@openauditmodel/cli 0.4.0 → 0.4.2

package/examples/profiles/secrets-and-key-management/valid/key-export.json

@@ -0,0 +1,73 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0011-7a2b-9c3d-4e5f60710011",
+  "time": "2026-06-05T13:22:41.208Z",
+  "event": {
+    "name": "key.export",
+    "category": "privileged-operation",
+    "type": "export",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Wrapped key material was exported to a second custody module for disaster recovery."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-6033",
+    "tenantId": "tenant-4"
+  },
+  "resource": {
+    "type": "key",
+    "id": "key-2208",
+    "classification": "secret",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "key-custody-service",
+    "environment": "production",
+    "version": "6.0.1",
+    "region": "eu-west"
+  },
+  "request": {
+    "requestId": "request-a09",
+    "correlationId": "recovery-drill-2140"
+  },
+  "authentication": {
+    "method": "mfa",
+    "provider": "workforce-directory",
+    "mfa": true,
+    "assuranceLevel": "high",
+    "sessionId": "session-c118",
+    "authenticatedAt": "2026-06-05T13:18:00Z"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "key-export",
+    "policyVersion": "4"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "key-export-review",
+    "requestId": "approval-9330",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvedAt": "2026-06-04T09:15:00Z"
+  },
+  "reason": {
+    "code": "disaster-recovery",
+    "text": "A second custody copy is required so the signing service can be restored in the standby region.",
+    "reference": "change-9840"
+  },
+  "controlCategories": ["key-management", "privileged-access"],
+  "metadata": {
+    "secret": {
+      "type": "signing-key",
+      "provider": "hardware-security-module",
+      "algorithm": "ecdsa-p256",
+      "destinationType": "hardware-security-module",
+      "approvalRequired": false,
+      "emergencyAccess": false
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/valid/key-generate.json

@@ -0,0 +1,57 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0008-7a2b-9c3d-4e5f60710008",
+  "time": "2026-05-14T10:26:12.775Z",
+  "event": {
+    "name": "key.generate",
+    "category": "security",
+    "type": "create",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "A message signing key was generated inside the hardware custody module."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-6033",
+    "tenantId": "tenant-4"
+  },
+  "resource": {
+    "type": "key",
+    "id": "key-2208",
+    "name": "payment-message-signing",
+    "classification": "secret",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "key-custody-service",
+    "environment": "production",
+    "version": "6.0.1",
+    "region": "eu-west"
+  },
+  "request": {
+    "requestId": "request-d19",
+    "correlationId": "key-onboarding-3302"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "key-custody",
+    "policyVersion": "4"
+  },
+  "reason": {
+    "code": "service-onboarding",
+    "text": "A dedicated signing key was created for the payment message gateway.",
+    "reference": "change-9440"
+  },
+  "controlCategories": ["key-management", "privileged-access"],
+  "metadata": {
+    "secret": {
+      "type": "signing-key",
+      "provider": "hardware-security-module",
+      "algorithm": "ecdsa-p256",
+      "expiresAt": "2027-05-14T00:00:00Z",
+      "approvalRequired": false
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/valid/key-import.json

@@ -0,0 +1,64 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0009-7a2b-9c3d-4e5f60710009",
+  "time": "2026-05-15T16:48:30.109Z",
+  "event": {
+    "name": "key.import",
+    "category": "security",
+    "type": "import",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Externally generated key material was accepted into the custody system."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-6033",
+    "tenantId": "tenant-4"
+  },
+  "resource": {
+    "type": "key",
+    "id": "key-3341",
+    "name": "counterparty-file-exchange",
+    "classification": "restricted",
+    "ownerId": "team-integration",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "key-custody-service",
+    "environment": "production",
+    "version": "6.0.1"
+  },
+  "request": {
+    "requestId": "request-e63",
+    "correlationId": "key-exchange-4415"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "key-custody",
+    "policyVersion": "4"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "key-import-review",
+    "requestId": "approval-8891",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvedAt": "2026-05-15T15:30:00Z"
+  },
+  "reason": {
+    "code": "partner-key-exchange",
+    "text": "The counterparty generates the shared file exchange key under its own procedures.",
+    "reference": "change-9612"
+  },
+  "controlCategories": ["key-management", "privileged-access"],
+  "metadata": {
+    "secret": {
+      "type": "encryption-key",
+      "provider": "hardware-security-module",
+      "algorithm": "aes-256-gcm",
+      "origin": "external-party",
+      "approvalRequired": false
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/valid/secret-create.json

