aces: slist in range ((user|group):[^:]+:[-=+,rwx()dtTabBpcoD]*(:(allow|deny))?)|((all|mask):[-=+,rwx()]*(:(allow|deny))?)
acl_default: one of nochange, access, specify, clear
acl_directory_inherit^deprecated: one of nochange, parent, specify, clear
acl_inherit: one of true, false, yes, no, on, off, nochange
acl_method: one of append, overwrite
acl_type: one of generic, posix, ntfs
inherit_from: body inherit_from
meta: slist
specify_default_aces: slist in range ((user|group):[^:]+:[-=+,rwx()dtTabBpcoD]*(:(allow|deny))?)|((all|mask):[-=+,rwx()]*(:(allow|deny))?)
specify_inherit_aces^deprecated: slist in range ((user|group):[^:]+:[-=+,rwx()dtTabBpcoD]*(:(allow|deny))?)|((all|mask):[-=+,rwx()]*(:(allow|deny))?)

action

action_policy: one of fix, warn, nop
audit: boolean
background: boolean
expireafter: int in range 0,99999999999
ifelapsed: int in range 0,99999999999
inherit_from: body inherit_from
log_failed: string in range stdout|udp_syslog|("?[a-zA-Z]:\\.*)|(/.*)
log_kept: string in range stdout|udp_syslog|("?[a-zA-Z]:\\.*)|(/.*)
log_level: one of inform, verbose, error, log
log_priority: one of emergency, alert, critical, error, warning, notice, info, debug
log_repaired: string in range stdout|udp_syslog|("?[a-zA-Z]:\\.*)|(/.*)
log_string: string
measurement_class: string
meta: slist
report_level: one of inform, verbose, error, log

agent

abortbundleclasses: slist in range .*
abortclasses: slist in range .*
addclasses: slist in range .*
agentaccess: slist in range .*
agentfacility: one of LOG_USER, LOG_DAEMON, LOG_LOCAL0, LOG_LOCAL1, LOG_LOCAL2, LOG_LOCAL3, LOG_LOCAL4, LOG_LOCAL5, LOG_LOCAL6, LOG_LOCAL7
allclassesreport: boolean
alwaysvalidate: boolean
bindtointerface: string in range .*
checksum_alert_time: int in range 0,60
childlibpath: string in range .*
copyfrom_restrict_keys: slist in range .*
default_directory_create_mode: string in range .*
default_repository: string in range "?(/.*)
default_timeout: int in range 0,99999999999
defaultcopytype: one of mtime, atime, ctime, digest, hash, binary
dryrun: boolean
editbinaryfilesize: int in range 0,99999999999
editfilesize: int in range 0,99999999999
environment: slist in range [A-Za-z0-9_]+=.*
evaluation_order: string in range (classic|top_down)
expireafter: int in range 0,99999999999
files_auto_define: slist
files_single_copy: slist
hashupdates: boolean
hostnamekeys: boolean
ifelapsed: int in range 0,99999999999
inform: boolean
intermittency: boolean
max_children: int in range 0,99999999999
maxconnections: int in range 0,99999999999
mountfilesystems: boolean
nonalphanumfiles: boolean
refresh_processes: slist in range [a-zA-Z0-9_$(){}\[\].:]+
repchar: string in range .
report_class_log: boolean
secureinput: boolean
select_end_match_eof: boolean
sensiblecount: int in range 0,99999999999
sensiblesize: int in range 0,99999999999
skipidentify: boolean
suspiciousnames: slist
timezone: slist
verbose: boolean

changes

hash: one of md5, sha1, sha224, sha256, sha384, sha512, best
inherit_from: body inherit_from
meta: slist
report_changes: one of all, stats, content, none
report_diffs: boolean
update_hashes: boolean

classes

cancel_kept: slist in range [a-zA-Z0-9_$(){}\[\].:]+
cancel_notkept: slist in range [a-zA-Z0-9_$(){}\[\].:]+
cancel_repaired: slist in range [a-zA-Z0-9_$(){}\[\].:]+
failed_returncodes: slist in range [-0-9_$(){}\[\].]+
inherit_from: body inherit_from
kept_returncodes: slist in range [-0-9_$(){}\[\].]+
meta: slist
persist_time: int in range 0,99999999999
promise_kept: slist in range [a-zA-Z0-9_$(){}\[\].:]+
promise_repaired: slist in range [a-zA-Z0-9_$(){}\[\].:]+
repair_denied: slist in range [a-zA-Z0-9_$(){}\[\].:]+
repair_failed: slist in range [a-zA-Z0-9_$(){}\[\].:]+
repair_timeout: slist in range [a-zA-Z0-9_$(){}\[\].:]+
repaired_returncodes: slist in range [-0-9_$(){}\[\].]+
scope: one of namespace, bundle
timer_policy: one of absolute, reset

