{"resources":{"netlify":{"id":"netlify","name":"netlify","fields":{"account":{"name":"account","type":"\u001bnetlify.account","title":"Netlify Account","desc":"A Netlify team account and the posture that applies to every site under it. Query `enforceMfa` and `enforceSaml` for how members authenticate, `samlSessionExpiration` for how long a federated session stays valid, `teamRegistrationDomains` for who may join without an invitation, `supportAdministrationEnabled` for whether Netlify staff may administer the team, and `blockSiteTransfers` for whether a site can be moved out. The `members` field lists the roster with each member's role and enrollment, and `environmentVariables` covers the variables shared across the account's sites. The `rolesAllowed` field reports the roles the account's plan permits, which bounds how finely access can be split. Select an account with `netlify.accounts.where(slug == \"acme\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/netlify","is_implicit_resource":true},"accounts":{"name":"accounts","type":"\u0019\u001bnetlify.account","title":"Accounts the token can access","provider":"go.mondoo.com/mql/providers/netlify"},"currentUser":{"name":"currentUser","type":"\u001bnetlify.user","title":"Authenticated Netlify account behind the token","provider":"go.mondoo.com/mql/providers/netlify"},"deployKey":{"name":"deployKey","type":"\u001bnetlify.deployKey","title":"Netlify Deploy Key","desc":"An SSH key pair Netlify registers with a source control provider so builds can clone a private repository. The key grants repository access for as long as it stays registered, so a key no longer attached to any site is worth removing at the provider. Only the public half is exposed.","is_private":true,"provider":"go.mondoo.com/mql/providers/netlify","is_implicit_resource":true},"deployKeys":{"name":"deployKeys","type":"\u0019\u001bnetlify.deployKey","title":"Deploy keys registered for the authenticated user","provider":"go.mondoo.com/mql/providers/netlify"},"dnsZone":{"name":"dnsZone","type":"\u001bnetlify.dnsZone","title":"Netlify DNS Zone","desc":"A DNS zone Netlify serves for a domain, including its records and the nameservers delegated to it. A zone whose records point at decommissioned infrastructure is how a subdomain gets taken over, so `records` is worth reconciling against what still exists. Select a zone with `netlify.dnsZones.where(name == \"example.com\")`.","is_private":true,"provider":"go.mondoo.com/mql/providers/netlify","is_implicit_resource":true},"dnsZones":{"name":"dnsZones","type":"\u0019\u001bnetlify.dnsZone","title":"Netlify-managed DNS zones across every accessible account","provider":"go.mondoo.com/mql/providers/netlify"},"envVar":{"name":"envVar","type":"\u001bnetlify.envVar","title":"Netlify Environment Variable","desc":"An environment variable defined on an account or one of its sites, including the deploy contexts it applies to and whether Netlify treats it as a secret. A variable with `isSecret` false is readable by anyone who can reach the build logs or the site settings, so credentials stored that way are exposed well beyond the deploy. The `scopes` field reports which parts of the platform receive the value.","is_private":true,"provider":"go.mondoo.com/mql/providers/netlify","is_implicit_resource":true},"site":{"name":"site","type":"\u001bnetlify.site","title":"Netlify Site","desc":"A Netlify site and the controls that govern who can reach it and what a deploy is permitted to do. Query `ssl` and `forceSsl` for transport enforcement, `untrustedFlow` for what a fork's pull request may run, `customDomain` and `domainAliases` for the names it answers on, the `repo` fields for the source a build runs from, `publicRepo` and `privateLogs` for build-output exposure, `stopBuilds` for whether automatic deploys are suspended, and `preventNonGitProdDeploys` for whether production can be published outside of git. The `environmentVariables`, `buildHooks`, `notificationHooks`, and `snippets` fields cover what a deploy injects and what can trigger one. Select a site with `netlify.sites.where(name == \"www\")`.  The `privateLogs`, `skipPrs`, and `skipAutomaticBuilds` controls are tri-state: true, false, or null when the site has never set the control and follows the team default. Test them with `!= true` rather than `== false`, which matches only sites that explicitly turned the control off and skips every site still on the default. For example `netlify.sites.where(privateLogs != true)` finds every site whose build logs are not known to be restricted, and `where(privateLogs == null)` narrows that to the ones inheriting the team setting.","is_private":true,"provider":"go.mondoo.com/mql/providers/netlify","is_implicit_resource":true},"sites":{"name":"sites","type":"\u0019\u001bnetlify.site","title":"Sites across every accessible account","provider":"go.mondoo.com/mql/providers/netlify"},"user":{"name":"user","type":"\u001bnetlify.user","title":"Netlify User","desc":"The authenticated Netlify account behind the API token, including its email, display name, sign-in providers, and last sign-in time. Use it to attribute a scan to a principal and to confirm which account the token belongs to.","is_private":true,"provider":"go.mondoo.com/mql/providers/netlify","is_implicit_resource":true}},"title":"Netlify","desc":"Netlify account posture across every