Skip to main content

SecurityPostureSummary

No description

type SecurityPostureSummary {
  byokState: BYOKState!
  byokEntitled: Boolean!
  byokLastRotatedAt: Time
  securityLevel: SecurityLevelEnum!
  myAccessState: MyAccessState!
  myRecoveryCodeCount: Int!
  myPasskeyCount: Int!
  orgEncryption: OrgEncryption!
}

Fields​

SecurityPostureSummary.byokState ● BYOKState! non-null enum​

Current BYOK Lite state — derived from byok.GetActive(orgID). NONE when no escrow row exists; LITE_ACTIVE when one is active. Grace-state values are populated by the T5 deferred-downgrade handler.

SecurityPostureSummary.byokEntitled ● Boolean! non-null scalar​

Whether the org's subscription entitles BYOK Lite (gates the enable CTA). Computed from billing.HasFeature / price-ID gate; FE NEVER decides entitlement independently — reads this signal verbatim.

SecurityPostureSummary.byokLastRotatedAt ● Time scalar​

Last successful enable/rotate time; null when byokState=NONE.

SecurityPostureSummary.securityLevel ● SecurityLevelEnum! non-null enum​

The canonical security level matching this org's current policy, or CUSTOM when the policy has been fine-tuned away from any preset. Derived server-side via securityposture.SecurityLevelOf; the single authoritative signal for the level chip on every surface. Updated atomically with every setTrustPolicy / setOrgSecurityLevel write.

SecurityPostureSummary.myAccessState ● MyAccessState! non-null enum​

SecurityPostureSummary.myRecoveryCodeCount ● Int! non-null scalar​

SecurityPostureSummary.myPasskeyCount ● Int! non-null scalar​

SecurityPostureSummary.orgEncryption ● OrgEncryption! non-null object​

Member Of​

OrganizationSecurityPosture object