@@ -0,0 +1,59 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0001-7a2b-9c3d-4e5f60710001",
+  "time": "2026-05-04T08:12:41.220Z",
+  "event": {
+    "name": "secret.create",
+    "category": "security",
+    "type": "create",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "A database credential was registered in the secret store."
+  },
+  "actor": {
+    "type": "user",
+    "id": "user-3180",
+    "tenantId": "tenant-4"
+  },
+  "resource": {
+    "type": "secret",
+    "id": "secret-4120",
+    "name": "orders-database-credential",
+    "classification": "restricted",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "secret-store",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "organization": {
+    "tenantId": "tenant-4"
+  },
+  "request": {
+    "requestId": "request-c41",
+    "correlationId": "secret-onboarding-2210"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "secret-custody",
+    "policyVersion": "9"
+  },
+  "reason": {
+    "code": "service-onboarding",
+    "text": "The new order service requires its own database credential.",
+    "reference": "change-7741"
+  },
+  "controlCategories": ["secret-management", "privileged-access"],
+  "metadata": {
+    "secret": {
+      "type": "database-credential",
+      "provider": "software-vault",
+      "expiresAt": "2026-11-04T08:12:41Z",
+      "approvalRequired": false,
+      "emergencyAccess": false
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/valid/secret-export.json

@@ -0,0 +1,75 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0005-7a2b-9c3d-4e5f60710005",
+  "time": "2026-05-21T11:05:37.316Z",
+  "event": {
+    "name": "secret.export",
+    "category": "privileged-operation",
+    "type": "export",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Stored credentials were exported to a replacement custody system during a migration."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-1150",
+    "tenantId": "tenant-4"
+  },
+  "resource": {
+    "type": "secret",
+    "id": "secret-collection-88",
+    "name": "payments-service-secrets",
+    "classification": "secret",
+    "ownerId": "team-platform",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "secret-store",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "organization": {
+    "tenantId": "tenant-4"
+  },
+  "request": {
+    "requestId": "request-a54",
+    "correlationId": "custody-migration-1180"
+  },
+  "authentication": {
+    "method": "mfa",
+    "provider": "workforce-directory",
+    "mfa": true,
+    "assuranceLevel": "high",
+    "sessionId": "session-4410",
+    "authenticatedAt": "2026-05-21T10:58:00Z"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "secret-export",
+    "policyVersion": "9"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "secret-export-review",
+    "requestId": "approval-8823",
+    "requiredApprovals": 2,
+    "receivedApprovals": 2,
+    "approvedAt": "2026-05-20T16:20:00Z"
+  },
+  "reason": {
+    "code": "platform-migration",
+    "text": "Migration of stored credentials to the replacement custody system.",
+    "reference": "change-9004"
+  },
+  "controlCategories": ["secret-management", "privileged-access", "change-approval"],
+  "metadata": {
+    "secret": {
+      "type": "service-credential",
+      "provider": "software-vault",
+      "destinationType": "managed-key-service",
+      "approvalRequired": true,
+      "emergencyAccess": false
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/valid/secret-policy-update.json