account the token can reach. The `accounts` field enumerates those accounts with their members and shared environment variables, `sites` flattens every site across them, `dnsZones` covers Netlify-managed DNS, `deployKeys` lists the SSH keys that grant repository access to builds, and `currentUser` identifies the principal the token belongs to.","min_provider_version":"13.0.0","provider":"go.mondoo.com/mql/providers/netlify"},"netlify.account":{"id":"netlify.account","name":"netlify.account","fields":{"billingEmail":{"name":"billingEmail","type":"\u0007","is_mandatory":true,"title":"Address billing notices are sent to","provider":"go.mondoo.com/mql/providers/netlify"},"blockSiteTransfers":{"name":"blockSiteTransfers","type":"\u0004","is_mandatory":true,"title":"Whether moving a site out of the account is blocked","provider":"go.mondoo.com/mql/providers/netlify"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the account was created","provider":"go.mondoo.com/mql/providers/netlify"},"enforceMfa":{"name":"enforceMfa","type":"\u0007","is_mandatory":true,"title":"Whether members must enroll in multi-factor authentication","desc":"One of not_enforced or a value requiring enrollment. When not enforced, a member holding administrative rights can sit behind a single factor, which the mfaEnabled field on each member reports individually.","provider":"go.mondoo.com/mql/providers/netlify"},"enforceSaml":{"name":"enforceSaml","type":"\u0007","is_mandatory":true,"title":"Whether members must authenticate through the account's SAML provider","desc":"One of not_enforced or a value requiring it. When not enforced, a member may sign in with a password or a git provider even where SAML is configured, so the identity provider's controls do not apply.","provider":"go.mondoo.com/mql/providers/netlify"},"environmentVariables":{"name":"environmentVariables","type":"\u0019\u001bnetlify.envVar","title":"Environment variables shared across the account's sites","provider":"go.mondoo.com/mql/providers/netlify"},"hasSitePassword":{"name":"hasSitePassword","type":"\u0004","is_mandatory":true,"title":"Whether any site in the account is gated behind a visitor password","desc":"Reported for the account rather than per site, which is the only form the API exposes it in.","provider":"go.mondoo.com/mql/providers/netlify"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique account identifier","provider":"go.mondoo.com/mql/providers/netlify"},"lifecycleState":{"name":"lifecycleState","type":"\u0007","is_mandatory":true,"title":"Lifecycle state of the account, for example active","provider":"go.mondoo.com/mql/providers/netlify"},"member":{"name":"member","type":"\u001bnetlify.account.member","title":"Member of a Netlify account","desc":"A single member of an account with the role that member holds. Use `role` to find members holding administrative rights and `email` to reconcile the roster against an identity provider.","is_private":true,"provider":"go.mondoo.com/mql/providers/netlify","is_implicit_resource":true},"members":{"name":"members","type":"\u0019\u001bnetlify.account.member","title":"Members of the account and the role each holds","provider":"go.mondoo.com/mql/providers/netlify"},"membersCount":{"name":"membersCount","type":"\u0005","is_mandatory":true,"title":"Number of members on the account","provider":"go.mondoo.com/mql/providers/netlify"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Display name","provider":"go.mondoo.com/mql/providers/netlify"},"owners":{"name":"owners","type":"\u0019\u001bnetlify.account.member","title":"Members that own the account","desc":"Resolved against the account roster, so an owner that is no longer a member of the account does not appear. Ownership carries every administrative right on the account, including billing and member management.","provider":"go.mondoo.com/mql/providers/netlify"},"rolesAllowed":{"name":"rolesAllowed","type":"\u0019\u0007","is_mandatory":true,"title":"Member roles the account's plan permits","desc":"Contains entries such as Owner, Collaborator, Controller, or Billing Admin. An account whose plan permits only Owner cannot separate administrative duties from day-to-day contributors.","provider":"go.mondoo.com/mql/providers/netlify"},"samlEnabled":{"name":"samlEnabled","type":"\u0004","is_mandatory":true,"title":"Whether SAML single sign-on is configured for the account","provider":"go.mondoo.com/mql/providers/netlify"},"samlSessionExpiration":{"name":"samlSessionExpiration","type":"\u0005","is_mandatory":true,"title":"Seconds a SAML session stays valid before reauthentication is required","desc":"A long window keeps a session usable well after the identity provider would have revoked it.","provider":"go.mondoo.com/mql/providers/netlify"},"siteAccess":{"name":"siteAccess","type":"\u0007","is_mandatory":true,"title":"Default site access members hold, for example all","provider":"go.mondoo.com/mql/providers/netlify"},"sitePasswordContext":{"name":"sitePasswordContext","type":"\u0007","is_mandatory":true,"title":"Scope the site password applies to, for example all","provider":"go.mondoo.com/mql/providers/netlify"},"siteSsoLogin":{"name":"siteSsoLogin","type":"\u0004","is_mandatory":true,"title":"Whether single sign-on is required to view the account's sites","provider":"go.mondoo.com/mql/providers/netlify"},"sites":{"name":"sites","type":"\u0019\u001bnetlify.site","title":"Sites