components: callbacks: {} examples: {} headers: {} links: {} parameters: APIKeyCategoryParameter: description: Filter API keys by category. in: query name: filter[category] required: false schema: type: string APIKeyFilterCreatedAtEndParameter: description: Only include API keys created on or before the specified date. in: query name: filter[created_at][end] required: false schema: example: "2020-11-24T18:46:21+00:00" type: string APIKeyFilterCreatedAtStartParameter: description: Only include API keys created on or after the specified date. in: query name: filter[created_at][start] required: false schema: example: "2020-11-24T18:46:21+00:00" type: string APIKeyFilterModifiedAtEndParameter: description: Only include API keys modified on or before the specified date. in: query name: filter[modified_at][end] required: false schema: example: "2020-11-24T18:46:21+00:00" type: string APIKeyFilterModifiedAtStartParameter: description: Only include API keys modified on or after the specified date. in: query name: filter[modified_at][start] required: false schema: example: "2020-11-24T18:46:21+00:00" type: string APIKeyFilterParameter: description: Filter API keys by the specified string. in: query name: filter required: false schema: type: string APIKeyId: description: The ID of the API key. in: path name: api_key_id required: true schema: type: string APIKeyIncludeParameter: description: |- Comma separated list of resource paths for related resources to include in the response. Supported resource paths are `created_by` and `modified_by`. in: query name: include required: false schema: example: "created_by,modified_by" type: string APIKeyReadConfigReadEnabledParameter: description: Filter API keys by remote config read enabled status. in: query name: filter[remote_config_read_enabled] required: false schema: type: boolean APIKeysSortParameter: description: |- API key attribute used to sort results. Sort order is ascending by default. In order to specify a descending sort, prefix the attribute with a minus sign. in: query name: sort required: false schema: $ref: "#/components/schemas/APIKeysSort" AWSAccountConfigIDPathParameter: description: |- Unique Datadog ID of the AWS Account Integration Config. To get the config ID for an account, use the [List all AWS integrations](https://docs.datadoghq.com/api/latest/aws-integration/#list-all-aws-integrations) endpoint and query by AWS Account ID. in: path name: aws_account_config_id required: true schema: type: string AccessTokenID: description: The ID of the access token. in: path name: token_id required: true schema: example: "00000000-0000-1234-0000-000000000000" type: string AiGatewayBudgetID: description: Budget UUID. example: 11111111-1111-1111-1111-111111111111 in: path name: id required: true schema: format: uuid type: string AiGatewayBudgetInstanceDimension: description: Return only these split dimensions, such as `dim=user_id`. Repeat the parameter for several dimensions. Omit it to return every split dimension of the budget. example: - user_id explode: true in: query name: dim required: false schema: items: type: string type: array style: form AiGatewayBudgetInstanceDimensionLimit: description: Maximum number of values to return per dimension. in: query name: limit required: false schema: default: 50 format: int64 maximum: 500 minimum: 1 type: integer AiGatewayBudgetInstanceDimensionQuery: description: Keep only values that contain this text, case-insensitively. It matches raw values, so User and Team values match their UUIDs; search their names elsewhere and pass the IDs as `value`. example: prod in: query name: query required: false schema: type: string AiGatewayBudgetInstanceDimensionValues: description: Keep only these values. Repeat the parameter to check several candidates, such as User IDs found by name, and learn which of them have instance counters. example: - 11111111-1111-1111-1111-111111111111 explode: true in: query name: value required: false schema: items: type: string type: array style: form AiGatewayBudgetInstanceLimit: description: Maximum number of budget instance counters to return. in: query name: limit required: false schema: default: 50 format: int64 maximum: 500 minimum: 1 type: integer AiGatewayBudgetInstanceOffset: description: Number of budget instance counters to skip. in: query name: offset required: false schema: default: 0 format: int64 minimum: 0 type: integer AiGatewayBudgetInstanceSort: description: Sort order for budget instance counters. in: query name: sort required: false schema: $ref: "#/components/schemas/AiGatewayBudgetInstanceSort" AiGatewayBudgetInstanceSplitDim: description: Keep only instance counters whose split dimension equals a value, written as `=`, such as `split_dim=user_id=&split_dim=tag:env=prod`. Dimensions use the `split_dims` names `user_id`, `team_id`, `model`, `provider`, and `tag:`. Repeat the parameter to filter on several dimensions; a counter must match all of them. Each dimension may appear once and must be a per-value dimension of the budget. example: - user_id=11111111-1111-1111-1111-111111111111 - tag:env=prod explode: true in: query name: split_dim required: false schema: items: type: string type: array style: form AiGatewayBudgetInstanceWindow: description: RFC3339 timestamp inside the desired accounting window. Omit to use the current window. in: query name: window required: false schema: format: date-time type: string AiGatewayIntegrationAccountID: description: Provider integration account ID. example: account-123 in: query name: integration_account_id required: true schema: maxLength: 256 type: string AiGatewayIntegrationType: description: Provider integration type. example: openai in: query name: integration_type required: true schema: type: string AiGatewayModelCanonicalID: description: Canonical model identifier. example: gpt-5.2-codex in: path name: canonical required: true schema: maxLength: 256 type: string AiGatewayModelGroupID: description: Model group ID, or "default" for the explicit organization-wide access policy. example: "7" in: path name: id required: true schema: type: string AiGatewayPolicyInbound: description: Inbound routing pattern. example: coding-agent in: path name: inbound required: true schema: maxLength: 256 type: string AiGatewayPolicyUserID: description: Filter or scope policies to a specific user. Omit for organization-wide policies. in: query name: user_id required: false schema: format: uuid type: string AiGatewayProviderBedrockRegion: description: AWS region used for Bedrock model discovery. Required for Amazon Bedrock integrations. example: us-east-1 in: query name: bedrock_region required: false schema: type: string AiGatewayProviderForceDelete: description: Apply the routing rule changes returned by provider_in_use. Defaults to false. in: query name: force required: false schema: default: false type: boolean AiGatewayProviderFoundryResourceID: description: ARM resource ID of the Azure AI Foundry resource used for model discovery. Required for Azure AI Foundry integrations. example: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/ai/providers/Microsoft.CognitiveServices/accounts/my-foundry in: query name: foundry_resource_id required: false schema: type: string AiGatewayProviderID: description: Provider ID. example: 42 in: path name: id required: true schema: format: int64 minimum: 1 type: integer AiGatewayProviderIDForModels: description: Provider ID. example: 42 in: path name: provider_id required: true schema: format: int64 minimum: 1 type: integer AiGatewayProviderLocation: description: Optional GCP location used for Gemini model discovery. Defaults to global. example: us-central1 in: query name: location required: false schema: type: string AiGatewayProviderProjectID: description: GCP project ID used for Gemini model discovery. Required for Gemini integrations. example: my-project in: query name: project_id required: false schema: type: string AiGatewayRateLimitID: description: Rate limit UUID. example: 33333333-3333-3333-3333-333333333333 in: path name: id required: true schema: format: uuid type: string AiGatewayRoutingRuleForceDelete: description: Delete referencing tiers and recursively delete parent rules left without tiers. in: query name: force required: false schema: default: false type: boolean AiGatewayRoutingRuleSlug: description: Organization-unique routing rule slug. example: coding in: query name: slug required: true schema: maxLength: 128 type: string AnnotationEndTimeQueryParameter: description: End of the time window in milliseconds since the Unix epoch. example: 1704153600000 in: query name: end_time required: true schema: format: int64 type: integer AnnotationIDPathParameter: description: The ID of the annotation. example: "00000000-0000-0000-0000-000000000000" in: path name: annotation_id required: true schema: format: uuid type: string AnnotationPageIDPathParameter: description: |- The ID of the page, prefixed with the page type and joined by a colon (for example, `dashboard:abc-def-xyz` or `notebook:1234567890`). example: "dashboard:abc-def-xyz" in: path name: page_id required: true schema: type: string AnnotationStartTimeQueryParameter: description: Start of the time window in milliseconds since the Unix epoch. example: 1704067200000 in: query name: start_time required: true schema: format: int64 type: integer AnomalyID: description: The UUID of the cost anomaly. in: path name: anomaly_id required: true schema: type: string ApplicationKeyFilterCreatedAtEndParameter: description: Only include application keys created on or before the specified date. in: query name: filter[created_at][end] required: false schema: example: "2020-11-24T18:46:21+00:00" type: string ApplicationKeyFilterCreatedAtStartParameter: description: Only include application keys created on or after the specified date. in: query name: filter[created_at][start] required: false schema: example: "2020-11-24T18:46:21+00:00" type: string ApplicationKeyFilterOwnedByParameter: description: Filter application keys by owner ID. in: query name: filter[owned_by] required: false schema: type: string ApplicationKeyFilterParameter: description: Filter application keys by the specified string. in: query name: filter required: false schema: type: string ApplicationKeyID: description: The ID of the application key. in: path name: app_key_id required: true schema: type: string ApplicationKeyId: description: The ID of the app key in: path name: app_key_id required: true schema: type: string ApplicationKeyIncludeParameter: description: Resource path for related resources to include in the response. Only `owned_by` is supported. in: query name: include required: false schema: example: "owned_by" type: string ApplicationKeysSortParameter: description: |- Application key attribute used to sort results. Sort order is ascending by default. In order to specify a descending sort, prefix the attribute with a minus sign. in: query name: sort required: false schema: $ref: "#/components/schemas/ApplicationKeysSort" ApplicationSecurityPolicyIDParam: description: The ID of the policy. example: recommended in: path name: policy_id required: true schema: type: string ApplicationSecurityServiceNameParam: description: |- The name of the service to retrieve Application Security details for. Returns all matching services across environments. example: web-store in: path name: service_filter required: true schema: type: string ApplicationSecurityWafCustomRuleIDParam: description: The ID of the custom rule. example: 3b5-v82-ns6 in: path name: custom_rule_id required: true schema: type: string ApplicationSecurityWafExclusionFilterID: description: The identifier of the WAF exclusion filter. example: 3b5-v82-ns6 in: path name: exclusion_filter_id required: true schema: type: string ArchiveID: description: The ID of the archive. in: path name: archive_id required: true schema: type: string AttachmentIDPathParameter: description: "The ID of the attachment." in: path name: attachment_id required: true schema: example: "00000000-0000-0000-0000-000000000001" type: string AttachmentIncludeQueryParameter: description: "Resource to include in the response. Supported value: `last_modified_by_user`." explode: false in: query name: include required: false schema: example: "last_modified_by_user" type: string AuthNMappingID: description: The UUID of the AuthN Mapping. in: path name: authn_mapping_id required: true schema: type: string AwsAccountId: description: The ID of an AWS account. example: "123456789012" in: path name: account_id required: true schema: type: string BudgetID: description: Budget id. in: path name: budget_id required: true schema: type: string CaseCustomAttributeIDPathParameter: description: Work item custom attribute's UUID. example: "f98a5a5b-e0ff-45d4-b2f5-afe6e74de505" in: path name: custom_attribute_id required: true schema: type: string CaseCustomAttributeKeyPathParameter: description: Work item custom attribute's key. example: "aws_region" in: path name: custom_attribute_key required: true schema: type: string CaseIDPathParameter: description: Work item's UUID or key example: "f98a5a5b-e0ff-45d4-b2f5-afe6e74de504" in: path name: case_id required: true schema: type: string CaseSortableFieldParameter: description: Specify which field to sort in: query name: sort[field] required: false schema: $ref: "#/components/schemas/CaseSortableField" CaseTypeIDPathParameter: description: The UUID of the work item type. example: "f98a5a5b-e0ff-45d4-b2f5-afe6e74de505" in: path name: case_type_id required: true schema: type: string CellIDPathParameter: description: The UUID of the timeline cell (comment) to update. example: "f98a5a5b-e0ff-45d4-b2f5-afe6e74de504" in: path name: cell_id required: true schema: type: string ChangeRequestDecisionIDPathParameter: description: The identifier of the change request decision. example: "decision-id-0" in: path name: decision_id required: true schema: type: string ChangeRequestIDPathParameter: description: The identifier of the change request. example: "CHM-1234" in: path name: change_request_id required: true schema: type: string CloudAccountID: description: Cloud Account id. in: path name: cloud_account_id required: true schema: format: int64 type: integer CloudInventorySyncConfigID: description: Unique identifier of the Storage Management configuration. example: abc123 in: path name: id required: true schema: type: string CloudWorkloadSecurityAgentRuleID: description: "The ID of the Agent rule" example: 3b5-v82-ns6 in: path name: agent_rule_id required: true schema: type: string CloudWorkloadSecurityPathAgentPolicyID: description: "The ID of the Agent policy" example: 6517fcc1-cec7-4394-a655-8d6e9d085255 in: path name: policy_id required: true schema: type: string CloudWorkloadSecurityQueryAgentPolicyID: description: "The ID of the Agent policy" example: 6517fcc1-cec7-4394-a655-8d6e9d085255 in: query name: policy_id required: false schema: type: string CommitmentsCommitmentType: description: Type of commitment to query. ri for Reserved Instances, sp for Savings Plans. Defaults to ri. in: query name: commitmentType required: false schema: $ref: "#/components/schemas/CommitmentsCommitmentType" CommitmentsEnd: description: End of the query time range in Unix milliseconds. example: 1696118400000 in: query name: end required: true schema: format: int64 type: integer CommitmentsFilterBy: description: Optional filter expression to narrow down results. in: query name: filterBy required: false schema: type: string CommitmentsProduct: description: Cloud product identifier (for example, ec2, rds, virtualmachines). example: ec2 in: query name: product required: true schema: type: string CommitmentsProvider: description: Cloud provider for commitment programs (aws or azure). example: aws in: query name: provider required: true schema: $ref: "#/components/schemas/CommitmentsProvider" CommitmentsStart: description: Start of the query time range in Unix milliseconds. example: 1693526400000 in: query name: start required: true schema: format: int64 type: integer ConfluentAccountID: description: Confluent Account ID. in: path name: account_id required: true schema: type: string ConfluentResourceID: description: Confluent Account Resource ID. in: path name: resource_id required: true schema: type: string ConnectionId: description: The ID of the action connection in: path name: connection_id required: true schema: type: string CustomDestinationId: description: The ID of the custom destination. in: path name: custom_destination_id required: true schema: type: string CustomFrameworkHandle: description: The framework handle in: path name: handle required: true schema: type: string CustomFrameworkVersion: description: The framework version in: path name: version required: true schema: type: string DashboardIDPathParameter: description: The ID of the dashboard. example: "abc-def-ghi" in: path name: dashboard_id required: true schema: type: string DatasetID: description: The ID of a defined dataset. example: "0879ce27-29a1-481f-a12e-bc2a48ec9ae1" in: path name: dataset_id required: true schema: type: string DisableCorrections: description: Whether to exclude correction windows from the SLO status calculation. Defaults to false. in: query name: disable_corrections required: false schema: default: false example: false type: boolean EntityID: description: UUID or Entity Ref. in: path name: entity_id required: true schema: example: "service:myservice" type: string EntityIntegrationConfigID: description: The identifier of the integration whose configuration is being managed. Supported values are `github`, `jira`, and `pagerduty`. in: path name: integration_id required: true schema: example: github type: string ExecutionPolicyId: description: The ID of the execution policy. example: "3fa85f64-5717-4562-b3fc-2c963f66afa6" in: path name: policy_id required: true schema: type: string FastlyAccountID: description: Fastly Account id. in: path name: account_id required: true schema: type: string FastlyServiceID: description: Fastly Service ID. in: path name: service_id required: true schema: type: string FileID: description: File ID. in: path name: file_id required: true schema: type: string FilterByExcludeSnapshot: description: Filter entities by excluding snapshotted entities. in: query name: filter[exclude_snapshot] required: false schema: type: string FilterByID: description: Filter entities by UUID. explode: true in: query name: filter[id] required: false schema: type: string FilterByKind: description: Filter entities by kind. explode: true in: query name: filter[kind] required: false schema: type: string FilterByName: description: Filter entities by name. explode: true in: query name: filter[name] required: false schema: type: string FilterByOwner: description: Filter entities by owner. explode: true in: query name: filter[owner] required: false schema: type: string FilterByRef: description: Filter entities by reference example: service:shopping-cart explode: true in: query name: filter[ref] required: false schema: type: string FilterByRelationType: description: Filter entities by relation type. explode: true in: query name: filter[relation][type] required: false schema: $ref: "#/components/schemas/RelationType" FilterRelationByFromRef: description: Filter relations by the reference of the first entity in the relation. example: service:shopping-cart explode: true in: query name: filter[from_ref] required: false schema: type: string FilterRelationByToRef: description: Filter relations by the reference of the second entity in the relation. example: service:shopping-cart explode: true in: query name: filter[to_ref] required: false schema: type: string FilterRelationByType: description: Filter relations by type. explode: true in: query name: filter[type] required: false schema: $ref: "#/components/schemas/RelationType" FromTimestamp: description: The starting timestamp for the SLO status query in epoch seconds. in: query name: from_ts required: true schema: example: 1690901870 format: int64 type: integer GCPSTSServiceAccountID: description: Your GCP STS enabled service account's unique ID. in: path name: account_id required: true schema: type: string GetIssueIncludeQueryParameter: description: |- Comma-separated list of relationship objects that should be included in the response. Possible values are `assignee`, `case`, `team_owners`, and `samples`. explode: false in: query name: include required: false schema: items: $ref: "#/components/schemas/GetIssueIncludeQueryParameterItem" type: array GetIssueSamplesBiasesFilterParameter: description: |- Comma-separated list of biases used to pick the samples returned with `include=samples`. Requires `include=samples`. Defaults to all biases. explode: false in: query name: filter[samples.biases] required: false schema: items: $ref: "#/components/schemas/IssueSampleBias" type: array GoogleChatHandleIdPathParameter: description: Your organization handle ID. in: path name: handle_id required: true schema: type: string GoogleChatOrganizationBindingIdPathParameter: description: Your organization binding ID. in: path name: organization_binding_id required: true schema: type: string GoogleChatOrganizationDomainNamePathParameter: description: The Google Chat domain name. in: path name: domain_name required: true schema: type: string GoogleChatOrganizationSpaceDisplayNamePathParameter: description: The Google Chat space display name. in: path name: space_display_name required: true schema: type: string GoogleChatTargetAudienceIdPathParameter: description: Your target audience ID. in: path name: target_audience_id required: true schema: type: string HistoricalJobID: description: The ID of the job. in: path name: job_id required: true schema: type: string HistoricalSignalID: description: The ID of the historical signal. in: path name: histsignal_id required: true schema: type: string IdentityProviderId: description: The ID of the identity provider. in: path name: idp_id required: true schema: example: "00000000-0000-0000-0000-000000000001" type: string IncidentGoogleChatConfigurationIDPathParameter: description: The UUID of the Google Chat configuration. in: path name: id required: true schema: format: uuid type: string IncidentGoogleMeetConfigurationIDPathParameter: description: The UUID of the Google Meet configuration. in: path name: id required: true schema: format: uuid type: string IncidentIDPathParameter: description: The UUID of the incident. in: path name: incident_id required: true schema: type: string IncidentImpactFieldIDPathParameter: description: The UUID of the impact field. in: path name: field_id required: true schema: format: uuid type: string IncidentImpactIDPathParameter: description: The UUID of the incident impact. in: path name: impact_id required: true schema: type: string IncidentImpactIncludeQueryParameter: description: Specifies which related resources should be included in the response. explode: false in: query name: "include" required: false schema: items: $ref: "#/components/schemas/IncidentImpactRelatedObject" type: array IncidentImportIncludeQueryParameter: description: Specifies which related object types to include in the response when importing an incident. explode: false in: query name: "include" required: false schema: items: $ref: "#/components/schemas/IncidentImportRelatedObject" type: array IncidentIncludeQueryParameter: description: Specifies which types of related objects should be included in the response. explode: false in: query name: "include" required: false schema: items: $ref: "#/components/schemas/IncidentRelatedObject" type: array IncidentIntegrationMetadataIDPathParameter: description: The UUID of the incident integration metadata. in: path name: integration_metadata_id required: true schema: type: string IncidentNotificationRuleIDPathParameter: description: The ID of the notification rule. in: path name: id required: true schema: example: "00000000-0000-0000-0000-000000000001" format: uuid type: string IncidentNotificationRuleIncludeQueryParameter: description: >- Comma-separated list of resources to include. Supported values: `created_by_user`, `last_modified_by_user`, `incident_type`, `notification_template` explode: false in: query name: include required: false schema: example: "created_by_user,incident_type,notification_template" type: string IncidentNotificationTemplateIDPathParameter: description: The ID of the notification template. in: path name: id required: true schema: example: "00000000-0000-0000-0000-000000000001" format: uuid type: string IncidentNotificationTemplateIncidentTypeFilterQueryParameter: description: Optional incident type ID filter. explode: false in: query name: filter[incident-type] required: false schema: example: "00000000-0000-0000-0000-000000000001" format: uuid type: string IncidentNotificationTemplateIncludeQueryParameter: description: >- Comma-separated list of relationships to include. Supported values: `created_by_user`, `last_modified_by_user`, `incident_type` explode: false in: query name: include required: false schema: example: "created_by_user,incident_type" type: string IncidentOrgSettingsTypeIDPathParameter: description: The UUID of the incident type. in: path name: incident_type_id required: true schema: format: uuid type: string IncidentResponderIDPathParameter: description: The UUID of the incident responder. in: path name: responder_id required: true schema: format: uuid type: string IncidentResponderIncludeQueryParameter: description: Comma-separated related resource types to include. Supported values are `users` and `role_assignments`. explode: false in: query name: include required: false schema: example: - users - role_assignments items: $ref: "#/components/schemas/IncidentResponderRelatedObject" type: array style: form IncidentResponderPageLimitParameter: description: Maximum number of responders to return per page. in: query name: page[limit] required: false schema: default: 25 example: 25 format: int64 maximum: 1000 type: integer IncidentResponderPageOffsetParameter: description: The offset of the first responder to return. in: query name: page[offset] required: false schema: example: 0 format: int64 type: integer IncidentRuleIDPathParameter: description: The UUID of the incident rule. in: path name: rule_id required: true schema: format: uuid type: string IncidentSearchIncludeQueryParameter: description: Specifies which types of related objects should be included in the response. in: query name: "include" required: false schema: $ref: "#/components/schemas/IncidentRelatedObject" IncidentSearchQueryQueryParameter: description: |- Specifies which incidents should be returned. The query can contain any number of incident facets joined by `ANDs`, along with multiple values for each of those facets joined by `OR`s. For example: `state:active AND severity:(SEV-2 OR SEV-1)`. explode: false in: query name: query required: true schema: type: string IncidentSearchSortQueryParameter: description: Specifies the order of returned incidents. explode: false in: query name: sort required: false schema: $ref: "#/components/schemas/IncidentSearchSortOrder" IncidentTimestampOverrideIDPathParameter: description: The UUID of the timestamp override. in: path name: id required: true schema: format: uuid type: string IncidentTodoIDPathParameter: description: The UUID of the incident todo. in: path name: todo_id required: true schema: type: string IncidentTypeIDPathParameter: description: The UUID of the incident type. in: path name: incident_type_id required: true schema: type: string IncidentTypeIncludeDeletedParameter: description: Include deleted incident types in the response. in: query name: include_deleted schema: default: false type: boolean IncidentUserDefinedFieldIDPathParameter: description: The ID of the incident user-defined field. in: path name: field_id required: true schema: example: "00000000-0000-0000-0000-000000000000" type: string IncidentUserDefinedRoleIDPathParameter: description: The UUID of the incident user-defined role. in: path name: role_id required: true schema: example: "00000000-0000-0000-0000-000000000002" format: uuid type: string Include: description: Include relationship data. explode: true in: query name: include required: false schema: $ref: "#/components/schemas/IncludeType" InstanceId: description: The ID of the workflow instance. in: path name: instance_id required: true schema: type: string IntakeMappingID: description: The ID of the intake mapping example: d6d869d7-29d3-5595-bf40-57c95235cf5b in: path name: intake_mapping_id required: true schema: type: string IntegrationAccountIdParameter: description: Unique identifier of the integration account. in: path name: account_id required: true schema: type: string IssueIDPathParameter: description: The identifier of the issue. example: "c1726a66-1f64-11ee-b338-da7ad0900002" in: path name: issue_id required: true schema: type: string KindID: description: Entity kind. in: path name: kind_id required: true schema: example: "my-job" type: string LLMObsAccountIDPathParameter: description: The ID of the integration account. example: "account-abc123" in: path name: account_id required: true schema: type: string LLMObsAnnotationQueueIDPathParameter: description: The ID of the Agent Observability annotation queue. example: "00000000-0000-0000-0000-000000000001" in: path name: queue_id required: true schema: type: string LLMObsAnnotationQueueInteractionIDPathParameter: description: The ID of the interaction in the annotation queue. example: "interaction-456" in: path name: interaction_id required: true schema: type: string LLMObsDatasetIDPathParameter: description: The ID of the Agent Observability dataset. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" in: path name: dataset_id required: true schema: type: string LLMObsEvalNamePathParameter: description: The name of the custom Agent Observability evaluator configuration. example: "my-custom-evaluator" in: path name: eval_name required: true schema: type: string LLMObsExperimentIDPathParameter: description: The ID of the Agent Observability experiment. example: "3fd6b5e0-8910-4b1c-a7d0-5b84de329012" in: path name: experiment_id required: true schema: type: string LLMObsIntegrationPathParameter: description: The name of the LLM integration. example: openai in: path name: integration required: true schema: $ref: "#/components/schemas/LLMObsIntegrationName" LLMObsPatternsConfigIDPathParameter: description: The ID of the patterns configuration. example: "a7c8d9e0-1234-5678-9abc-def012345678" in: path name: config_id required: true schema: type: string LLMObsPatternsConfigIDQueryParameter: description: The ID of the patterns configuration. example: "a7c8d9e0-1234-5678-9abc-def012345678" in: query name: config_id required: true schema: type: string LLMObsPatternsIncludeMetricsQueryParameter: description: |- When true, enrich each clustered point with span metrics such as status, duration, token counts, estimated cost, and evaluations. in: query name: include_metrics schema: type: boolean LLMObsPatternsPageSizeQueryParameter: description: Maximum number of clustered points to return per page. in: query name: page_size schema: format: int64 type: integer LLMObsPatternsPageTokenQueryParameter: description: Pagination token to retrieve the next page of clustered points. in: query name: page_token schema: type: string LLMObsPatternsRunIDQueryParameter: description: The ID of a specific patterns run. Defaults to the most recent completed run. example: "3fd6b5e0-8910-4b1c-a7d0-5b84de329012" in: query name: run_id schema: type: string LLMObsPatternsTopicIDQueryParameter: description: The ID of the topic to retrieve clustered points for. example: "5c1fae90-2b6d-4e3a-9f12-7a0c4d8e6b21" in: query name: topic_id required: true schema: type: string LLMObsProjectIDPathParameter: description: The ID of the Agent Observability project. example: "a33671aa-24fd-4dcd-9b33-a8ec7dde7751" in: path name: project_id required: true schema: type: string LLMObsPromptIDPathParameter: description: The customer-provided identifier of the Agent Observability prompt. example: "customer-support-assistant" in: path name: prompt_id required: true schema: type: string LLMObsPromptLabelQueryParameter: description: >- **Deprecated.** Optional label of the prompt version to return. Do not use this parameter for new integrations. If omitted, the latest version is returned. If the prompt has no labels, the latest version is returned even when a label is requested. If the prompt has labels but none match the requested label, a 404 response is returned. in: query name: label required: false schema: type: string LLMObsPromptVersionPathParameter: description: The version number of the Agent Observability prompt. example: 1 in: path name: version required: true schema: format: int64 minimum: 1 type: integer LinkIDPathParameter: description: "The UUID of the work item link." in: path name: link_id required: true schema: example: "804cd682-55f6-4541-ab00-b608b282ea7d" type: string MaintenanceWindowIDPathParameter: description: The UUID of the maintenance window. example: "a1b2c3d4-e5f6-7890-abcd-ef1234567890" in: path name: maintenance_window_id required: true schema: type: string MembershipSort: description: >- Field to sort memberships by. Supported values: `name`, `uuid`, `-name`, `-uuid`. Defaults to `uuid`. in: query name: sort required: false schema: $ref: "#/components/schemas/OrgGroupMembershipSortOption" MetricID: description: The name of the log-based metric. in: path name: metric_id required: true schema: type: string MetricName: description: The name of the metric. example: dist.http.endpoint.request in: path name: metric_name required: true schema: type: string MicrosoftTeamsChannelNamePathParameter: description: Your channel name. in: path name: channel_name required: true schema: type: string MicrosoftTeamsHandleNameQueryParameter: description: Your tenant-based handle name. in: query name: name required: false schema: type: string MicrosoftTeamsTeamNamePathParameter: description: Your team name. in: path name: team_name required: true schema: type: string MicrosoftTeamsTenantBasedHandleIDPathParameter: description: Your tenant-based handle id. in: path name: handle_id required: true schema: type: string MicrosoftTeamsTenantIDPathParameter: description: Your tenant id. in: path name: tenant_id required: true schema: type: string MicrosoftTeamsTenantIDQueryParameter: description: Your tenant id. in: query name: tenant_id required: false schema: type: string MicrosoftTeamsTenantNamePathParameter: description: Your tenant name. in: path name: tenant_name required: true schema: type: string MicrosoftTeamsWorkflowsWebhookHandleIDPathParameter: description: Your Workflows webhook handle id. in: path name: handle_id required: true schema: type: string MicrosoftTeamsWorkflowsWebhookHandleNameQueryParameter: description: Your Workflows webhook handle name. in: query name: name required: false schema: type: string ModelLabProjectIDPathParameter: description: The ID of the Model Lab project. in: path name: project_id required: true schema: example: 1 format: int64 type: integer ModelLabRunIDPathParameter: description: The ID of the Model Lab run. in: path name: run_id required: true schema: example: 42 format: int64 type: integer NDMPageNumber: description: Specific page number to return. Defaults to 0. in: query name: page[number] required: false schema: default: 0 example: 0 format: int64 type: integer NDMPageSize: description: Size for a given page. The maximum allowed value is 500. Defaults to 50. in: query name: page[size] required: false schema: default: 50 example: 50 format: int64 type: integer NotificationRuleIDPathParameter: description: Notification Rule UUID example: "e555e290-ed65-49bd-ae18-8acbfcf18db7" in: path name: notification_rule_id required: true schema: type: string OAuth2ClientId: description: The ID of the OAuth2 client. in: path name: client_id required: true schema: example: "00000000-0000-0000-0000-000000000010" type: string OAuthClientUUIDPathParameter: description: UUID of the OAuth2 client. in: path name: client_uuid required: true schema: example: fafa8e1c-36a5-11f0-a83d-da7ad0900001 format: uuid type: string OnDemandTaskId: description: The UUID of the task. example: "6d09294c-9ad9-42fd-a759-a0c1599b4828" in: path name: task_id required: true schema: type: string OpsgenieAccountIDPathParameter: description: The UUID of the Opsgenie account. in: path name: account_id required: true schema: type: string OpsgenieServiceIDPathParameter: description: The UUID of the service. in: path name: integration_service_id required: true schema: type: string OrgAuthorizedClientId: description: The ID of the org authorized client. in: path name: org_authorized_client_id required: true schema: example: "00000000-0000-0000-0000-000000000001" type: string OrgConfigName: description: The name of an Org Config. in: path name: org_config_name required: true schema: example: monitor_timezone type: string OrgConnectionId: description: The unique identifier of the org connection. in: path name: connection_id required: true schema: example: "f9ec96b0-8c8a-4b0a-9b0a-1b2c3d4e5f6a" format: uuid type: string OrgGroupId: description: The ID of the org group. in: path name: org_group_id required: true schema: example: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" format: uuid type: string OrgGroupMembershipDeleteFilterOrgGroupId: description: The ID of the organization group that the memberships belong to. in: query name: filter[org_group_id] required: true schema: example: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" format: uuid type: string OrgGroupMembershipFilterOrgGroupId: description: Filter memberships by org group ID. Required when `filter[org_uuid]` is not provided. in: query name: filter[org_group_id] required: false schema: example: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" format: uuid type: string OrgGroupMembershipFilterOrgUuid: description: Filter memberships by org UUID. Returns a single-item list. in: query name: filter[org_uuid] required: false schema: example: "b2c3d4e5-f6a7-8901-bcde-f01234567890" format: uuid type: string OrgGroupMembershipId: description: The ID of the org group membership. in: path name: org_group_membership_id required: true schema: example: "f1e2d3c4-b5a6-7890-1234-567890abcdef" format: uuid type: string OrgGroupPageNumber: description: The page number to return. in: query name: page[number] required: false schema: default: 0 example: 0 format: int64 minimum: 0 type: integer OrgGroupPageSize: description: The number of items per page. Maximum is 1000. in: query name: page[size] required: false schema: default: 50 example: 50 format: int64 maximum: 1000 minimum: 1 type: integer OrgGroupPolicyFilterOrgGroupId: description: Filter policies by org group ID. in: query name: filter[org_group_id] required: true schema: example: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" format: uuid type: string OrgGroupPolicyFilterPolicyName: description: Filter policies by policy name. in: query name: filter[policy_name] required: false schema: example: monitor_timezone type: string OrgGroupPolicyFilterPolicyType: description: Filter policies by policy type. Supported values are `org_config` and `role`. in: query name: filter[policy_type] required: false schema: $ref: "#/components/schemas/OrgGroupPolicyFilterPolicyTypeValue" x-enum-varnames: - ORG_CONFIG - ROLE OrgGroupPolicyId: description: The ID of the org group policy. in: path name: org_group_policy_id required: true schema: example: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" format: uuid type: string OrgGroupPolicyOverrideFilterOrgGroupId: description: Filter policy overrides by org group ID. in: query name: filter[org_group_id] required: true schema: example: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" format: uuid type: string OrgGroupPolicyOverrideFilterPolicyId: description: Filter policy overrides by policy ID. in: query name: filter[policy_id] required: false schema: example: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" format: uuid type: string OrgGroupPolicyOverrideId: description: The ID of the org group policy override. in: path name: org_group_policy_override_id required: true schema: example: "9f8e7d6c-5b4a-3210-fedc-ba0987654321" format: uuid type: string OrgGroupSort: description: >- Field to sort org groups by. Supported values: `name`, `uuid`, `-name`, `-uuid`. Defaults to `uuid`. in: query name: sort required: false schema: $ref: "#/components/schemas/OrgGroupSortOption" OverrideSort: description: >- Field to sort overrides by. Supported values: `id`, `org_uuid`, `-id`, `-org_uuid`. Defaults to `id`. in: query name: sort required: false schema: $ref: "#/components/schemas/OrgGroupPolicyOverrideSortOption" PageNumber: description: Specific page number to return. in: query name: page[number] required: false schema: default: 0 example: 0 format: int64 type: integer PageOffset: description: Specific offset to use as the beginning of the returned page. in: query name: page[offset] required: false schema: default: 0 example: 0 format: int64 type: integer PageSize: description: Number of items to return per page. The maximum allowed value is 100. in: query name: page[size] required: false schema: default: 10 example: 10 format: int64 type: integer PersonaMappingID: description: The ID of the persona mapping example: c5c758c6-18c2-4484-ae3f-46b84128404a in: path name: persona_mapping_id required: true schema: type: string PersonalAccessTokensFilterLeakedParameter: description: When true, only return access tokens that have been detected as leaked. Has no effect when false. in: query name: filter[leaked] required: false schema: example: true type: boolean PersonalAccessTokensFilterOwnerIDParameter: description: Filter access tokens by the owner's ID. Supports multiple values. in: query name: filter[owned_by] required: false schema: items: example: "00000000-0000-1234-0000-000000000000" type: string type: array PersonalAccessTokensFilterParameter: description: Filter access tokens by the specified string. in: query name: filter required: false schema: type: string PersonalAccessTokensIncludeParameter: description: Comma-separated list of relationship objects that should be included in the response. explode: false in: query name: include required: false schema: items: $ref: "#/components/schemas/PersonalAccessTokensIncludeQueryParameterItem" type: array PersonalAccessTokensSortParameter: description: |- Access token attribute used to sort results. Sort order is ascending by default. In order to specify a descending sort, prefix the attribute with a minus sign. in: query name: sort required: false schema: $ref: "#/components/schemas/PersonalAccessTokensSort" PolicySort: description: >- Field to sort policies by. Supported values: `id`, `name`, `-id`, `-name`. Defaults to `id`. in: query name: sort required: false schema: $ref: "#/components/schemas/OrgGroupPolicySortOption" PostmortemTemplateFilterIncidentTypeParameter: description: Filter postmortem templates by the associated incident type ID. in: query name: filter[incident-type] required: false schema: format: uuid type: string PostmortemTemplateIdParameter: description: The ID of the postmortem template. example: 00000000-0000-0000-0000-000000000000 in: path name: template_id required: true schema: type: string PostmortemTemplateSortParameter: description: The attribute to sort results by. Prefix with `-` for descending order. in: query name: sort required: false schema: default: created_at example: "-created_at" type: string ProductName: description: Name of the product to be deleted. Only `logs` is supported. in: path name: product required: true schema: type: string ProjectIDPathParameter: description: Project UUID. example: "e555e290-ed65-49bd-ae18-8acbfcf18db7" in: path name: project_id required: true schema: type: string QueryFilterFrom: description: The minimum timestamp for requested security signals. example: "2019-01-02T09:42:36.320Z" in: query name: filter[from] required: false schema: format: date-time type: string QueryFilterSearch: description: The search query for security signals. example: security:attack status:high in: query name: filter[query] required: false schema: type: string QueryFilterTo: description: The maximum timestamp for requested security signals. example: "2019-01-03T09:42:36.320Z" in: query name: filter[to] required: false schema: format: date-time type: string QueryPageCursor: description: A list of results using the cursor provided in the previous query. example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== in: query name: page[cursor] required: false schema: type: string QueryPageLimit: description: The maximum number of security signals in the response. example: 25 in: query name: page[limit] required: false schema: default: 10 format: int32 maximum: 1000 type: integer QuerySort: description: The order of the security signals in results. in: query name: sort required: false schema: $ref: "#/components/schemas/SecurityMonitoringSignalsSort" RelationInclude: description: Include relationship data. explode: true in: query name: include required: false schema: $ref: "#/components/schemas/RelationIncludeType" ReportID: description: The ID of the report job. in: path name: report_id required: true schema: type: string RequestId: description: ID of the deletion request. in: path name: id required: true schema: type: string ResourceFilterAccountID: description: Filter resource filters by cloud provider account ID. This parameter is only valid when provider is specified. in: query name: account_id required: false schema: type: string ResourceFilterProvider: description: Filter resource filters by cloud provider (e.g. aws, gcp, azure). in: query name: cloud_provider required: false schema: type: string ResourceID: description: |- Identifier, formatted as `type:id`. Supported types: `ai-gateway-provider`, `dashboard`, `integration-service`, `integration-webhook`, `notebook`, `powerpack`, `reference-table`, `security-rule`, `slo`, `synthetics-global-variable`, `synthetics-test`, `synthetics-private-location`, `monitor`, `workflow`, `app-builder-app`, `connection`, `connection-group`, `rum-application`, `cross-org-connection`, `spreadsheet`, `on-call-schedule`, `on-call-escalation-policy`, `on-call-team-routing-rules`, `logs-pipeline`, `case-management-project`, `monitor-notification-rule`, `status-page`, `feature-flag`, `network-path-config`. example: "dashboard:abc-def-ghi" in: path name: resource_id required: true schema: type: string RestrictionQueryID: description: The ID of the restriction query. in: path name: restriction_query_id required: true schema: type: string RestrictionQueryRoleID: description: "The ID of the role." in: path name: role_id required: true schema: type: string RestrictionQueryUserID: description: "The ID of the user." in: path name: user_id required: true schema: type: string RetentionFilterIdParam: description: The ID of the retention filter. in: path name: filter_id required: true schema: type: string RoleID: description: The unique identifier of the role. in: path name: role_id required: true schema: type: string RuleBasedViewFramework: description: Compliance framework handle to filter rules and findings by. in: query name: framework required: false schema: default: "" example: hipaa type: string RuleBasedViewIncludeRulesWithoutFindings: description: When `true`, includes rules in the response that have no associated findings. in: query name: include_rules_without_findings required: false schema: default: false example: false type: boolean RuleBasedViewIsCustom: description: Set to `true` when the requested `framework` is a custom framework. in: query name: is_custom required: false schema: example: false type: boolean RuleBasedViewQuery: description: Additional event-platform filters applied to the underlying findings query. For example, `scored:true project_id:datadog-prod-us5`. in: query name: query required: false schema: default: "" example: scored:true type: string RuleBasedViewQueryFindingsWithoutFrameworkVersion: description: When `true`, returns findings without a `framework_version` tag. Used for findings from custom frameworks or those created before framework versioning was introduced. in: query name: query_findings_without_framework_version required: false schema: default: false example: false type: boolean RuleBasedViewTo: description: Timestamp of the query end, in milliseconds since the Unix epoch. in: query name: to required: true schema: example: 1739982278000 format: int64 type: integer RuleBasedViewVersion: description: Version of the compliance framework to filter rules and findings by. in: query name: version required: false schema: example: "1" type: string RuleIDPathParameter: description: The UUID of the automation rule. example: "e6773723-fe58-49ff-9975-dff00f14e28d" in: path name: rule_id required: true schema: type: string RuleId: description: The ID of the rule. in: path name: rule_id required: true schema: type: string RumApplicationIDParameter: description: RUM application ID. in: path name: app_id required: true schema: type: string RumExclusionFilterApplicationIDParameter: description: RUM application ID. in: path name: app_id required: true schema: type: string RumExclusionFilterIDParameter: description: Exclusion filter ID. in: path name: ef_id required: true schema: type: string RumMetricIDParameter: description: The name of the RUM-based metric, as returned in `data.id` by `ListRumMetrics`. in: path name: metric_id required: true schema: example: rum.sessions.web.count type: string RumPermanentRetentionFilterIDParameter: description: The identifier of the permanent RUM retention filter. in: path name: permanent_rf_id required: true schema: $ref: "#/components/schemas/RumPermanentRetentionFilterID" RumRetentionFilterIDParameter: description: Retention filter ID. in: path name: rf_id required: true schema: type: string RumRetentionQuotaScopeIDParameter: description: |- The identifier of the scope the retention quota configuration applies to. For the `application` scope, this is the RUM application ID. in: path name: scope_id required: true schema: example: cd73a516-a481-4af5-8352-9b577465c77b type: string RumRetentionQuotaScopeTypeParameter: description: |- The type of scope the retention quota configuration applies to. `application` is the only supported scope type. in: path name: scope_type required: true schema: $ref: "#/components/schemas/RumRetentionQuotaScopeType" SAMLConfigurationUUIDPathParameter: description: The UUID of the SAML configuration. in: path name: saml_config_uuid required: true schema: example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string SampleLogGenerationContentPackID: description: The identifier of the Cloud SIEM content pack to operate on (for example, `aws-cloudtrail`). in: path name: content_pack_id required: true schema: type: string SchemaVersion: description: The schema version desired in the response. in: query name: schema_version required: false schema: $ref: "#/components/schemas/ServiceDefinitionSchemaVersions" SearchIssuesIncludeQueryParameter: description: Comma-separated list of relationship objects that should be included in the response. Possible values are `issue`, `issue.assignee`, `issue.case`, and `issue.team_owners`. explode: false in: query name: include required: false schema: items: $ref: "#/components/schemas/SearchIssuesIncludeQueryParameterItem" type: array SecureEmbedTokenPathParameter: description: The share token identifying the secure embed. example: "s3cur3t0k3n-abcdef123456" in: path name: token required: true schema: type: string SecurityAgentInvestigationFields: description: Attributes to return, comma-separated. Defaults to all attributes. example: - state - verdict - conclusion explode: false in: query name: fields[investigations] required: false schema: items: $ref: "#/components/schemas/SecurityAgentInvestigationField" type: array SecurityAgentInvestigationID: description: The ID of the investigation, as returned by the list. example: 7f3c9a2e-5d14-4e8b-9c61-2a0b4f8d1e53 in: path name: investigation_id required: true schema: type: string SecurityAgentInvestigationsCountField: description: Field to count completed investigations by. in: query name: field required: true schema: $ref: "#/components/schemas/SecurityAgentInvestigationCountField" SecurityAgentInvestigationsFilterEntity: description: |- Only investigations whose signal has all of these entities. Write each entity as `attribute:value`, matching the values returned by the count endpoint with `field=entity`. Comma-separated values; an investigation must have every one of them. example: "@usr.id:jane.doe" in: query name: filter[entity] required: false schema: type: string SecurityAgentInvestigationsFilterFrom: description: Only investigations last updated at or after this time, as RFC 3339 or milliseconds since the epoch. example: "2026-10-01T00:00:00Z" in: query name: filter[from] required: false schema: type: string SecurityAgentInvestigationsFilterRuleID: description: |- Only investigations of signals from one of these detection rule IDs. Comma-separated values; an investigation matches any of them. example: abc-def-ghi in: query name: filter[rule_id] required: false schema: type: string SecurityAgentInvestigationsFilterRuleType: description: |- Only investigations of signals from detection rules of one of these types, as returned by the count with `field=rule_type`. Comma-separated values; an investigation matches any of them. example: log_detection in: query name: filter[rule_type] required: false schema: type: string SecurityAgentInvestigationsFilterSignalID: description: |- List every investigation of this signal, newest first. Accepts the signal ID in its V1 form, which starts with `AQ`, or in its longer V3 form, which starts with `Aw`. Investigations carry the V1 form, so their `signal_id` can differ from the ID you pass. Can't be combined with other filters or with `sort`. example: AQAAAaGNHjq4XzqcIQAAAABBWm8xY0wybUFBQmNYSjl1QUFBQUFBQUE in: query name: filter[signal_id] required: false schema: type: string SecurityAgentInvestigationsFilterSignalSeverity: description: |- Only investigations of signals with one of these severities: `info`, `low`, `medium`, `high`, or `critical`. Comma-separated values; an investigation matches any of them. example: high,critical in: query name: filter[signal_severity] required: false schema: type: string SecurityAgentInvestigationsFilterSignalSource: description: |- Only investigations of signals from one of these sources, as returned by the count with `field=signal_source`. Comma-separated values; an investigation matches any of them. example: okta in: query name: filter[signal_source] required: false schema: type: string SecurityAgentInvestigationsFilterState: description: |- Only investigations in one of these states: `investigating` or `completed`. Investigations reported as `failed` match `investigating`. Comma-separated values; an investigation matches any of them. example: completed in: query name: filter[state] required: false schema: type: string SecurityAgentInvestigationsFilterTags: description: |- Only investigations whose signal has all of these tags, written `key:value`. Comma-separated values; an investigation must have every one of them. example: env:prod in: query name: filter[tags] required: false schema: type: string SecurityAgentInvestigationsFilterTitle: description: Only investigations whose signal title contains this text, case-insensitive. example: login in: query name: filter[title] required: false schema: type: string SecurityAgentInvestigationsFilterTo: description: Only investigations last updated at or before this time, as RFC 3339 or milliseconds since the epoch. example: "2026-10-31T00:00:00Z" in: query name: filter[to] required: false schema: type: string SecurityAgentInvestigationsFilterVerdict: description: |- Only investigations with one of these verdicts: `benign`, `suspicious`, or `malicious`. Comma-separated values; an investigation matches any of them. example: suspicious,malicious in: query name: filter[verdict] required: false schema: type: string SecurityAgentInvestigationsPageNumber: description: Page number, starting at 1. example: 1 in: query name: page[number] required: false schema: default: 1 format: int64 minimum: 1 type: integer SecurityAgentInvestigationsPageSize: description: Number of investigations per page. example: 25 in: query name: page[size] required: false schema: default: 25 format: int64 maximum: 100 minimum: 1 type: integer SecurityAgentInvestigationsSort: description: |- Sort field, prefixed with `-` for descending: `updated_at`, `severity`, `verdict`, `rule_id`, or `signal_title`. Defaults to `-updated_at`. `verdict` sorts by severity (`benign`, `suspicious`, `malicious`), so `-verdict` puts `malicious` first. example: -updated_at in: query name: sort required: false schema: type: string SecurityFilterID: description: The ID of the security filter. in: path name: security_filter_id required: true schema: type: string SecurityMonitoringBatchMigrationID: description: The UUID of the batch migration. in: path name: batch_id required: true schema: example: 7cdb3a75-64fb-46ce-9445-41969e78fe8e format: uuid type: string SecurityMonitoringBatchMigrationPageNumber: description: Specific page number to return, starting at 1. in: query name: page[number] required: false schema: default: 1 example: 1 format: int64 minimum: 1 type: integer SecurityMonitoringBatchMigrationPageSize: description: Size for a given page. The maximum allowed value is 500. in: query name: page[size] required: false schema: default: 50 example: 50 format: int64 maximum: 500 minimum: 1 type: integer SecurityMonitoringBatchMigrationResourceID: description: The UUID of the batch migration resource. in: path name: resource_id required: true schema: example: c968cf83-56c2-4d54-a993-6c86dfb83527 format: uuid type: string SecurityMonitoringCriticalAssetID: description: The ID of the critical asset. in: path name: critical_asset_id required: true schema: type: string SecurityMonitoringDatasetID: description: The UUID of the dataset. in: path name: dataset_id required: true schema: example: 123e4567-e89b-12d3-a456-426614174000 type: string SecurityMonitoringIntegrationConfigID: description: The ID of the entity context sync configuration. in: path name: integration_config_id required: true schema: type: string SecurityMonitoringRuleID: description: The ID of the rule. in: path name: rule_id required: true schema: type: string SecurityMonitoringRuleProposalID: description: The ID of the rule proposal, returned by the start a rule proposal endpoint. in: path name: proposal_id required: true schema: example: c968cf83-56c2-4d54-a993-6c86dfb83527 format: uuid type: string SecurityMonitoringRuleVersion: description: The historical version number of the rule. in: path name: version required: true schema: example: 1 format: int64 type: integer SecurityMonitoringSuppressionID: description: The ID of the suppression rule in: path name: suppression_id required: true schema: type: string SecurityMonitoringTerraformResourceId: description: The ID of the security monitoring resource to export. in: path name: resource_id required: true schema: type: string SecurityMonitoringTerraformResourceType: description: The type of security monitoring resource to export. in: path name: resource_type required: true schema: $ref: "#/components/schemas/SecurityMonitoringTerraformResourceType" SensitiveDataScannerGroupID: description: The ID of a group of rules. in: path name: group_id required: true schema: type: string SensitiveDataScannerRuleID: description: The ID of the rule. in: path name: rule_id required: true schema: type: string ServiceAccountID: description: "The ID of the service account." in: path name: service_account_id required: true schema: example: "00000000-0000-1234-0000-000000000000" type: string ServiceName: description: The name of the service. in: path name: service_name required: true schema: example: "my-service" type: string SharedDashboardDashboardIDPathParameter: description: ID of the dashboard. in: path name: dashboard_id required: true schema: example: abc-def-ghi type: string SignalID: description: The ID of the signal. in: path name: signal_id required: true schema: type: string SkipCache: description: Skip cache for resource filters. in: query name: skip_cache required: false schema: type: boolean SlackUserUuidQueryParameter: description: The UUID of the Datadog user to list Slack bindings for. in: query name: user_uuid required: true schema: format: uuid type: string SloID: description: The ID of the SLO. in: path name: slo_id required: true schema: example: "00000000-0000-0000-0000-000000000000" type: string SpansMetricIDParameter: description: The name of the span-based metric. in: path name: metric_id required: true schema: type: string StatuspageUrlSettingIDPathParameter: description: The UUID of the Statuspage URL setting. in: path name: statuspage_url_setting_id required: true schema: type: string TagIndexingRuleId: description: ID of the tag indexing rule. example: 00000000-0000-0000-0000-000000000001 in: path name: id required: true schema: type: string TagKey: description: The Cloud Cost Management tag key. Tag keys can contain forward slashes (for example, `kubernetes/instance`). in: path name: tag_key required: true schema: type: string TeamsOwnershipFilterApplicationIdParameter: description: Filter mappings by RUM application ID. Each value must be a valid UUID. in: query name: filter[application_id] schema: items: format: uuid type: string type: array TeamsOwnershipFilterServiceParameter: description: Filter mappings by RUM application service name. in: query name: filter[service] schema: items: type: string type: array TeamsOwnershipFilterTeamHandleParameter: description: Filter mappings by owning team handle. in: query name: filter[team_handle] schema: items: type: string type: array TeamsOwnershipFilterViewNameParameter: description: Filter mappings by RUM view name. in: query name: filter[view_name] schema: items: type: string type: array TeamsOwnershipMappingIdParameter: description: The ID of the teams ownership mapping. in: path name: id required: true schema: type: string ToTimestamp: description: The ending timestamp for the SLO status query in epoch seconds. in: query name: to_ts required: true schema: example: 1706803070 format: int64 type: integer TraceIDPathParameter: description: |- The trace ID. Accepts either a hexadecimal string of up to 32 characters (128-bit trace ID) or a decimal string of up to 39 digits. Hexadecimal IDs are case-insensitive, and shorter values are left-padded with zeros. Use the `trace_id` attribute of a span returned by the Search spans or Get a list of spans endpoints. Values in any other format, such as UUIDs, return `400 Bad Request`. A well-formed ID with no matching trace returns `404 Not Found`. example: "0000000000000000abc1230000000000" in: path name: trace_id required: true schema: pattern: "^([0-9a-fA-F]{1,32}|[0-9]{1,39})$" type: string UnitCostID: description: The UUID of the unit cost. example: 64aecd58-e355-4f07-9c3a-56ff6bda6cd8 in: path name: unit_cost_id required: true schema: format: uuid type: string UserAuthorizedClientId: description: The ID of the user authorized client. in: path name: user_authorized_client_id required: true schema: example: "00000000-0000-0000-0000-000000000001" type: string UserAuthorizedClientIdForOrg: description: The ID of the user authorized client. in: path name: user_authorized_client_id required: true schema: example: "00000000-0000-0000-0000-000000000002" type: string UserID: description: "The ID of the user." in: path name: user_id required: true schema: example: "00000000-0000-9999-0000-000000000000" type: string UserIdForOrgClient: description: The ID of the user. in: path name: user_id required: true schema: example: "00000000-0000-9999-0000-000000000001" type: string UserUUIDPathParameter: description: The UUID of the user to add or remove as a watcher. example: "8146583c-0b5f-11ec-abf8-da7ad0900001" in: path name: user_uuid required: true schema: type: string ViewIDPathParameter: description: The UUID of the work item view. example: a1b2c3d4-e5f6-7890-abcd-ef1234567890 in: path name: view_id required: true schema: type: string WebhooksAuthMethodIDPathParameter: description: The UUID of the auth method. in: path name: auth_method_id required: true schema: type: string WebhooksAuthMethodInclude: description: Comma-separated list of relationships to include in the response. explode: true in: query name: include required: false schema: $ref: "#/components/schemas/WebhooksAuthMethodProtocol" WorkflowId: description: The ID of the workflow. in: path name: workflow_id required: true schema: type: string environment_id: description: The ID of the environment. in: path name: environment_id required: true schema: example: "550e8400-e29b-41d4-a716-446655440001" format: uuid type: string exposure_schedule_id: description: The ID of the exposure schedule. in: path name: exposure_schedule_id required: true schema: example: "550e8400-e29b-41d4-a716-446655440010" format: uuid type: string feature_flag_id: description: The ID of the feature flag. in: path name: feature_flag_id required: true schema: example: "550e8400-e29b-41d4-a716-446655440000" format: uuid type: string variant_id: description: The ID of the variant. in: path name: variant_id required: true schema: example: "550e8400-e29b-41d4-a716-446655440002" format: uuid type: string requestBodies: {} responses: BadRequestResponse: content: "application/json": schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request ConcurrentModificationResponse: content: "application/json": schema: $ref: "#/components/schemas/APIErrorResponse" description: Concurrent Modification ConflictResponse: content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Conflict FindingsBadRequestResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Bad Request: The server cannot process the request due to invalid syntax in the request." FindingsForbiddenResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Forbidden: Access denied" FindingsNotFoundResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Not Found: The requested finding cannot be found." FindingsTooManyRequestsResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Too many requests: The rate limit set by the API has been exceeded." ForbiddenResponse: content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden HTTPCDGatesBadRequestResponse: content: application/json: schema: $ref: "#/components/schemas/HTTPCDGatesBadRequestResponse" description: Bad request. HTTPCDGatesNotFoundResponse: content: application/json: schema: $ref: "#/components/schemas/HTTPCDGatesNotFoundResponse" description: Deployment gate not found. HTTPCDRulesNotFoundResponse: content: application/json: schema: $ref: "#/components/schemas/HTTPCDRulesNotFoundResponse" description: Deployment rule not found. NDMBadRequestResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request NDMNotFoundResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found NotAuthorizedResponse: content: "application/json": schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Authorized NotFoundResponse: content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found NotificationRulesList: content: "application/json": schema: $ref: "#/components/schemas/NotificationRulesListResponse" description: The list of notification rules. PreconditionFailedResponse: content: "application/json": schema: $ref: "#/components/schemas/APIErrorResponse" description: Failed Precondition RumExclusionFilterMethodNotAllowedResponse: content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Method Not Allowed SecurityMonitoringBatchMigrationBadRequestResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request SecurityMonitoringBatchMigrationConflictResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict SecurityMonitoringBatchMigrationForbiddenResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden SecurityMonitoringBatchMigrationInternalServerErrorResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error SecurityMonitoringBatchMigrationNotFoundResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found SecurityMonitoringBatchMigrationUnauthorizedResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized SecurityMonitoringRuleProposalBadRequestResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request SecurityMonitoringRuleProposalForbiddenResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden SecurityMonitoringRuleProposalNotFoundResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found SecurityMonitoringRuleProposalUnauthorizedResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized SpansBadRequestResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Bad Request." SpansForbiddenResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Forbidden: Access denied." SpansTooManyRequestsResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Too many requests: The rate limit set by the API has been exceeded." SpansUnprocessableEntityResponse: content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Unprocessable Entity." TooManyRequestsResponse: content: "application/json": schema: $ref: "#/components/schemas/APIErrorResponse" description: Too many requests UnauthorizedResponse: content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Unauthorized UnprocessableEntityResponse: content: "application/json": schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The server cannot process the request because it contains invalid data. schemas: AIGuardAction: description: The recommended action for the evaluated conversation. enum: - ALLOW - DENY - ABORT example: ALLOW type: string x-enum-varnames: - ALLOW - DENY - ABORT AIGuardCodingAgent: description: |- The coding agent that produced the conversation. By default, a non-empty value selects the coding-agent evaluator profile, while an omitted or empty value selects the default profile. Known identifiers include `claude-code`, `codex`, `cursor`, and `github-copilot`; other identifiers are accepted. The coding-agent profile assumes the caller can ask the user to confirm Supply Chain Firewall warnings; the default profile assumes it cannot. example: claude-code type: string AIGuardConfidenceThreshold: additionalProperties: description: The confidence threshold override for the threat tag named by the property. example: 0.9 format: double type: number description: |- Request-level confidence threshold override. `flagging_global` is the global threshold applied to every threat category. Any other property is a per-category override keyed by an AI Guard threat tag; per-category values take precedence over `flagging_global`, and categories without an entry fall back to it. When this object omits flagging_global, the fallback is `0.5`. Recognized category keys include policy-evasion, indirect-prompt-injection, system-and-capability-discovery, credential-access, sensitive-data-collection, privilege-escalation, malicious-execution, private-network-target, destructive-or-resource-abuse, tool-abuse, poisoning-or-persistence, and `data-exfiltration`. Unknown category keys are ignored. example: flagging_global: 0.6 policy-evasion: 0.9 properties: flagging_global: description: The global confidence threshold applied to categories without a specific override. example: 0.6 format: double type: number type: object AIGuardConfidenceThresholdOverride: description: |- Request-only confidence threshold override. A number sets the threshold for every threat category; an object supplies a global threshold and optional per-category overrides. Omit this field to use the stored sensitivity policy. This field is not returned in evaluation responses. oneOf: - $ref: "#/components/schemas/AIGuardGlobalConfidenceThreshold" - $ref: "#/components/schemas/AIGuardConfidenceThreshold" AIGuardContentPart: description: |- One part of multipart message content, following the OpenAI content part format. For user, system, developer, and tool messages, a text part must include non-empty `text`, and an image part must include `image_url` with a non-empty `url`. These content-part checks do not apply to assistant messages. properties: image_url: $ref: "#/components/schemas/AIGuardImageURL" text: description: The text content, required and non-empty when `type` is `text` in a user, system, developer, or tool message. example: What is the weather like today? type: string type: $ref: "#/components/schemas/AIGuardContentPartType" required: - type type: object AIGuardContentPartType: description: The type of the content part. enum: - text - image_url example: text type: string x-enum-varnames: - TEXT - IMAGE_URL AIGuardEvaluateAttributesResponse: description: The evaluation result with the recommended action and detected threat information. properties: action: $ref: "#/components/schemas/AIGuardAction" global_prob: description: The global threat probability, between `0` and `1`. Included only when computed. example: 0.005218505859375 format: double type: number is_blocking_enabled: description: Whether blocking is enabled for the organization. example: false type: boolean reason: description: The explanation for the recommended action, for logging rather than user-facing display. example: No rule match. type: string redaction_replacements: description: The redacted replacements computed for the request. Included only when redaction applies. items: $ref: "#/components/schemas/AIGuardRedactionReplacement" type: array scfw_findings: $ref: "#/components/schemas/AIGuardScfwFindings" sds_findings: description: The sensitive data findings from the Sensitive Data Scanner. Included only when findings exist. items: $ref: "#/components/schemas/AIGuardSdsFinding" type: array tag_probs: additionalProperties: description: The detection confidence for the threat tag named by the property. example: 0.97 format: double type: number description: The detection confidence for each threat tag, between `0` and `1`. May be null when the evaluation does not produce per-category scores. example: nullable: true type: object tags: description: The threat tags detected in the conversation. example: [] items: description: A detected threat tag. example: destructive-or-resource-abuse type: string type: array required: - action - reason - tags - tag_probs - is_blocking_enabled type: object AIGuardEvaluateDataResponse: description: The JSON:API evaluation resource. properties: attributes: $ref: "#/components/schemas/AIGuardEvaluateAttributesResponse" id: description: The unique identifier of the evaluation. example: a76a703c-324f-42ed-af33-9b17d65e28af type: string type: $ref: "#/components/schemas/AIGuardEvaluationType" required: - id - type - attributes type: object AIGuardEvaluateRequest: description: The request to evaluate a conversation for security threats. example: data: attributes: messages: - content: Hello world! role: user meta: confidence_threshold: 0.8 type: evaluations properties: data: $ref: "#/components/schemas/AIGuardEvaluateRequestData" required: - data type: object AIGuardEvaluateRequestData: description: The JSON:API request envelope for an AI Guard evaluation. properties: attributes: $ref: "#/components/schemas/AIGuardEvaluateRequestDataAttributes" type: $ref: "#/components/schemas/AIGuardEvaluationType" required: - type - attributes type: object AIGuardEvaluateRequestDataAttributes: description: The conversation to evaluate and its metadata. properties: messages: description: The messages of the conversation to evaluate, in order. Must contain at least one message. items: $ref: "#/components/schemas/AIGuardMessage" minItems: 1 type: array meta: $ref: "#/components/schemas/AIGuardMeta" required: - messages type: object AIGuardEvaluateResponse: description: The response containing the evaluation result. properties: data: $ref: "#/components/schemas/AIGuardEvaluateDataResponse" required: - data type: object AIGuardEvaluationType: description: |- The JSON:API resource type for AI Guard evaluation requests and responses. Its value is `evaluations` for the action endpoint `/api/v2/ai-guard/evaluate`. enum: - evaluations example: evaluations type: string x-enum-varnames: - EVALUATIONS AIGuardGlobalConfidenceThreshold: description: The global confidence threshold applied to every threat category. example: 0.8 format: double type: number AIGuardImageURL: description: An image referenced by URL in a message content part. properties: url: description: The image URL or a data URI with an `image/png`, `image/jpeg`, `image/gif`, or `image/webp` MIME type. example: https://example.com/image.png type: string required: - url type: object AIGuardMessage: description: |- A message in the conversation. Content is required for user, system, developer, and tool messages, but may be omitted for assistant messages. For those non-assistant roles, a plain content string may be empty, but a multipart content array must contain at least one valid content part. Only assistant messages may contain tool calls, and tool call entries must not be null. Tool messages must include a non-empty `tool_call_id`; other message roles must not include a non-empty `tool_call_id`. properties: content: $ref: "#/components/schemas/AIGuardMessageContent" role: $ref: "#/components/schemas/AIGuardMessageRole" tool_call_id: description: The identifier of the tool call this message responds to, present on tool result messages. example: call_1 type: string tool_calls: description: The tool calls emitted by the assistant, present on assistant messages that call tools. items: $ref: "#/components/schemas/AIGuardToolCall" type: array required: - role type: object AIGuardMessageContent: description: The content of a message, either a plain string or a list of OpenAI-style content parts. oneOf: - $ref: "#/components/schemas/AIGuardMessageContentText" - $ref: "#/components/schemas/AIGuardMessageContentParts" AIGuardMessageContentParts: description: The message content as a list of content parts. The list must be non-empty for user, system, developer, and tool messages. items: $ref: "#/components/schemas/AIGuardContentPart" type: array AIGuardMessageContentText: description: The message content as a plain string. example: What is the weather like today? type: string AIGuardMessageRole: description: The role of the message author in the conversation. enum: - user - assistant - system - developer - tool example: user type: string x-enum-varnames: - USER - ASSISTANT - SYSTEM - DEVELOPER - TOOL AIGuardMeta: description: Metadata about the evaluated conversation, used to select the policy and evaluator behavior. properties: coding_agent: $ref: "#/components/schemas/AIGuardCodingAgent" confidence_threshold: $ref: "#/components/schemas/AIGuardConfidenceThresholdOverride" env: description: The environment the conversation belongs to. example: production type: string is_sds_enabled_override: description: Whether to run the Sensitive Data Scanner for this request, overriding the stored policy. example: true type: boolean service: description: The name of the service the conversation belongs to. example: my-web-app type: string tool_policies: additionalProperties: $ref: "#/components/schemas/AIGuardToolPolicyAction" description: |- A non-empty map replaces stored tool policies for this request only, keyed by tool name. Any called tool not present resolves to EVALUATE. Only takes effect when tool policies are enabled for the organization. example: shell: BLOCK type: object type: object AIGuardRedactionReplacement: description: The fully redacted content for one path in the request. properties: path: description: The path of the redacted content relative to the request attributes. example: messages[0].content type: string replacement: description: The redacted replacement content. example: "[REDACTED]" type: string required: - path - replacement type: object AIGuardScfwFindings: description: |- The Supply Chain Firewall verdict for the version-pinned install packages found in the request. Evaluation requires Supply Chain Firewall to be enabled for the organization and the caller to have the `appsec_vm_read` permission. Without that permission, Supply Chain Firewall evaluation is skipped; the AI Guard evaluation request itself is not rejected. Findings are omitted when Supply Chain Firewall does not produce a result. The recommended action combines the package outcomes. Confirmation support is inferred from the evaluator profile, not from a separate confirmation-capability flag. By default, a non-empty `meta.coding_agent` selects the coding-agent profile, which assumes the caller can ask for confirmation and retains WARN in `recommended_action`. Omitting `meta.coding_agent` or setting it to an empty string selects the default profile, which assumes the caller cannot ask for confirmation and returns ALLOW instead of WARN in `recommended_action`. Package outcomes still retain WARN, and BLOCK is never changed to ALLOW by this rule. properties: packages: description: The packages the firewall evaluated, `ALLOW` ones included. items: $ref: "#/components/schemas/AIGuardScfwPackageFinding" type: array recommended_action: $ref: "#/components/schemas/AIGuardScfwOutcome" required: - recommended_action type: object AIGuardScfwMatchedRule: description: One rule the Supply Chain Firewall matched on a package, with the outcome the rule reached. properties: outcome: $ref: "#/components/schemas/AIGuardScfwOutcome" rule: description: The rule text the firewall reported, or the policy type when no text was reported. example: "Disallow install commands" type: string required: - rule - outcome type: object AIGuardScfwOutcome: description: The Supply Chain Firewall outcome for a package, a matched rule, or the whole request. enum: - ALLOW - WARN - BLOCK example: BLOCK type: string x-enum-descriptions: - Proceed with the install. - Confirm with the user before installing. - Do not install. x-enum-varnames: - ALLOW - WARN - BLOCK AIGuardScfwPackageFinding: description: One package the Supply Chain Firewall evaluated, with the outcome and every matched rule. properties: ecosystem: description: The package ecosystem the firewall evaluated, such as `PyPI`, `npm`, or `crates.io`. example: npm type: string matched_rules: description: Every rule the firewall matched on the package. items: $ref: "#/components/schemas/AIGuardScfwMatchedRule" type: array name: description: The name of the package. example: left-pad type: string outcome: $ref: "#/components/schemas/AIGuardScfwOutcome" version: description: The version of the package. example: 1.3.0 type: string required: - ecosystem - name - version - outcome type: object AIGuardSdsFinding: description: A sensitive data finding from the Sensitive Data Scanner. properties: category: description: The category of the sensitive data found. example: financial type: string location: $ref: "#/components/schemas/AIGuardSdsFindingLocation" rule_display_name: description: The display name of the SDS rule that matched. example: Credit Card Number type: string rule_tag: description: The tag of the SDS rule that matched. example: credit-card type: string required: - rule_display_name - rule_tag - category - location type: object AIGuardSdsFindingLocation: description: The location of a sensitive data match within the request. properties: end_index_exclusive: description: The exclusive end index of the match within the located content. example: 42 format: int64 type: integer path: description: The path of the match relative to the request attributes. example: messages[0].content type: string start_index: description: The start index of the match within the located content. example: 12 format: int64 type: integer required: - path - start_index - end_index_exclusive type: object AIGuardToolCall: description: A tool call emitted by the assistant. properties: function: $ref: "#/components/schemas/AIGuardToolCallFunction" id: description: The identifier of the tool call. example: call_1 type: string required: - id - function type: object AIGuardToolCallFunction: description: The function invoked by a tool call. properties: arguments: description: The arguments of the function call, serialized as a JSON string. example: '{"command":"shutdown"}' type: string name: description: The name of the function to call. example: shell type: string required: - name - arguments type: object AIGuardToolPolicyAction: description: |- The policy action for a tool named by the property. Tool policies override the recommendation after evaluation; they do not skip evaluation. Any BLOCK takes precedence over PASS and EVALUATE. The Supply Chain Firewall is applied afterward and can still return DENY. enum: - PASS - BLOCK - EVALUATE example: EVALUATE type: string x-enum-descriptions: - Recommend ALLOW when all called tools use PASS, overriding the evaluation result. - Recommend DENY if any called tool uses BLOCK, overriding the evaluation result. - Use the evaluation result unless another called tool uses BLOCK. x-enum-varnames: - PASS - BLOCK - EVALUATE AIImpactUserActivityAttributes: additionalProperties: false description: |- Daily AI coding tool activity for a single user. Each entry reports whether the user was active on a given day and which AI tools and models they used. properties: day: description: The day the activity refers to, in `YYYY-MM-DD` format. example: "2026-05-26" pattern: "^\\d{4}-\\d{2}-\\d{2}$" type: string is_active: description: Whether the user actively used the listed AI tools on that day. example: true type: boolean models: $ref: "#/components/schemas/AIImpactUserActivityModels" tools: $ref: "#/components/schemas/AIImpactUserActivityTools" user_email: description: |- The email address of the user. It is case-insensitive and is matched against the email addresses of commit authors. example: user@example.com pattern: "^[^@]+@[^@.]