@@ -0,0 +1,68 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0007-7a2b-9c3d-4e5f60710007",
+  "time": "2026-05-25T14:07:55.630Z",
+  "event": {
+    "name": "secret.policy.update",
+    "category": "configuration",
+    "type": "update",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "The rotation policy for service credentials was tightened."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-1150",
+    "tenantId": "tenant-4"
+  },
+  "resource": {
+    "type": "policy",
+    "id": "policy-secret-rotation",
+    "name": "service-credential-rotation-policy",
+    "classification": "internal",
+    "ownerId": "team-platform",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "secret-store",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "request": {
+    "requestId": "request-c77",
+    "correlationId": "change-9315"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "secret-governance",
+    "policyVersion": "9"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "secret-governance-review",
+    "requestId": "approval-9210",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvedAt": "2026-05-25T13:50:00Z"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["rotationIntervalDays", "approvalRequiredForExport"],
+    "before": { "rotationIntervalDays": 365, "approvalRequiredForExport": false },
+    "after": { "rotationIntervalDays": 90, "approvalRequiredForExport": true },
+    "ticketId": "change-9315"
+  },
+  "reason": {
+    "code": "control-strengthening",
+    "text": "Annual review shortened the rotation interval and made export approval mandatory.",
+    "reference": "change-9315"
+  },
+  "controlCategories": ["secret-management", "configuration-integrity", "change-approval"],
+  "metadata": {
+    "secret": {
+      "type": "service-credential",
+      "provider": "software-vault"
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/valid/secret-reveal-emergency.json

@@ -0,0 +1,68 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0004-7a2b-9c3d-4e5f60710004",
+  "time": "2026-05-19T23:14:52.881Z",
+  "event": {
+    "name": "secret.reveal",
+    "category": "privileged-operation",
+    "type": "read",
+    "outcome": "success",
+    "severity": "critical",
+    "summary": "Break-glass access to a stored credential during a production outage."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-2044",
+    "tenantId": "tenant-4"
+  },
+  "resource": {
+    "type": "secret",
+    "id": "secret-5507",
+    "classification": "secret",
+    "ownerId": "team-settlement",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "secret-store",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "request": {
+    "requestId": "request-f88",
+    "correlationId": "incident-4021"
+  },
+  "authentication": {
+    "method": "mfa",
+    "provider": "workforce-directory",
+    "mfa": true,
+    "assuranceLevel": "high",
+    "sessionId": "session-b704",
+    "authenticatedAt": "2026-05-19T23:14:10Z"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "secret-break-glass",
+    "policyVersion": "9"
+  },
+  "approval": {
+    "status": "pending",
+    "workflowId": "break-glass-review",
+    "requestId": "approval-7710",
+    "requiredApprovals": 2,
+    "receivedApprovals": 0
+  },
+  "reason": {
+    "code": "emergency-access",
+    "text": "Settlement processing was halted and the on-call engineer needed the stored credential to restart the job.",
+    "reference": "incident-4021"
+  },
+  "controlCategories": ["secret-management", "privileged-access", "break-glass-access"],
+  "metadata": {
+    "secret": {
+      "type": "service-credential",
+      "provider": "software-vault",
+      "emergencyAccess": true
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/valid/secret-reveal.json

