{"resources":{"portainer":{"id":"portainer","name":"portainer","fields":{"apiKey":{"name":"apiKey","type":"\u001bportainer.apiKey","title":"Portainer API key","desc":"Bearer credential issued for a Portainer account. An API key carries the full authority of the account it belongs to and does not expire, so a key on an administrator account is a standing administrator credential. `lastUsed` is null for a key that has never authenticated a request, and `dateCreated` together with it is how a forgotten key is found. The key material and its stored digest are never reported; `prefix` is the short identifier Portainer itself displays.","is_private":true,"provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"asset":{"name":"asset","type":"\u001basset","title":"Asset this root belongs to","desc":"Platform, version, identity and labels of the asset this root describes.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"edgeGroup":{"name":"edgeGroup","type":"\u001bportainer.edgeGroup","title":"Portainer edge group","desc":"Edge group used to target Edge environments and Edge stacks. When `dynamic` is true, membership is derived from tag matches; otherwise it is a static set of explicitly assigned environments. Select an Edge group by its numeric `id`, for example `portainer.edgeGroup(id: 3)`.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"edgeGroups":{"name":"edgeGroups","type":"\u0019\u001bportainer.edgeGroup","title":"Edge groups defined on the instance","provider":"go.mondoo.com/mql/providers/portainer"},"edgeJob":{"name":"edgeJob","type":"\u001bportainer.edgeJob","title":"Portainer Edge job","desc":"Script Portainer runs on Edge hosts on a schedule. The script executes with the Edge agent's own privileges on every targeted host, so `cronExpression` together with the targeted `edgeGroups` and `environments` describes a recurring remote-execution path into the fleet. Select an Edge job by its numeric `id`.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"edgeJobs":{"name":"edgeJobs","type":"\u0019\u001bportainer.edgeJob","title":"Edge jobs scheduled on the instance","min_provider_version":"13.1.9","provider":"go.mondoo.com/mql/providers/portainer"},"edgeStack":{"name":"edgeStack","type":"\u001bportainer.edgeStack","title":"Portainer edge stack","desc":"Workload definition deployed to Edge environments through one or more Edge groups. Select an Edge stack by its numeric `id`, for example `portainer.edgeStack(id: 3)`. The deploymentType field distinguishes compose from Kubernetes stacks, and numDeployments reports how many environments the stack currently runs on.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"edgeStacks":{"name":"edgeStacks","type":"\u0019\u001bportainer.edgeStack","title":"Edge stacks defined on the instance","provider":"go.mondoo.com/mql/providers/portainer"},"environment":{"name":"environment","type":"\u001bportainer.environment","title":"Portainer environment","desc":"Environment (endpoint) managed by Portainer: a Docker host, a Docker Swarm or Kubernetes cluster, or an Edge agent. The `type` field reports which of these it is and `status` whether it is currently reachable. `teamAccessPolicies` and `userAccessPolicies` capture the per-environment RBAC grants (keyed by team and user id), which together with the instance `settings` describe who can deploy workloads where. Select an environment by its numeric `id`.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"environmentGroup":{"name":"environmentGroup","type":"\u001bportainer.environmentGroup","title":"Portainer environment group","desc":"Environment group (endpoint group) that bundles environments so access policies and tags can be managed together. `teamAccessPolicies` and `userAccessPolicies` capture the per-group RBAC grants, letting you audit which teams and users hold access to every environment in the group. Select a group by its numeric `id`.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"environmentGroups":{"name":"environmentGroups","type":"\u0019\u001bportainer.environmentGroup","title":"Environment groups (endpoint groups) defined on the instance","provider":"go.mondoo.com/mql/providers/portainer"},"environments":{"name":"environments","type":"\u0019\u001bportainer.environment","title":"Environments (endpoints) managed by the instance","provider":"go.mondoo.com/mql/providers/portainer"},"instanceId":{"name":"instanceId","type":"\u0007","title":"Unique Portainer instance identifier","provider":"go.mondoo.com/mql/providers/portainer"},"license":{"name":"license","type":"\u001bportainer.license","title":"Portainer license","desc":"License applied to the Portainer instance, covering the company it is issued to, the number of licensed nodes, and the creation and expiry times that govern which enterprise features remain available. Audit this to confirm a valid, unexpired license backs the deployment and to track how many nodes the entitlement permits.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"licenses":{"name":"licenses","type":"\u0019\u001bportainer.license","title":"Licenses applied to the instance","provider":"go.mondoo.com/mql/providers/portainer"},"registries":{"name":"registries","type":"\u0019\u001bportainer.registry","title":"Container registries configured on the instance","min_provider_version":"13.1.9","provider":"go.mondoo.com/mql/providers/portainer"},"registry":{"name":"registry","type":"\u001bportainer.registry","title":"Portainer container registry","desc":"Registry Portainer pulls images from, and the credentials it holds for it. `authenticationEnabled` reports whether Portainer stores a credential for the registry at all, and `accesses` reports which teams and users were granted the use of that credential on each environment. A registry whose access grants reach standard users hands them the credential's pull rights on every host they can deploy to. The stored password, access token, and any cloud secret key are never reported. Select a registry by its numeric `id`, for example `portainer.registries.where(name == \"internal\")`.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"role":{"name":"role","type":"\u001bportainer.role","title":"Portainer role definition","desc":"Role that an environment or environment group access policy grants. The numeric role ids in those policies are resolved against these definitions, and `authorizations` is the set of operations the role actually permits. Role definitions are customizable, so a role named readonly_user may carry write authorizations, which only reading the definition reveals. Instances that do not expose customizable roles report none.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"roles":{"name":"roles","type":"\u0019\u001bportainer.role","title":"Role definitions the instance offers for environment access policies","min_provider_version":"13.1.9","provider":"go.mondoo.com/mql/providers/portainer"},"settings":{"name":"settings","type":"\u001bportainer.settings","title":"Instance-wide authentication and container-security settings","provider":"go.mondoo.com/mql/providers/portainer"},"stack":{"name":"stack","type":"\u001bportainer.stack","title":"Portainer stack","desc":"Workload definition Portainer deploys onto one environment, the route most workloads take to reach a managed host. `webhookEnabled` reports whether the stack can be redeployed by an unauthenticated POST to a token URL, and the `autoUpdate*` fields whether Portainer redeploys it on a schedule or on a Git change. Combined with a `gitUrl` on a repository the operator does not control, either is a path by which code the operator did not review reaches the host. The webhook token, and any Git credential stored with the stack, are never reported. Select a stack by its numeric `id`, for example `portainer.stacks.where(name == \"web\")`.