belonging to the account","provider":"go.mondoo.com/mql/providers/netlify"},"slug":{"name":"slug","type":"\u0007","is_mandatory":true,"title":"URL-safe account slug","provider":"go.mondoo.com/mql/providers/netlify"},"supportAdministrationEnabled":{"name":"supportAdministrationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Netlify support staff may administer the account","provider":"go.mondoo.com/mql/providers/netlify"},"teamRegistrationDomains":{"name":"teamRegistrationDomains","type":"\u0019\u0007","is_mandatory":true,"title":"Email domains whose users may join the account without an invitation","desc":"Anyone with an address at a listed domain can add themselves to the account, so each entry is a standing grant of membership.","provider":"go.mondoo.com/mql/providers/netlify"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Plan identifier the account is subscribed to","provider":"go.mondoo.com/mql/providers/netlify"},"typeName":{"name":"typeName","type":"\u0007","is_mandatory":true,"title":"Human-readable plan name, for example Starter, Pro, or Enterprise","provider":"go.mondoo.com/mql/providers/netlify"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the account was last updated","provider":"go.mondoo.com/mql/providers/netlify"}},"title":"Netlify Account","desc":"A Netlify team account and the posture that applies to every site under it. Query `enforceMfa` and `enforceSaml` for how members authenticate, `samlSessionExpiration` for how long a federated session stays valid, `teamRegistrationDomains` for who may join without an invitation, `supportAdministrationEnabled` for whether Netlify staff may administer the team, and `blockSiteTransfers` for whether a site can be moved out. The `members` field lists the roster with each member's role and enrollment, and `environmentVariables` covers the variables shared across the account's sites. The `rolesAllowed` field reports the roles the account's plan permits, which bounds how finely access can be split. Select an account with `netlify.accounts.where(slug == \"acme\")`.","private":true,"min_provider_version":"13.0.0","defaults":"slug name","provider":"go.mondoo.com/mql/providers/netlify"},"netlify.account.member":{"id":"netlify.account.member","name":"netlify.account.member","fields":{"avatarUrl":{"name":"avatarUrl","type":"\u0007","is_mandatory":true,"title":"URL of the member avatar image","provider":"go.mondoo.com/mql/providers/netlify"},"connectedAccounts":{"name":"connectedAccounts","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"External identities linked to the member","desc":"Keyed by provider, such as github, with the account name held at that provider. A linked identity is another way to authenticate as this member.","provider":"go.mondoo.com/mql/providers/netlify"},"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"Email address of the member","provider":"go.mondoo.com/mql/providers/netlify"},"fullName":{"name":"fullName","type":"\u0007","is_mandatory":true,"title":"Display name of the member","provider":"go.mondoo.com/mql/providers/netlify"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique member identifier","desc":"Identifies the membership, not the person. The account's ownership is recorded against userId instead.","provider":"go.mondoo.com/mql/providers/netlify"},"lastActivityDate":{"name":"lastActivityDate","type":"\t","is_mandatory":true,"title":"Date the member was last active on the account","provider":"go.mondoo.com/mql/providers/netlify"},"managedByDirectorySync":{"name":"managedByDirectorySync","type":"\u0004","is_mandatory":true,"title":"Whether the membership is maintained by directory sync rather than by hand","provider":"go.mondoo.com/mql/providers/netlify"},"mfaEnabled":{"name":"mfaEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the member has enrolled in multi-factor authentication","desc":"Reported per member whether or not the account enforces it, so an owner without a second factor is visible even where enrollment is voluntary.","provider":"go.mondoo.com/mql/providers/netlify"},"pending":{"name":"pending","type":"\u0004","is_mandatory":true,"title":"Whether the invitation is still outstanding","desc":"A pending member has been offered access that has not been accepted. The offer stands until it is withdrawn.","provider":"go.mondoo.com/mql/providers/netlify"},"role":{"name":"role","type":"\u0007","is_mandatory":true,"title":"Role the member holds, for example Owner, Collaborator, or Controller","provider":"go.mondoo.com/mql/providers/netlify"},"siteAccess":{"name":"siteAccess","type":"\u0007","is_mandatory":true,"title":"Sites the member may reach, for example all","provider":"go.mondoo.com/mql/providers/netlify"},"userId":{"name":"userId","type":"\u0007","is_mandatory":true,"title":"Identifier of the user account behind the membership","desc":"This is the identifier the account records its owners against, and the one that matches the id of the authenticated user.","provider":"go.mondoo.com/mql/providers/netlify"}},"title":"Member of a Netlify account","desc":"A single member of an account with the role that member holds. Use `role` to find members holding administrative rights and `email` to reconcile the roster against an identity provider.","private":true,"min_provider_version":"13.0.0","defaults":"email