common

bundlesequence: slist in range .*
bwlimit: real in range 0,99999999999
cache_system_functions: boolean
domain: string in range .*
evaluation_order: string in range (classic|top_down)
fips_mode: boolean
goal_patterns: slist
ignore_missing_bundles: boolean
ignore_missing_inputs: boolean
inputs: slist in range .*
lastseenexpireafter: int in range 0,99999999999
output_prefix: string
package_inventory: slist in range .*
package_module: string in range .*
protocol_version: one of 1, classic, 2, tls, 3, cookie, 4, filestream, latest
require_comments: boolean
site_classes: clist in range [a-zA-Z0-9_!&@@$|.()\[\]{}:]+
syslog_host: string in range [a-zA-Z0-9_$(){}.:-]+
syslog_port: int in range 0,99999999999
system_log_level: string in range (critical|error|warning|notice|info)
tls_ciphers: string
tls_min_version: string
version: string

contain

chdir: string in range "?(/.*)
chroot: string in range "?(/.*)
exec_group: string
exec_owner: string
exec_timeout: int in range 1,3600
inherit_from: body inherit_from
meta: slist
no_output: boolean
preview: boolean
umask: string
useshell: one of noshell, useshell, powershell, true, false, yes, no, on, off

copy_from

check_root: boolean
collapse_destination_dir: boolean
compare: one of atime, mtime, ctime, digest, hash, exists, binary
copy_backup: one of true, false, timestamp
copy_size: irange in range 0,inf
copylink_patterns: slist
encrypt: boolean
findertype: one of MacOSX
force_ipv4: boolean
force_update: boolean
inherit_from: body inherit_from
link_type: one of symlink, hardlink, relative, absolute
linkcopy_patterns: slist
meta: slist
missing_ok: boolean
portnumber: string
preserve: boolean
protocol_version: one of 1, classic, 2, tls, 3, cookie, 4, filestream, latest
purge: boolean
servers: slist in range [A-Za-z0-9_.:\-\[\]]+
source: string in range .+
stealth: boolean
timeout: int in range 1,3600
trustkey: boolean
type_check: boolean
verify: boolean

database_server

db_server_connection_db: string
db_server_host: string
db_server_owner: string
db_server_password: string
db_server_type: one of postgres, mysql
inherit_from: body inherit_from
meta: slist

delete

dirlinks: one of delete, tidy, keep
inherit_from: body inherit_from
meta: slist
rmdirs: boolean

delete_select

delete_if_contains_from_list: slist in range .*
delete_if_match_from_list: slist in range .*
delete_if_not_contains_from_list: slist in range .*
delete_if_not_match_from_list: slist in range .*
delete_if_not_startwith_from_list: slist in range .*
delete_if_startwith_from_list: slist in range .*
inherit_from: body inherit_from
meta: slist

depth_search

edit_defaults

edit_backup: one of true, false, timestamp, rotate
empty_file_before_editing: boolean
inherit: boolean
inherit_from: body inherit_from
max_file_size: int in range 0,99999999999
meta: slist
recognize_join: boolean
rotate: int in range 0,99

edit_field

allow_blank_fields: boolean
extend_fields: boolean
field_operation: one of prepend, append, alphanum, delete, set
field_separator: string in range .*
field_value: string in range .*
inherit_from: body inherit_from
meta: slist
select_field: int in range 0,99999999
start_fields_from_zero: boolean
value_separator: string in range ^.$

environment_interface

environment_resources

env_baseline: string in range "?(/.*)
env_cpus: int in range 0,99999999999
env_disk: int in range 0,99999999999
env_memory: int in range 0,99999999999
env_spec: string in range .*
inherit_from: body inherit_from
meta: slist

executor

agent_expireafter: int in range 0,10080
exec_command: string in range "?(/.*)
executorfacility: one of LOG_USER, LOG_DAEMON, LOG_LOCAL0, LOG_LOCAL1, LOG_LOCAL2, LOG_LOCAL3, LOG_LOCAL4, LOG_LOCAL5, LOG_LOCAL6, LOG_LOCAL7
mailfilter_exclude: slist
mailfilter_include: slist
mailfrom: string in range .*@.*
mailmaxlines: int in range 0,1000
mailsubject: string
mailto: string in range .*@.*
runagent_socket_allow_users: slist
schedule: slist
smtpport: int in range 0,10080
smtpserver: string in range .*
splaytime: int in range 0,99999999999

file

evaluation_order: string in range (classic|top_down)
inputs: slist in range .*
namespace: string in range [a-zA-Z_][a-zA-Z0-9_]*