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"stacks":{"name":"stacks","type":"\u0019\u001bportainer.stack","title":"Stacks deployed through the instance","min_provider_version":"13.1.9","provider":"go.mondoo.com/mql/providers/portainer"},"tag":{"name":"tag","type":"\u001bportainer.tag","title":"Portainer tag","desc":"Label applied to environments and environment groups on the Portainer instance so that Edge groups can target them dynamically. Auditing tags reveals how environments are grouped for policy and deployment targeting. Select a tag by its numeric `id` or `name`.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"tags":{"name":"tags","type":"\u0019\u001bportainer.tag","title":"Tags defined on the instance","provider":"go.mondoo.com/mql/providers/portainer"},"team":{"name":"team","type":"\u001bportainer.team","title":"Portainer team","desc":"Team and its membership within a Portainer instance. Teams group standard users so that environment access policies can be granted in bulk rather than user by user, so a team's roster is what determines who inherits those grants. Select a team by its numeric `id` and read `members` to enumerate the users that belong to it.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"teamMembership":{"name":"teamMembership","type":"\u001bportainer.teamMembership","title":"Portainer team membership","desc":"One user's place in one team, and the role held there. A membership joins the user and the team as resources, so a query for every team leader on the instance reads `portainer.teamMemberships.where(role == \"leader\")` and traverses to the account and team from there. Team leaders may change a team's roster, which decides who inherits the environment access granted to that team.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"teamMemberships":{"name":"teamMemberships","type":"\u0019\u001bportainer.teamMembership","title":"Team memberships defined on the instance","min_provider_version":"13.1.9","provider":"go.mondoo.com/mql/providers/portainer"},"teams":{"name":"teams","type":"\u0019\u001bportainer.team","title":"Teams defined on the instance","provider":"go.mondoo.com/mql/providers/portainer"},"user":{"name":"user","type":"\u001bportainer.user","title":"Portainer user account","desc":"User account that authenticates to the Portainer server. The `role` field reports whether the account is a site `administrator` or a `standard` user, a key RBAC audit since administrators can reach every managed environment. Select a user by its numeric `id`, for example `portainer.users.where(role == \"administrator\")`, and traverse `teams` to see which teams it belongs to.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"users":{"name":"users","type":"\u0019\u001bportainer.user","title":"User accounts defined on the instance","provider":"go.mondoo.com/mql/providers/portainer"},"version":{"name":"version","type":"\u0007","title":"Portainer server version","provider":"go.mondoo.com/mql/providers/portainer","maturity":"deprecated","replaced_by":"asset.version"},"webhook":{"name":"webhook","type":"\u001bportainer.webhook","title":"Portainer webhook","desc":"Redeploy trigger registered against a service or container on one environment. Invoking a webhook is a POST to a URL containing a token and carries no other authentication, so anyone who obtains the URL can force the target to be redeployed; when the target runs a mutable image tag, that redeploy pulls whatever the tag points at now. The token is never reported. Select a webhook by its numeric `id`.","provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"webhooks":{"name":"webhooks","type":"\u0019\u001bportainer.webhook","title":"Webhooks defined on the instance","min_provider_version":"13.1.9","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer instance","desc":"Portainer container-management control plane at the root of an audit. The server version and instance-wide security settings describe the control plane itself, the user accounts and teams make up its RBAC model, and the environments (Docker hosts, Swarm or Kubernetes clusters, and Edge agents) are the hosts it manages. The registries, stacks, webhooks, and Edge jobs are the paths by which code reaches those hosts.","min_provider_version":"13.0.0","provider":"go.mondoo.com/mql/providers/portainer","root":true},"portainer.apiKey":{"id":"portainer.apiKey","name":"portainer.apiKey","fields":{"dateCreated":{"name":"dateCreated","type":"\t","is_mandatory":true,"title":"Time the key was created (null if unset)","provider":"go.mondoo.com/mql/providers/portainer"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description recorded when the key was created","provider":"go.mondoo.com/mql/providers/portainer"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric API key identifier","provider":"go.mondoo.com/mql/providers/portainer"},"lastUsed":{"name":"lastUsed","type":"\t","is_mandatory":true,"title":"Time the key last authenticated a request (null if never used)","provider":"go.mondoo.com/mql/providers/portainer"},"prefix":{"name":"prefix","type":"\u0007","is_mandatory":true,"title":"Short identifier of the key, as displayed by Portainer","provider":"go.mondoo.com/mql/providers/portainer"},"user":{"name":"user","type":"\u001bportainer.user","title":"Account the key was issued for","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer API key","desc":"Bearer credential issued for a Portainer account. An API key carries the full authority of the account it belongs to and does not expire, so a key on an administrator account is a standing administrator credential. `lastUsed` is null for a key that has never authenticated a request, and `dateCreated` together with it is how a forgotten key is found. The key material and its stored digest are never reported; `prefix` is the short identifier Portainer itself displays.","private":true,"min_provider_version":"13.1.9","defaults":"description prefix lastUsed","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.edgeGroup":{"id":"portainer.edgeGroup","name":"portainer.edgeGroup","fields":{"dynamic":{"name":"dynamic","type":"\u0004","is_mandatory":true,"title":"Whether membership is determined dynamically by tag match","provider":"go.mondoo.com/mql/providers/portainer"},"environments":{"name":"environments","type":"\u0019\u001bportainer.environment","title":"Environments in the group","provider":"go.mondoo.com/mql/providers/portainer"},"hasEdgeStack":{"name":"hasEdgeStack","type":"\u0004","is_mandatory":true,"title":"Whether the group has an associated Edge stack","provider":"go.mondoo.com/mql/providers/portainer"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric Edge group identifier","provider":"go.mondoo.com/mql/providers/portainer"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Edge group name","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer edge group","desc":"Edge group used to target Edge environments and Edge stacks. When `dynamic` is true, membership is derived from tag matches; otherwise it is a static set of explicitly assigned environments. Select an Edge group by its numeric `id`, for example `portainer.edgeGroup(id: 3)`.","min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.edgeJob":{"id":"portainer.edgeJob","name":"portainer.edgeJob","fields":{"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Time the Edge job was created (null if unset)","provider":"go.mondoo.com/mql/providers/portainer"},"cronExpression":{"name":"cronExpression","type":"\u0007","is_mandatory":true,"title":"Cron expression the job runs on","provider":"go.mondoo.com/mql/providers/portainer"},"edgeGroups":{"name":"edgeGroups","type":"\u0019\u001bportainer.edgeGroup","title":"Edge groups the job targets","provider":"go.mondoo.com/mql/providers/portainer"},"environments":{"name":"environments","type":"\u0019\u001bportainer.environment","title":"Environments the job targets directly","provider":"go.mondoo.com/mql/providers/portainer"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric Edge job identifier","provider":"go.mondoo.com/mql/providers/portainer"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Edge job name","provider":"go.mondoo.com/mql/providers/portainer"},"recurring":{"name":"recurring","type":"\u0004","is_mandatory":true,"title":"Whether the job runs repeatedly rather than once","provider":"go.mondoo.com/mql/providers/portainer"},"scriptPath":{"name":"scriptPath","type":"\u0007","is_mandatory":true,"title":"Path of the script the job executes on each host","provider":"go.mondoo.com/mql/providers/portainer"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"Job revision, incremented on each update","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer Edge job","desc":"Script Portainer runs on Edge hosts on a schedule. The script executes with the Edge agent's own privileges on every targeted host, so `cronExpression` together with the targeted `edgeGroups` and `environments` describes a recurring remote-execution path into the fleet. Select an Edge job by its numeric `id`.","min_provider_version":"13.1.9","defaults":"name cronExpression recurring","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.edgeStack":{"id":"portainer.edgeStack","name":"portainer.edgeStack","fields":{"creationDate":{"name":"creationDate","type":"\t","is_mandatory":true,"title":"Time the Edge stack was created (null if unset)","provider":"go.mondoo.com/mql/providers/portainer"},"deploymentType":{"name":"deploymentType","type":"\u0007","is_mandatory":true,"title":"Deployment type: compose, kubernetes, or unknown","provider":"go.mondoo.com/mql/providers/portainer"},"edgeGroups":{"name":"edgeGroups","type":"\u0019\u001bportainer.edgeGroup","title":"Edge groups the stack targets","provider":"go.mondoo.com/mql/providers/portainer"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric Edge stack identifier","provider":"go.mondoo.com/mql/providers/portainer"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Edge stack name","provider":"go.mondoo.com/mql/providers/portainer"},"numDeployments":{"name":"numDeployments","type":"\u0005","is_mandatory":true,"title":"Number of environments the stack is deployed to","provider":"go.mondoo.com/mql/providers/portainer"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"Stack revision, incremented on each update","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer edge stack","desc":"Workload definition deployed to Edge environments through one or more Edge groups. Select an Edge stack by its numeric `id`, for example `portainer.edgeStack(id: 3)`. The deploymentType field distinguishes compose from Kubernetes stacks, and numDeployments reports how many environments the stack currently runs on.","min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.environment":{"id":"portainer.environment","name":"portainer.environment","fields":{"containerEngine":{"name":"containerEngine","type":"\u0007","is_mandatory":true,"title":"Container engine in use, for example docker or podman","provider":"go.mondoo.com/mql/providers/portainer"},"edgeId":{"name":"edgeId","type":"\u0007","is_mandatory":true,"title":"Edge agent identifier, for Edge environments","provider":"go.mondoo.com/mql/providers/portainer"},"gpuManagementEnabled":{"name":"gpuManagementEnabled","type":"\u0004","is_mandatory":true,"title":"Whether GPU management is enabled for the environment","provider":"go.mondoo.com/mql/providers/portainer"},"group":{"name":"group","type":"\u001bportainer.environmentGroup","title":"Environment group (endpoint group) this environment belongs to","provider":"go.mondoo.com/mql/providers/portainer"},"heartbeat":{"name":"heartbeat","type":"\u0004","is_mandatory":true,"title":"Whether the Edge agent is currently connected (heartbeat)","provider":"go.mondoo.com/mql/providers/portainer"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric environment identifier","provider":"go.mondoo.com/mql/providers/portainer"},"mtlsEnabled":{"name":"mtlsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the environment's agent authenticates back with mutual TLS","desc":"tlsEnabled and tlsSkipVerify describe how Portainer reaches the environment; this reports whether the agent proves its own identity on the return path. Null on instances that report no mutual TLS state.","min_provider_version":"13.1.9","provider":"go.mondoo.com/mql/providers/portainer"},"mtlsOk":{"name":"mtlsOk","type":"\u0004","is_mandatory":true,"title":"Whether the server reports the environment's mutual TLS material as usable","desc":"Null on instances that report no mutual TLS state.","min_provider_version":"13.1.9","provider":"go.mondoo.com/mql/providers/portainer"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Environment name","provider":"go.mondoo.com/mql/providers/portainer"},"publicUrl":{"name":"publicUrl","type":"\u0007","is_mandatory":true,"title":"Public URL used to reach exposed containers","provider":"go.mondoo.com/mql/providers/portainer"},"securitySettings":{"name":"securitySettings","type":"\n","is_mandatory":true,"title":"Per-environment container-security overrides","desc":"Boolean flags, keyed by setting name, that relax container privileges for non-admin (regular) users. Keys: allowBindMountsForRegularUsers, allowContainerCapabilitiesForRegularUsers, allowDeviceMappingForRegularUsers, allowHostNamespaceForRegularUsers, allowPrivilegedModeForRegularUsers, allowStackManagementForRegularUsers, allowSysctlSettingForRegularUsers, allowVolumeBrowserForRegularUsers, and enableHostManagementFeatures. Any flag set to true widens the container attack surface available to unprivileged users on this environment.","provider":"go.mondoo.com/mql/providers/portainer"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Connection status: up, down, provisioning, error, or unknown","provider":"go.mondoo.com/mql/providers/portainer"},"tags":{"name":"tags","type":"\u0019\u001bportainer.tag","title":"Tags