role","provider":"go.mondoo.com/mql/providers/netlify"},"netlify.deployKey":{"id":"netlify.deployKey","name":"netlify.deployKey","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the key was created","provider":"go.mondoo.com/mql/providers/netlify"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique deploy key identifier","provider":"go.mondoo.com/mql/providers/netlify"},"publicKey":{"name":"publicKey","type":"\u0007","is_mandatory":true,"title":"Public half of the key pair, in OpenSSH format","provider":"go.mondoo.com/mql/providers/netlify"},"sites":{"name":"sites","type":"\u0019\u001bnetlify.site","title":"Sites whose builds clone with this key","desc":"Empty when no site references the key, which is the state a rotated or abandoned key is left in while it still grants access at the provider.","provider":"go.mondoo.com/mql/providers/netlify"}},"title":"Netlify Deploy Key","desc":"An SSH key pair Netlify registers with a source control provider so builds can clone a private repository. The key grants repository access for as long as it stays registered, so a key no longer attached to any site is worth removing at the provider. Only the public half is exposed.","private":true,"min_provider_version":"13.0.0","defaults":"id createdAt","provider":"go.mondoo.com/mql/providers/netlify"},"netlify.dnsZone":{"id":"netlify.dnsZone","name":"netlify.dnsZone","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the zone was created","provider":"go.mondoo.com/mql/providers/netlify"},"dedicated":{"name":"dedicated","type":"\u0004","is_mandatory":true,"title":"Whether the zone is served by nameservers dedicated to this account","provider":"go.mondoo.com/mql/providers/netlify"},"dnsServers":{"name":"dnsServers","type":"\u0019\u0007","is_mandatory":true,"title":"Nameservers the domain must delegate to for the zone to answer","provider":"go.mondoo.com/mql/providers/netlify"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique zone identifier","provider":"go.mondoo.com/mql/providers/netlify"},"ipv6Enabled":{"name":"ipv6Enabled","type":"\u0004","is_mandatory":true,"title":"Whether the zone answers AAAA queries for Netlify-hosted records","provider":"go.mondoo.com/mql/providers/netlify"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Domain the zone serves","provider":"go.mondoo.com/mql/providers/netlify"},"record":{"name":"record","type":"\u001bnetlify.dnsZone.record","title":"Record in a Netlify DNS zone","desc":"A single published DNS record. Use `type` and `value` to find records delegating a name to somewhere else, such as a CNAME at a provider the account no longer uses. The `managed` field reports whether Netlify maintains the record for a site it hosts rather than an operator having written it.","is_private":true,"provider":"go.mondoo.com/mql/providers/netlify","is_implicit_resource":true},"records":{"name":"records","type":"\u0019\u001bnetlify.dnsZone.record","title":"Records published in the zone","provider":"go.mondoo.com/mql/providers/netlify"},"site":{"name":"site","type":"\u001bnetlify.site","title":"Site the zone was created for, or null when the zone stands alone","provider":"go.mondoo.com/mql/providers/netlify"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the zone was last updated","provider":"go.mondoo.com/mql/providers/netlify"}},"title":"Netlify DNS Zone","desc":"A DNS zone Netlify serves for a domain, including its records and the nameservers delegated to it. A zone whose records point at decommissioned infrastructure is how a subdomain gets taken over, so `records` is worth reconciling against what still exists. Select a zone with `netlify.dnsZones.where(name == \"example.com\")`.","private":true,"min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/providers/netlify"},"netlify.dnsZone.record":{"id":"netlify.dnsZone.record","name":"netlify.dnsZone.record","fields":{"flag":{"name":"flag","type":"\u0005","is_mandatory":true,"title":"Flag byte of a CAA record","provider":"go.mondoo.com/mql/providers/netlify"},"hostname":{"name":"hostname","type":"\u0007","is_mandatory":true,"title":"Fully qualified name the record answers on","provider":"go.mondoo.com/mql/providers/netlify"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique record identifier","provider":"go.mondoo.com/mql/providers/netlify"},"managed":{"name":"managed","type":"\u0004","is_mandatory":true,"title":"Whether Netlify maintains the record automatically","provider":"go.mondoo.com/mql/providers/netlify"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Priority of an MX or SRV record","provider":"go.mondoo.com/mql/providers/netlify"},"tag":{"name":"tag","type":"\u0007","is_mandatory":true,"title":"Property tag of a CAA record, for example issue or iodef","provider":"go.mondoo.com/mql/providers/netlify"},"ttl":{"name":"ttl","type":"\u0005","is_mandatory":true,"title":"Seconds resolvers may cache the record","provider":"go.mondoo.com/mql/providers/netlify"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Record type, for example A, AAAA, CNAME, MX, TXT, NS, or CAA","provider":"go.mondoo.com/mql/providers/netlify"},"value":{"name":"value","type":"\u0007","is_mandatory":true,"title":"Value the record resolves to","provider":"go.mondoo.com/mql/providers/netlify"}},"title":"Record in a Netlify DNS zone","desc":"A single published DNS record. Use `type` and `value` to find records