+(?:\\.[^@.]+)+$" type: string required: - user_email - is_active - day - tools type: object AIImpactUserActivityData: additionalProperties: false description: A single daily AI tool activity entry. properties: attributes: $ref: "#/components/schemas/AIImpactUserActivityAttributes" type: $ref: "#/components/schemas/AIImpactUserActivityType" required: - type - attributes type: object AIImpactUserActivityDataArray: description: |- A batch of daily AI tool activity entries. A batch must contain between 1 and 1,000 entries. example: - attributes: day: "2026-05-26" is_active: true models: - claude-sonnet-4.5 - gpt-5 tools: - Claude Code - Cursor user_email: user@example.com type: ai_impact_user_activity items: $ref: "#/components/schemas/AIImpactUserActivityData" maxItems: 1000 minItems: 1 type: array AIImpactUserActivityModels: description: |- The AI models the user used on that day, for example `claude-sonnet-4.5` or `gpt-5`. Values are lowercased and duplicates are removed. example: - claude-sonnet-4.5 - gpt-5 items: description: The name of an AI model. example: claude-sonnet-4.5 type: string type: array AIImpactUserActivityRequest: additionalProperties: false description: Request to send daily AI tool activity for one or more users. properties: data: $ref: "#/components/schemas/AIImpactUserActivityDataArray" required: - data type: object AIImpactUserActivityTools: description: |- The AI coding tools the user used on that day, for example `Claude Code`, `Cursor`, or `GitHub Copilot`. Known tools are normalized to a canonical name (`claude_code`, `cursor`, `copilot`), and other values are converted to snake case. Entries must not be empty. example: - Claude Code - Cursor items: description: The name of an AI coding tool. example: Claude Code minLength: 1 pattern: ".*\\S.*" type: string minItems: 1 type: array AIImpactUserActivityType: default: ai_impact_user_activity description: JSON:API type for AI Impact user activity entries. enum: - ai_impact_user_activity example: ai_impact_user_activity type: string x-enum-varnames: - AI_IMPACT_USER_ACTIVITY APIErrorResponse: description: API error response. properties: errors: description: A list of errors. example: - Bad Request items: description: A list of items. example: Bad Request type: string type: array required: - errors type: object APIKeyCreateAttributes: description: Attributes used to create an API Key. properties: category: description: The APIKeyCreateAttributes category. type: string name: description: Name of the API key. example: "API Key for submitting metrics" type: string remote_config_read_enabled: description: The APIKeyCreateAttributes remote_config_read_enabled. type: boolean required: - name type: object APIKeyCreateData: description: Object used to create an API key. properties: attributes: $ref: "#/components/schemas/APIKeyCreateAttributes" type: $ref: "#/components/schemas/APIKeysType" required: - attributes - type type: object APIKeyCreateRequest: description: Request used to create an API key. properties: data: $ref: "#/components/schemas/APIKeyCreateData" required: - data type: object APIKeyRelationships: description: Resources related to the API key. properties: created_by: $ref: "#/components/schemas/RelationshipToUser" modified_by: $ref: "#/components/schemas/NullableRelationshipToUser" type: object APIKeyResponse: description: Response for retrieving an API key. properties: data: $ref: "#/components/schemas/FullAPIKey" included: description: Array of objects related to the API key. items: $ref: "#/components/schemas/APIKeyResponseIncludedItem" type: array type: object APIKeyResponseIncludedItem: description: An object related to an API key. oneOf: - $ref: "#/components/schemas/User" - $ref: "#/components/schemas/LeakedKey" APIKeyUpdateAttributes: description: Attributes used to update an API Key. properties: category: description: The APIKeyUpdateAttributes category. type: string name: description: Name of the API key. example: "API Key for submitting metrics" type: string remote_config_read_enabled: description: The APIKeyUpdateAttributes remote_config_read_enabled. type: boolean required: - name type: object APIKeyUpdateData: description: Object used to update an API key. properties: attributes: $ref: "#/components/schemas/APIKeyUpdateAttributes" id: description: ID of the API key. example: "00112233-4455-6677-8899-aabbccddeeff" type: string type: $ref: "#/components/schemas/APIKeysType" required: - attributes - id - type type: object APIKeyUpdateRequest: description: Request used to update an API key. properties: data: $ref: "#/components/schemas/APIKeyUpdateData" required: - data type: object APIKeysResponse: description: Response for a list of API keys. properties: data: description: Array of API keys. items: $ref: "#/components/schemas/PartialAPIKey" type: array included: description: Array of objects related to the API key. items: $ref: "#/components/schemas/APIKeyResponseIncludedItem" type: array meta: $ref: "#/components/schemas/APIKeysResponseMeta" type: object APIKeysResponseMeta: description: Additional information related to api keys response. properties: max_allowed: description: Max allowed number of API keys. format: int64 type: integer page: $ref: "#/components/schemas/APIKeysResponseMetaPage" type: object APIKeysResponseMetaPage: description: Additional information related to the API keys response. properties: total_filtered_count: description: Total filtered application key count. format: int64 type: integer type: object APIKeysSort: default: name description: Sorting options enum: - created_at - -created_at - last4 - -last4 - modified_at - -modified_at - name - -name type: string x-enum-varnames: - CREATED_AT_ASCENDING - CREATED_AT_DESCENDING - LAST4_ASCENDING - LAST4_DESCENDING - MODIFIED_AT_ASCENDING - MODIFIED_AT_DESCENDING - NAME_ASCENDING - NAME_DESCENDING APIKeysType: default: api_keys description: API Keys resource type. enum: - api_keys example: api_keys type: string x-enum-varnames: - API_KEYS APITrigger: description: "Trigger a workflow from an API request. The workflow must be published." properties: rateLimit: $ref: "#/components/schemas/TriggerRateLimit" type: object APITriggerWrapper: description: "Schema for an API-based trigger." properties: apiTrigger: $ref: "#/components/schemas/APITrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - apiTrigger type: object APMSpanErrorFlag: description: Error flag for a span. `1` when the span is in error, `0` otherwise. enum: - 0 - 1 example: 0 format: int32 type: integer x-enum-varnames: - NO_ERROR - ERROR APMTraceSpan: description: A single APM span returned as part of a trace. properties: duration: description: The duration of the span, in nanoseconds. example: 500000000 format: int64 type: integer endTime: description: The end time of the span, in Unix nanoseconds. example: 1716800000500000000 format: int64 type: integer error: $ref: "#/components/schemas/APMSpanErrorFlag" meta: additionalProperties: type: string description: |- String-valued tags attached to the span. Tag keys starting with `_` are filtered out of the response. example: env: production http.method: GET type: object metrics: additionalProperties: format: double type: number description: |- Numeric metrics attached to the span. Metric keys starting with `_` are filtered out of the response. example: http.status_code: 200 type: object name: description: The operation name of the span. example: web.request type: string parentID: description: The ID of the parent span, or `0` when the span is a trace root. example: 0 format: int64 type: integer resource: description: The resource that the span describes. example: GET /products type: string resourceHash: description: A hash of the resource field. example: 6a4e9b7f type: string restricted: description: Whether access to the span is restricted by the organization's data access policies. example: false type: boolean self_time: description: The time spent in the span itself, excluding time spent in child spans, in nanoseconds. example: 250000000 format: double type: number service: description: The name of the service that emitted the span. example: web-store type: string spanID: description: The span ID, as an unsigned 64-bit integer. example: 9876543210987654321 format: int64 type: integer startTime: description: The start time of the span, in Unix nanoseconds. example: 1716800000000000000 format: int64 type: integer traceID: description: The lower 64 bits of the trace ID, as an unsigned 64-bit integer. example: 12345678901234567890 format: int64 type: integer traceIDFull: description: The full 128-bit trace ID, encoded as a 32-character hexadecimal string. example: "0000000000000000abc1230000000000" type: string type: description: The type of the span (for example, `web`, `db`, or `rpc`). example: web type: string required: - service - name - resource - traceID - spanID - parentID - startTime - endTime - duration - error - type - meta - metrics - traceIDFull type: object APMTraceSpans: description: The list of spans that compose the trace. items: $ref: "#/components/schemas/APMTraceSpan" type: array AWSAccountConfigID: description: |- Unique Datadog ID of the AWS Account Integration Config. To get the config ID for an account, use the [List all AWS integrations](https://docs.datadoghq.com/api/latest/aws-integration/#list-all-aws-integrations) endpoint and query by AWS Account ID. example: "00000000-abcd-0001-0000-000000000000" type: string AWSAccountCreateRequest: description: AWS Account Create Request body. properties: data: $ref: "#/components/schemas/AWSAccountCreateRequestData" required: - data type: object AWSAccountCreateRequestAttributes: description: The AWS Account Integration Config to be created. properties: account_tags: $ref: "#/components/schemas/AWSAccountTags" auth_config: $ref: "#/components/schemas/AWSAuthConfig" aws_account_id: $ref: "#/components/schemas/AWSAccountID" aws_partition: $ref: "#/components/schemas/AWSAccountPartition" aws_regions: $ref: "#/components/schemas/AWSRegions" logs_config: $ref: "#/components/schemas/AWSLogsConfig" metrics_config: $ref: "#/components/schemas/AWSMetricsConfig" resources_config: $ref: "#/components/schemas/AWSResourcesConfig" traces_config: $ref: "#/components/schemas/AWSTracesConfig" required: - aws_account_id - aws_partition - auth_config type: object AWSAccountCreateRequestData: description: AWS Account Create Request data. properties: attributes: $ref: "#/components/schemas/AWSAccountCreateRequestAttributes" type: $ref: "#/components/schemas/AWSAccountType" required: - attributes - type type: object AWSAccountID: description: AWS Account ID. example: "123456789012" type: string AWSAccountPartition: description: |- AWS partition your AWS account is scoped to. Defaults to `aws`. See [Partitions](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/partitions.html) in the AWS documentation for more information. enum: - aws - aws-cn - aws-us-gov example: aws type: string x-enum-varnames: - AWS - AWS_CN - AWS_US_GOV AWSAccountResponse: description: AWS Account response body. properties: data: $ref: "#/components/schemas/AWSAccountResponseData" required: - data type: object AWSAccountResponseAttributes: description: AWS Account response attributes. properties: account_tags: $ref: "#/components/schemas/AWSAccountTags" auth_config: $ref: "#/components/schemas/AWSAuthConfig" aws_account_id: $ref: "#/components/schemas/AWSAccountID" aws_partition: $ref: "#/components/schemas/AWSAccountPartition" aws_regions: $ref: "#/components/schemas/AWSRegions" created_at: description: Timestamp of when the account integration was created. format: date-time readOnly: true type: string logs_config: $ref: "#/components/schemas/AWSLogsConfig" metrics_config: $ref: "#/components/schemas/AWSMetricsConfig" modified_at: description: Timestamp of when the account integration was updated. format: date-time readOnly: true type: string resources_config: $ref: "#/components/schemas/AWSResourcesConfig" traces_config: $ref: "#/components/schemas/AWSTracesConfig" required: - aws_account_id type: object AWSAccountResponseData: description: AWS Account response data. properties: attributes: $ref: "#/components/schemas/AWSAccountResponseAttributes" id: $ref: "#/components/schemas/AWSAccountConfigID" type: $ref: "#/components/schemas/AWSAccountType" required: - id - type type: object AWSAccountTags: description: Tags to apply to all hosts and metrics reporting for this account. Defaults to `[]`. items: description: Tag in the form `key:value`. example: "env:prod" type: string nullable: true type: array AWSAccountType: default: account description: AWS Account resource type. enum: - account example: account type: string x-enum-varnames: - ACCOUNT AWSAccountUpdateRequest: description: AWS Account Update Request body. properties: data: $ref: "#/components/schemas/AWSAccountUpdateRequestData" required: - data type: object AWSAccountUpdateRequestAttributes: description: The AWS Account Integration Config to be updated. properties: account_tags: $ref: "#/components/schemas/AWSAccountTags" auth_config: $ref: "#/components/schemas/AWSAuthConfig" aws_account_id: $ref: "#/components/schemas/AWSAccountID" aws_partition: $ref: "#/components/schemas/AWSAccountPartition" aws_regions: $ref: "#/components/schemas/AWSRegions" logs_config: $ref: "#/components/schemas/AWSLogsConfig" metrics_config: $ref: "#/components/schemas/AWSMetricsConfig" resources_config: $ref: "#/components/schemas/AWSResourcesConfig" traces_config: $ref: "#/components/schemas/AWSTracesConfig" required: - aws_account_id type: object AWSAccountUpdateRequestData: description: AWS Account Update Request data. properties: attributes: $ref: "#/components/schemas/AWSAccountUpdateRequestAttributes" id: $ref: "#/components/schemas/AWSAccountConfigID" type: $ref: "#/components/schemas/AWSAccountType" required: - attributes - type type: object AWSAccountsResponse: description: AWS Accounts response body. properties: data: description: List of AWS Account Integration Configs. items: $ref: "#/components/schemas/AWSAccountResponseData" type: array required: - data type: object AWSAssumeRole: description: The definition of `AWSAssumeRole` object. properties: account_id: description: AWS account the connection is created for example: "111222333444" pattern: ^\d{12}$ type: string external_id: description: External ID used to scope which connection can be used to assume the role example: 33a1011635c44b38a064cf14e82e1d8f readOnly: true type: string principal_id: description: AWS account that will assume the role example: "123456789012" readOnly: true type: string role: description: Role to assume example: my-role type: string type: $ref: "#/components/schemas/AWSAssumeRoleType" required: - type - account_id - role type: object AWSAssumeRoleType: description: The definition of `AWSAssumeRoleType` object. enum: - AWSAssumeRole example: AWSAssumeRole type: string x-enum-varnames: - AWSASSUMEROLE AWSAssumeRoleUpdate: description: The definition of `AWSAssumeRoleUpdate` object. properties: account_id: description: AWS account the connection is created for example: "111222333444" pattern: ^\d{12}$ type: string generate_new_external_id: description: The `AWSAssumeRoleUpdate` `generate_new_external_id`. type: boolean role: description: Role to assume example: my-role type: string type: $ref: "#/components/schemas/AWSAssumeRoleType" required: - type type: object AWSAuthConfig: description: AWS Authentication config. oneOf: - $ref: "#/components/schemas/AWSAuthConfigKeys" - $ref: "#/components/schemas/AWSAuthConfigRole" AWSAuthConfigKeys: description: AWS Authentication config to integrate your account using an access key pair. properties: access_key_id: description: AWS Access Key ID. example: "AKIAIOSFODNN7EXAMPLE" type: string secret_access_key: description: AWS Secret Access Key. example: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY" minLength: 1 type: string writeOnly: true required: - access_key_id type: object AWSAuthConfigRole: description: AWS Authentication config to integrate your account using an IAM role. properties: external_id: description: AWS IAM External ID for associated role. type: string role_name: description: AWS IAM Role name. example: "DatadogIntegrationRole" maxLength: 576 minLength: 1 type: string required: - role_name type: object AWSCcmConfig: description: AWS Cloud Cost Management config. properties: data_export_configs: description: List of data export configurations for Cost and Usage Reports. items: $ref: "#/components/schemas/DataExportConfig" type: array required: - data_export_configs type: object AWSCcmConfigRequest: description: AWS CCM Config Create/Update Request body. properties: data: $ref: "#/components/schemas/AWSCcmConfigRequestData" required: - data type: object AWSCcmConfigRequestAttributes: description: AWS CCM Config attributes for Create/Update requests. properties: ccm_config: $ref: "#/components/schemas/AWSCcmConfig" required: - ccm_config type: object AWSCcmConfigRequestData: description: AWS CCM Config Create/Update Request data. properties: attributes: $ref: "#/components/schemas/AWSCcmConfigRequestAttributes" type: $ref: "#/components/schemas/AWSCcmConfigType" required: - attributes - type type: object AWSCcmConfigResponse: description: AWS CCM Config response body. properties: data: $ref: "#/components/schemas/AWSCcmConfigResponseData" required: - data type: object AWSCcmConfigResponseAttributes: description: AWS CCM Config response attributes. properties: data_export_configs: description: List of data export configurations for Cost and Usage Reports. items: $ref: "#/components/schemas/DataExportConfig" type: array type: object AWSCcmConfigResponseData: description: AWS CCM Config response data. properties: attributes: $ref: "#/components/schemas/AWSCcmConfigResponseAttributes" id: $ref: "#/components/schemas/AWSAccountConfigID" type: $ref: "#/components/schemas/AWSCcmConfigType" required: - type type: object AWSCcmConfigType: default: "ccm_config" description: AWS CCM Config resource type. enum: - ccm_config example: "ccm_config" type: string x-enum-varnames: - CCM_CONFIG AWSCcmConfigValidationIssue: description: A single validation issue found while validating an AWS Cost and Usage Report (CUR) 2.0 configuration. properties: code: $ref: "#/components/schemas/AWSCcmConfigValidationIssueCode" description: description: Human-readable description of the validation issue. example: 'no CUR 2.0 export named "cost-and-usage-report" found' type: string required: - code - description type: object AWSCcmConfigValidationIssueCode: description: Identifies the specific reason a Cost and Usage Report (CUR) 2.0 configuration failed validation. enum: - ISSUE_CODE_UNSPECIFIED - CREDENTIAL_ERROR - BUCKET_NAME_INVALID_GOVCLOUD - S3_LIST_PERMISSION_MISSING - S3_GET_PERMISSION_MISSING - S3_BUCKET_REGION_MISMATCH - S3_BUCKET_NOT_ACCESSIBLE - EXPORT_LIST_PERMISSION_MISSING - EXPORT_GET_PERMISSION_MISSING - EXPORT_NOT_FOUND - EXPORT_STATUS_UNHEALTHY - TIME_GRANULARITY_INVALID - FILE_FORMAT_INVALID - INCLUDE_RESOURCES_DISABLED - REFRESH_CADENCE_INVALID - OVERWRITE_MODE_INVALID - QUERY_STATEMENT_INVALID example: "EXPORT_NOT_FOUND" type: string x-enum-varnames: - ISSUE_CODE_UNSPECIFIED - CREDENTIAL_ERROR - BUCKET_NAME_INVALID_GOVCLOUD - S3_LIST_PERMISSION_MISSING - S3_GET_PERMISSION_MISSING - S3_BUCKET_REGION_MISMATCH - S3_BUCKET_NOT_ACCESSIBLE - EXPORT_LIST_PERMISSION_MISSING - EXPORT_GET_PERMISSION_MISSING - EXPORT_NOT_FOUND - EXPORT_STATUS_UNHEALTHY - TIME_GRANULARITY_INVALID - FILE_FORMAT_INVALID - INCLUDE_RESOURCES_DISABLED - REFRESH_CADENCE_INVALID - OVERWRITE_MODE_INVALID - QUERY_STATEMENT_INVALID AWSCcmConfigValidationIssues: description: List of validation issues found for the Cost and Usage Report (CUR) 2.0 configuration. Empty when the configuration is valid. items: $ref: "#/components/schemas/AWSCcmConfigValidationIssue" type: array AWSCcmConfigValidationRequest: description: AWS CCM config validation request body. properties: data: $ref: "#/components/schemas/AWSCcmConfigValidationRequestData" required: - data type: object AWSCcmConfigValidationRequestAttributes: description: Attributes for an AWS CCM config validation request. properties: account_id: description: Your AWS Account ID without dashes. example: "123456789012" type: string bucket_name: description: Name of the S3 bucket where the Cost and Usage Report is stored. example: "billing" type: string bucket_region: description: AWS region of the S3 bucket. example: "us-east-1" type: string report_name: description: Name of the Cost and Usage Report. example: "cost-and-usage-report" type: string report_prefix: description: S3 prefix where the Cost and Usage Report is stored. example: "reports" type: string required: - account_id - bucket_name - bucket_region - report_name type: object AWSCcmConfigValidationRequestData: description: AWS CCM config validation request data. properties: attributes: $ref: "#/components/schemas/AWSCcmConfigValidationRequestAttributes" type: $ref: "#/components/schemas/AWSCcmConfigValidationType" required: - attributes - type type: object AWSCcmConfigValidationResponse: description: AWS CCM config validation response body. properties: data: $ref: "#/components/schemas/AWSCcmConfigValidationResponseData" required: - data type: object AWSCcmConfigValidationResponseAttributes: description: Attributes for an AWS CCM config validation response. properties: account_id: description: Your AWS Account ID without dashes. example: "123456789012" type: string issues: $ref: "#/components/schemas/AWSCcmConfigValidationIssues" required: - account_id - issues type: object AWSCcmConfigValidationResponseData: description: AWS CCM config validation response data. properties: attributes: $ref: "#/components/schemas/AWSCcmConfigValidationResponseAttributes" id: description: AWS CCM config validation resource identifier. example: "ccm_config_validation" type: string type: $ref: "#/components/schemas/AWSCcmConfigValidationType" required: - attributes - id - type type: object AWSCcmConfigValidationType: default: "ccm_config_validation" description: AWS CCM config validation resource type. enum: - ccm_config_validation example: "ccm_config_validation" type: string x-enum-varnames: - CCM_CONFIG_VALIDATION AWSCloudAuthIntakeMappingAttributesResponse: description: Attributes for AWS cloud authentication intake mapping response. properties: arn_pattern: description: AWS caller ARN pattern allowed to authenticate for telemetry submission. ARN syntax and AWS integration membership are validated by the server. For an assumed role, use the STS assumed-role ARN with a trailing /* wildcard to match its sessions. example: arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/* type: string par_enrollment_enabled: description: Whether the mapping allows Private Action Runner enrollment. This attribute may be omitted when enrollment is disabled. Enrollment permission is managed separately from the ARN pattern. example: true readOnly: true type: boolean required: - arn_pattern type: object AWSCloudAuthIntakeMappingCreateAttributes: description: Attributes for creating an AWS cloud authentication intake mapping. properties: arn_pattern: description: AWS caller ARN pattern allowed to authenticate for telemetry submission. ARN syntax and AWS integration membership are validated by the server. For an assumed role, use the STS assumed-role ARN with a trailing /* wildcard to match its sessions. example: arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/* minLength: 1 type: string required: - arn_pattern type: object AWSCloudAuthIntakeMappingCreateData: description: Data for creating an AWS cloud authentication intake mapping. properties: attributes: $ref: "#/components/schemas/AWSCloudAuthIntakeMappingCreateAttributes" type: $ref: "#/components/schemas/AWSCloudAuthIntakeMappingType" required: - type - attributes type: object AWSCloudAuthIntakeMappingCreateRequest: description: Request used to create an AWS cloud authentication intake mapping. properties: data: $ref: "#/components/schemas/AWSCloudAuthIntakeMappingCreateData" required: - data type: object AWSCloudAuthIntakeMappingDataResponse: description: Data for AWS cloud authentication intake mapping response. properties: attributes: $ref: "#/components/schemas/AWSCloudAuthIntakeMappingAttributesResponse" id: description: Unique identifier for the intake mapping. example: c5c758c6-18c2-4484-ae3f-46b84128404a type: string type: $ref: "#/components/schemas/AWSCloudAuthIntakeMappingType" required: - id - type - attributes type: object AWSCloudAuthIntakeMappingResponse: description: Response containing a single AWS cloud authentication intake mapping. properties: data: $ref: "#/components/schemas/AWSCloudAuthIntakeMappingDataResponse" required: - data type: object AWSCloudAuthIntakeMappingType: description: Type identifier for AWS cloud authentication intake mapping. enum: - aws_cloud_auth_intake_mapping example: aws_cloud_auth_intake_mapping type: string x-enum-varnames: - AWS_CLOUD_AUTH_INTAKE_MAPPING AWSCloudAuthIntakeMappingsData: description: List of AWS cloud authentication intake mappings. items: $ref: "#/components/schemas/AWSCloudAuthIntakeMappingDataResponse" type: array AWSCloudAuthIntakeMappingsResponse: description: Response containing a list of AWS cloud authentication intake mappings. properties: data: $ref: "#/components/schemas/AWSCloudAuthIntakeMappingsData" example: - attributes: arn_pattern: arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/* id: c5c758c6-18c2-4484-ae3f-46b84128404a type: aws_cloud_auth_intake_mapping required: - data type: object AWSCloudAuthPersonaMappingAttributesResponse: description: Attributes for AWS cloud authentication persona mapping response properties: account_identifier: description: Datadog account identifier (email or handle) mapped to the AWS principal example: "test@test.com" type: string account_uuid: description: Datadog account UUID example: "12bbdc5c-5966-47e0-8733-285f9e44bcf4" type: string arn_pattern: description: AWS IAM ARN pattern to match for authentication example: "arn:aws:iam::123456789012:user/testuser" type: string required: - arn_pattern - account_identifier - account_uuid type: object AWSCloudAuthPersonaMappingCreateAttributes: description: Attributes for creating an AWS cloud authentication persona mapping properties: account_identifier: description: Datadog account identifier (email or handle) mapped to the AWS principal example: "test@test.com" type: string arn_pattern: description: AWS IAM ARN pattern to match for authentication example: "arn:aws:iam::123456789012:user/testuser" type: string required: - arn_pattern - account_identifier type: object AWSCloudAuthPersonaMappingCreateData: description: Data for creating an AWS cloud authentication persona mapping properties: attributes: $ref: "#/components/schemas/AWSCloudAuthPersonaMappingCreateAttributes" type: $ref: "#/components/schemas/AWSCloudAuthPersonaMappingType" required: - type - attributes type: object AWSCloudAuthPersonaMappingCreateRequest: description: Request used to create an AWS cloud authentication persona mapping properties: data: $ref: "#/components/schemas/AWSCloudAuthPersonaMappingCreateData" required: - data type: object AWSCloudAuthPersonaMappingDataResponse: description: Data for AWS cloud authentication persona mapping response properties: attributes: $ref: "#/components/schemas/AWSCloudAuthPersonaMappingAttributesResponse" id: description: Unique identifier for the persona mapping example: "c5c758c6-18c2-4484-ae3f-46b84128404a" type: string type: $ref: "#/components/schemas/AWSCloudAuthPersonaMappingType" required: - id - type - attributes type: object AWSCloudAuthPersonaMappingResponse: description: Response containing a single AWS cloud authentication persona mapping properties: data: $ref: "#/components/schemas/AWSCloudAuthPersonaMappingDataResponse" required: - data type: object AWSCloudAuthPersonaMappingType: description: Type identifier for AWS cloud authentication persona mapping enum: - aws_cloud_auth_config example: aws_cloud_auth_config type: string x-enum-varnames: - AWS_CLOUD_AUTH_CONFIG AWSCloudAuthPersonaMappingsData: description: List of AWS cloud authentication persona mappings items: $ref: "#/components/schemas/AWSCloudAuthPersonaMappingDataResponse" type: array AWSCloudAuthPersonaMappingsResponse: description: Response containing a list of AWS cloud authentication persona mappings properties: data: $ref: "#/components/schemas/AWSCloudAuthPersonaMappingsData" example: - attributes: account_identifier: "test@test.com" account_uuid: "12bbdc5c-5966-47e0-8733-285f9e44bcf4" arn_pattern: "arn:aws:iam::123456789012:user/testuser" id: "c5c758c6-18c2-4484-ae3f-46b84128404a" type: aws_cloud_auth_config required: - data type: object AWSCredentials: description: The definition of `AWSCredentials` object. oneOf: - $ref: "#/components/schemas/AWSAssumeRole" AWSCredentialsUpdate: description: The definition of `AWSCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/AWSAssumeRoleUpdate" AWSEventBridgeAccountConfiguration: description: The EventBridge configuration for one AWS account. properties: account_id: description: Your AWS Account ID without dashes. example: "123456789012" type: string event_hubs: description: Array of AWS event sources associated with this account. items: $ref: "#/components/schemas/AWSEventBridgeSource" type: array tags: description: |- Array of tags (in the form `key:value`) which are added to all hosts and metrics reporting through the main AWS integration. example: ["$KEY:$VALUE"] items: description: The list of the host_tags. type: string type: array type: object AWSEventBridgeCreateRequest: description: Amazon EventBridge create request body. properties: data: $ref: "#/components/schemas/AWSEventBridgeCreateRequestData" required: - data type: object AWSEventBridgeCreateRequestAttributes: description: The EventBridge source to be created. properties: account_id: $ref: "#/components/schemas/AWSAccountID" create_event_bus: description: |- Set to true if Datadog should create the event bus in addition to the event source. Requires the `events:CreateEventBus` permission. example: true type: boolean event_generator_name: description: |- The given part of the event source name, which is then combined with an assigned suffix to form the full name. example: "app-alerts" type: string region: description: |- The event source's [AWS region](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). example: "us-east-1" type: string required: - account_id - event_generator_name - region type: object AWSEventBridgeCreateRequestData: description: Amazon EventBridge create request data. properties: attributes: $ref: "#/components/schemas/AWSEventBridgeCreateRequestAttributes" type: $ref: "#/components/schemas/AWSEventBridgeType" required: - attributes - type type: object AWSEventBridgeCreateResponse: description: Amazon EventBridge create response body. properties: data: $ref: "#/components/schemas/AWSEventBridgeCreateResponseData" required: - data type: object AWSEventBridgeCreateResponseAttributes: description: A created EventBridge source. properties: event_source_name: description: The event source name. example: "app-alerts-zyxw3210" type: string has_bus: description: True if the event bus was created in addition to the source. example: true type: boolean region: description: |- The event source's [AWS region](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). example: "us-east-1" type: string status: $ref: "#/components/schemas/AWSEventBridgeCreateStatus" type: object AWSEventBridgeCreateResponseData: description: Amazon EventBridge create response data. properties: attributes: $ref: "#/components/schemas/AWSEventBridgeCreateResponseAttributes" id: default: "create_event_bridge" description: The ID of the Amazon EventBridge create response data. example: "create_event_bridge" type: string type: $ref: "#/components/schemas/AWSEventBridgeType" required: - attributes - type type: object AWSEventBridgeCreateStatus: description: The event source status "created". enum: ["created"] example: created type: string x-enum-varnames: ["CREATED"] AWSEventBridgeDeleteRequest: description: Amazon EventBridge delete request body. properties: data: $ref: "#/components/schemas/AWSEventBridgeDeleteRequestData" required: - data type: object AWSEventBridgeDeleteRequestAttributes: description: The EventBridge source to be deleted. properties: account_id: $ref: "#/components/schemas/AWSAccountID" event_generator_name: description: The event source name. example: "app-alerts-zyxw3210" type: string region: description: |- The event source's [AWS region](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). example: "us-east-1" type: string required: - account_id - event_generator_name - region type: object AWSEventBridgeDeleteRequestData: description: Amazon EventBridge delete request data. properties: attributes: $ref: "#/components/schemas/AWSEventBridgeDeleteRequestAttributes" type: $ref: "#/components/schemas/AWSEventBridgeType" required: - attributes - type type: object AWSEventBridgeDeleteResponse: description: Amazon EventBridge delete response body. properties: data: $ref: "#/components/schemas/AWSEventBridgeDeleteResponseData" required: - data type: object AWSEventBridgeDeleteResponseAttributes: description: The EventBridge source delete response attributes. properties: status: $ref: "#/components/schemas/AWSEventBridgeDeleteStatus" type: object AWSEventBridgeDeleteResponseData: description: Amazon EventBridge delete response data. properties: attributes: $ref: "#/components/schemas/AWSEventBridgeDeleteResponseAttributes" id: default: "delete_event_bridge" description: The ID of the Amazon EventBridge list response data. example: "delete_event_bridge" type: string type: $ref: "#/components/schemas/AWSEventBridgeType" required: - attributes - type type: object AWSEventBridgeDeleteStatus: description: The event source status "empty". enum: ["empty"] example: empty type: string x-enum-varnames: ["EMPTY"] AWSEventBridgeListResponse: description: Amazon EventBridge list response body. properties: data: $ref: "#/components/schemas/AWSEventBridgeListResponseData" required: - data type: object AWSEventBridgeListResponseAttributes: description: An object describing the EventBridge configuration for multiple accounts. properties: accounts: description: List of accounts with their event sources. items: $ref: "#/components/schemas/AWSEventBridgeAccountConfiguration" type: array is_installed: description: True if the EventBridge integration is enabled for your organization. type: boolean type: object AWSEventBridgeListResponseData: description: Amazon EventBridge list response data. properties: attributes: $ref: "#/components/schemas/AWSEventBridgeListResponseAttributes" id: default: "get_event_bridge" description: The ID of the Amazon EventBridge list response data. example: "get_event_bridge" type: string type: $ref: "#/components/schemas/AWSEventBridgeType" required: - attributes - id - type type: object AWSEventBridgeSource: description: An EventBridge source. properties: name: description: The event source name. example: "app-alerts-zyxw3210" type: string region: description: |- The event source's [AWS region](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). example: "us-east-1" type: string type: object AWSEventBridgeType: default: "event_bridge" description: Amazon EventBridge resource type. enum: - event_bridge example: "event_bridge" type: string x-enum-varnames: - EVENT_BRIDGE AWSIntegration: description: The definition of `AWSIntegration` object. properties: credentials: $ref: "#/components/schemas/AWSCredentials" type: $ref: "#/components/schemas/AWSIntegrationType" required: - type - credentials type: object AWSIntegrationIamPermissionsResponse: description: AWS Integration IAM Permissions response body. properties: data: $ref: "#/components/schemas/AWSIntegrationIamPermissionsResponseData" required: - data type: object AWSIntegrationIamPermissionsResponseAttributes: description: AWS Integration IAM Permissions response attributes. properties: permissions: description: List of AWS IAM permissions required for the integration. example: - "account:GetContactInformation" - "amplify:ListApps" - "amplify:ListArtifacts" - "amplify:ListBackendEnvironments" - "amplify:ListBranches" items: description: An AWS IAM permission required for the Datadog integration. example: "account:GetContactInformation" type: string type: array required: - permissions type: object AWSIntegrationIamPermissionsResponseData: description: AWS Integration IAM Permissions response data. properties: attributes: $ref: "#/components/schemas/AWSIntegrationIamPermissionsResponseAttributes" id: default: "permissions" description: The `AWSIntegrationIamPermissionsResponseData` `id`. example: "permissions" type: string type: $ref: "#/components/schemas/AWSIntegrationIamPermissionsResponseDataType" type: object AWSIntegrationIamPermissionsResponseDataType: default: "permissions" description: The `AWSIntegrationIamPermissionsResponseData` `type`. enum: - permissions example: "permissions" type: string x-enum-varnames: - PERMISSIONS AWSIntegrationType: description: The definition of `AWSIntegrationType` object. enum: - AWS example: AWS type: string x-enum-varnames: - AWS AWSIntegrationUpdate: description: The definition of `AWSIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/AWSCredentialsUpdate" type: $ref: "#/components/schemas/AWSIntegrationType" required: - type type: object AWSLambdaForwarderConfig: description: |- Log Autosubscription configuration for Datadog Forwarder Lambda functions. Automatically set up triggers for existing and new logs for some services, ensuring no logs from new resources are missed and saving time spent on manual configuration. properties: lambdas: description: List of Datadog Lambda Log Forwarder ARNs in your AWS account. Defaults to `[]`. items: description: The ARN of a Datadog Lambda Log Forwarder function. example: "arn:aws:lambda:us-east-1:123456789012:function:DatadogLambdaLogForwarder" type: string type: array log_source_config: $ref: "#/components/schemas/AWSLambdaForwarderConfigLogSourceConfig" sources: description: |- List of service IDs set to enable automatic log collection. Discover the list of available services with the [Get list of AWS log ready services](https://docs.datadoghq.com/api/latest/aws-logs-integration/#get-list-of-aws-log-ready-services) endpoint. items: description: An AWS service ID for which automatic log collection is enabled. example: s3 type: string type: array type: object AWSLambdaForwarderConfigLogSourceConfig: description: Log source configuration. properties: tag_filters: description: List of AWS log source tag filters. Defaults to `[]`. items: $ref: "#/components/schemas/AWSLogSourceTagFilter" type: array type: object AWSLogSourceTagFilter: description: |- AWS log source tag filter list. Defaults to `[]`. Array of log source to AWS resource tag mappings. Each mapping contains a log source and its associated AWS resource tags (in `key:value` format) used to filter logs submitted to Datadog. Tag filters are applied for tags on the AWS resource emitting logs; tags associated with the log storage entity (such as a CloudWatch Log Group or S3 Bucket) are not considered. For more information on resource tag filter syntax, [see AWS resource exclusion](https://docs.datadoghq.com/account_management/billing/aws/#aws-resource-exclusion) in the AWS integration billing page. properties: source: description: The AWS log source to which the tag filters defined in `tags` are applied. example: "s3" type: string tags: description: The AWS resource tags to filter on for the log source specified by `source`. items: description: Tag in the form `key:value`. example: "env:prod" type: string nullable: true type: array type: object AWSLogsConfig: description: AWS Logs Collection config. properties: lambda_forwarder: $ref: "#/components/schemas/AWSLambdaForwarderConfig" type: object AWSLogsServicesResponse: description: AWS Logs Services response body properties: data: $ref: "#/components/schemas/AWSLogsServicesResponseData" required: - data type: object AWSLogsServicesResponseAttributes: description: AWS Logs Services response body properties: logs_services: description: List of AWS services that can send logs to Datadog example: - "s3" items: description: The name of an AWS service that can send logs to Datadog. example: "s3" type: string type: array required: - logs_services type: object AWSLogsServicesResponseData: description: AWS Logs Services response body properties: attributes: $ref: "#/components/schemas/AWSLogsServicesResponseAttributes" id: default: "logs_services" description: The `AWSLogsServicesResponseData` `id`. example: "logs_services" type: string type: $ref: "#/components/schemas/AWSLogsServicesResponseDataType" required: - id - type type: object AWSLogsServicesResponseDataType: default: "logs_services" description: The `AWSLogsServicesResponseData` `type`. enum: - logs_services example: "logs_services" type: string x-enum-varnames: - LOGS_SERVICES AWSMetricNameFilterPreviewDDName: description: A Datadog metric name and whether it is filtered. properties: filtered: description: Whether this Datadog metric name is filtered out. example: true type: boolean name: description: The Datadog metric name. example: "aws.ec2.network_in" type: string required: - name - filtered type: object AWSMetricNameFilterPreviewFilterMatch: description: A metric name filter pattern and how many metrics it matched. properties: match_count: description: The number of Datadog metric names matched by this pattern. example: 1 format: int64 type: integer pattern: description: The metric name filter pattern. example: "aws.ec2.network_in" type: string required: - pattern - match_count type: object AWSMetricNameFilterPreviewMetric: description: A CloudWatch metric and the Datadog metric names it produces. properties: cw_name: description: The CloudWatch metric name. example: "NetworkIn" type: string dd_names: description: The Datadog metric names produced from this CloudWatch metric. items: $ref: "#/components/schemas/AWSMetricNameFilterPreviewDDName" type: array required: - cw_name - dd_names type: object AWSMetricNameFilterPreviewNamespace: description: The metric name filter preview for a single namespace. properties: filters: description: The metric name filter patterns evaluated for this namespace and how many metrics they matched. items: $ref: "#/components/schemas/AWSMetricNameFilterPreviewFilterMatch" type: array metrics: description: |- The CloudWatch metrics collected for this namespace and whether each resulting Datadog metric is filtered. items: $ref: "#/components/schemas/AWSMetricNameFilterPreviewMetric" type: array namespace: description: The AWS CloudWatch namespace. example: "AWS/EC2" type: string required: - namespace - filters - metrics type: object AWSMetricNameFilterPreviewRequest: description: AWS metric name filter preview request body. properties: data: $ref: "#/components/schemas/AWSMetricNameFilterPreviewRequestData" required: - data type: object AWSMetricNameFilterPreviewRequestAttributes: description: AWS metric name filter preview request attributes. properties: metric_name_filters: description: The metric name filters to preview. items: $ref: "#/components/schemas/AWSMetricNameFilters" type: array required: - metric_name_filters type: object AWSMetricNameFilterPreviewRequestData: description: AWS metric name filter preview request data. properties: attributes: $ref: "#/components/schemas/AWSMetricNameFilterPreviewRequestAttributes" type: $ref: "#/components/schemas/AWSMetricNameFilterPreviewType" required: - type - attributes type: object AWSMetricNameFilterPreviewResponse: description: AWS metric name filter preview response body. properties: data: $ref: "#/components/schemas/AWSMetricNameFilterPreviewResponseData" required: - data type: object AWSMetricNameFilterPreviewResponseAttributes: description: AWS metric name filter preview response attributes. properties: namespaces: description: The list of namespaces affected by the previewed metric name filters. items: $ref: "#/components/schemas/AWSMetricNameFilterPreviewNamespace" type: array required: - namespaces type: object AWSMetricNameFilterPreviewResponseData: description: AWS metric name filter preview response data. properties: attributes: $ref: "#/components/schemas/AWSMetricNameFilterPreviewResponseAttributes" id: $ref: "#/components/schemas/AWSAccountConfigID" type: $ref: "#/components/schemas/AWSMetricNameFilterPreviewType" required: - id - type - attributes type: object AWSMetricNameFilterPreviewType: default: "metric_name_filter_preview" description: The `AWSMetricNameFilterPreviewResponseData` `type`. enum: - metric_name_filter_preview example: "metric_name_filter_preview" type: string x-enum-varnames: - METRIC_NAME_FILTER_PREVIEW AWSMetricNameFilters: description: |- AWS CloudWatch metric name filter for a single namespace. Exactly one of `include_only` or `exclude_only` must be set. oneOf: - $ref: "#/components/schemas/AWSMetricNameFiltersIncludeOnly" - $ref: "#/components/schemas/AWSMetricNameFiltersExcludeOnly" AWSMetricNameFiltersExcludeOnly: description: Exclude metric names matching one of these patterns for a single namespace. properties: exclude_only: description: Exclude metric names matching one of these patterns. example: - "aws.ec2.network_in" items: description: A metric name pattern to exclude. example: "aws.ec2.network_in" type: string type: array namespace: description: The AWS CloudWatch namespace to which this metric name filter applies. example: "AWS/EC2" type: string required: - namespace - exclude_only type: object AWSMetricNameFiltersIncludeOnly: description: Include only metric names matching one of these patterns for a single namespace. properties: include_only: description: Include only metric names matching one of these patterns. example: - "aws.ec2.network_in" items: description: A metric name pattern to include. example: "aws.ec2.network_in" type: string type: array namespace: description: The AWS CloudWatch namespace to which this metric name filter applies. example: "AWS/EC2" type: string required: - namespace - include_only type: object AWSMetricsConfig: description: AWS Metrics Collection config. properties: automute_enabled: description: Enable EC2 automute for AWS metrics. Defaults to `true`. example: true type: boolean collect_cloudwatch_alarms: description: Enable CloudWatch alarms collection. Defaults to `false`. example: false type: boolean collect_custom_metrics: description: Enable custom metrics collection. Defaults to `false`. example: false type: boolean collect_service_quotas: description: Enable Service Quotas collection. Defaults to `false`. example: false type: boolean enabled: description: Enable AWS metrics collection. Defaults to `true`. example: true type: boolean metric_name_filters: description: |- AWS CloudWatch metric name filters. Each filter applies to a single namespace. Exactly one of `include_only` or `exclude_only` must be set on each filter. items: $ref: "#/components/schemas/AWSMetricNameFilters" type: array namespace_filters: $ref: "#/components/schemas/AWSNamespaceFilters" resource_type_tag_filters: description: AWS Metrics collection resource type tag filters list. Defaults to `[]`. items: $ref: "#/components/schemas/AWSResourceTypeTagFilter" type: array tag_filters: deprecated: true description: |- AWS Metrics collection tag filters list. Defaults to `[]`. Deprecated in favor of `resource_type_tag_filters`. The two fields are mutually exclusive on an account. items: $ref: "#/components/schemas/AWSNamespaceTagFilter" type: array type: object AWSNamespaceFilters: description: AWS Metrics namespace filters. Defaults to `exclude_only`. oneOf: - $ref: "#/components/schemas/AWSNamespaceFiltersExcludeOnly" - $ref: "#/components/schemas/AWSNamespaceFiltersIncludeOnly" AWSNamespaceFiltersExcludeOnly: description: |- Exclude only these namespaces from metrics collection. Defaults to `["AWS/SQS", "AWS/ElasticMapReduce", "AWS/Usage"]`. `AWS/SQS`, `AWS/ElasticMapReduce`, and `AWS/Usage` are excluded by default to reduce your AWS CloudWatch costs from `GetMetricData` API calls. properties: exclude_only: description: |- Exclude only these namespaces from metrics collection. Defaults to `["AWS/SQS", "AWS/ElasticMapReduce", "AWS/Usage"]`. `AWS/SQS`, `AWS/ElasticMapReduce`, and `AWS/Usage` are excluded by default to reduce your AWS CloudWatch costs from `GetMetricData` API calls. example: - "AWS/SQS" - "AWS/ElasticMapReduce" - "AWS/Usage" items: description: An AWS CloudWatch namespace to exclude from metrics collection. example: "AWS/SQS" type: string type: array required: - exclude_only type: object AWSNamespaceFiltersIncludeOnly: description: Include only these namespaces. properties: include_only: description: Include only these namespaces. example: - "AWS/EC2" items: description: An AWS CloudWatch namespace to include in metrics collection. example: "AWS/EC2" type: string type: array required: - include_only type: object AWSNamespaceTagFilter: description: |- AWS Metrics Collection tag filters list. Defaults to `[]`. The array of custom AWS resource tags (in the form `key:value`) defines a filter that Datadog uses when collecting metrics from a specified service. Wildcards, such as `?` (match a single character) and `*` (match multiple characters), and exclusion using `!` before the tag are supported. For EC2, only hosts that match one of the defined tags are imported into Datadog. The rest are ignored. For example, `env:production,instance-type:c?.*,!region:us-east-1`. properties: namespace: description: The AWS service for which the tag filters defined in `tags` will be applied. example: "AWS/EC2" type: string tags: description: The AWS resource tags to filter on for the service specified by `namespace`. items: description: Tag in the form `key:value`. example: "datadog:true" type: string nullable: true type: array type: object AWSNamespacesResponse: description: AWS Namespaces response body. properties: data: $ref: "#/components/schemas/AWSNamespacesResponseData" required: - data type: object AWSNamespacesResponseAttributes: description: AWS Namespaces response attributes. properties: namespaces: description: AWS CloudWatch namespace. example: - "AWS/ApiGateway" items: description: An AWS CloudWatch namespace name. example: "AWS/ApiGateway" type: string type: array required: - namespaces type: object AWSNamespacesResponseData: description: AWS Namespaces response data. properties: attributes: $ref: "#/components/schemas/AWSNamespacesResponseAttributes" id: default: "namespaces" description: The `AWSNamespacesResponseData` `id`. example: "namespaces" type: string type: $ref: "#/components/schemas/AWSNamespacesResponseDataType" required: - id - type type: object AWSNamespacesResponseDataType: default: "namespaces" description: The `AWSNamespacesResponseData` `type`. enum: - namespaces example: "namespaces" type: string x-enum-varnames: - NAMESPACES AWSNewExternalIDResponse: description: AWS External ID response body. properties: data: $ref: "#/components/schemas/AWSNewExternalIDResponseData" required: - data type: object AWSNewExternalIDResponseAttributes: description: AWS External ID response body. properties: external_id: description: AWS IAM External ID for associated role. example: "acb8f6b8a844443dbb726d07dcb1a870" type: string required: - external_id type: object AWSNewExternalIDResponseData: description: AWS External ID response body. properties: attributes: $ref: "#/components/schemas/AWSNewExternalIDResponseAttributes" id: default: "external_id" description: The `AWSNewExternalIDResponseData` `id`. example: "external_id" type: string type: $ref: "#/components/schemas/AWSNewExternalIDResponseDataType" required: - id - type type: object AWSNewExternalIDResponseDataType: default: "external_id" description: The `AWSNewExternalIDResponseData` `type`. enum: - external_id example: "external_id" type: string x-enum-varnames: - EXTERNAL_ID AWSRegions: description: AWS Regions to collect data from. Defaults to `include_all`. oneOf: - $ref: "#/components/schemas/AWSRegionsIncludeAll" - $ref: "#/components/schemas/AWSRegionsIncludeOnly" AWSRegionsIncludeAll: description: Include all regions. Defaults to `true`. properties: include_all: description: Include all regions. example: true type: boolean required: - include_all type: object AWSRegionsIncludeOnly: description: Include only these regions. properties: include_only: description: Include only these regions. example: - "us-east-1" items: description: An AWS region to include in metrics collection. example: "us-east-1" type: string type: array required: - include_only type: object AWSResourceTypeTagFilter: description: |- AWS Metrics Collection resource type tag filter. Each filter targets either a specific AWS service's resource types (`service` and `resource_types`) or custom metrics (`custom`). These two modes are mutually exclusive. The `expression` defines a tag filter that Datadog uses when collecting metrics from the resource types of a specified service. Wildcards, such as `?` (match a single character) and `*` (match multiple characters), and exclusion using `!` before the tag are supported. For example, `env:production AND instance-type:c?.* AND !region:us-east-1`. properties: custom: description: Whether the tag filter applies to custom metrics. When `true`, `service` and `resource_types` must be omitted. example: false type: boolean expression: description: The tag filter expression to apply when collecting metrics for the matching resource types. example: "env:production" type: string resource_types: description: The AWS resource types of the service to which the tag filter applies. Required when `service` is set. Use `*` as the only entry to match all resource types of the service; `*` cannot be combined with specific resource types. items: description: An AWS resource type of the service. example: "instance" type: string type: array service: description: The AWS service for which the tag filter defined in `expression` will be applied. Required unless `custom` is `true`, and must be set together with `resource_types`. example: "ec2" type: string required: - expression type: object AWSResourcesConfig: description: AWS Resources Collection config. properties: cloud_security_posture_management_collection: description: |- Enable Cloud Security Management to scan AWS resources for vulnerabilities, misconfigurations, identity risks, and compliance violations. Defaults to `false`. Requires `extended_collection` to be set to `true`. example: false type: boolean extended_collection: description: |- Whether Datadog collects additional attributes and configuration information about the resources in your AWS account. Defaults to `true`. Required for `cloud_security_posture_management_collection`. example: true type: boolean type: object AWSTracesConfig: description: AWS Traces Collection config. properties: xray_services: $ref: "#/components/schemas/XRayServicesList" type: object AccessTokenListItem: description: An access token entry returned by the personal access tokens list endpoint. May represent either a personal or a service access token. properties: attributes: $ref: "#/components/schemas/PersonalAccessTokenAttributes" id: description: ID of the access token. type: string relationships: $ref: "#/components/schemas/AccessTokenListItemRelationships" type: $ref: "#/components/schemas/AccessTokensType" type: object AccessTokenListItemRelationships: description: Resources related to the access token entry in the mixed list response. properties: leak_information: $ref: "#/components/schemas/RelationshipToLeakedKey" owned_by: $ref: "#/components/schemas/RelationshipToAccessTokenOwner" type: object AccessTokenOwnerType: description: Owner resource type. Either a user or a service account. enum: - users - service_account example: users type: string x-enum-varnames: - USERS - SERVICE_ACCOUNT AccessTokenResponseIncludedArray: description: Array of objects related to the access tokens. items: $ref: "#/components/schemas/AccessTokenResponseIncludedItem" type: array AccessTokenResponseIncludedItem: description: An object related to an access token. oneOf: - $ref: "#/components/schemas/LeakedKey" AccessTokensType: description: Resource type returned by the access tokens list endpoint. Includes both personal and service access tokens. enum: - personal_access_tokens - service_access_tokens example: personal_access_tokens type: string x-enum-varnames: - PERSONAL_ACCESS_TOKENS - SERVICE_ACCESS_TOKENS AccountFilteringConfig: description: The account filtering configuration. properties: excluded_accounts: description: The AWS account IDs to be excluded from your billing dataset. This field is used when `include_new_accounts` is `true`. example: ["123456789123", "123456789143"] items: description: An AWS account ID to exclude from the billing dataset. type: string type: array include_new_accounts: description: Whether or not to automatically include new member accounts by default in your billing dataset. example: true nullable: true type: boolean included_accounts: description: The AWS account IDs to be included in your billing dataset. This field is used when `include_new_accounts` is `false`. example: ["123456789123", "123456789143"] items: description: An AWS account ID to include in the billing dataset. type: string type: array type: object AccountFilters: description: The account filters for a cloud account. properties: attributes: $ref: "#/components/schemas/AccountFiltersAttributes" id: description: The ID of the cloud account. example: "123456789123" type: string type: $ref: "#/components/schemas/AccountFiltersType" required: - attributes - type type: object AccountFiltersAttributes: description: Attributes for the account filters of a cloud account. properties: account_filters: $ref: "#/components/schemas/AccountFilteringConfig" account_id: description: The cloud account ID. example: "123456789123" type: string cloud: description: The cloud provider of the account, for example `aws`, `aws_cur2`, or `oci`. example: "aws_cur2" type: string type: object AccountFiltersPatchData: description: Account filters patch data. properties: attributes: $ref: "#/components/schemas/AccountFiltersPatchRequestAttributes" type: $ref: "#/components/schemas/AccountFiltersPatchRequestType" required: - attributes - type type: object AccountFiltersPatchRequest: description: Account filters patch request. properties: data: $ref: "#/components/schemas/AccountFiltersPatchData" required: - data type: object AccountFiltersPatchRequestAttributes: description: Attributes for an account filters patch request. properties: account_filters: $ref: "#/components/schemas/AccountFilteringConfig" required: - account_filters type: object AccountFiltersPatchRequestType: default: account_filters_patch_request description: Type of account filters patch request. enum: - account_filters_patch_request example: account_filters_patch_request type: string x-enum-varnames: - ACCOUNT_FILTERS_PATCH_REQUEST AccountFiltersResponse: description: Response containing the account filters for a cloud account. properties: data: $ref: "#/components/schemas/AccountFilters" type: object AccountFiltersType: default: account_filters description: Type of account filters. enum: - account_filters example: account_filters type: string x-enum-varnames: - ACCOUNT_FILTERS ActionConnectionAWSSecretsManager: description: >- AWS Secrets Manager settings shared by the credential references on a `DATACENTER` connection. These settings are required whenever a field uses an AWS Secrets Manager reference. nullable: true properties: connection_id: description: >- ID of the AWS connection used to retrieve secrets. This connection must be in the same Datadog organization. example: 00000000-0000-0000-0000-000000000001 type: string region: description: AWS region containing the referenced secrets. example: us-east-1 minLength: 1 type: string type: $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerType" required: - type - connection_id - region type: object ActionConnectionAWSSecretsManagerReference: description: >- Reference to a string value in AWS Secrets Manager. The connection must also specify `external_secrets_manager` settings. AWS Secrets Manager references are supported for token-based credentials and HTTP authentication tokens on `DATACENTER` connections. properties: key: description: >- Top-level JSON key to extract from the secret string. Omit this field to use the entire secret string. example: private_key type: string secret_id: description: Name or ARN of the AWS Secrets Manager secret. example: example/gcp/service-account minLength: 1 type: string type: $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerType" version_id: description: >- ID of the secret version to retrieve. Cannot be used together with `version_stage`. If both are omitted, the current version is used. type: string version_stage: description: >- Staging label of the secret version to retrieve. Cannot be used together with `version_id`. If both are omitted, the current version is used. example: AWSCURRENT type: string required: - type - secret_id type: object ActionConnectionAWSSecretsManagerType: description: AWS Secrets Manager secret backend. enum: - aws_secrets_manager example: aws_secrets_manager type: string x-enum-varnames: - AWS_SECRETS_MANAGER ActionConnectionAttributes: description: The definition of `ActionConnectionAttributes` object. properties: external_secrets_manager: $ref: "#/components/schemas/ActionConnectionAWSSecretsManager" integration: $ref: "#/components/schemas/ActionConnectionIntegration" name: description: Name of the connection example: My AWS Connection type: string tags: description: |- Tags associated with the connection. Each tag must follow the `key:value` format. The `default` tag key is reserved. example: - env:prod - team:action-platform items: description: A non-reserved tag in `key:value` format. pattern: "^[A-Za-z0-9._/-]+:[A-Za-z0-9._/-]+$" type: string type: array required: - name - integration type: object ActionConnectionAttributesUpdate: description: The definition of `ActionConnectionAttributesUpdate` object. properties: external_secrets_manager: $ref: "#/components/schemas/ActionConnectionAWSSecretsManager" integration: $ref: "#/components/schemas/ActionConnectionIntegrationUpdate" name: description: Name of the connection example: My AWS Connection type: string tags: description: |- Tags associated with the connection. Each tag must follow the `key:value` format. The `default` tag key is reserved. example: - env:prod - team:action-platform items: description: A non-reserved tag in `key:value` format. pattern: "^[A-Za-z0-9._/-]+:[A-Za-z0-9._/-]+$" type: string type: array type: object ActionConnectionData: description: Data related to the connection. properties: attributes: $ref: "#/components/schemas/ActionConnectionAttributes" id: description: The connection identifier readOnly: true type: string type: $ref: "#/components/schemas/ActionConnectionDataType" required: - type - attributes type: object ActionConnectionDataType: description: The definition of `ActionConnectionDataType` object. enum: - action_connection example: action_connection type: string x-enum-varnames: - ACTION_CONNECTION ActionConnectionDataUpdate: description: Data related to the connection update. properties: attributes: $ref: "#/components/schemas/ActionConnectionAttributesUpdate" type: $ref: "#/components/schemas/ActionConnectionDataType" required: - type - attributes type: object ActionConnectionIntegration: description: The definition of `ActionConnectionIntegration` object. oneOf: - $ref: "#/components/schemas/AWSIntegration" - $ref: "#/components/schemas/AnthropicIntegration" - $ref: "#/components/schemas/AsanaIntegration" - $ref: "#/components/schemas/AzureIntegration" - $ref: "#/components/schemas/CircleCIIntegration" - $ref: "#/components/schemas/ClickupIntegration" - $ref: "#/components/schemas/CloudflareIntegration" - $ref: "#/components/schemas/ConfigCatIntegration" - $ref: "#/components/schemas/DatadogIntegration" - $ref: "#/components/schemas/FastlyIntegration" - $ref: "#/components/schemas/FreshserviceIntegration" - $ref: "#/components/schemas/GCPIntegration" - $ref: "#/components/schemas/GeminiIntegration" - $ref: "#/components/schemas/GitlabIntegration" - $ref: "#/components/schemas/GreyNoiseIntegration" - $ref: "#/components/schemas/HTTPIntegration" - $ref: "#/components/schemas/LaunchDarklyIntegration" - $ref: "#/components/schemas/NotionIntegration" - $ref: "#/components/schemas/OktaIntegration" - $ref: "#/components/schemas/OpenAIIntegration" - $ref: "#/components/schemas/ServiceNowIntegration" - $ref: "#/components/schemas/SplitIntegration" - $ref: "#/components/schemas/StatsigIntegration" - $ref: "#/components/schemas/VirusTotalIntegration" ActionConnectionIntegrationUpdate: description: The definition of `ActionConnectionIntegrationUpdate` object. oneOf: - $ref: "#/components/schemas/AWSIntegrationUpdate" - $ref: "#/components/schemas/AnthropicIntegrationUpdate" - $ref: "#/components/schemas/AsanaIntegrationUpdate" - $ref: "#/components/schemas/AzureIntegrationUpdate" - $ref: "#/components/schemas/CircleCIIntegrationUpdate" - $ref: "#/components/schemas/ClickupIntegrationUpdate" - $ref: "#/components/schemas/CloudflareIntegrationUpdate" - $ref: "#/components/schemas/ConfigCatIntegrationUpdate" - $ref: "#/components/schemas/DatadogIntegrationUpdate" - $ref: "#/components/schemas/FastlyIntegrationUpdate" - $ref: "#/components/schemas/FreshserviceIntegrationUpdate" - $ref: "#/components/schemas/GCPIntegrationUpdate" - $ref: "#/components/schemas/GeminiIntegrationUpdate" - $ref: "#/components/schemas/GitlabIntegrationUpdate" - $ref: "#/components/schemas/GreyNoiseIntegrationUpdate" - $ref: "#/components/schemas/HTTPIntegrationUpdate" - $ref: "#/components/schemas/LaunchDarklyIntegrationUpdate" - $ref: "#/components/schemas/NotionIntegrationUpdate" - $ref: "#/components/schemas/OktaIntegrationUpdate" - $ref: "#/components/schemas/OpenAIIntegrationUpdate" - $ref: "#/components/schemas/ServiceNowIntegrationUpdate" - $ref: "#/components/schemas/SplitIntegrationUpdate" - $ref: "#/components/schemas/StatsigIntegrationUpdate" - $ref: "#/components/schemas/VirusTotalIntegrationUpdate" ActionConnectionLiteralValue: description: A literal string value for a connection credential. type: string ActionQuery: description: An action query. This query type is used to trigger an action, such as sending a HTTP request. properties: events: description: Events to listen for downstream of the action query. items: $ref: "#/components/schemas/AppBuilderEvent" type: array id: description: The ID of the action query. