type":"\t","is_mandatory":true,"title":"Time the branch was last reset from its parent, or null when it never was","provider":"go.mondoo.com/mql/providers/neon"},"logicalSize":{"name":"logicalSize","type":"\u0005","is_mandatory":true,"title":"Logical size of the branch in bytes, or null when not yet measured","provider":"go.mondoo.com/mql/providers/neon"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Branch name","provider":"go.mondoo.com/mql/providers/neon"},"parent":{"name":"parent","type":"\u001bneon.branch","title":"Branch this branch was created from, or null for a root branch","provider":"go.mondoo.com/mql/providers/neon"},"project":{"name":"project","type":"\u001bneon.project","title":"Project the branch belongs to","provider":"go.mondoo.com/mql/providers/neon"},"protected":{"name":"protected","type":"\u0004","is_mandatory":true,"title":"Whether the branch is protected","desc":"A protected branch cannot be deleted or reset, and the project's allowed-address list applies to it even when the list is configured to constrain protected branches only.","provider":"go.mondoo.com/mql/providers/neon"},"restrictedActions":{"name":"restrictedActions","type":"\u0019\n","is_mandatory":true,"title":"Actions the branch currently refuses and why","desc":"Each entry carries the `name` of a restricted action, such as restore or delete-rw-endpoint, and the `reason` it is restricted.","provider":"go.mondoo.com/mql/providers/neon"},"roles":{"name":"roles","type":"\u0019\u001bneon.role","title":"Postgres roles defined on the branch","provider":"go.mondoo.com/mql/providers/neon"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the branch was last updated","provider":"go.mondoo.com/mql/providers/neon"}},"title":"Neon Branch","desc":"A branch of a Neon project, holding its own copy of the data and its own roles and databases. Query `protected` for whether the branch is guarded against deletion and reset and covered by the project's allowed-address list, `default` for whether it is the branch applications connect to by default, and `restrictedActions` for what the branch currently refuses. A branch created from production data carries that data at full fidelity, so a long-lived unprotected branch is a second copy of production with weaker controls. Select a branch with `neon.projects.branches.where(name == \"main\")`.","private":true,"min_provider_version":"13.0.0","defaults":"name protected","provider":"go.mondoo.com/mql/providers/neon"},"neon.database":{"id":"neon.database","name":"neon.database","fields":{"branch":{"name":"branch","type":"\u001bneon.branch","title":"Branch the database is defined on","provider":"go.mondoo.com/mql/providers/neon"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the database was created","provider":"go.mondoo.com/mql/providers/neon"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique database identifier","provider":"go.mondoo.com/mql/providers/neon"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Database name","provider":"go.mondoo.com/mql/providers/neon"},"owner":{"name":"owner","type":"\u001bneon.role","title":"Role that owns the database","provider":"go.mondoo.com/mql/providers/neon"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the database was last updated","provider":"go.mondoo.com/mql/providers/neon"}},"title":"Database on a Neon branch","desc":"A Postgres database on a branch, together with the role that owns it. The owning role holds full rights over the database, so `owner` is where a review of who can read a database starts.","private":true,"min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/providers/neon"},"neon.endpoint":{"id":"neon.endpoint","name":"neon.endpoint","fields":{"autoscalingLimitMaxCu":{"name":"autoscalingLimitMaxCu","type":"\u0006","is_mandatory":true,"title":"Maximum compute units the endpoint scales up to","provider":"go.mondoo.com/mql/providers/neon"},"autoscalingLimitMinCu":{"name":"autoscalingLimitMinCu","type":"\u0006","is_mandatory":true,"title":"Minimum compute units the endpoint scales down to","provider":"go.mondoo.com/mql/providers/neon"},"branch":{"name":"branch","type":"\u001bneon.branch","title":"Branch the endpoint serves","provider":"go.mondoo.com/mql/providers/neon"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the endpoint was created","provider":"go.mondoo.com/mql/providers/neon"},"currentState":{"name":"currentState","type":"\u0007","is_mandatory":true,"title":"Lifecycle state of the compute, for example init, active, or idle","provider":"go.mondoo.com/mql/providers/neon"},"disabled":{"name":"disabled","type":"\u0004","is_mandatory":true,"title":"Whether connections to the endpoint