assigned to the environment","provider":"go.mondoo.com/mql/providers/portainer"},"teamAccessPolicies":{"name":"teamAccessPolicies","type":"\n","is_mandatory":true,"title":"Team access policies keyed by team id, with the granted role id as the value","provider":"go.mondoo.com/mql/providers/portainer"},"teamAccessRoles":{"name":"teamAccessRoles","type":"\n","is_mandatory":true,"title":"Team access roles keyed by team id, with the granted role name as the value","desc":"The same grants as teamAccessPolicies with the role id resolved to its name: environment_administrator, helpdesk_user, standard_user, readonly_user, or operator_user. An unrecognized role id maps to unknown.","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/portainer"},"tlsEnabled":{"name":"tlsEnabled","type":"\u0004","is_mandatory":true,"title":"Whether the connection to the environment uses TLS","provider":"go.mondoo.com/mql/providers/portainer"},"tlsSkipVerify":{"name":"tlsSkipVerify","type":"\u0004","is_mandatory":true,"title":"Whether verification of the environment's TLS certificate is skipped","desc":"True when Portainer is configured to accept the environment's server certificate without validating it, which leaves the control-plane connection open to interception. Only meaningful when tlsEnabled is true.","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/portainer"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Environment type: docker, agent-docker, azure-aci, edge-agent-docker, kubernetes, agent-kubernetes, or edge-agent-kubernetes","provider":"go.mondoo.com/mql/providers/portainer"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"API endpoint URL of the environment","provider":"go.mondoo.com/mql/providers/portainer"},"userAccessPolicies":{"name":"userAccessPolicies","type":"\n","is_mandatory":true,"title":"User access policies keyed by user id, with the granted role id as the value","provider":"go.mondoo.com/mql/providers/portainer"},"userAccessRoles":{"name":"userAccessRoles","type":"\n","is_mandatory":true,"title":"User access roles keyed by user id, with the granted role name as the value","desc":"The same grants as userAccessPolicies with the role id resolved to its name: environment_administrator, helpdesk_user, standard_user, readonly_user, or operator_user. An unrecognized role id maps to unknown.","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/portainer"},"userTrusted":{"name":"userTrusted","type":"\u0004","is_mandatory":true,"title":"Whether the environment has been manually trusted by an administrator","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer environment","desc":"Environment (endpoint) managed by Portainer: a Docker host, a Docker Swarm or Kubernetes cluster, or an Edge agent. The `type` field reports which of these it is and `status` whether it is currently reachable. `teamAccessPolicies` and `userAccessPolicies` capture the per-environment RBAC grants (keyed by team and user id), which together with the instance `settings` describe who can deploy workloads where. Select an environment by its numeric `id`.","min_provider_version":"13.0.0","defaults":"name type status","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.environmentGroup":{"id":"portainer.environmentGroup","name":"portainer.environmentGroup","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description of the environment group","provider":"go.mondoo.com/mql/providers/portainer"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric environment group identifier","provider":"go.mondoo.com/mql/providers/portainer"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Environment group name","provider":"go.mondoo.com/mql/providers/portainer"},"tags":{"name":"tags","type":"\u0019\u001bportainer.tag","title":"Tags assigned to the group","provider":"go.mondoo.com/mql/providers/portainer"},"teamAccessPolicies":{"name":"teamAccessPolicies","type":"\n","is_mandatory":true,"title":"Team access policies keyed by team id, with the granted role id as the value","provider":"go.mondoo.com/mql/providers/portainer"},"teamAccessRoles":{"name":"teamAccessRoles","type":"\n","is_mandatory":true,"title":"Team access roles keyed by team id, with the granted role name as the value","desc":"The same grants as teamAccessPolicies with the role id resolved to its name: environment_administrator, helpdesk_user, standard_user, readonly_user, or operator_user. An unrecognized role id maps to unknown.","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/portainer"},"userAccessPolicies":{"name":"userAccessPolicies","type":"\n","is_mandatory":true,"title":"User access policies keyed by user id, with the granted role id as the value","provider":"go.mondoo.com/mql/providers/portainer"},"userAccessRoles":{"name":"userAccessRoles","type":"\n","is_mandatory":true,"title":"User access roles keyed by user id, with the granted role name as the value","desc":"The same grants as userAccessPolicies with the role id resolved to its name: environment_administrator, helpdesk_user, standard_user, readonly_user, or operator_user. An unrecognized role id maps to unknown.","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer environment group","desc":"Environment group (endpoint group) that bundles environments so access policies and tags can be managed together. `teamAccessPolicies` and `userAccessPolicies` capture the per-group RBAC grants, letting you audit which teams and users hold access to every environment in the group. Select a group by its numeric `id`.","min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.license":{"id":"portainer.license","name":"portainer.license","fields":{"company":{"name":"company","type":"\u0007","is_mandatory":true,"title":"Company the license is issued to","provider":"go.mondoo.com/mql/providers/portainer"},"created":{"name":"created","type":"\t","is_mandatory":true,"title":"Time the license was created (null if unset)","provider":"go.mondoo.com/mql/providers/portainer"},"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"Contact email on the license","provider":"go.mondoo.com/mql/providers/portainer"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Time the license expires (null if perpetual)","provider":"go.mondoo.com/mql/providers/portainer"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"License identifier","provider":"go.mondoo.com/mql/providers/portainer"},"nodes":{"name":"nodes","type":"\u0005","is_mandatory":true,"title":"Number of licensed nodes","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer license","desc":"License applied to the Portainer instance, covering the company it is issued to, the number of licensed nodes, and the creation and expiry times that govern which enterprise features remain available. Audit this to confirm a valid, unexpired license backs the deployment and to track how many nodes the entitlement permits.","min_provider_version":"13.0.0","defaults":"company expiresAt","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.registry":{"id":"portainer.registry","name":"portainer.registry","fields":{"access":{"name":"access","type":"\u001bportainer.registry.access","title":"Grant of a Portainer registry on one environment","desc":"Which teams and