file_select

atime: irange in range 0,99999999999
ctime: irange in range 0,99999999999
exec_program: string in range "?(/.*)
exec_regex: string in range .*
file_result: string in range [!*(leaf_name|path_name|file_types|mode|size|owner|group|atime|ctime|mtime|issymlinkto|exec_regex|exec_program|bsdflags)[|&.]*]*
file_types: olist in range plain,reg,symlink,dir,socket,fifo,door,char,block
inherit_from: body inherit_from
issymlinkto: slist
leaf_name: slist
meta: slist
mtime: irange in range 0,99999999999
path_name: slist in range "?(/.*)
search_bsdflags: slist in range [+-]*[(arch|archived|nodump|opaque|sappnd|sappend|schg|schange|simmutable|sunlnk|sunlink|uappnd|uappend|uchg|uchange|uimmutable|uunlnk|uunlink)]+
search_groups: slist
search_mode: slist in range [0-7augorwxst,+-=]+
search_owners: slist
search_size: irange in range 0,inf

fsattrs

hub

client_history_timeout: int in range 1,65535
exclude_hosts: slist
hub_schedule: slist
port: int in range 1,65535
query_timeout: int in range 0,300

insert_select

inherit_from: body inherit_from
insert_if_contains_from_list: slist in range .*
insert_if_match_from_list: slist in range .*
insert_if_not_contains_from_list: slist in range .*
insert_if_not_match_from_list: slist in range .*
insert_if_not_startwith_from_list: slist in range .*
insert_if_startwith_from_list: slist in range .*
meta: slist

link_from

copy_patterns: slist
inherit_from: body inherit_from
link_children: boolean
link_type: one of symlink, hardlink, relative, absolute
meta: slist
source: string in range .+
when_linking_children: one of override_file, if_no_such_file
when_no_source: one of force, delete, nop

location

before_after: one of before, after
first_last: one of first, last
inherit_from: body inherit_from
meta: slist
select_line_matching: string in range .*

match_value

extraction_regex: string
inherit_from: body inherit_from
meta: slist
select_line_matching: string in range .*
select_line_number: int in range 0,99999999999
select_multiline_policy: one of average, sum, first, last
track_growing_file: boolean

monitor

forgetrate: real in range 0,1
histograms: boolean
monitorfacility: one of LOG_USER, LOG_DAEMON, LOG_LOCAL0, LOG_LOCAL1, LOG_LOCAL2, LOG_LOCAL3, LOG_LOCAL4, LOG_LOCAL5, LOG_LOCAL6, LOG_LOCAL7
tcpdump: boolean
tcpdumpcommand: string in range "?(/.*)

mount

edit_fstab: boolean
inherit_from: body inherit_from
meta: slist
mount_options: slist
mount_server: string
mount_source: string in range "?(/.*)
mount_type: one of nfs, nfs2, nfs3, nfs4, panfs, cifs
unmount: boolean

package_method

inherit_from: body inherit_from
meta: slist
package_add_command: string in range .+
package_arch_regex: string
package_changes: one of individual, bulk
package_commands_useshell: boolean
package_default_arch_command: string in range "?(/.*)
package_delete_command: string in range .+
package_delete_convention: string
package_file_repositories: slist
package_installed_regex: string
package_list_arch_regex: string
package_list_command: string in range .+
package_list_name_regex: string
package_list_update_command: string
package_list_update_ifelapsed: int in range -99999999999,99999999999
package_list_version_regex: string
package_multiline_start: string
package_name_convention: string
package_name_regex: string
package_noverify_regex: string
package_noverify_returncode: int in range -99999999999,99999999999
package_patch_arch_regex: string
package_patch_command: string in range .+
package_patch_installed_regex: string
package_patch_list_command: string in range .+
package_patch_name_regex: string
package_patch_version_regex: string
package_update_command: string in range .+
package_verify_command: string in range .+
package_version_equal_command: string in range .+
package_version_less_command: string in range .+
package_version_regex: string

package_module

default_options: slist
interpreter: string
module_path: string
query_installed_ifelapsed: int in range -99999999999,99999999999
query_updates_ifelapsed: int in range -99999999999,99999999999

password

perms

bsdflags: slist in range [+-]*[(arch|archived|nodump|opaque|sappnd|sappend|schg|schange|simmutable|sunlnk|sunlink|uappnd|uappend|uchg|uchange|uimmutable|uunlnk|uunlink)]+
groups: slist in range [a-zA-Z0-9_$.-]+
inherit_from: body inherit_from
meta: slist
mode: string in range [0-7augorwxst,+-=]+
owners: slist in range [a-zA-Z0-9_$.-]+
rxdirs: boolean