are refused","desc":"A disabled endpoint cannot be woken by a connection or a console action, which takes the branch's data out of reach without deleting it.","provider":"go.mondoo.com/mql/providers/neon"},"host":{"name":"host","type":"\u0007","is_mandatory":true,"title":"Hostname clients connect to","provider":"go.mondoo.com/mql/providers/neon"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique endpoint identifier","provider":"go.mondoo.com/mql/providers/neon"},"lastActive":{"name":"lastActive","type":"\t","is_mandatory":true,"title":"Time the endpoint was last active, or null when it never was","provider":"go.mondoo.com/mql/providers/neon"},"passwordlessAccess":{"name":"passwordlessAccess","type":"\u0004","is_mandatory":true,"title":"Whether a client may connect without presenting a password","provider":"go.mondoo.com/mql/providers/neon"},"poolerEnabled":{"name":"poolerEnabled","type":"\u0004","is_mandatory":true,"title":"Whether connection pooling is enabled","provider":"go.mondoo.com/mql/providers/neon"},"poolerMode":{"name":"poolerMode","type":"\u0007","is_mandatory":true,"title":"Pooling mode, for example transaction","provider":"go.mondoo.com/mql/providers/neon"},"project":{"name":"project","type":"\u001bneon.project","title":"Project the endpoint belongs to","provider":"go.mondoo.com/mql/providers/neon"},"provisioner":{"name":"provisioner","type":"\u0007","is_mandatory":true,"title":"Compute provisioner backing the endpoint","provider":"go.mondoo.com/mql/providers/neon"},"regionId":{"name":"regionId","type":"\u0007","is_mandatory":true,"title":"Region the endpoint runs in","provider":"go.mondoo.com/mql/providers/neon"},"startedAt":{"name":"startedAt","type":"\t","is_mandatory":true,"title":"Time the endpoint was last started, or null when it never was","provider":"go.mondoo.com/mql/providers/neon"},"suspendTimeoutSeconds":{"name":"suspendTimeoutSeconds","type":"\u0005","is_mandatory":true,"title":"Seconds of inactivity before the compute suspends","desc":"A value of zero applies the default. A suspended compute wakes on the next connection.","provider":"go.mondoo.com/mql/providers/neon"},"suspendedAt":{"name":"suspendedAt","type":"\t","is_mandatory":true,"title":"Time the endpoint was last suspended, or null when it never was","provider":"go.mondoo.com/mql/providers/neon"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Endpoint type, either read_write or read_only","provider":"go.mondoo.com/mql/providers/neon"}},"title":"Compute endpoint of a Neon branch","desc":"The compute that serves connections to a branch, and the network surface clients reach it on. Query `disabled` for whether the endpoint refuses connections outright, `passwordlessAccess` for whether a client may connect without presenting a password, `poolerEnabled` and `poolerMode` for connection pooling, and the autoscaling and suspend-timeout fields for how the compute behaves under load and at rest. Select an endpoint with `neon.projects.endpoints.where(type == \"read_write\")`.","private":true,"min_provider_version":"13.0.0","defaults":"id host","provider":"go.mondoo.com/mql/providers/neon"},"neon.organization":{"id":"neon.organization","name":"neon.organization","fields":{"allowHipaaProjects":{"name":"allowHipaaProjects","type":"\u0004","is_mandatory":true,"title":"Whether projects in the organization may be marked as HIPAA regulated","provider":"go.mondoo.com/mql/providers/neon"},"apiKeys":{"name":"apiKeys","type":"\u0019\u001bneon.apiKey","title":"API keys scoped to the organization","provider":"go.mondoo.com/mql/providers/neon"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the organization was created","provider":"go.mondoo.com/mql/providers/neon"},"handle":{"name":"handle","type":"\u0007","is_mandatory":true,"title":"URL-safe organization handle","provider":"go.mondoo.com/mql/providers/neon"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique organization identifier","provider":"go.mondoo.com/mql/providers/neon"},"managedBy":{"name":"managedBy","type":"\u0007","is_mandatory":true,"title":"Mechanism that manages the organization","desc":"An organization created through the console or the API reports console. An organization created another way, such as through a cloud marketplace subscription, reports that source and cannot be deleted through the API.","provider":"go.mondoo.com/mql/providers/neon"},"member":{"name":"member","type":"\u001bneon.organization.member","title":"Member of a Neon organization","desc":"A single member of an organization with the role that member holds. Use `role` to find members holding administrative rights, which in Neon carry project creation, member