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string name: description: A unique identifier for this action query. This name is also used to access the query's result throughout the app. example: "fetchPendingOrders" type: string properties: $ref: "#/components/schemas/ActionQueryProperties" type: $ref: "#/components/schemas/ActionQueryType" required: - id - name - type - properties type: object ActionQueryCondition: description: Whether to run this query. If specified, the query will only run if this condition evaluates to `true` in JavaScript and all other conditions are also met. oneOf: - type: boolean - example: "${true}" type: string ActionQueryDebounceInMs: description: The minimum time in milliseconds that must pass before the query can be triggered again. This is useful for preventing accidental double-clicks from triggering the query multiple times. oneOf: - example: 310.5 format: double type: number - description: "If this is a string, it must be a valid JavaScript expression that evaluates to a number." example: "${1000}" type: string ActionQueryMockedOutputs: description: The mocked outputs of the action query. This is useful for testing the app without actually running the action. oneOf: - type: string - $ref: "#/components/schemas/ActionQueryMockedOutputsObject" ActionQueryMockedOutputsEnabled: description: Whether to enable the mocked outputs for testing. example: false oneOf: - type: boolean - description: "If this is a string, it must be a valid JavaScript expression that evaluates to a boolean." example: "${true}" type: string ActionQueryMockedOutputsObject: description: The mocked outputs of the action query. properties: enabled: $ref: "#/components/schemas/ActionQueryMockedOutputsEnabled" outputs: description: The mocked outputs of the action query, serialized as JSON. example: '{"status": "success"}' type: string required: - enabled type: object ActionQueryOnlyTriggerManually: description: Determines when this query is executed. If set to `false`, the query will run when the app loads and whenever any query arguments change. If set to `true`, the query will only run when manually triggered from elsewhere in the app. oneOf: - type: boolean - description: "If this is a string, it must be a valid JavaScript expression that evaluates to a boolean." example: "${true}" type: string ActionQueryPollingIntervalInMs: description: If specified, the app will poll the query at the specified interval in milliseconds. The minimum polling interval is 15 seconds. The query will only poll when the app's browser tab is active. oneOf: - example: 30000.0 format: double minimum: 15000.0 type: number - description: "If this is a string, it must be a valid JavaScript expression that evaluates to a number." example: "${15000}" type: string ActionQueryProperties: description: The properties of the action query. properties: condition: $ref: "#/components/schemas/ActionQueryCondition" debounceInMs: $ref: "#/components/schemas/ActionQueryDebounceInMs" mockedOutputs: $ref: "#/components/schemas/ActionQueryMockedOutputs" onlyTriggerManually: $ref: "#/components/schemas/ActionQueryOnlyTriggerManually" outputs: description: The post-query transformation function, which is a JavaScript function that changes the query's `.outputs` property after the query's execution. example: "${((outputs) => {return outputs.body.data})(self.rawOutputs)}" type: string pollingIntervalInMs: $ref: "#/components/schemas/ActionQueryPollingIntervalInMs" requiresConfirmation: $ref: "#/components/schemas/ActionQueryRequiresConfirmation" showToastOnError: $ref: "#/components/schemas/ActionQueryShowToastOnError" spec: $ref: "#/components/schemas/ActionQuerySpec" required: - spec type: object ActionQueryRequiresConfirmation: description: Whether to prompt the user to confirm this query before it runs. oneOf: - type: boolean - description: "If this is a string, it must be a valid JavaScript expression that evaluates to a boolean." example: "${true}" type: string ActionQueryShowToastOnError: description: Whether to display a toast to the user when the query returns an error. oneOf: - type: boolean - description: "If this is a string, it must be a valid JavaScript expression that evaluates to a boolean." example: "${true}" type: string ActionQuerySpec: description: The definition of the action query. example: "" oneOf: - type: string - $ref: "#/components/schemas/ActionQuerySpecObject" ActionQuerySpecConnectionGroup: description: The connection group to use for an action query. properties: id: description: The ID of the connection group. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string tags: description: The tags of the connection group. items: description: A tag for the connection group. type: string type: array type: object ActionQuerySpecInput: additionalProperties: {} description: The inputs to the action query. See the [Actions Catalog](https://docs.datadoghq.com/actions/actions_catalog/) for more detail on each action and its inputs. type: object ActionQuerySpecInputs: description: The inputs to the action query. These are the values that are passed to the action when it is triggered. oneOf: - type: string - $ref: "#/components/schemas/ActionQuerySpecInput" ActionQuerySpecObject: description: The action query spec object. properties: connectionGroup: $ref: "#/components/schemas/ActionQuerySpecConnectionGroup" connectionId: description: The ID of the custom connection to use for this action query. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 type: string fqn: description: The fully qualified name of the action type. example: "com.datadoghq.http.request" type: string inputs: $ref: "#/components/schemas/ActionQuerySpecInputs" required: - fqn type: object ActionQueryType: default: action description: The action query type. enum: - action example: action type: string x-enum-varnames: - ACTION ActiveBillingDimensionsAttributes: description: List of active billing dimensions. properties: month: description: "Datetime in ISO-8601 format, UTC, precise to hour: `[YYYY-MM-DDThh]`." format: date-time type: string values: description: "List of active billing dimensions. Example: `[infra_host, apm_host, serverless_infra]`." items: description: A given billing dimension in a list. example: "infra_host" type: string type: array type: object ActiveBillingDimensionsBody: description: Active billing dimensions data. properties: attributes: $ref: "#/components/schemas/ActiveBillingDimensionsAttributes" id: description: Unique ID of the response. type: string type: $ref: "#/components/schemas/ActiveBillingDimensionsType" type: object ActiveBillingDimensionsResponse: description: Active billing dimensions response. properties: data: $ref: "#/components/schemas/ActiveBillingDimensionsBody" type: object ActiveBillingDimensionsType: default: billing_dimensions description: Type of active billing dimensions data. enum: - billing_dimensions type: string x-enum-varnames: - BILLING_DIMENSIONS AddMemberTeamRequest: description: Request to add a member team to super team's hierarchy properties: data: $ref: "#/components/schemas/MemberTeam" required: - data type: object Advisory: description: Advisory. properties: base_severity: description: Advisory base severity. example: Critical type: string id: description: Advisory id. example: GHSA-4wrc-f8pq-fpqp type: string severity: description: Advisory Datadog severity. example: Medium type: string required: - id - base_severity type: object AgentHealthAgentType: default: node description: Agent type associated with the resource. enum: - node - cluster example: node type: string x-enum-varnames: - NODE - CLUSTER AgentHealthHostIssue: description: An active Agent Health issue associated with a resource. properties: category: description: The category used by the Agent to group and reconcile the issue. example: configuration type: string issue_id: description: The unique identifier of the issue. example: invalid-config:4828e7d6c704c4a3 type: string issue_name: description: The human-readable name of the issue. example: Invalid Config type: string issue_type: description: The machine-readable type of the issue. example: invalid_config type: string required: - issue_id - issue_name - issue_type - category type: object AgentHealthHostIssuesAttributes: description: Active Agent Health issues for a resource. properties: issues: description: The active issues and their reconciliation metadata. example: - category: configuration issue_id: invalid-config:4828e7d6c704c4a3 issue_name: Invalid Config issue_type: invalid_config items: $ref: "#/components/schemas/AgentHealthHostIssue" type: array required: - issues type: object AgentHealthHostIssuesData: description: Agent Health issue data for a resource. properties: attributes: $ref: "#/components/schemas/AgentHealthHostIssuesAttributes" id: description: The resource identifier. example: 123e4567-e89b-12d3-a456-426614174000 type: string type: $ref: "#/components/schemas/AgentHealthHostIssuesType" required: - id - type - attributes type: object AgentHealthHostIssuesResponse: description: Response containing the active Agent Health issues for a resource. properties: data: $ref: "#/components/schemas/AgentHealthHostIssuesData" required: - data type: object AgentHealthHostIssuesType: default: agent_health_issues description: The Agent Health issue resource type. enum: - agent_health_issues example: agent_health_issues type: string x-enum-varnames: - AGENT_HEALTH_ISSUES AgentTrigger: description: "Trigger a workflow from an agent via the MCP execute tool. Workflow can be executed from Bits Chat, Bits Agent Builder, Claude Code, Codex, Cursor, and any other coding agent using the Datadog MCP." properties: rateLimit: $ref: "#/components/schemas/TriggerRateLimit" type: object AgentTriggerWrapper: description: "Schema for an agent-based trigger." properties: agentTrigger: $ref: "#/components/schemas/AgentTrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - agentTrigger type: object AggregatedLongTasksByInvokerType: description: Aggregated long task statistics for a single invoker type. properties: criteria_view_occurrences: description: Number of sampled views where this invoker type had long tasks contributing to the criteria metric. example: 40 format: int32 maximum: 2147483647 type: integer impact_score: description: Rank-product impact score combining view frequency and blocking time severity. example: 0.4 format: double type: number invoker_type: description: Category of the long task invoker (for example, resolve-promise, user-callback). example: resolve-promise type: string stats_per_view: $ref: "#/components/schemas/LongTaskStatsPerView" top_invokers: description: Top invokers within this invoker type, sorted by impact score descending. items: $ref: "#/components/schemas/TopLongTaskInvoker" type: array view_occurrences: description: Number of sampled views where this invoker type had any long tasks. example: 68 format: int32 maximum: 2147483647 type: integer required: - invoker_type - view_occurrences - stats_per_view - top_invokers type: object AggregatedLongTasksRequest: description: Request body for the aggregated long tasks endpoint. properties: data: $ref: "#/components/schemas/AggregatedLongTasksRequestData" required: - data type: object AggregatedLongTasksRequestAttributes: description: Attributes for an aggregated long tasks query. properties: application_id: description: The RUM application ID to analyze. example: ccbc53b1-74f2-496b-bdd7-9a8fa7b7376b type: string criteria: $ref: "#/components/schemas/AggregatedWaterfallPerformanceCriteria" filter: description: RUM query string to filter events (for example, @session.type:user @geo.country:US). example: "@session.type:user" type: string from: description: Start of the time range as a Unix timestamp in seconds. example: 1762437564 format: int64 type: integer sample_size: description: Number of view instances to sample, between 1 and 500. example: 20 format: int32 maximum: 500 minimum: 1 type: integer to: description: End of the time range as a Unix timestamp in seconds. example: 1762523964 format: int64 type: integer view_name: description: The RUM view name to analyze (for example, /account/login). example: /account/login(/:type) type: string required: - application_id - view_name - from - to - sample_size type: object AggregatedLongTasksRequestData: description: Data envelope for an aggregated long tasks request. properties: attributes: $ref: "#/components/schemas/AggregatedLongTasksRequestAttributes" type: $ref: "#/components/schemas/AggregatedLongTasksRequestType" required: - type - attributes type: object AggregatedLongTasksRequestType: description: The JSON:API type for aggregated long tasks requests. enum: - aggregated_long_tasks example: aggregated_long_tasks type: string x-enum-varnames: - AGGREGATED_LONG_TASKS AggregatedLongTasksResponse: description: Response body for the aggregated long tasks endpoint. properties: data: $ref: "#/components/schemas/AggregatedLongTasksResponseData" required: - data type: object AggregatedLongTasksResponseAttributes: description: Attributes of an aggregated long tasks response. properties: application_id: description: The RUM application ID that was analyzed. example: ccbc53b1-74f2-496b-bdd7-9a8fa7b7376b type: string criteria: $ref: "#/components/schemas/AggregatedLongTasksResponseAttributesCriteria" from: description: Start of the analyzed time range as a Unix timestamp in seconds. example: 1762437564 format: int64 type: integer long_tasks_by_invoker_type: description: Long task statistics grouped by invoker type, sorted by impact score descending. items: $ref: "#/components/schemas/AggregatedLongTasksByInvokerType" type: array sampled_view_ids: description: List of RUM view IDs sampled for this aggregation, capped at 50. example: - 6fbf69b6-9455-436a-b894-a6bf64126d40 items: type: string type: array to: description: End of the analyzed time range as a Unix timestamp in seconds. example: 1762523964 format: int64 type: integer view_count: description: Number of view instances included in the analysis. example: 50 format: int32 maximum: 2147483647 type: integer view_name: description: The RUM view name that was analyzed. example: /account/login(/:type) type: string required: - view_name - application_id - view_count - from - to - criteria - sampled_view_ids - long_tasks_by_invoker_type type: object AggregatedLongTasksResponseAttributesCriteria: description: Performance criteria used to filter view instances by a metric threshold, or null if no criteria were applied. nullable: true properties: max: description: Maximum threshold in seconds (inclusive). example: 5.0 format: double type: number metric: $ref: "#/components/schemas/AggregatedWaterfallPerformanceCriteriaMetric" min: description: Minimum threshold in seconds (inclusive). example: 2.5 format: double type: number required: - metric type: object AggregatedLongTasksResponseData: description: Data envelope for an aggregated long tasks response. properties: attributes: $ref: "#/components/schemas/AggregatedLongTasksResponseAttributes" id: description: Hash-based unique identifier for this aggregation. example: 2f0b3455 type: string type: $ref: "#/components/schemas/AggregatedLongTasksRequestType" required: - id - type - attributes type: object AggregatedResource: description: Aggregated performance statistics for a single network resource across sampled view instances. properties: avg_duration_ms: description: Average total duration in milliseconds. example: 839.1 format: double type: number avg_start_time_ms: description: Average start time relative to view start in milliseconds. example: 1486.3 format: double type: number cache_hit_rate_pct: description: Cache hit rate as a percentage. example: 100.0 format: double type: number cached_count: description: Number of requests served from cache. example: 27 format: int32 maximum: 2147483647 type: integer downloaded_count: description: Number of requests downloaded from the network. example: 0 format: int32 maximum: 2147483647 type: integer global_p75_duration_ms: description: 75th percentile duration across all view names in the application, present when include_global_appearance is true. example: 500.0 format: double type: number global_view_name_count: description: Number of distinct view names in the application that load this resource, present when include_global_appearance is true. example: 3 format: int32 maximum: 2147483647 type: integer global_view_name_pct: description: Percentage of distinct view names in the application that load this resource, present when include_global_appearance is true. example: 30.0 format: double type: number http_method: description: HTTP method for the resource request. example: GET nullable: true type: string load_frequency_pct: description: Percentage of sampled view instances that loaded this resource. example: 54.0 format: double type: number local_cache_count: description: Number of requests served from the local browser cache without a network round trip. example: 20 format: int32 maximum: 2147483647 type: integer max_duration_ms: description: Maximum duration in milliseconds. example: 945.6 format: double type: number median_duration_ms: description: Median duration in milliseconds. example: 836.2 format: double type: number min_duration_ms: description: Minimum duration in milliseconds. example: 812.7 format: double type: number non_blocking_count: description: Number of requests reported by the browser as non-render-blocking. example: 23 format: int32 maximum: 2147483647 type: integer p75_duration_ms: description: 75th percentile duration in milliseconds. example: 844.1 format: double type: number p95_duration_ms: description: 95th percentile duration in milliseconds. example: 861.8 format: double type: number render_blocking_count: description: Number of requests reported by the browser as render-blocking. example: 4 format: int32 maximum: 2147483647 type: integer render_blocking_pct: description: Percentage of render-blocking requests among those reporting a render-blocking status. example: 14.8 format: double type: number resource_type: description: Resource type (JS, CSS, image, fetch, XHR, document, and so on). example: fetch nullable: true type: string resource_url_path_group: description: URL path group used to aggregate similar resources. example: /api/gallery type: string server_validated_cache_count: description: Number of cached requests revalidated by the server with a 304 response. example: 7 format: int32 maximum: 2147483647 type: integer timing_breakdown: $ref: "#/components/schemas/AggregatedResourceTimingBreakdown" total_requests: description: Total number of requests for this resource across all sampled views. example: 27 format: int32 maximum: 2147483647 type: integer views_with_resource: description: Number of sampled view instances that loaded this resource. example: 27 format: int32 maximum: 2147483647 type: integer required: - resource_url_path_group - resource_type - http_method - avg_start_time_ms - avg_duration_ms - p95_duration_ms - p75_duration_ms - median_duration_ms - min_duration_ms - max_duration_ms - timing_breakdown - total_requests - views_with_resource - load_frequency_pct - cached_count - downloaded_count - cache_hit_rate_pct - render_blocking_count - non_blocking_count - render_blocking_pct - local_cache_count - server_validated_cache_count type: object AggregatedResourceTimingBreakdown: description: Average timing breakdown per network phase for a resource. properties: avg_connect_ms: description: Average TCP connect duration in milliseconds. example: 20.0 format: double type: number avg_dns_ms: description: Average DNS resolution duration in milliseconds. example: 10.0 format: double type: number avg_download_ms: description: Average download phase duration in milliseconds. example: 135.0 format: double type: number avg_first_byte_ms: description: Average time to first byte in milliseconds. example: 30.0 format: double type: number avg_redirect_ms: description: Average redirect phase duration in milliseconds. example: 0.0 format: double type: number avg_ssl_ms: description: Average SSL handshake duration in milliseconds. example: 5.0 format: double type: number required: - avg_redirect_ms - avg_dns_ms - avg_connect_ms - avg_ssl_ms - avg_first_byte_ms - avg_download_ms type: object AggregatedWaterfallPerformanceCriteria: description: Performance criteria to filter view instances by a metric threshold. properties: max: description: Maximum threshold in seconds (inclusive). example: 5.0 format: double type: number metric: $ref: "#/components/schemas/AggregatedWaterfallPerformanceCriteriaMetric" min: description: Minimum threshold in seconds (inclusive). example: 2.5 format: double type: number required: - metric type: object AggregatedWaterfallPerformanceCriteriaMetric: description: Performance metric used to filter view instances by threshold. enum: - loading_time - largest_contentful_paint - first_contentful_paint - interaction_to_next_paint example: largest_contentful_paint type: string x-enum-varnames: - LOADING_TIME - LARGEST_CONTENTFUL_PAINT - FIRST_CONTENTFUL_PAINT - INTERACTION_TO_NEXT_PAINT AggregatedWaterfallRequest: description: Request body for the aggregated waterfall endpoint. properties: data: $ref: "#/components/schemas/AggregatedWaterfallRequestData" required: - data type: object AggregatedWaterfallRequestAttributes: description: Attributes for an aggregated waterfall query. properties: application_id: description: The RUM application ID to analyze. example: ccbc53b1-74f2-496b-bdd7-9a8fa7b7376b type: string criteria: $ref: "#/components/schemas/AggregatedWaterfallPerformanceCriteria" filter: description: RUM query string to filter events (for example, @session.type:user @geo.country:US). example: "@session.type:user" type: string from: description: Start of the time range as a Unix timestamp in seconds. example: 1762437564 format: int64 type: integer include_global_appearance: description: When true, enriches each resource with cross-view appearance statistics. example: false type: boolean sample_size: description: Number of view instances to sample, between 1 and 500. example: 20 format: int32 maximum: 500 minimum: 1 type: integer to: description: End of the time range as a Unix timestamp in seconds. example: 1762523964 format: int64 type: integer view_name: description: The RUM view name to analyze (for example, /account/login). example: /account/login(/:type) type: string required: - application_id - view_name - from - to - sample_size type: object AggregatedWaterfallRequestData: description: Data envelope for an aggregated waterfall request. properties: attributes: $ref: "#/components/schemas/AggregatedWaterfallRequestAttributes" type: $ref: "#/components/schemas/AggregatedWaterfallRequestType" required: - type - attributes type: object AggregatedWaterfallRequestType: description: The JSON:API type for aggregated waterfall requests. enum: - aggregated_waterfall example: aggregated_waterfall type: string x-enum-varnames: - AGGREGATED_WATERFALL AggregatedWaterfallResponse: description: Response body for the aggregated waterfall endpoint. properties: data: $ref: "#/components/schemas/AggregatedWaterfallResponseData" required: - data type: object AggregatedWaterfallResponseAttributes: description: Attributes of an aggregated waterfall response. properties: application_id: description: The RUM application ID that was analyzed. example: ccbc53b1-74f2-496b-bdd7-9a8fa7b7376b type: string criteria: $ref: "#/components/schemas/AggregatedWaterfallResponseAttributesCriteria" from: description: Start of the analyzed time range as a Unix timestamp in seconds. example: 1762437564 format: int64 type: integer resources: description: Network resources in chronological waterfall order. items: $ref: "#/components/schemas/AggregatedResource" type: array sampled_view_ids: description: List of RUM view IDs sampled for this aggregation, capped at 50. example: - 6fbf69b6-9455-436a-b894-a6bf64126d40 - dfe318df-4ae5-44b8-9fe2-4107885e1a46 items: type: string type: array to: description: End of the analyzed time range as a Unix timestamp in seconds. example: 1762523964 format: int64 type: integer total_cache_hit_rate_pct: description: Overall cache hit rate across all sampled views. example: 0.677 format: double type: number view_count: description: Number of view instances included in the analysis. example: 50 format: int32 maximum: 2147483647 type: integer view_name: description: The RUM view name that was analyzed. example: /account/login(/:type) type: string required: - view_name - application_id - view_count - from - to - criteria - sampled_view_ids - total_cache_hit_rate_pct - resources type: object AggregatedWaterfallResponseAttributesCriteria: description: Performance criteria used to filter view instances by a metric threshold, or null if no criteria were applied. nullable: true properties: max: description: Maximum threshold in seconds (inclusive). example: 5.0 format: double type: number metric: $ref: "#/components/schemas/AggregatedWaterfallPerformanceCriteriaMetric" min: description: Minimum threshold in seconds (inclusive). example: 2.5 format: double type: number required: - metric type: object AggregatedWaterfallResponseData: description: Data envelope for an aggregated waterfall response. properties: attributes: $ref: "#/components/schemas/AggregatedWaterfallResponseAttributes" id: description: Hash-based unique identifier for this aggregation. example: 2f0b3455 type: string type: $ref: "#/components/schemas/AggregatedWaterfallRequestType" required: - id - type - attributes type: object AiCustomRuleDataType: description: AI custom rule resource type. enum: [ai_rule] example: ai_rule type: string x-enum-varnames: - AI_RULE AiCustomRuleItem: description: An AI custom rule embedded within a ruleset response. properties: created_at: description: The creation timestamp. example: "2024-01-01T00:00:00+00:00" format: date-time type: string created_by: description: The identifier of the user who created the rule. example: example-handle type: string last_revision: $ref: "#/components/schemas/AiCustomRuleRevisionResponseAttributes" description: The most recent revision of the rule. nullable: true name: description: The rule name. example: my-ai-rule type: string required: - name - created_at - created_by - last_revision type: object AiCustomRuleRequest: description: Request body for creating an AI custom rule. properties: data: $ref: "#/components/schemas/AiCustomRuleRequestData" type: object AiCustomRuleRequestAttributes: description: Attributes for creating an AI custom rule. properties: name: description: The rule name. example: my-ai-rule type: string type: object AiCustomRuleRequestData: description: Request data for creating an AI custom rule. properties: attributes: $ref: "#/components/schemas/AiCustomRuleRequestAttributes" id: description: The rule identifier, which must match the name. example: my-ai-rule type: string type: $ref: "#/components/schemas/AiCustomRuleDataType" type: object AiCustomRuleResponse: description: Response containing a single AI custom rule. properties: data: $ref: "#/components/schemas/AiCustomRuleResponseData" required: - data type: object AiCustomRuleResponseData: description: Response data for an AI custom rule. properties: attributes: $ref: "#/components/schemas/AiCustomRuleItem" id: description: The rule identifier. example: my-ai-rule type: string type: $ref: "#/components/schemas/AiCustomRuleDataType" required: - id - type - attributes type: object AiCustomRuleRevisionDataType: description: AI custom rule revision resource type. enum: [ai_rule_revision] example: ai_rule_revision type: string x-enum-varnames: - AI_RULE_REVISION AiCustomRuleRevisionExecutionMode: description: The execution mode for an AI rule revision. enum: [auto, manual, always] example: auto type: string x-enum-varnames: - AUTO - MANUAL - ALWAYS AiCustomRuleRevisionRequest: description: Request body for creating an AI custom rule revision. properties: data: $ref: "#/components/schemas/AiCustomRuleRevisionRequestData" type: object AiCustomRuleRevisionRequestAttributes: description: Attributes for creating an AI custom rule revision. properties: category: $ref: "#/components/schemas/CustomRuleRevisionAttributesCategory" content: description: Base64-encoded AI model content for this revision. example: Content type: string cwe: description: The associated CWE identifier. example: "79" nullable: true type: string description: description: Base64-encoded full description. example: Ruleset description type: string directories: description: Directory patterns this rule applies to. example: [] items: type: string type: array execution_mode: $ref: "#/components/schemas/AiCustomRuleRevisionExecutionMode" globs: description: File glob patterns this rule applies to. example: - "**/*.py" items: type: string type: array is_published: description: Whether this revision is published. example: false type: boolean is_testing: description: Whether this revision is for testing only. example: false type: boolean severity: $ref: "#/components/schemas/CustomRuleRevisionAttributesSeverity" short_description: description: Base64-encoded short description. example: Ruleset short description type: string version_id: description: The version identifier for this revision. example: 1 format: int64 type: integer required: - short_description - description - content - globs - directories - execution_mode - severity - category - is_published - is_testing type: object AiCustomRuleRevisionRequestData: description: Request data for creating an AI custom rule revision. properties: attributes: $ref: "#/components/schemas/AiCustomRuleRevisionRequestAttributes" id: description: The revision identifier. example: revision-abc-123 type: string type: $ref: "#/components/schemas/AiCustomRuleRevisionDataType" type: object AiCustomRuleRevisionResponse: description: Response containing a single AI custom rule revision. properties: data: $ref: "#/components/schemas/AiCustomRuleRevisionResponseData" required: - data type: object AiCustomRuleRevisionResponseAttributes: description: Response attributes of an AI custom rule revision. properties: category: $ref: "#/components/schemas/CustomRuleRevisionAttributesCategory" checksum: description: Checksum of the revision content. example: abc123def456 type: string content: description: Base64-encoded AI model content for this revision. example: Content type: string created_at: description: The creation timestamp. example: "2024-01-01T00:00:00+00:00" format: date-time type: string created_by: description: The identifier of the user who created the revision. example: example-handle type: string cwe: description: The associated CWE identifier. example: "79" nullable: true type: string description: description: Base64-encoded full description. example: Ruleset description type: string directories: description: Directory patterns this rule applies to. example: [] items: type: string type: array execution_mode: $ref: "#/components/schemas/AiCustomRuleRevisionExecutionMode" globs: description: File glob patterns this rule applies to. example: - "**/*.py" items: type: string type: array is_default: description: Whether this is a default Datadog rule. example: false type: boolean is_published: description: Whether this revision is published. example: false type: boolean is_testing: description: Whether this revision is for testing only. example: false type: boolean severity: $ref: "#/components/schemas/CustomRuleRevisionAttributesSeverity" short_description: description: Base64-encoded short description. example: Ruleset short description type: string version_id: description: The version identifier for this revision. example: 1 format: int64 type: integer required: - version_id - short_description - description - content - globs - directories - execution_mode - cwe - checksum - created_at - created_by - severity - category - is_published - is_testing - is_default type: object AiCustomRuleRevisionResponseData: description: Response data for an AI custom rule revision. properties: attributes: $ref: "#/components/schemas/AiCustomRuleRevisionResponseAttributes" id: description: The revision identifier. example: revision-abc-123 type: string type: $ref: "#/components/schemas/AiCustomRuleRevisionDataType" required: - id - type - attributes type: object AiCustomRuleRevisionsResponse: description: Response containing a list of AI custom rule revisions. properties: data: description: The list of AI custom rule revisions. items: $ref: "#/components/schemas/AiCustomRuleRevisionResponseData" type: array required: - data type: object AiCustomRulesetDataType: description: AI custom ruleset resource type. enum: [ai_ruleset] example: ai_ruleset type: string x-enum-varnames: - AI_RULESET AiCustomRulesetRequest: description: Request body for creating an AI custom ruleset. properties: data: $ref: "#/components/schemas/AiCustomRulesetRequestData" type: object AiCustomRulesetRequestAttributes: description: Attributes for creating an AI custom ruleset. properties: description: description: Base64-encoded full description of the ruleset. example: Ruleset description type: string name: description: The ruleset name. example: my-ai-ruleset type: string short_description: description: Base64-encoded short description of the ruleset. example: Ruleset short description type: string required: - name - short_description - description type: object AiCustomRulesetRequestData: description: Request data for creating an AI custom ruleset. properties: attributes: $ref: "#/components/schemas/AiCustomRulesetRequestAttributes" id: description: The ruleset identifier, which must match the name. example: my-ai-ruleset type: string type: $ref: "#/components/schemas/AiCustomRulesetDataType" type: object AiCustomRulesetResponse: description: Response containing a single AI custom ruleset. properties: data: $ref: "#/components/schemas/AiCustomRulesetResponseData" required: - data type: object AiCustomRulesetResponseAttributes: description: Response attributes of an AI custom ruleset. properties: created_at: description: The creation timestamp. example: "2024-01-01T00:00:00+00:00" format: date-time type: string created_by: description: The identifier of the user who created the ruleset. example: example-handle type: string description: description: Base64-encoded full description of the ruleset. example: Ruleset description type: string name: description: The ruleset name. example: my-ai-ruleset type: string rules: description: The rules contained in the ruleset. items: $ref: "#/components/schemas/AiCustomRuleItem" nullable: true type: array short_description: description: Base64-encoded short description of the ruleset. example: Ruleset short description type: string required: - name - short_description - description - created_at - created_by - rules type: object AiCustomRulesetResponseData: description: Response data for an AI custom ruleset. properties: attributes: $ref: "#/components/schemas/AiCustomRulesetResponseAttributes" id: description: The ruleset identifier. example: my-ai-ruleset type: string type: $ref: "#/components/schemas/AiCustomRulesetDataType" required: - id - type - attributes type: object AiCustomRulesetUpdateAttributes: description: Attributes for updating an AI custom ruleset. properties: description: description: Base64-encoded full description of the ruleset. example: Ruleset description type: string name: description: The ruleset name. example: my-ai-ruleset type: string short_description: description: Base64-encoded short description of the ruleset. example: Ruleset short description type: string type: object AiCustomRulesetUpdateData: description: Request data for updating an AI custom ruleset. properties: attributes: $ref: "#/components/schemas/AiCustomRulesetUpdateAttributes" id: description: The ruleset identifier. example: my-ai-ruleset type: string type: $ref: "#/components/schemas/AiCustomRulesetDataType" type: object AiCustomRulesetUpdateRequest: description: Request body for updating an AI custom ruleset. properties: data: $ref: "#/components/schemas/AiCustomRulesetUpdateData" type: object AiCustomRulesetsResponse: description: Response containing a list of AI custom rulesets. properties: data: description: The list of AI custom rulesets. items: $ref: "#/components/schemas/AiCustomRulesetResponseData" type: array required: - data type: object AiGatewayBudgetAttributes: description: AI Gateway budget configuration and metadata. properties: capacity_microcents: description: Budget capacity in microcents. example: 100000000 format: int64 type: integer created_at: description: Time when the resource was created. example: "2026-08-24T12:00:00Z" format: date-time type: string created_by: description: Identifier of the principal that created the resource. example: admin@example.com type: string enabled: description: Whether the resource is enabled. example: true type: boolean enforcement: $ref: "#/components/schemas/AiGatewayBudgetEnforcement" monitor_id: description: Datadog monitor ID provisioned for this budget. Null when monitor provisioning was skipped or failed. example: 12345678 format: int64 nullable: true type: integer name: description: Human-readable resource name. example: Coding agents type: string scope_restricted: description: Whether provider or model scope metadata was withheld. Omit unchanged scope fields on an unrelated update to preserve their saved values. example: false type: boolean selector: $ref: "#/components/schemas/AiGatewayBudgetSelector" tags: $ref: "#/components/schemas/AiGatewayBudgetTags" team_id: description: Optional Datadog Team scope. format: uuid type: string updated_at: description: Time when the resource was last updated. example: "2026-08-24T12:00:00Z" format: date-time type: string user_id: description: User scope. Omitted when the budget is not user-scoped. format: uuid type: string warning_threshold: description: Fraction of capacity at which to issue a warning. example: 0.9 format: double type: number window_policy: $ref: "#/components/schemas/AiGatewayBudgetWindowPolicy" required: - scope_restricted - monitor_id - name - tags - capacity_microcents - window_policy - warning_threshold - enforcement - enabled - created_by - created_at - updated_at type: object AiGatewayBudgetCreateAttributes: description: Attributes used to create an AI Gateway budget. properties: capacity_microcents: description: Budget capacity in microcents. example: 100000000 format: int64 minimum: 1 type: integer enforcement: $ref: "#/components/schemas/AiGatewayBudgetEnforcement" name: description: Human-readable resource name. example: Coding agents minLength: 1 type: string selector: $ref: "#/components/schemas/AiGatewayBudgetSelector" tags: $ref: "#/components/schemas/AiGatewayBudgetTags" team_id: description: Optional Datadog Team scope. format: uuid type: string track_existing: default: false description: Initialize current-period spend from historical priced LLM Observability spans. Defaults to false. Unsupported for template budgets; failures can be retried with an update. type: boolean user_id: description: Optional user scope. format: uuid type: string warning_threshold: default: 0.9 description: Fraction of capacity at which to issue a warning. exclusiveMinimum: true format: double maximum: 1 minimum: 0 type: number window_policy: $ref: "#/components/schemas/AiGatewayBudgetWindowPolicy" required: - name - capacity_microcents - window_policy - enforcement type: object AiGatewayBudgetCreateData: description: Data used to create an AI Gateway budget. properties: attributes: $ref: "#/components/schemas/AiGatewayBudgetCreateAttributes" type: $ref: "#/components/schemas/AiGatewayBudgetType" required: - type - attributes type: object AiGatewayBudgetCreateRequest: description: Request to create an AI Gateway budget. properties: data: $ref: "#/components/schemas/AiGatewayBudgetCreateData" required: - data type: object AiGatewayBudgetEnforcement: description: Action taken when spend exceeds the budget. enum: - BLOCK - NOTIFY example: BLOCK type: string x-enum-varnames: - BLOCK - NOTIFY AiGatewayBudgetInstanceAttributes: description: One budget instance counter. properties: budget_id: description: Budget identifier. example: 11111111-1111-1111-1111-111111111111 format: uuid type: string effective_capacity_microcents: description: Capacity enforced for this instance, in microcents. example: 100000000 format: int64 type: integer instance_key: description: Opaque canonical counter key. Empty for legacy pooled counters. example: "" type: string modified_at: description: Time the instance counter was last modified. example: "2026-10-05T12:00:00Z" format: date-time type: string spend_microcents: description: Spend counted against this instance, in microcents. example: 25000000 format: int64 type: integer split_dims: additionalProperties: type: string description: Dimension values decoded from instance_key. User and Team values are raw UUIDs. example: {} type: object window_start: description: Start of the accounting window. example: "2026-10-01T00:00:00Z" format: date-time type: string required: - budget_id - window_start - instance_key - split_dims - spend_microcents - effective_capacity_microcents - modified_at type: object AiGatewayBudgetInstanceCapacityOverrideAttributes: description: Attributes used to override one budget instance's active-period capacity. properties: capacity_microcents: description: New capacity for this instance in the active accounting period, in microcents. example: 250000000 format: int64 minimum: 1 type: integer instance_key: description: Counter key of the instance to override, as returned by the list budget instances endpoint. example: "v1|7:user_id=36:22222222-2222-2222-2222-222222222222" minLength: 1 type: string reason: description: Optional reason recorded with the capacity override. example: Temporary increase for a launch week maxLength: 1024 type: string required: - instance_key - capacity_microcents type: object AiGatewayBudgetInstanceCapacityOverrideData: description: Data used to override one budget instance's active-period capacity. properties: attributes: $ref: "#/components/schemas/AiGatewayBudgetInstanceCapacityOverrideAttributes" type: $ref: "#/components/schemas/AiGatewayBudgetInstanceType" required: - type - attributes type: object AiGatewayBudgetInstanceCapacityOverrideRequest: description: Request to override one budget instance's active-period capacity. properties: data: $ref: "#/components/schemas/AiGatewayBudgetInstanceCapacityOverrideData" required: - data type: object AiGatewayBudgetInstanceDimensionAttributes: description: Values of one budget split dimension. properties: budget_id: description: Budget identifier. example: 11111111-1111-1111-1111-111111111111 format: uuid type: string dim: description: Split dimension name, as used in `split_dims` and the `split_dim` filter. example: tag:env type: string restricted_details: description: Whether identifying instance details were withheld. Aggregate totals still include restricted instances. example: false type: boolean truncated: description: Whether more values matched than were returned. Narrow the results with `query` or `value` to see them. example: false type: boolean values: description: Values of this dimension across matching instance counters, highest spend first and at most `limit` of them. Values are counted under every `split_dim` filter except the one for this dimension. items: $ref: "#/components/schemas/AiGatewayBudgetInstanceDimensionValue" type: array window_start: description: Start of the accounting window. example: "2026-10-01T00:00:00Z" format: date-time type: string required: - restricted_details - budget_id - window_start - dim - values - truncated type: object AiGatewayBudgetInstanceDimensionListResponse: description: Response containing values of budget split dimensions. properties: data: items: $ref: "#/components/schemas/AiGatewayBudgetInstanceDimensionResource" type: array required: - data type: object AiGatewayBudgetInstanceDimensionResource: description: Values of one budget split dimension. properties: attributes: $ref: "#/components/schemas/AiGatewayBudgetInstanceDimensionAttributes" id: description: Resource identifier. example: 11111111-1111-1111-1111-111111111111|2026-10-01T00:00:00Z|tag:env type: string type: $ref: "#/components/schemas/AiGatewayBudgetInstanceDimensionType" required: - type - id - attributes type: object AiGatewayBudgetInstanceDimensionType: description: Budget split dimension values resource type. enum: - budget-instance-dimensions example: budget-instance-dimensions type: string x-enum-varnames: - BUDGET_INSTANCE_DIMENSIONS AiGatewayBudgetInstanceDimensionValue: description: One value of a budget split dimension. properties: instance_count: description: Number of instance counters carrying this value. example: 2 format: int64 type: integer spend_microcents: description: Spend summed across those instance counters, in microcents. example: 50000000 format: int64 type: integer value: description: Raw dimension value. User and Team values are UUIDs. A counter with no value for the dimension carries the null character (U+0000). example: prod type: string required: - value - instance_count - spend_microcents type: object AiGatewayBudgetInstanceListResponse: description: Response containing budget instance counters. properties: data: items: $ref: "#/components/schemas/AiGatewayBudgetInstanceResource" type: array meta: $ref: "#/components/schemas/AiGatewayRestrictedDetailsMeta" required: - meta - data type: object AiGatewayBudgetInstanceResetAttributes: description: Attributes used to reset one budget instance's active-period spend. properties: instance_key: description: Counter key of the instance to reset, as returned by the list budget instances endpoint. example: "v1|7:user_id=36:22222222-2222-2222-2222-222222222222" minLength: 1 type: string reason: description: Optional reason recorded with the spend reset. example: Credit approved after incorrect usage attribution maxLength: 1024 type: string required: - instance_key type: object AiGatewayBudgetInstanceResetData: description: Data used to reset one budget instance's active-period spend. properties: attributes: $ref: "#/components/schemas/AiGatewayBudgetInstanceResetAttributes" type: $ref: "#/components/schemas/AiGatewayBudgetInstanceType" required: - type - attributes type: object AiGatewayBudgetInstanceResetRequest: description: Request to reset one budget instance's active-period spend. properties: data: $ref: "#/components/schemas/AiGatewayBudgetInstanceResetData" required: - data type: object AiGatewayBudgetInstanceResource: description: One budget instance counter. properties: attributes: $ref: "#/components/schemas/AiGatewayBudgetInstanceAttributes" id: description: Resource identifier. example: 11111111-1111-1111-1111-111111111111|2026-10-01T00:00:00Z| type: string type: $ref: "#/components/schemas/AiGatewayBudgetInstanceType" required: - type - id - attributes type: object AiGatewayBudgetInstanceResponse: description: Response containing one budget instance counter. properties: data: $ref: "#/components/schemas/AiGatewayBudgetInstanceResource" required: - data type: object AiGatewayBudgetInstanceSort: default: spend_desc description: Sort order for budget instance counters. enum: - spend_desc - spend_asc - key_asc example: spend_desc type: string x-enum-varnames: - SPEND_DESC - SPEND_ASC - KEY_ASC AiGatewayBudgetInstanceType: description: Budget instance counter resource type. enum: - budget-instances example: budget-instances type: string x-enum-varnames: - BUDGET_INSTANCES AiGatewayBudgetInstancesSummaryAttributes: description: Aggregate state across budget instance counters. properties: budget_id: description: Budget identifier. example: 11111111-1111-1111-1111-111111111111 format: uuid type: string exceeded_capacity_count: description: Number of instances at or above capacity. example: 0 format: int64 type: integer instance_count: description: Number of instance counters. example: 3 format: int64 type: integer over_warning_threshold_count: description: Number of instances at or above the warning threshold. example: 1 format: int64 type: integer restricted_details: description: Whether instances were withheld because their provider or model is hidden. Summary counts and totals exclude those instances. example: false type: boolean total_spend_microcents: description: Spend summed across all instances, in microcents. example: 75000000 format: int64 type: integer window_start: description: Start of the accounting window. example: "2026-10-01T00:00:00Z" format: date-time type: string required: - restricted_details - budget_id - window_start - instance_count - total_spend_microcents - over_warning_threshold_count - exceeded_capacity_count type: object AiGatewayBudgetInstancesSummaryResource: description: Aggregate state across budget instance counters. properties: attributes: $ref: "#/components/schemas/AiGatewayBudgetInstancesSummaryAttributes" id: description: Resource identifier. example: 11111111-1111-1111-1111-111111111111 format: uuid type: string type: $ref: "#/components/schemas/AiGatewayBudgetInstancesSummaryType" required: - type - id - attributes type: object AiGatewayBudgetInstancesSummaryResponse: description: Response containing aggregate state across budget instance counters. properties: data: $ref: "#/components/schemas/AiGatewayBudgetInstancesSummaryResource" required: - data type: object AiGatewayBudgetInstancesSummaryType: description: Budget instance summary resource type. enum: - budget-instances-summary example: budget-instances-summary type: string x-enum-varnames: - BUDGET_INSTANCES_SUMMARY AiGatewayBudgetListAttributes: description: Budget configuration including spend and capacity for the active accounting window. properties: capacity_microcents: description: Budget capacity in microcents. example: 100000000 format: int64 type: integer created_at: description: Time when the resource was created. example: "2026-08-24T12:00:00Z" format: date-time type: string created_by: description: Identifier of the principal that created the resource. example: admin@example.com type: string current_period_capacity_microcents: description: Capacity enforced for the active window, in microcents. example: 120000000 format: int64 type: integer current_spend_microcents: description: Spend currently counted against the active window, in microcents. example: 25000000 format: int64 type: integer enabled: description: Whether the resource is enabled. example: true type: boolean enforcement: $ref: "#/components/schemas/AiGatewayBudgetEnforcement" monitor_id: description: Datadog monitor ID provisioned for this budget. Null when monitor provisioning was skipped or failed. example: 12345678 format: int64 nullable: true type: integer name: description: Human-readable resource name. example: Coding agents type: string scope_restricted: description: Whether provider or model scope metadata was withheld. Omit unchanged scope fields on an unrelated update to preserve their saved values. example: false type: boolean selector: $ref: "#/components/schemas/AiGatewayBudgetSelector" tags: $ref: "#/components/schemas/AiGatewayBudgetTags" team_id: description: Optional Datadog Team scope. format: uuid type: string updated_at: description: Time when the resource was last updated. example: "2026-08-24T12:00:00Z" format: date-time type: string user_id: description: User scope. Omitted when the budget is not user-scoped. format: uuid type: string warning_threshold: description: Fraction of capacity at which to issue a warning. example: 0.9 format: double type: number window_end: description: End of the active accounting window. example: "2026-09-01T00:00:00Z" format: date-time type: string window_policy: $ref: "#/components/schemas/AiGatewayBudgetWindowPolicy" window_start: description: Start of the active accounting window. example: "2026-08-01T00:00:00Z" format: date-time type: string required: - scope_restricted - monitor_id - name - tags - capacity_microcents - window_policy - warning_threshold - enforcement - enabled - created_by - created_at - updated_at - window_start - window_end - current_spend_microcents - current_period_capacity_microcents type: object AiGatewayBudgetListResource: description: Budget resource including active-window spend and capacity. properties: attributes: $ref: "#/components/schemas/AiGatewayBudgetListAttributes" id: description: Resource identifier. example: 11111111-1111-1111-1111-111111111111 format: uuid type: string type: $ref: "#/components/schemas/AiGatewayBudgetType" required: - type - id - attributes type: object AiGatewayBudgetListResponse: description: Response containing AI Gateway budgets. properties: data: items: $ref: "#/components/schemas/AiGatewayBudgetListResource" type: array required: - data type: object AiGatewayBudgetPeriodAttributes: description: Accounting state enforced for an AI Gateway budget's active period. properties: budget_id: description: Budget resource identifier. example: 11111111-1111-1111-1111-111111111111 format: uuid type: string current_spend_microcents: description: Spend currently counted against the active accounting period. example: 25000000 format: int64 type: integer default_capacity_microcents: description: Capacity that new accounting periods inherit from the budget definition. example: 100000000 format: int64 type: integer effective_capacity_microcents: description: Capacity enforced for the active accounting period. example: 120000000 format: int64 type: integer monitor_id: description: Datadog monitor ID provisioned for this budget. Null when monitor provisioning was skipped or failed. example: 12345678 format: int64 nullable: true type: integer window_end: description: End of the active accounting window. example: "2026-08-28T00:00:00Z" format: date-time type: string window_start: description: Start of the active accounting window. example: "2026-08-27T00:00:00Z" format: date-time type: string required: - budget_id - monitor_id - window_start - window_end - default_capacity_microcents - effective_capacity_microcents - current_spend_microcents type: object AiGatewayBudgetPeriodResource: description: Active accounting period for an AI Gateway budget. properties: attributes: $ref: "#/components/schemas/AiGatewayBudgetPeriodAttributes" id: description: Budget identifier associated with this active period. example: 11111111-1111-1111-1111-111111111111 format: uuid type: string type: $ref: "#/components/schemas/AiGatewayBudgetPeriodType" required: - type - id - attributes type: object AiGatewayBudgetPeriodResponse: description: Response containing an AI Gateway budget's active period. properties: data: $ref: "#/components/schemas/AiGatewayBudgetPeriodResource" required: - data type: object AiGatewayBudgetPeriodType: description: AI Gateway budget period resource type. enum: - budget-periods example: budget-periods type: string x-enum-varnames: - BUDGET_PERIODS AiGatewayBudgetResource: description: AI Gateway budget resource. properties: attributes: $ref: "#/components/schemas/AiGatewayBudgetAttributes" id: description: Resource identifier. example: 11111111-1111-1111-1111-111111111111 format: uuid type: string type: $ref: "#/components/schemas/AiGatewayBudgetType" required: - type - id - attributes type: object AiGatewayBudgetResponse: description: Response containing one AI Gateway budget. properties: data: $ref: "#/components/schemas/AiGatewayBudgetResource" required: - data type: object AiGatewayBudgetSelector: description: Dimension rules for a template budget. A nonempty selector creates independent counters for matched instances. Omit or pass an empty selector for a legacy fixed-scope budget. items: $ref: "#/components/schemas/AiGatewayBudgetSelectorEntry" nullable: true type: array AiGatewayBudgetSelectorEntry: description: One dimension rule in a template budget selector. properties: dim: description: "Dimension to match: user_id, team_id, model, provider, or tag:. Reserved metadata tag keys are rejected." example: user_id type: string per_value: default: false description: Separate counters by the matched value when true. Otherwise, pool spend within the other separated dimensions. example: true type: boolean values: description: Allowed dimension values. Omit to match any value, including an absent dimension. An explicit list must contain at least one value. example: - 11111111-1111-1111-1111-111111111111 items: type: string minItems: 1 type: array required: - dim - per_value type: object AiGatewayBudgetTags: additionalProperties: type: string description: Request tags that must match for the budget to apply. example: model: gpt-5.2-codex type: object AiGatewayBudgetType: description: AI Gateway budget resource type. enum: - budgets example: budgets type: string x-enum-varnames: - BUDGETS AiGatewayBudgetUpdateAttributes: description: Mutable attributes of an AI Gateway budget. properties: apply_to_current_period: default: false description: Whether a capacity change also applies to the active accounting period. Requires capacity_microcents. Unsupported for template budgets. type: boolean capacity_microcents: description: Default capacity for future accounting periods, in microcents. example: 120000000 format: int64 minimum: 1 type: integer enabled: description: Whether the budget is enabled. example: true type: boolean enforcement: $ref: "#/components/schemas/AiGatewayBudgetEnforcement" name: description: Human-readable resource name. example: Coding agents minLength: 1 type: string reason: description: Optional reason recorded with an active-period capacity adjustment. example: Temporary capacity increase approved for an incident maxLength: 1024 type: string track_existing: default: false description: Initialize current-period spend from historical priced LLM Observability spans. Defaults to false. Unsupported for template budgets; failures can be retried with an update. type: boolean warning_threshold: description: Fraction of capacity at which to issue a warning. example: 0.8 exclusiveMinimum: true format: double maximum: 1 minimum: 0 type: number type: object AiGatewayBudgetUpdateData: description: Data used to update an AI Gateway budget. properties: attributes: $ref: "#/components/schemas/AiGatewayBudgetUpdateAttributes" id: description: Resource identifier. Must match the budget ID in the path. example: 11111111-1111-1111-1111-111111111111 format: uuid type: string type: $ref: "#/components/schemas/AiGatewayBudgetType" required: - type - id - attributes type: object AiGatewayBudgetUpdateRequest: description: Request to update an AI Gateway budget. properties: data: $ref: "#/components/schemas/AiGatewayBudgetUpdateData" required: - data type: object AiGatewayBudgetWindowPolicy: description: UTC accounting period for a budget. enum: - DAILY - WEEKLY - MONTHLY example: MONTHLY type: string x-enum-varnames: - DAILY - WEEKLY - MONTHLY AiGatewayCaptureConfigurationResponse: description: Response containing the organization data capture configuration. properties: data: $ref: "#/components/schemas/AiGatewayCaptureConfigurationResponseData" required: - data type: object AiGatewayCaptureConfigurationResponseData: description: Organization data capture configuration, including its default mode and scoped overrides. properties: attributes: $ref: "#/components/schemas/AiGatewayCaptureConfigurationResponseDataAttributes" id: description: Identifier of the organization configuration resource, always `organization`. example: organization type: string type: $ref: "#/components/schemas/AiGatewayCaptureConfigurationResponseDataType" required: - id - type - attributes type: object AiGatewayCaptureConfigurationResponseDataAttributes: description: Organization default mode, scoped overrides, and current configuration revision. properties: configuration_revision: description: Opaque revision of the organization default and all overrides. Writes require the revision returned by a current read or preview. example: "capture-revision-1" type: string default_metadata_capture: $ref: "#/components/schemas/AiGatewayMetadataCapture" description: >- Items Metadata-only capture adds by default, when no scoped override matches. Change them in **Org defaults**. default_mode: $ref: "#/components/schemas/AiGatewayCaptureConfigurationResponseDataAttributesDefaultMode" overrides: description: Scoped overrides currently configured for the organization. items: $ref: "#/components/schemas/AiGatewayCaptureOverride" type: array required: - configuration_revision - default_mode - overrides type: object AiGatewayCaptureConfigurationResponseDataAttributesDefaultMode: description: Default capture mode for the organization. Change it in **Org defaults**. enum: - metadata_only - full_capture example: metadata_only type: string x-enum-varnames: - METADATA_ONLY - FULL_CAPTURE AiGatewayCaptureConfigurationResponseDataType: default: data-capture-configurations description: Data capture configurations resource type. enum: - data-capture-configurations example: data-capture-configurations type: string x-enum-varnames: - DATA_CAPTURE_CONFIGURATIONS AiGatewayCaptureCreateRequest: description: Request body for creating a scoped data capture override. properties: data: $ref: "#/components/schemas/AiGatewayCaptureCreateRequestData" required: - data type: object AiGatewayCaptureCreateRequestData: description: New data capture override with a client-generated UUID and its settings. properties: attributes: $ref: "#/components/schemas/AiGatewayCaptureCreateRequestDataAttributes" id: description: Client-generated UUID for the override. example: "11111111-1111-4111-8111-111111111111" format: uuid type: string type: $ref: "#/components/schemas/AiGatewayCaptureCreateRequestDataType" required: - id - type - attributes type: object AiGatewayCaptureCreateRequestDataAttributes: description: Settings and configuration revision for creating the override. properties: configuration_revision: description: Opaque revision of the organization default and all overrides. Writes require the revision returned by a current read or preview. example: "capture-revision-1" type: string confirm_full_capture: description: >- Set to `true` to confirm a change that can enable full capture, including a deletion that causes a `full_capture` override or the organization default to apply. type: boolean metadata_capture: $ref: "#/components/schemas/AiGatewayMetadataCapture" description: >- Optional items Metadata-only capture adds for matching requests: structure and counts, never conversation text. Applies only under `metadata_only`. Omit it on replacement to keep the stored items. mode: $ref: "#/components/schemas/AiGatewayCaptureCreateRequestDataAttributesMode" name: description: Display name of the override. Names need not be unique; identify overrides by `id`. example: Research maxLength: 256 minLength: 1 type: string operation: $ref: "#/components/schemas/AiGatewayCaptureCreateRequestDataAttributesOperation" revision: description: Current override revision, required for replacement or deletion. example: 1 format: int64 type: integer scope: $ref: "#/components/schemas/AiGatewayCaptureScope" required: - name - mode - scope - configuration_revision type: object AiGatewayCaptureCreateRequestDataAttributesMode: description: Capture mode for matching traffic. enum: - metadata_only - full_capture example: metadata_only type: string x-enum-varnames: - METADATA_ONLY - FULL_CAPTURE AiGatewayCaptureCreateRequestDataAttributesOperation: description: Proposed operation for preview. Write endpoints infer it from the HTTP method. enum: - create - replace - delete example: create type: string x-enum-varnames: - CREATE - REPLACE - DELETE AiGatewayCaptureCreateRequestDataType: default: data-capture-overrides description: Data capture overrides resource type. enum: - data-capture-overrides example: data-capture-overrides type: string x-enum-varnames: - DATA_CAPTURE_OVERRIDES AiGatewayCaptureDeleteRequest: description: Request body for deleting a scoped data capture override. properties: data: $ref: "#/components/schemas/AiGatewayCaptureDeleteRequestData" required: - data type: object AiGatewayCaptureDeleteRequestData: description: Override identifier, revisions, and confirmation required for deletion. properties: attributes: $ref: "#/components/schemas/AiGatewayCaptureDeleteRequestDataAttributes" id: description: UUID of the override to delete. Must match the `id` path parameter. example: "11111111-1111-4111-8111-111111111111" format: uuid type: string type: $ref: "#/components/schemas/AiGatewayCaptureDeleteRequestDataType" required: - id - type - attributes type: object AiGatewayCaptureDeleteRequestDataAttributes: description: Revisions and confirmation used to delete the override. properties: configuration_revision: description: Opaque revision of the organization default and all overrides. Writes require the revision returned by a current read or preview. example: "capture-revision-1" type: string confirm_full_capture: description: >- Set to `true` to confirm a change that can enable full capture, including a deletion that causes a `full_capture` override or the organization default to apply. type: boolean mode: $ref: "#/components/schemas/AiGatewayCaptureDeleteRequestDataAttributesMode" name: description: Display name of the override. Names need not be unique; identify overrides by `id`. example: Research type: string operation: $ref: "#/components/schemas/AiGatewayCaptureDeleteRequestDataAttributesOperation" revision: description: Current override revision, required for replacement or deletion. example: 1 format: int64 type: integer scope: $ref: "#/components/schemas/AiGatewayCaptureScope" required: - revision - configuration_revision type: object AiGatewayCaptureDeleteRequestDataAttributesMode: description: Capture mode for matching traffic. enum: - metadata_only - full_capture example: metadata_only type: string x-enum-varnames: - METADATA_ONLY - FULL_CAPTURE AiGatewayCaptureDeleteRequestDataAttributesOperation: description: Proposed operation for preview. Write endpoints infer it from the HTTP method. enum: - create - replace - delete example: create type: string x-enum-varnames: - CREATE - REPLACE - DELETE AiGatewayCaptureDeleteRequestDataType: default: data-capture-overrides description: Data capture overrides resource type. enum: - data-capture-overrides example: data-capture-overrides type: string x-enum-varnames: - DATA_CAPTURE_OVERRIDES AiGatewayCaptureOverride: description: Saved data capture override with its request filters, capture mode, revision, and timestamps. properties: created_at: description: Timestamp when the override was created. example: "2026-10-15T12:00:00Z" format: date-time type: string id: description: UUID identifying the override within the organization. example: "11111111-1111-4111-8111-111111111111" format: uuid type: string metadata_capture: $ref: "#/components/schemas/AiGatewayMetadataCapture" description: >- Items Metadata-only capture adds for matching requests. Empty when none are selected. mode: $ref: "#/components/schemas/AiGatewayCaptureOverrideMode" name: description: Display name of the override. Names need not be unique; identify overrides by `id`. example: Research type: string revision: description: Current override revision, required for replacement or deletion. example: 1 format: int64 type: integer scope: $ref: "#/components/schemas/AiGatewayCaptureResponseScope" scope_restricted: description: Whether provider or model scope metadata was withheld. Omit unchanged scope fields on an unrelated update to preserve their saved values. example: false type: boolean updated_at: description: Timestamp when the override was last modified. example: "2026-10-15T12:00:00Z" format: date-time type: string required: - scope_restricted - created_at - id - mode - name - revision - scope - updated_at type: object AiGatewayCaptureOverrideMode: description: Capture mode for matching traffic. enum: - metadata_only - full_capture example: metadata_only type: string x-enum-varnames: - METADATA_ONLY - FULL_CAPTURE AiGatewayCaptureOverrideResponse: description: Response containing a data capture override after creation or replacement. properties: data: $ref: "#/components/schemas/AiGatewayCaptureOverrideResponseData" required: - data type: object AiGatewayCaptureOverrideResponseData: description: Saved data capture override with its identifier, mode, scope, and revision. properties: attributes: $ref: "#/components/schemas/AiGatewayCaptureOverrideResponseDataAttributes" id: description: UUID of the saved override, used to retrieve it from the configuration or change it. example: "11111111-1111-4111-8111-111111111111" format: uuid type: string type: $ref: "#/components/schemas/AiGatewayCaptureOverrideResponseDataType" required: - id - type - attributes type: object AiGatewayCaptureOverrideResponseDataAttributes: description: Saved name, capture mode, request filters, and revision of the override. properties: metadata_capture: $ref: "#/components/schemas/AiGatewayMetadataCapture" description: >- Items Metadata-only capture adds for matching requests. Empty when none are selected. mode: $ref: "#/components/schemas/AiGatewayCaptureOverrideResponseDataAttributesMode" name: description: Display name of the override. Names need not be unique; identify overrides by `id`. example: Research type: string revision: description: Current override revision, required for replacement or deletion. example: 1 format: int64 type: integer scope: $ref: "#/components/schemas/AiGatewayCaptureResponseScope" scope_restricted: description: Whether provider or model scope metadata was withheld. Omit unchanged scope on replacement to preserve it. example: false type: boolean required: - scope_restricted - mode - name - revision - scope type: object AiGatewayCaptureOverrideResponseDataAttributesMode: description: Capture mode for matching traffic. enum: - metadata_only - full_capture example: metadata_only type: string x-enum-varnames: - METADATA_ONLY - FULL_CAPTURE AiGatewayCaptureOverrideResponseDataType: default: data-capture-overrides description: Data capture overrides resource type. enum: - data-capture-overrides example: data-capture-overrides type: string x-enum-varnames: - DATA_CAPTURE_OVERRIDES AiGatewayCaptureResponseScope: additionalProperties: false description: >- Visible request filters. Provider and model tags are withheld when the caller cannot view them. An empty object or empty tags can represent a fully restricted scope; scope_restricted identifies redaction. example: tags: env: prod properties: tags: additionalProperties: type: string description: >- Exact-match request tags with lowercase keys. The reserved `model` tag is the canonical model ID, and the reserved `provider` tag is the configured connection slug. The server sets both. Custom tags come from `x-dd-tag` headers. Keys and values must not have leading or trailing white space. Values are case-sensitive. maxProperties: 100 type: object team_id: description: >- UUID of a Datadog team. Matches the authorized team selected by the `x-ai-gateway-team` request header. Requests without this header do not match team-scoped overrides. Open-membership teams cannot scope overrides. format: uuid type: string user_id: description: Authenticated Datadog user UUID in this organization. format: uuid type: string type: object AiGatewayCaptureScope: additionalProperties: false description: >- All selected filters combine with AND, with one value per filter. The `model` and `provider` tags apply to each actual direct or routed attempt, including fallback destinations. Routes are not selectable filters. At least one filter is required. If any matching override uses `metadata_only`, that mode applies. Otherwise, if any matching override uses `full_capture`, that mode applies. The organization default applies only when no override matches. Overrides have no priority or specificity ordering. example: tags: env: prod minProperties: 1 properties: tags: additionalProperties: type: string description: >- Exact-match request tags with lowercase keys. The reserved `model` tag is the canonical model ID, and the reserved `provider` tag is the configured connection slug. The server sets both. Custom tags come from `x-dd-tag` headers. Keys and values must not have leading or trailing white space. Values are case-sensitive. maxProperties: 100 minProperties: 1 type: object team_id: description: >- UUID of a Datadog team. Matches the authorized team selected by the `x-ai-gateway-team` request header. Requests without this header do not match team-scoped overrides. Open-membership teams cannot scope overrides. format: uuid type: string user_id: description: Authenticated Datadog user UUID in this organization. format: uuid type: string type: object AiGatewayCaptureUpdateRequest: description: Request body for replacing a scoped data capture override. properties: data: $ref: "#/components/schemas/AiGatewayCaptureUpdateRequestData" required: - data type: object AiGatewayCaptureUpdateRequestData: description: Existing override identifier, replacement settings, and revisions required for the update. properties: attributes: $ref: "#/components/schemas/AiGatewayCaptureUpdateRequestDataAttributes" id: description: UUID of the override to replace. Must match the `id` path parameter. example: "11111111-1111-4111-8111-111111111111" format: uuid type: string type: $ref: "#/components/schemas/AiGatewayCaptureUpdateRequestDataType" required: - id - type - attributes type: object AiGatewayCaptureUpdateRequestDataAttributes: description: Replacement settings and revisions for updating the override. properties: configuration_revision: description: Opaque revision of the organization default and all overrides. Writes require the revision returned by a current read or preview. example: "capture-revision-1" type: string confirm_full_capture: description: >- Set to `true` to confirm a change that can enable full capture, including a deletion that causes a `full_capture` override or the organization default to apply. type: boolean metadata_capture: $ref: "#/components/schemas/AiGatewayMetadataCapture" description: >- Optional items Metadata-only capture adds for matching requests: structure and counts, never conversation text. Applies only under `metadata_only`. Omit it on replacement to keep the stored items. mode: $ref: "#/components/schemas/AiGatewayCaptureUpdateRequestDataAttributesMode" name: description: Display name of the override. Names need not be unique; identify overrides by `id`. example: Research maxLength: 256 minLength: 1 type: string operation: $ref: "#/components/schemas/AiGatewayCaptureUpdateRequestDataAttributesOperation" revision: description: Current override revision, required for replacement or deletion. example: 1 format: int64 type: integer scope: $ref: "#/components/schemas/AiGatewayCaptureScope" description: Omit on replacement to preserve the saved scope, including hidden provider and model references. An explicitly supplied scope replaces it. required: - name - mode - revision - configuration_revision type: object AiGatewayCaptureUpdateRequestDataAttributesMode: description: Capture mode for matching traffic. enum: - metadata_only - full_capture example: metadata_only type: string x-enum-varnames: - METADATA_ONLY - FULL_CAPTURE AiGatewayCaptureUpdateRequestDataAttributesOperation: description: Proposed operation for preview. Write endpoints infer it from the HTTP method. enum: - create - replace - delete example: create type: string x-enum-varnames: - CREATE - REPLACE - DELETE AiGatewayCaptureUpdateRequestDataType: default: data-capture-overrides description: Data capture overrides resource type. enum: - data-capture-overrides example: data-capture-overrides type: string x-enum-varnames: - DATA_CAPTURE_OVERRIDES AiGatewayCustomProviderSupportedOperation: description: Operation supported by a custom provider. enum: - OPENAI_CHAT_COMPLETIONS - OPENAI_RESPONSES - ANTHROPIC_MESSAGES example: OPENAI_CHAT_COMPLETIONS type: string x-enum-varnames: - OPENAI_CHAT_COMPLETIONS - OPENAI_RESPONSES - ANTHROPIC_MESSAGES AiGatewayDataCaptureMode: description: Controls whether AI Gateway captures request and response content in addition to metadata. enum: - metadata_only - full_capture example: metadata_only type: string x-enum-varnames: - METADATA_ONLY - FULL_CAPTURE AiGatewayDiscoveredModelAttributes: description: Model discovered from a provider integration account. properties: display_name: description: Human-readable model name. example: GPT-5.2 Codex type: string model_id_wire: description: Model identifier sent to the provider. example: gpt-5.2-codex-20260801 type: string supported_operations: description: Operations supported by the model. example: - OPENAI_CHAT_COMPLETIONS items: $ref: "#/components/schemas/AiGatewaySupportedOperation" type: array required: - model_id_wire - supported_operations type: object AiGatewayDiscoveredModelListResponse: description: Response containing models discovered from an integration account. properties: data: items: $ref: "#/components/schemas/AiGatewayDiscoveredModelResource" description: Discovered provider model. type: array required: - data type: object AiGatewayDiscoveredModelResource: description: Discovered provider model resource. properties: attributes: $ref: "#/components/schemas/AiGatewayDiscoveredModelAttributes" id: description: Resource identifier. example: gpt-5.2-codex type: string type: $ref: "#/components/schemas/AiGatewayDiscoveredModelType" required: - type - id - attributes type: object AiGatewayDiscoveredModelType: description: Discovered provider model resource type. enum: - provider-models example: provider-models type: string x-enum-varnames: - PROVIDER_MODELS AiGatewayGovernanceAttributes: description: Organization-wide AI Gateway governance controls. properties: data_capture_mode: $ref: "#/components/schemas/AiGatewayDataCaptureMode" description: Data capture mode used when no scoped override matches the request. metadata_capture: $ref: "#/components/schemas/AiGatewayMetadataCapture" description: >- Items Metadata-only capture adds when no scoped override matches. Empty when none are selected. zdr_mode: $ref: "#/components/schemas/AiGatewayZDRMode" description: Whether the organization requires every request to reach a provider covered by a zero data retention agreement. required: - data_capture_mode - zdr_mode type: object AiGatewayGovernanceReplaceAttributes: description: Organization-wide AI Gateway governance controls to replace. properties: data_capture_mode: $ref: "#/components/schemas/AiGatewayDataCaptureMode" description: Data capture mode used when no scoped override matches the request. metadata_capture: $ref: "#/components/schemas/AiGatewayMetadataCapture" description: >- Optional items Metadata-only capture adds when no scoped override matches. Omit it to keep the stored items. zdr_mode: $ref: "#/components/schemas/AiGatewayZDRMode" description: Whether the organization requires every request to reach a provider covered by a zero data retention agreement. Omit to leave unchanged. required: - data_capture_mode type: object AiGatewayGovernanceReplaceData: description: Data used to replace the organization's AI Gateway governance controls. properties: attributes: $ref: "#/components/schemas/AiGatewayGovernanceReplaceAttributes" id: description: Optional singleton governance resource identifier. When provided, it must be `organization`. example: organization type: string type: $ref: "#/components/schemas/AiGatewayGovernanceType" required: - type - attributes type: object AiGatewayGovernanceReplaceRequest: description: Request to replace the organization's AI Gateway governance controls. properties: data: $ref: "#/components/schemas/AiGatewayGovernanceReplaceData" required: - data type: object AiGatewayGovernanceResource: description: Organization-wide AI Gateway governance resource. properties: attributes: $ref: "#/components/schemas/AiGatewayGovernanceAttributes" id: description: Singleton governance resource identifier. example: organization type: string type: $ref: "#/components/schemas/AiGatewayGovernanceType" required: - type - id - attributes type: object AiGatewayGovernanceResponse: description: Response containing the organization's AI Gateway governance controls. properties: data: $ref: "#/components/schemas/AiGatewayGovernanceResource" required: - data type: object AiGatewayGovernanceType: description: AI Gateway governance resource type. enum: - governance example: governance type: string x-enum-varnames: - GOVERNANCE AiGatewayKnownProvider: description: Known provider implementation. enum: - custom - anthropic - openai - azure_openai - bedrock - gemini - baseten - fireworks - together - typesafe - azure_foundry example: openai type: string x-enum-varnames: - CUSTOM - ANTHROPIC - OPENAI - AZURE_OPENAI - BEDROCK - GEMINI - BASETEN - FIREWORKS - TOGETHER - TYPESAFE - AZURE_FOUNDRY AiGatewayMaxReasoningLevel: description: Maximum reasoning level permitted by a model group. enum: - none - minimal - low - medium - high - xhigh - max example: high type: string x-enum-varnames: - NONE - MINIMAL - LOW - MEDIUM - HIGH - XHIGH - MAX AiGatewayMetadataCapture: description: >- Items Metadata-only capture adds, each listed once. An item requires the items whose information it already reveals: `tool_output_size`, `tool_names` and `conversation_shape` require `tool_usage`, and `input_size_by_role` requires `tool_output_size`. A set that leaves out a required item is rejected. When several Metadata-only overrides match a request, it gets only the items all of them select. example: - tool_usage - tool_output_size - tool_names items: $ref: "#/components/schemas/AiGatewayMetadataCaptureItem" type: array uniqueItems: true AiGatewayMetadataCaptureItem: description: >- An item Metadata-only capture can add to LLM Observability spans. Each is structure or a number, never conversation text. `tool_usage` adds tool call and result counts; `tool_output_size` adds estimated tool output tokens, total and average; `tool_names` adds each tool call and result with its name, ID and type; `conversation_shape` adds every message with its role and no text; `input_size_by_role` adds estimated input tokens per role; `available_tools` adds the names of the tools the request offered; `generation_settings` adds numeric and enumerated settings such as temperature and the finish reason. enum: - tool_usage - tool_output_size - tool_names - conversation_shape - input_size_by_role - available_tools - generation_settings example: tool_usage type: string x-enum-varnames: - TOOL_USAGE - TOOL_OUTPUT_SIZE - TOOL_NAMES - CONVERSATION_SHAPE - INPUT_SIZE_BY_ROLE - AVAILABLE_TOOLS - GENERATION_SETTINGS AiGatewayModelCapabilities: description: Model features reported by the enrichment source. Omitted properties are unknown. properties: attachment: description: Whether attachment input is supported. type: boolean interleaved_reasoning: description: Whether reasoning can be interleaved with tool use. type: boolean reasoning: description: Whether reasoning is supported. type: boolean structured_output: description: Whether structured output is supported. type: boolean temperature: description: Whether temperature can be configured. type: boolean tool_call: description: Whether tool calls are supported. type: boolean type: object AiGatewayModelCatalogEntryAttributes: description: Model catalog entry configuration and metadata. properties: created_at: description: Time when the resource was created. example: "2026-08-24T12:00:00Z" format: date-time type: string enabled: description: Whether the resource is enabled. example: true type: boolean metadata: $ref: "#/components/schemas/AiGatewayModelMetadata" model_id_canonical: description: Provider-independent model identifier. example: gpt-5.2-codex type: string model_id_wire: description: Model identifier sent to the provider. example: gpt-5.2-codex-20260801 type: string provider_id: description: Provider identifier. example: 42 format: int64 type: integer source: $ref: "#/components/schemas/AiGatewayModelSource" supported_operations: description: Operations supported by the model. example: - OPENAI_CHAT_COMPLETIONS items: $ref: "#/components/schemas/AiGatewaySupportedOperation" type: array updated_at: description: Time when the resource was last updated. example: "2026-08-24T12:00:00Z" format: date-time type: string required: - provider_id - model_id_canonical - model_id_wire - supported_operations - enabled - source - created_at - updated_at type: object AiGatewayModelCatalogEntryIdentifier: description: Model catalog entry identifier. properties: id: description: Resource identifier. example: "101" type: string type: $ref: "#/components/schemas/AiGatewayModelCatalogEntryType" required: - type - id type: object AiGatewayModelCatalogEntryListResponse: description: Response containing model catalog entries. properties: data: items: $ref: "#/components/schemas/AiGatewayModelCatalogEntryResource" description: Model catalog entry resource. type: array required: - data type: object AiGatewayModelCatalogEntryResource: description: AI Gateway model catalog entry resource. properties: attributes: $ref: "#/components/schemas/AiGatewayModelCatalogEntryAttributes" id: description: Resource identifier. example: "101" type: string type: $ref: "#/components/schemas/AiGatewayModelCatalogEntryType" required: - type - id - attributes type: object AiGatewayModelCatalogEntryResponse: description: Response containing one model catalog entry. properties: data: $ref: "#/components/schemas/AiGatewayModelCatalogEntryResource" required: - data type: object AiGatewayModelCatalogEntryType: description: Model catalog entry resource type. enum: - model-catalog-entries example: model-catalog-entries type: string x-enum-varnames: - MODEL_CATALOG_ENTRIES AiGatewayModelCreateAttributes: description: Attributes used to create a model catalog entry. properties: model_id_canonical: description: Provider-independent model identifier. example: gpt-5.2-codex maxLength: 256 minLength: 1 type: string model_id_wire: description: Model identifier sent to the provider. example: gpt-5.2-codex-20260801 maxLength: 256 minLength: 1 type: string supported_operations: description: Operations supported by the model. items: $ref: "#/components/schemas/AiGatewaySupportedOperation" type: array required: - model_id_canonical - model_id_wire type: object AiGatewayModelCreateData: description: Data used to create a model catalog entry. properties: attributes: $ref: "#/components/schemas/AiGatewayModelCreateAttributes" type: $ref: "#/components/schemas/AiGatewayModelCatalogEntryType" required: - type - attributes type: object AiGatewayModelCreateRequest: description: Request to create a model catalog entry. properties: data: $ref: "#/components/schemas/AiGatewayModelCreateData" required: - data type: object AiGatewayModelGroupAttributes: description: Complete AI Gateway model group configuration. properties: allow_fast_mode: description: Whether fast mode is allowed for models and routing rules in the group. example: true type: boolean created_at: description: Time when the resource was created. example: "2026-08-24T12:00:00Z" format: date-time type: string max_reasoning_level: $ref: "#/components/schemas/AiGatewayNullableMaxReasoningLevel" description: Maximum reasoning level. Null means there is no group-specific limit. model_ids: description: All saved model catalog IDs, including selections whose provider metadata is hidden. Preserve these IDs independently of the visible catalog. example: - 101 items: description: Saved opaque model catalog ID. example: 101 format: int64 minimum: 1 type: integer type: array models: description: Metadata for saved model selections whose providers the caller can view. Missing metadata does not remove a saved ID. items: $ref: "#/components/schemas/AiGatewayModelGroupModel" type: array name: description: Human-readable resource name. example: Coding models type: string provider_ids: description: All explicitly selected provider IDs, including hidden providers. Embedded provider metadata includes only viewable providers. example: - 42 items: description: Saved opaque provider ID. example: 42 format: int64 minimum: 1 type: integer type: array providers: description: Viewable explicitly selected providers, separate from individually selected models. Use provider_ids to retain all selections. items: $ref: "#/components/schemas/AiGatewayModelGroupProvider" type: array revision: description: Revision of the organization-wide policy. Present for the default model group and absent for named policies. format: int64 minimum: 0 type: integer routing_rules: items: $ref: "#/components/schemas/AiGatewayModelGroupRoutingRule" description: Routing rule in the group. type: array updated_at: description: Time when the resource was last updated. example: "2026-08-24T12:00:00Z" format: date-time type: string required: - model_ids - provider_ids - name - models - providers - routing_rules - created_at - updated_at - allow_fast_mode - max_reasoning_level type: object AiGatewayModelGroupBinding: description: Initial access binding for an AI Gateway model group. properties: principals: description: Principals granted the relation. example: - "user:55555555-5555-5555-5555-555555555555" items: description: Principal identifier. example: "user:55555555-5555-5555-5555-555555555555" minLength: 1 type: string minItems: 1 type: array relation: $ref: "#/components/schemas/AiGatewayModelGroupBindingRelation" required: - relation - principals type: object AiGatewayModelGroupBindingRelation: description: Access relation granted on a model group. enum: - viewer - runner - editor example: runner type: string x-enum-varnames: - VIEWER - RUNNER - EDITOR AiGatewayModelGroupCreateAttributes: description: Attributes used to create an AI Gateway model group. properties: allow_fast_mode: default: true description: Whether fast mode is allowed for models and routing rules in the group. example: true type: boolean bindings: description: Optional initial model-group access bindings. items: $ref: "#/components/schemas/AiGatewayModelGroupBinding" type: array max_reasoning_level: $ref: "#/components/schemas/AiGatewayMaxReasoningLevel" description: Optional maximum reasoning level. Omit for no group-specific limit. model_ids: description: Model catalog IDs to select. New selections require provider View. items: description: Model catalog entry ID. example: 101 format: int64 minimum: 1 type: integer type: array name: description: Human-readable resource name. example: Coding models maxLength: 256 minLength: 1 type: string provider_ids: description: Explicit provider selections, including current and future models. Omit to preserve selections on update; an empty array clears them. Null is invalid. New selections require provider View; saved hidden IDs can be retained or removed. items: description: Provider ID. format: int64 minimum: 1 type: integer type: array routing_rule_slugs: description: Organization-unique routing rule slugs, such as coding-route. items: description: Routing rule slug. example: coding-route maxLength: 128 minLength: 1 type: string type: array required: - name type: object AiGatewayModelGroupCreateData: description: Data used to create an AI Gateway model group. properties: attributes: $ref: "#/components/schemas/AiGatewayModelGroupCreateAttributes" type: $ref: "#/components/schemas/AiGatewayModelGroupType" required: - type - attributes type: object AiGatewayModelGroupCreateRequest: description: Request to create an AI Gateway model group. properties: data: $ref: "#/components/schemas/AiGatewayModelGroupCreateData" required: - data type: object AiGatewayModelGroupListResponse: description: Response containing AI Gateway model groups. properties: data: items: $ref: "#/components/schemas/AiGatewayModelGroupResource" description: AI Gateway model group resource. type: array required: - data type: object AiGatewayModelGroupModel: description: Model catalog entry embedded in a model group. properties: created_at: description: Time when the resource was created. example: "2026-08-24T12:00:00Z" format: date-time type: string enabled: description: Whether the resource is enabled. example: true type: boolean id: description: Model catalog entry identifier. example: "101" type: string metadata: $ref: "#/components/schemas/AiGatewayModelMetadata" model_id_canonical: description: Provider-independent model identifier. example: gpt-5.2-codex type: string model_id_wire: description: Model identifier sent to the provider. example: gpt-5.2-codex-20260801 type: string provider_id: description: Provider identifier. example: 42 format: int64 type: integer source: $ref: "#/components/schemas/AiGatewayModelSource" supported_operations: description: Operations supported by the model. example: - OPENAI_CHAT_COMPLETIONS items: $ref: "#/components/schemas/AiGatewaySupportedOperation" type: array updated_at: description: Time when the resource was last updated. example: "2026-08-24T12:00:00Z" format: date-time type: string required: - id - provider_id - model_id_canonical - model_id_wire - supported_operations - enabled - source - created_at - updated_at type: object AiGatewayModelGroupProvider: description: Explicitly selected provider. Its current and future models are covered. properties: id: description: Provider ID. example: 42 format: int64 minimum: 1 type: integer name: description: Provider display name. example: production-us type: string required: - id - name type: object AiGatewayModelGroupResource: description: AI Gateway model group resource. properties: attributes: $ref: "#/components/schemas/AiGatewayModelGroupAttributes" id: description: Resource identifier. example: "7" type: string type: $ref: "#/components/schemas/AiGatewayModelGroupType" required: - type - id - attributes type: object AiGatewayModelGroupResponse: description: Response containing one AI Gateway model group. properties: data: $ref: "#/components/schemas/AiGatewayModelGroupResource" required: - data type: object AiGatewayModelGroupRoutingRule: description: Routing rule in an AI Gateway model group. properties: slug: description: Organization-unique routing rule slug. example: coding-route type: string required: - slug type: object AiGatewayModelGroupType: description: AI Gateway model group resource type. enum: - model-groups example: model-groups type: string x-enum-varnames: - MODEL_GROUPS AiGatewayModelGroupUpdateAttributes: description: Attributes used to update an AI Gateway model group. properties: allow_fast_mode: description: Whether fast mode is allowed for models and routing rules in the group. example: true type: boolean expected_revision: description: Required when updating the default model group. Must match its current revision; a stale revision returns HTTP 409. Omit for named policies. format: int64 minimum: 0 type: integer max_reasoning_level: $ref: "#/components/schemas/AiGatewayNullableMaxReasoningLevel" description: Maximum reasoning level. Null clears the group-specific limit. model_ids: description: Individually selected model catalog IDs. Replaces this selection only. Omit to preserve it; an empty array clears it. Null is invalid. Individual selections do not include future models. New selections require provider View; retaining or removing saved hidden selections requires only parent Edit. items: description: Model catalog entry ID. example: 101 format: int64 minimum: 1 type: integer type: array name: description: Human-readable resource name. example: Coding models maxLength: 256 minLength: 1 type: string provider_ids: description: Explicit provider selections, including current and future models. Omit to preserve selections on update; an empty array clears them. Null is invalid. New selections require provider View; saved hidden IDs can be retained or removed. items: description: Provider ID. format: int64 minimum: 1 type: integer type: array routing_rule_slugs: description: Organization-unique routing rule slugs. Replaces route selections only. Omit to preserve them; an empty array clears them. Null is invalid. items: description: Routing rule slug. example: coding-route maxLength: 128 minLength: 1 type: string type: array type: object AiGatewayModelGroupUpdateData: description: Data used to update an AI Gateway model group. properties: attributes: $ref: "#/components/schemas/AiGatewayModelGroupUpdateAttributes" id: description: Resource identifier. example: "7" type: string type: $ref: "#/components/schemas/AiGatewayModelGroupType" required: - type - id - attributes type: object AiGatewayModelGroupUpdateRequest: description: Request to update an AI Gateway model group. properties: data: $ref: "#/components/schemas/AiGatewayModelGroupUpdateData" required: - data type: object AiGatewayModelInput: description: Manually managed model definition supplied when creating a provider or catalog entry. properties: model_id_canonical: description: Provider-independent model identifier. example: gpt-5.2-codex maxLength: 256 minLength: 1 type: string model_id_wire: description: Model identifier sent to the provider. example: gpt-5.2-codex-20260801 maxLength: 256 minLength: 1 type: string supported_operations: description: Operations supported by the model. items: $ref: "#/components/schemas/AiGatewaySupportedOperation" type: array required: - model_id_canonical - model_id_wire type: object AiGatewayModelLimits: description: Token limits reported by the enrichment source. properties: context_window_tokens: description: Total model context window in tokens. example: 400000 format: int64 minimum: 0 type: integer max_input_tokens: description: Maximum input tokens when reported separately. format: int64 minimum: 0 type: integer max_output_tokens: description: Maximum output tokens. example: 128000 format: int64 minimum: 0 type: integer type: object AiGatewayModelMetadata: description: Optional, typed enrichment for a model catalog entry. Missing properties remain unknown. properties: capabilities: $ref: "#/components/schemas/AiGatewayModelCapabilities" description: description: Human-readable model description. type: string display_name: description: Human-readable model name. type: string family: description: Model family identifier. type: string kind: $ref: "#/components/schemas/AiGatewayModelMetadataKind" knowledge_cutoff: description: Knowledge cutoff reported by the source. type: string last_updated: description: Date the source record was last updated. pattern: '^\d{4}-\d{2}(-\d{2})?$' type: string lifecycle: $ref: "#/components/schemas/AiGatewayModelMetadataLifecycle" limits: $ref: "#/components/schemas/AiGatewayModelLimits" modalities: $ref: "#/components/schemas/AiGatewayModelModalities" open_weights: description: Whether model weights are openly available. type: boolean reasoning: $ref: "#/components/schemas/AiGatewayModelReasoning" reference_pricing: description: Provider-specific reference prices from the enrichment source. Omitted for shared canonical-model fallback matches. These do not determine gateway charges. items: $ref: "#/components/schemas/AiGatewayModelReferencePrice" type: array release_date: description: Model release date. pattern: '^\d{4}-\d{2}(-\d{2})?$' type: string source: $ref: "#/components/schemas/AiGatewayModelMetadataSource" status: $ref: "#/components/schemas/AiGatewayModelMetadataStatus" required: - source - status - capabilities - modalities - limits type: object AiGatewayModelMetadataKind: description: Primary model kind. Decision models return a choice or score instead of generated text. enum: - language - embedding - image - audio - decision - reranking type: string x-enum-varnames: - LANGUAGE - EMBEDDING - IMAGE - AUDIO - DECISION - RERANKING AiGatewayModelMetadataLifecycle: description: Model lifecycle state. enum: - active - alpha - beta - deprecated type: string x-enum-varnames: - ACTIVE - ALPHA - BETA - DEPRECATED AiGatewayModelMetadataSource: description: Provenance for model metadata enrichment. properties: matched_by: $ref: "#/components/schemas/AiGatewayModelMetadataSourceMatchedBy" model_id: description: Model identifier in the metadata source provider catalog. example: gpt-5.2-codex type: string name: description: Metadata source name. example: models.dev type: string observed_at: description: Last successful observation of this valid source record. Retained invalid entries keep their previous timestamp. format: date-time type: string provider: description: Provider namespace in the metadata source, or canonical for a shared model record. example: openai type: string revision: description: SHA-256 content revision of the source snapshot that supplied this record. type: string required: - name - provider - model_id - matched_by type: object AiGatewayModelMetadataSourceMatchedBy: description: Identifier strategy used to match the gateway catalog entry. Date-suffix and shared canonical-model fallback matches produce partial metadata. enum: - override - wire_id - canonical_id - wire_id_date_suffix - canonical_model example: wire_id type: string x-enum-varnames: - OVERRIDE - WIRE_ID - CANONICAL_ID - WIRE_ID_DATE_SUFFIX - CANONICAL_MODEL AiGatewayModelMetadataStatus: description: Completeness of the matched source record. Partial also identifies metadata from a base model for a dated snapshot or from a shared canonical-model fallback. enum: - available - partial example: available type: string x-enum-varnames: - AVAILABLE - PARTIAL AiGatewayModelModalities: description: Supported model input and output modalities. properties: input: items: description: Input modality. example: text type: string type: array output: items: description: Output modality. example: text type: string type: array type: object AiGatewayModelPricingAttributes: description: Attributes of a model pricing resource. properties: effective_source: $ref: "#/components/schemas/AiGatewayModelPricingEffectiveSource" pricing_config: $ref: "#/components/schemas/AiGatewayModelPricingConfig" description: Pricing configuration for the model. type: object AiGatewayModelPricingCatalogRequestConfig: additionalProperties: false description: Catalog pricing configuration with optional manual rate overrides. properties: overrides: $ref: "#/components/schemas/AiGatewayModelPricingRates" description: Manual pricing overrides. source: $ref: "#/components/schemas/AiGatewayModelPricingCatalogRequestSource" version: $ref: "#/components/schemas/AiGatewayModelPricingVersion" required: - version - source type: object AiGatewayModelPricingCatalogRequestSource: additionalProperties: false description: Source for a catalog pricing configuration. properties: provider_id: description: Pricing catalog provider identifier. example: openai minLength: 1 type: string type: $ref: "#/components/schemas/AiGatewayModelPricingCatalogRequestSourceType" required: - type - provider_id type: object AiGatewayModelPricingCatalogRequestSourceType: description: Catalog pricing source type. enum: - catalog example: catalog type: string x-enum-varnames: - CATALOG AiGatewayModelPricingConfig: description: Pricing configuration for a model. properties: overrides: $ref: "#/components/schemas/AiGatewayModelPricingRates" description: Manual pricing overrides. rates: $ref: "#/components/schemas/AiGatewayModelPricingRates" description: Effective pricing rates. source: $ref: "#/components/schemas/AiGatewayModelPricingSource" description: Source of the pricing data. version: $ref: "#/components/schemas/AiGatewayModelPricingVersion" required: - version - source type: object AiGatewayModelPricingCustomRequestConfig: additionalProperties: false description: Custom pricing configuration. All four rates are required. properties: rates: $ref: "#/components/schemas/AiGatewayModelPricingRequiredRates" source: $ref: "#/components/schemas/AiGatewayModelPricingCustomRequestSource" version: $ref: "#/components/schemas/AiGatewayModelPricingVersion" required: - version - source - rates type: object AiGatewayModelPricingCustomRequestSource: additionalProperties: false description: Source for a custom pricing configuration. properties: type: $ref: "#/components/schemas/AiGatewayModelPricingCustomRequestSourceType" required: - type type: object AiGatewayModelPricingCustomRequestSourceType: default: custom description: Custom pricing source type. enum: - custom example: custom type: string x-enum-varnames: - CUSTOM AiGatewayModelPricingEffectiveSource: description: Effective source of the model pricing data. enum: - catalog_auto - model_override - unknown type: string x-enum-varnames: - CATALOG_AUTO - MODEL_OVERRIDE - UNKNOWN AiGatewayModelPricingRates: additionalProperties: false description: Pricing rates for a model. minProperties: 1 properties: cache_read_cost_per_mtok: description: Cost per million tokens for cache reads. format: double minimum: 0 type: number cache_write_cost_per_mtok: description: Cost per million tokens for cache writes. format: double minimum: 0 type: number non_cached_input_cost_per_mtok: description: Cost per million tokens for non-cached input. format: double minimum: 0 type: number output_cost_per_mtok: description: Cost per million tokens for output. format: double minimum: 0 type: number type: object AiGatewayModelPricingRequest: description: Request body for setting model pricing. properties: data: $ref: "#/components/schemas/AiGatewayModelPricingRequestData" required: - data type: object AiGatewayModelPricingRequestAttributes: description: Attributes for a model pricing request. properties: pricing_config: $ref: "#/components/schemas/AiGatewayModelPricingRequestConfig" description: Pricing configuration for the model. required: - pricing_config type: object AiGatewayModelPricingRequestConfig: description: Pricing configuration accepted when setting model pricing. oneOf: - $ref: "#/components/schemas/AiGatewayModelPricingCustomRequestConfig" - $ref: "#/components/schemas/AiGatewayModelPricingCatalogRequestConfig" AiGatewayModelPricingRequestData: description: Data for a model pricing request. properties: attributes: $ref: "#/components/schemas/AiGatewayModelPricingRequestAttributes" id: description: Resource identifier. example: gpt-4o type: string type: $ref: "#/components/schemas/AiGatewayModelPricingType" required: - type - id - attributes type: object AiGatewayModelPricingRequiredRates: additionalProperties: false description: Complete set of rates required for custom pricing. properties: cache_read_cost_per_mtok: description: Cost per million tokens for cache reads. example: 0.0 format: double minimum: 0 type: number cache_write_cost_per_mtok: description: Cost per million tokens for cache writes. example: 0.0 format: double minimum: 0 type: number non_cached_input_cost_per_mtok: description: Cost per million tokens for non-cached input. example: 0.0 format: double minimum: 0 type: number output_cost_per_mtok: description: Cost per million tokens for output. example: 0.0 format: double minimum: 0 type: number required: - non_cached_input_cost_per_mtok - cache_write_cost_per_mtok - cache_read_cost_per_mtok - output_cost_per_mtok type: object AiGatewayModelPricingResponse: description: Response containing model pricing information. properties: data: $ref: "#/components/schemas/AiGatewayModelPricingResponseData" required: - data type: object AiGatewayModelPricingResponseData: description: Data for a model pricing response. properties: attributes: $ref: "#/components/schemas/AiGatewayModelPricingAttributes" id: description: Resource identifier. example: gpt-4o type: string type: $ref: "#/components/schemas/AiGatewayModelPricingType" required: - type - id - attributes type: object AiGatewayModelPricingSource: description: Source information for a model's pricing. properties: provider_id: description: Pricing catalog provider identifier. example: openai type: string type: $ref: "#/components/schemas/AiGatewayModelPricingSourceType" required: - type type: object AiGatewayModelPricingSourceType: description: Source type for the pricing configuration. enum: - catalog - custom example: custom type: string x-enum-varnames: - CATALOG - CUSTOM AiGatewayModelPricingType: description: Model pricing resource type. enum: - model-pricing example: model-pricing type: string x-enum-varnames: - MODEL_PRICING AiGatewayModelPricingVersion: description: Pricing configuration version. The only supported version is `1`. example: 1 format: int64 maximum: 1 minimum: 1 type: integer AiGatewayModelReasoning: description: Supported reasoning controls. Absence means controls are unknown or unavailable. properties: controls: items: $ref: "#/components/schemas/AiGatewayModelReasoningControl" type: array required: - controls type: object AiGatewayModelReasoningControl: description: One supported mechanism for configuring model reasoning. properties: effort_levels: description: Supported effort values in provider order for an effort control. items: description: Provider reasoning effort value. example: high nullable: true type: string type: array max_budget_tokens: description: Maximum reasoning-token budget. format: int64 minimum: 0 type: integer min_budget_tokens: description: Minimum reasoning-token budget. format: int64 minimum: -1 type: integer type: $ref: "#/components/schemas/AiGatewayModelReasoningControlType" required: - type type: object AiGatewayModelReasoningControlType: description: Reasoning-control mechanism. enum: - toggle - effort - budget_tokens example: effort type: string x-enum-varnames: - TOGGLE - EFFORT - BUDGET_TOKENS AiGatewayModelReferencePrice: description: Informational source pricing, not gateway billing configuration. Prices can differ by provider, mode, and input length. properties: amount: description: Exact decimal amount per unit, zero or greater, represented as a string to preserve precision. Supports fixed decimal and exponent notation. example: "2.5" pattern: '^\d+(\.\d+)?([eE][+-]?\d+)?$' type: string component: description: Token category priced, such as input, output, cache_read, or cache_write. example: input type: string context_max_tokens: description: Largest input length covered by this price. Omitted when there is no upper bound. example: 272000 format: int64 minimum: 1 type: integer context_min_tokens: description: Input length above which this price applies. Zero identifies the base tier. example: 0 format: int64 minimum: 0 type: integer currency: description: Currency of the price. The only supported value is USD. example: USD type: string mode: description: Source mode name. Standard is the base mode; other values, such as fast, are source-defined. example: standard type: string service_tier: description: Provider service tier explicitly associated with this mode by the source. Omitted when unknown. example: priority type: string unit: description: Unit of the quoted amount. The only supported value is million_tokens. example: million_tokens type: string required: - component - currency - unit - amount - mode - context_min_tokens type: object AiGatewayModelSource: description: How a model catalog entry is managed. enum: - discovered - manual example: discovered type: string x-enum-varnames: - DISCOVERED - MANUAL AiGatewayModelUpdateAttributes: description: Attributes used to update a model catalog entry. properties: model_id_wire: description: Model identifier sent to the provider. example: gpt-5.2-codex-20260801 maxLength: 256 type: string supported_operations: description: Operations supported by the model. items: $ref: "#/components/schemas/AiGatewaySupportedOperation" type: array type: object AiGatewayModelUpdateData: description: Data used to update a model catalog entry. properties: attributes: $ref: "#/components/schemas/AiGatewayModelUpdateAttributes" id: description: Resource identifier. example: "101" type: string type: $ref: "#/components/schemas/AiGatewayModelCatalogEntryType" required: - type - id - attributes type: object AiGatewayModelUpdateRequest: description: Request to update a model catalog entry. properties: data: $ref: "#/components/schemas/AiGatewayModelUpdateData" required: - data type: object AiGatewayModelsBulkCreateAttributes: description: Attributes used to create several model catalog entries. properties: models: items: $ref: "#/components/schemas/AiGatewayModelCreateAttributes" description: Model catalog entry attributes. minItems: 1 type: array required: - models type: object AiGatewayModelsBulkCreateData: description: Data used to create several model catalog entries. properties: attributes: $ref: "#/components/schemas/AiGatewayModelsBulkCreateAttributes" type: $ref: "#/components/schemas/AiGatewayModelCatalogEntryType" required: - type - attributes type: object AiGatewayModelsBulkCreateRequest: description: Request to create several model catalog entries. properties: data: $ref: "#/components/schemas/AiGatewayModelsBulkCreateData" required: - data type: object AiGatewayModelsByCanonicalAttributes: description: Provider entries grouped under one canonical model ID. properties: model_id_canonical: description: Provider-independent model identifier. example: gpt-5.2-codex type: string providers: items: $ref: "#/components/schemas/AiGatewayProviderModelEntry" description: Provider-specific model entry. type: array required: - model_id_canonical - providers type: object AiGatewayModelsByCanonicalListResponse: description: Response containing model catalog entries grouped by canonical ID. properties: data: items: $ref: "#/components/schemas/AiGatewayModelsByCanonicalResource" description: Canonical model grouping. type: array required: - data type: object AiGatewayModelsByCanonicalResource: description: Canonical model grouping resource. properties: attributes: $ref: "#/components/schemas/AiGatewayModelsByCanonicalAttributes" id: description: Resource identifier. example: gpt-5.2-codex type: string type: $ref: "#/components/schemas/AiGatewayModelsByCanonicalType" required: - type - id - attributes type: object AiGatewayModelsByCanonicalType: description: Canonical model grouping resource type. enum: - models-by-canonical example: models-by-canonical type: string x-enum-varnames: - MODELS_BY_CANONICAL AiGatewayNullableMaxReasoningLevel: description: Maximum reasoning level permitted by a model group. enum: - none - minimal - low - medium - high - xhigh - max example: high nullable: true type: string x-enum-varnames: - NONE - MINIMAL - LOW - MEDIUM - HIGH - XHIGH - MAX AiGatewayNullableRoutingRuleTierOrdering: default: configured description: >- How a tier orders its targets. Omitted or null defaults to configured, which preserves target order. The weighted_affinity ordering distributes first-choice assignments by relative target weights and accepts only model targets with an explicit provider, without repeated provider and model pairs in the same tier. enum: - configured - weighted_affinity example: configured nullable: true type: string x-enum-varnames: - CONFIGURED - WEIGHTED_AFFINITY AiGatewayPolicyAttributes: description: Routing policy configuration. properties: priority: description: Routing priority. example: 1 format: int64 type: integer tiers: items: $ref: "#/components/schemas/AiGatewayPolicyTier" description: Resolved routing policy tier. type: array required: - priority - tiers type: object AiGatewayPolicyListResponse: description: Response containing routing policy documents. properties: data: items: $ref: "#/components/schemas/AiGatewayPolicyResource" description: Routing policy resource. type: array required: - data type: object AiGatewayPolicyRequest: description: Request to create or replace a routing policy document. properties: data: $ref: "#/components/schemas/AiGatewayPolicyRequestData" required: - data type: object AiGatewayPolicyRequestAttributes: description: Attributes used to create or replace a routing policy document. properties: inbound: description: Inbound request pattern. example: coding-agent maxLength: 256 minLength: 1 type: string priority: description: Routing priority. example: 1 format: int64 type: integer tiers: items: $ref: "#/components/schemas/AiGatewayPolicyTierRequest" description: Routing policy tier. minItems: 1 type: array required: - inbound - tiers type: object AiGatewayPolicyRequestData: description: Data used to create or replace a routing policy document. properties: attributes: $ref: "#/components/schemas/AiGatewayPolicyRequestAttributes" type: $ref: "#/components/schemas/AiGatewayPolicyType" required: - type - attributes type: object AiGatewayPolicyResource: description: AI Gateway routing policy resource. properties: attributes: $ref: "#/components/schemas/AiGatewayPolicyAttributes" id: description: Resource identifier. example: coding-agent type: string type: $ref: "#/components/schemas/AiGatewayPolicyType" required: - type - id - attributes type: object AiGatewayPolicyResponse: description: Response containing one routing policy document. properties: data: $ref: "#/components/schemas/AiGatewayPolicyResource" required: - data type: object AiGatewayPolicyTarget: description: Resolved routing target in a policy response. properties: id: description: Saved target row ID. On replacement, retain this ID only within its original route and at most once. A stale or foreign ID is rejected. example: 901 format: int64 minimum: 1 type: integer model: description: Model name or pattern. Omitted when retaining a saved target by ID or when its provider is hidden. example: gpt-5.2-codex type: string priority: description: Routing priority. example: 1 format: int64 type: integer provider: description: Provider slug. Omitted for dynamic resolution or when its provider is hidden. example: prod-us nullable: true type: string required: - id - priority type: object AiGatewayPolicyTargetRequest: description: Provider and model target in a routing policy request. properties: id: description: Saved target row ID. On replacement, retain this ID only within its original route and at most once. A stale or foreign ID is rejected. example: 901 format: int64 minimum: 1 type: integer model: description: Model name or pattern. Omitted when retaining a saved target by ID or when its provider is hidden. example: gpt-5.2-codex maxLength: 256 minLength: 1 type: string provider: description: Provider slug. Omitted for dynamic resolution or when its provider is hidden. example: prod-us maxLength: 256 type: string type: object AiGatewayPolicyTier: description: Resolved routing policy tier. properties: targets: items: $ref: "#/components/schemas/AiGatewayPolicyTarget" description: Resolved routing policy target. type: array required: - targets type: object AiGatewayPolicyTierRequest: description: Routing policy tier supplied in a request. properties: priority: description: Routing priority. example: 1 format: int64 type: integer targets: items: $ref: "#/components/schemas/AiGatewayPolicyTargetRequest" description: Routing policy target. minItems: 1 type: array required: - targets type: object AiGatewayPolicyType: description: AI Gateway routing policy resource type. enum: - routing-documents example: routing-documents type: string x-enum-varnames: - ROUTING_DOCUMENTS AiGatewayProviderAttributes: description: AI Gateway provider configuration and metadata. properties: cost_multiplier: description: Multiplier applied to provider costs. example: 1.0 format: double type: number created_at: description: Time when the resource was created. example: "2026-08-24T12:00:00Z" format: date-time type: string integration_account_id: description: Provider integration account identifier. example: account-123 type: string integration_config: $ref: "#/components/schemas/AiGatewayProviderIntegrationConfig" known_provider: $ref: "#/components/schemas/AiGatewayKnownProvider" name: description: Human-readable resource name. example: production-us type: string slug: description: Immutable routing identifier. example: prod-us type: string updated_at: description: Time when the resource was last updated. example: "2026-08-24T12:00:00Z" format: date-time type: string required: - name - slug - known_provider - integration_account_id - created_at - updated_at - cost_multiplier type: object AiGatewayProviderCreateAttributes: description: Attributes used to create an AI Gateway provider. properties: cost_multiplier: default: 1.0 description: Multiplier applied to provider costs. Must be greater than 0 and at most 1000000. example: 1.0 exclusiveMinimum: true format: double maximum: 1000000 minimum: 0 type: number initial_bindings: description: Reserved for initial View/Edit permissions. Supplying this attribute, including an empty array or null, returns HTTP 503 before discovery or persistence. Omit it for normal creation. items: $ref: "#/components/schemas/AiGatewayProviderInitialBinding" type: array integration_account_id: description: Provider integration account identifier. example: account-123 maxLength: 256 type: string integration_config: $ref: "#/components/schemas/AiGatewayProviderIntegrationConfig" known_provider: $ref: "#/components/schemas/AiGatewayKnownProvider" models: description: Manually managed models to add alongside models discovered from the provider integration. items: $ref: "#/components/schemas/AiGatewayModelInput" description: Manually managed provider model definition. type: array name: description: Human-readable resource name. example: production-us maxLength: 256 minLength: 1 type: string slug: description: Immutable routing identifier. example: prod-us maxLength: 256 minLength: 1 pattern: "^[A-Za-z0-9_-]+$" type: string required: - name - slug type: object AiGatewayProviderCreateData: description: Data used to create an AI Gateway provider. properties: attributes: $ref: "#/components/schemas/AiGatewayProviderCreateAttributes" type: $ref: "#/components/schemas/AiGatewayProviderType" required: - type - attributes type: object AiGatewayProviderCreateRequest: description: Request to create an AI Gateway provider. properties: data: $ref: "#/components/schemas/AiGatewayProviderCreateData" required: - data type: object AiGatewayProviderInitialBinding: description: Reserved initial provider access binding. Initial provider sharing is unavailable. properties: principals: description: Access principals in type:id form. example: - "org:11111111-1111-1111-1111-111111111111" items: description: User, team, role, or organization principal. example: "org:11111111-1111-1111-1111-111111111111" type: string minItems: 1 type: array relation: $ref: "#/components/schemas/AiGatewayProviderInitialBindingRelation" required: - relation - principals type: object AiGatewayProviderInitialBindingRelation: description: Provider access relation. Editor also grants View. enum: [viewer, editor] example: viewer type: string x-enum-varnames: [VIEWER, EDITOR] AiGatewayProviderIntegrationConfig: description: Provider-specific integration configuration. properties: bedrock_region: description: AWS region used for Bedrock model discovery, routing, and request signing. example: us-east-1 maxLength: 64 type: string foundry_project: description: Azure AI Foundry project name, used to call the project's agents. example: my-project maxLength: 256 type: string foundry_resource_id: description: ARM resource ID of the Azure AI Foundry resource, such as `/subscriptions//resourceGroups//providers/Microsoft.CognitiveServices/accounts/`. Required for `azure_foundry` providers. example: /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/ai/providers/Microsoft.CognitiveServices/accounts/my-foundry maxLength: 512 type: string location: description: GCP location used for Gemini model discovery and credential resolution. example: us-central1 maxLength: 256 type: string project_id: description: GCP project ID used for Gemini model discovery and credential resolution. example: my-gcp-project maxLength: 256 type: string supported_operations: description: Custom provider default for discovered and new manual models. Omit to use Chat Completions. An empty list is invalid. items: $ref: "#/components/schemas/AiGatewayCustomProviderSupportedOperation" minItems: 1 type: array type: object AiGatewayProviderListResponse: description: Response containing AI Gateway providers. properties: data: items: $ref: "#/components/schemas/AiGatewayProviderResource" description: AI Gateway provider resource. type: array required: - data type: object AiGatewayProviderModelEntry: description: Provider-specific entry for a canonical model. properties: created_at: description: Time when the resource was created. example: "2026-08-24T12:00:00Z" format: date-time type: string enabled: description: Whether the resource is enabled. example: true type: boolean id: description: Resource identifier. example: "101" type: string metadata: $ref: "#/components/schemas/AiGatewayModelMetadata" model_id_wire: description: Model identifier sent to the provider. example: gpt-5.2-codex-20260801 type: string provider_id: description: Provider identifier. example: 42 format: int64 type: integer source: $ref: "#/components/schemas/AiGatewayModelSource" supported_operations: description: Operations supported by the model. example: - OPENAI_CHAT_COMPLETIONS items: $ref: "#/components/schemas/AiGatewaySupportedOperation" type: array updated_at: description: Time when the resource was last updated. example: "2026-08-24T12:00:00Z" format: date-time type: string required: - id - provider_id - model_id_wire - supported_operations - enabled - source - created_at - updated_at type: object AiGatewayProviderModelsRelationship: description: Model catalog entries associated with a provider. properties: data: $ref: "#/components/schemas/AiGatewayProviderModelsRelationshipData" required: - data type: object AiGatewayProviderModelsRelationshipData: items: $ref: "#/components/schemas/AiGatewayModelCatalogEntryIdentifier" description: Model catalog entry identifier. type: array AiGatewayProviderRelationships: description: Provider relationships. properties: models: $ref: "#/components/schemas/AiGatewayProviderModelsRelationship" required: - models type: object AiGatewayProviderResource: description: AI Gateway provider resource. properties: attributes: $ref: "#/components/schemas/AiGatewayProviderAttributes" id: description: Resource identifier. example: "42" type: string relationships: $ref: "#/components/schemas/AiGatewayProviderRelationships" type: $ref: "#/components/schemas/AiGatewayProviderType" required: - type - id - attributes type: object AiGatewayProviderResponse: description: Response containing one AI Gateway provider. properties: data: $ref: "#/components/schemas/AiGatewayProviderResource" included: description: Model catalog entries created with the provider. items: $ref: "#/components/schemas/AiGatewayModelCatalogEntryResource" description: Model catalog entry resource. type: array required: - data type: object AiGatewayProviderType: description: AI Gateway provider resource type. enum: - providers example: providers type: string x-enum-varnames: - PROVIDERS AiGatewayProviderUpdateAttributes: description: Attributes used to update an AI Gateway provider. properties: cost_multiplier: description: Multiplier applied to provider costs. Must be greater than 0 and at most 1000000. example: 1.0 exclusiveMinimum: true format: double maximum: 1000000 minimum: 0 type: number name: description: Human-readable resource name. example: production-us-v2 maxLength: 256 minLength: 1 type: string type: object AiGatewayProviderUpdateData: description: Data used to update an AI Gateway provider. properties: attributes: $ref: "#/components/schemas/AiGatewayProviderUpdateAttributes" id: description: Resource identifier. example: "42" type: string type: $ref: "#/components/schemas/AiGatewayProviderType" required: - type - id - attributes type: object AiGatewayProviderUpdateRequest: description: Request to update an AI Gateway provider. properties: data: $ref: "#/components/schemas/AiGatewayProviderUpdateData" required: - data type: object AiGatewayRateLimitAttributes: description: Attributes of an AI Gateway rate limit. properties: created_at: description: Creation timestamp. example: "2026-09-01T00:00:00Z" format: date-time type: string created_by: description: Email of the user who created this rate limit. example: user@example.com type: string enabled: description: Whether this rate limit is active. example: true type: boolean input_tokens_per_minute: description: Maximum input tokens per rolling minute shared by all matching traffic. Null when this rule does not limit input tokens. example: 500000 format: int64 maximum: 100000000000 minimum: 1 nullable: true type: integer mode: $ref: "#/components/schemas/AiGatewayRateLimitMode" monitor_id: description: Datadog monitor that alerts on this rule. Null until one is provisioned. example: 12345678 format: int64 nullable: true type: integer name: description: Rate limit name. example: Default rate limit type: string output_tokens_per_minute: description: Maximum output tokens per rolling minute shared by all matching traffic. Null when this rule does not limit output tokens. example: 200000 format: int64 maximum: 100000000000 minimum: 1 nullable: true type: integer requests_per_minute: description: Maximum requests per rolling minute shared by all matching traffic. Null when this rule does not limit requests. example: 1000 format: int64 maximum: 10000000 minimum: 1 nullable: true type: integer revision: description: Increases on every change to the definition. example: 1 format: int64 type: integer scope_restricted: description: Whether provider or model scope metadata was withheld. Omit unchanged scope fields on an unrelated update to preserve their saved values. example: false type: boolean tags: additionalProperties: type: string description: Optional scope tags, such as provider, model, ml_app, or custom dimensions. A request matches when it has all of these tags. example: provider: openai type: object team_id: description: Optional Team UUID. Count only requests attributed to this Datadog Team. example: bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb format: uuid nullable: true type: string updated_at: description: Last modification timestamp. example: "2026-09-15T14:30:00Z" format: date-time type: string updated_by: description: Email of the user who last modified this rate limit. example: user@example.com type: string user_id: description: Optional user UUID. Count only this user's requests. example: aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa format: uuid nullable: true type: string required: - scope_restricted - name - tags - mode - enabled - revision - created_by - updated_by - created_at - updated_at type: object AiGatewayRateLimitCreateAttributes: description: Attributes used to create an AI Gateway rate limit. properties: input_tokens_per_minute: description: Maximum input tokens per rolling minute. format: int64 maximum: 100000000000 minimum: 1 nullable: true type: integer mode: $ref: "#/components/schemas/AiGatewayRateLimitMode" name: description: Rate limit name. Must not be empty. example: Default rate limit type: string output_tokens_per_minute: description: Maximum output tokens per rolling minute. format: int64 maximum: 100000000000 minimum: 1 nullable: true type: integer requests_per_minute: description: Maximum requests per rolling minute. At least one of `requests_per_minute`, `input_tokens_per_minute`, and `output_tokens_per_minute` is required. example: 600 format: int64 maximum: 10000000 minimum: 1 nullable: true type: integer tags: additionalProperties: type: string description: Optional scope tags, such as `provider`, `model`, `ml_app`, or custom dimensions. A request matches when it has all of these tags. The reserved metadata keys `name`, `budget_name`, and `span_filter` are rejected. type: object team_id: description: Optional UUID. Count only requests attributed to this Datadog Team. example: 00000000-0000-4000-8000-000000000002 format: uuid type: string user_id: description: Optional UUID. Count only this user's requests. example: 00000000-0000-4000-8000-000000000001 format: uuid type: string required: - name type: object AiGatewayRateLimitCreateData: description: Data used to create an AI Gateway rate limit. properties: attributes: $ref: "#/components/schemas/AiGatewayRateLimitCreateAttributes" type: $ref: "#/components/schemas/AiGatewayRateLimitType" required: - type - attributes type: object AiGatewayRateLimitCreateRequest: description: Request to create an AI Gateway rate limit. properties: data: $ref: "#/components/schemas/AiGatewayRateLimitCreateData" required: - data type: object AiGatewayRateLimitListResponse: description: Response containing AI Gateway rate limits. properties: data: items: $ref: "#/components/schemas/AiGatewayRateLimitResource" description: AI Gateway rate limit resource. type: array required: - data type: object AiGatewayRateLimitMode: description: Action taken when request rate exceeds the limit. enum: - ALERT - ENFORCE example: ALERT type: string x-enum-varnames: - ALERT - ENFORCE AiGatewayRateLimitResource: description: AI Gateway rate limit resource. properties: attributes: $ref: "#/components/schemas/AiGatewayRateLimitAttributes" id: description: Rate limit UUID. example: 33333333-3333-3333-3333-333333333333 format: uuid type: string type: $ref: "#/components/schemas/AiGatewayRateLimitType" required: - type - id - attributes type: object AiGatewayRateLimitResponse: description: Response containing one AI Gateway rate limit. properties: data: $ref: "#/components/schemas/AiGatewayRateLimitResource" required: - data type: object AiGatewayRateLimitType: description: AI Gateway rate limit resource type. enum: - rate-limits example: rate-limits type: string x-enum-varnames: - RATE_LIMITS AiGatewayRateLimitUpdateAttributes: description: Attributes used to update an AI Gateway rate limit. Only sent fields are changed. properties: enabled: description: Whether this rate limit is active. type: boolean input_tokens_per_minute: description: Set to 0 to remove the request limit. Null is ignored. At least one limit must remain. format: int64 maximum: 100000000000 minimum: 0 nullable: true type: integer mode: $ref: "#/components/schemas/AiGatewayRateLimitMode" name: description: Rate limit name. type: string output_tokens_per_minute: description: Set to 0 to remove the request limit. Null is ignored. At least one limit must remain. format: int64 maximum: 100000000000 minimum: 0 nullable: true type: integer requests_per_minute: description: Set to 0 to remove the request limit. Null is ignored. At least one limit must remain. format: int64 maximum: 10000000 minimum: 0 nullable: true type: integer tags: additionalProperties: type: string description: Replaces all scope tags. An empty object clears them. Null is ignored. nullable: true type: object team_id: description: Replaces the Team scope. An empty string clears it. Null is ignored. nullable: true type: string user_id: description: Replaces the user scope. An empty string clears it. Null is ignored. nullable: true type: string type: object AiGatewayRateLimitUpdateData: description: Data used to update an AI Gateway rate limit. properties: attributes: $ref: "#/components/schemas/AiGatewayRateLimitUpdateAttributes" id: description: Rate limit UUID. Must match the path parameter. example: 11111111-1111-1111-1111-111111111111 format: uuid type: string type: $ref: "#/components/schemas/AiGatewayRateLimitType" required: - id - type - attributes type: object AiGatewayRateLimitUpdateRequest: description: Request to update an AI Gateway rate limit. properties: data: $ref: "#/components/schemas/AiGatewayRateLimitUpdateData" required: - data type: object AiGatewayRateLimitUsageAttributes: description: Live consumption of one AI Gateway rate limit. properties: input_tokens: description: Input tokens counted in the rolling one-minute window. example: 45000 format: int64 type: integer limited_requests: description: Requests this rate limit rejected in the last 15 minutes. Applies when mode is ENFORCE. example: 3 format: int64 type: integer output_tokens: description: Output tokens counted in the rolling one-minute window. example: 12000 format: int64 type: integer requests: description: Requests counted in the rolling one-minute window. example: 120 format: int64 type: integer would_limit_requests: description: Requests this rate limit would have rejected in the last 15 minutes. Applies when mode is ALERT. example: 0 format: int64 type: integer required: - requests - input_tokens - output_tokens - limited_requests - would_limit_requests type: object AiGatewayRateLimitUsageListResponse: description: Response containing live usage for the organization's AI Gateway rate limits. properties: data: items: $ref: "#/components/schemas/AiGatewayRateLimitUsageResource" description: Live usage for one AI Gateway rate limit. type: array required: - data type: object AiGatewayRateLimitUsageResource: description: Live usage for one AI Gateway rate limit, or for the untracked or total traffic. properties: attributes: $ref: "#/components/schemas/AiGatewayRateLimitUsageAttributes" id: description: Rate limit UUID, `untracked` for traffic no enforced rate limit covers, or `total` for all gateway traffic. example: 33333333-3333-3333-3333-333333333333 type: string type: $ref: "#/components/schemas/AiGatewayRateLimitUsageType" required: - type - id - attributes type: object AiGatewayRateLimitUsageType: description: AI Gateway rate limit usage resource type. enum: - rate-limit-usage example: rate-limit-usage type: string x-enum-varnames: - RATE_LIMIT_USAGE AiGatewayRestrictedDetailsMeta: description: Visibility information for identifying instance details. properties: restricted_details: description: Whether identifying rows were withheld from the returned page. Pagination uses the underlying rows. example: false type: boolean required: - restricted_details type: object AiGatewayRoutingReasoningLevel: description: >- Optional reasoning effort preference for this model destination. Must be supported by the selected model and provider. For provider "*", every eligible provider must support the level. An explicit value overrides the request's reasoning setting, subject to model-group policy. Omitted or null preserves request and provider behavior; none is an explicit level, not the default. Omitted or null clears an override on full replacement. Routing-rule references cannot set this field; each referenced model destination owns its override. If an override cannot be applied at runtime, the gateway keeps the destination and restores the caller's original reasoning settings, or preserves the provider default when omitted. It rechecks all applicable route and model-group policies against those settings before sending. Model-group max_reasoning_level enforces hard limits; the override is not an additional cap. Normal fallback applies if governance denies the resulting request or the destination cannot otherwise serve it. Metrics and span tags record the override outcome and incompatibility reason. When response headers have not already been committed, `X-Ai-Gateway-Reasoning-Override` reports applied or not_applied for the returned attempt, and `X-Ai-Gateway-Reasoning-Override-Reason` reports the reason when not applied. enum: - none - minimal - low - medium - high - xhigh - max example: medium nullable: true type: string x-enum-varnames: - NONE - MINIMAL - LOW - MEDIUM - HIGH - XHIGH - MAX AiGatewayRoutingRuleAttributes: description: Routing rule configuration and metadata. properties: created_at: description: Time when the resource was created. example: "2026-08-24T12:00:00Z" format: date-time type: string route_id: description: Stable numeric route identifier used by scoped policies. example: 123 format: int64 type: integer tiers: items: $ref: "#/components/schemas/AiGatewayRoutingRuleTier" description: Routing fallback tier. minItems: 1 type: array updated_at: description: Time when the resource was last updated. example: "2026-08-24T12:00:00Z" format: date-time type: string required: - tiers - created_at - updated_at type: object AiGatewayRoutingRuleCreateAttributes: description: Attributes used to create an AI Gateway routing rule. properties: slug: description: Organization-unique resource slug. example: coding maxLength: 128 minLength: 1 type: string tiers: items: $ref: "#/components/schemas/AiGatewayRoutingRuleTierRequest" description: Routing fallback tier. minItems: 1 type: array required: - slug - tiers type: object AiGatewayRoutingRuleCreateData: description: Data used to create an AI Gateway routing rule. properties: attributes: $ref: "#/components/schemas/AiGatewayRoutingRuleCreateAttributes" type: $ref: "#/components/schemas/AiGatewayRoutingRuleType" required: - type - attributes type: object AiGatewayRoutingRuleCreateRequest: description: Request to create an AI Gateway routing rule. properties: data: $ref: "#/components/schemas/AiGatewayRoutingRuleCreateData" required: - data type: object AiGatewayRoutingRuleListResponse: description: Response containing AI Gateway routing rules. properties: data: items: $ref: "#/components/schemas/AiGatewayRoutingRuleResource" description: AI Gateway routing rule resource. type: array required: - data type: object AiGatewayRoutingRuleReplaceAttributes: description: Attributes used to replace an AI Gateway routing rule. properties: tiers: items: $ref: "#/components/schemas/AiGatewayRoutingRuleTierRequest" description: Routing fallback tier. minItems: 1 type: array required: - tiers type: object AiGatewayRoutingRuleReplaceData: description: Data used to replace an AI Gateway routing rule. properties: attributes: $ref: "#/components/schemas/AiGatewayRoutingRuleReplaceAttributes" id: description: Resource identifier. example: coding type: string type: $ref: "#/components/schemas/AiGatewayRoutingRuleType" required: - type - id - attributes type: object AiGatewayRoutingRuleReplaceRequest: description: Request to replace an AI Gateway routing rule. properties: data: $ref: "#/components/schemas/AiGatewayRoutingRuleReplaceData" required: - data type: object AiGatewayRoutingRuleResource: description: AI Gateway routing rule resource. properties: attributes: $ref: "#/components/schemas/AiGatewayRoutingRuleAttributes" id: description: Resource identifier. example: coding type: string type: $ref: "#/components/schemas/AiGatewayRoutingRuleType" required: - type - id - attributes type: object AiGatewayRoutingRuleResponse: description: Response containing one AI Gateway routing rule. properties: data: $ref: "#/components/schemas/AiGatewayRoutingRuleResource" required: - data type: object AiGatewayRoutingRuleTarget: description: Model target or reference to another routing rule. properties: id: description: Saved target row ID. On replacement, retain this ID only within its original route and at most once. A stale or foreign ID is rejected. example: 901 format: int64 minimum: 1 type: integer model: description: Model name or pattern. Omitted when the caller cannot view its provider. example: gpt-5.2-codex type: string model_id: description: Opaque model catalog ID for a concrete model target. New selections require provider View; saved selections can be retained without metadata. example: 101 format: int64 minimum: 1 type: integer provider: description: Provider slug. Omitted for dynamic resolution and when the caller cannot view its provider. example: prod-us type: string reasoning_level: $ref: "#/components/schemas/AiGatewayRoutingReasoningLevel" slug: description: Organization-unique resource slug. example: coding-fallback type: string type: $ref: "#/components/schemas/AiGatewayRoutingRuleTargetType" weight: description: Effective relative weight. Returned only for targets in weighted_affinity tiers. example: 70 format: int64 maximum: 10000 minimum: 1 type: integer required: - type type: object AiGatewayRoutingRuleTargetRequest: description: Model target or reference to another routing rule used to create or replace a rule. properties: id: description: Saved target row ID. On replacement, retain this ID only within its original route and at most once. A stale or foreign ID is rejected. example: 901 format: int64 minimum: 1 type: integer model: description: Model name. Omit when retaining a saved target by ID or selecting a concrete target by model_id. example: gpt-5.2-codex type: string model_id: description: Opaque model catalog ID for a concrete model target. New selections require provider View; saved selections can be retained without metadata. example: 101 format: int64 minimum: 1 type: integer provider: description: Provider slug. weighted_affinity requires an explicit provider and does not allow "*". example: prod-us type: string reasoning_level: $ref: "#/components/schemas/AiGatewayRoutingReasoningLevel" slug: description: Organization-unique routing rule slug. Allowed only in configured tiers. example: coding-fallback type: string type: $ref: "#/components/schemas/AiGatewayRoutingRuleTargetType" weight: description: >- Relative weight in a weighted_affinity tier. Omitted or null defaults to 1. Weights need not total 100. Must be omitted or null in configured tiers. example: 70 format: int64 maximum: 10000 minimum: 1 nullable: true type: integer required: - type type: object AiGatewayRoutingRuleTargetType: description: Type of routing target. enum: - model - routing-rule example: model type: string x-enum-varnames: - MODEL - ROUTING_RULE AiGatewayRoutingRuleTier: description: Routing fallback tier containing targets and their effective ordering. properties: ordering: $ref: "#/components/schemas/AiGatewayRoutingRuleTierOrdering" ordering_issue: $ref: "#/components/schemas/AiGatewayRoutingRuleTierOrderingIssue" targets: items: $ref: "#/components/schemas/AiGatewayRoutingRuleTarget" description: Routing target. minItems: 1 type: array required: - ordering - targets type: object AiGatewayRoutingRuleTierOrdering: description: How a tier orders its targets. enum: - configured - weighted_affinity example: configured type: string x-enum-varnames: - CONFIGURED - WEIGHTED_AFFINITY AiGatewayRoutingRuleTierOrderingIssue: description: >- Stored tier ordering is inconsistent. mixed means targets have different supported orderings, and unknown means a target has an unsupported ordering. The tier is reported as configured without weights. Replace the rule to repair it. Omitted for consistent tiers. A forced deletion cannot rewrite a surviving tier with an unknown issue. enum: - mixed - unknown example: mixed readOnly: true type: string x-enum-varnames: - MIXED - UNKNOWN AiGatewayRoutingRuleTierRequest: description: Routing fallback tier used to create or replace a rule. properties: ordering: $ref: "#/components/schemas/AiGatewayNullableRoutingRuleTierOrdering" targets: items: $ref: "#/components/schemas/AiGatewayRoutingRuleTargetRequest" description: Routing target. minItems: 1 type: array required: - targets type: object AiGatewayRoutingRuleType: description: AI Gateway routing rule resource type. enum: - routing-rules example: routing-rules type: string x-enum-varnames: - ROUTING_RULES AiGatewaySupportedOperation: description: Operation