users may use one registry on one environment, and in which Kubernetes namespaces. The grants carry the registry's stored credential with them, so a grant to a team of standard users gives that team the registry's pull rights on the environment.","is_private":true,"provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"accesses":{"name":"accesses","type":"\u0019\u001bportainer.registry.access","title":"Per-environment grants of this registry","provider":"go.mondoo.com/mql/providers/portainer"},"authenticationEnabled":{"name":"authenticationEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Portainer stores a credential and authenticates to the registry","provider":"go.mondoo.com/mql/providers/portainer"},"baseUrl":{"name":"baseUrl","type":"\u0007","is_mandatory":true,"title":"Base URL, used by registries that serve the API under a prefix","provider":"go.mondoo.com/mql/providers/portainer"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric registry identifier","provider":"go.mondoo.com/mql/providers/portainer"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Registry name","provider":"go.mondoo.com/mql/providers/portainer"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Registry type: quay, azure, custom, gitlab, proget, dockerhub, ecr, or unknown","provider":"go.mondoo.com/mql/providers/portainer"},"url":{"name":"url","type":"\u0007","is_mandatory":true,"title":"URL or address of the registry","provider":"go.mondoo.com/mql/providers/portainer"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Username or access key id Portainer authenticates with","desc":"Empty when no credential is stored. The matching password or secret key is never reported.","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer container registry","desc":"Registry Portainer pulls images from, and the credentials it holds for it. `authenticationEnabled` reports whether Portainer stores a credential for the registry at all, and `accesses` reports which teams and users were granted the use of that credential on each environment. A registry whose access grants reach standard users hands them the credential's pull rights on every host they can deploy to. The stored password, access token, and any cloud secret key are never reported. Select a registry by its numeric `id`, for example `portainer.registries.where(name == \"internal\")`.","min_provider_version":"13.1.9","defaults":"name type url","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.registry.access":{"id":"portainer.registry.access","name":"portainer.registry.access","fields":{"environment":{"name":"environment","type":"\u001bportainer.environment","title":"Environment the grant applies to","provider":"go.mondoo.com/mql/providers/portainer"},"namespaces":{"name":"namespaces","type":"\u0019\u0007","is_mandatory":true,"title":"Kubernetes namespaces the registry may be used from","provider":"go.mondoo.com/mql/providers/portainer"},"teamAccessPolicies":{"name":"teamAccessPolicies","type":"\n","is_mandatory":true,"title":"Team access policies keyed by team id, with the granted role id as the value","provider":"go.mondoo.com/mql/providers/portainer"},"teamAccessRoles":{"name":"teamAccessRoles","type":"\n","is_mandatory":true,"title":"Team access roles keyed by team id, with the granted role name as the value","desc":"The same grants as teamAccessPolicies with the role id resolved to its name: environment_administrator, helpdesk_user, standard_user, readonly_user, or operator_user. An unrecognized role id maps to unknown.","provider":"go.mondoo.com/mql/providers/portainer"},"userAccessPolicies":{"name":"userAccessPolicies","type":"\n","is_mandatory":true,"title":"User access policies keyed by user id, with the granted role id as the value","provider":"go.mondoo.com/mql/providers/portainer"},"userAccessRoles":{"name":"userAccessRoles","type":"\n","is_mandatory":true,"title":"User access roles keyed by user id, with the granted role name as the value","desc":"The same grants as userAccessPolicies with the role id resolved to its name: environment_administrator, helpdesk_user, standard_user, readonly_user, or operator_user. An unrecognized role id maps to unknown.","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Grant of a Portainer registry on one environment","desc":"Which teams and users may use one registry on one environment, and in which Kubernetes namespaces. The grants carry the registry's stored credential with them, so a grant to a team of standard users gives that team the registry's pull rights on the environment.","private":true,"min_provider_version":"13.1.9","defaults":"teamAccessRoles userAccessRoles","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.role":{"id":"portainer.role","name":"portainer.role","fields":{"authorizations":{"name":"authorizations","type":"\u0019\u0007","is_mandatory":true,"title":"Names of the authorizations the role grants","desc":"Each entry is an operation the role permits, for example DockerContainerCreate or PortainerEndpointUpdate. Only granted authorizations are listed.","provider":"go.mondoo.com/mql/providers/portainer"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Role description","provider":"go.mondoo.com/mql/providers/portainer"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric role identifier","provider":"go.mondoo.com/mql/providers/portainer"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Role name, for example environment_administrator","provider":"go.mondoo.com/mql/providers/portainer"},"priority":{"name":"priority","type":"\u0005","is_mandatory":true,"title":"Ordering priority of the role","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer role definition","desc":"Role that an environment or environment group access policy grants. The numeric role ids in those policies are resolved against these definitions, and `authorizations` is the set of operations the role actually permits. Role definitions are customizable, so a role named readonly_user may carry write authorizations, which only reading the definition reveals. Instances that do not expose customizable roles report none.","min_provider_version":"13.1.9","defaults":"name priority","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.settings":{"id":"portainer.settings","name":"portainer.settings","fields":{"allowBindMountsForRegularUsers":{"name":"allowBindMountsForRegularUsers","type":"\u0004","is_mandatory":true,"title":"Whether regular users may bind-mount host paths","provider":"go.mondoo.com/mql/providers/portainer"},"allowContainerCapabilitiesForRegularUsers":{"name":"allowContainerCapabilitiesForRegularUsers","type":"\u0004","is_mandatory":true,"title":"Whether regular users may add container capabilities","provider":"go.mondoo.com/mql/providers/portainer"},"allowDeviceMappingForRegularUsers":{"name":"allowDeviceMappingForRegularUsers","type":"\u0004","is_mandatory":true,"title":"Whether regular users may map host devices into containers","provider":"go.mondoo.com/mql/providers/portainer"},"allowHostNamespaceForRegularUsers":{"name":"allowHostNamespaceForRegularUsers","type":"\u0004","is_mandatory":true,"title":"Whether regular users may share host