management, and API key issuance.","is_private":true,"provider":"go.mondoo.com/mql/providers/neon","is_implicit_resource":true},"members":{"name":"members","type":"\u0019\u001bneon.organization.member","title":"Members of the organization and the role each holds","provider":"go.mondoo.com/mql/providers/neon"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/mql/providers/neon"},"plan":{"name":"plan","type":"\u0007","is_mandatory":true,"title":"Plan the organization is subscribed to, for example free, launch, or scale","provider":"go.mondoo.com/mql/providers/neon"},"projects":{"name":"projects","type":"\u0019\u001bneon.project","title":"Projects belonging to the organization","provider":"go.mondoo.com/mql/providers/neon"},"requireMfa":{"name":"requireMfa","type":"\u0004","is_mandatory":true,"title":"Whether members must have multi-factor authentication enabled","desc":"When false, a member can hold administrative rights over every project in the organization behind a single factor. The `hasMfa` field on each member reports who has enrolled regardless of whether it is required.","provider":"go.mondoo.com/mql/providers/neon"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the organization was last updated","provider":"go.mondoo.com/mql/providers/neon"}},"title":"Neon Organization","desc":"A Neon organization and the posture that applies to every project under it. The `members` field lists the roster with each member's role, `apiKeys` covers the organization-scoped keys with when each was last used and from where, and `allowHipaaProjects` reports whether projects may be marked as handling regulated health data. Select an organization with `neon.organizations.where(name == \"acme\")`.","private":true,"min_provider_version":"13.0.0","defaults":"name plan","provider":"go.mondoo.com/mql/providers/neon"},"neon.organization.member":{"id":"neon.organization.member","name":"neon.organization.member","fields":{"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"Email address of the member","provider":"go.mondoo.com/mql/providers/neon"},"hasMfa":{"name":"hasMfa","type":"\u0004","is_mandatory":true,"title":"Whether the member has multi-factor authentication enabled","desc":"Reported per member whether or not the organization requires it, so an admin without a second factor is visible even where enrollment is voluntary.","provider":"go.mondoo.com/mql/providers/neon"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique membership identifier","provider":"go.mondoo.com/mql/providers/neon"},"joinedAt":{"name":"joinedAt","type":"\t","is_mandatory":true,"title":"Time the member joined the organization","provider":"go.mondoo.com/mql/providers/neon"},"role":{"name":"role","type":"\u0007","is_mandatory":true,"title":"Role the member holds, either admin or member","provider":"go.mondoo.com/mql/providers/neon"}},"title":"Member of a Neon organization","desc":"A single member of an organization with the role that member holds. Use `role` to find members holding administrative rights, which in Neon carry project creation, member management, and API key issuance.","private":true,"min_provider_version":"13.0.0","defaults":"email role","provider":"go.mondoo.com/mql/providers/neon"},"neon.project":{"id":"neon.project","name":"neon.project","fields":{"allowedIps":{"name":"allowedIps","type":"\u0019\u0007","is_mandatory":true,"title":"Addresses permitted to connect to the project's endpoints","desc":"Empty when every address is permitted, which is the default. An entry is a single address or a CIDR range.","provider":"go.mondoo.com/mql/providers/neon"},"allowedIpsProtectedBranchesOnly":{"name":"allowedIpsProtectedBranchesOnly","type":"\u0004","is_mandatory":true,"title":"Whether the allowed-address list applies only to protected branches","desc":"When true, the list constrains protected branches and every other branch stays reachable from any address.","provider":"go.mondoo.com/mql/providers/neon"},"auditLogLevel":{"name":"auditLogLevel","type":"\u0007","is_mandatory":true,"title":"Level of audit logging configured for the project","provider":"go.mondoo.com/mql/providers/neon"},"blockPublicConnections":{"name":"blockPublicConnections","type":"\u0004","is_mandatory":true,"title":"Whether connections from the public internet are blocked","desc":"When true, the project answers only over private connectivity, and this supersedes the allowedIps list. When false, the endpoints are reachable from any address the allowedIps list permits.","provider":"go.mondoo.com/mql/providers/neon"},"blockVpcConnections":{"name":"blockVpcConnections","type":"\u0004","is_mandatory":true,"title":"Whether connections arriving