supported by an AI Gateway model. enum: - ANTHROPIC_MESSAGES - ANTHROPIC_COUNT_TOKENS - OPENAI_CHAT_COMPLETIONS - OPENAI_RESPONSES - OPENAI_WEB_SEARCH - OPENAI_EMBEDDINGS - GEMINI_GENERATE_CONTENT - GEMINI_RAW_PREDICTIONS example: OPENAI_CHAT_COMPLETIONS type: string x-enum-varnames: - ANTHROPIC_MESSAGES - ANTHROPIC_COUNT_TOKENS - OPENAI_CHAT_COMPLETIONS - OPENAI_RESPONSES - OPENAI_WEB_SEARCH - OPENAI_EMBEDDINGS - GEMINI_GENERATE_CONTENT - GEMINI_RAW_PREDICTIONS AiGatewayZDRMode: description: Zero data retention requirement for the organization's requests. enum: - "off" - required example: "off" type: string x-enum-varnames: - "OFF" - REQUIRED AiMemoryViolationResultDataType: description: AI memory violation result resource type. enum: [ai_memory_violation_result] example: ai_memory_violation_result type: string x-enum-varnames: - AI_MEMORY_VIOLATION_RESULT AiMemoryViolationResultRequest: description: Request body for creating an AI memory violation result. properties: data: $ref: "#/components/schemas/AiMemoryViolationResultRequestData" type: object AiMemoryViolationResultRequestAttributes: description: Attributes for creating an AI memory violation result. properties: line: description: The line number where the violation was found. example: 10 format: int64 type: integer message: description: A message explaining the violation result. example: This is a false positive because the input is sanitized. type: string name: description: The file path where the violation was found. example: src/main.py type: string repository_id: description: The repository identifier. example: my-repo type: string rule: description: The rule identifier in the format ruleset/rule. example: my-ai-ruleset/my-ai-rule type: string sha: description: The git commit SHA where the violation was found. example: abc123def456789012345678901234567890abcd type: string type: $ref: "#/components/schemas/AiMemoryViolationType" required: - rule - repository_id - sha - name - line - type - message type: object AiMemoryViolationResultRequestData: description: Request data for creating an AI memory violation result. properties: attributes: $ref: "#/components/schemas/AiMemoryViolationResultRequestAttributes" id: description: The violation result identifier. example: violation-abc type: string type: $ref: "#/components/schemas/AiMemoryViolationResultDataType" type: object AiMemoryViolationResultResponseAttributes: description: Response attributes of an AI memory violation result. properties: created_at: description: The creation timestamp. example: "2024-01-01T00:00:00+00:00" format: date-time type: string created_by: description: The identifier of the user who created the result. example: example-handle type: string line: description: The line number where the violation was found. example: 10 format: int64 type: integer message: description: A message explaining the violation result. example: This is a false positive because the input is sanitized. type: string name: description: The file path where the violation was found. example: src/main.py type: string repository_id: description: The repository identifier. example: my-repo type: string rule: description: The rule identifier in the format ruleset/rule. example: my-ai-ruleset/my-ai-rule type: string sha: description: The git commit SHA where the violation was found. example: abc123def456789012345678901234567890abcd type: string type: $ref: "#/components/schemas/AiMemoryViolationType" required: - rule - repository_id - sha - name - line - created_at - created_by - type - message type: object AiMemoryViolationResultResponseData: description: Response data for an AI memory violation result. properties: attributes: $ref: "#/components/schemas/AiMemoryViolationResultResponseAttributes" id: description: The numeric identifier of the violation result. example: "42" type: string type: $ref: "#/components/schemas/AiMemoryViolationResultDataType" required: - id - type - attributes type: object AiMemoryViolationResultsResponse: description: Response containing a list of AI memory violation results. properties: data: description: The list of AI memory violation results. items: $ref: "#/components/schemas/AiMemoryViolationResultResponseData" type: array required: - data type: object AiMemoryViolationType: description: The type of AI memory violation result indicating whether it is a true positive or false positive. enum: [TP, FP] example: FP type: string x-enum-varnames: - TP - FP AiPromptDataType: description: AI prompt resource type. enum: [ai_prompt] example: ai_prompt type: string x-enum-varnames: - AI_PROMPT AiPromptResponseAttributes: description: Response attributes of an AI prompt. properties: category: $ref: "#/components/schemas/CustomRuleRevisionAttributesCategory" checksum: description: Checksum of the prompt content. example: abc123 type: string content: description: Base64-encoded AI prompt content. example: Content type: string cwe: description: The CWE identifier associated with this prompt. example: "79" type: string description: description: Base64-encoded full description. example: Ruleset description type: string directories: description: Directory patterns this prompt applies to. example: [] items: type: string type: array execution_mode: $ref: "#/components/schemas/AiCustomRuleRevisionExecutionMode" file_search_keywords: description: Keywords used to search for relevant files. example: - import items: type: string type: array globs: description: File glob patterns this prompt applies to. example: - "**/*.py" items: type: string type: array is_default: description: Whether this is a default Datadog prompt. example: false type: boolean is_testing: description: Whether this prompt is for testing only. example: false type: boolean language: $ref: "#/components/schemas/Language" result_keywords_exclude: description: Keywords to exclude from results. example: [] items: type: string type: array rule_version: description: The version of the rule this prompt is associated with. example: "1" type: string severity: $ref: "#/components/schemas/CustomRuleRevisionAttributesSeverity" short_description: description: Base64-encoded short description. example: Ruleset short description type: string required: - rule_version - globs - short_description - description - severity - category - file_search_keywords - result_keywords_exclude - content - checksum - execution_mode - directories - is_testing - is_default type: object AiPromptResponseData: description: Response data for an AI prompt. properties: attributes: $ref: "#/components/schemas/AiPromptResponseAttributes" id: description: The prompt identifier. example: my-ai-ruleset/my-ai-rule type: string type: $ref: "#/components/schemas/AiPromptDataType" required: - id - type - attributes type: object AiPromptsResponse: description: Response containing a list of AI prompts. properties: data: description: The list of AI prompts. items: $ref: "#/components/schemas/AiPromptResponseData" type: array required: - data type: object AlertEventAttributes: description: Alert event attributes. properties: aggregation_key: $ref: "#/components/schemas/V2EventAggregationKey" custom: description: JSON object of custom attributes. example: {} type: object evt: $ref: "#/components/schemas/EventSystemAttributes" links: description: The links related to the event. example: [{"category": "runbook", "title": "Runbook Link", "url": "https://app.datadoghq.com/runbook"}] items: $ref: "#/components/schemas/AlertEventAttributesLinksItem" type: array priority: $ref: "#/components/schemas/AlertEventAttributesPriority" service: $ref: "#/components/schemas/V2EventService" status: $ref: "#/components/schemas/AlertEventAttributesStatus" timestamp: $ref: "#/components/schemas/V2EventTimestamp" title: $ref: "#/components/schemas/V2EventTitle" type: object AlertEventAttributesLinksItem: description: A link. properties: category: $ref: "#/components/schemas/AlertEventAttributesLinksItemCategory" title: description: |- The display text of the link. type: string url: description: |- The URL of the link. type: string type: object AlertEventAttributesLinksItemCategory: description: |- The category of the link. enum: - runbook - documentation - dashboard type: string x-enum-varnames: - RUNBOOK - DOCUMENTATION - DASHBOARD AlertEventAttributesPriority: description: The priority of the alert. enum: - "1" - "2" - "3" - "4" - "5" example: "5" type: string x-enum-varnames: - PRIORITY_ONE - PRIORITY_TWO - PRIORITY_THREE - PRIORITY_FOUR - PRIORITY_FIVE AlertEventAttributesStatus: description: The status of the alert. enum: - warn - error - ok example: "error" type: string x-enum-varnames: - WARN - ERROR - OK AlertEventCustomAttributes: additionalProperties: false description: |- Alert event attributes. properties: custom: $ref: "#/components/schemas/AlertEventCustomAttributesCustom" links: $ref: "#/components/schemas/AlertEventCustomAttributesLinks" priority: $ref: "#/components/schemas/AlertEventCustomAttributesPriority" status: $ref: "#/components/schemas/AlertEventCustomAttributesStatus" required: - status type: object AlertEventCustomAttributesCustom: additionalProperties: {} description: |- Free form JSON object for arbitrary data. Supports up to 100 properties per object and a maximum nesting depth of 10 levels. example: {} type: object AlertEventCustomAttributesLinks: description: |- The links related to the event. Maximum of 20 links allowed. items: $ref: "#/components/schemas/AlertEventCustomAttributesLinksItems" maxItems: 20 minItems: 1 type: array AlertEventCustomAttributesLinksItems: additionalProperties: false description: |- A link. properties: category: $ref: "#/components/schemas/AlertEventCustomAttributesLinksItemsCategory" title: description: |- The display text of the link. Limited to 300 characters. example: "Runbook Link" maxLength: 300 minLength: 1 type: string url: description: |- The URL of the link. Limited to 2048 characters. example: "https://app.datadoghq.com/runbook" maxLength: 2048 minLength: 1 type: string required: - url - category type: object AlertEventCustomAttributesLinksItemsCategory: description: |- The category of the link. enum: - runbook - documentation - dashboard - resource example: "runbook" type: string x-enum-varnames: - RUNBOOK - DOCUMENTATION - DASHBOARD - RESOURCE AlertEventCustomAttributesPriority: default: "5" description: |- The priority of the alert. enum: - "1" - "2" - "3" - "4" - "5" example: "5" type: string x-enum-varnames: - PRIORITY_ONE - PRIORITY_TWO - PRIORITY_THREE - PRIORITY_FOUR - PRIORITY_FIVE AlertEventCustomAttributesStatus: description: |- The status of the alert. enum: - warn - error - ok example: "warn" type: string x-enum-varnames: - WARN - ERROR - OK Allocation: description: Targeting rule (allocation) details for a feature flag environment. properties: created_at: description: The timestamp when the targeting rule allocation was created. example: "2024-01-01T12:00:00Z" format: date-time type: string environment_ids: description: Environment IDs associated with this targeting rule allocation. example: - "550e8400-e29b-41d4-a716-446655440001" items: description: Environment ID linked to this targeting rule allocation. format: uuid type: string type: array experiment_id: description: The experiment ID linked to this targeting rule allocation. example: "550e8400-e29b-41d4-a716-446655440030" nullable: true type: string exposure_schedule: $ref: "#/components/schemas/AllocationExposureSchedule" guardrail_metrics: description: Guardrail metrics associated with this targeting rule allocation. items: $ref: "#/components/schemas/GuardrailMetric" type: array id: description: "The unique identifier of the targeting rule allocation. Use this ID with the allocation management endpoints, such as `/api/v2/allocations/{allocation_id}`. It is not included in SDK evaluation results or exposure events." example: "550e8400-e29b-41d4-a716-446655440020" format: uuid type: string key: description: "The unique key of the targeting rule allocation. SDKs report this key in flag evaluation results and exposure events to indicate which targeting rule assigned the variant. Use it to match evaluation or experiment data to this rule." example: "prod-rollout" type: string name: description: The display name of the targeting rule. example: "Production Rollout" type: string order_position: description: Sort order position within the environment. example: 0 format: int64 type: integer targeting_rules: description: Conditions associated with this targeting rule allocation. items: $ref: "#/components/schemas/TargetingRule" type: array type: $ref: "#/components/schemas/AllocationType" updated_at: description: The timestamp when the targeting rule allocation was last updated. example: "2024-01-01T12:00:00Z" format: date-time type: string variant_weights: description: Weighted variant assignments for this targeting rule allocation. items: $ref: "#/components/schemas/VariantWeight" type: array required: - name - key - targeting_rules - variant_weights - order_position - environment_ids - type - guardrail_metrics - created_at - updated_at type: object AllocationDataRequest: description: Data wrapper for allocation request payloads. properties: attributes: $ref: "#/components/schemas/UpsertAllocationRequest" type: $ref: "#/components/schemas/AllocationDataType" required: - type - attributes type: object AllocationDataResponse: description: Data wrapper for targeting rule allocation responses. properties: attributes: $ref: "#/components/schemas/Allocation" id: description: "The unique identifier of the targeting rule allocation. Use this ID with the allocation management endpoints, such as `/api/v2/allocations/{allocation_id}`. It is not included in SDK evaluation results or exposure events." example: "550e8400-e29b-41d4-a716-446655440020" format: uuid type: string type: $ref: "#/components/schemas/AllocationDataType" required: - id - type - attributes type: object AllocationDataType: description: The resource type. enum: - "allocations" example: "allocations" type: string x-enum-varnames: - ALLOCATIONS AllocationExposureGuardrailTrigger: description: Guardrail trigger details for a progressive rollout. properties: allocation_exposure_schedule_id: description: The progressive rollout ID this trigger belongs to. example: "550e8400-e29b-41d4-a716-446655440010" format: uuid type: string created_at: description: The timestamp when this trigger was created. example: "2024-01-01T12:00:00Z" format: date-time type: string flagging_variant_id: description: The variant ID that triggered this event. example: "550e8400-e29b-41d4-a716-446655440001" format: uuid type: string id: description: The unique identifier of the guardrail trigger. example: "550e8400-e29b-41d4-a716-446655440080" format: uuid type: string metric_id: description: The metric ID associated with the trigger. example: "metric-error-rate" type: string triggered_action: description: The action that was triggered. example: "PAUSE" type: string updated_at: description: The timestamp when this trigger was last updated. example: "2024-01-01T12:00:00Z" format: date-time type: string required: - id - allocation_exposure_schedule_id - flagging_variant_id - metric_id - triggered_action - created_at - updated_at type: object AllocationExposureRolloutStep: description: Exposure progression step details. properties: allocation_exposure_schedule_id: description: The progressive rollout ID this step belongs to. example: "550e8400-e29b-41d4-a716-446655440010" format: uuid type: string created_at: description: The timestamp when the progression step was created. example: "2024-01-01T12:00:00Z" format: date-time type: string exposure_ratio: description: The exposure ratio for this step. example: 0.1 format: double maximum: 1 minimum: 0 type: number grouped_step_index: description: Logical index grouping related steps. example: 0 format: int64 minimum: 0 type: integer id: description: The unique identifier of the progression step. example: "550e8400-e29b-41d4-a716-446655440040" format: uuid type: string interval_ms: description: Step duration in milliseconds. example: 3600000 format: int64 nullable: true type: integer is_pause_record: description: Whether this step represents a pause record. example: false type: boolean order_position: description: Sort order for the progression step. example: 0 format: int64 type: integer updated_at: description: The timestamp when the progression step was last updated. example: "2024-01-01T12:00:00Z" format: date-time type: string required: - id - allocation_exposure_schedule_id - order_position - exposure_ratio - is_pause_record - grouped_step_index - created_at - updated_at type: object AllocationExposureSchedule: description: Progressive release details for a targeting rule allocation. properties: absolute_start_time: description: The absolute UTC start time for this schedule. example: "2025-06-13T12:00:00Z" format: date-time nullable: true type: string allocation_id: description: "The unique identifier (UUID) of the targeting rule allocation this progressive rollout belongs to. This is not the allocation key that SDKs report in evaluation results and exposure events." example: "550e8400-e29b-41d4-a716-446655440020" format: uuid type: string control_variant_id: description: The control variant ID used for experiment comparisons. example: "550e8400-e29b-41d4-a716-446655440012" nullable: true type: string created_at: description: The timestamp when the schedule was created. example: "2024-01-01T12:00:00Z" format: date-time type: string guardrail_triggered_action: description: Last guardrail action triggered for this schedule. example: "PAUSE" nullable: true type: string guardrail_triggers: description: Guardrail trigger records for this schedule. items: $ref: "#/components/schemas/AllocationExposureGuardrailTrigger" type: array id: description: The unique identifier of the progressive rollout. example: "550e8400-e29b-41d4-a716-446655440010" format: uuid type: string rollout_options: $ref: "#/components/schemas/RolloutOptions" rollout_steps: description: Ordered progression steps for exposure. items: $ref: "#/components/schemas/AllocationExposureRolloutStep" type: array updated_at: description: The timestamp when the schedule was last updated. example: "2024-01-01T12:00:00Z" format: date-time type: string required: - allocation_id - rollout_options - rollout_steps - guardrail_triggers - created_at - updated_at type: object AllocationExposureScheduleData: description: Data wrapper for progressive rollout schedule responses. properties: attributes: $ref: "#/components/schemas/AllocationExposureSchedule" id: description: The unique identifier of the progressive rollout. example: "550e8400-e29b-41d4-a716-446655440010" format: uuid type: string type: $ref: "#/components/schemas/AllocationExposureScheduleDataType" required: - id - type - attributes type: object AllocationExposureScheduleDataType: description: The resource type for progressive rollout schedules. enum: - "allocation_exposure_schedules" example: "allocation_exposure_schedules" type: string x-enum-varnames: - ALLOCATION_EXPOSURE_SCHEDULES AllocationExposureScheduleResponse: description: Response containing a progressive rollout schedule. properties: data: $ref: "#/components/schemas/AllocationExposureScheduleData" required: - data type: object AllocationResponse: description: Response containing a single targeting rule (allocation). properties: data: $ref: "#/components/schemas/AllocationDataResponse" required: - data type: object AllocationType: description: The type of targeting rule (called allocation in the API model). enum: - FEATURE_GATE - CANARY example: "FEATURE_GATE" type: string x-enum-varnames: - FEATURE_GATE - CANARY AnalysisEdit: description: A single edit operation within a fix suggestion for a rule violation. properties: content: description: The content to insert or replace at the specified position, if applicable. example: "safe_alternative()" nullable: true type: string edit_type: $ref: "#/components/schemas/AnalysisEditType" end: $ref: "#/components/schemas/AnalysisPosition" description: The end position of the edit, or null for pure insertions. nullable: true start: $ref: "#/components/schemas/AnalysisPosition" required: - start - end - edit_type - content type: object AnalysisEditType: default: ADD description: The type of code edit to apply when fixing a violation. enum: - ADD - UPDATE - REMOVE example: ADD type: string x-enum-varnames: - ADD - UPDATE - REMOVE AnalysisFix: description: A fix suggestion for a rule violation, consisting of one or more edit operations. properties: description: description: A human-readable description of what the fix does. example: Replace with a safe alternative. type: string edits: description: The list of edit operations that constitute the fix. items: $ref: "#/components/schemas/AnalysisEdit" type: array required: - description - edits type: object AnalysisPosition: description: A position in source code, identified by line and column numbers. properties: col: description: The column number in the source file (1-based). example: 5 format: int64 type: integer line: description: The line number in the source file (1-based). example: 10 format: int64 type: integer required: - line - col type: object AnalysisRequest: description: The request payload for running static analysis on source code. properties: _authentication_token: description: CSRF token for security, sent by browser-based clients. Ignored by the API when absent. type: string data: $ref: "#/components/schemas/AnalysisRequestData" required: - data type: object AnalysisRequestData: description: The primary data object in the analysis request. properties: attributes: $ref: "#/components/schemas/AnalysisRequestDataAttributes" id: description: An optional identifier for the analysis request resource. type: string type: $ref: "#/components/schemas/AnalysisRequestDataType" required: - type - attributes type: object AnalysisRequestDataAttributes: description: The attributes of the analysis request, containing the source code and rules to apply. properties: code: description: The base64-encoded source code to analyze. example: aW1wb3J0IHN5cw== type: string file_encoding: description: The encoding of the source code file (must be `utf-8`). example: utf-8 type: string filename: description: The name of the file being analyzed. example: test.py type: string language: description: The programming language of the source code. example: python type: string options: $ref: "#/components/schemas/AnalysisRequestOptions" rules: description: The list of static analysis rules to apply during analysis. items: $ref: "#/components/schemas/AnalysisRequestRule" type: array required: - code - file_encoding - filename - language - rules type: object AnalysisRequestDataType: default: analysis_request description: Analysis request resource type. enum: - analysis_request example: analysis_request type: string x-enum-varnames: - ANALYSIS_REQUEST AnalysisRequestOptions: description: |- Analyzer options sent by browser-based clients. Accepted but ignored: the API always runs the analysis with tree-sitter enabled and rule output logged. properties: log_output: description: Whether to capture the output logged by rules during execution. Ignored by this operation. example: true type: boolean use_tree_sitter: description: Whether to use tree-sitter to parse the source code. Ignored by this operation. example: true type: boolean type: object AnalysisRequestRule: additionalProperties: {} description: |- A static analysis rule to apply during code analysis. Clients forward complete rule objects returned by the rulesets endpoints, so every member of that resource is declared here; only `id`, `category`, `checksum`, `language`, `severity`, `tree_sitter_query`, `entity_checked`, `regex`, `type` and `code` are read by this operation and the rest are ignored. The schema stays open so that any member beyond the forwarded rule resource is reported as a promotion candidate rather than rejected; it can be closed once that telemetry confirms none remain. properties: arguments: description: The configurable arguments accepted by the rule. Forwarded from the rulesets endpoints; ignored by this operation. items: $ref: "#/components/schemas/AnalysisRequestRuleArgument" type: array category: description: The category of the rule (for example, `BEST_PRACTICES`, `SECURITY`). example: BEST_PRACTICES type: string checksum: description: A checksum of the rule definition. example: abc123def456 type: string code: description: The base64-encoded rule implementation code. example: ZnVuY3Rpb24gdmlzaXQobm9kZSkge30= type: string created_at: description: The date and time when the rule was created. Server-assigned by the rulesets endpoints; ignored by this operation. format: date-time readOnly: true type: string created_by: description: The identifier of the user or system that created the rule. Server-assigned by the rulesets endpoints; ignored by this operation. readOnly: true type: string creation_message: description: The message associated with the custom rule revision. Forwarded from the custom rulesets endpoints; ignored by this operation. type: string cve: description: The CVE identifier associated with the rule. Forwarded from the rulesets endpoints; ignored by this operation. type: string cwe: description: The CWE identifier associated with the rule. Forwarded from the rulesets endpoints; ignored by this operation. type: string description: description: A detailed explanation of what the rule detects. Forwarded from the rulesets endpoints; ignored by this operation. type: string documentation_url: description: A URL pointing to the rule documentation. Forwarded from the rulesets endpoints; ignored by this operation. type: string entity_checked: description: The code entity type checked by the rule, applicable when rule type is `AST_CHECK`. nullable: true type: string id: description: The unique identifier of the rule. example: python-best-practices/no-exit type: string is_published: description: Whether the rule is published. Forwarded from the rulesets endpoints; ignored by this operation. type: boolean is_testing: description: Whether the rule is in testing mode. Forwarded from the rulesets endpoints; ignored by this operation. type: boolean language: description: The programming language this rule targets. example: python type: string last_updated_at: description: The date and time when the rule was last modified. Server-assigned by the rulesets endpoints; ignored by this operation. format: date-time readOnly: true type: string last_updated_by: description: The identifier of the user or system that last updated the rule. Server-assigned by the rulesets endpoints; ignored by this operation. readOnly: true type: string name: description: The name of the rule. Forwarded from the rulesets endpoints; ignored by this operation. example: no-exit type: string regex: description: A base64-encoded regex pattern used by the rule, applicable when rule type is `REGEX`. nullable: true type: string severity: description: The severity of findings from this rule (for example, `ERROR`, `WARNING`). example: WARNING type: string short_description: description: A brief summary of what the rule detects. Forwarded from the rulesets endpoints; ignored by this operation. type: string should_use_ai_fix: description: Whether an AI-generated fix should be offered. Forwarded from the rulesets endpoints; ignored by this operation. type: boolean tags: description: Tags associated with the custom rule revision. Forwarded from the custom rulesets endpoints; ignored by this operation. items: type: string type: array tests: description: The test cases associated with the rule. Forwarded from the rulesets endpoints; ignored by this operation. items: $ref: "#/components/schemas/AnalysisRequestRuleTest" type: array tree_sitter_query: description: The base64-encoded tree-sitter query used by the rule. example: KGNhbGwgbmFtZTogKGF0dHJpYnV0ZSkpQHZhbA== type: string type: description: The rule type indicating the detection mechanism (for example, `TREE_SITTER_QUERY`). example: TREE_SITTER_QUERY type: string version_id: description: The custom rule revision version. Forwarded from the custom rulesets endpoints; ignored by this operation. format: int64 type: integer required: - id - category - checksum - language - severity - tree_sitter_query - type - code type: object AnalysisRequestRuleArgument: description: A configurable argument of a forwarded static analysis rule. properties: description: description: An explanation of the argument's purpose and accepted values. type: string name: description: The name of the rule argument. type: string type: object AnalysisRequestRuleTest: description: A test case of a forwarded static analysis rule. properties: annotation_count: description: The expected number of findings the rule should produce against the test code. format: int64 maximum: 65535 minimum: 0 type: integer code: description: The source code snippet used as input for the rule test. type: string filename: description: The filename associated with the test code snippet. type: string type: object AnalysisResponse: description: The response payload from running static analysis on source code. properties: data: $ref: "#/components/schemas/AnalysisResponseData" required: - data type: object AnalysisResponseData: description: The primary data object in the analysis response. properties: attributes: $ref: "#/components/schemas/AnalysisResponseDataAttributes" id: description: The unique identifier of the analysis response resource. example: abc-123 type: string type: $ref: "#/components/schemas/AnalysisResponseDataType" required: - id - type - attributes type: object AnalysisResponseDataAttributes: description: The attributes of the analysis response, containing rule results and any top-level errors. properties: errors: description: Top-level error messages encountered during the analysis operation. example: [] items: type: string type: array rule_responses: description: The list of results for each static analysis rule applied during analysis. items: $ref: "#/components/schemas/AnalysisRuleResponse" type: array required: - rule_responses - errors type: object AnalysisResponseDataType: default: server_request description: Analysis response resource type. enum: - server_request example: server_request type: string x-enum-varnames: - SERVER_REQUEST AnalysisRuleResponse: description: The result of applying a single static analysis rule to the analyzed source code. properties: errors: description: A list of error messages encountered while executing the rule. example: [] items: type: string type: array execution_error: description: An error message if the rule execution failed, or null if execution succeeded. example: nullable: true type: string execution_time_ms: description: The time taken to execute the rule, in milliseconds. example: 42 format: int64 type: integer identifier: description: The identifier of the rule that produced this response. example: python-best-practices/no-exit type: string output: description: The raw output produced by the rule engine during execution. example: "" type: string violations: description: The list of violations found by this rule. items: $ref: "#/components/schemas/AnalysisViolation" type: array required: - errors - execution_error - execution_time_ms - identifier - output - violations type: object AnalysisViolation: description: A rule violation found in the analyzed source code. properties: category: description: The category of the violation. example: BEST_PRACTICES type: string end: $ref: "#/components/schemas/AnalysisPosition" fixes: description: The list of suggested fixes for this violation. items: $ref: "#/components/schemas/AnalysisFix" type: array message: description: A human-readable description of the violation. example: Use of sys.exit() is discouraged. type: string severity: description: The severity level of the violation. example: WARNING type: string start: $ref: "#/components/schemas/AnalysisPosition" required: - category - severity - message - start - end - fixes type: object Annotation: description: A text annotation displayed on the workflow canvas. properties: display: $ref: "#/components/schemas/AnnotationDisplay" id: description: The unique identifier of this annotation within the workflow. example: "" minLength: 1 type: string markdownTextAnnotation: $ref: "#/components/schemas/AnnotationMarkdownTextAnnotation" required: - id - display - markdownTextAnnotation type: object AnnotationAttributes: description: Attributes of an annotation returned in a response. properties: author_id: description: Identifier of the user who created the annotation. example: "00000000-0000-0000-0000-000000000000" type: string color: $ref: "#/components/schemas/AnnotationColor" created_at: description: Creation time of the annotation in milliseconds since the Unix epoch. example: 1704067200000 format: int64 type: integer description: description: User-defined text attached to the annotation. example: "Deployed v2.3.1 to production." type: string end_time: description: End time of the annotation in milliseconds since the Unix epoch. Null for `pointInTime` annotations. example: 1704070800000 format: int64 nullable: true type: integer modified_at: description: Last modification time of the annotation in milliseconds since the Unix epoch. example: 1704067200000 format: int64 type: integer page_id: description: |- ID of the page the annotation belongs to, prefixed with the page type and joined by a colon (for example, `dashboard:abc-def-xyz` or `notebook:1234567890`). example: "dashboard:abc-def-xyz" type: string start_time: description: Start time of the annotation in milliseconds since the Unix epoch. example: 1704067200000 format: int64 type: integer type: $ref: "#/components/schemas/AnnotationKind" widget_ids: description: IDs of widgets the annotation is associated with. When empty or omitted, the annotation applies to the whole page. example: - "1234567890" items: description: Widget ID. type: string type: array required: - page_id - description - author_id - type - color - start_time - end_time - created_at - modified_at type: object AnnotationColor: description: Color used to render the annotation in the UI. enum: - gray - blue - purple - green - yellow - red example: blue type: string x-enum-varnames: - GRAY - BLUE - PURPLE - GREEN - YELLOW - RED AnnotationCreateAttributes: description: Attributes for creating or updating an annotation. properties: color: $ref: "#/components/schemas/AnnotationColor" description: description: User-defined text attached to the annotation. example: "Deployed v2.3.1 to production." type: string end_time: description: End time of the annotation in milliseconds since the Unix epoch. Required for `timeRegion` annotations; omit or set to null for `pointInTime` annotations. example: 1704070800000 format: int64 nullable: true type: integer page_id: description: |- ID of the page the annotation belongs to, prefixed with the page type and joined by a colon (for example, `dashboard:abc-def-xyz` or `notebook:1234567890`). example: "dashboard:abc-def-xyz" type: string start_time: description: Start time of the annotation in milliseconds since the Unix epoch. example: 1704067200000 format: int64 type: integer type: $ref: "#/components/schemas/AnnotationKind" widget_ids: description: IDs of widgets the annotation is associated with. When empty or omitted, the annotation applies to the whole page. example: - "1234567890" items: description: Widget ID. type: string type: array required: - page_id - description - type - color - start_time type: object AnnotationCreateRequest: description: Request body for creating an annotation. properties: data: $ref: "#/components/schemas/AnnotationRequestData" required: - data type: object AnnotationData: description: A single annotation resource. properties: attributes: $ref: "#/components/schemas/AnnotationAttributes" id: description: Unique identifier of the annotation. example: "00000000-0000-0000-0000-000000000000" format: uuid type: string type: $ref: "#/components/schemas/AnnotationType" required: - id - type - attributes type: object AnnotationDisplay: description: The annotation's position and size on the workflow canvas. properties: bounds: $ref: "#/components/schemas/AnnotationDisplayBounds" type: object AnnotationDisplayBounds: description: Canvas coordinates and dimensions for an annotation on the workflow canvas. properties: height: description: The annotation's height on the canvas. format: double type: number width: description: The annotation's width on the canvas. format: double type: number x: description: The annotation's horizontal canvas coordinate. format: double type: number y: description: The annotation's vertical canvas coordinate. format: double type: number type: object AnnotationInPage: description: A flat annotation object as it appears within a page annotations response. properties: author_id: description: Identifier of the user who created the annotation. example: "00000000-0000-0000-0000-000000000000" type: string color: $ref: "#/components/schemas/AnnotationColor" created_at: description: Creation time of the annotation in milliseconds since the Unix epoch. example: 1704067200000 format: int64 type: integer description: description: User-defined text attached to the annotation. example: "Deployed v2.3.1 to production." type: string end_time: description: End time of the annotation in milliseconds since the Unix epoch. Null for `pointInTime` annotations. example: 1704070800000 format: int64 nullable: true type: integer id: description: Unique identifier of the annotation. example: "00000000-0000-0000-0000-000000000000" format: uuid type: string modified_at: description: Last modification time of the annotation in milliseconds since the Unix epoch. example: 1704067200000 format: int64 type: integer page_id: description: |- ID of the page the annotation belongs to, prefixed with the page type and joined by a colon (for example, `dashboard:abc-def-xyz` or `notebook:1234567890`). example: "dashboard:abc-def-xyz" type: string start_time: description: Start time of the annotation in milliseconds since the Unix epoch. example: 1704067200000 format: int64 type: integer type: $ref: "#/components/schemas/AnnotationKind" widget_ids: description: IDs of widgets the annotation is associated with. When empty or omitted, the annotation applies to the whole page. example: - "1234567890" items: description: Widget ID. type: string type: array required: - id - page_id - description - author_id - type - color - start_time - end_time - created_at - modified_at type: object AnnotationKind: description: |- Kind of annotation. `pointInTime` annotations mark a single moment in time, while `timeRegion` annotations span a window of time and require an `end_time`. enum: - pointInTime - timeRegion example: pointInTime type: string x-enum-varnames: - POINT_IN_TIME - TIME_REGION AnnotationMarkdownTextAnnotation: description: Markdown content displayed in an annotation. properties: text: description: The annotation's Markdown content. maxLength: 3000 type: string type: object AnnotationRequestData: description: Data for creating an annotation. properties: attributes: $ref: "#/components/schemas/AnnotationCreateAttributes" type: $ref: "#/components/schemas/AnnotationType" required: - type - attributes type: object AnnotationResponse: description: Response containing a single annotation. properties: data: $ref: "#/components/schemas/AnnotationData" required: - data type: object AnnotationType: description: Annotation resource type. enum: - annotation example: annotation type: string x-enum-varnames: - ANNOTATION AnnotationUpdateRequest: description: Request body for updating an annotation. properties: data: $ref: "#/components/schemas/AnnotationRequestData" required: - data type: object AnnotationsData: description: List of annotation resources. items: $ref: "#/components/schemas/AnnotationData" type: array AnnotationsInPageMap: additionalProperties: $ref: "#/components/schemas/AnnotationInPage" description: Map of annotation UUID to annotation object, keyed by annotation ID. example: "00000000-0000-0000-0000-000000000000": author_id: "00000000-0000-0000-0000-000000000001" color: blue created_at: 1704067200000 description: "Deployed v2.3.1 to production." end_time: id: "00000000-0000-0000-0000-000000000000" modified_at: 1704067200000 page_id: "dashboard:abc-def-xyz" start_time: 1704067200000 type: pointInTime widget_ids: - "1234567890" type: object AnnotationsResponse: description: Response containing a list of annotations. properties: data: $ref: "#/components/schemas/AnnotationsData" required: - data type: object AnonymizeUserError: description: Error encountered when anonymizing a specific user. properties: error: description: Error message describing why anonymization failed. example: "" type: string user_id: description: UUID of the user that failed to be anonymized. example: "00000000-0000-0000-0000-000000000000" type: string required: - user_id - error type: object AnonymizeUsersRequest: description: Request body for anonymizing users. properties: data: $ref: "#/components/schemas/AnonymizeUsersRequestData" required: - data type: object AnonymizeUsersRequestAttributes: description: Attributes of an anonymize users request. properties: user_ids: description: List of user IDs (UUIDs) to anonymize. example: - "00000000-0000-0000-0000-000000000000" items: example: "00000000-0000-0000-0000-000000000000" type: string type: array required: - user_ids type: object AnonymizeUsersRequestData: description: Object to anonymize a list of users. properties: attributes: $ref: "#/components/schemas/AnonymizeUsersRequestAttributes" id: description: Unique identifier for the request. Not used server-side. example: "00000000-0000-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/AnonymizeUsersRequestType" required: - type - attributes type: object AnonymizeUsersRequestType: default: anonymize_users_request description: Type of the anonymize users request. enum: - anonymize_users_request example: anonymize_users_request type: string x-enum-varnames: - ANONYMIZE_USERS_REQUEST AnonymizeUsersResponse: description: Response containing the result of an anonymize users request. properties: data: $ref: "#/components/schemas/AnonymizeUsersResponseData" type: object AnonymizeUsersResponseAttributes: description: Attributes of an anonymize users response. properties: anonymize_errors: description: List of errors encountered during anonymization, one entry per failed user. items: $ref: "#/components/schemas/AnonymizeUserError" type: array anonymized_user_ids: description: List of user IDs (UUIDs) that were successfully anonymized. example: - "00000000-0000-0000-0000-000000000000" items: example: "00000000-0000-0000-0000-000000000000" type: string type: array required: - anonymized_user_ids - anonymize_errors type: object AnonymizeUsersResponseData: description: Response data for anonymizing users. properties: attributes: $ref: "#/components/schemas/AnonymizeUsersResponseAttributes" id: description: Unique identifier of the response. example: "00000000-0000-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/AnonymizeUsersResponseType" type: object AnonymizeUsersResponseType: default: anonymize_users_response description: Type of the anonymize users response. enum: - anonymize_users_response example: anonymize_users_response type: string x-enum-varnames: - ANONYMIZE_USERS_RESPONSE AnthropicAPIKey: description: The definition of the `AnthropicAPIKey` object. properties: api_token: $ref: "#/components/schemas/AnthropicAPIKeyApiToken" type: $ref: "#/components/schemas/AnthropicAPIKeyType" required: - type - api_token type: object AnthropicAPIKeyApiToken: description: The `AnthropicAPIKey` `api_token`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" AnthropicAPIKeyType: description: The definition of the `AnthropicAPIKey` object. enum: - AnthropicAPIKey example: AnthropicAPIKey type: string x-enum-varnames: - ANTHROPICAPIKEY AnthropicAPIKeyUpdate: description: The definition of the `AnthropicAPIKey` object. properties: api_token: $ref: "#/components/schemas/AnthropicAPIKeyUpdateApiToken" type: $ref: "#/components/schemas/AnthropicAPIKeyType" required: - type type: object AnthropicAPIKeyUpdateApiToken: description: The `AnthropicAPIKeyUpdate` `api_token`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" AnthropicCredentials: description: The definition of the `AnthropicCredentials` object. oneOf: - $ref: "#/components/schemas/AnthropicAPIKey" AnthropicCredentialsUpdate: description: The definition of the `AnthropicCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/AnthropicAPIKeyUpdate" AnthropicIntegration: description: The definition of the `AnthropicIntegration` object. properties: credentials: $ref: "#/components/schemas/AnthropicCredentials" type: $ref: "#/components/schemas/AnthropicIntegrationType" required: - type - credentials type: object AnthropicIntegrationType: description: The definition of the `AnthropicIntegrationType` object. enum: - Anthropic example: Anthropic type: string x-enum-varnames: - ANTHROPIC AnthropicIntegrationUpdate: description: The definition of the `AnthropicIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/AnthropicCredentialsUpdate" type: $ref: "#/components/schemas/AnthropicIntegrationType" required: - type type: object AnyValue: description: Represents any valid JSON value. nullable: true oneOf: - $ref: "#/components/schemas/AnyValueString" - $ref: "#/components/schemas/AnyValueNumber" - $ref: "#/components/schemas/AnyValueObject" - $ref: "#/components/schemas/AnyValueArray" - $ref: "#/components/schemas/AnyValueBoolean" type: object AnyValueArray: description: An array of arbitrary values. items: $ref: "#/components/schemas/AnyValueItem" type: array AnyValueBoolean: description: A scalar boolean value. type: boolean AnyValueItem: description: A single item in an array of arbitrary values, which can be a string, number, object, or boolean. oneOf: - $ref: "#/components/schemas/AnyValueString" - $ref: "#/components/schemas/AnyValueNumber" - $ref: "#/components/schemas/AnyValueObject" - $ref: "#/components/schemas/AnyValueBoolean" AnyValueNumber: description: A scalar numeric value. format: double type: number AnyValueObject: additionalProperties: {} description: An arbitrary object value with additional properties. type: object AnyValueString: description: A scalar value represented as a string. type: string ApiID: description: API identifier. example: "90646597-5fdb-4a17-a240-647003f8c028" format: uuid type: string ApmDependencyStatName: description: The APM dependency statistic to query. enum: - avg_duration - avg_root_duration - avg_spans_per_trace - error_rate - pct_exec_time - pct_of_traces - total_traces_count example: avg_duration type: string x-enum-varnames: - AVG_DURATION - AVG_ROOT_DURATION - AVG_SPANS_PER_TRACE - ERROR_RATE - PCT_EXEC_TIME - PCT_OF_TRACES - TOTAL_TRACES_COUNT ApmDependencyStatsDataSource: default: apm_dependency_stats description: A data source for APM dependency statistics queries. enum: - apm_dependency_stats example: apm_dependency_stats type: string x-enum-varnames: - APM_DEPENDENCY_STATS ApmDependencyStatsQuery: description: >- A query for APM dependency statistics between services, such as call latency and error rates. properties: cross_org_uuids: $ref: "#/components/schemas/CrossOrgUuids" data_source: $ref: "#/components/schemas/ApmDependencyStatsDataSource" env: description: The environment to query. example: prod type: string is_upstream: description: Determines whether stats for upstream or downstream dependencies should be queried. example: true type: boolean name: description: The variable name for use in formulas. example: query1 type: string operation_name: description: The APM operation name. example: web.request type: string primary_tag_name: description: The name of the second primary tag used within APM; required when `primary_tag_value` is specified. See https://docs.datadoghq.com/tracing/guide/setting_primary_tags_to_scope/#add-a-second-primary-tag-in-datadog. example: datacenter type: string primary_tag_value: description: Filter APM data by the second primary tag. `primary_tag_name` must also be specified. example: us-east-1 type: string resource_name: description: The resource name to filter by. example: "GET /api/v2/users" type: string service: description: The service name to filter by. example: web-store type: string stat: $ref: "#/components/schemas/ApmDependencyStatName" required: - data_source - name - env - operation_name - resource_name - service - stat type: object ApmMetricsDataSource: default: apm_metrics description: A data source for APM metrics queries. enum: - apm_metrics example: apm_metrics type: string x-enum-varnames: - APM_METRICS ApmMetricsQuery: description: >- A query for APM trace metrics such as hits, errors, and latency percentiles, aggregated across services. properties: cross_org_uuids: $ref: "#/components/schemas/CrossOrgUuids" data_source: $ref: "#/components/schemas/ApmMetricsDataSource" group_by: description: Optional fields to group the query results by. items: description: A field to group results by. example: service type: string type: array name: description: The variable name for use in formulas. example: query1 type: string operation_mode: description: Optional operation mode to aggregate across operation names. example: "primary" type: string operation_name: description: Name of operation on service. If not provided, the primary operation name is used. example: web.request type: string peer_tags: description: Tags to query for a specific downstream entity (peer.service, peer.db_instance, peer.s3, peer.s3.bucket, etc.). items: description: A peer tag value. example: "peer.service:my-service" type: string type: array query_filter: description: Additional filters for the query using metrics query syntax (for example, env, primary_tag). example: "env:prod" type: string resource_hash: description: The resource hash for exact matching. example: "abc123" type: string resource_name: description: The full name of a specific resource to filter by. example: "GET /api/v1/users" type: string service: description: The service name to filter by. example: web-store type: string span_kind: $ref: "#/components/schemas/ApmMetricsSpanKind" stat: $ref: "#/components/schemas/ApmMetricsStat" required: - data_source - name - stat type: object ApmMetricsSpanKind: description: Describes the relationship between the span, its parents, and its children in a trace. enum: - consumer - server - client - producer - internal example: server type: string x-enum-varnames: - CONSUMER - SERVER - CLIENT - PRODUCER - INTERNAL ApmMetricsStat: description: The APM metric statistic to query. enum: - error_rate - errors - errors_per_second - hits - hits_per_second - apdex - latency_avg - latency_max - latency_p50 - latency_p75 - latency_p90 - latency_p95 - latency_p99 - latency_p999 - latency_distribution - total_time example: latency_p99 type: string x-enum-varnames: - ERROR_RATE - ERRORS - ERRORS_PER_SECOND - HITS - HITS_PER_SECOND - APDEX - LATENCY_AVG - LATENCY_MAX - LATENCY_P50 - LATENCY_P75 - LATENCY_P90 - LATENCY_P95 - LATENCY_P99 - LATENCY_P999 - LATENCY_DISTRIBUTION - TOTAL_TIME ApmResourceStatName: description: The APM resource statistic to query. enum: - error_rate - errors - hits - latency_avg - latency_max - latency_p50 - latency_p75 - latency_p90 - latency_p95 - latency_p99 - latency_distribution - total_time example: latency_p95 type: string x-enum-varnames: - ERROR_RATE - ERRORS - HITS - LATENCY_AVG - LATENCY_MAX - LATENCY_P50 - LATENCY_P75 - LATENCY_P90 - LATENCY_P95 - LATENCY_P99 - LATENCY_DISTRIBUTION - TOTAL_TIME ApmResourceStatsDataSource: default: apm_resource_stats description: A data source for APM resource statistics queries. enum: - apm_resource_stats example: apm_resource_stats type: string x-enum-varnames: - APM_RESOURCE_STATS ApmResourceStatsQuery: description: >- A query for APM resource statistics such as latency, error rate, and hit count, grouped by resource name. properties: cross_org_uuids: $ref: "#/components/schemas/CrossOrgUuids" data_source: $ref: "#/components/schemas/ApmResourceStatsDataSource" env: description: The environment to query. example: prod type: string group_by: description: Tag keys to group results by. items: description: A tag key to group by. example: resource_name type: string type: array name: description: The variable name for use in formulas. example: query1 type: string operation_name: description: The APM operation name. example: web.request type: string primary_tag_name: description: Name of the second primary tag used within APM. Required when `primary_tag_value` is specified. See https://docs.datadoghq.com/tracing/guide/setting_primary_tags_to_scope/#add-a-second-primary-tag-in-datadog example: datacenter type: string primary_tag_value: description: Value of the second primary tag by which to filter APM data. `primary_tag_name` must also be specified. example: us-east-1 type: string resource_name: description: The resource name to filter by. example: "Admin::ProductsController#create" type: string service: description: The service name to filter by. example: web-store type: string stat: $ref: "#/components/schemas/ApmResourceStatName" required: - data_source - name - env - service - stat type: object ApmRetentionFilterType: default: apm_retention_filter description: The type of the resource. enum: - apm_retention_filter example: apm_retention_filter type: string x-enum-varnames: ["apm_retention_filter"] AppBuilderEvent: additionalProperties: {} description: An event on a UI component that triggers a response or action in an app. properties: name: $ref: "#/components/schemas/AppBuilderEventName" type: $ref: "#/components/schemas/AppBuilderEventType" type: object AppBuilderEventName: description: "The triggering action for the event." enum: - pageChange - tableRowClick - _tableRowButtonClick - change - submit - click - toggleOpen - close - open - executionFinished example: click type: string x-enum-varnames: - PAGECHANGE - TABLEROWCLICK - TABLEROWBUTTONCLICK - CHANGE - SUBMIT - CLICK - TOGGLEOPEN - CLOSE - OPEN - EXECUTIONFINISHED AppBuilderEventType: description: The response to the event. enum: - custom - setComponentState - triggerQuery - openModal - closeModal - openUrl - downloadFile - setStateVariableValue example: triggerQuery type: string x-enum-varnames: - CUSTOM - SETCOMPONENTSTATE - TRIGGERQUERY - OPENMODAL - CLOSEMODAL - OPENURL - DOWNLOADFILE - SETSTATEVARIABLEVALUE AppBuilderListTagsResponse: description: The response for listing tags associated with apps. properties: data: description: An array of tags. items: $ref: "#/components/schemas/TagData" type: array type: object AppDefinitionType: default: appDefinitions description: The app definition type. enum: - appDefinitions example: appDefinitions type: string x-enum-varnames: - APPDEFINITIONS AppDeploymentType: default: deployment description: The deployment type. enum: - deployment example: deployment type: string x-enum-varnames: - DEPLOYMENT AppFavoriteType: default: favorites description: The favorite resource type. enum: - favorites example: favorites type: string x-enum-varnames: - FAVORITES AppKeyRegistrationData: description: Data related to the app key registration. properties: id: description: The app key registration identifier format: uuid readOnly: true type: string type: $ref: "#/components/schemas/AppKeyRegistrationDataType" required: - type type: object AppKeyRegistrationDataType: description: The definition of `AppKeyRegistrationDataType` object. enum: - app_key_registration example: app_key_registration type: string x-enum-varnames: - APP_KEY_REGISTRATION AppMeta: description: Metadata of an app. properties: created_at: description: Timestamp of when the app was created. format: date-time type: string deleted_at: description: Timestamp of when the app was deleted. format: date-time type: string org_id: description: The Datadog organization ID that owns the app. format: int64 type: integer updated_at: description: Timestamp of when the app was last updated. format: date-time type: string updated_since_deployment: description: Whether the app was updated since it was last published. Published apps are pinned to a specific version and do not automatically update when the app is updated. type: boolean user_id: description: The ID of the user who created the app. format: int64 type: integer user_name: description: The name (or email address) of the user who created the app. type: string user_uuid: description: The UUID of the user who created the app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string version: description: The version number of the app. This starts at 1 and increments with each update. format: int64 type: integer type: object AppProtectionLevel: description: The publication protection level of the app. `approval_required` means changes must go through an approval workflow before being published. enum: - direct_publish - approval_required example: direct_publish type: string x-enum-varnames: - DIRECT_PUBLISH - APPROVAL_REQUIRED AppProtectionLevelType: default: protectionLevel description: The protection-level resource type. enum: - protectionLevel example: protectionLevel type: string x-enum-varnames: - PROTECTIONLEVEL AppRelationship: description: The app's publication relationship and custom connections. properties: connections: description: Array of custom connections used by the app. items: $ref: "#/components/schemas/CustomConnection" type: array deployment: $ref: "#/components/schemas/DeploymentRelationship" type: object AppSelfServiceType: default: selfService description: The self-service resource type. enum: - selfService example: selfService type: string x-enum-varnames: - SELFSERVICE AppTagsType: default: tags description: The tags resource type. enum: - tags example: tags type: string x-enum-varnames: - TAGS AppTriggerWrapper: description: "Schema for an App-based trigger." properties: appTrigger: description: "Trigger a workflow from an App." type: object startStepNames: $ref: "#/components/schemas/StartStepNames" required: - appTrigger type: object AppVersion: description: A version of an app. properties: attributes: $ref: "#/components/schemas/AppVersionAttributes" id: description: The ID of the app version. example: 9e20cbaf-68da-45a6-9ccf-54193ac29fa5 format: uuid type: string type: $ref: "#/components/schemas/AppVersionType" type: object AppVersionAttributes: description: Attributes describing an app version. properties: app_id: description: The ID of the app this version belongs to. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string created_at: description: Timestamp of when the version was created. format: date-time type: string has_ever_been_published: description: Whether this version has ever been published. example: true type: boolean name: description: The optional human-readable name of the version. example: v1.2.0 - bug fix release type: string updated_at: description: Timestamp of when the version was last updated. format: date-time type: string user_id: description: The ID of the user who created the version. format: int64 type: integer user_name: description: The name (or email) of the user who created the version. example: jane.doe@example.com type: string user_uuid: description: The UUID of the user who created the version. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string version: description: The version number of the app, starting at 1. example: 3 format: int64 type: integer type: object AppVersionNameType: default: versionNames description: The version-name resource type. enum: - versionNames example: versionNames type: string x-enum-varnames: - VERSIONNAMES AppVersionType: default: appVersions description: The app-version resource type. enum: - appVersions example: appVersions type: string x-enum-varnames: - APPVERSIONS ApplicationKeyCreateAttributes: description: Attributes used to create an application Key. properties: name: description: Name of the application key. example: "Application Key for managing dashboards" type: string scopes: description: Array of scopes to grant the application key. example: ["dashboards_read", "dashboards_write", "dashboards_public_share"] items: description: Name of scope. type: string nullable: true type: array required: - name type: object ApplicationKeyCreateData: description: Object used to create an application key. properties: attributes: $ref: "#/components/schemas/ApplicationKeyCreateAttributes" type: $ref: "#/components/schemas/ApplicationKeysType" required: - attributes - type type: object ApplicationKeyCreateRequest: description: Request used to create an application key. properties: data: $ref: "#/components/schemas/ApplicationKeyCreateData" required: - data type: object ApplicationKeyRelationships: description: Resources related to the application key. properties: owned_by: $ref: "#/components/schemas/RelationshipToUser" type: object ApplicationKeyResponse: description: Response for retrieving an application key. properties: data: $ref: "#/components/schemas/FullApplicationKey" included: description: Array of objects related to the application key. items: $ref: "#/components/schemas/ApplicationKeyResponseIncludedItem" type: array type: object ApplicationKeyResponseIncludedItem: description: An object related to an application key. oneOf: - $ref: "#/components/schemas/User" - $ref: "#/components/schemas/Role" - $ref: "#/components/schemas/LeakedKey" ApplicationKeyResponseMeta: description: Additional information related to the application key response. properties: max_allowed_per_user: description: Max allowed number of application keys per user. format: int64 type: integer page: $ref: "#/components/schemas/ApplicationKeyResponseMetaPage" type: object ApplicationKeyResponseMetaPage: description: Additional information related to the application key response. properties: total_filtered_count: description: Total filtered application key count. format: int64 type: integer type: object ApplicationKeyUpdateAttributes: description: Attributes used to update an application Key. properties: name: description: Name of the application key. example: "Application Key for managing dashboards" type: string scopes: description: Array of scopes to grant the application key. example: ["dashboards_read", "dashboards_write", "dashboards_public_share"] items: description: Name of scope. type: string nullable: true type: array type: object ApplicationKeyUpdateData: description: Object used to update an application key. properties: attributes: $ref: "#/components/schemas/ApplicationKeyUpdateAttributes" id: description: ID of the application key. example: "00112233-4455-6677-8899-aabbccddeeff" type: string type: $ref: "#/components/schemas/ApplicationKeysType" required: - attributes - id - type type: object ApplicationKeyUpdateRequest: description: Request used to update an application key. properties: data: $ref: "#/components/schemas/ApplicationKeyUpdateData" required: - data type: object ApplicationKeysSort: default: name description: Sorting options enum: - created_at - -created_at - last4 - -last4 - name - -name type: string x-enum-varnames: - CREATED_AT_ASCENDING - CREATED_AT_DESCENDING - LAST4_ASCENDING - LAST4_DESCENDING - NAME_ASCENDING - NAME_DESCENDING ApplicationKeysType: default: application_keys description: Application Keys resource type. enum: - application_keys example: application_keys type: string x-enum-varnames: - APPLICATION_KEYS ApplicationSecurityPolicyAttributes: description: "A WAF policy." properties: description: description: Description of the WAF policy. example: "Policy applied to internal web applications." type: string isDefault: description: |- Make this policy the default policy. The default policy is applied to every service not specifically assigned to another policy. example: false type: boolean name: description: The name of the WAF policy. example: "Internal Network Policy" type: string protectionPresets: description: Presets enabled on this policy. items: example: attack-tools type: string type: array rules: description: Rule overrides applied by the policy. items: $ref: "#/components/schemas/ApplicationSecurityPolicyRuleOverride" type: array rulesets: deprecated: true description: "Deprecated: Ruleset overrides. Use `protectionPresets` instead." items: $ref: "#/components/schemas/ApplicationSecurityPolicyRulesetOverride" type: array scope: description: The scope of the WAF policy. items: $ref: "#/components/schemas/ApplicationSecurityPolicyScope" type: array version: default: 0 description: Version of the WAF ruleset maintained by Datadog used by this policy. 0 is the default value. example: 0 format: int64 type: integer required: - name - description type: object ApplicationSecurityPolicyCreateAttributes: description: "Create a new WAF policy." properties: basedOn: description: When creating a new policy, clone the policy indicated by this identifier. example: recommended type: string description: description: Description of the WAF policy. example: "Policy applied to internal web applications." type: string isDefault: description: |- Make this policy the default policy. The default policy is applied to every service not specifically assigned to another policy. example: false type: boolean name: description: The name of the WAF policy. example: "Internal Network Policy" type: string protectionPresets: description: Presets enabled on this policy. items: example: attack-tools type: string type: array rules: description: Rule overrides applied by the policy. items: $ref: "#/components/schemas/ApplicationSecurityPolicyRuleOverride" type: array rulesets: deprecated: true description: "Deprecated: Ruleset overrides. Use `protectionPresets` instead." items: $ref: "#/components/schemas/ApplicationSecurityPolicyRulesetOverride" type: array scope: description: The scope of the WAF policy. items: $ref: "#/components/schemas/ApplicationSecurityPolicyScope" type: array version: default: 0 description: Version of the WAF ruleset maintained by Datadog used by this policy. 0 is the default value. example: 0 format: int64 type: integer required: - name - description - basedOn type: object ApplicationSecurityPolicyCreateData: description: Object for a single WAF policy. properties: attributes: $ref: "#/components/schemas/ApplicationSecurityPolicyCreateAttributes" type: $ref: "#/components/schemas/ApplicationSecurityPolicyType" required: - attributes - type type: object ApplicationSecurityPolicyCreateRequest: description: Request object that includes the policy to create. properties: data: $ref: "#/components/schemas/ApplicationSecurityPolicyCreateData" required: - data type: object ApplicationSecurityPolicyData: description: Object for a single WAF policy. properties: attributes: $ref: "#/components/schemas/ApplicationSecurityPolicyAttributes" id: description: "The ID of the policy." example: "2857c47d-1e3a-4300-8b2f-dc24089c084b" readOnly: true type: string meta: $ref: "#/components/schemas/ApplicationSecurityPolicyMetadata" type: $ref: "#/components/schemas/ApplicationSecurityPolicyType" type: object ApplicationSecurityPolicyListResponse: description: Response object that includes a list of WAF policies. properties: data: description: The WAF policy data. items: $ref: "#/components/schemas/ApplicationSecurityPolicyData" type: array type: object ApplicationSecurityPolicyMetadata: description: Metadata associated with the WAF policy. properties: added_at: description: The date and time the WAF policy was created. example: "2021-01-01T00:00:00Z" format: date-time type: string added_by: description: The handle of the user who created the WAF policy. example: "john.doe@datadoghq.com" type: string added_by_name: description: The name of the user who created the WAF policy. example: "John Doe" type: string modified_at: description: The date and time the WAF policy was last updated. example: "2021-01-01T00:00:00Z" format: date-time type: string modified_by: description: The handle of the user who last updated the WAF policy. example: "john.doe@datadoghq.com" type: string modified_by_name: description: The name of the user who last updated the WAF policy. example: "John Doe" type: string readOnly: true type: object ApplicationSecurityPolicyResponse: description: Response object that includes a single WAF policy. properties: data: $ref: "#/components/schemas/ApplicationSecurityPolicyData" type: object ApplicationSecurityPolicyRuleOverride: description: Override WAF rule parameters for services in a policy. properties: blocking: description: When blocking is enabled, the rule will block the traffic matched by this rule. example: false type: boolean enabled: description: When false, this rule will not match any traffic. example: true type: boolean extended_data_collection: description: When true, collects additional data from the WAF for this rule. example: false type: boolean id: description: Override the parameters for this WAF rule identifier. example: rasp-001-002 type: string required: - id - enabled - blocking type: object ApplicationSecurityPolicyRulesetOverride: deprecated: true description: "Deprecated: Override WAF ruleset parameters. Use `protectionPresets` instead." properties: blocking: description: When blocking is enabled, the ruleset will block the traffic it matches. example: false type: boolean enabled: description: When false, this ruleset will not match any traffic. example: true type: boolean id: description: The identifier of the ruleset to override. example: attack_tool type: string required: - id - enabled - blocking type: object ApplicationSecurityPolicyScope: description: The scope of the WAF policy. properties: env: description: The environment scope for the WAF policy. example: "prod" type: string service: description: The service scope for the WAF policy. example: "billing-service" type: string required: - service - env type: object ApplicationSecurityPolicyType: default: policy description: The type of the resource. The value should always be `policy`. enum: - policy example: policy type: string x-enum-varnames: - POLICY ApplicationSecurityPolicyUpdateAttributes: description: "Update a WAF policy." properties: description: description: Description of the WAF policy. example: "Policy applied to internal web applications." type: string isDefault: description: |- Make this policy the default policy. The default policy is applied to every service not specifically assigned to another policy. example: false type: boolean name: description: The name of the WAF policy. example: "Internal Network Policy" type: string protectionPresets: description: Presets enabled on this policy. example: - attack-tools items: example: attack-tools type: string type: array rules: description: Rule overrides applied by the policy. items: $ref: "#/components/schemas/ApplicationSecurityPolicyRuleOverride" type: array rulesets: deprecated: true description: "Deprecated: Ruleset overrides. Use `protectionPresets` instead." items: $ref: "#/components/schemas/ApplicationSecurityPolicyRulesetOverride" type: array scope: description: The scope of the WAF policy. items: $ref: "#/components/schemas/ApplicationSecurityPolicyScope" type: array version: default: 0 description: Version of the WAF ruleset maintained by Datadog used by this policy. 