delegating a name to somewhere else, such as a CNAME at a provider the account no longer uses. The `managed` field reports whether Netlify maintains the record for a site it hosts rather than an operator having written it.","private":true,"min_provider_version":"13.0.0","defaults":"hostname type value","provider":"go.mondoo.com/mql/providers/netlify"},"netlify.envVar":{"id":"netlify.envVar","name":"netlify.envVar","fields":{"isSecret":{"name":"isSecret","type":"\u0004","is_mandatory":true,"title":"Whether Netlify stores the value as a secret and withholds it from reads","provider":"go.mondoo.com/mql/providers/netlify"},"key":{"name":"key","type":"\u0007","is_mandatory":true,"title":"Variable name","provider":"go.mondoo.com/mql/providers/netlify"},"scopes":{"name":"scopes","type":"\u0019\u0007","is_mandatory":true,"title":"Parts of the platform the variable is exposed to","desc":"Contains entries such as builds, functions, runtime, and post_processing. A variable scoped to runtime reaches code served to visitors.","provider":"go.mondoo.com/mql/providers/netlify"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the variable was last updated","provider":"go.mondoo.com/mql/providers/netlify"},"updatedBy":{"name":"updatedBy","type":"\u001bnetlify.account.member","title":"Member that last updated the variable","desc":"Resolved against the roster of the account the variable belongs to, so a member who has since left does not appear. Null when the roster is not readable with this token.","provider":"go.mondoo.com/mql/providers/netlify"},"values":{"name":"values","type":"\u0019\n","is_mandatory":true,"title":"Values set for the variable, one per deploy context","desc":"Each entry carries the `context` the value applies to, such as production, deploy-preview, branch-deploy, or dev, the `contextParameter` naming the branch for a branch-deploy context, and the `value` itself. Netlify withholds the value of a secret variable, so those entries carry an empty value.","provider":"go.mondoo.com/mql/providers/netlify"}},"title":"Netlify Environment Variable","desc":"An environment variable defined on an account or one of its sites, including the deploy contexts it applies to and whether Netlify treats it as a secret. A variable with `isSecret` false is readable by anyone who can reach the build logs or the site settings, so credentials stored that way are exposed well beyond the deploy. The `scopes` field reports which parts of the platform receive the value.","private":true,"min_provider_version":"13.0.0","defaults":"key isSecret","provider":"go.mondoo.com/mql/providers/netlify"},"netlify.site":{"id":"netlify.site","name":"netlify.site","fields":{"account":{"name":"account","type":"\u001bnetlify.account","title":"Account the site belongs to","provider":"go.mondoo.com/mql/providers/netlify"},"adminUrl":{"name":"adminUrl","type":"\u0007","is_mandatory":true,"title":"URL of the site in the Netlify admin interface","provider":"go.mondoo.com/mql/providers/netlify"},"allowedBranches":{"name":"allowedBranches","type":"\u0019\u0007","is_mandatory":true,"title":"Branches permitted to produce deploys","desc":"Empty when every branch may deploy. Listing branches here keeps an untrusted branch from publishing a preview that carries the site's environment variables.","provider":"go.mondoo.com/mql/providers/netlify"},"branchDeployCustomDomain":{"name":"branchDeployCustomDomain","type":"\u0007","is_mandatory":true,"title":"Custom domain serving branch deploys, or null when unset","provider":"go.mondoo.com/mql/providers/netlify"},"buildCommand":{"name":"buildCommand","type":"\u0007","is_mandatory":true,"title":"Command run to build the site","provider":"go.mondoo.com/mql/providers/netlify"},"buildHook":{"name":"buildHook","type":"\u001bnetlify.site.buildHook","title":"Build hook of a Netlify site","desc":"A URL that triggers a deploy of one branch when it receives a request. A build hook is an unauthenticated trigger, so every hook is a way to start a production deploy without an account. The trigger URL itself is a bearer secret and is deliberately not exposed here. Use `branch` to find hooks pointing at production.","is_private":true,"provider":"go.mondoo.com/mql/providers/netlify","is_implicit_resource":true},"buildHooks":{"name":"buildHooks","type":"\u0019\u001bnetlify.site.buildHook","title":"Build hooks that trigger a deploy of the site","provider":"go.mondoo.com/mql/providers/netlify"},"buildImage":{"name":"buildImage","type":"\u0007","is_mandatory":true,"title":"Build image the site's deploys run on, for example noble","provider":"go.mondoo.com/mql/providers/netlify"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the site was created","provider":"go.mondoo.com/mql/providers/netlify"},"customDomain":{"name":"customDomain","type":"\u0007","is_mandatory":true,"title":"Custom domain the site answers on, or null when it uses its netlify.app name","provider":"go.mondoo.com/mql/providers/netlify"},"deployKey":{"name":"deployKey","type":"\u001bnetlify.deployKey","title":"Deploy key granting the build access to the repository","provider":"go.mondoo.com/mql/providers/netlify"},"deployPreviewCustomDomain":{"name":"deployPreviewCustomDomain","type":"\u0007","is_mandatory":true,"title":"Custom domain serving deploy previews, or null when