over VPC endpoints are blocked","provider":"go.mondoo.com/mql/providers/neon"},"branches":{"name":"branches","type":"\u0019\u001bneon.branch","title":"Branches of the project","provider":"go.mondoo.com/mql/providers/neon"},"computeLastActiveAt":{"name":"computeLastActiveAt","type":"\t","is_mandatory":true,"title":"Time any endpoint of the project was last active, or null when never","provider":"go.mondoo.com/mql/providers/neon"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the project was created","provider":"go.mondoo.com/mql/providers/neon"},"defaultBranch":{"name":"defaultBranch","type":"\u001bneon.branch","title":"Default branch of the project","provider":"go.mondoo.com/mql/providers/neon"},"enableLogicalReplication":{"name":"enableLogicalReplication","type":"\u0004","is_mandatory":true,"title":"Whether write-ahead logging is set up for logical replication","desc":"Enabling logical replication lets an outside system subscribe to the project's changes. Neon cannot turn it back off once enabled.","provider":"go.mondoo.com/mql/providers/neon"},"endpoints":{"name":"endpoints","type":"\u0019\u001bneon.endpoint","title":"Compute endpoints across every branch of the project","provider":"go.mondoo.com/mql/providers/neon"},"hipaa":{"name":"hipaa","type":"\u0004","is_mandatory":true,"title":"Whether the project is marked as handling HIPAA regulated data","provider":"go.mondoo.com/mql/providers/neon"},"hipaaEnabledAt":{"name":"hipaaEnabledAt","type":"\t","is_mandatory":true,"title":"Time HIPAA handling was enabled for the project, or null when it is not","provider":"go.mondoo.com/mql/providers/neon"},"historyRetentionSeconds":{"name":"historyRetentionSeconds","type":"\u0005","is_mandatory":true,"title":"Seconds of history retained for restoring the project's branches","desc":"A longer window allows recovery from a change discovered late. A window of zero means a branch cannot be restored to an earlier point.","provider":"go.mondoo.com/mql/providers/neon"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique project identifier","provider":"go.mondoo.com/mql/providers/neon"},"jwksEndpoint":{"name":"jwksEndpoint","type":"\u001bneon.project.jwksEndpoint","title":"JWKS endpoint trusted by a Neon project","desc":"A JSON Web Key Set that the project trusts to authenticate database access, which is how an outside identity provider is wired up to Postgres row-level security. The `jwksUrl` field is the endpoint whose keys are trusted, and `roleNames` reports which database roles a presented token may act as, so a token minted by that provider reaches the data those roles can read.","is_private":true,"provider":"go.mondoo.com/mql/providers/neon","is_implicit_resource":true},"jwksEndpoints":{"name":"jwksEndpoints","type":"\u0019\u001bneon.project.jwksEndpoint","title":"JWKS endpoints trusted to authenticate database access","provider":"go.mondoo.com/mql/providers/neon"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Project name","provider":"go.mondoo.com/mql/providers/neon"},"organization":{"name":"organization","type":"\u001bneon.organization","title":"Organization the project belongs to, or null for a personal project","provider":"go.mondoo.com/mql/providers/neon"},"ownerEmail":{"name":"ownerEmail","type":"\u0007","title":"Email address of the account that owns the project","provider":"go.mondoo.com/mql/providers/neon"},"permission":{"name":"permission","type":"\u001bneon.project.permission","title":"Access granted on a Neon project","desc":"A grant of project access to an account outside the project's owner. The `revokedAt` field is null while the grant is live, so a query for live grants is what shows who can reach the project's data today. Sharing survives the departure of the person who set it up, so an unreviewed grant is how access outlives its reason.","is_private":true,"provider":"go.mondoo.com/mql/providers/neon","is_implicit_resource":true},"permissions":{"name":"permissions","type":"\u0019\u001bneon.project.permission","title":"Accounts outside the project's owner that have been granted access","provider":"go.mondoo.com/mql/providers/neon"},"pgVersion":{"name":"pgVersion","type":"\u0005","is_mandatory":true,"title":"Major PostgreSQL version the project runs","provider":"go.mondoo.com/mql/providers/neon"},"platformId":{"name":"platformId","type":"\u0007","is_mandatory":true,"title":"Cloud platform the project runs on, for example aws or azure","provider":"go.mondoo.com/mql/providers/neon"},"provisioner":{"name":"provisioner","type":"\u0007","is_mandatory":true,"title":"Compute provisioner backing the project's