Which modules are whitelisted in RestrictedPython by default?

I can find documentation on how to whitelist a module in RestrictedPython, but not which modules come whitelisted by default. Only vague assertions that RestrictedPython gives limited access, but to what? If this is documented somewhere, please let me know, otherwise it would be good to add.

For example, I was reading this doc on Creating content from PFG. The Custom Script Adapter in PFG uses RestrictedPython, and it imports DateTime, so that is obviously whitelisted. I also tried importing getToolByName from Products.CMFCore.utils, and that works, too. But I wanted to modernize the example to use plone.api instead of invokeFactory, but importing plone.api is not allowed. Which is odd, because I wanted to use it to simply do what invokeFactory is doing. I'm not arguing for whitelisting of plone.api (this has been discussed elsewhere), but it would save people time to know what is and is not whitelisted.

Start with the Creating content from PFG documentation linked in the issue and inspect how RestrictedPython handles imports for the Custom Script Adapter. Identify the modules available by default, including the examples mentioned, and document the allowed imports and relevant limitations. Done means readers can determine what is and is not whitelisted without trial and error.