unset","provider":"go.mondoo.com/mql/providers/netlify"},"dnsZones":{"name":"dnsZones","type":"\u0019\u001bnetlify.dnsZone","title":"Netlify-managed DNS zones serving the site","provider":"go.mondoo.com/mql/providers/netlify"},"domainAliases":{"name":"domainAliases","type":"\u0019\u0007","is_mandatory":true,"title":"Additional domains the site answers on","provider":"go.mondoo.com/mql/providers/netlify"},"environmentVariables":{"name":"environmentVariables","type":"\u0019\u001bnetlify.envVar","title":"Environment variables that apply to the site","provider":"go.mondoo.com/mql/providers/netlify"},"forceSsl":{"name":"forceSsl","type":"\u0004","is_mandatory":true,"title":"Whether visitors are redirected from HTTP to HTTPS","provider":"go.mondoo.com/mql/providers/netlify"},"functionsDirectory":{"name":"functionsDirectory","type":"\u0007","is_mandatory":true,"title":"Directory functions are built from","provider":"go.mondoo.com/mql/providers/netlify"},"functionsRegion":{"name":"functionsRegion","type":"\u0007","is_mandatory":true,"title":"Region the site's functions execute in","provider":"go.mondoo.com/mql/providers/netlify"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique site identifier","provider":"go.mondoo.com/mql/providers/netlify"},"idDomain":{"name":"idDomain","type":"\u0007","is_mandatory":true,"title":"Identity domain issuing JSON Web Tokens for the site's visitor access","provider":"go.mondoo.com/mql/providers/netlify"},"managedDns":{"name":"managedDns","type":"\u0004","is_mandatory":true,"title":"Whether Netlify serves DNS for the site's domain","provider":"go.mondoo.com/mql/providers/netlify"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Site name, which is also the subdomain of its netlify.app address","provider":"go.mondoo.com/mql/providers/netlify"},"notificationEmail":{"name":"notificationEmail","type":"\u0007","is_mandatory":true,"title":"Address notified about the site's deploys, or null when unset","provider":"go.mondoo.com/mql/providers/netlify"},"notificationHook":{"name":"notificationHook","type":"\u001bnetlify.site.notificationHook","title":"Notification hook of a Netlify site","desc":"An outgoing notification fired when a site event occurs, such as a completed deploy or a submitted form. Use `type` to see where the notification is sent, for example email, slack, or a generic webhook URL, `event` for what triggers it, and `disabled` to find hooks that are configured but inactive. The hook's delivery settings can carry a bearer secret and are deliberately not exposed here.","is_private":true,"provider":"go.mondoo.com/mql/providers/netlify","is_implicit_resource":true},"notificationHooks":{"name":"notificationHooks","type":"\u0019\u001bnetlify.site.notificationHook","title":"Outgoing notifications configured for the site's events","provider":"go.mondoo.com/mql/providers/netlify"},"plan":{"name":"plan","type":"\u0007","is_mandatory":true,"title":"Plan the site is billed under","provider":"go.mondoo.com/mql/providers/netlify"},"prerender":{"name":"prerender","type":"\u0007","is_mandatory":true,"title":"Prerendering service enabled for the site, or null when disabled","provider":"go.mondoo.com/mql/providers/netlify"},"preventNonGitProdDeploys":{"name":"preventNonGitProdDeploys","type":"\u0004","is_mandatory":true,"title":"Whether publishing production outside of git is blocked","desc":"When true, a production deploy must come from the connected repository, which keeps a manual upload from reaching production unreviewed.","provider":"go.mondoo.com/mql/providers/netlify"},"privateLogs":{"name":"privateLogs","type":"\u0004","is_mandatory":true,"title":"Whether build logs are restricted to account members","desc":"Public build logs expose the build command output, including anything a build prints about its environment. Null when the site has never set the control and follows the team default.","provider":"go.mondoo.com/mql/providers/netlify"},"publicRepo":{"name":"publicRepo","type":"\u0004","is_mandatory":true,"title":"Whether the connected repository is public","provider":"go.mondoo.com/mql/providers/netlify"},"publishDirectory":{"name":"publishDirectory","type":"\u0007","is_mandatory":true,"title":"Directory published after a build completes","provider":"go.mondoo.com/mql/providers/netlify"},"repoBranch":{"name":"repoBranch","type":"\u0007","is_mandatory":true,"title":"Branch published to production","provider":"go.mondoo.com/mql/providers/netlify"},"repoPath":{"name":"repoPath","type":"\u0007","is_mandatory":true,"title":"Path of the repository within its provider, for example acme/www","provider":"go.mondoo.com/mql/providers/netlify"},"repoProvider":{"name":"repoProvider","type":"\u0007","is_mandatory":true,"title":"Source control provider hosting the site's repository, for example github","provider":"go.mondoo.com/mql/providers/netlify"},"repoUrl":{"name":"repoUrl","type":"\u0007","is_mandatory":true,"title":"URL of the repository builds are produced from","provider":"go.mondoo.com/mql/providers/netlify"},"skipAutomaticBuilds":{"name":"skipAutomaticBuilds","type":"\u0004","is_mandatory":true,"title":"Whether automatic builds are skipped entirely, or null when the site follows the team default","provider":"go.mondoo.com/mql/providers/netlify"},"skipPrs":{"name":"skipPrs","type":"\u0004","is_mandatory":true,"title":"Whether builds are skipped for pull requests, or null when the site follows the team