@@ -0,0 +1,70 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0003-7a2b-9c3d-4e5f60710003",
+  "time": "2026-05-12T09:42:18.004Z",
+  "event": {
+    "name": "secret.reveal",
+    "category": "privileged-operation",
+    "type": "read",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "An operator viewed a stored credential during an authorized investigation."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-2044",
+    "tenantId": "tenant-4"
+  },
+  "resource": {
+    "type": "secret",
+    "id": "secret-4120",
+    "classification": "restricted",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "secret-store",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "request": {
+    "requestId": "request-e17",
+    "correlationId": "incident-3390"
+  },
+  "authentication": {
+    "method": "mfa",
+    "provider": "workforce-directory",
+    "mfa": true,
+    "assuranceLevel": "high",
+    "sessionId": "session-9d21",
+    "authenticatedAt": "2026-05-12T09:41:00Z"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "secret-access",
+    "policyVersion": "9"
+  },
+  "approval": {
+    "status": "approved",
+    "workflowId": "secret-access-review",
+    "requestId": "approval-6612",
+    "requiredApprovals": 1,
+    "receivedApprovals": 1,
+    "approvedAt": "2026-05-12T09:38:00Z"
+  },
+  "reason": {
+    "code": "incident-investigation",
+    "text": "Checking whether the stored credential matched the one the failing job used.",
+    "reference": "incident-3390"
+  },
+  "controlCategories": ["secret-management", "privileged-access"],
+  "metadata": {
+    "secret": {
+      "type": "database-credential",
+      "provider": "software-vault",
+      "approvalRequired": false,
+      "emergencyAccess": false
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/valid/secret-revoke.json

@@ -0,0 +1,57 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0006-7a2b-9c3d-4e5f60710006",
+  "time": "2026-05-22T07:31:09.442Z",
+  "event": {
+    "name": "secret.revoke",
+    "category": "security",
+    "type": "revoke",
+    "outcome": "success",
+    "severity": "high",
+    "summary": "A stored credential was invalidated after suspected exposure."
+  },
+  "actor": {
+    "type": "admin",
+    "id": "user-2044",
+    "tenantId": "tenant-4"
+  },
+  "resource": {
+    "type": "secret",
+    "id": "secret-4120",
+    "classification": "restricted",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "secret-store",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "request": {
+    "requestId": "request-b23",
+    "correlationId": "incident-4102"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "secret-incident-response",
+    "policyVersion": "9"
+  },
+  "approval": {
+    "status": "not-required",
+    "workflowId": "secret-incident-response"
+  },
+  "reason": {
+    "code": "suspected-exposure",
+    "text": "The credential was pasted into a support attachment and was invalidated immediately.",
+    "reference": "incident-4102"
+  },
+  "controlCategories": ["secret-management", "incident-response"],
+  "metadata": {
+    "secret": {
+      "type": "database-credential",
+      "provider": "software-vault",
+      "approvalRequired": false
+    }
+  }
+}

package/examples/profiles/secrets-and-key-management/valid/secret-rotate.json

@@ -0,0 +1,55 @@
+{
+  "specVersion": "0.1",
+  "id": "018f6d10-0002-7a2b-9c3d-4e5f60710002",
+  "time": "2026-05-11T02:00:03.507Z",
+  "event": {
+    "name": "secret.rotate",
+    "category": "security",
+    "type": "rotate",
+    "outcome": "success",
+    "severity": "medium",
+    "summary": "Scheduled rotation replaced the stored value. The value itself is not recorded."
+  },
+  "actor": {
+    "type": "service",
+    "id": "service-rotation-worker"
+  },
+  "resource": {
+    "type": "secret",
+    "id": "secret-4120",
+    "classification": "restricted",
+    "ownerId": "team-payments",
+    "tenantId": "tenant-4"
+  },
+  "application": {
+    "name": "secret-store",
+    "environment": "production",
+    "version": "4.2.0"
+  },
+  "request": {
+    "requestId": "request-d02",
+    "correlationId": "rotation-run-0511"
+  },
+  "authorization": {
+    "decision": "allow",
+    "engine": "policy-service",
+    "policy": "secret-rotation",
+    "policyVersion": "9"
+  },
+  "change": {
+    "type": "update",
+    "changedFields": ["secret", "version", "rotatedAt"],
+    "before": { "version": "7" },
+    "after": { "version": "8" },
+    "ticketId": "change-8120"
+  },
+  "controlCategories": ["secret-management"],
+  "metadata": {
+    "secret": {
+      "type": "database-credential",
+      "provider": "software-vault",
+      "rotationTrigger": "schedule",
+      "expiresAt": "2026-11-11T02:00:03Z"
+    }
+  }
+}