namespaces","provider":"go.mondoo.com/mql/providers/portainer"},"allowPrivilegedModeForRegularUsers":{"name":"allowPrivilegedModeForRegularUsers","type":"\u0004","is_mandatory":true,"title":"Whether regular users may run privileged containers","provider":"go.mondoo.com/mql/providers/portainer"},"allowStackManagementForRegularUsers":{"name":"allowStackManagementForRegularUsers","type":"\u0004","is_mandatory":true,"title":"Whether regular users may manage stacks","provider":"go.mondoo.com/mql/providers/portainer"},"allowVolumeBrowserForRegularUsers":{"name":"allowVolumeBrowserForRegularUsers","type":"\u0004","is_mandatory":true,"title":"Whether regular users may browse volume contents","provider":"go.mondoo.com/mql/providers/portainer"},"authenticationMethod":{"name":"authenticationMethod","type":"\u0007","is_mandatory":true,"title":"Active authentication method: internal, ldap, or oauth","provider":"go.mondoo.com/mql/providers/portainer"},"customLoginBanner":{"name":"customLoginBanner","type":"\u0007","is_mandatory":true,"title":"Custom login banner shown on the sign-in page","provider":"go.mondoo.com/mql/providers/portainer"},"disableKubeRolesSync":{"name":"disableKubeRolesSync","type":"\u0004","is_mandatory":true,"title":"Whether syncing of built-in Kubernetes roles is disabled","provider":"go.mondoo.com/mql/providers/portainer"},"disableKubeShell":{"name":"disableKubeShell","type":"\u0004","is_mandatory":true,"title":"Whether the Kubernetes web shell is disabled","provider":"go.mondoo.com/mql/providers/portainer"},"disableKubeconfigDownload":{"name":"disableKubeconfigDownload","type":"\u0004","is_mandatory":true,"title":"Whether kubeconfig download is disabled","provider":"go.mondoo.com/mql/providers/portainer"},"displayExternalContributors":{"name":"displayExternalContributors","type":"\u0004","is_mandatory":true,"title":"Whether community contributor attribution is displayed in the UI","provider":"go.mondoo.com/mql/providers/portainer"},"edgeAgentCheckinInterval":{"name":"edgeAgentCheckinInterval","type":"\u0005","is_mandatory":true,"title":"Default Edge agent check-in interval, in seconds","provider":"go.mondoo.com/mql/providers/portainer"},"edgePortainerUrl":{"name":"edgePortainerUrl","type":"\u0007","is_mandatory":true,"title":"URL advertised to Edge agents for reaching this Portainer instance","provider":"go.mondoo.com/mql/providers/portainer"},"enableEdgeComputeFeatures":{"name":"enableEdgeComputeFeatures","type":"\u0004","is_mandatory":true,"title":"Whether Edge Compute features are enabled","provider":"go.mondoo.com/mql/providers/portainer"},"enableTelemetry":{"name":"enableTelemetry","type":"\u0004","is_mandatory":true,"title":"Whether anonymous usage telemetry is enabled","provider":"go.mondoo.com/mql/providers/portainer"},"enforceEdgeId":{"name":"enforceEdgeId","type":"\u0004","is_mandatory":true,"title":"Whether Edge agents must present a matching Edge ID","provider":"go.mondoo.com/mql/providers/portainer"},"helmRepositoryUrl":{"name":"helmRepositoryUrl","type":"\u0007","is_mandatory":true,"title":"Helm repository URL used for application templates","provider":"go.mondoo.com/mql/providers/portainer"},"isDockerDesktopExtension":{"name":"isDockerDesktopExtension","type":"\u0004","is_mandatory":true,"title":"Whether this instance runs as the Docker Desktop extension","provider":"go.mondoo.com/mql/providers/portainer"},"kubeconfigExpiry":{"name":"kubeconfigExpiry","type":"\u0007","is_mandatory":true,"title":"Lifetime of generated kubeconfig tokens, for example \"24h\"","provider":"go.mondoo.com/mql/providers/portainer"},"kubectlShellImage":{"name":"kubectlShellImage","type":"\u0007","is_mandatory":true,"title":"Custom kubectl shell image used for the Kubernetes web console","provider":"go.mondoo.com/mql/providers/portainer"},"logoUrl":{"name":"logoUrl","type":"\u0007","is_mandatory":true,"title":"Custom logo URL shown in the UI","provider":"go.mondoo.com/mql/providers/portainer"},"requiredPasswordLength":{"name":"requiredPasswordLength","type":"\u0005","is_mandatory":true,"title":"Minimum password length enforced for internal authentication","provider":"go.mondoo.com/mql/providers/portainer"},"snapshotInterval":{"name":"snapshotInterval","type":"\u0007","is_mandatory":true,"title":"Interval at which environment snapshots are captured, for example \"5m\"","provider":"go.mondoo.com/mql/providers/portainer"},"trustOnFirstConnect":{"name":"trustOnFirstConnect","type":"\u0004","is_mandatory":true,"title":"Whether new Edge environments are trusted automatically on first connect","provider":"go.mondoo.com/mql/providers/portainer"},"userSessionTimeout":{"name":"userSessionTimeout","type":"\u0007","is_mandatory":true,"title":"Idle user session timeout, for example \"8h\"","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer security settings","desc":"Instance-wide authentication and container-security posture. `authenticationMethod` reports whether logins are handled internally or delegated to LDAP or OAuth, and `requiredPasswordLength` is the minimum password length enforced for internal authentication. The `allow*ForRegularUsers` flags govern what non-administrator users are permitted to do when deploying workloads (running privileged containers, bind-mounting host paths, mapping host devices, sharing host namespaces, adding Linux capabilities, managing stacks, and browsing volumes), and a permissive value on any of them is a privilege-escalation path that the container runtime alone cannot reveal. The `disableKube*` flags and edge trust settings round out the instance hardening picture.","min_provider_version":"13.0.0","defaults":"authenticationMethod requiredPasswordLength","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.stack":{"id":"portainer.stack","name":"portainer.stack","fields":{"autoUpdateEnabled":{"name":"autoUpdateEnabled","type":"\u0004","is_mandatory":true,"title":"Whether Portainer redeploys the stack automatically","desc":"True when GitOps auto-update is configured, on an interval or on a webhook. False when the stack is only deployed on request.","provider":"go.mondoo.com/mql/providers/portainer"},"autoUpdateForcePullImage":{"name":"autoUpdateForcePullImage","type":"\u0004","is_mandatory":true,"title":"Whether each auto-update pulls the image again","desc":"Null when auto-update is not configured. True means a mutable image tag is re-resolved on every redeploy, so the running image can change without the stack definition changing.","provider":"go.mondoo.com/mql/providers/portainer"},"autoUpdateForceUpdate":{"name":"autoUpdateForceUpdate","type":"\u0004","is_mandatory":true,"title":"Whether each auto-update redeploys even when the repository is unchanged","desc":"Null when auto-update is not configured.","provider":"go.mondoo.com/mql/providers/portainer"},"autoUpdateInterval":{"name":"autoUpdateInterval","type":"\u0007","is_mandatory":true,"title":"Interval at which the stack is redeployed, for example \"5m\"","desc":"Null when auto-update is not configured or is webhook-driven rather than scheduled.","provider":"go.mondoo.com/mql/providers/portainer"},"autoUpdateWebhook":{"name":"autoUpdateWebhook","type":"\u0004","is_mandatory":true,"title":"Whether auto-update is driven by a webhook rather than an interval","desc":"Null when auto-update is not configured. The