default","provider":"go.mondoo.com/mql/providers/netlify"},"snippet":{"name":"snippet","type":"\u001bnetlify.site.snippet","title":"Snippet injected into a Netlify site","desc":"Markup injected into every page Netlify serves for the site, held separately from the repository. A snippet is script that reaches visitors without passing through the build, so it is worth reconciling against what the repository is reviewed to contain. The `general` field carries the markup injected into every page and `goal` the markup injected on form-submission success.","is_private":true,"provider":"go.mondoo.com/mql/providers/netlify","is_implicit_resource":true},"snippets":{"name":"snippets","type":"\u0019\u001bnetlify.site.snippet","title":"Code snippets injected into the site's pages","provider":"go.mondoo.com/mql/providers/netlify"},"ssl":{"name":"ssl","type":"\u0004","is_mandatory":true,"title":"Whether a TLS certificate is provisioned for the site","provider":"go.mondoo.com/mql/providers/netlify"},"sslUrl":{"name":"sslUrl","type":"\u0007","is_mandatory":true,"title":"HTTPS URL of the site, or null when no certificate is provisioned","provider":"go.mondoo.com/mql/providers/netlify"},"state":{"name":"state","type":"\u0007","is_mandatory":true,"title":"Lifecycle state of the site, for example current","provider":"go.mondoo.com/mql/providers/netlify"},"stopBuilds":{"name":"stopBuilds","type":"\u0004","is_mandatory":true,"title":"Whether automatic builds are suspended for the site","provider":"go.mondoo.com/mql/providers/netlify"},"untrustedFlow":{"name":"untrustedFlow","type":"\u0007","is_mandatory":true,"title":"How builds from untrusted contributors are handled","desc":"A pull request from outside the team can run build commands with the site's environment. One of review, which holds such builds for approval, or a value permitting them to run unreviewed.","provider":"go.mondoo.com/mql/providers/netlify"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the site was last updated","provider":"go.mondoo.com/mql/providers/netlify"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"Primary URL the site is served on","provider":"go.mondoo.com/mql/providers/netlify"}},"title":"Netlify Site","desc":"A Netlify site and the controls that govern who can reach it and what a deploy is permitted to do. Query `ssl` and `forceSsl` for transport enforcement, `untrustedFlow` for what a fork's pull request may run, `customDomain` and `domainAliases` for the names it answers on, the `repo` fields for the source a build runs from, `publicRepo` and `privateLogs` for build-output exposure, `stopBuilds` for whether automatic deploys are suspended, and `preventNonGitProdDeploys` for whether production can be published outside of git. The `environmentVariables`, `buildHooks`, `notificationHooks`, and `snippets` fields cover what a deploy injects and what can trigger one. Select a site with `netlify.sites.where(name == \"www\")`.  The `privateLogs`, `skipPrs`, and `skipAutomaticBuilds` controls are tri-state: true, false, or null when the site has never set the control and follows the team default. Test them with `!= true` rather than `== false`, which matches only sites that explicitly turned the control off and skips every site still on the default. For example `netlify.sites.where(privateLogs != true)` finds every site whose build logs are not known to be restricted, and `where(privateLogs == null)` narrows that to the ones inheriting the team setting.","private":true,"min_provider_version":"13.0.0","defaults":"name url","provider":"go.mondoo.com/mql/providers/netlify"},"netlify.site.buildHook":{"id":"netlify.site.buildHook","name":"netlify.site.buildHook","fields":{"branch":{"name":"branch","type":"\u0007","is_mandatory":true,"title":"Branch the hook deploys","provider":"go.mondoo.com/mql/providers/netlify"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the hook was created","provider":"go.mondoo.com/mql/providers/netlify"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique build hook identifier","provider":"go.mondoo.com/mql/providers/netlify"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Human-readable hook name","provider":"go.mondoo.com/mql/providers/netlify"}},"title":"Build hook of a Netlify site","desc":"A URL that triggers a deploy of one branch when it receives a request. A build hook is an unauthenticated trigger, so every hook is a way to start a production deploy without an account. The trigger URL itself is a bearer secret and is deliberately not exposed here. Use `branch` to find hooks pointing at production.","private":true,"min_provider_version":"13.0.0","defaults":"title branch","provider":"go.mondoo.com/mql/providers/netlify"},"netlify.site.notificationHook":{"id":"netlify.site.notificationHook","name":"netlify.site.notificationHook","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the hook was created","provider":"go.mondoo.com/mql/providers/netlify"},"disabled":{"name":"disabled","type":"\u0004","is_mandatory":true,"title":"Whether the hook is configured but inactive","provider":"go.mondoo.com/mql/providers/netlify"},"event":{"name":"event","type":"\u0007","is_mandatory":true,"title":"Event that fires the hook, for example deploy_created or submission_created","provider":"go.mondoo.com/mql/providers/netlify"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique hook