endpoints","provider":"go.mondoo.com/mql/providers/neon"},"proxyHost":{"name":"proxyHost","type":"\u0007","is_mandatory":true,"title":"Host that proxies connections to the project","provider":"go.mondoo.com/mql/providers/neon"},"regionId":{"name":"regionId","type":"\u0007","is_mandatory":true,"title":"Region the project runs in, for example aws-us-east-1","provider":"go.mondoo.com/mql/providers/neon"},"storePasswords":{"name":"storePasswords","type":"\u0004","is_mandatory":true,"title":"Whether Neon retains the passwords of the project's roles","desc":"Storing passwords lets features that connect on the account's behalf work, and it means the passwords are recoverable through the API by anyone the key authorizes.","provider":"go.mondoo.com/mql/providers/neon"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the project was last updated","provider":"go.mondoo.com/mql/providers/neon"},"vpcEndpoints":{"name":"vpcEndpoints","type":"\u0019\u001bneon.vpcEndpoint","title":"Private connectivity endpoints attached to the project","provider":"go.mondoo.com/mql/providers/neon"}},"title":"Neon Project","desc":"A Neon project and the controls that govern who can reach its data. Query `blockPublicConnections` and `allowedIps` for network exposure of the project's compute endpoints, `blockVpcConnections` for private connectivity, `storePasswords` for whether Neon retains role passwords, `hipaa` for regulated-data handling, `historyRetentionSeconds` for how far back a branch can be restored, and `enableLogicalReplication` for whether data can be streamed out to another system. The `branches`, `endpoints`, `permissions`, and `jwksEndpoints` fields cover what runs in the project and who can reach it. Select a project with `neon.projects.where(name == \"production\")`.","private":true,"min_provider_version":"13.0.0","defaults":"name regionId","provider":"go.mondoo.com/mql/providers/neon"},"neon.project.jwksEndpoint":{"id":"neon.project.jwksEndpoint","name":"neon.project.jwksEndpoint","fields":{"branch":{"name":"branch","type":"\u001bneon.branch","title":"Branch the key set applies to, or null when it applies to every branch","provider":"go.mondoo.com/mql/providers/neon"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the key set was registered","provider":"go.mondoo.com/mql/providers/neon"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique JWKS identifier","provider":"go.mondoo.com/mql/providers/neon"},"jwksUrl":{"name":"jwksUrl","type":"\u0007","is_mandatory":true,"title":"URL the key set is published at","provider":"go.mondoo.com/mql/providers/neon"},"jwtAudience":{"name":"jwtAudience","type":"\u0007","is_mandatory":true,"title":"Audience a presented token must carry, or null when any audience is accepted","provider":"go.mondoo.com/mql/providers/neon"},"providerName":{"name":"providerName","type":"\u0007","is_mandatory":true,"title":"Name of the authentication provider, for example Clerk, Stytch, or Auth0","provider":"go.mondoo.com/mql/providers/neon"},"roleNames":{"name":"roleNames","type":"\u0019\u0007","is_mandatory":true,"title":"Database roles a token authenticated by this key set may act as","provider":"go.mondoo.com/mql/providers/neon"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the key set was last updated","provider":"go.mondoo.com/mql/providers/neon"}},"title":"JWKS endpoint trusted by a Neon project","desc":"A JSON Web Key Set that the project trusts to authenticate database access, which is how an outside identity provider is wired up to Postgres row-level security. The `jwksUrl` field is the endpoint whose keys are trusted, and `roleNames` reports which database roles a presented token may act as, so a token minted by that provider reaches the data those roles can read.","private":true,"min_provider_version":"13.0.0","defaults":"providerName jwksUrl","provider":"go.mondoo.com/mql/providers/neon"},"neon.project.permission":{"id":"neon.project.permission","name":"neon.project.permission","fields":{"grantedAt":{"name":"grantedAt","type":"\t","is_mandatory":true,"title":"Time the grant was made","provider":"go.mondoo.com/mql/providers/neon"},"grantedToEmail":{"name":"grantedToEmail","type":"\u0007","is_mandatory":true,"title":"Email address the project was shared with","provider":"go.mondoo.com/mql/providers/neon"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique grant identifier","provider":"go.mondoo.com/mql/providers/neon"},"revokedAt":{"name":"revokedAt","type":"\t","is_mandatory":true,"title":"Time the grant was revoked, or null while it is live","provider":"go.mondoo.com/mql/providers/neon"}},"title":"Access granted on a Neon project","desc":"A grant of project access to an account outside the project's owner. The `revokedAt` field is null while the grant is live, so a query for live grants is what shows who can reach the project's data today. Sharing survives the departure of the person who set it up, so an unreviewed grant is how access outlives its reason.","private":true,"min_provider_version":"13.0.0","defaults":"grantedToEmail grantedAt","provider":"go.mondoo.com/mql/providers/neon"},"neon.role":{"id":"neon.role","name":"neon.role","fields":{"authenticationMethod":{"name":"authenticationMethod","type":"\u0007","is_mandatory":true,"title":"How a client authenticates as the role","desc":"Either password for a role holding its own credential, or another mechanism where the role is reached through a trusted key set rather than by presenting a password.","provider":"go.mondoo.com/mql/providers/neon"},"branch":{"name":"branch","type":"\u001bneon.branch","title":"Branch the role is defined on","provider":"go.mondoo.com/mql/providers/neon"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the role was created","provider":"go.mondoo.com/mql/providers/neon"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Role name","provider":"go.mondoo.com/mql/providers/neon"},"protected":{"name":"protected","type":"\u0004","is_mandatory":true,"title":"Whether the role is maintained by Neon rather than by an operator","provider":"go.mondoo.com/mql/providers/neon"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the role was last updated","provider":"go.mondoo.com/mql/providers/neon"}},"title":"Postgres role on a Neon branch","desc":"A database role defined on a branch. The `protected` field reports whether Neon maintains the role for its own features rather than an operator having created it. Role passwords are not exposed, though a project with `storePasswords` enabled holds them in a form the API can return.","private":true,"min_provider_version":"13.0.0","defaults":"name protected","provider":"go.mondoo.com/mql/providers/neon"},"neon.user":{"id":"neon.user","name":"neon.user","fields":{"authProviders":{"name":"authProviders","type":"\u0019\u0007","is_mandatory":true,"title":"Identity providers the account can sign in with","desc":"Each entry names a linked provider, such as github, google, or hasura. An account reachable through a social provider inherits that provider's authentication controls, including whether it enforces multi-factor authentication.","provider":"go.mondoo.com/mql/providers/neon"},"branchesLimit":{"name":"branchesLimit","type":"\u0005","is_mandatory":true,"title":"Maximum number of branches the account may create per project","provider":"go.mondoo.com/mql/providers/neon"},"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"Primary email address","provider":"go.mondoo.com/mql/providers/neon"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique user identifier","provider":"go.mondoo.com/mql/providers/neon"},"lastName":{"name":"lastName","type":"\u0007","is_mandatory":true,"title":"Family name of the account holder","provider":"go.mondoo.com/mql/providers/neon"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Display name of the account","provider":"go.mondoo.com/mql/providers/neon"},"plan":{"name":"plan","type":"\u0007","is_mandatory":true,"title":"Plan the account is subscribed to","provider":"go.mondoo.com/mql/providers/neon"},"projectsLimit":{"name":"projectsLimit","type":"\u0005","is_mandatory":true,"title":"Maximum number of projects the account may create","provider":"go.mondoo.com/mql/providers/neon"}},"title":"Neon User","desc":"The authenticated Neon account behind the API key, including its email, display name, plan, and the identity providers it can sign in with. Use it to attribute a scan to a principal and to confirm which account the key belongs to.","private":true,"min_provider_version":"13.0.0","defaults":"email name","provider":"go.mondoo.com/mql/providers/neon"},"neon.vpcEndpoint":{"id":"neon.vpcEndpoint","name":"neon.vpcEndpoint","fields":{"label":{"name":"label","type":"\u0007","is_mandatory":true,"title":"Descriptive label given to the endpoint","provider":"go.mondoo.com/mql/providers/neon"},"vpcEndpointId":{"name":"vpcEndpointId","type":"\u0007","is_mandatory":true,"title":"Identifier of the VPC endpoint in the cloud platform","provider":"go.mondoo.com/mql/providers/neon"}},"title":"Private connectivity endpoint of a Neon project","desc":"A VPC endpoint attached to a project so connections can arrive over private connectivity rather than the public internet. It is what `blockPublicConnections` on the project is set alongside.","private":true,"min_provider_version":"13.0.0","defaults":"vpcEndpointId label","provider":"go.mondoo.com/mql/providers/neon"}}}