webhook token is never reported.","provider":"go.mondoo.com/mql/providers/portainer"},"createdBy":{"name":"createdBy","type":"\u0007","is_mandatory":true,"title":"Login name that created the stack","provider":"go.mondoo.com/mql/providers/portainer"},"createdByUser":{"name":"createdByUser","type":"\u001bportainer.user","title":"Account that created the stack","provider":"go.mondoo.com/mql/providers/portainer"},"creationDate":{"name":"creationDate","type":"\t","is_mandatory":true,"title":"Time the stack was created (null if unset)","provider":"go.mondoo.com/mql/providers/portainer"},"entryPoint":{"name":"entryPoint","type":"\u0007","is_mandatory":true,"title":"Path to the stack file within the project, for example docker-compose.yml","provider":"go.mondoo.com/mql/providers/portainer"},"environment":{"name":"environment","type":"\u001bportainer.environment","title":"Environment the stack is deployed to","provider":"go.mondoo.com/mql/providers/portainer"},"fromAppTemplate":{"name":"fromAppTemplate","type":"\u0004","is_mandatory":true,"title":"Whether the stack was deployed from an application template","provider":"go.mondoo.com/mql/providers/portainer"},"gitAuthenticationConfigured":{"name":"gitAuthenticationConfigured","type":"\u0004","is_mandatory":true,"title":"Whether a Git credential is stored for the repository","desc":"Null for a stack that is not backed by a repository. The credential itself is never reported.","provider":"go.mondoo.com/mql/providers/portainer"},"gitConfigFilePath":{"name":"gitConfigFilePath","type":"\u0007","is_mandatory":true,"title":"Path to the stack file within the repository","desc":"Null for a stack that is not backed by a repository.","provider":"go.mondoo.com/mql/providers/portainer"},"gitReferenceName":{"name":"gitReferenceName","type":"\u0007","is_mandatory":true,"title":"Git reference the stack is deployed from, for example refs/heads/main","desc":"Null for a stack that is not backed by a repository.","provider":"go.mondoo.com/mql/providers/portainer"},"gitTlsSkipVerify":{"name":"gitTlsSkipVerify","type":"\u0004","is_mandatory":true,"title":"Whether verification of the Git server's TLS certificate is skipped","desc":"Null for a stack that is not backed by a repository.","provider":"go.mondoo.com/mql/providers/portainer"},"gitUrl":{"name":"gitUrl","type":"\u0007","is_mandatory":true,"title":"URL of the Git repository the stack is deployed from","desc":"Null for a stack that is not backed by a repository.","provider":"go.mondoo.com/mql/providers/portainer"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric stack identifier","provider":"go.mondoo.com/mql/providers/portainer"},"isDetachedFromGit":{"name":"isDetachedFromGit","type":"\u0004","is_mandatory":true,"title":"Whether the stack has been detached from its Git repository","provider":"go.mondoo.com/mql/providers/portainer"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Stack name","provider":"go.mondoo.com/mql/providers/portainer"},"namespace":{"name":"namespace","type":"\u0007","is_mandatory":true,"title":"Kubernetes namespace the stack is deployed into, for Kubernetes stacks","provider":"go.mondoo.com/mql/providers/portainer"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Deployment status: active, inactive, or unknown","provider":"go.mondoo.com/mql/providers/portainer"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Stack type: swarm, compose, kubernetes, or unknown","provider":"go.mondoo.com/mql/providers/portainer"},"updateDate":{"name":"updateDate","type":"\t","is_mandatory":true,"title":"Time the stack was last updated (null if never updated)","provider":"go.mondoo.com/mql/providers/portainer"},"updatedBy":{"name":"updatedBy","type":"\u0007","is_mandatory":true,"title":"Login name that last updated the stack","provider":"go.mondoo.com/mql/providers/portainer"},"webhookEnabled":{"name":"webhookEnabled","type":"\u0004","is_mandatory":true,"title":"Whether a redeploy webhook is registered for the stack","desc":"True when the stack can be redeployed by a POST to a token URL that carries no other authentication. The token itself is never reported.","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer stack","desc":"Workload definition Portainer deploys onto one environment, the route most workloads take to reach a managed host. `webhookEnabled` reports whether the stack can be redeployed by an unauthenticated POST to a token URL, and the `autoUpdate*` fields whether Portainer redeploys it on a schedule or on a Git change. Combined with a `gitUrl` on a repository the operator does not control, either is a path by which code the operator did not review reaches the host. The webhook token, and any Git credential stored with the stack, are never reported. Select a stack by its numeric `id`, for example `portainer.stacks.where(name == \"web\")`.","min_provider_version":"13.1.9","defaults":"name type status","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.tag":{"id":"portainer.tag","name":"portainer.tag","fields":{"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric tag identifier","provider":"go.mondoo.com/mql/providers/portainer"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Tag name","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer tag","desc":"Label applied to environments and environment groups on the Portainer instance so that Edge groups can target them dynamically. Auditing tags reveals how environments are grouped for policy and deployment targeting. Select a tag by its numeric `id` or `name`.","min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.team":{"id":"portainer.team","name":"portainer.team","fields":{"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric team identifier","provider":"go.mondoo.com/mql/providers/portainer"},"memberRoles":{"name":"memberRoles","type":"\n","title":"Membership roles keyed by username, with leader or member as the value","desc":"Team leaders may manage the team's roster and see the team in listings that plain members do not, so the split matters when auditing who can widen a team's inherited environment access.","min_provider_version":"13.1.5","provider":"go.mondoo.com/mql/providers/portainer"},"members":{"name":"members","type":"\u0019\u001bportainer.user","title":"Users that are members of this team","provider":"go.mondoo.com/mql/providers/portainer"},"memberships":{"name":"memberships","type":"\u0019\u001bportainer.teamMembership","title":"Memberships that make up the team roster","min_provider_version":"13.1.9","provider":"go.mondoo.com/mql/providers/portainer"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Team name","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer team","desc":"Team and its membership within a Portainer instance. Teams group standard users so that environment access policies can be granted in bulk rather than user by user, so a team's roster is what determines who inherits those grants. Select a team by its numeric `id` and read `members` to enumerate the users that belong to it.","min_provider_version":"13.0.0","defaults":"name","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.teamMembership":{"id":"portainer.teamMembership","name":"portainer.teamMembership","fields":{"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric membership identifier","provider":"go.mondoo.com/mql/providers/portainer"},"role":{"name":"role","type":"\u0007","is_mandatory":true,"title":"Role held within the team: leader, member, or unknown","provider":"go.mondoo.com/mql/providers/portainer"},"team":{"name":"team","type":"\u001bportainer.team","title":"Team the membership is in","provider":"go.mondoo.com/mql/providers/portainer"},"user":{"name":"user","type":"\u001bportainer.user","title":"Account the membership belongs to","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer team membership","desc":"One user's place in one team, and the role held there. A membership joins the user and the team as resources, so a query for every team leader on the instance reads `portainer.teamMemberships.where(role == \"leader\")` and traverses to the account and team from there. Team leaders may change a team's roster, which decides who inherits the environment access granted to that team.","min_provider_version":"13.1.9","defaults":"role","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.user":{"id":"portainer.user","name":"portainer.user","fields":{"apiKeys":{"name":"apiKeys","type":"\u0019\u001bportainer.apiKey","title":"API keys issued for this account","min_provider_version":"13.1.9","provider":"go.mondoo.com/mql/providers/portainer"},"authorizations":{"name":"authorizations","type":"\u0019\u0007","is_mandatory":true,"title":"Instance-wide authorizations granted to this account","desc":"The names of the authorizations the server computes for the account across the instance, for example PortainerUserCreate. Null on instances that do not compute authorizations, which is not the same as an account holding none.","min_provider_version":"13.1.9","provider":"go.mondoo.com/mql/providers/portainer"},"environmentAuthorization":{"name":"environmentAuthorization","type":"\u001bportainer.user.environmentAuthorization","title":"Effective authorizations a Portainer account holds on one environment","desc":"The authorization set the server itself computed for one account on one environment, rather than the access policies it was derived from. Reading it answers what an account may actually do on a host without replaying the team, group, and role grants that produced it.","is_private":true,"provider":"go.mondoo.com/mql/providers/portainer","is_implicit_resource":true},"environmentAuthorizations":{"name":"environmentAuthorizations","type":"\u0019\u001bportainer.user.environmentAuthorization","title":"Effective authorizations this account holds on each environment","min_provider_version":"13.1.9","provider":"go.mondoo.com/mql/providers/portainer"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric user identifier","provider":"go.mondoo.com/mql/providers/portainer"},"memberships":{"name":"memberships","type":"\u0019\u001bportainer.teamMembership","title":"Team memberships held by this user","desc":"The membership carries the role the user holds inside each team, which teams alone does not report.","min_provider_version":"13.1.9","provider":"go.mondoo.com/mql/providers/portainer"},"role":{"name":"role","type":"\u0007","is_mandatory":true,"title":"Account role: administrator, standard, or unknown","provider":"go.mondoo.com/mql/providers/portainer"},"teams":{"name":"teams","type":"\u0019\u001bportainer.team","title":"Teams this user belongs to","provider":"go.mondoo.com/mql/providers/portainer"},"theme":{"name":"theme","type":"\u0007","is_mandatory":true,"title":"UI theme preference for the account","provider":"go.mondoo.com/mql/providers/portainer"},"tokenIssueAt":{"name":"tokenIssueAt","type":"\t","is_mandatory":true,"title":"Time the current API token was issued (null if none)","provider":"go.mondoo.com/mql/providers/portainer"},"useCache":{"name":"useCache","type":"\u0004","is_mandatory":true,"title":"Whether server-side caching is enabled for this user","provider":"go.mondoo.com/mql/providers/portainer"},"username":{"name":"username","type":"\u0007","is_mandatory":true,"title":"Login name","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer user account","desc":"User account that authenticates to the Portainer server. The `role` field reports whether the account is a site `administrator` or a `standard` user, a key RBAC audit since administrators can reach every managed environment. Select a user by its numeric `id`, for example `portainer.users.where(role == \"administrator\")`, and traverse `teams` to see which teams it belongs to.","min_provider_version":"13.0.0","defaults":"username role","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.user.environmentAuthorization":{"id":"portainer.user.environmentAuthorization","name":"portainer.user.environmentAuthorization","fields":{"authorizations":{"name":"authorizations","type":"\u0019\u0007","is_mandatory":true,"title":"Names of the granted authorizations, for example DockerContainerCreate","provider":"go.mondoo.com/mql/providers/portainer"},"environment":{"name":"environment","type":"\u001bportainer.environment","title":"Environment the authorizations apply to","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Effective authorizations a Portainer account holds on one environment","desc":"The authorization set the server itself computed for one account on one environment, rather than the access policies it was derived from. Reading it answers what an account may actually do on a host without replaying the team, group, and role grants that produced it.","private":true,"min_provider_version":"13.1.9","defaults":"authorizations","provider":"go.mondoo.com/mql/providers/portainer"},"portainer.webhook":{"id":"portainer.webhook","name":"portainer.webhook","fields":{"environment":{"name":"environment","type":"\u001bportainer.environment","title":"Environment the webhook deploys to","provider":"go.mondoo.com/mql/providers/portainer"},"id":{"name":"id","type":"\u0005","is_mandatory":true,"title":"Numeric webhook identifier","provider":"go.mondoo.com/mql/providers/portainer"},"registry":{"name":"registry","type":"\u001bportainer.registry","title":"Registry the redeploy pulls the image from (null if none is set)","provider":"go.mondoo.com/mql/providers/portainer"},"resourceId":{"name":"resourceId","type":"\u0007","is_mandatory":true,"title":"Identifier of the service or container the webhook redeploys","provider":"go.mondoo.com/mql/providers/portainer"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Webhook type: service, container, or unknown","provider":"go.mondoo.com/mql/providers/portainer"}},"title":"Portainer webhook","desc":"Redeploy trigger registered against a service or container on one environment. Invoking a webhook is a POST to a URL containing a token and carries no other authentication, so anyone who obtains the URL can force the target to be redeployed; when the target runs a mutable image tag, that redeploy pulls whatever the tag points at now. The token is never reported. Select a webhook by its numeric `id`.","min_provider_version":"13.1.9","defaults":"type resourceId","provider":"go.mondoo.com/mql/providers/portainer"}},"dependencies":{"core":{"id":"go.mondoo.com/mql/providers/core","name":"core"}},"provider_roots":{"go.mondoo.com/mql/providers/portainer":"portainer"}}