identifier","provider":"go.mondoo.com/mql/providers/netlify"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Delivery mechanism, for example email, slack, or url","provider":"go.mondoo.com/mql/providers/netlify"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Time the hook was last updated","provider":"go.mondoo.com/mql/providers/netlify"}},"title":"Notification hook of a Netlify site","desc":"An outgoing notification fired when a site event occurs, such as a completed deploy or a submitted form. Use `type` to see where the notification is sent, for example email, slack, or a generic webhook URL, `event` for what triggers it, and `disabled` to find hooks that are configured but inactive. The hook's delivery settings can carry a bearer secret and are deliberately not exposed here.","private":true,"min_provider_version":"13.0.0","defaults":"type event","provider":"go.mondoo.com/mql/providers/netlify"},"netlify.site.snippet":{"id":"netlify.site.snippet","name":"netlify.site.snippet","fields":{"general":{"name":"general","type":"\u0007","is_mandatory":true,"title":"Markup injected into every page","provider":"go.mondoo.com/mql/providers/netlify"},"generalPosition":{"name":"generalPosition","type":"\u0007","is_mandatory":true,"title":"Location the general markup is injected at, either head or body","provider":"go.mondoo.com/mql/providers/netlify"},"goal":{"name":"goal","type":"\u0007","is_mandatory":true,"title":"Markup injected after a successful form submission","provider":"go.mondoo.com/mql/providers/netlify"},"goalPosition":{"name":"goalPosition","type":"\u0007","is_mandatory":true,"title":"Location the goal markup is injected at, either head or body","provider":"go.mondoo.com/mql/providers/netlify"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique snippet identifier","provider":"go.mondoo.com/mql/providers/netlify"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Human-readable snippet name","provider":"go.mondoo.com/mql/providers/netlify"}},"title":"Snippet injected into a Netlify site","desc":"Markup injected into every page Netlify serves for the site, held separately from the repository. A snippet is script that reaches visitors without passing through the build, so it is worth reconciling against what the repository is reviewed to contain. The `general` field carries the markup injected into every page and `goal` the markup injected on form-submission success.","private":true,"min_provider_version":"13.0.0","defaults":"title","provider":"go.mondoo.com/mql/providers/netlify"},"netlify.user":{"id":"netlify.user","name":"netlify.user","fields":{"avatarUrl":{"name":"avatarUrl","type":"\u0007","is_mandatory":true,"title":"URL of the account avatar image","provider":"go.mondoo.com/mql/providers/netlify"},"connectedAccounts":{"name":"connectedAccounts","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"External identities the account can sign in with","desc":"Keyed by provider, such as github, with the account name held at that provider. Each entry is another way to authenticate as this person.","provider":"go.mondoo.com/mql/providers/netlify"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Time the account was created","provider":"go.mondoo.com/mql/providers/netlify"},"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"Primary email address","provider":"go.mondoo.com/mql/providers/netlify"},"fullName":{"name":"fullName","type":"\u0007","is_mandatory":true,"title":"Display name of the account","provider":"go.mondoo.com/mql/providers/netlify"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Unique user identifier","provider":"go.mondoo.com/mql/providers/netlify"},"lastLogin":{"name":"lastLogin","type":"\t","is_mandatory":true,"title":"Time the account last signed in, or null when it never has","provider":"go.mondoo.com/mql/providers/netlify"},"loginProviders":{"name":"loginProviders","type":"\u0019\u0007","is_mandatory":true,"title":"Identity providers the account can sign in with","desc":"Contains an entry such as github, gitlab, bitbucket, or email for every provider linked to the account. An account reachable through a git provider inherits that provider's authentication controls.","provider":"go.mondoo.com/mql/providers/netlify"},"managedBySsoOrDirectorySync":{"name":"managedBySsoOrDirectorySync","type":"\u0004","is_mandatory":true,"title":"Whether the account is provisioned through single sign-on or directory sync","desc":"A managed account's lifecycle is controlled by the identity provider, so deprovisioning there removes the access. An unmanaged account outlives it.","provider":"go.mondoo.com/mql/providers/netlify"},"mfaEnabled":{"name":"mfaEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the account has enrolled in multi-factor authentication","provider":"go.mondoo.com/mql/providers/netlify"},"siteCount":{"name":"siteCount","type":"\u0005","is_mandatory":true,"title":"Number of sites the account can reach","provider":"go.mondoo.com/mql/providers/netlify"}},"title":"Netlify User","desc":"The authenticated Netlify account behind the API token, including its email, display name, sign-in providers, and last sign-in time. Use it to attribute a scan to a principal and to confirm which account the token belongs to.","private":true,"min_provider_version":"13.0.0","defaults":"email fullName","provider":"go.mondoo.com/mql/providers/netlify"}}}