0 is the default value. example: 0 format: int64 type: integer required: - name - description - version - isDefault - rules - protectionPresets - scope type: object ApplicationSecurityPolicyUpdateData: description: Object for a single WAF policy. properties: attributes: $ref: "#/components/schemas/ApplicationSecurityPolicyUpdateAttributes" type: $ref: "#/components/schemas/ApplicationSecurityPolicyType" required: - attributes - type type: object ApplicationSecurityPolicyUpdateRequest: description: Request object that includes the policy to update. properties: data: $ref: "#/components/schemas/ApplicationSecurityPolicyUpdateData" required: - data type: object ApplicationSecurityServiceAttributes: description: Application Security details describing a service in a given environment. properties: agent_versions: description: The Datadog Agent versions reporting for the service. example: - 7.50.0 items: description: A Datadog Agent version reporting for the service. example: 7.50.0 type: string type: array app_type: description: The application type of the service, such as `web` or `serverless`. example: web type: string asm_threat_compatible: description: Whether the service is compatible with Application Security Management (Threats). example: true type: boolean backend_waf_event_count: description: The number of backend WAF events detected for the service. example: 10 format: int64 type: integer business_logic: description: The enabled business logic detection rules for the service. example: - users.login.success items: description: A business logic detection rule enabled for the service. example: users.login.success type: string type: array color: deprecated: true description: "Deprecated: a display color associated with the service in the UI." example: "" type: string env: description: The environment the service runs in. example: prod type: string event_count: description: The number of Application Security events detected for the service. example: 42 format: int64 type: integer event_trend: deprecated: true description: "Deprecated: the trend of Application Security events over time." example: - 0 items: description: A point in the Application Security events trend. example: 0 format: int64 type: integer type: array has_appsec_enabled: description: Whether Application Security Management (Threats) is enabled for the service. example: true type: boolean hits: deprecated: true description: "Deprecated: the number of hits for the service." example: 0 format: int64 type: integer iast_product_activation: description: Whether Interactive Application Security Testing (IAST) is enabled for the service. example: false type: boolean iast_product_compatibility: description: The Interactive Application Security Testing (IAST) compatibility status of the service. example: compatible type: string iast_product_compatibility_reasons: description: The reasons explaining the Interactive Application Security Testing (IAST) compatibility status. example: - service_not_compatible items: description: A reason explaining the Interactive Application Security Testing (IAST) compatibility status. example: service_not_compatible type: string type: array languages: description: The programming languages detected for the service. example: - go items: description: A programming language detected for the service. example: go type: string type: array last_ingested_spans: description: The Unix timestamp, in seconds, of the last ingested span for the service. example: 1610000000 format: int64 type: integer rc_capabilities: description: The Remote Configuration capabilities reported by the service. example: - ASM_DD_RULES items: description: A Remote Configuration capability reported by the service. example: ASM_DD_RULES type: string type: array recommended_business_logic: description: The recommended business logic detection rules for the service. example: - users.login.success items: description: A recommended business logic detection rule for the service. example: users.login.success type: string type: array risk_product_activation: description: Whether Software Composition Analysis (SCA) is enabled for the service. example: false type: boolean risk_product_compatibility: description: The Software Composition Analysis (SCA) compatibility status of the service. example: compatible type: string risk_product_compatibility_reasons: description: The reasons explaining the Software Composition Analysis (SCA) compatibility status. example: - service_not_compatible items: description: A reason explaining the Software Composition Analysis (SCA) compatibility status. example: service_not_compatible type: string type: array rules_version: description: The WAF rules versions applied to the service. example: - 1.13.0 items: description: A WAF rules version applied to the service. example: 1.13.0 type: string type: array service: description: The name of the service. example: web-store type: string signal_count: deprecated: true description: "Deprecated: the number of security signals for the service." example: 0 format: int64 type: integer signal_trend: deprecated: true description: "Deprecated: the trend of security signals over time." example: - 0 items: description: A point in the security signals trend. example: 0 format: int64 type: integer type: array source: description: The data sources that contributed information about the service. example: - services-activity items: description: A data source that contributed information about the service. example: services-activity type: string type: array teams: description: The teams that own the service. example: - security-team items: description: A team that owns the service. example: security-team type: string type: array tracer_versions: description: The Datadog tracing library versions reporting for the service. example: - 1.60.0 items: description: A Datadog tracing library version reporting for the service. example: 1.60.0 type: string type: array vm-activation: description: The Vulnerability Management activation status of the service. example: enabled type: string vuln_critical_count: deprecated: true description: "Deprecated: the number of critical-severity vulnerabilities for the service." example: 0 format: int64 type: integer vuln_high_count: deprecated: true description: "Deprecated: the number of high-severity vulnerabilities for the service." example: 0 format: int64 type: integer without_filter_services: description: The total number of services available without applying the service filter. example: 0 format: int64 type: integer required: - service - env - app_type - has_appsec_enabled - asm_threat_compatible - languages - teams - event_count - backend_waf_event_count - risk_product_activation - risk_product_compatibility - risk_product_compatibility_reasons - iast_product_activation - iast_product_compatibility - iast_product_compatibility_reasons - vm-activation - agent_versions - tracer_versions - rules_version - rc_capabilities - source - last_ingested_spans - business_logic - recommended_business_logic - without_filter_services - color - event_trend - signal_trend - signal_count - hits - vuln_high_count - vuln_critical_count type: object ApplicationSecurityServiceResource: description: A JSON:API resource describing a service and its Application Security details. properties: attributes: $ref: "#/components/schemas/ApplicationSecurityServiceAttributes" id: description: The unique identifier of the service, formatted as `_`. example: web-store_prod type: string type: $ref: "#/components/schemas/ApplicationSecurityServiceType" required: - id - type - attributes type: object ApplicationSecurityServiceType: default: service_env description: The type of the resource. The value should always be `service_env`. enum: - service_env example: service_env type: string x-enum-varnames: - SERVICE_ENV ApplicationSecurityServicesMetadata: description: Metadata returned alongside the list of services. properties: num_services_with_appsec: description: The number of services with Application Security Management (Threats) enabled. example: 1 format: int64 type: integer required: - num_services_with_appsec type: object ApplicationSecurityServicesResponse: description: Response object containing the list of services matching the requested name. properties: data: description: The list of services matching the requested name. items: $ref: "#/components/schemas/ApplicationSecurityServiceResource" type: array meta: $ref: "#/components/schemas/ApplicationSecurityServicesMetadata" required: - data - meta type: object ApplicationSecurityWafCustomRuleAction: description: The definition of `ApplicationSecurityWafCustomRuleAction` object. properties: action: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleActionAction" parameters: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleActionParameters" type: object ApplicationSecurityWafCustomRuleActionAction: default: block_request description: Override the default action to take when the WAF custom rule would block. enum: - redirect_request - block_request example: block_request type: string x-enum-varnames: - REDIRECT_REQUEST - BLOCK_REQUEST ApplicationSecurityWafCustomRuleActionParameters: description: The definition of `ApplicationSecurityWafCustomRuleActionParameters` object. properties: location: description: The location to redirect to when the WAF custom rule triggers. example: "/blocking" type: string status_code: default: 403 description: The status code to return when the WAF custom rule triggers. example: 403 format: int64 type: integer type: object ApplicationSecurityWafCustomRuleAttributes: description: "A WAF custom rule." properties: action: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleAction" blocking: description: Indicates whether the WAF custom rule will block the request. example: false type: boolean conditions: description: |- Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF rule to trigger. items: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleCondition" type: array enabled: description: Indicates whether the WAF custom rule is enabled. example: false type: boolean metadata: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleMetadata" name: description: The name of the WAF custom rule. example: "Block request from bad useragent" type: string path_glob: description: The path glob for the WAF custom rule. example: "/api/search/*" type: string scope: description: The scope of the WAF custom rule. items: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleScope" type: array tags: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleTags" required: - enabled - blocking - name - tags - conditions type: object ApplicationSecurityWafCustomRuleCondition: description: One condition of the WAF Custom Rule. properties: operator: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleConditionOperator" parameters: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleConditionParameters" required: - operator - parameters type: object ApplicationSecurityWafCustomRuleConditionInput: description: Input from the request on which the condition should apply. properties: address: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleConditionInputAddress" key_path: description: Specific path for the input. items: description: A path segment for the input key. type: string type: array required: - address type: object ApplicationSecurityWafCustomRuleConditionInputAddress: description: Input from the request on which the condition should apply. enum: - server.db.statement - server.io.fs.file - server.io.fs.file_write - server.io.net.url - server.sys.shell.cmd - server.request.method - server.request.uri.raw - server.request.path_params - server.request.query - server.request.headers - server.request.headers.no_cookies - server.request.custom-auth - server.request.cookies - server.request.trailers - server.request.body - server.request.body.filenames - server.request.body.files_content - server.response.status - server.response.headers.no_cookies - server.response.trailers - server.response.body - server.response.body.raw - grpc.server.request.metadata - grpc.server.request.message - grpc.server.method - graphql.server.all_resolvers - usr.id - http.client_ip - server.llm.event - server.llm.guard.verdict - _dd.appsec.fp.http.header - _dd.appsec.fp.http.network - _dd.appsec.fp.session - _dd.appsec.fp.http.endpoint example: server.db.statement type: string x-enum-varnames: - SERVER_DB_STATEMENT - SERVER_IO_FS_FILE - SERVER_IO_FS_FILE_WRITE - SERVER_IO_NET_URL - SERVER_SYS_SHELL_CMD - SERVER_REQUEST_METHOD - SERVER_REQUEST_URI_RAW - SERVER_REQUEST_PATH_PARAMS - SERVER_REQUEST_QUERY - SERVER_REQUEST_HEADERS - SERVER_REQUEST_HEADERS_NO_COOKIES - SERVER_REQUEST_CUSTOM_AUTH - SERVER_REQUEST_COOKIES - SERVER_REQUEST_TRAILERS - SERVER_REQUEST_BODY - SERVER_REQUEST_BODY_FILENAMES - SERVER_REQUEST_BODY_FILES_CONTENT - SERVER_RESPONSE_STATUS - SERVER_RESPONSE_HEADERS_NO_COOKIES - SERVER_RESPONSE_TRAILERS - SERVER_RESPONSE_BODY - SERVER_RESPONSE_BODY_RAW - GRPC_SERVER_REQUEST_METADATA - GRPC_SERVER_REQUEST_MESSAGE - GRPC_SERVER_METHOD - GRAPHQL_SERVER_ALL_RESOLVERS - USR_ID - HTTP_CLIENT_IP - SERVER_LLM_EVENT - SERVER_LLM_GUARD_VERDICT - DD_APPSEC_FP_HTTP_HEADER - DD_APPSEC_FP_HTTP_NETWORK - DD_APPSEC_FP_SESSION - DD_APPSEC_FP_HTTP_ENDPOINT ApplicationSecurityWafCustomRuleConditionOperator: description: Operator to use for the WAF Condition. enum: - match_regex - "!match_regex" - phrase_match - "!phrase_match" - is_xss - is_sqli - exact_match - "!exact_match" - ip_match - "!ip_match" - capture_data - exists - "!exists" - equals - "!equals" example: "match_regex" type: string x-enum-varnames: - MATCH_REGEX - NOT_MATCH_REGEX - PHRASE_MATCH - NOT_PHRASE_MATCH - IS_XSS - IS_SQLI - EXACT_MATCH - NOT_EXACT_MATCH - IP_MATCH - NOT_IP_MATCH - CAPTURE_DATA - EXISTS - NOT_EXISTS - EQUALS - NOT_EQUALS ApplicationSecurityWafCustomRuleConditionOptions: description: Options for the operator of this condition. properties: case_sensitive: default: false description: Evaluate the value as case sensitive. type: boolean min_length: default: 0 description: Only evaluate this condition if the value has a minimum amount of characters. format: int64 type: integer type: object ApplicationSecurityWafCustomRuleConditionParameters: description: The scope of the WAF custom rule. properties: data: description: |- Identifier of a list of data from the denylist. Can only be used as substitution from the list parameter. example: "blocked_users" type: string inputs: description: List of inputs on which at least one should match with the given operator. items: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleConditionInput" type: array list: description: |- List of value to use with the condition. Only used with the phrase_match, !phrase_match, exact_match and !exact_match operator. items: description: A value to match against in the condition. type: string type: array options: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleConditionOptions" regex: description: "Regex to use with the condition. Only used with match_regex and !match_regex operator." example: "path.*" type: string type: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleConditionParametersType" value: description: |- Store the captured value in the specified tag name. Only used with the capture_data operator. example: custom_tag type: string required: - inputs type: object ApplicationSecurityWafCustomRuleConditionParametersType: description: The type of the value to compare against. Only used with the equals and !equals operator. enum: - boolean - signed - unsigned - float - string example: "string" type: string x-enum-varnames: - BOOLEAN - SIGNED - UNSIGNED - FLOAT - STRING ApplicationSecurityWafCustomRuleCreateAttributes: description: "Create a new WAF custom rule." properties: action: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleAction" blocking: description: Indicates whether the WAF custom rule will block the request. example: false type: boolean conditions: description: |- Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF rule to trigger items: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleCondition" type: array enabled: description: Indicates whether the WAF custom rule is enabled. example: false type: boolean name: description: The name of the WAF custom rule. example: "Block request from a bad useragent" type: string path_glob: description: The path glob for the WAF custom rule. example: "/api/search/*" type: string scope: description: The scope of the WAF custom rule. items: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleScope" type: array tags: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleTags" required: - enabled - blocking - name - tags - conditions type: object ApplicationSecurityWafCustomRuleCreateData: description: Object for a single WAF custom rule. properties: attributes: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleCreateAttributes" type: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleType" required: - attributes - type type: object ApplicationSecurityWafCustomRuleCreateRequest: description: Request object that includes the custom rule to create. properties: data: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleCreateData" required: - data type: object ApplicationSecurityWafCustomRuleData: description: Object for a single WAF custom rule. properties: attributes: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleAttributes" id: description: "The ID of the custom rule." example: "2857c47d-1e3a-4300-8b2f-dc24089c084b" readOnly: true type: string type: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleType" type: object ApplicationSecurityWafCustomRuleListResponse: description: Response object that includes a list of WAF custom rules. properties: data: description: The WAF custom rule data. items: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleData" type: array type: object ApplicationSecurityWafCustomRuleMetadata: description: Metadata associated with the WAF Custom Rule. properties: added_at: description: The date and time the WAF custom rule was created. example: "2021-01-01T00:00:00Z" format: date-time type: string added_by: description: The handle of the user who created the WAF custom rule. example: "john.doe@datadoghq.com" type: string added_by_name: description: The name of the user who created the WAF custom rule. example: "John Doe" type: string modified_at: description: The date and time the WAF custom rule was last updated. example: "2021-01-01T00:00:00Z" format: date-time type: string modified_by: description: The handle of the user who last updated the WAF custom rule. example: "john.doe@datadoghq.com" type: string modified_by_name: description: The name of the user who last updated the WAF custom rule. example: "John Doe" type: string readOnly: true type: object ApplicationSecurityWafCustomRuleResponse: description: Response object that includes a single WAF custom rule. properties: data: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleData" type: object ApplicationSecurityWafCustomRuleScope: description: The scope of the WAF custom rule. properties: env: description: The environment scope for the WAF custom rule. example: "prod" type: string service: description: The service scope for the WAF custom rule. example: "billing-service" type: string required: - service - env type: object ApplicationSecurityWafCustomRuleTags: additionalProperties: type: string description: |- Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security activity field associated with the traces. maxProperties: 32 properties: category: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleTagsCategory" type: description: The type of the WAF rule, associated with the category will form the security activity. example: "users.login.success" type: string required: - category - type type: object ApplicationSecurityWafCustomRuleTagsCategory: description: The category of the WAF Rule, can be either `business_logic`, `attack_attempt` or `security_response`. enum: - attack_attempt - business_logic - security_response example: "business_logic" type: string x-enum-varnames: - ATTACK_ATTEMPT - BUSINESS_LOGIC - SECURITY_RESPONSE ApplicationSecurityWafCustomRuleType: default: custom_rule description: The type of the resource. The value should always be `custom_rule`. enum: - custom_rule example: custom_rule type: string x-enum-varnames: - CUSTOM_RULE ApplicationSecurityWafCustomRuleUpdateAttributes: description: "Update a WAF custom rule." properties: action: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleAction" blocking: description: Indicates whether the WAF custom rule will block the request. example: false type: boolean conditions: description: |- Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF rule to trigger. items: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleCondition" type: array enabled: description: Indicates whether the WAF custom rule is enabled. example: false type: boolean name: description: The name of the WAF custom rule. example: "Block request from bad useragent" type: string path_glob: description: The path glob for the WAF custom rule. example: "/api/search/*" type: string scope: description: The scope of the WAF custom rule. items: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleScope" type: array tags: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleTags" required: - enabled - blocking - name - tags - conditions type: object ApplicationSecurityWafCustomRuleUpdateData: description: Object for a single WAF Custom Rule. properties: attributes: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleUpdateAttributes" type: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleType" required: - attributes - type type: object ApplicationSecurityWafCustomRuleUpdateRequest: description: Request object that includes the Custom Rule to update. properties: data: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleUpdateData" required: - data type: object ApplicationSecurityWafExclusionFilterAttributes: description: Attributes describing a WAF exclusion filter. properties: description: description: A description for the exclusion filter. example: "Exclude false positives on a path" type: string enabled: description: Indicates whether the exclusion filter is enabled. example: true type: boolean event_query: description: The event query matched by the legacy exclusion filter. Cannot be created nor updated. type: string ip_list: description: The client IP addresses matched by the exclusion filter (CIDR notation is supported). items: description: A single IP address to exclude. example: "198.51.100.72" type: string type: array metadata: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterMetadata" on_match: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterOnMatch" parameters: description: A list of parameters matched by the exclusion filter in the HTTP query string and HTTP request body. Nested parameters can be matched by joining fields with a dot character. items: description: A request parameter name to exclude from the query string or request body. example: "list.search.query" type: string type: array path_glob: description: The HTTP path glob expression matched by the exclusion filter. example: "/accounts/*" type: string rules_target: description: The WAF rules targeted by the exclusion filter. items: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterRulesTarget" type: array scope: description: The services where the exclusion filter is deployed. items: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterScope" type: array search_query: description: Generated event search query for traces matching the exclusion filter. readOnly: true type: string type: object ApplicationSecurityWafExclusionFilterCreateAttributes: description: Attributes for creating a WAF exclusion filter. properties: description: description: A description for the exclusion filter. example: "Exclude false positives on a path" type: string enabled: description: Indicates whether the exclusion filter is enabled. example: true type: boolean ip_list: description: The client IP addresses matched by the exclusion filter (CIDR notation is supported). items: description: A single IP address to exclude. example: "198.51.100.72" type: string type: array on_match: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterOnMatch" parameters: description: A list of parameters matched by the exclusion filter in the HTTP query string and HTTP request body. Nested parameters can be matched by joining fields with a dot character. items: description: A request parameter name to exclude from the query string or request body. example: "list.search.query" type: string type: array path_glob: description: The HTTP path glob expression matched by the exclusion filter. example: "/accounts/*" type: string rules_target: description: The WAF rules targeted by the exclusion filter. items: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterRulesTarget" type: array scope: description: The services where the exclusion filter is deployed. items: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterScope" type: array required: - description - enabled type: object ApplicationSecurityWafExclusionFilterCreateData: description: Object for creating a single WAF exclusion filter. properties: attributes: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterCreateAttributes" type: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterType" required: - attributes - type type: object ApplicationSecurityWafExclusionFilterCreateRequest: description: Request object for creating a single WAF exclusion filter. properties: data: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterCreateData" required: - data type: object ApplicationSecurityWafExclusionFilterID: description: The identifier of the WAF exclusion filter. example: "3dd-0uc-h1s" readOnly: true type: string ApplicationSecurityWafExclusionFilterMetadata: description: Extra information about the exclusion filter. properties: added_at: description: The creation date of the exclusion filter. format: date-time type: string added_by: description: The handle of the user who created the exclusion filter. type: string added_by_name: description: The name of the user who created the exclusion filter. type: string modified_at: description: The last modification date of the exclusion filter. format: date-time type: string modified_by: description: The handle of the user who last modified the exclusion filter. type: string modified_by_name: description: The name of the user who last modified the exclusion filter. type: string readOnly: true type: object ApplicationSecurityWafExclusionFilterOnMatch: description: The action taken when the exclusion filter matches. When set to `monitor`, security traces are emitted but the requests are not blocked. By default, security traces are not emitted and the requests are not blocked. enum: - monitor type: string x-enum-varnames: - MONITOR ApplicationSecurityWafExclusionFilterResource: description: A JSON:API resource for an WAF exclusion filter. properties: attributes: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterAttributes" id: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterID" type: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterType" type: object ApplicationSecurityWafExclusionFilterResponse: description: Response object for a single WAF exclusion filter. properties: data: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterResource" type: object ApplicationSecurityWafExclusionFilterRulesTarget: description: Target WAF rules based either on an identifier or tags. properties: rule_id: description: Target a single WAF rule based on its identifier. example: dog-913-009 type: string tags: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterRulesTargetTags" type: object ApplicationSecurityWafExclusionFilterRulesTargetTags: additionalProperties: type: string description: Target multiple WAF rules based on their tags. properties: category: description: The category of the targeted WAF rules. example: attack_attempt type: string type: description: The type of the targeted WAF rules. example: lfi type: string type: object ApplicationSecurityWafExclusionFilterScope: description: Deploy on services based on their environment and/or service name. properties: env: description: Deploy on this environment. example: www type: string service: description: Deploy on this service. example: prod type: string type: object ApplicationSecurityWafExclusionFilterType: default: exclusion_filter description: Type of the resource. The value should always be `exclusion_filter`. enum: - exclusion_filter example: exclusion_filter type: string x-enum-varnames: ["EXCLUSION_FILTER"] ApplicationSecurityWafExclusionFilterUpdateAttributes: description: Attributes for updating a WAF exclusion filter. properties: description: description: A description for the exclusion filter. example: "Exclude false positives on a path" type: string enabled: description: Indicates whether the exclusion filter is enabled. example: true type: boolean ip_list: description: The client IP addresses matched by the exclusion filter (CIDR notation is supported). items: description: A single IP address to exclude. example: "198.51.100.72" type: string type: array on_match: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterOnMatch" parameters: description: A list of parameters matched by the exclusion filter in the HTTP query string and HTTP request body. Nested parameters can be matched by joining fields with a dot character. items: description: A parameter name matched by the exclusion filter in the HTTP query string or request body. example: "list.search.query" type: string type: array path_glob: description: The HTTP path glob expression matched by the exclusion filter. example: "/accounts/*" type: string rules_target: description: The WAF rules targeted by the exclusion filter. items: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterRulesTarget" type: array scope: description: The services where the exclusion filter is deployed. items: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterScope" type: array required: - description - enabled type: object ApplicationSecurityWafExclusionFilterUpdateData: description: Object for updating a single WAF exclusion filter. properties: attributes: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterUpdateAttributes" type: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterType" required: - attributes - type type: object ApplicationSecurityWafExclusionFilterUpdateRequest: description: Request object for updating a single WAF exclusion filter. properties: data: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterUpdateData" required: - data type: object ApplicationSecurityWafExclusionFiltersResponse: description: Response object for multiple WAF exclusion filters. properties: data: description: A list of WAF exclusion filters. items: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterResource" type: array type: object AppsSortField: description: "The field and direction to sort apps by" enum: - name - created_at - updated_at - user_name - -name - -created_at - -updated_at - -user_name example: -created_at type: string x-enum-varnames: - NAME - CREATED_AT - UPDATED_AT - USER_NAME - NAME_DESC - CREATED_AT_DESC - UPDATED_AT_DESC - USER_NAME_DESC ArbitraryCostUpsertRequest: description: The definition of `ArbitraryCostUpsertRequest` object. example: data: attributes: costs_to_allocate: - condition: is tag: account_id value: "123456789" values: - condition: in tag: environment value: "" values: - production - staging enabled: true order_id: 1 provider: - aws - gcp rule_name: example-arbitrary-cost-rule strategy: allocated_by_tag_keys: - team - environment based_on_costs: - condition: is tag: service value: web-api values: - condition: not in tag: team value: "" values: - legacy - deprecated granularity: daily method: proportional type: shared type: upsert_arbitrary_rule properties: data: $ref: "#/components/schemas/ArbitraryCostUpsertRequestData" type: object ArbitraryCostUpsertRequestData: description: The definition of `ArbitraryCostUpsertRequestData` object. properties: attributes: $ref: "#/components/schemas/ArbitraryCostUpsertRequestDataAttributes" id: description: The `ArbitraryCostUpsertRequestData` `id`. type: string type: $ref: "#/components/schemas/ArbitraryCostUpsertRequestDataType" required: - type type: object ArbitraryCostUpsertRequestDataAttributes: description: The definition of `ArbitraryCostUpsertRequestDataAttributes` object. properties: costs_to_allocate: description: The `attributes` `costs_to_allocate`. items: $ref: "#/components/schemas/ArbitraryCostUpsertRequestDataAttributesCostsToAllocateItems" type: array enabled: description: The `attributes` `enabled`. type: boolean order_id: description: The `attributes` `order_id`. format: int64 type: integer provider: description: The `attributes` `provider`. example: - "" items: description: A cloud provider name. type: string type: array rejected: description: The `attributes` `rejected`. type: boolean rule_name: description: The `attributes` `rule_name`. example: "" type: string strategy: $ref: "#/components/schemas/ArbitraryCostUpsertRequestDataAttributesStrategy" type: description: The `attributes` `type`. example: "" type: string required: - costs_to_allocate - provider - rule_name - strategy - type type: object ArbitraryCostUpsertRequestDataAttributesCostsToAllocateItems: description: The definition of `ArbitraryCostUpsertRequestDataAttributesCostsToAllocateItems` object. properties: condition: description: The `items` `condition`. example: "" type: string tag: description: The `items` `tag`. example: "" type: string value: description: The `items` `value`. type: string values: description: The `items` `values`. items: description: A filter value string. type: string nullable: true type: array required: - condition - tag type: object ArbitraryCostUpsertRequestDataAttributesStrategy: description: The definition of `ArbitraryCostUpsertRequestDataAttributesStrategy` object. properties: allocated_by: description: The `strategy` `allocated_by`. items: $ref: "#/components/schemas/ArbitraryCostUpsertRequestDataAttributesStrategyAllocatedByItems" type: array allocated_by_filters: description: The `strategy` `allocated_by_filters`. items: $ref: "#/components/schemas/ArbitraryCostUpsertRequestDataAttributesStrategyAllocatedByFiltersItems" type: array allocated_by_tag_keys: description: The `strategy` `allocated_by_tag_keys`. items: description: A tag key used to group cost allocations. type: string type: array based_on_costs: description: The `strategy` `based_on_costs`. items: $ref: "#/components/schemas/ArbitraryCostUpsertRequestDataAttributesStrategyBasedOnCostsItems" type: array based_on_timeseries: additionalProperties: {} description: The `strategy` `based_on_timeseries`. type: object evaluate_grouped_by_filters: description: The `strategy` `evaluate_grouped_by_filters`. items: $ref: "#/components/schemas/ArbitraryCostUpsertRequestDataAttributesStrategyEvaluateGroupedByFiltersItems" type: array evaluate_grouped_by_tag_keys: description: The `strategy` `evaluate_grouped_by_tag_keys`. items: description: A tag key used to group cost evaluation. type: string type: array granularity: description: The `strategy` `granularity`. type: string method: description: The `strategy` `method`. example: "" type: string required: - method type: object ArbitraryCostUpsertRequestDataAttributesStrategyAllocatedByFiltersItems: description: The definition of `ArbitraryCostUpsertRequestDataAttributesStrategyAllocatedByFiltersItems` object. properties: condition: description: The `items` `condition`. example: "" type: string tag: description: The `items` `tag`. example: "" type: string value: description: The `items` `value`. type: string values: description: The `items` `values`. items: description: A filter value string. type: string nullable: true type: array required: - condition - tag type: object ArbitraryCostUpsertRequestDataAttributesStrategyAllocatedByItems: description: The definition of `ArbitraryCostUpsertRequestDataAttributesStrategyAllocatedByItems` object. properties: allocated_tags: description: The `items` `allocated_tags`. items: $ref: "#/components/schemas/ArbitraryCostUpsertRequestDataAttributesStrategyAllocatedByItemsAllocatedTagsItems" type: array percentage: description: The `items` `percentage`. The numeric value format should be a 32bit float value. example: 0.0 format: double type: number required: - allocated_tags - percentage type: object ArbitraryCostUpsertRequestDataAttributesStrategyAllocatedByItemsAllocatedTagsItems: description: The definition of `ArbitraryCostUpsertRequestDataAttributesStrategyAllocatedByItemsAllocatedTagsItems` object. properties: key: description: The `items` `key`. example: "" type: string value: description: The `items` `value`. example: "" type: string required: - key - value type: object ArbitraryCostUpsertRequestDataAttributesStrategyBasedOnCostsItems: description: The definition of `ArbitraryCostUpsertRequestDataAttributesStrategyBasedOnCostsItems` object. properties: condition: description: The `items` `condition`. example: "" type: string tag: description: The `items` `tag`. example: "" type: string value: description: The `items` `value`. type: string values: description: The `items` `values`. items: description: A filter value string. type: string nullable: true type: array required: - condition - tag type: object ArbitraryCostUpsertRequestDataAttributesStrategyEvaluateGroupedByFiltersItems: description: The definition of `ArbitraryCostUpsertRequestDataAttributesStrategyEvaluateGroupedByFiltersItems` object. properties: condition: description: The `items` `condition`. example: "" type: string tag: description: The `items` `tag`. example: "" type: string value: description: The `items` `value`. type: string values: description: The `items` `values`. items: description: A filter value string. type: string nullable: true type: array required: - condition - tag type: object ArbitraryCostUpsertRequestDataType: default: upsert_arbitrary_rule description: Upsert arbitrary rule resource type. enum: - upsert_arbitrary_rule example: upsert_arbitrary_rule type: string x-enum-varnames: - UPSERT_ARBITRARY_RULE ArbitraryRuleResponse: description: The definition of `ArbitraryRuleResponse` object. example: data: attributes: costs_to_allocate: - condition: is tag: account_id value: "123456789" values: - condition: in tag: environment value: "" values: - production - staging created: "2023-01-01T12:00:00Z" enabled: true last_modified_user_uuid: user-123-uuid order_id: 1 provider: - aws - gcp rule_name: Example custom allocation rule strategy: allocated_by_tag_keys: - team - environment based_on_costs: - condition: is tag: service value: web-api values: - condition: not in tag: team value: "" values: - legacy - deprecated granularity: daily method: proportional type: shared updated: "2023-01-01T12:00:00Z" version: 1 id: "123" type: arbitrary_rule properties: data: $ref: "#/components/schemas/ArbitraryRuleResponseData" type: object ArbitraryRuleResponseArray: description: The definition of `ArbitraryRuleResponseArray` object. example: data: - attributes: costs_to_allocate: - condition: like tag: service value: orgstore-csm* values: created: "2024-11-20T03:44:37Z" enabled: true last_modified_user_uuid: user-example-uuid order_id: 1 processing_status: done provider: - gcp rule_name: gcp-orgstore-csm-team-allocation strategy: allocated_by: - allocated_tags: - key: team value: csm-activation percentage: 0.34 - allocated_tags: - key: team value: csm-agentless percentage: 0.66 method: percent type: shared updated: "2025-09-02T21:28:32Z" version: 1 id: "19" type: arbitrary_rule - attributes: costs_to_allocate: - condition: is tag: env value: staging values: created: "2025-05-27T18:48:05Z" enabled: true last_modified_user_uuid: user-example-uuid-2 order_id: 2 processing_status: done provider: - aws rule_name: test-even-2 strategy: allocated_by_tag_keys: - team based_on_costs: - condition: is tag: aws_product value: s3 values: granularity: daily method: even type: shared updated: "2025-09-03T21:00:49Z" version: 1 id: "311" type: arbitrary_rule - attributes: costs_to_allocate: - condition: is tag: servicename value: s3 values: created: "2025-03-21T20:42:40Z" enabled: false last_modified_user_uuid: user-example-uuid-3 order_id: 3 processing_status: done provider: - aws rule_name: test-s3-timeseries strategy: granularity: daily method: proportional_timeseries type: shared updated: "2025-09-02T21:16:50Z" version: 1 id: "289" type: arbitrary_rule - attributes: costs_to_allocate: - condition: "=" tag: aws_product value: msk values: - condition: is tag: product value: "null" values: created: "2025-08-27T14:39:31Z" enabled: true last_modified_user_uuid: user-example-uuid-4 order_id: 4 processing_status: done provider: - aws rule_name: azure-unallocated-by-product-2 strategy: allocated_by_tag_keys: - aws_product based_on_costs: - condition: "=" tag: aws_product value: msk values: - condition: is not tag: product value: "null" values: granularity: daily method: proportional type: shared updated: "2025-09-02T21:28:32Z" version: 1 id: "523" type: arbitrary_rule properties: data: description: The `ArbitraryRuleResponseArray` `data`. items: $ref: "#/components/schemas/ArbitraryRuleResponseData" type: array meta: $ref: "#/components/schemas/ArbitraryRuleResponseArrayMeta" required: - data type: object ArbitraryRuleResponseArrayMeta: description: The `ArbitraryRuleResponseArray` `meta`. properties: total_count: description: The `meta` `total_count`. format: int64 type: integer type: object ArbitraryRuleResponseData: description: The definition of `ArbitraryRuleResponseData` object. properties: attributes: $ref: "#/components/schemas/ArbitraryRuleResponseDataAttributes" id: description: The `ArbitraryRuleResponseData` `id`. type: string type: $ref: "#/components/schemas/ArbitraryRuleResponseDataType" required: - type type: object ArbitraryRuleResponseDataAttributes: description: The definition of `ArbitraryRuleResponseDataAttributes` object. properties: costs_to_allocate: description: The `attributes` `costs_to_allocate`. items: $ref: "#/components/schemas/ArbitraryRuleResponseDataAttributesCostsToAllocateItems" type: array created: description: The `attributes` `created`. example: "" format: date-time type: string enabled: description: The `attributes` `enabled`. example: false type: boolean last_modified_user_uuid: description: The `attributes` `last_modified_user_uuid`. example: "" type: string order_id: description: The `attributes` `order_id`. example: 0 format: int64 type: integer processing_status: description: The `attributes` `processing_status`. example: "" type: string provider: description: The `attributes` `provider`. example: - "" items: description: A cloud provider name. type: string type: array rejected: description: The `attributes` `rejected`. type: boolean rule_name: description: The `attributes` `rule_name`. example: "" type: string strategy: $ref: "#/components/schemas/ArbitraryRuleResponseDataAttributesStrategy" type: description: The `attributes` `type`. example: "" type: string updated: description: The `attributes` `updated`. example: "" format: date-time type: string version: description: The `attributes` `version`. example: 0 format: int32 maximum: 2147483647 type: integer required: - costs_to_allocate - created - enabled - last_modified_user_uuid - order_id - provider - rule_name - strategy - type - updated - version type: object ArbitraryRuleResponseDataAttributesCostsToAllocateItems: description: The definition of `ArbitraryRuleResponseDataAttributesCostsToAllocateItems` object. properties: condition: description: The `items` `condition`. example: "" type: string tag: description: The `items` `tag`. example: "" type: string value: description: The `items` `value`. type: string values: description: The `items` `values`. items: description: A filter value string. type: string nullable: true type: array required: - condition - tag type: object ArbitraryRuleResponseDataAttributesStrategy: description: The definition of `ArbitraryRuleResponseDataAttributesStrategy` object. properties: allocated_by: description: The `strategy` `allocated_by`. items: $ref: "#/components/schemas/ArbitraryRuleResponseDataAttributesStrategyAllocatedByItems" type: array allocated_by_filters: description: The `strategy` `allocated_by_filters`. items: $ref: "#/components/schemas/ArbitraryRuleResponseDataAttributesStrategyAllocatedByFiltersItems" type: array allocated_by_tag_keys: description: The `strategy` `allocated_by_tag_keys`. items: description: A tag key used to group cost allocations. type: string type: array based_on_costs: description: The `strategy` `based_on_costs`. items: $ref: "#/components/schemas/ArbitraryRuleResponseDataAttributesStrategyBasedOnCostsItems" type: array based_on_timeseries: additionalProperties: {} description: The rule `strategy` `based_on_timeseries`. type: object evaluate_grouped_by_filters: description: The `strategy` `evaluate_grouped_by_filters`. items: $ref: "#/components/schemas/ArbitraryRuleResponseDataAttributesStrategyEvaluateGroupedByFiltersItems" type: array evaluate_grouped_by_tag_keys: description: The `strategy` `evaluate_grouped_by_tag_keys`. items: description: A tag key used to group cost evaluation. type: string type: array granularity: description: The `strategy` `granularity`. type: string method: description: The `strategy` `method`. example: "" type: string required: - method type: object ArbitraryRuleResponseDataAttributesStrategyAllocatedByFiltersItems: description: The definition of `ArbitraryRuleResponseDataAttributesStrategyAllocatedByFiltersItems` object. properties: condition: description: The `items` `condition`. example: "" type: string tag: description: The `items` `tag`. example: "" type: string value: description: The `items` `value`. type: string values: description: The `items` `values`. items: description: A filter value string. type: string nullable: true type: array required: - condition - tag type: object ArbitraryRuleResponseDataAttributesStrategyAllocatedByItems: description: The definition of `ArbitraryRuleResponseDataAttributesStrategyAllocatedByItems` object. properties: allocated_tags: description: The `items` `allocated_tags`. items: $ref: "#/components/schemas/ArbitraryRuleResponseDataAttributesStrategyAllocatedByItemsAllocatedTagsItems" type: array percentage: description: The `items` `percentage`. The numeric value format should be a 32bit float value. example: 0.0 format: double type: number required: - allocated_tags - percentage type: object ArbitraryRuleResponseDataAttributesStrategyAllocatedByItemsAllocatedTagsItems: description: The definition of `ArbitraryRuleResponseDataAttributesStrategyAllocatedByItemsAllocatedTagsItems` object. properties: key: description: The `items` `key`. example: "" type: string value: description: The `items` `value`. example: "" type: string required: - key - value type: object ArbitraryRuleResponseDataAttributesStrategyBasedOnCostsItems: description: The definition of `ArbitraryRuleResponseDataAttributesStrategyBasedOnCostsItems` object. properties: condition: description: The `items` `condition`. example: "" type: string tag: description: The `items` `tag`. example: "" type: string value: description: The `items` `value`. type: string values: description: The `items` `values`. items: description: A filter value string. type: string nullable: true type: array required: - condition - tag type: object ArbitraryRuleResponseDataAttributesStrategyEvaluateGroupedByFiltersItems: description: The definition of `ArbitraryRuleResponseDataAttributesStrategyEvaluateGroupedByFiltersItems` object. properties: condition: description: The `items` `condition`. example: "" type: string tag: description: The `items` `tag`. example: "" type: string value: description: The `items` `value`. type: string values: description: The `items` `values`. items: description: A filter value string. type: string nullable: true type: array required: - condition - tag type: object ArbitraryRuleResponseDataType: default: arbitrary_rule description: Arbitrary rule resource type. enum: - arbitrary_rule example: arbitrary_rule type: string x-enum-varnames: - ARBITRARY_RULE ArbitraryRuleStatusResponseArray: description: Processing statuses for all custom allocation rules in the specified organization. example: data: - attributes: processing_status: processing id: "123" type: arbitrary_rule_status - attributes: processing_status: done id: "456" type: arbitrary_rule_status properties: data: description: Processing status for a custom allocation rule. items: $ref: "#/components/schemas/ArbitraryRuleStatusResponseData" type: array required: - data type: object ArbitraryRuleStatusResponseData: description: Processing status for a custom allocation rule. properties: attributes: $ref: "#/components/schemas/ArbitraryRuleStatusResponseDataAttributes" id: description: The unique identifier of the custom allocation rule. example: "123" type: string type: $ref: "#/components/schemas/ArbitraryRuleStatusResponseDataType" required: - id - type - attributes type: object ArbitraryRuleStatusResponseDataAttributes: description: Processing status for a custom allocation rule. properties: processing_status: description: The processing status of the custom allocation rule. example: processing type: string required: - processing_status type: object ArbitraryRuleStatusResponseDataType: default: arbitrary_rule_status description: Custom allocation rule status resource type. enum: - arbitrary_rule_status example: arbitrary_rule_status type: string x-enum-varnames: - ARBITRARY_RULE_STATUS ArchiveSearchCreateRehydration: description: |- Rehydration settings. Include this object to index the matched logs into a retained historical view. Omit it to run an Archive Search that only scans the archive. properties: max_rehydrated_events: description: |- Maximum number of events to rehydrate. The organization's reindexing limit is configured in millions, so this value is at least 1,000,000. example: 1000000 format: int64 minimum: 1000000 type: integer retention_days: description: Number of days the rehydrated logs are retained for. example: 15 format: int64 type: integer tier: $ref: "#/components/schemas/ArchiveSearchRehydrationTier" required: - retention_days - tier - max_rehydrated_events type: object ArchiveSearchCreateRequest: description: Request to create an Archive Search. properties: data: $ref: "#/components/schemas/ArchiveSearchCreateRequestData" required: - data type: object ArchiveSearchCreateRequestAttributes: description: Attributes accepted when creating an Archive Search. properties: archive_id: description: ID of the archive to search. Use the Logs Archives API to list the archives of the organization. example: mhmyYmyLTOaFYKvhNadu1w type: string description: description: Free-text description of the Archive Search. example: Investigating the checkout latency spike. type: string from: description: Start of the time range to search, as an ISO 8601 timestamp. example: "2026-01-01T00:00:00Z" format: date-time type: string name: description: Name of the Archive Search. example: checkout-latency-investigation type: string query: description: Log search query used to filter the archived logs. example: service:checkout status:error type: string rehydration: $ref: "#/components/schemas/ArchiveSearchCreateRehydration" to: description: End of the time range to search, as an ISO 8601 timestamp. Must be after `from`. example: "2026-01-02T00:00:00Z" format: date-time type: string required: - archive_id - name - query - from - to type: object ArchiveSearchCreateRequestData: description: Archive Search object to create. properties: attributes: $ref: "#/components/schemas/ArchiveSearchCreateRequestAttributes" type: $ref: "#/components/schemas/ArchiveSearchType" required: - type - attributes type: object ArchiveSearchListResponse: description: Response containing multiple Archive Searches. properties: data: description: Array of Archive Searches. items: $ref: "#/components/schemas/ArchiveSearchResponseData" type: array meta: $ref: "#/components/schemas/ArchiveSearchListResponseMeta" required: - data type: object ArchiveSearchListResponseMeta: description: Metadata of the Archive Searches response. properties: truncated: description: Whether more Archive Searches exist beyond the ones returned. example: false type: boolean type: object ArchiveSearchRehydrateRequest: description: Request to rehydrate an Archive Search. properties: data: $ref: "#/components/schemas/ArchiveSearchRehydrateRequestData" required: - data type: object ArchiveSearchRehydrateRequestAttributes: description: Attributes accepted when rehydrating an Archive Search. properties: rehydration: $ref: "#/components/schemas/ArchiveSearchRehydrateRequestRehydration" required: - rehydration type: object ArchiveSearchRehydrateRequestData: description: Archive Search object to rehydrate. properties: attributes: $ref: "#/components/schemas/ArchiveSearchRehydrateRequestAttributes" type: $ref: "#/components/schemas/ArchiveSearchType" required: - type - attributes type: object ArchiveSearchRehydrateRequestRehydration: description: Rehydration settings to apply. properties: retention_days: description: Number of days the rehydrated logs are retained for. example: 15 format: int64 type: integer tier: $ref: "#/components/schemas/ArchiveSearchRehydrationTier" required: - retention_days - tier type: object ArchiveSearchRehydration: description: |- Rehydration settings of the Archive Search. Absent when the search only scans the archive without indexing the results. properties: max_rehydrated_events: description: Maximum number of events to rehydrate. example: 1000000 format: int64 type: integer retention_days: description: Number of days the rehydrated logs are retained for. example: 15 format: int64 type: integer tier: $ref: "#/components/schemas/ArchiveSearchRehydrationTier" required: - retention_days - tier - max_rehydrated_events type: object ArchiveSearchRehydrationTier: description: Storage tier the matched logs are rehydrated into. enum: - standard - flex example: standard type: string x-enum-varnames: - STANDARD - FLEX ArchiveSearchResponse: description: Response containing a single Archive Search. properties: data: $ref: "#/components/schemas/ArchiveSearchResponseData" required: - data type: object ArchiveSearchResponseAttributes: description: Attributes of an Archive Search. properties: archive_id: description: ID of the archive being searched. example: mhmyYmyLTOaFYKvhNadu1w type: string bytes_scanned: description: Number of bytes read from the archive at the end of the search. example: 402764439 format: int64 type: integer completed_at: description: |- Time the Archive Search finished, as an ISO 8601 timestamp. Absent while the search is still running. example: "2026-01-02T12:30:00Z" format: date-time type: string created_at: description: Time the Archive Search was created, as an ISO 8601 timestamp. example: "2026-01-02T12:00:00Z" format: date-time type: string description: description: Free-text description of the Archive Search. example: Investigating the checkout latency spike. type: string events_scanned: description: Number of events read from the archive at the end of the search. example: 1500 format: int64 type: integer expected_duration: description: Estimated time left before the Archive Search completes, in seconds. example: 120 format: int64 type: integer from: description: Start of the searched time range, as an ISO 8601 timestamp. example: "2026-01-01T00:00:00Z" format: date-time type: string name: description: Name of the Archive Search. example: checkout-latency-investigation type: string query: description: Log search query used to filter the archived logs. example: service:checkout status:error type: string rehydration: $ref: "#/components/schemas/ArchiveSearchRehydration" status: $ref: "#/components/schemas/ArchiveSearchStatus" to: description: End of the searched time range, as an ISO 8601 timestamp. example: "2026-01-02T00:00:00Z" format: date-time type: string required: - archive_id - name - query - from - to - status - created_at - events_scanned - bytes_scanned type: object ArchiveSearchResponseData: description: Archive Search object. properties: attributes: $ref: "#/components/schemas/ArchiveSearchResponseAttributes" id: description: Unique identifier of the Archive Search. example: nv2eu4srgyzdkulggjzg2zkmmzifa2rum5iq type: string type: $ref: "#/components/schemas/ArchiveSearchType" required: - id - type - attributes type: object ArchiveSearchStatus: description: Current state of an Archive Search. enum: - RUNNING - COMPLETED - FAILED - CANCELLED - QUOTA_REACHED - EXPIRED example: RUNNING type: string x-enum-varnames: - RUNNING - COMPLETED - FAILED - CANCELLED - QUOTA_REACHED - EXPIRED ArchiveSearchType: default: archive_search description: Archive Search resource type. enum: - archive_search example: archive_search type: string x-enum-varnames: - ARCHIVE_SEARCH Argument: description: A named argument for a custom static analysis rule. properties: description: description: Base64-encoded argument description example: YXJndW1lbnQgZGVzY3JpcHRpb24= type: string name: description: Base64-encoded argument name example: YXJndW1lbnRfbmFtZQ== type: string required: - name - description type: object AsanaAccessToken: description: The definition of the `AsanaAccessToken` object. properties: access_token: $ref: "#/components/schemas/AsanaAccessTokenAccessToken" type: $ref: "#/components/schemas/AsanaAccessTokenType" required: - type - access_token type: object AsanaAccessTokenAccessToken: description: The `AsanaAccessToken` `access_token`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" AsanaAccessTokenType: description: The definition of the `AsanaAccessToken` object. enum: - AsanaAccessToken example: AsanaAccessToken type: string x-enum-varnames: - ASANAACCESSTOKEN AsanaAccessTokenUpdate: description: The definition of the `AsanaAccessToken` object. properties: access_token: $ref: "#/components/schemas/AsanaAccessTokenUpdateAccessToken" type: $ref: "#/components/schemas/AsanaAccessTokenType" required: - type type: object AsanaAccessTokenUpdateAccessToken: description: The `AsanaAccessTokenUpdate` `access_token`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" AsanaCredentials: description: The definition of the `AsanaCredentials` object. oneOf: - $ref: "#/components/schemas/AsanaAccessToken" AsanaCredentialsUpdate: description: The definition of the `AsanaCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/AsanaAccessTokenUpdate" AsanaIntegration: description: The definition of the `AsanaIntegration` object. properties: credentials: $ref: "#/components/schemas/AsanaCredentials" type: $ref: "#/components/schemas/AsanaIntegrationType" required: - type - credentials type: object AsanaIntegrationType: description: The definition of the `AsanaIntegrationType` object. enum: - Asana example: Asana type: string x-enum-varnames: - ASANA AsanaIntegrationUpdate: description: The definition of the `AsanaIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/AsanaCredentialsUpdate" type: $ref: "#/components/schemas/AsanaIntegrationType" required: - type type: object Asset: description: A single vulnerable asset properties: attributes: $ref: "#/components/schemas/AssetAttributes" id: description: The unique ID for this asset. example: Repository|github.com/DataDog/datadog-agent.git type: string type: $ref: "#/components/schemas/AssetEntityType" required: - id - type - attributes type: object AssetAttributes: description: The JSON:API attributes of the asset. properties: arch: description: Asset architecture. example: arm64 type: string environments: description: List of environments where the asset is deployed. example: - staging items: description: An environment where the asset is deployed. example: staging type: string type: array name: description: Asset name. example: github.com/DataDog/datadog-agent.git type: string operating_system: $ref: "#/components/schemas/AssetOperatingSystem" risks: $ref: "#/components/schemas/AssetRisks" teams: description: List of teams that own the asset. example: - compute items: description: A team that owns the asset. example: compute type: string type: array type: $ref: "#/components/schemas/AssetType" version: $ref: "#/components/schemas/AssetVersion" required: - name - type - risks - environments type: object AssetEntityType: description: The JSON:API type. enum: - assets example: assets type: string x-enum-varnames: - ASSETS AssetOperatingSystem: description: Asset operating system. properties: description: description: Operating system version. example: "24.04" type: string name: description: Operating system name. example: ubuntu type: string version: description: Operating system version. example: "24.04" type: string required: - name type: object AssetRisks: description: Asset risks. properties: has_access_to_sensitive_data: description: Whether the asset has access to sensitive data or not. example: false type: boolean has_privileged_access: description: Whether the asset has privileged access or not. example: false type: boolean in_production: description: Whether the asset is in production or not. example: false type: boolean is_publicly_accessible: description: Whether the asset is publicly accessible or not. example: false type: boolean under_attack: description: Whether the asset is under attack or not. example: false type: boolean required: - in_production type: object AssetType: description: The asset type enum: - Repository - Service - Host - HostImage - Image - ServerlessFunction example: Repository type: string x-enum-varnames: - REPOSITORY - SERVICE - HOST - HOSTIMAGE - IMAGE - SERVERLESSFUNCTION AssetVersion: description: Asset version. properties: first: description: Asset first version. example: _latest type: string last: description: Asset last version. example: _latest type: string type: object AssignSeatsUserRequest: description: The request body for assigning seats to users for a product code. properties: data: $ref: "#/components/schemas/AssignSeatsUserRequestData" description: The data for the assign seats user request. type: object AssignSeatsUserRequestData: description: The request data object containing attributes for assigning seats to users. properties: attributes: $ref: "#/components/schemas/AssignSeatsUserRequestDataAttributes" description: The attributes of the assign seats user request. id: description: The ID of the assign seats user request. type: string type: $ref: "#/components/schemas/SeatAssignmentsDataType" description: The type of the assign seats user request. required: - type - attributes type: object AssignSeatsUserRequestDataAttributes: description: Attributes specifying the product and users to whom seats will be assigned. properties: product_code: description: The product code for which to assign seats. example: "" type: string user_uuids: description: The list of user IDs to assign seats to. example: - "" items: description: A user UUID identifying a user to assign a seat to. type: string type: array required: - product_code - user_uuids type: object AssignSeatsUserResponse: description: The response body returned after successfully assigning seats to users. properties: data: $ref: "#/components/schemas/AssignSeatsUserResponseData" description: The data for the assign seats user response. type: object AssignSeatsUserResponseData: description: The response data object containing attributes of the seat assignment result. properties: attributes: $ref: "#/components/schemas/AssignSeatsUserResponseDataAttributes" description: The attributes of the assign seats user response. id: description: The ID of the assign seats user response. type: string type: $ref: "#/components/schemas/SeatAssignmentsDataType" type: object AssignSeatsUserResponseDataAttributes: description: Attributes of the assign seats response, including the list of users assigned and the product code. properties: assigned_ids: description: The list of user IDs to which the seats were assigned. items: description: A user UUID identifying a user to whom a seat was assigned. type: string type: array product_code: description: The product code for which the seats were assigned. type: string type: object AssigneeDataType: default: assignee description: Assignee resource type. enum: - assignee example: assignee type: string x-enum-varnames: - ASSIGNEE AssigneeRequest: description: Request to assign or unassign security findings. properties: data: $ref: "#/components/schemas/AssigneeRequestData" required: - data type: object AssigneeRequestData: description: Data of the assignee request. properties: attributes: $ref: "#/components/schemas/AssigneeRequestDataAttributes" id: description: Unique identifier of the assignee request. example: "00000000-0000-0000-0000-000000000001" type: string relationships: $ref: "#/components/schemas/AssigneeRequestDataRelationships" type: $ref: "#/components/schemas/AssigneeDataType" required: - relationships - type type: object AssigneeRequestDataAttributes: description: Attributes of the assignee request. properties: assignee_id: description: Unique identifier of the Datadog user to assign the security findings to. If this field is not provided, the security findings are unassigned. example: "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0" type: string type: object AssigneeRequestDataRelationships: description: Relationships of the assignee request. properties: findings: $ref: "#/components/schemas/Findings" description: Security findings to assign or unassign. required: - findings type: object AssigneeResponse: description: Response for the assign or unassign request. properties: data: $ref: "#/components/schemas/AssigneeResponseData" meta: $ref: "#/components/schemas/AssigneeResponseMeta" required: - data type: object AssigneeResponseData: description: Data of the assignee response. properties: attributes: $ref: "#/components/schemas/AssigneeResponseDataAttributes" id: description: Unique identifier of the assignee request. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/AssigneeDataType" required: - id - type - attributes type: object AssigneeResponseDataAttributes: description: Attributes of the assignee response. properties: assignee_id: description: Unique identifier of the Datadog user assigned to the security findings. Omitted when the findings were unassigned. example: "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0" type: string type: object AssigneeResponseMeta: description: Per-finding warnings and failures produced while processing the bulk assignee request. properties: failures: description: Findings that could not be assigned or unassigned. items: $ref: "#/components/schemas/AssignmentResult" type: array warnings: description: Findings for which the assignment succeeded but a non-critical error occurred during processing. items: $ref: "#/components/schemas/AssignmentResult" type: array type: object AssignmentResult: description: Per-finding outcome of an assign or unassign operation. properties: detail: description: Human-readable explanation of the outcome. example: "failed to update finding assignee" type: string finding_id: description: Unique identifier of the security finding. example: "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==" type: string status: description: HTTP-like status code describing the outcome for this finding. example: 500 format: int32 maximum: 599 type: integer title: description: Short label describing the outcome for this finding. example: "Internal Server Error" type: string required: - finding_id - status - title - detail type: object AstNode: description: A node in the abstract syntax tree of the parsed source code. properties: ast_type: description: The tree-sitter node type of this AST node. example: module type: string children: description: The child nodes of this AST node, or null for a leaf node. items: $ref: "#/components/schemas/AstNode" nullable: true type: array end: $ref: "#/components/schemas/AnalysisPosition" field_name: description: The name of the field this node occupies within its parent node, when the parent addresses it by name. type: string start: $ref: "#/components/schemas/AnalysisPosition" required: - ast_type - start - end - children type: object AttachCaseRequest: description: Request for attaching security findings to a case. properties: data: $ref: "#/components/schemas/AttachCaseRequestData" type: object AttachCaseRequestData: description: Data of the case to attach security findings to. properties: id: description: Unique identifier of the case. example: "c1234567-89ab-cdef-0123-456789abcdef" type: string relationships: $ref: "#/components/schemas/AttachCaseRequestDataRelationships" type: $ref: "#/components/schemas/CaseDataType" required: - type - id type: object AttachCaseRequestDataRelationships: description: Relationships of the case to attach security findings to. properties: findings: $ref: "#/components/schemas/Findings" description: Security findings to attach to the case. required: - findings type: object AttachJiraIssueRequest: description: Request for attaching security findings to a Jira issue. properties: data: $ref: "#/components/schemas/AttachJiraIssueRequestData" type: object AttachJiraIssueRequestData: description: Data of the Jira issue to attach security findings to. properties: attributes: $ref: "#/components/schemas/AttachJiraIssueRequestDataAttributes" relationships: $ref: "#/components/schemas/AttachJiraIssueRequestDataRelationships" type: $ref: "#/components/schemas/JiraIssuesDataType" required: - type type: object AttachJiraIssueRequestDataAttributes: description: Attributes of the Jira issue to attach security findings to. properties: jira_issue_url: description: URL of the Jira issue to attach security findings to. example: "https://domain.atlassian.net/browse/PROJ-123" type: string required: - jira_issue_url type: object AttachJiraIssueRequestDataRelationships: description: Relationships of the Jira issue to attach security findings to. properties: findings: $ref: "#/components/schemas/Findings" description: Security findings to attach to the Jira issue. project: $ref: "#/components/schemas/CaseManagementProject" description: Case management project with Jira integration configured. It is used to attach security findings to the Jira issue. To configure the integration, see [Bidirectional ticket syncing with Jira](https://docs.datadoghq.com/security/ticketing_integrations/#bidirectional-ticket-syncing-with-jira). required: - findings - project type: object AttachLinearIssueRequest: description: Request for attaching security findings to a Linear issue. properties: data: $ref: "#/components/schemas/AttachLinearIssueRequestData" required: - data type: object AttachLinearIssueRequestData: description: Data of the Linear issue to attach security findings to. properties: attributes: $ref: "#/components/schemas/AttachLinearIssueRequestDataAttributes" relationships: $ref: "#/components/schemas/AttachLinearIssueRequestDataRelationships" type: $ref: "#/components/schemas/LinearIssuesDataType" required: - attributes - relationships - type type: object AttachLinearIssueRequestDataAttributes: description: Attributes of the Linear issue to attach security findings to. properties: linear_issue_url: description: URL of the Linear issue to attach security findings to. example: "https://linear.app/your-workspace/issue/ENG-123" type: string required: - linear_issue_url type: object AttachLinearIssueRequestDataRelationships: description: Relationships of the Linear issue to attach security findings to. properties: findings: $ref: "#/components/schemas/Findings" description: Security findings to attach to the Linear issue. project: $ref: "#/components/schemas/CaseManagementProject" description: Case management project with the Linear integration configured. It is used to attach security findings to the Linear issue. required: - findings - project type: object AttachServiceNowTicketRequest: description: Request for attaching security findings to a ServiceNow ticket. properties: data: $ref: "#/components/schemas/AttachServiceNowTicketRequestData" required: - data type: object AttachServiceNowTicketRequestData: description: Data of the ServiceNow ticket to attach security findings to. properties: attributes: $ref: "#/components/schemas/AttachServiceNowTicketRequestDataAttributes" relationships: $ref: "#/components/schemas/AttachServiceNowTicketRequestDataRelationships" type: $ref: "#/components/schemas/ServiceNowTicketsDataType" required: - attributes - relationships - type type: object AttachServiceNowTicketRequestDataAttributes: description: Attributes of the ServiceNow ticket to attach security findings to. properties: servicenow_ticket_url: description: URL of the ServiceNow incident to attach security findings to. Must be a service-now.com URL pointing to an incident record. example: "https://example.service-now.com/now/nav/ui/classic/params/target/incident.do?sys_id=abcdef0123456789abcdef0123456789" type: string required: - servicenow_ticket_url type: object AttachServiceNowTicketRequestDataRelationships: description: Relationships of the ServiceNow ticket to attach security findings to. properties: findings: $ref: "#/components/schemas/Findings" description: Security findings to attach to the ServiceNow ticket. project: $ref: "#/components/schemas/CaseManagementProject" description: Case management project with the ServiceNow integration configured. It is used to attach security findings to the ServiceNow ticket. required: - findings - project type: object Attachment: description: An attachment response containing the attachment data and related objects. properties: data: $ref: "#/components/schemas/AttachmentData" included: description: A list of related objects included in the response. items: $ref: "#/components/schemas/AttachmentIncluded" type: array type: object AttachmentArray: description: A list of incident attachments. properties: data: description: An array of attachment data objects. items: $ref: "#/components/schemas/AttachmentData" type: array included: description: A list of related objects included in the response. items: $ref: "#/components/schemas/AttachmentIncluded" type: array required: - data type: object AttachmentData: description: Attachment data from a response. properties: attributes: $ref: "#/components/schemas/AttachmentDataAttributes" id: description: The unique identifier of the attachment. example: "00000000-abcd-0002-0000-000000000000" type: string relationships: $ref: "#/components/schemas/AttachmentDataRelationships" type: $ref: "#/components/schemas/IncidentAttachmentType" required: - type - attributes - relationships - id type: object AttachmentDataAttributes: description: The attachment's attributes. properties: attachment: $ref: "#/components/schemas/AttachmentDataAttributesAttachment" attachment_type: $ref: "#/components/schemas/AttachmentDataAttributesAttachmentType" modified: description: Timestamp when the attachment was last modified. example: "2025-01-01T01:01:01.000000001Z" format: date-time type: string type: object AttachmentDataAttributesAttachment: description: The attachment object. properties: documentUrl: description: The URL of the attachment. example: "https://app.datadoghq.com/notebook/123/Postmortem-IR-123" type: string title: description: The title of the attachment. example: "Postmortem IR-123" type: string type: object AttachmentDataAttributesAttachmentType: description: The type of the attachment. enum: ["postmortem", "link"] example: "postmortem" type: string x-enum-varnames: - POSTMORTEM - LINK AttachmentDataRelationships: description: The attachment's resource relationships. properties: incident: $ref: "#/components/schemas/RelationshipToIncident" last_modified_by_user: $ref: "#/components/schemas/RelationshipToUser" type: object AttachmentIncluded: description: Objects related to an attachment. oneOf: - $ref: "#/components/schemas/IncidentUserData" AuditLogsEvent: description: Object description of an Audit Logs event after it is processed and stored by Datadog. properties: attributes: $ref: "#/components/schemas/AuditLogsEventAttributes" id: description: Unique ID of the event. example: "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA" type: string type: $ref: "#/components/schemas/AuditLogsEventType" type: object AuditLogsEventAttributes: description: JSON object containing all event attributes and their associated values. properties: attributes: additionalProperties: {} description: JSON object of attributes from Audit Logs events. example: {"customAttribute": 123, "duration": 2345} type: object message: description: Message of the event. type: string service: description: |- Name of the application or service generating Audit Logs events. This name is used to correlate Audit Logs to APM, so make sure you specify the same value when you use both products. example: "web-app" type: string tags: description: Array of tags associated with your event. example: ["team:A"] items: description: Tag associated with your event. type: string type: array timestamp: description: Timestamp of your event. example: "2019-01-02T09:42:36.320Z" format: date-time type: string type: object AuditLogsEventType: default: audit description: Type of the event. enum: - audit example: "audit" type: string x-enum-varnames: - Audit AuditLogsEventsResponse: description: Response object with all events matching the request and pagination information. properties: data: description: Array of events matching the request. items: $ref: "#/components/schemas/AuditLogsEvent" type: array links: $ref: "#/components/schemas/AuditLogsResponseLinks" meta: $ref: "#/components/schemas/AuditLogsResponseMetadata" type: object AuditLogsQueryFilter: description: Search and filter query settings. properties: from: default: "now-15m" description: Minimum time for the requested events. Supports date, math, and regular timestamps (in milliseconds). example: "now-15m" type: string query: default: "*" description: Search query following the Audit Logs search syntax. example: "@type:session AND @session.type:user" type: string to: default: "now" description: Maximum time for the requested events. Supports date, math, and regular timestamps (in milliseconds). example: "now" type: string type: object AuditLogsQueryOptions: description: |- Global query options that are used during the query. Note: Specify either timezone or time offset, not both. Otherwise, the query fails. properties: time_offset: description: Time offset (in seconds) to apply to the query. format: int64 type: integer timezone: default: "UTC" description: |- The timezone can be specified as GMT, UTC, an offset from UTC (like UTC+1), or as a Timezone Database identifier (like America/New_York). example: "GMT" type: string type: object AuditLogsQueryPageOptions: description: Paging attributes for listing events. properties: cursor: description: |- List following results with a cursor provided in the previous query. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string limit: default: 10 description: Maximum number of events in the response. example: 25 format: int32 maximum: 1000 type: integer type: object AuditLogsResponseLinks: description: Links attributes. properties: next: description: |- Link for the next set of results. Note that the request can also be made using the POST endpoint. example: "https://app.datadoghq.com/api/v2/audit/event?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string type: object AuditLogsResponseMetadata: description: The metadata associated with a request. properties: elapsed: description: Time elapsed in milliseconds. example: 132 format: int64 type: integer page: $ref: "#/components/schemas/AuditLogsResponsePage" request_id: description: The identifier of the request. example: "MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR" type: string status: $ref: "#/components/schemas/AuditLogsResponseStatus" warnings: description: |- A list of warnings (non-fatal errors) encountered. Partial results may return if warnings are present in the response. items: $ref: "#/components/schemas/AuditLogsWarning" type: array type: object AuditLogsResponsePage: description: Paging attributes. properties: after: description: |- The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of `page[cursor]`. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string type: object AuditLogsResponseStatus: description: The status of the response. enum: ["done", "timeout"] example: "done" type: string x-enum-varnames: ["DONE", "TIMEOUT"] AuditLogsSearchEventsRequest: description: The request for a Audit Logs events list. properties: filter: $ref: "#/components/schemas/AuditLogsQueryFilter" options: $ref: "#/components/schemas/AuditLogsQueryOptions" page: $ref: "#/components/schemas/AuditLogsQueryPageOptions" sort: $ref: "#/components/schemas/AuditLogsSort" type: object AuditLogsSort: description: Sort parameters when querying events. enum: - timestamp - -timestamp type: string x-enum-varnames: - TIMESTAMP_ASCENDING - TIMESTAMP_DESCENDING AuditLogsWarning: description: Warning message indicating something that went wrong with the query. properties: code: description: Unique code for this type of warning. example: "unknown_index" type: string detail: description: Detailed explanation of this specific warning. example: "indexes: foo, bar" type: string title: description: Short human-readable summary of the warning. example: "One or several indexes are missing or invalid, results hold data from the other indexes" type: string type: object AuthNMapping: description: The AuthN Mapping object returned by API. properties: attributes: $ref: "#/components/schemas/AuthNMappingAttributes" id: description: ID of the AuthN Mapping. example: "3653d3c6-0c75-11ea-ad28-fb5701eabc7d" type: string relationships: $ref: "#/components/schemas/AuthNMappingRelationships" type: $ref: "#/components/schemas/AuthNMappingsType" required: - id - type type: object AuthNMappingAttributes: description: Attributes of AuthN Mapping. properties: attribute_key: description: Key portion of a key/value pair of the attribute sent from the Identity Provider. example: member-of type: string attribute_value: description: Value portion of a key/value pair of the attribute sent from the Identity Provider. example: Development type: string created_at: description: Creation time of the AuthN Mapping. format: date-time readOnly: true type: string modified_at: description: Time of last AuthN Mapping modification. format: date-time readOnly: true type: string saml_assertion_attribute_id: description: The ID of the SAML assertion attribute. example: "0" type: string type: object AuthNMappingCreateAttributes: description: Key/Value pair of attributes used for create request. properties: attribute_key: description: Key portion of a key/value pair of the attribute sent from the Identity Provider. example: member-of type: string attribute_value: description: Value portion of a key/value pair of the attribute sent from the Identity Provider. example: Development type: string type: object AuthNMappingCreateData: description: Data for creating an AuthN Mapping. properties: attributes: $ref: "#/components/schemas/AuthNMappingCreateAttributes" relationships: $ref: "#/components/schemas/AuthNMappingCreateRelationships" type: $ref: "#/components/schemas/AuthNMappingsType" required: - type type: object AuthNMappingCreateRelationships: description: Relationship of AuthN Mapping create object to a Role or Team. oneOf: - $ref: "#/components/schemas/AuthNMappingRelationshipToRole" - $ref: "#/components/schemas/AuthNMappingRelationshipToTeam" AuthNMappingCreateRequest: description: Request for creating an AuthN Mapping. properties: data: $ref: "#/components/schemas/AuthNMappingCreateData" required: - data type: object AuthNMappingIncluded: description: Included data in the AuthN Mapping response. oneOf: - $ref: "#/components/schemas/SAMLAssertionAttribute" - $ref: "#/components/schemas/Role" - $ref: "#/components/schemas/AuthNMappingTeam" AuthNMappingRelationshipToRole: description: Relationship of AuthN Mapping to a Role. properties: role: $ref: "#/components/schemas/RelationshipToRole" required: - role type: object AuthNMappingRelationshipToTeam: description: Relationship of AuthN Mapping to a Team. properties: team: $ref: "#/components/schemas/RelationshipToTeam" required: - team type: object AuthNMappingRelationships: description: All relationships associated with AuthN Mapping. properties: role: $ref: "#/components/schemas/RelationshipToRole" saml_assertion_attribute: $ref: "#/components/schemas/RelationshipToSAMLAssertionAttribute" team: $ref: "#/components/schemas/RelationshipToTeam" type: object AuthNMappingResourceType: description: The type of resource being mapped to. enum: - role - team type: string x-enum-varnames: - ROLE - TEAM AuthNMappingResponse: description: AuthN Mapping response from the API. properties: data: $ref: "#/components/schemas/AuthNMapping" included: description: Included data in the AuthN Mapping response. items: $ref: "#/components/schemas/AuthNMappingIncluded" type: array type: object AuthNMappingTeam: description: Team. properties: attributes: $ref: "#/components/schemas/AuthNMappingTeamAttributes" id: description: The ID of the Team. example: "f9bb8444-af7f-11ec-ac2c-da7ad0900001" type: string type: $ref: "#/components/schemas/TeamType" type: object AuthNMappingTeamAttributes: description: Team attributes. properties: avatar: description: Unicode representation of the avatar for the team, limited to a single grapheme example: "🥑" nullable: true type: string banner: description: Banner selection for the team format: int64 nullable: true type: integer handle: description: The team's identifier example: example-team maxLength: 195 type: string link_count: description: The number of links belonging to the team format: int32 maximum: 2147483647 readOnly: true type: integer name: description: The name of the team example: Example Team maxLength: 200 type: string summary: description: A brief summary of the team, derived from the `description` maxLength: 120 nullable: true type: string user_count: description: The number of users belonging to the team format: int32 maximum: 2147483647 readOnly: true type: integer type: object AuthNMappingUpdateAttributes: description: Key/Value pair of attributes used for update request. properties: attribute_key: description: Key portion of a key/value pair of the attribute sent from the Identity Provider. example: member-of type: string attribute_value: description: Value portion of a key/value pair of the attribute sent from the Identity Provider. example: Development type: string type: object AuthNMappingUpdateData: description: Data for updating an AuthN Mapping. properties: attributes: $ref: "#/components/schemas/AuthNMappingUpdateAttributes" id: description: ID of the AuthN Mapping. example: "3653d3c6-0c75-11ea-ad28-fb5701eabc7d" type: string relationships: $ref: "#/components/schemas/AuthNMappingUpdateRelationships" type: $ref: "#/components/schemas/AuthNMappingsType" required: - id - type type: object AuthNMappingUpdateRelationships: description: Relationship of AuthN Mapping update object to a Role or Team. oneOf: - $ref: "#/components/schemas/AuthNMappingRelationshipToRole" - $ref: "#/components/schemas/AuthNMappingRelationshipToTeam" AuthNMappingUpdateRequest: description: Request to update an AuthN Mapping. properties: data: $ref: "#/components/schemas/AuthNMappingUpdateData" required: - data type: object AuthNMappingsResponse: description: Array of AuthN Mappings response. properties: data: description: Array of returned AuthN Mappings. items: $ref: "#/components/schemas/AuthNMapping" type: array included: description: Included data in the AuthN Mapping response. items: $ref: "#/components/schemas/AuthNMappingIncluded" type: array meta: $ref: "#/components/schemas/ResponseMetaAttributes" type: object AuthNMappingsSort: description: Sorting options for AuthN Mappings. enum: - created_at - -created_at - role_id - -role_id - saml_assertion_attribute_id - -saml_assertion_attribute_id - role.name - -role.name - saml_assertion_attribute.attribute_key - -saml_assertion_attribute.attribute_key - saml_assertion_attribute.attribute_value - -saml_assertion_attribute.attribute_value type: string x-enum-varnames: - CREATED_AT_ASCENDING - CREATED_AT_DESCENDING - ROLE_ID_ASCENDING - ROLE_ID_DESCENDING - SAML_ASSERTION_ATTRIBUTE_ID_ASCENDING - SAML_ASSERTION_ATTRIBUTE_ID_DESCENDING - ROLE_NAME_ASCENDING - ROLE_NAME_DESCENDING - SAML_ASSERTION_ATTRIBUTE_KEY_ASCENDING - SAML_ASSERTION_ATTRIBUTE_KEY_DESCENDING - SAML_ASSERTION_ATTRIBUTE_VALUE_ASCENDING - SAML_ASSERTION_ATTRIBUTE_VALUE_DESCENDING AuthNMappingsType: default: authn_mappings description: AuthN Mappings resource type. enum: - authn_mappings example: authn_mappings type: string x-enum-varnames: - AUTHN_MAPPINGS AutoCloseInactiveCases: description: Auto-close inactive work items settings. properties: enabled: description: Whether auto-close is enabled. type: boolean max_inactive_time_in_secs: description: Maximum inactive time in seconds before auto-closing. format: int64 type: integer type: object AutoTransitionAssignedCases: description: Auto-transition assigned work items settings. properties: auto_transition_assigned_cases_on_self_assigned: description: Whether to auto-transition work items when self-assigned. type: boolean type: object AutomationRule: description: An automation rule that executes an action (such as running a Datadog workflow or assigning an AI agent) when a specified work item event occurs within a project. properties: attributes: $ref: "#/components/schemas/AutomationRuleAttributes" id: description: Automation rule identifier. example: "e6773723-fe58-49ff-9975-dff00f14e28d" type: string relationships: $ref: "#/components/schemas/AutomationRuleRelationships" type: $ref: "#/components/schemas/CaseAutomationRuleResourceType" required: - id - type - attributes type: object AutomationRuleAction: description: Defines what happens when the rule triggers. Combines an action type with action-specific configuration data. properties: data: $ref: "#/components/schemas/AutomationRuleActionData" type: $ref: "#/components/schemas/AutomationRuleActionType" required: - type - data type: object AutomationRuleActionData: description: Configuration for the action to execute, dependent on the action type. properties: agent_type: description: The type of AI agent to assign. Required when the action type is `ASSIGN_AGENT`. type: string assigned_agent_id: description: The identifier of the AI agent to assign to the work item. Required when the action type is `ASSIGN_AGENT`. type: string handle: description: The handle of the Datadog workflow to execute. Required when the action type is `EXECUTE_WORKFLOW`. example: "workflow-handle-123" type: string type: object AutomationRuleActionType: description: The type of automated action to perform when the rule triggers. `EXECUTE_WORKFLOW` runs a Datadog workflow; `ASSIGN_AGENT` assigns an AI agent to the work item. enum: - EXECUTE_WORKFLOW - ASSIGN_AGENT example: EXECUTE_WORKFLOW type: string x-enum-varnames: - EXECUTE_WORKFLOW - ASSIGN_AGENT AutomationRuleActorType: description: Whether the actor is a user or the Datadog system. enum: - user - system example: user type: string x-enum-varnames: - USER - SYSTEM AutomationRuleAttributes: description: Core attributes of an automation rule, including its name, trigger condition, action to execute, and current state. properties: action: $ref: "#/components/schemas/AutomationRuleAction" created_at: description: Timestamp when the automation rule was created. example: "2024-01-01T00:00:00.000Z" format: date-time readOnly: true type: string modified_at: description: Timestamp when the automation rule was last modified. format: date-time readOnly: true type: string name: description: A human-readable name for the automation rule, used to identify the rule in the UI and API responses. example: "Auto-assign workflow" type: string state: $ref: "#/components/schemas/CaseAutomationRuleState" trigger: $ref: "#/components/schemas/AutomationRuleTrigger" required: - name - trigger - action - state - created_at type: object AutomationRuleCreate: description: Data object for creating an automation rule. properties: attributes: $ref: "#/components/schemas/AutomationRuleCreateAttributes" type: $ref: "#/components/schemas/CaseAutomationRuleResourceType" required: - type - attributes type: object AutomationRuleCreateAttributes: description: Attributes required to create an automation rule. properties: action: $ref: "#/components/schemas/AutomationRuleAction" name: description: Name of the automation rule. example: "Auto-assign workflow" type: string state: $ref: "#/components/schemas/CaseAutomationRuleState" trigger: $ref: "#/components/schemas/AutomationRuleTrigger" required: - name - trigger - action type: object AutomationRuleCreateRequest: description: Request payload for creating an automation rule. properties: data: $ref: "#/components/schemas/AutomationRuleCreate" required: - data type: object AutomationRuleCreatedBy: description: The user or Datadog system who created the rule. properties: id: description: The actor's identifier (a user UUID or a system identifier). example: "00000000-0000-0000-0000-000000000000" type: string name: description: The name of the actor. example: "Jane Doe" type: string type: $ref: "#/components/schemas/AutomationRuleActorType" required: - type - id - name type: object AutomationRuleModifiedBy: description: The user or Datadog system who last modified the rule. properties: id: description: The actor's identifier (a user UUID or a system identifier). example: "00000000-0000-0000-0000-000000000000" type: string name: description: The name of the actor. example: "Jane Doe" type: string type: $ref: "#/components/schemas/AutomationRuleActorType" required: - type - id - name type: object AutomationRuleRelationships: description: Related resources for the automation rule, including the users who created and last modified it. properties: created_by: $ref: "#/components/schemas/NullableUserRelationship" modified_by: $ref: "#/components/schemas/NullableUserRelationship" type: object AutomationRuleResponse: description: Response containing a single automation rule. properties: data: $ref: "#/components/schemas/AutomationRule" required: - data type: object AutomationRuleScope: description: Defines the scope of findings to which the automation rule applies. properties: finding_types: $ref: "#/components/schemas/SecurityFindingTypes" query: description: A search query to further filter the findings matched by this rule. The `@workflow.*` namespace and `@status` fields are not permitted. For a reference of available fields, see the [Security Findings schema documentation](https://docs.datadoghq.com/security/guide/findings-schema/). example: "env:prod team:platform" maxLength: 30000 type: string required: - finding_types type: object AutomationRuleTrigger: description: Defines when the rule activates. Combines a trigger type (the work item event to listen for) with optional trigger data (conditions that narrow when the trigger fires). properties: data: $ref: "#/components/schemas/AutomationRuleTriggerData" type: $ref: "#/components/schemas/AutomationRuleTriggerType" required: - type type: object AutomationRuleTriggerData: description: Additional configuration for the trigger, dependent on the trigger type. For `STATUS_TRANSITIONED` triggers, specify `from_status_name` and `to_status_name`. For `ATTRIBUTE_VALUE_CHANGED` triggers, specify `field` and `change_type`. properties: approval_type: description: The approval outcome to match. Used with `CASE_REVIEW_APPROVED` triggers. type: string change_type: description: "The kind of attribute change to match. Allowed values: `VALUE_ADDED`, `VALUE_DELETED`, `ANY_CHANGES`. Used with `ATTRIBUTE_VALUE_CHANGED` triggers." type: string field: description: The work item attribute field name to monitor for changes. Used with `ATTRIBUTE_VALUE_CHANGED` triggers. type: string from_status_name: description: The originating status name. Used with `STATUS_TRANSITIONED` triggers to match transitions from this status. type: string to_status_name: description: The destination status name. Used with `STATUS_TRANSITIONED` triggers to match transitions to this status. type: string type: object AutomationRuleTriggerType: description: The work item event that activates the automation rule. enum: - CASE_CREATED - STATUS_TRANSITIONED - ATTRIBUTE_VALUE_CHANGED - EVENT_CORRELATION_SIGNAL_CORRELATED - CASE_REVIEW_APPROVED - COMMENT_ADDED example: CASE_CREATED type: string x-enum-varnames: - CASE_CREATED - STATUS_TRANSITIONED - ATTRIBUTE_VALUE_CHANGED - EVENT_CORRELATION_SIGNAL_CORRELATED - CASE_REVIEW_APPROVED - COMMENT_ADDED AutomationRuleUpdate: description: Data object for updating an automation rule. properties: attributes: $ref: "#/components/schemas/AutomationRuleCreateAttributes" type: $ref: "#/components/schemas/CaseAutomationRuleResourceType" required: - type type: object AutomationRuleUpdateRequest: description: Request payload for updating an automation rule. properties: data: $ref: "#/components/schemas/AutomationRuleUpdate" required: - data type: object AutomationRulesResponse: description: Response containing a list of automation rules for a project. properties: data: description: List of automation rules. items: $ref: "#/components/schemas/AutomationRule" type: array required: - data type: object AwsAccountId: description: The ID of the AWS account. example: "123456789012" type: string AwsCURConfig: description: AWS CUR config. properties: attributes: $ref: "#/components/schemas/AwsCURConfigAttributes" id: description: The ID of the AWS CUR config. type: string type: $ref: "#/components/schemas/AwsCURConfigType" required: - attributes - type type: object AwsCURConfigAttributes: description: Attributes for An AWS CUR config. properties: account_filters: $ref: "#/components/schemas/AccountFilteringConfig" account_id: description: The AWS account ID. example: "123456789123" type: string bucket_name: description: The AWS bucket name used to store the Cost and Usage Report. example: "dd-cost-bucket" type: string bucket_region: description: The region the bucket is located in. example: "us-east-1" type: string created_at: description: The timestamp when the AWS CUR config was created. pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$ type: string error_messages: description: The error messages for the AWS CUR config. items: description: An error message string. type: string nullable: true type: array months: deprecated: true description: The number of months the report has been backfilled. format: int32 maximum: 36 type: integer report_name: description: The name of the Cost and Usage Report. example: "dd-report-name" type: string report_prefix: description: The report prefix used for the Cost and Usage Report. example: "dd-report-prefix" type: string status: description: The status of the AWS CUR. example: "active" type: string status_updated_at: description: The timestamp when the AWS CUR config status was updated. pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$ type: string updated_at: description: The timestamp when the AWS CUR config status was updated. pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$ type: string required: - account_id - bucket_name - bucket_region - report_name - report_prefix - status type: object AwsCURConfigPatchData: description: AWS CUR config Patch data. properties: attributes: $ref: "#/components/schemas/AwsCURConfigPatchRequestAttributes" type: $ref: "#/components/schemas/AwsCURConfigPatchRequestType" required: - attributes - type type: object AwsCURConfigPatchRequest: description: AWS CUR config Patch Request. properties: data: $ref: "#/components/schemas/AwsCURConfigPatchData" required: - data type: object AwsCURConfigPatchRequestAttributes: description: Attributes for AWS CUR config Patch Request. properties: account_filters: $ref: "#/components/schemas/AccountFilteringConfig" is_enabled: description: Whether or not the Cloud Cost Management account is enabled. example: true type: boolean type: object AwsCURConfigPatchRequestType: default: aws_cur_config_patch_request description: Type of AWS CUR config Patch Request. enum: - aws_cur_config_patch_request example: aws_cur_config_patch_request type: string x-enum-varnames: - AWS_CUR_CONFIG_PATCH_REQUEST AwsCURConfigPostData: description: AWS CUR config Post data. properties: attributes: $ref: "#/components/schemas/AwsCURConfigPostRequestAttributes" type: $ref: "#/components/schemas/AwsCURConfigPostRequestType" required: - type type: object AwsCURConfigPostRequest: description: AWS CUR config Post Request. properties: data: $ref: "#/components/schemas/AwsCURConfigPostData" required: - data type: object AwsCURConfigPostRequestAttributes: description: Attributes for AWS CUR config Post Request. properties: account_filters: $ref: "#/components/schemas/AccountFilteringConfig" account_id: description: The AWS account ID. example: "123456789123" type: string bucket_name: description: The AWS bucket name used to store the Cost and Usage Report. example: "dd-cost-bucket" type: string bucket_region: description: The region the bucket is located in. example: "us-east-1" type: string months: description: The month of the report. format: int32 maximum: 36 type: integer report_name: description: The name of the Cost and Usage Report. example: "dd-report-name" type: string report_prefix: description: The report prefix used for the Cost and Usage Report. example: "dd-report-prefix" type: string required: - account_id - bucket_name - report_name - report_prefix type: object AwsCURConfigPostRequestType: default: aws_cur_config_post_request description: Type of AWS CUR config Post Request. enum: - aws_cur_config_post_request example: aws_cur_config_post_request type: string x-enum-varnames: - AWS_CUR_CONFIG_POST_REQUEST AwsCURConfigType: default: aws_cur_config description: Type of AWS CUR config. enum: - aws_cur_config example: aws_cur_config type: string x-enum-varnames: - AWS_CUR_CONFIG AwsCURConfigsResponse: description: List of AWS CUR configs. properties: data: description: An AWS CUR config. items: $ref: "#/components/schemas/AwsCURConfig" type: array required: - data type: object AwsCurConfigResponse: description: The definition of `AwsCurConfigResponse` object. example: data: attributes: account_filters: excluded_accounts: - "123456789124" - "123456789125" include_new_accounts: true account_id: "123456789123" bucket_name: dd-cost-bucket bucket_region: us-east-1 created_at: "2023-01-01T12:00:00.000000" error_messages: [] months: 36 report_name: dd-report-name report_prefix: dd-report-prefix status: active status_updated_at: "2023-01-01T12:00:00.000000" updated_at: "2023-01-01T12:00:00.000000" id: "123456789123" type: aws_cur_config properties: data: $ref: "#/components/schemas/AwsCurConfigResponseData" type: object AwsCurConfigResponseData: description: The definition of `AwsCurConfigResponseData` object. properties: attributes: $ref: "#/components/schemas/AwsCurConfigResponseDataAttributes" id: description: The `AwsCurConfigResponseData` `id`. type: string type: $ref: "#/components/schemas/AwsCurConfigResponseDataType" required: - type type: object AwsCurConfigResponseDataAttributes: description: The definition of `AwsCurConfigResponseDataAttributes` object. properties: account_filters: $ref: "#/components/schemas/AwsCurConfigResponseDataAttributesAccountFilters" account_id: description: The `attributes` `account_id`. type: string bucket_name: description: The `attributes` `bucket_name`. type: string bucket_region: description: The `attributes` `bucket_region`. type: string created_at: description: The `attributes` `created_at`. type: string error_messages: description: The `attributes` `error_messages`. items: description: An error message string. type: string nullable: true type: array months: description: The `attributes` `months`. format: int64 type: integer report_name: description: The `attributes` `report_name`. type: string report_prefix: description: The `attributes` `report_prefix`. type: string status: description: The `attributes` `status`. type: string status_updated_at: description: The `attributes` `status_updated_at`. type: string updated_at: description: The `attributes` `updated_at`. type: string type: object AwsCurConfigResponseDataAttributesAccountFilters: description: The definition of `AwsCurConfigResponseDataAttributesAccountFilters` object. properties: excluded_accounts: description: The `account_filters` `excluded_accounts`. items: description: An AWS account ID to exclude. type: string type: array include_new_accounts: description: The `account_filters` `include_new_accounts`. nullable: true type: boolean included_accounts: description: The `account_filters` `included_accounts`. items: description: An AWS account ID to include. type: string type: array type: object AwsCurConfigResponseDataType: default: aws_cur_config description: AWS CUR config resource type. enum: - aws_cur_config example: aws_cur_config type: string x-enum-varnames: - AWS_CUR_CONFIG AwsOnDemandAttributes: description: Attributes for the AWS on demand task. properties: arn: description: The arn of the resource to scan. example: "arn:aws:ec2:us-east-1:727000456123:instance/i-0eabb50529b67a1ba" type: string assigned_at: description: Specifies the assignment timestamp if the task has been already assigned to a scanner. example: "2025-02-11T18:25:04.550564Z" type: string created_at: description: The task submission timestamp. example: "2025-02-11T18:13:24.576915Z" type: string status: description: |- Indicates the status of the task. QUEUED: the task has been submitted successfully and the resource has not been assigned to a scanner yet. ASSIGNED: the task has been assigned. ABORTED: the scan has been aborted after a period of time due to technical reasons, such as resource not found, insufficient permissions, or the absence of a configured scanner. example: "QUEUED" type: string type: object AwsOnDemandCreateAttributes: description: Attributes for the AWS on demand task. properties: arn: description: |- The arn of the resource to scan. Agentless supports the scan of EC2 instances, lambda functions, AMI, ECR, RDS and S3 buckets. example: "arn:aws:ec2:us-east-1:727000456123:instance/i-0eabb50529b67a1ba" type: string required: - arn type: object AwsOnDemandCreateData: description: Object for a single AWS on demand task. properties: attributes: $ref: "#/components/schemas/AwsOnDemandCreateAttributes" type: $ref: "#/components/schemas/AwsOnDemandType" required: - type - attributes type: object AwsOnDemandCreateRequest: description: Request object that includes the on demand task to submit. properties: data: $ref: "#/components/schemas/AwsOnDemandCreateData" required: - data type: object AwsOnDemandData: description: Single AWS on demand task. properties: attributes: $ref: "#/components/schemas/AwsOnDemandAttributes" id: description: The UUID of the task. example: "6d09294c-9ad9-42fd-a759-a0c1599b4828" type: string type: $ref: "#/components/schemas/AwsOnDemandType" type: object AwsOnDemandListResponse: description: Response object that includes a list of AWS on demand tasks. properties: data: description: A list of on demand tasks. items: $ref: "#/components/schemas/AwsOnDemandData" type: array type: object AwsOnDemandResponse: description: Response object that includes an AWS on demand task. properties: data: $ref: "#/components/schemas/AwsOnDemandData" type: object AwsOnDemandType: default: aws_resource description: The type of the on demand task. The value should always be `aws_resource`. enum: - aws_resource example: aws_resource type: string x-enum-varnames: ["AWS_RESOURCE"] AwsScanOptionsAttributes: description: Attributes for the AWS scan options. properties: compliance_host: description: Indicates whether host compliance scanning is enabled. example: false type: boolean lambda: description: Indicates if scanning of Lambda functions is enabled. example: true type: boolean sensitive_data: description: Indicates if scanning for sensitive data is enabled. example: false type: boolean vuln_containers_os: description: Indicates if scanning for vulnerabilities in containers is enabled. example: true type: boolean vuln_host_os: description: Indicates if scanning for vulnerabilities in hosts is enabled. example: true type: boolean type: object AwsScanOptionsCreateAttributes: description: Attributes for the AWS scan options to create. properties: compliance_host: description: Indicates whether host compliance scanning is enabled. example: false type: boolean lambda: description: Indicates if scanning of Lambda functions is enabled. example: true type: boolean sensitive_data: description: Indicates if scanning for sensitive data is enabled. example: false type: boolean vuln_containers_os: description: Indicates if scanning for vulnerabilities in containers is enabled. example: true type: boolean vuln_host_os: description: Indicates if scanning for vulnerabilities in hosts is enabled. example: true type: boolean required: - compliance_host - lambda - sensitive_data - vuln_containers_os - vuln_host_os type: object AwsScanOptionsCreateData: description: Object for the scan options of a single AWS account. properties: attributes: $ref: "#/components/schemas/AwsScanOptionsCreateAttributes" id: $ref: "#/components/schemas/AwsAccountId" type: $ref: "#/components/schemas/AwsScanOptionsType" required: - id - type - attributes type: object AwsScanOptionsCreateRequest: description: Request object that includes the scan options to create. properties: data: $ref: "#/components/schemas/AwsScanOptionsCreateData" required: - data type: object AwsScanOptionsData: description: Single AWS Scan Options entry. properties: attributes: $ref: "#/components/schemas/AwsScanOptionsAttributes" id: description: The ID of the AWS account. example: "184366314700" type: string type: $ref: "#/components/schemas/AwsScanOptionsType" type: object AwsScanOptionsListResponse: description: Response object that includes a list of AWS scan options. properties: data: description: A list of AWS scan options. items: $ref: "#/components/schemas/AwsScanOptionsData" type: array type: object AwsScanOptionsResponse: description: Response object that includes the scan options of an AWS account. properties: data: $ref: "#/components/schemas/AwsScanOptionsData" type: object AwsScanOptionsType: default: aws_scan_options description: The type of the resource. The value should always be `aws_scan_options`. enum: - aws_scan_options example: aws_scan_options type: string x-enum-varnames: ["AWS_SCAN_OPTIONS"] AwsScanOptionsUpdateAttributes: description: Attributes for the AWS scan options to update. properties: compliance_host: description: Indicates whether host compliance scanning is enabled. example: false type: boolean lambda: description: Indicates if scanning of Lambda functions is enabled. example: true type: boolean sensitive_data: description: Indicates if scanning for sensitive data is enabled. example: false type: boolean vuln_containers_os: description: Indicates if scanning for vulnerabilities in containers is enabled. example: true type: boolean vuln_host_os: description: Indicates if scanning for vulnerabilities in hosts is enabled. example: true type: boolean type: object AwsScanOptionsUpdateData: description: Object for the scan options of a single AWS account. properties: attributes: $ref: "#/components/schemas/AwsScanOptionsUpdateAttributes" id: $ref: "#/components/schemas/AwsAccountId" type: $ref: "#/components/schemas/AwsScanOptionsType" required: - id - type - attributes type: object AwsScanOptionsUpdateRequest: description: Request object that includes the scan options to update. properties: data: $ref: "#/components/schemas/AwsScanOptionsUpdateData" required: - data type: object AzureCredentials: description: The definition of the `AzureCredentials` object. oneOf: - $ref: "#/components/schemas/AzureTenant" AzureCredentialsUpdate: description: The definition of the `AzureCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/AzureTenantUpdate" AzureIntegration: description: The definition of the `AzureIntegration` object. properties: credentials: $ref: "#/components/schemas/AzureCredentials" type: $ref: "#/components/schemas/AzureIntegrationType" required: - type - credentials type: object AzureIntegrationType: description: The definition of the `AzureIntegrationType` object. enum: - Azure example: Azure type: string x-enum-varnames: - AZURE AzureIntegrationUpdate: description: The definition of the `AzureIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/AzureCredentialsUpdate" type: $ref: "#/components/schemas/AzureIntegrationType" required: - type type: object AzureScanOptions: description: Response object containing Azure scan options for a single subscription. example: data: attributes: compliance_host: false function: true vuln_containers_os: true vuln_host_os: true id: 12345678-90ab-cdef-1234-567890abcdef type: azure_scan_options properties: data: $ref: "#/components/schemas/AzureScanOptionsData" type: object AzureScanOptionsArray: description: Response object containing a list of Azure scan options. example: data: - attributes: compliance_host: false function: true vuln_containers_os: true vuln_host_os: true id: 12345678-90ab-cdef-1234-567890abcdef type: azure_scan_options properties: data: description: A list of Azure scan options. items: $ref: "#/components/schemas/AzureScanOptionsData" type: array required: - data type: object AzureScanOptionsData: description: Single Azure scan options entry. properties: attributes: $ref: "#/components/schemas/AzureScanOptionsDataAttributes" id: description: The Azure subscription ID. example: "" type: string type: $ref: "#/components/schemas/AzureScanOptionsDataType" required: - type - id type: object AzureScanOptionsDataAttributes: description: Attributes for Azure scan options configuration. properties: compliance_host: description: Indicates whether host compliance scanning is enabled. type: boolean function: description: Indicates if scanning of Azure Functions is enabled. type: boolean vuln_containers_os: description: Indicates if scanning for vulnerabilities in containers is enabled. type: boolean vuln_host_os: description: Indicates if scanning for vulnerabilities in hosts is enabled. type: boolean type: object AzureScanOptionsDataType: default: azure_scan_options description: The type of the resource. The value should always be `azure_scan_options`. enum: - azure_scan_options example: azure_scan_options type: string x-enum-varnames: - AZURE_SCAN_OPTIONS AzureScanOptionsInputUpdate: description: Request object for updating Azure scan options. example: data: id: 12345678-90ab-cdef-1234-567890abcdef type: azure_scan_options properties: data: $ref: "#/components/schemas/AzureScanOptionsInputUpdateData" type: object AzureScanOptionsInputUpdateData: description: Data object for updating the scan options of a single Azure subscription. properties: attributes: $ref: "#/components/schemas/AzureScanOptionsInputUpdateDataAttributes" id: description: The Azure subscription ID. example: "12345678-90ab-cdef-1234-567890abcdef" type: string type: $ref: "#/components/schemas/AzureScanOptionsInputUpdateDataType" required: - type - id type: object AzureScanOptionsInputUpdateDataAttributes: description: Attributes for updating Azure scan options configuration. properties: compliance_host: description: Indicates whether host compliance scanning is enabled. type: boolean function: description: Indicates if scanning of Azure Functions is enabled. type: boolean vuln_containers_os: description: Indicates if scanning for vulnerabilities in containers is enabled. type: boolean vuln_host_os: description: Indicates if scanning for vulnerabilities in hosts is enabled. type: boolean type: object AzureScanOptionsInputUpdateDataType: default: azure_scan_options description: Azure scan options resource type. enum: - azure_scan_options example: azure_scan_options type: string x-enum-varnames: - AZURE_SCAN_OPTIONS AzureStorageDestination: description: |- The `azure_storage` destination forwards logs to an Azure Blob Storage container. **Supported pipeline types:** logs properties: blob_prefix: description: Optional prefix for blobs written to the container. example: "logs/" type: string buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" compression: $ref: "#/components/schemas/ObservabilityPipelineAzureStorageDestinationCompression" connection_string_key: description: Name of the environment variable or secret that holds the Azure Storage connection string. example: AZURE_STORAGE_CONNECTION_STRING type: string container_name: description: The name of the Azure Blob Storage container to store logs in. example: "my-log-container" type: string id: description: The unique identifier for this component. example: "azure-storage-destination" type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["processor-id"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array type: $ref: "#/components/schemas/AzureStorageDestinationType" required: - id - type - inputs - container_name type: object x-pipeline-types: [logs] AzureStorageDestinationType: default: azure_storage description: The destination type. The value should always be `azure_storage`. enum: - azure_storage example: azure_storage type: string x-enum-varnames: - AZURE_STORAGE AzureTenant: description: The definition of the `AzureTenant` object. properties: app_client_id: description: "The Client ID, also known as the Application ID in Azure, is a unique identifier for an application. It's used to identify the application during the authentication process. Your Application (client) ID is listed in the application's overview page. You can navigate to your application via the Azure Directory." example: "" type: string client_secret: description: The Client Secret is a confidential piece of information known only to the application and Azure AD. It's used to prove the application's identity. Your Client Secret is available from the application’s secrets page. You can navigate to your application via the Azure Directory. example: "" type: string custom_scopes: description: If provided, the custom scope to be requested from Microsoft when acquiring an OAuth 2 access token. This custom scope is used only in conjunction with the HTTP action. A resource's scope is constructed by using the identifier URI for the resource and .default, separated by a forward slash (/) as follows:{identifierURI}/.default. type: string tenant_id: description: The Tenant ID, also known as the Directory ID in Azure, is a unique identifier that represents an Azure AD instance. Your Tenant ID (Directory ID) is listed in your Active Directory overview page under the 'Tenant information' section. example: "" type: string type: $ref: "#/components/schemas/AzureTenantType" required: - type - tenant_id - app_client_id - client_secret type: object AzureTenantType: description: The definition of the `AzureTenant` object. enum: - AzureTenant example: AzureTenant type: string x-enum-varnames: - AZURETENANT AzureTenantUpdate: description: The definition of the `AzureTenant` object. properties: app_client_id: description: "The Client ID, also known as the Application ID in Azure, is a unique identifier for an application. It's used to identify the application during the authentication process. Your Application (client) ID is listed in the application's overview page. You can navigate to your application via the Azure Directory." type: string client_secret: description: The Client Secret is a confidential piece of information known only to the application and Azure AD. It's used to prove the application's identity. Your Client Secret is available from the application’s secrets page. You can navigate to your application via the Azure Directory. type: string custom_scopes: description: If provided, the custom scope to be requested from Microsoft when acquiring an OAuth 2 access token. This custom scope is used only in conjunction with the HTTP action. A resource's scope is constructed by using the identifier URI for the resource and .default, separated by a forward slash (/) as follows:{identifierURI}/.default. type: string tenant_id: description: The Tenant ID, also known as the Directory ID in Azure, is a unique identifier that represents an Azure AD instance. Your Tenant ID (Directory ID) is listed in your Active Directory overview page under the 'Tenant information' section. type: string type: $ref: "#/components/schemas/AzureTenantType" required: - type type: object AzureUCConfig: description: Azure config. properties: account_id: description: The tenant ID of the Azure account. example: "1234abcd-1234-abcd-1234-1234abcd1234" type: string client_id: description: The client ID of the Azure account. example: "1234abcd-1234-abcd-1234-1234abcd1234" type: string created_at: description: The timestamp when the Azure config was created. pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$ type: string dataset_type: description: The dataset type of the Azure config. example: "actual" type: string error_messages: description: The error messages for the Azure config. items: description: An error message string. type: string nullable: true type: array export_name: description: The name of the configured Azure Export. example: "dd-actual-export" type: string export_path: description: The path where the Azure Export is saved. example: "dd-export-path" type: string id: description: The ID of the Azure config. type: string months: deprecated: true description: The number of months the report has been backfilled. format: int32 maximum: 36 type: integer scope: description: The scope of your observed subscription. example: "/subscriptions/1234abcd-1234-abcd-1234-1234abcd1234" type: string status: description: The status of the Azure config. example: "active" type: string status_updated_at: description: The timestamp when the Azure config status was last updated. pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$ type: string storage_account: description: The name of the storage account where the Azure Export is saved. example: "dd-storage-account" type: string storage_container: description: The name of the storage container where the Azure Export is saved. example: "dd-storage-container" type: string updated_at: description: The timestamp when the Azure config was last updated. pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$ type: string required: - account_id - client_id - dataset_type - export_name - export_path - scope - status - storage_account - storage_container type: object AzureUCConfigPair: description: Azure config pair. properties: attributes: $ref: "#/components/schemas/AzureUCConfigPairAttributes" id: description: The ID of Cloud Cost Management account. type: string type: $ref: "#/components/schemas/AzureUCConfigPairType" required: - attributes - type type: object AzureUCConfigPairAttributes: description: Attributes for Azure config pair. properties: configs: description: An Azure config. items: $ref: "#/components/schemas/AzureUCConfig" type: array id: description: The ID of the Azure config pair. type: string required: - configs type: object AzureUCConfigPairType: default: azure_uc_configs description: Type of Azure config pair. enum: - azure_uc_configs example: azure_uc_configs type: string x-enum-varnames: - AZURE_UC_CONFIGS AzureUCConfigPairsResponse: description: Response of Azure config pair. properties: data: $ref: "#/components/schemas/AzureUCConfigPair" type: object AzureUCConfigPatchData: description: Azure config Patch data. properties: attributes: $ref: "#/components/schemas/AzureUCConfigPatchRequestAttributes" type: $ref: "#/components/schemas/AzureUCConfigPatchRequestType" required: - type type: object AzureUCConfigPatchRequest: description: Azure config Patch Request. properties: data: $ref: "#/components/schemas/AzureUCConfigPatchData" required: - data type: object AzureUCConfigPatchRequestAttributes: description: Attributes for Azure config Patch Request. properties: is_enabled: description: Whether or not the Cloud Cost Management account is enabled. example: true type: boolean required: - is_enabled type: object AzureUCConfigPatchRequestType: default: azure_uc_config_patch_request description: Type of Azure config Patch Request. enum: - azure_uc_config_patch_request example: azure_uc_config_patch_request type: string x-enum-varnames: - AZURE_UC_CONFIG_PATCH_REQUEST AzureUCConfigPostData: description: Azure config Post data. properties: attributes: $ref: "#/components/schemas/AzureUCConfigPostRequestAttributes" type: $ref: "#/components/schemas/AzureUCConfigPostRequestType" required: - type type: object AzureUCConfigPostRequest: description: Azure config Post Request. properties: data: $ref: "#/components/schemas/AzureUCConfigPostData" required: - data type: object AzureUCConfigPostRequestAttributes: description: Attributes for Azure config Post Request. properties: account_id: description: The tenant ID of the Azure account. example: "1234abcd-1234-abcd-1234-1234abcd1234" type: string actual_bill_config: $ref: "#/components/schemas/BillConfig" amortized_bill_config: $ref: "#/components/schemas/BillConfig" client_id: description: The client ID of the Azure account. example: "1234abcd-1234-abcd-1234-1234abcd1234" type: string scope: description: The scope of your observed subscription. example: "/subscriptions/1234abcd-1234-abcd-1234-1234abcd1234" type: string required: - account_id - actual_bill_config - amortized_bill_config - client_id - scope type: object AzureUCConfigPostRequestType: default: azure_uc_config_post_request description: Type of Azure config Post Request. enum: - azure_uc_config_post_request example: azure_uc_config_post_request type: string x-enum-varnames: - AZURE_UC_CONFIG_POST_REQUEST AzureUCConfigsResponse: description: List of Azure accounts with configs. properties: data: description: An Azure config pair. items: $ref: "#/components/schemas/AzureUCConfigPair" type: array required: - data type: object BatchDeleteRowsRequestArray: description: The request body for deleting multiple rows from a reference table. properties: data: description: >- List of row resources to delete from the reference table. The request payload can be up to 1 MiB. items: $ref: "#/components/schemas/TableRowResourceIdentifier" maxItems: 45589 type: array required: - data type: object BatchRowsQueryDataType: default: reference-tables-batch-rows-query description: Resource type identifier for batch queries of reference table rows. enum: - reference-tables-batch-rows-query example: reference-tables-batch-rows-query type: string x-enum-varnames: - REFERENCE_TABLES_BATCH_ROWS_QUERY BatchRowsQueryRequest: description: Request object for querying multiple rows from a reference table by their identifiers. properties: data: $ref: "#/components/schemas/BatchRowsQueryRequestData" type: object BatchRowsQueryRequestData: description: Data object for a batch rows query request. properties: attributes: $ref: "#/components/schemas/BatchRowsQueryRequestDataAttributes" type: $ref: "#/components/schemas/BatchRowsQueryDataType" required: - type type: object BatchRowsQueryRequestDataAttributes: description: Attributes for a batch rows query request. properties: row_ids: description: List of row identifiers to query from the reference table. example: - "row_id_1" - "row_id_2" items: description: A single row identifier. type: string type: array table_id: description: Unique identifier of the reference table to query. example: "00000000-0000-0000-0000-000000000000" type: string required: - row_ids - table_id type: object BatchRowsQueryResponse: description: Response object for a batch rows query against a reference table. example: data: id: 00000000-0000-0000-0000-000000000000 relationships: rows: data: - id: row_id_1 type: row - id: row_id_2 type: row type: reference-tables-batch-rows-query included: - attributes: values: ip_address: 102.130.113.9 id: row_id_1 type: row - attributes: values: ip_address: 102.130.113.10 id: row_id_2 type: row properties: data: $ref: "#/components/schemas/BatchRowsQueryResponseData" included: description: Full row resources matching the query, included alongside the relationship references in `data`. items: $ref: "#/components/schemas/TableRowResourceData" type: array type: object BatchRowsQueryResponseData: description: Data object for a batch rows query response. properties: id: description: Unique identifier of the batch query. type: string relationships: $ref: "#/components/schemas/BatchRowsQueryResponseDataRelationships" type: $ref: "#/components/schemas/BatchRowsQueryDataType" required: - type type: object BatchRowsQueryResponseDataRelationships: description: Relationships of the batch rows query response data. properties: rows: $ref: "#/components/schemas/BatchRowsQueryResponseDataRelationshipsRows" type: object BatchRowsQueryResponseDataRelationshipsRows: description: Relationship data containing the list of matching rows. properties: data: items: $ref: "#/components/schemas/TableRowResourceIdentifier" type: array type: object BatchUpsertRowsRequestArray: description: The request body for creating or updating multiple rows into a reference table. properties: data: description: >- List of row resources to create or update in the reference table. The request payload can be up to 1 MiB. items: $ref: "#/components/schemas/BatchUpsertRowsRequestData" maxItems: 20971 type: array required: - data type: object BatchUpsertRowsRequestData: description: Row resource containing a single row identifier and its column values. properties: attributes: $ref: "#/components/schemas/BatchUpsertRowsRequestDataAttributes" id: description: The primary key value that uniquely identifies the row to create or update. example: "primary_key_value" type: string type: $ref: "#/components/schemas/TableRowResourceDataType" required: - type - id type: object BatchUpsertRowsRequestDataAttributes: description: Attributes containing row data values for row creation or update operations. example: values: {} properties: values: additionalProperties: $ref: "#/components/schemas/BatchUpsertRowsRequestDataAttributesValue" description: >- Key-value pairs representing row data, where keys are schema field names and values match the corresponding column types. type: object required: - values type: object BatchUpsertRowsRequestDataAttributesValue: description: Types allowed for Reference Table row values. oneOf: - example: "row_name" type: string - example: 25 format: int32 maximum: 2147483647 type: integer BillConfig: description: Bill config. properties: export_name: description: The name of the configured Azure Export. example: "dd-actual-export" type: string export_path: description: The path where the Azure Export is saved. example: "dd-export-path" type: string storage_account: description: The name of the storage account where the Azure Export is saved. example: "dd-storage-account" type: string storage_container: description: The name of the storage container where the Azure Export is saved. example: "dd-storage-container" type: string required: - export_name - export_path - storage_account - storage_container type: object BillingDimensionsMappingBody: description: Billing dimensions mapping data. items: $ref: "#/components/schemas/BillingDimensionsMappingBodyItem" type: array BillingDimensionsMappingBodyItem: description: The mapping data for each billing dimension. properties: attributes: $ref: "#/components/schemas/BillingDimensionsMappingBodyItemAttributes" id: description: ID of the billing dimension. type: string type: $ref: "#/components/schemas/ActiveBillingDimensionsType" type: object BillingDimensionsMappingBodyItemAttributes: description: Mapping of billing dimensions to endpoint keys. properties: endpoints: description: "List of supported endpoints with their keys mapped to the billing_dimension." items: $ref: "#/components/schemas/BillingDimensionsMappingBodyItemAttributesEndpointsItems" type: array in_app_label: description: "Label used for the billing dimension in the Plan & Usage charts." example: APM Hosts type: string timestamp: description: "Month in ISO-8601 format, UTC, and precise to the second: `[YYYY-MM-DDThh:mm:ss]`." format: date-time type: string type: object BillingDimensionsMappingBodyItemAttributesEndpointsItems: description: An endpoint's keys mapped to the billing_dimension. properties: id: description: The URL for the endpoint. example: "api/v1/usage/billable-summary" type: string keys: description: The billing dimension. example: - "apm_host_top99p" - "apm_host_sum" items: description: A billing dimension key. example: apm_host_top99p type: string type: array status: $ref: "#/components/schemas/BillingDimensionsMappingBodyItemAttributesEndpointsItemsStatus" type: object BillingDimensionsMappingBodyItemAttributesEndpointsItemsStatus: description: Denotes whether mapping keys were available for this endpoint. enum: - OK - NOT_FOUND type: string x-enum-varnames: - OK - NOT_FOUND BillingDimensionsMappingResponse: description: Billing dimensions mapping response. properties: data: $ref: "#/components/schemas/BillingDimensionsMappingBody" type: object BlueprintAttributes: description: The attributes of a blueprint resource. properties: created_at: description: The timestamp when the blueprint was created. example: "" format: date-time type: string definition: $ref: "#/components/schemas/AppDefinitionType" description: description: A description of what the blueprint does. example: "" type: string embedded_datastore_blueprints: additionalProperties: {} description: Embedded datastore blueprints. type: object embedded_native_actions: description: Embedded native actions. items: $ref: "#/components/schemas/BlueprintNativeAction" type: array embedded_workflow_blueprints: additionalProperties: {} description: Embedded workflow blueprints. type: object integration_id: description: The integration ID associated with the blueprint. type: string mocked_outputs: additionalProperties: {} description: Mocked outputs for testing the blueprint. type: object name: description: The human-readable name of the blueprint. example: AWS Service Manager type: string slug: description: The unique slug identifier of the blueprint. example: aws-service-manager type: string tags: description: Tags associated with the blueprint. items: type: string type: array tile_background: description: The background style of the blueprint tile. type: string tile_icon_action_fqn: description: The fully qualified name of the action used as the tile icon. type: string updated_at: description: The timestamp when the blueprint was last updated. example: "" format: date-time type: string required: - slug - name - description - definition - created_at - updated_at type: object BlueprintData: description: A blueprint resource. properties: attributes: $ref: "#/components/schemas/BlueprintAttributes" id: description: The ID of the blueprint. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string type: $ref: "#/components/schemas/BlueprintDataType" required: - id - type - attributes type: object BlueprintDataType: description: The resource type for a blueprint. enum: - blueprint example: blueprint type: string x-enum-varnames: - BLUEPRINT BlueprintMetadataAttributes: description: The attributes of a blueprint metadata resource. properties: created_at: description: The timestamp when the blueprint was created. example: "" format: date-time type: string description: description: A description of what the blueprint does. example: "" type: string name: description: The human-readable name of the blueprint. example: AWS Service Manager type: string slug: description: The unique slug identifier of the blueprint. example: aws-service-manager type: string tags: description: Tags associated with the blueprint. items: type: string type: array tile_background: description: The background style of the blueprint tile. type: string tile_icon_action_fqn: description: The fully qualified name of the action used as the tile icon. type: string updated_at: description: The timestamp when the blueprint was last updated. example: "" format: date-time type: string required: - slug - name - description - created_at - updated_at type: object BlueprintMetadataData: description: A blueprint metadata resource. properties: attributes: $ref: "#/components/schemas/BlueprintMetadataAttributes" id: description: The ID of the blueprint. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string type: $ref: "#/components/schemas/BlueprintDataType" required: - id - type - attributes type: object BlueprintNativeAction: additionalProperties: {} description: An embedded native action in a blueprint. type: object BranchCoverageSummaryRequest: description: Request object for getting code coverage summary for a branch. properties: data: $ref: "#/components/schemas/BranchCoverageSummaryRequestData" required: - data type: object BranchCoverageSummaryRequestAttributes: description: Attributes for requesting code coverage summary for a branch. properties: branch: description: The branch name. example: prod minLength: 1 type: string repository_id: deprecated: true description: "Deprecated: use `repository_url` instead. The repository URL." example: github.com/datadog/shopist minLength: 1 type: string repository_url: description: The repository URL. Accepts a full URL with or without a scheme (for example, `https://github.com/org/repo` or `github.com/org/repo`). example: https://github.com/datadog/shopist minLength: 1 type: string required: - branch type: object BranchCoverageSummaryRequestData: description: Data object for branch summary request. properties: attributes: $ref: "#/components/schemas/BranchCoverageSummaryRequestAttributes" type: $ref: "#/components/schemas/BranchCoverageSummaryRequestType" required: - type - attributes type: object BranchCoverageSummaryRequestType: description: JSON:API type for branch coverage summary request. The value must always be `ci_app_coverage_branch_summary_request`. enum: - ci_app_coverage_branch_summary_request example: ci_app_coverage_branch_summary_request type: string x-enum-varnames: - CI_APP_COVERAGE_BRANCH_SUMMARY_REQUEST Budget: description: A budget. properties: attributes: $ref: "#/components/schemas/BudgetAttributes" id: description: The id of the budget. type: string type: description: The type of the object, must be `budget`. example: "" type: string required: - type type: object BudgetArray: description: An array of budgets. example: data: - attributes: created_at: 1741011342772 created_by: user1 end_month: 202502 metrics_query: aws.cost.amortized{service:ec2} by {service} name: my budget org_id: 123 start_month: 202501 total_amount: 1000 updated_at: 1741011342772 updated_by: user2 id: "00000000-0a0a-0a0a-aaa0-00000000000a" type: budget properties: data: description: The `BudgetArray` `data`. items: $ref: "#/components/schemas/Budget" type: array required: - data type: object BudgetAttributes: description: The attributes of a budget. properties: costs: $ref: "#/components/schemas/BudgetAttributesCosts" description: Aggregated cost data for the budget. Present only when `actual=true` or `forecast=true` is requested. costs_period_end: description: The end of the period used to compute cost data, in milliseconds since epoch. format: int64 type: integer costs_period_start: description: The start of the period used to compute cost data, in milliseconds since epoch. format: int64 type: integer costs_unit: $ref: "#/components/schemas/BudgetAttributesCostsUnit" description: The unit used for all cost values in the response. created_at: description: The timestamp when the budget was created. example: 1738258683590 format: int64 type: integer created_by: description: The id of the user that created the budget. example: 00000000-0a0a-0a0a-aaa0-00000000000a type: string end_month: description: The month when the budget ends. example: 202502 format: int64 type: integer entries: description: The list of monthly budget entries. items: $ref: "#/components/schemas/BudgetWithEntriesDataAttributesEntriesItems" type: array metrics_query: description: The cost query used to track against the budget. example: aws.cost.amortized{service:ec2} by {service} type: string name: description: The name of the budget. example: my budget type: string org_id: description: The id of the org the budget belongs to. example: 123 format: int64 type: integer start_month: description: The month when the budget starts. example: 202501 format: int64 type: integer tags: description: The tag keys used to group costs for the budget. example: - service items: type: string type: array total_amount: description: The sum of all budget entries' amounts. example: 1000 format: double type: number updated_at: description: The timestamp when the budget was last updated. example: 1738258683590 format: int64 type: integer updated_by: description: The id of the user that created the budget. example: 00000000-0a0a-0a0a-aaa0-00000000000a type: string type: object BudgetAttributesCosts: description: Aggregated cost data for the budget over the requested period. properties: actual: description: The total actual cost. Present only when `actual=true` is requested. format: double nullable: true type: number amount: description: The total budgeted amount over the requested period. format: double nullable: true type: number forecast: description: The total forecast cost, with any custom forecast overrides applied. Present only when `forecast=true` is requested. format: double nullable: true type: number ootb_forecast: description: The out-of-the-box ML forecast before custom overrides. Present only when `forecast=true` is requested. format: double nullable: true type: number type: object BudgetAttributesCostsUnit: description: The unit used for all cost values in the response. properties: family: description: The unit family (for example, `currency`). type: string id: description: The unique identifier for the unit. example: 42 format: int64 type: integer name: description: The full name of the unit. type: string plural: description: The plural form of the unit name. type: string scale_factor: description: The scale factor applied to raw cost values. format: double type: number short_name: description: The abbreviated unit name. type: string type: object BudgetValidationRequest: description: The request object for validating a budget configuration before creating or updating it. example: data: attributes: created_at: 1738258683590 created_by: 00000000-0a0a-0a0a-aaa0-00000000000a end_month: 202502 entries: - amount: 500 month: 202501 tag_filters: - tag_key: service tag_value: ec2 - amount: 500 month: 202502 tag_filters: - tag_key: service tag_value: ec2 metrics_query: aws.cost.amortized{service:ec2} by {service} name: my budget org_id: 123 start_month: 202501 total_amount: 1000 updated_at: 1738258683590 updated_by: 00000000-0a0a-0a0a-aaa0-00000000000a id: "1" type: budget properties: data: $ref: "#/components/schemas/BudgetValidationRequestData" type: object BudgetValidationRequestData: description: The data object for a budget validation request, containing the resource type, ID, and budget attributes to validate. properties: attributes: $ref: "#/components/schemas/BudgetWithEntriesDataAttributes" id: description: The unique identifier of the budget to validate. type: string type: $ref: "#/components/schemas/BudgetWithEntriesDataType" required: - type type: object BudgetValidationResponse: description: The response object for a budget validation request, containing the validation result data. example: data: attributes: errors: [] valid: true id: budget_validation type: budget_validation properties: data: $ref: "#/components/schemas/BudgetValidationResponseData" type: object BudgetValidationResponseData: description: The data object for a budget validation response, containing the resource type, ID, and validation attributes. properties: attributes: $ref: "#/components/schemas/BudgetValidationResponseDataAttributes" id: description: The unique identifier of the budget being validated. type: string type: $ref: "#/components/schemas/BudgetValidationResponseDataType" required: - type type: object BudgetValidationResponseDataAttributes: description: The attributes of a budget validation response, including any validation errors and the validity status. properties: errors: description: A list of validation error messages for the budget. items: description: A validation error message. type: string type: array valid: description: Whether the budget configuration is valid. type: boolean type: object BudgetValidationResponseDataType: default: budget_validation description: Budget validation resource type. enum: - budget_validation example: budget_validation type: string x-enum-varnames: - BUDGET_VALIDATION BudgetWithEntries: description: The definition of the `BudgetWithEntries` object. properties: data: $ref: "#/components/schemas/BudgetWithEntriesData" meta: $ref: "#/components/schemas/BudgetWithEntriesMeta" type: object BudgetWithEntriesData: description: A budget and all its entries. properties: attributes: $ref: "#/components/schemas/BudgetAttributes" id: description: The `BudgetWithEntriesData` `id`. example: 00000000-0a0a-0a0a-aaa0-00000000000a type: string type: description: The type of the object, must be `budget`. example: "" type: string type: object BudgetWithEntriesDataAttributes: description: The attributes of a budget including all its monthly entries. properties: created_at: description: The timestamp when the budget was created. format: int64 type: integer created_by: description: The ID of the user that created the budget. type: string end_month: description: The month when the budget ends, in YYYYMM format. format: int64 type: integer entries: description: The list of monthly budget entries. items: $ref: "#/components/schemas/BudgetWithEntriesDataAttributesEntriesItems" type: array metrics_query: description: The cost query used to track spending against the budget. type: string name: description: The name of the budget. type: string org_id: description: The ID of the organization the budget belongs to. format: int64 type: integer start_month: description: The month when the budget starts, in YYYYMM format. format: int64 type: integer total_amount: description: The total budget amount across all entries. format: double type: number updated_at: description: The timestamp when the budget was last updated. format: int64 type: integer updated_by: description: The ID of the user that last updated the budget. type: string type: object BudgetWithEntriesDataAttributesEntriesItems: description: A single monthly budget entry defining the allocated amount and optional tag filters for a specific month. properties: amount: description: The budgeted amount for this entry. format: double type: number costs: $ref: "#/components/schemas/BudgetWithEntriesDataAttributesEntriesItemsCosts" description: Cost data for this entry. Present only when `actual=true` or `forecast=true` is requested. month: description: The month this budget entry applies to, in YYYYMM format. format: int64 type: integer tag_filters: description: The list of tag filters that scope this budget entry to specific resources. items: $ref: "#/components/schemas/BudgetWithEntriesDataAttributesEntriesItemsTagFiltersItems" type: array type: object BudgetWithEntriesDataAttributesEntriesItemsCosts: description: Cost data for a single budget entry. properties: actual: description: The actual cost for this entry. Present only when `actual=true` is requested. format: double nullable: true type: number amount: description: The budgeted amount for this entry. format: double nullable: true type: number custom_forecast: description: |- The custom forecast override for this entry. `null` when `forecast=true` is requested but no custom forecast has been set for this entry's month. A numeric value, including `0`, indicates an explicit custom forecast override. Omitted when `forecast=false` or the feature is not available for the organization. format: double nullable: true type: number forecast: description: The final forecast for this entry, with any custom forecast override applied. Present only when `forecast=true` is requested. format: double nullable: true type: number ootb_forecast: description: The out-of-the-box ML forecast for this entry, before custom overrides. Present only when `forecast=true` is requested. format: double nullable: true type: number type: object BudgetWithEntriesDataAttributesEntriesItemsTagFiltersItems: description: A tag filter used to scope a budget entry to specific resource tags. properties: tag_key: description: The tag key to filter on. type: string tag_value: description: The tag value to filter on. type: string type: object BudgetWithEntriesDataType: default: budget description: Budget resource type. enum: - budget example: budget type: string x-enum-varnames: - BUDGET BudgetWithEntriesMeta: description: Additional information about errors encountered while retrieving budget cost data. properties: error: description: A user-facing explanation of why budget cost data could not be retrieved. example: "" type: string required: - error type: object BulkDeleteAppsDatastoreItemsRequest: description: Request to delete items from a datastore. properties: data: $ref: "#/components/schemas/BulkDeleteAppsDatastoreItemsRequestData" type: object BulkDeleteAppsDatastoreItemsRequestData: description: Data wrapper containing the data needed to delete items from a datastore. properties: attributes: $ref: "#/components/schemas/BulkDeleteAppsDatastoreItemsRequestDataAttributes" id: description: ID for the datastore of the items to delete. type: string type: $ref: "#/components/schemas/BulkDeleteAppsDatastoreItemsRequestDataType" required: - type type: object BulkDeleteAppsDatastoreItemsRequestDataAttributes: description: Attributes of request data to delete items from a datastore. properties: item_keys: description: List of primary keys identifying items to delete from datastore. Up to 100 items can be deleted in a single request. items: description: A primary key identifying a datastore item to delete. type: string maxItems: 100 type: array type: object BulkDeleteAppsDatastoreItemsRequestDataType: default: items description: Items resource type. enum: - items example: items type: string x-enum-varnames: - ITEMS BulkPutAppsDatastoreItemsRequest: description: Request to insert multiple items into a datastore in a single operation. properties: data: $ref: "#/components/schemas/BulkPutAppsDatastoreItemsRequestData" type: object BulkPutAppsDatastoreItemsRequestData: description: Data wrapper containing the items to insert and their configuration for the bulk insert operation. properties: attributes: $ref: "#/components/schemas/BulkPutAppsDatastoreItemsRequestDataAttributes" type: $ref: "#/components/schemas/DatastoreItemsDataType" required: - type type: object BulkPutAppsDatastoreItemsRequestDataAttributes: description: Configuration for bulk inserting multiple items into a datastore. properties: conflict_mode: $ref: "#/components/schemas/DatastoreItemConflictMode" values: $ref: "#/components/schemas/DatastoreItemValues" required: - values type: object CIAppAggregateBucketValue: description: A bucket value, can either be a timeseries or a single value. oneOf: - $ref: "#/components/schemas/CIAppAggregateBucketValueSingleString" - $ref: "#/components/schemas/CIAppAggregateBucketValueSingleNumber" - $ref: "#/components/schemas/CIAppAggregateBucketValueTimeseries" CIAppAggregateBucketValueSingleNumber: description: A single number value. format: double type: number CIAppAggregateBucketValueSingleString: description: A single string value. type: string CIAppAggregateBucketValueTimeseries: description: A timeseries array. items: $ref: "#/components/schemas/CIAppAggregateBucketValueTimeseriesPoint" type: array x-generate-alias-as-model: true CIAppAggregateBucketValueTimeseriesPoint: description: A timeseries point. properties: time: description: The time value for this point. example: "2020-06-08T11:55:00.123Z" format: date-time type: string value: description: The value for this point. example: 19 format: double type: number type: object CIAppAggregateSort: description: |- A sort rule. The `aggregation` field is required when `type` is `measure`. example: {"aggregation": "count", "order": "asc"} properties: aggregation: $ref: "#/components/schemas/CIAppAggregationFunction" metric: description: The metric to sort by (only used for `type=measure`). example: "@duration" type: string order: $ref: "#/components/schemas/CIAppSortOrder" type: $ref: "#/components/schemas/CIAppAggregateSortType" type: object CIAppAggregateSortType: default: "alphabetical" description: The type of sorting algorithm. enum: ["alphabetical", "measure"] type: string x-enum-varnames: ["ALPHABETICAL", "MEASURE"] CIAppAggregationFunction: description: An aggregation function. enum: ["count", "cardinality", "pc75", "pc90", "pc95", "pc98", "pc99", "sum", "min", "max", "avg", "median", "latest", "earliest", "most_frequent", "delta"] example: "pc90" type: string x-enum-varnames: ["COUNT", "CARDINALITY", "PERCENTILE_75", "PERCENTILE_90", "PERCENTILE_95", "PERCENTILE_98", "PERCENTILE_99", "SUM", "MIN", "MAX", "AVG", "MEDIAN", "LATEST", "EARLIEST", "MOST_FREQUENT", "DELTA"] CIAppCIError: description: Contains information of the CI error. nullable: true properties: domain: $ref: "#/components/schemas/CIAppCIErrorDomain" message: description: Error message. maxLength: 5000 nullable: true type: string stack: description: The stack trace of the reported errors. nullable: true type: string type: description: Short description of the error type. maxLength: 100 nullable: true type: string type: object CIAppCIErrorDomain: description: Error category used to differentiate between issues related to the developer or provider environments. enum: [provider, user, unknown] type: string x-enum-varnames: ["PROVIDER", "USER", "UNKNOWN"] CIAppCompute: description: A compute rule to compute metrics or timeseries. properties: aggregation: $ref: "#/components/schemas/CIAppAggregationFunction" interval: description: |- The time buckets' size (only used for type=timeseries) Defaults to a resolution of 150 points. example: "5m" type: string metric: description: The metric to use. example: "@duration" type: string type: $ref: "#/components/schemas/CIAppComputeType" required: - aggregation type: object CIAppComputeType: default: "total" description: The type of compute. enum: ["timeseries", "total"] type: string x-enum-varnames: ["TIMESERIES", "TOTAL"] CIAppComputes: additionalProperties: $ref: "#/components/schemas/CIAppAggregateBucketValue" description: A map of the metric name to value for regular compute, or a list of values for a timeseries. type: object CIAppCreatePipelineEventRequest: description: Request object. properties: data: $ref: "#/components/schemas/CIAppCreatePipelineEventRequestDataSingleOrArray" type: object CIAppCreatePipelineEventRequestAttributes: description: Attributes of the pipeline event to create. properties: env: description: The Datadog environment. type: string provider_name: description: The name of the CI provider. By default, this is "custom". type: string resource: $ref: "#/components/schemas/CIAppCreatePipelineEventRequestAttributesResource" service: description: If the CI provider is SaaS, use this to differentiate between instances. type: string required: - resource type: object CIAppCreatePipelineEventRequestAttributesResource: description: Details of the CI pipeline event. example: "Details TBD" oneOf: - $ref: "#/components/schemas/CIAppPipelineEventPipeline" - $ref: "#/components/schemas/CIAppPipelineEventStage" - $ref: "#/components/schemas/CIAppPipelineEventJob" - $ref: "#/components/schemas/CIAppPipelineEventStep" CIAppCreatePipelineEventRequestData: description: Data of the pipeline event to create. properties: attributes: $ref: "#/components/schemas/CIAppCreatePipelineEventRequestAttributes" type: $ref: "#/components/schemas/CIAppCreatePipelineEventRequestDataType" type: object CIAppCreatePipelineEventRequestDataArray: description: Array of pipeline events to create in batch. items: $ref: "#/components/schemas/CIAppCreatePipelineEventRequestData" type: array CIAppCreatePipelineEventRequestDataSingleOrArray: description: Data of the pipeline events to create. oneOf: - $ref: "#/components/schemas/CIAppCreatePipelineEventRequestData" - $ref: "#/components/schemas/CIAppCreatePipelineEventRequestDataArray" CIAppCreatePipelineEventRequestDataType: default: cipipeline_resource_request description: Type of the event. enum: ["cipipeline_resource_request"] example: "cipipeline_resource_request" type: string x-enum-varnames: ["CIPIPELINE_RESOURCE_REQUEST"] CIAppEventAttributes: description: JSON object containing all event attributes and their associated values. properties: attributes: additionalProperties: {} description: JSON object of attributes from CI Visibility test events. example: {"customAttribute": 123, "duration": 2345} type: object tags: $ref: "#/components/schemas/TagsEventAttribute" test_level: $ref: "#/components/schemas/CIAppTestLevel" type: object CIAppGitHubAccountAttributes: description: Attributes describing a GitHub account's CI Visibility opt-in status. properties: account: description: The GitHub account (organization or user) name. example: datadog type: string enabled: description: Whether CI Visibility is enabled at the account level. example: true type: boolean host: description: The GitHub host (`github.com` or a GitHub Enterprise Server (GHES) hostname) this account belongs to. example: github.com type: string repo_count: description: The number of repositories known for this account. example: 12 format: int64 type: integer repositories: description: The repositories belonging to this account, with their individual opt-in status. items: $ref: "#/components/schemas/CIAppGitHubAccountRepository" type: array type: object CIAppGitHubAccountData: description: Data object for a GitHub account. properties: attributes: $ref: "#/components/schemas/CIAppGitHubAccountAttributes" id: description: |- The account's unique identifier, in the form `/` (for example `github.com/datadog`). example: github.com/datadog type: string type: $ref: "#/components/schemas/CIAppGitHubAccountType" required: - id - type - attributes type: object CIAppGitHubAccountRepository: description: A GitHub repository within a GitHub account, and its CI Visibility opt-in status. properties: enabled: description: Whether CI Visibility is enabled for this repository. example: true type: boolean name: description: The repository name. example: shopist type: string type: object CIAppGitHubAccountResponse: description: Response object containing a single GitHub account's CI Visibility opt-in status. properties: data: $ref: "#/components/schemas/CIAppGitHubAccountData" required: - data type: object CIAppGitHubAccountType: description: |- JSON:API type for the GitHub account resource. The value must always be `ci_github_account`. enum: - ci_github_account example: ci_github_account type: string x-enum-varnames: - CI_GITHUB_ACCOUNT CIAppGitHubAccountUpdateRequest: description: Request object for updating a GitHub account's CI Visibility opt-in status. properties: data: $ref: "#/components/schemas/CIAppGitHubAccountUpdateRequestData" required: - data type: object CIAppGitHubAccountUpdateRequestAttributes: description: |- Attributes for updating a GitHub account's CI Visibility opt-in status. At least one of `enabled` or `repository.enabled` must be provided. properties: account: description: The GitHub account (organization or user) name to update, identified by name. example: datadog minLength: 1 type: string enabled: description: Whether to enable or disable CI Visibility at the account level. example: true type: boolean host: description: |- The GitHub host (`github.com` or a GHES hostname) the account belongs to. Required to disambiguate when the same account name exists on more than one host. example: github.com type: string repository: $ref: "#/components/schemas/CIAppGitHubAccountUpdateRequestRepository" required: - account type: object CIAppGitHubAccountUpdateRequestData: description: Data object for updating a GitHub account's CI Visibility opt-in status. properties: attributes: $ref: "#/components/schemas/CIAppGitHubAccountUpdateRequestAttributes" type: $ref: "#/components/schemas/CIAppGitHubAccountType" required: - type - attributes type: object CIAppGitHubAccountUpdateRequestRepository: description: Repository-level opt-in change to apply, identified by name. properties: enabled: description: Whether to enable or disable CI Visibility for this repository. example: true type: boolean name: description: The repository name to update. example: shopist minLength: 1 type: string required: - name - enabled type: object CIAppGitHubAccountsResponse: description: Response object containing a list of GitHub accounts and their CI Visibility opt-in status. properties: data: items: $ref: "#/components/schemas/CIAppGitHubAccountData" type: array required: - data type: object CIAppGitInfo: description: |- If pipelines are triggered due to actions to a Git repository, then all payloads must contain this. Note that either `tag` or `branch` has to be provided, but not both. nullable: true properties: author_email: description: The commit author email. example: author@example.com type: string author_name: description: The commit author name. example: John Doe nullable: true type: string author_time: description: The commit author timestamp in RFC3339 format. example: "2023-05-31T15:30:00Z" nullable: true type: string branch: description: The branch name (if a tag use the tag parameter). example: feature-1 nullable: true type: string commit_time: description: The commit timestamp in RFC3339 format. example: "2023-05-31T15:30:00Z" nullable: true type: string committer_email: description: The committer email. example: committer@example.com nullable: true type: string committer_name: description: The committer name. nullable: true type: string default_branch: description: The Git repository's default branch. example: main nullable: true type: string message: description: The commit message. example: Instrumenting tests with CI Visibility. nullable: true type: string repository_url: description: The URL of the repository. example: https://github.com/username/repository type: string sha: description: The git commit SHA. example: da39a3ee5e6b4b0d3255bfef95601890afd80709 pattern: "^[a-fA-F0-9]{40}$" type: string tag: description: The tag name (if a branch use the branch parameter). example: v1.0.0 nullable: true type: string required: - repository_url - sha - author_email type: object CIAppGroupByHistogram: description: |- Used to perform a histogram computation (only for measure facets). At most, 100 buckets are allowed, the number of buckets is `(max - min)/interval`. properties: interval: description: The bin size of the histogram buckets. example: 10 format: double type: number max: description: |- The maximum value for the measure used in the histogram (values greater than this one are filtered out). example: 100 format: double type: number min: description: |- The minimum value for the measure used in the histogram (values smaller than this one are filtered out). example: 50 format: double type: number required: - interval - min - max type: object CIAppGroupByMissing: description: The value to use for logs that don't have the facet used to group-by. oneOf: - $ref: "#/components/schemas/CIAppGroupByMissingString" - $ref: "#/components/schemas/CIAppGroupByMissingNumber" CIAppGroupByMissingNumber: description: The missing value to use if there is a number valued facet. format: double type: number CIAppGroupByMissingString: description: The missing value to use if there is a string valued facet. type: string CIAppGroupByTotal: default: false description: |- A resulting object to put the given computes in over all the matching records. oneOf: - $ref: "#/components/schemas/CIAppGroupByTotalBoolean" - $ref: "#/components/schemas/CIAppGroupByTotalString" - $ref: "#/components/schemas/CIAppGroupByTotalNumber" CIAppGroupByTotalBoolean: description: If set to true, creates an additional bucket labeled "$facet_total". type: boolean CIAppGroupByTotalNumber: description: A number to use as the key value for the total bucket. format: double type: number CIAppGroupByTotalString: description: A string to use as the key value for the total bucket. type: string CIAppHostInfo: description: Contains information of the host running the pipeline, stage, job, or step. nullable: true properties: hostname: description: FQDN of the host. example: www.example.com type: string labels: description: A list of labels used to select or identify the node. example: - ubuntu-18.04 - n2.large items: description: A label used to select or identify the node. type: string type: array name: description: Name for the host. type: string workspace: description: The path where the code is checked out. example: /home/workspace/code/my-repo type: string type: object CIAppPipelineEvent: description: Object description of a pipeline event after being processed and stored by Datadog. properties: attributes: $ref: "#/components/schemas/CIAppPipelineEventAttributes" id: description: Unique ID of the event. example: "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA" type: string type: $ref: "#/components/schemas/CIAppPipelineEventTypeName" type: object CIAppPipelineEventAttributes: description: JSON object containing all event attributes and their associated values. properties: attributes: additionalProperties: {} description: JSON object of attributes from CI Visibility pipeline events. example: {"customAttribute": 123, "duration": 2345} type: object ci_level: $ref: "#/components/schemas/CIAppPipelineLevel" tags: $ref: "#/components/schemas/TagsEventAttribute" type: object CIAppPipelineEventFinishedJob: description: Details of a finished CI job. properties: dependencies: description: A list of job IDs that this job depends on. example: ["f7e6a006-a029-46c3-b0cc-742c9d7d363b", "c8a69849-3c3b-4721-8b33-3e8ec2df1ebe"] items: description: A list of job IDs. type: string nullable: true type: array end: description: Time when the job run finished. The time format must be RFC3339. example: "2023-05-31T15:30:00Z" format: date-time type: string error: $ref: "#/components/schemas/CIAppCIError" git: $ref: "#/components/schemas/CIAppGitInfo" id: description: The UUID for the job. It has to be unique within each pipeline execution. example: c865bad4-de82-44b8-ade7-2c987528eb54 type: string level: $ref: "#/components/schemas/CIAppPipelineEventJobLevel" metrics: $ref: "#/components/schemas/CIAppPipelineEventMetrics" name: description: The name for the job. example: test type: string node: $ref: "#/components/schemas/CIAppHostInfo" parameters: $ref: "#/components/schemas/CIAppPipelineEventParameters" pipeline_name: description: The parent pipeline name. example: Build type: string pipeline_unique_id: description: The parent pipeline UUID. example: "76b572af-a078-42b2-a08a-cc28f98b944f" type: string queue_time: description: The queue time in milliseconds, if applicable. example: 1004 format: int64 minimum: 0 nullable: true type: integer stage_id: description: The parent stage UUID (if applicable). nullable: true type: string stage_name: description: The parent stage name (if applicable). nullable: true type: string start: description: |- Time when the job run instance started (it should not include any queue time). The time format must be RFC3339. example: "2023-05-31T15:30:00Z" format: date-time type: string status: $ref: "#/components/schemas/CIAppPipelineEventJobStatus" tags: $ref: "#/components/schemas/CIAppPipelineEventTags" url: description: The URL to look at the job in the CI provider UI. example: https://ci-platform.com/job/your-job-name/build/123 type: string required: - level - id - name - pipeline_unique_id - pipeline_name - start - end - status - url type: object CIAppPipelineEventFinishedPipeline: description: Details of a finished pipeline. properties: end: description: Time when the pipeline run finished. It cannot be older than 18 hours in the past from the current time. The time format must be RFC3339. example: "2023-05-31T15:30:00Z" format: date-time type: string error: $ref: "#/components/schemas/CIAppCIError" git: $ref: "#/components/schemas/CIAppGitInfo" is_manual: description: Whether or not the pipeline was triggered manually by the user. example: false nullable: true type: boolean is_resumed: description: Whether or not the pipeline was resumed after being blocked. example: false nullable: true type: boolean level: $ref: "#/components/schemas/CIAppPipelineEventPipelineLevel" metrics: $ref: "#/components/schemas/CIAppPipelineEventMetrics" name: description: Name of the pipeline. All pipeline runs for the builds should have the same name. example: Deploy to AWS type: string node: $ref: "#/components/schemas/CIAppHostInfo" parameters: $ref: "#/components/schemas/CIAppPipelineEventParameters" parent_pipeline: $ref: "#/components/schemas/CIAppPipelineEventParentPipeline" partial_retry: description: |- Whether or not the pipeline was a partial retry of a previous attempt. A partial retry is one which only runs a subset of the original jobs. example: false type: boolean pipeline_id: description: |- Any ID used in the provider to identify the pipeline run even if it is not unique across retries. If the `pipeline_id` is unique, then both `unique_id` and `pipeline_id` can be set to the same value. example: "#023" type: string previous_attempt: $ref: "#/components/schemas/CIAppPipelineEventPreviousPipeline" queue_time: description: The queue time in milliseconds, if applicable. example: 1004 format: int64 minimum: 0 nullable: true type: integer start: description: Time when the pipeline run started (it should not include any queue time). The time format must be RFC3339. example: "2023-05-31T15:30:00Z" format: date-time type: string status: $ref: "#/components/schemas/CIAppPipelineEventPipelineStatus" tags: $ref: "#/components/schemas/CIAppPipelineEventTags" unique_id: description: |- UUID of the pipeline run. The ID has to be unique across retries and pipelines, including partial retries. example: "3eacb6f3-ff04-4e10-8a9c-46e6d054024a" type: string url: description: The URL to look at the pipeline in the CI provider UI. example: https://my-ci-provider.example/pipelines/my-pipeline/run/1 type: string required: - level - unique_id - name - url - start - end - status - partial_retry type: object CIAppPipelineEventInProgressJob: description: Details of a running CI job. properties: dependencies: description: A list of job IDs that this job depends on. example: ["f7e6a006-a029-46c3-b0cc-742c9d7d363b", "c8a69849-3c3b-4721-8b33-3e8ec2df1ebe"] items: description: A list of job IDs. type: string nullable: true type: array error: $ref: "#/components/schemas/CIAppCIError" git: $ref: "#/components/schemas/CIAppGitInfo" id: description: The UUID for the job. It must match the ID of the corresponding finished job. example: c865bad4-de82-44b8-ade7-2c987528eb54 type: string level: $ref: "#/components/schemas/CIAppPipelineEventJobLevel" metrics: $ref: "#/components/schemas/CIAppPipelineEventMetrics" name: description: The name for the job. example: test type: string node: $ref: "#/components/schemas/CIAppHostInfo" parameters: $ref: "#/components/schemas/CIAppPipelineEventParameters" pipeline_name: description: The parent pipeline name. example: Build type: string pipeline_unique_id: description: The parent pipeline UUID. example: "76b572af-a078-42b2-a08a-cc28f98b944f" type: string queue_time: description: The queue time in milliseconds, if applicable. example: 1004 format: int64 minimum: 0 nullable: true type: integer stage_id: description: The parent stage UUID (if applicable). nullable: true type: string stage_name: description: The parent stage name (if applicable). nullable: true type: string start: description: |- Time when the job run instance started (it should not include any queue time). The time format must be RFC3339. example: "2023-05-31T15:30:00Z" format: date-time type: string status: $ref: "#/components/schemas/CIAppPipelineEventJobInProgressStatus" tags: $ref: "#/components/schemas/CIAppPipelineEventTags" url: description: The URL to look at the job in the CI provider UI. example: https://ci-platform.com/job/your-job-name/build/123 type: string required: - level - id - name - pipeline_unique_id - pipeline_name - start - status - url type: object CIAppPipelineEventInProgressPipeline: description: Details of a running pipeline. properties: error: $ref: "#/components/schemas/CIAppCIError" git: $ref: "#/components/schemas/CIAppGitInfo" is_manual: description: Whether or not the pipeline was triggered manually by the user. example: false nullable: true type: boolean is_resumed: description: Whether or not the pipeline was resumed after being blocked. example: false nullable: true type: boolean level: $ref: "#/components/schemas/CIAppPipelineEventPipelineLevel" metrics: $ref: "#/components/schemas/CIAppPipelineEventMetrics" name: description: Name of the pipeline. All pipeline runs for the builds should have the same name. example: Deploy to AWS type: string node: $ref: "#/components/schemas/CIAppHostInfo" parameters: $ref: "#/components/schemas/CIAppPipelineEventParameters" parent_pipeline: $ref: "#/components/schemas/CIAppPipelineEventParentPipeline" partial_retry: description: |- Whether or not the pipeline was a partial retry of a previous attempt. A partial retry is one which only runs a subset of the original jobs. example: false type: boolean pipeline_id: description: |- Any ID used in the provider to identify the pipeline run even if it is not unique across retries. If the `pipeline_id` is unique, then both `unique_id` and `pipeline_id` can be set to the same value. example: "#023" type: string previous_attempt: $ref: "#/components/schemas/CIAppPipelineEventPreviousPipeline" queue_time: description: The queue time in milliseconds, if applicable. example: 1004 format: int64 minimum: 0 nullable: true type: integer start: description: Time when the pipeline run started (it should not include any queue time). The time format must be RFC3339. example: "2023-05-31T15:30:00Z" format: date-time type: string status: $ref: "#/components/schemas/CIAppPipelineEventPipelineInProgressStatus" tags: $ref: "#/components/schemas/CIAppPipelineEventTags" unique_id: description: |- UUID of the pipeline run. The ID has to be the same as the finished pipeline. example: "3eacb6f3-ff04-4e10-8a9c-46e6d054024a" type: string url: description: The URL to look at the pipeline in the CI provider UI. example: https://my-ci-provider.example/pipelines/my-pipeline/run/1 type: string required: - level - unique_id - name - url - start - status - partial_retry type: object CIAppPipelineEventJob: description: Details of a CI job. oneOf: - $ref: "#/components/schemas/CIAppPipelineEventFinishedJob" - $ref: "#/components/schemas/CIAppPipelineEventInProgressJob" CIAppPipelineEventJobInProgressStatus: description: The in-progress status of the job. enum: ["running"] example: running type: string x-enum-varnames: ["RUNNING"] CIAppPipelineEventJobLevel: default: job description: Used to distinguish between pipelines, stages, jobs, and steps. enum: ["job"] example: "job" type: string x-enum-varnames: ["JOB"] CIAppPipelineEventJobStatus: description: The final status of the job. enum: ["success", "error", "canceled", "skipped"] example: success type: string x-enum-varnames: ["SUCCESS", "ERROR", "CANCELED", "SKIPPED"] CIAppPipelineEventMetrics: description: A list of user-defined metrics. The metrics must follow the `key:value` pattern and the value must be numeric. example: - bundle_size:370 - build_time:50021 items: description: Metrics in the form of `key:value`. The value needs to be numeric. type: string nullable: true type: array CIAppPipelineEventParameters: additionalProperties: type: string description: A map of key-value parameters or environment variables that were defined for the pipeline. example: LOG_LEVEL: debug nullable: true type: object CIAppPipelineEventParentPipeline: description: If the pipeline is triggered as child of another pipeline, this should contain the details of the parent pipeline. nullable: true properties: id: description: UUID of a pipeline. example: 93bfeb70-af47-424d-908a-948d3f08e37f type: string url: description: The URL to look at the pipeline in the CI provider UI. example: https://ci-platform.com/pipelines/123456789 type: string required: - id type: object CIAppPipelineEventPipeline: description: Details of the top level pipeline, build, or workflow of your CI. oneOf: - $ref: "#/components/schemas/CIAppPipelineEventFinishedPipeline" - $ref: "#/components/schemas/CIAppPipelineEventInProgressPipeline" CIAppPipelineEventPipelineInProgressStatus: description: The in progress status of the pipeline. enum: ["running"] example: running type: string x-enum-varnames: ["RUNNING"] CIAppPipelineEventPipelineLevel: default: pipeline description: Used to distinguish between pipelines, stages, jobs, and steps. enum: ["pipeline"] example: "pipeline" type: string x-enum-varnames: ["PIPELINE"] CIAppPipelineEventPipelineStatus: description: The final status of the pipeline. enum: ["success", "error", "canceled", "skipped", "blocked"] example: success type: string x-enum-varnames: ["SUCCESS", "ERROR", "CANCELED", "SKIPPED", "BLOCKED"] CIAppPipelineEventPreviousPipeline: description: If the pipeline is a retry, this should contain the details of the previous attempt. nullable: true properties: id: description: UUID of a pipeline. example: 93bfeb70-af47-424d-908a-948d3f08e37f type: string url: description: The URL to look at the pipeline in the CI provider UI. example: https://ci-platform.com/pipelines/123456789 type: string required: - id type: object CIAppPipelineEventStage: description: Details of a CI stage. properties: dependencies: description: A list of stage IDs that this stage depends on. example: ["f7e6a006-a029-46c3-b0cc-742c9d7d363b", "c8a69849-3c3b-4721-8b33-3e8ec2df1ebe"] items: description: A list of stage IDs. type: string nullable: true type: array end: description: Time when the stage run finished. The time format must be RFC3339. example: "2023-05-31T15:30:00Z" format: date-time type: string error: $ref: "#/components/schemas/CIAppCIError" git: $ref: "#/components/schemas/CIAppGitInfo" id: description: UUID for the stage. It has to be unique at least in the pipeline scope. example: 562bdbbb-7cab-48c8-851c-b24ca14628bf type: string level: $ref: "#/components/schemas/CIAppPipelineEventStageLevel" metrics: $ref: "#/components/schemas/CIAppPipelineEventMetrics" name: description: The name for the stage. example: build type: string node: $ref: "#/components/schemas/CIAppHostInfo" parameters: $ref: "#/components/schemas/CIAppPipelineEventParameters" pipeline_name: description: The parent pipeline name. example: Build type: string pipeline_unique_id: description: The parent pipeline UUID. example: "76b572af-a078-42b2-a08a-cc28f98b944f" type: string queue_time: description: The queue time in milliseconds, if applicable. example: 1004 format: int64 minimum: 0 nullable: true type: integer start: description: Time when the stage run started (it should not include any queue time). The time format must be RFC3339. example: "2023-05-31T15:30:00Z" format: date-time type: string status: $ref: "#/components/schemas/CIAppPipelineEventStageStatus" tags: $ref: "#/components/schemas/CIAppPipelineEventTags" required: - level - id - name - pipeline_unique_id - pipeline_name - start - end - status type: object CIAppPipelineEventStageLevel: default: stage description: Used to distinguish between pipelines, stages, jobs and steps. enum: ["stage"] example: "stage" type: string x-enum-varnames: ["STAGE"] CIAppPipelineEventStageStatus: description: The final status of the stage. enum: ["success", "error", "canceled", "skipped"] example: success type: string x-enum-varnames: ["SUCCESS", "ERROR", "CANCELED", "SKIPPED"] CIAppPipelineEventStep: description: Details of a CI step. properties: end: description: Time when the step run finished. The time format must be RFC3339. example: "2023-05-31T15:30:00Z" format: date-time type: string error: $ref: "#/components/schemas/CIAppCIError" git: $ref: "#/components/schemas/CIAppGitInfo" id: description: UUID for the step. It has to be unique within each pipeline execution. example: c2d517a8-4f3a-4b41-b4ae-69df0c864c79 type: string job_id: description: The parent job UUID (if applicable). nullable: true type: string job_name: description: The parent job name (if applicable). nullable: true type: string level: $ref: "#/components/schemas/CIAppPipelineEventStepLevel" metrics: $ref: "#/components/schemas/CIAppPipelineEventMetrics" name: description: The name for the step. example: test-server type: string node: $ref: "#/components/schemas/CIAppHostInfo" parameters: $ref: "#/components/schemas/CIAppPipelineEventParameters" pipeline_name: description: The parent pipeline name. example: Build type: string pipeline_unique_id: description: The parent pipeline UUID. example: "76b572af-a078-42b2-a08a-cc28f98b944f" type: string stage_id: description: The parent stage UUID (if applicable). nullable: true type: string stage_name: description: The parent stage name (if applicable). nullable: true type: string start: description: Time when the step run started. The time format must be RFC3339. example: "2023-05-31T15:30:00Z" format: date-time type: string status: $ref: "#/components/schemas/CIAppPipelineEventStepStatus" tags: $ref: "#/components/schemas/CIAppPipelineEventTags" url: description: The URL to look at the step in the CI provider UI. nullable: true type: string required: - level - id - name - pipeline_unique_id - pipeline_name - start - end - status type: object CIAppPipelineEventStepLevel: default: step description: Used to distinguish between pipelines, stages, jobs and steps. enum: ["step"] example: "step" type: string x-enum-varnames: ["STEP"] CIAppPipelineEventStepStatus: description: The final status of the step. enum: ["success", "error"] example: success type: string x-enum-varnames: ["SUCCESS", "ERROR"] CIAppPipelineEventTags: description: A list of user-defined tags. The tags must follow the `key:value` pattern. example: - team:backend - type:deployment items: description: Tags in the form of `key:value`. type: string nullable: true type: array CIAppPipelineEventTypeName: description: Type of the event. enum: ["cipipeline"] example: "cipipeline" type: string x-enum-varnames: ["CIPIPELINE"] CIAppPipelineEventsRequest: description: The request for a pipelines search. properties: filter: $ref: "#/components/schemas/CIAppPipelinesQueryFilter" options: $ref: "#/components/schemas/CIAppQueryOptions" page: $ref: "#/components/schemas/CIAppQueryPageOptions" sort: $ref: "#/components/schemas/CIAppSort" type: object CIAppPipelineEventsResponse: description: Response object with all pipeline events matching the request and pagination information. properties: data: description: Array of events matching the request. items: $ref: "#/components/schemas/CIAppPipelineEvent" type: array links: $ref: "#/components/schemas/CIAppResponseLinks" meta: $ref: "#/components/schemas/CIAppResponseMetadataWithPagination" type: object CIAppPipelineLevel: description: Pipeline execution level. enum: [pipeline, stage, job, step, custom] example: pipeline type: string x-enum-varnames: ["PIPELINE", "STAGE", "JOB", "STEP", "CUSTOM"] CIAppPipelinesAggregateRequest: description: The object sent with the request to retrieve aggregation buckets of pipeline events from your organization. properties: compute: description: The list of metrics or timeseries to compute for the retrieved buckets. items: $ref: "#/components/schemas/CIAppCompute" type: array filter: $ref: "#/components/schemas/CIAppPipelinesQueryFilter" group_by: description: The rules for the group-by. items: $ref: "#/components/schemas/CIAppPipelinesGroupBy" type: array options: $ref: "#/components/schemas/CIAppQueryOptions" type: object CIAppPipelinesAggregationBucketsResponse: description: The query results. properties: buckets: description: The list of matching buckets, one item per bucket. items: $ref: "#/components/schemas/CIAppPipelinesBucketResponse" type: array type: object CIAppPipelinesAnalyticsAggregateResponse: description: The response object for the pipeline events aggregate API endpoint. properties: data: $ref: "#/components/schemas/CIAppPipelinesAggregationBucketsResponse" links: $ref: "#/components/schemas/CIAppResponseLinks" meta: $ref: "#/components/schemas/CIAppResponseMetadata" type: object CIAppPipelinesBucketResponse: description: Bucket values. properties: by: additionalProperties: description: The values for each group-by. description: The key-value pairs for each group-by. example: {"@ci.provider.name": "gitlab", "@ci.status": "success"} type: object computes: $ref: "#/components/schemas/CIAppComputes" type: object CIAppPipelinesGroupBy: description: A group-by rule. properties: facet: description: The name of the facet to use (required). example: "@ci.status" type: string histogram: $ref: "#/components/schemas/CIAppGroupByHistogram" limit: default: 10 description: The maximum buckets to return for this group-by. format: int64 type: integer missing: $ref: "#/components/schemas/CIAppGroupByMissing" sort: $ref: "#/components/schemas/CIAppAggregateSort" total: $ref: "#/components/schemas/CIAppGroupByTotal" required: - facet type: object CIAppPipelinesQueryFilter: description: The search and filter query settings. properties: from: default: "now-15m" description: The minimum time for the requested events; supports date, math, and regular timestamps (in milliseconds). example: "now-15m" type: string query: default: "*" description: The search query following the CI Visibility Explorer search syntax. example: "@ci.provider.name:github AND @ci.status:error" type: string to: default: "now" description: The maximum time for the requested events, supports date, math, and regular timestamps (in milliseconds). example: "now" type: string type: object CIAppQueryOptions: description: |- Global query options that are used during the query. Only supply timezone or time offset, not both. Otherwise, the query fails. properties: time_offset: description: The time offset (in seconds) to apply to the query. format: int64 type: integer timezone: default: "UTC" description: |- The timezone can be specified as GMT, UTC, an offset from UTC (like UTC+1), or as a Timezone Database identifier (like America/New_York). example: "GMT" type: string type: object CIAppQueryPageOptions: description: Paging attributes for listing events. properties: cursor: description: |- List following results with a cursor provided in the previous query. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string limit: default: 10 description: Maximum number of events in the response. example: 25 format: int32 maximum: 1000 type: integer type: object CIAppResponseLinks: description: Links attributes. properties: next: description: |- Link for the next set of results. The request can also be made using the POST endpoint. example: "https://app.datadoghq.com/api/v2/ci/tests/events?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string type: object CIAppResponseMetadata: description: The metadata associated with a request. properties: elapsed: description: The time elapsed in milliseconds. example: 132 format: int64 type: integer request_id: description: The identifier of the request. example: "MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR" type: string status: $ref: "#/components/schemas/CIAppResponseStatus" warnings: description: |- A list of warnings (non-fatal errors) encountered. Partial results may return if warnings are present in the response. items: $ref: "#/components/schemas/CIAppWarning" type: array type: object CIAppResponseMetadataWithPagination: description: The metadata associated with a request. properties: elapsed: description: The time elapsed in milliseconds. example: 132 format: int64 type: integer page: $ref: "#/components/schemas/CIAppResponsePage" request_id: description: The identifier of the request. example: "MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR" type: string status: $ref: "#/components/schemas/CIAppResponseStatus" warnings: description: |- A list of warnings (non-fatal errors) encountered. Partial results may return if warnings are present in the response. items: $ref: "#/components/schemas/CIAppWarning" type: array type: object CIAppResponsePage: description: Paging attributes. properties: after: description: |- The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of `page[cursor]`. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string type: object CIAppResponseStatus: description: The status of the response. enum: ["done", "timeout"] example: "done" type: string x-enum-varnames: ["DONE", "TIMEOUT"] CIAppSort: description: Sort parameters when querying events. enum: - timestamp - -timestamp type: string x-enum-varnames: - TIMESTAMP_ASCENDING - TIMESTAMP_DESCENDING CIAppSortOrder: description: The order to use, ascending or descending. enum: - "asc" - "desc" example: "asc" type: string x-enum-varnames: - "ASCENDING" - "DESCENDING" CIAppTestEvent: description: Object description of test event after being processed and stored by Datadog. properties: attributes: $ref: "#/components/schemas/CIAppEventAttributes" id: description: Unique ID of the event. example: "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA" type: string type: $ref: "#/components/schemas/CIAppTestEventTypeName" type: object CIAppTestEventTypeName: description: Type of the event. enum: ["citest"] example: "citest" type: string x-enum-varnames: ["CITEST"] CIAppTestEventsRequest: description: The request for a tests search. properties: filter: $ref: "#/components/schemas/CIAppTestsQueryFilter" options: $ref: "#/components/schemas/CIAppQueryOptions" page: $ref: "#/components/schemas/CIAppQueryPageOptions" sort: $ref: "#/components/schemas/CIAppSort" type: object CIAppTestEventsResponse: description: Response object with all test events matching the request and pagination information. properties: data: description: Array of events matching the request. items: $ref: "#/components/schemas/CIAppTestEvent" type: array links: $ref: "#/components/schemas/CIAppResponseLinks" meta: $ref: "#/components/schemas/CIAppResponseMetadataWithPagination" type: object CIAppTestLevel: description: Test run level. enum: [session, module, suite, test] example: test type: string x-enum-varnames: ["SESSION", "MODULE", "SUITE", "TEST"] CIAppTestsAggregateRequest: description: The object sent with the request to retrieve aggregation buckets of test events from your organization. properties: compute: description: The list of metrics or timeseries to compute for the retrieved buckets. items: $ref: "#/components/schemas/CIAppCompute" type: array filter: $ref: "#/components/schemas/CIAppTestsQueryFilter" group_by: description: The rules for the group-by. items: $ref: "#/components/schemas/CIAppTestsGroupBy" type: array options: $ref: "#/components/schemas/CIAppQueryOptions" type: object CIAppTestsAggregationBucketsResponse: description: The query results. properties: buckets: description: The list of matching buckets, one item per bucket. items: $ref: "#/components/schemas/CIAppTestsBucketResponse" type: array type: object CIAppTestsAnalyticsAggregateResponse: description: The response object for the test events aggregate API endpoint. properties: data: $ref: "#/components/schemas/CIAppTestsAggregationBucketsResponse" links: $ref: "#/components/schemas/CIAppResponseLinks" meta: $ref: "#/components/schemas/CIAppResponseMetadataWithPagination" type: object CIAppTestsBucketResponse: description: Bucket values. properties: by: additionalProperties: description: The values for each group-by. description: The key-value pairs for each group-by. example: {"@test.service": "web-ui-tests", "@test.status": "skip"} type: object computes: $ref: "#/components/schemas/CIAppComputes" type: object CIAppTestsGroupBy: description: A group-by rule. properties: facet: description: The name of the facet to use (required). example: "@test.service" type: string histogram: $ref: "#/components/schemas/CIAppGroupByHistogram" limit: default: 10 description: The maximum buckets to return for this group-by. format: int64 type: integer missing: $ref: "#/components/schemas/CIAppGroupByMissing" sort: $ref: "#/components/schemas/CIAppAggregateSort" total: $ref: "#/components/schemas/CIAppGroupByTotal" required: - facet type: object CIAppTestsQueryFilter: description: The search and filter query settings. properties: from: default: "now-15m" description: The minimum time for the requested events; supports date, math, and regular timestamps (in milliseconds). example: "now-15m" type: string query: default: "*" description: The search query following the CI Visibility Explorer search syntax. example: "@test.service:web-ui-tests AND @test.status:fail" type: string to: default: "now" description: The maximum time for the requested events, supports date, math, and regular timestamps (in milliseconds). example: "now" type: string type: object CIAppWarning: description: A warning message indicating something that went wrong with the query. properties: code: description: A unique code for this type of warning. example: "unknown_index" type: string detail: description: A detailed explanation of this specific warning. example: "indexes: foo, bar" type: string title: description: A short human-readable summary of the warning. example: "One or several indexes are missing or invalid, results hold data from the other indexes" type: string type: object CILogAttributeValue: description: A flat additional log attribute. Objects and arrays are not accepted. oneOf: - nullable: true type: string - format: double type: number - type: boolean CILogContentEncoding: description: HTTP header used to compress the JSON request body. enum: - identity - gzip type: string x-enum-varnames: - IDENTITY - GZIP CILogErrors: description: Authentication and authorization errors returned by the CI logs intake API. properties: errors: description: Error messages. example: - Forbidden - API key is missing or invalid items: type: string type: array type: object CILogIntakeError: description: A request error returned by the CI logs intake API. properties: detail: description: Error details. example: Malformed payload type: string status: description: HTTP status code. example: "400" type: string title: description: Error title. example: Bad Request type: string type: object CILogIntakeErrors: description: Request errors returned by the CI logs intake API. properties: errors: description: Request errors. items: $ref: "#/components/schemas/CILogIntakeError" type: array type: object CILogItem: additionalProperties: $ref: "#/components/schemas/CILogAttributeValue" description: A CI job log line. maxProperties: 137 properties: ddtags: description: Comma-separated `key:value` tags. A job can have up to 256 tags, including repeated keys. example: runner:linux,architecture:amd64 type: string job_id: description: The job event's `resource.id`, sent through the CI Visibility pipeline API. example: job-456 minLength: 1 type: string line_number: description: The line number in the job log. Use 0 or 1 for the first line. example: 812 format: int64 maximum: 9223372036854775807 minimum: 0 type: integer message: description: The non-empty log line message. example: Running go test ./... minLength: 1 type: string pipeline_unique_id: description: |- The `resource.unique_id` of the pipeline event, which must also match the job event's `resource.pipeline_unique_id`. example: 3eacb6f3-ff04-4e10-8a9c-46e6d054024a minLength: 1 type: string provider_name: description: |- The provider name sent with the pipeline event. It defaults to `custom` when omitted and, when provided, must be non-empty and cannot contain a comma. example: example-provider minLength: 1 pattern: "^[^,]+$" type: string section_name: description: |- The provider-defined section containing this log line, used to display collapsible groups of lines in the CI job log view. example: tests type: string status: description: |- The status of this log line. Any string is accepted. Datadog maps non-empty values to a standard log status. See [status mapping](https://docs.datadoghq.com/logs/log_configuration/processors/log_status_remapper/). example: warn type: string timestamp: description: |- The log line time in RFC 3339 format with an explicit timezone. If omitted, the intake time is used. It can be at most 18 hours in the past or 12 hours in the future. format: date-time type: string required: - message - pipeline_unique_id - job_id type: object CILogRequest: description: |- A batch of up to 1,000 CI job log lines. Use a one-item array to send one log line. items: $ref: "#/components/schemas/CILogItem" maxItems: 1000 type: array CSMAgentsMetadata: description: Metadata related to the paginated response. properties: page_index: description: The index of the current page in the paginated results. example: 0 format: int64 type: integer page_size: description: The number of items per page in the paginated results. example: 10 format: int64 type: integer total_filtered: description: Total number of items that match the filter criteria. example: 128697 format: int64 type: integer type: object CSMAgentsType: default: datadog_agent description: The type of the resource. The value should always be `datadog_agent`. enum: - datadog_agent example: datadog_agent type: string x-enum-varnames: ["DATADOG_AGENT"] CVSS: description: Vulnerability severity. properties: score: description: Vulnerability severity score. example: 4.5 format: double type: number severity: $ref: "#/components/schemas/VulnerabilitySeverity" vector: description: Vulnerability CVSS vector. example: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" type: string required: - score - severity - vector type: object CalculatedField: description: Calculated field. properties: expression: description: Expression. example: "@request_end_timestamp - @request_start_timestamp" type: string name: description: Field name. example: response_time type: string required: - name - expression type: object CampaignResponse: description: Response containing campaign data. properties: data: $ref: "#/components/schemas/CampaignResponseData" required: - data type: object CampaignResponseAttributes: description: Campaign attributes. properties: created_at: description: Creation time of the campaign. example: "2023-12-15T10:30:00Z" format: date-time type: string description: description: The description of the campaign. example: Campaign to improve security posture for Q1 2024. type: string due_date: description: The due date of the campaign. example: "2024-03-31T23:59:59Z" format: date-time type: string entity_scope: description: Entity scope query to filter entities for this campaign. example: kind:service AND team:platform type: string guidance: description: Guidance for the campaign. example: Please ensure all services pass the security requirements. type: string key: description: The unique key for the campaign. example: q1-security-2024 type: string modified_at: description: Time of last campaign modification. example: "2024-01-05T14:20:00Z" format: date-time type: string name: description: The name of the campaign. example: Q1 Security Campaign type: string owner: description: The UUID of the campaign owner. example: 550e8400-e29b-41d4-a716-446655440000 type: string start_date: description: The start date of the campaign. example: "2024-01-01T00:00:00Z" format: date-time type: string status: description: The status of the campaign. example: in_progress type: string required: - key - name - owner - status - start_date - created_at - modified_at type: object CampaignResponseData: description: Campaign data. properties: attributes: $ref: "#/components/schemas/CampaignResponseAttributes" id: description: The unique ID of the campaign. example: c10ODp0VCrrIpXmz type: string type: $ref: "#/components/schemas/CampaignType" required: - id - type - attributes type: object CampaignStatus: description: The status of the campaign. enum: - in_progress - not_started - completed example: in_progress type: string x-enum-varnames: - IN_PROGRESS - NOT_STARTED - COMPLETED CampaignType: description: The JSON:API type for campaigns. enum: - campaign example: campaign type: string x-enum-varnames: - CAMPAIGN CancelDataDeletionResponseBody: description: The response from the cancel data deletion request endpoint. properties: data: $ref: "#/components/schemas/DataDeletionResponseItem" meta: $ref: "#/components/schemas/DataDeletionResponseMeta" type: object Case: description: A work item properties: attributes: $ref: "#/components/schemas/CaseAttributes" id: description: Work item's identifier example: "aeadc05e-98a8-11ec-ac2c-da7ad0900001" type: string relationships: $ref: "#/components/schemas/CaseRelationships" type: $ref: "#/components/schemas/CaseResourceType" required: - id - type - attributes type: object Case3rdPartyTicketStatus: default: IN_PROGRESS description: Work item status enum: - IN_PROGRESS - COMPLETED - FAILED example: COMPLETED readOnly: true type: string x-enum-varnames: - IN_PROGRESS - COMPLETED - FAILED CaseAggregateGroup: description: A single group within the aggregation results, containing the group key and its associated count values. properties: group: description: "The value of the field being grouped on (for example, `OPEN` when grouping by status)." example: "OPEN" type: string value: description: The count of work items in this group. example: - 42.0 items: format: double type: number type: array required: - group - value type: object CaseAggregateGroupBy: description: Configuration for grouping aggregated results by one or more work item fields. properties: groups: description: Fields to group by. example: - "status" items: type: string type: array limit: description: Maximum number of groups to return. example: 14 format: int32 maximum: 1000 type: integer required: - groups - limit type: object CaseAggregateRequest: description: Request payload for aggregating work item counts with grouping. Use this to get faceted breakdowns of work items (for example, count of work items grouped by priority and status). properties: data: $ref: "#/components/schemas/CaseAggregateRequestData" required: - data type: object CaseAggregateRequestAttributes: description: Attributes for the aggregation request, including the search query and grouping configuration. properties: group_by: $ref: "#/components/schemas/CaseAggregateGroupBy" query_filter: description: "A search query to filter which work items are included in the aggregation. Uses the same syntax as the Work Management search bar." example: "service:case-api" type: string required: - query_filter - group_by type: object CaseAggregateRequestData: description: Data object wrapping the aggregation query type and attributes. properties: attributes: $ref: "#/components/schemas/CaseAggregateRequestAttributes" type: $ref: "#/components/schemas/CaseAggregateResourceType" required: - attributes - type type: object CaseAggregateResourceType: description: JSON:API resource type for work item aggregation requests. enum: - aggregate example: aggregate type: string x-enum-varnames: - AGGREGATE CaseAggregateResponse: description: Response containing aggregated work item counts grouped by the requested fields. properties: data: $ref: "#/components/schemas/CaseAggregateResponseData" required: - data type: object CaseAggregateResponseAttributes: description: Attributes of the aggregation result, including the total count across all groups and the per-group breakdowns. properties: groups: description: Aggregated groups. items: $ref: "#/components/schemas/CaseAggregateGroup" type: array total: description: Total count of aggregated work items. example: 100.0 format: double type: number required: - total - groups type: object CaseAggregateResponseData: description: Data object containing the aggregation results, including total count and per-group breakdowns. properties: attributes: $ref: "#/components/schemas/CaseAggregateResponseAttributes" id: description: Aggregate response identifier. example: "agg-result-001" type: string type: description: Aggregate resource type. example: "aggregate" type: string required: - type - id - attributes type: object CaseAssign: description: Work item assign properties: attributes: $ref: "#/components/schemas/CaseAssignAttributes" type: $ref: "#/components/schemas/CaseResourceType" required: - attributes - type type: object CaseAssignAttributes: description: Work item assign attributes properties: assignee_id: description: Assignee's UUID example: "f98a5a5b-e0ff-45d4-b2f5-afe6e74de504" type: string required: - assignee_id type: object CaseAssignRequest: description: Work item assign request properties: data: $ref: "#/components/schemas/CaseAssign" required: - data type: object CaseAttributes: description: Work item resource attributes properties: archived_at: description: Timestamp of when the work item was archived format: date-time nullable: true readOnly: true type: string attributes: $ref: "#/components/schemas/CaseObjectAttributes" closed_at: description: Timestamp of when the work item was closed format: date-time nullable: true readOnly: true type: string created_at: description: Timestamp of when the work item was created format: date-time readOnly: true type: string custom_attributes: additionalProperties: $ref: "#/components/schemas/CustomAttributeValue" description: Work item custom attributes type: object description: description: Description type: string jira_issue: $ref: "#/components/schemas/JiraIssue" key: description: Key example: "CASEM-4523" type: string modified_at: description: Timestamp of when the work item was last modified format: date-time nullable: true readOnly: true type: string priority: $ref: "#/components/schemas/CasePriority" service_now_ticket: $ref: "#/components/schemas/ServiceNowTicket" status: $ref: "#/components/schemas/CaseStatus" status_group: $ref: "#/components/schemas/CaseStatusGroup" status_name: $ref: "#/components/schemas/CaseStatusName" title: description: Title example: "Memory leak investigation on API" type: string type: $ref: "#/components/schemas/CaseType" type_id: description: Work item type UUID example: "3b010bde-09ce-4449-b745-71dd5f861963" type: string type: object CaseAutomationRuleResourceType: default: rule description: JSON:API resource type for work item automation rules. enum: - rule example: rule type: string x-enum-varnames: - RULE CaseAutomationRuleState: description: Whether the automation rule is active. Enabled rules trigger on matching work item events; disabled rules are inactive but preserve their configuration. enum: - ENABLED - DISABLED example: ENABLED type: string x-enum-varnames: - ENABLED - DISABLED CaseBulkActionType: description: "The type of action to apply in a bulk update. Allowed values are `priority`, `status`, `assign`, `unassign`, `archive`, `unarchive`, `jira`, `servicenow`, `linear`, `update_project`." enum: - priority - status - assign - unassign - archive - unarchive - jira - servicenow - linear - update_project example: priority type: string x-enum-varnames: - PRIORITY - STATUS - ASSIGN - UNASSIGN - ARCHIVE - UNARCHIVE - JIRA - SERVICENOW - LINEAR - UPDATE_PROJECT CaseBulkResourceType: description: JSON:API resource type for bulk work item operations. enum: - bulk example: bulk type: string x-enum-varnames: - BULK CaseBulkUpdateRequest: description: Request payload for applying a single action (such as changing priority, status, or assignment) to multiple work items at once. properties: data: $ref: "#/components/schemas/CaseBulkUpdateRequestData" required: - data type: object CaseBulkUpdateRequestAttributes: description: Attributes for the bulk update, specifying which work items to update and the action to apply. properties: case_ids: description: An array of work item identifiers to apply the bulk action to. example: - "case-id-1" - "case-id-2" items: type: string type: array payload: additionalProperties: type: string description: A key-value map of action-specific parameters. The required keys depend on the action type (for example, `priority` for the priority action, `assignee_id` for assign). example: priority: "P1" type: object type: $ref: "#/components/schemas/CaseBulkActionType" required: - case_ids - type type: object CaseBulkUpdateRequestData: description: Data object wrapping the bulk update type and attributes. properties: attributes: $ref: "#/components/schemas/CaseBulkUpdateRequestAttributes" type: $ref: "#/components/schemas/CaseBulkResourceType" required: - attributes - type type: object CaseComment: description: Work item comment properties: attributes: $ref: "#/components/schemas/CaseCommentAttributes" type: $ref: "#/components/schemas/CaseResourceType" required: - attributes - type type: object CaseCommentAttributes: description: Work item comment attributes properties: comment: description: The `CaseCommentAttributes` `message`. example: "This is my comment !" type: string required: - comment type: object CaseCommentRequest: description: Work item comment request properties: data: $ref: "#/components/schemas/CaseComment" required: - data type: object CaseCountGroup: description: A facet group containing counts broken down by the distinct values of a work item field (for example, status or priority). properties: group: description: "The name of the field being grouped on (for example, `status` or `priority`)." example: "status" type: string group_values: description: Values within this group. items: $ref: "#/components/schemas/CaseCountGroupValue" type: array required: - group - group_values type: object CaseCountGroupValue: description: A single value within a count group, representing the number of work items with that specific field value. properties: count: description: Count of work items for this value. example: 42 format: int64 type: integer value: description: The group value. example: "OPEN" type: string required: - value - count type: object CaseCountResponse: description: Response containing the total number of work items matching a query, optionally grouped by specified fields. properties: data: $ref: "#/components/schemas/CaseCountResponseData" required: - data type: object CaseCountResponseAttributes: description: Attributes for the count response, including the total count and optional facet breakdowns. properties: groups: description: List of facet groups, one per field specified in `group_bys`. items: $ref: "#/components/schemas/CaseCountGroup" type: array required: - groups type: object CaseCountResponseData: description: Data object containing the count results, including per-field group breakdowns. properties: attributes: $ref: "#/components/schemas/CaseCountResponseAttributes" id: description: Count response identifier. example: "count-result-001" type: string type: description: Count resource type. example: "count" type: string required: - type - id - attributes type: object CaseCreate: description: Work item creation data properties: attributes: $ref: "#/components/schemas/CaseCreateAttributes" relationships: $ref: "#/components/schemas/CaseCreateRelationships" type: $ref: "#/components/schemas/CaseResourceType" required: - attributes - type type: object CaseCreateAttributes: description: Work item creation attributes properties: custom_attributes: additionalProperties: $ref: "#/components/schemas/CustomAttributeValue" description: Work item custom attributes type: object description: description: Description type: string priority: $ref: "#/components/schemas/CasePriority" status_name: $ref: "#/components/schemas/CaseStatusName" title: description: Title example: "Security breach investigation" type: string type_id: description: Work item type UUID example: "3b010bde-09ce-4449-b745-71dd5f861963" type: string required: - title - type_id type: object CaseCreateRelationships: description: Relationships formed with the work item on creation properties: assignee: $ref: "#/components/schemas/NullableUserRelationship" project: $ref: "#/components/schemas/ProjectRelationship" required: - project type: object CaseCreateRequest: description: Work item create request properties: data: $ref: "#/components/schemas/CaseCreate" required: - data type: object CaseDataType: default: cases description: Cases resource type. enum: - cases example: cases type: string x-enum-varnames: - CASES CaseEmpty: description: Work item empty request data properties: type: $ref: "#/components/schemas/CaseResourceType" required: - type type: object CaseEmptyRequest: description: Work item empty request properties: data: $ref: "#/components/schemas/CaseEmpty" required: - data type: object CaseInsight: description: A reference to an external Datadog resource that provides investigative context for a work item, such as a security signal, monitor alert, error tracking issue, or incident. properties: ref: description: "The URL path or deep link to the insight resource within Datadog (for example, `/monitors/12345?q=total`)." example: "/monitors/12345?q=total" type: string resource_id: description: The unique identifier of the referenced Datadog resource (for example, a monitor ID, incident ID, or signal ID). example: "12345" type: string type: $ref: "#/components/schemas/CaseInsightType" required: - type - ref - resource_id type: object CaseInsightType: description: The type of Datadog resource linked to the work item as contextual evidence. Each type corresponds to a different Datadog product signal (for example, a security finding, a monitor alert, or an incident). enum: - SECURITY_SIGNAL - MONITOR - EVENT_CORRELATION - ERROR_TRACKING - CLOUD_COST_RECOMMENDATION - INCIDENT - SENSITIVE_DATA_SCANNER_ISSUE - EVENT - WATCHDOG_STORY - WIDGET - SECURITY_FINDING - INSIGHT_SCORECARD_CAMPAIGN - RESOURCE_POLICY - APM_RECOMMENDATION - SCM_URL - PROFILING_DOWNSIZING_EXPERIMENT example: SECURITY_SIGNAL type: string x-enum-varnames: - SECURITY_SIGNAL - MONITOR - EVENT_CORRELATION - ERROR_TRACKING - CLOUD_COST_RECOMMENDATION - INCIDENT - SENSITIVE_DATA_SCANNER_ISSUE - EVENT - WATCHDOG_STORY - WIDGET - SECURITY_FINDING - INSIGHT_SCORECARD_CAMPAIGN - RESOURCE_POLICY - APM_RECOMMENDATION - SCM_URL - PROFILING_DOWNSIZING_EXPERIMENT CaseInsightsAttributes: description: Attributes for adding or removing insights from a work item. properties: insights: description: Array of insights to add to or remove from a work item. items: $ref: "#/components/schemas/CaseInsight" maxItems: 100 minItems: 1 type: array required: - insights type: object CaseInsightsData: description: Data object containing the insights to add or remove. properties: attributes: $ref: "#/components/schemas/CaseInsightsAttributes" type: $ref: "#/components/schemas/CaseResourceType" required: - type - attributes type: object CaseInsightsItems: description: An insight of the case. properties: ref: description: Reference of the insight. example: "/security/appsec/vm/library/vulnerability/dfa027f7c037b2f77159adc027fecb56?detection=static" type: string resource_id: description: Unique identifier of the resource. For example, the unique identifier of a security finding. example: "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==" type: string type: description: Type of the resource. For example, the type of a security finding is "SECURITY_FINDING". example: "SECURITY_FINDING" type: string type: object CaseInsightsRequest: description: Request payload for adding or removing work item insights. properties: data: $ref: "#/components/schemas/CaseInsightsData" required: - data type: object CaseInvestigationNotebookCreateData: description: Case investigation notebook creation data. properties: type: $ref: "#/components/schemas/CaseInvestigationNotebookResourceType" required: - type type: object CaseInvestigationNotebookCreateRequest: description: Case investigation notebook creation request. properties: data: $ref: "#/components/schemas/CaseInvestigationNotebookCreateData" required: - data type: object CaseInvestigationNotebookResourceType: description: Case investigation notebook resource type. enum: - notebook example: notebook type: string x-enum-varnames: - NOTEBOOK CaseLink: description: "A directional link representing a relationship between two entities. At least one entity must be a work item." properties: attributes: $ref: "#/components/schemas/CaseLinkAttributes" id: description: "The work item link identifier." example: "804cd682-55f6-4541-ab00-b608b282ea7d" type: string type: $ref: "#/components/schemas/CaseLinkResourceType" required: - id - type - attributes type: object CaseLinkAttributes: description: "Attributes describing a directional relationship between two entities (work items, incidents, or pages)." properties: child_entity_id: description: "The UUID of the child (target) entity in the relationship." example: "4417921d-0866-4a38-822c-6f2a0f65f77d" type: string child_entity_type: description: "The type of the child entity. Allowed values: `CASE`, `INCIDENT`, `PAGE`, `AGENT_CONVERSATION`." example: "CASE" type: string parent_entity_id: description: "The UUID of the parent (source) entity in the relationship." example: "bf0cbac6-4c16-4cfb-b6bf-ca5e0ec37a4f" type: string parent_entity_type: description: "The type of the parent entity. Allowed values: `CASE`, `INCIDENT`, `PAGE`, `AGENT_CONVERSATION`." example: "CASE" type: string relationship: description: "The type of directional relationship. Allowed values: `RELATES_TO` (bidirectional association), `CAUSES` (parent causes child), `BLOCKS` (parent blocks child), `DUPLICATES` (parent duplicates child), `PARENT_OF` (hierarchical), `SUCCESSOR_OF` (sequence), `ESCALATES_TO` (priority escalation)." example: "BLOCKS" type: string required: - relationship - parent_entity_id - parent_entity_type - child_entity_id - child_entity_type type: object CaseLinkCreate: description: "Data object for creating a work item link." properties: attributes: $ref: "#/components/schemas/CaseLinkAttributes" type: $ref: "#/components/schemas/CaseLinkResourceType" required: - type - attributes type: object CaseLinkCreateRequest: description: "Request payload for creating a link between two entities." properties: data: $ref: "#/components/schemas/CaseLinkCreate" required: - data type: object CaseLinkResourceType: description: "JSON:API resource type for work item links." enum: - link example: link type: string x-enum-varnames: - LINK CaseLinkResponse: description: "Response containing a single work item link." properties: data: $ref: "#/components/schemas/CaseLink" required: - data type: object CaseLinksResponse: description: "Response containing a list of work item links." properties: data: description: "A list of work item links." items: $ref: "#/components/schemas/CaseLink" type: array required: - data type: object CaseManagementProject: description: Case management project. properties: data: $ref: "#/components/schemas/CaseManagementProjectData" required: - data type: object CaseManagementProjectData: description: Data object representing a case management project. properties: id: description: Unique identifier of the case management project. example: "aeadc05e-98a8-11ec-ac2c-da7ad0900001" type: string type: $ref: "#/components/schemas/CaseManagementProjectDataType" required: - type - id type: object CaseManagementProjectDataType: default: projects description: Projects resource type. enum: - projects example: projects type: string x-enum-varnames: - PROJECTS CaseNotificationRule: description: A notification rule for Work Management properties: attributes: $ref: "#/components/schemas/CaseNotificationRuleAttributes" id: description: The notification rule's identifier example: "aeadc05e-98a8-11ec-ac2c-da7ad0900001" type: string type: $ref: "#/components/schemas/CaseNotificationRuleResourceType" required: - id - type - attributes type: object CaseNotificationRuleAttributes: description: Notification rule attributes properties: is_enabled: description: Whether the notification rule is enabled type: boolean query: description: Query to filter work items for this notification rule type: string recipients: description: List of notification recipients items: $ref: "#/components/schemas/CaseNotificationRuleRecipient" type: array triggers: description: List of triggers for this notification rule items: $ref: "#/components/schemas/CaseNotificationRuleTrigger" type: array type: object CaseNotificationRuleCreate: description: Notification rule create properties: attributes: $ref: "#/components/schemas/CaseNotificationRuleCreateAttributes" type: $ref: "#/components/schemas/CaseNotificationRuleResourceType" required: - attributes - type type: object CaseNotificationRuleCreateAttributes: description: Notification rule creation attributes properties: is_enabled: default: true description: Whether the notification rule is enabled type: boolean query: description: Query to filter work items for this notification rule type: string recipients: description: List of notification recipients items: $ref: "#/components/schemas/CaseNotificationRuleRecipient" type: array triggers: description: List of triggers for this notification rule items: $ref: "#/components/schemas/CaseNotificationRuleTrigger" type: array required: - recipients - triggers type: object CaseNotificationRuleCreateRequest: description: Notification rule create request properties: data: $ref: "#/components/schemas/CaseNotificationRuleCreate" required: - data type: object CaseNotificationRuleRecipient: description: Notification rule recipient properties: data: $ref: "#/components/schemas/CaseNotificationRuleRecipientData" type: description: Type of recipient (SLACK_CHANNEL, EMAIL, HTTP, PAGERDUTY_SERVICE, MS_TEAMS_CHANNEL) example: EMAIL type: string type: object CaseNotificationRuleRecipientData: description: Recipient data properties: channel: description: Slack channel name type: string channel_id: description: Slack channel ID type: string channel_name: description: Microsoft Teams channel name type: string connector_name: description: Microsoft Teams connector name type: string email: description: Email address type: string name: description: HTTP webhook name type: string service_name: description: PagerDuty service name type: string team_id: description: Microsoft Teams team ID type: string team_name: description: Microsoft Teams team name type: string tenant_id: description: Microsoft Teams tenant ID type: string tenant_name: description: Microsoft Teams tenant name type: string workspace: description: Slack workspace name type: string workspace_id: description: Slack workspace ID type: string type: object CaseNotificationRuleResourceType: default: notification_rule description: Notification rule resource type enum: - notification_rule example: notification_rule type: string x-enum-varnames: - NOTIFICATION_RULE CaseNotificationRuleResponse: description: Notification rule response properties: data: $ref: "#/components/schemas/CaseNotificationRule" type: object CaseNotificationRuleTrigger: description: Notification rule trigger properties: data: $ref: "#/components/schemas/CaseNotificationRuleTriggerData" type: description: Type of trigger (CASE_CREATED, STATUS_TRANSITIONED, ATTRIBUTE_VALUE_CHANGED, EVENT_CORRELATION_SIGNAL_CORRELATED) example: CASE_CREATED type: string type: object CaseNotificationRuleTriggerData: description: Trigger data properties: change_type: description: Change type (added, removed, changed) type: string field: description: Field name for attribute value changed trigger type: string from_status: description: Status ID to transition from type: string from_status_name: description: Status name to transition from type: string to_status: description: Status ID to transition to type: string to_status_name: description: Status name to transition to type: string type: object CaseNotificationRuleUpdate: description: Notification rule update properties: attributes: $ref: "#/components/schemas/CaseNotificationRuleAttributes" type: $ref: "#/components/schemas/CaseNotificationRuleResourceType" required: - type type: object CaseNotificationRuleUpdateRequest: description: Notification rule update request properties: data: $ref: "#/components/schemas/CaseNotificationRuleUpdate" required: - data type: object CaseNotificationRulesResponse: description: Response with notification rules properties: data: description: Notification rules data items: $ref: "#/components/schemas/CaseNotificationRule" type: array type: object CaseObjectAttributes: additionalProperties: items: description: An attribute value. type: string type: array description: Key-value pairs of work item attributes. Each key maps to an array of string values, used for flexible metadata such as labels or tags. type: object CasePriority: default: NOT_DEFINED description: Work item priority enum: - NOT_DEFINED - P1 - P2 - P3 - P4 - P5 example: NOT_DEFINED type: string x-enum-varnames: - NOT_DEFINED - P1 - P2 - P3 - P4 - P5 CaseRelationships: description: Resources related to a work item properties: assignee: $ref: "#/components/schemas/NullableUserRelationship" created_by: $ref: "#/components/schemas/NullableUserRelationship" modified_by: $ref: "#/components/schemas/NullableUserRelationship" project: $ref: "#/components/schemas/ProjectRelationship" type: object CaseResourceType: default: case description: JSON:API resource type for work items. enum: - case example: case type: string x-enum-varnames: - CASE CaseResponse: description: Work item response properties: data: $ref: "#/components/schemas/Case" type: object CaseSortableField: description: Work item field that can be sorted on enum: - created_at - priority - status example: created_at type: string x-enum-varnames: - CREATED_AT - PRIORITY - STATUS CaseStatus: deprecated: true description: Deprecated way of representing the work item status, which only supports OPEN, IN_PROGRESS, and CLOSED statuses. Use `status_name` instead. enum: - OPEN - IN_PROGRESS - CLOSED example: OPEN type: string x-enum-varnames: - OPEN - IN_PROGRESS - CLOSED CaseStatusGroup: description: Status group of the work item. enum: - SG_OPEN - SG_IN_PROGRESS - SG_CLOSED example: SG_OPEN type: string x-enum-varnames: - SG_OPEN - SG_IN_PROGRESS - SG_CLOSED CaseStatusName: description: Status of the work item. Must be one of the existing statuses for the work item's type. example: "Open" type: string CaseTrigger: description: "Trigger a workflow from a Case. For automatic triggering a handle must be configured and the workflow must be published." properties: rateLimit: $ref: "#/components/schemas/TriggerRateLimit" type: object CaseTriggerWrapper: description: "Schema for a Case-based trigger." properties: caseTrigger: $ref: "#/components/schemas/CaseTrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - caseTrigger type: object CaseType: deprecated: true description: Work item type enum: - STANDARD example: STANDARD type: string x-enum-varnames: - STANDARD CaseTypeCreate: description: Data object for creating a work item type. properties: attributes: $ref: "#/components/schemas/CaseTypeResourceAttributes" type: $ref: "#/components/schemas/CaseTypeResourceType" required: - attributes - type type: object CaseTypeCreateRequest: description: Request payload for creating a work item type. properties: data: $ref: "#/components/schemas/CaseTypeCreate" required: - data type: object CaseTypeResource: description: A work item type that defines a classification category for work items. Each work item type can have its own custom attributes, statuses, and automation rules. properties: attributes: $ref: "#/components/schemas/CaseTypeResourceAttributes" id: description: Work item type's identifier example: "aeadc05e-98a8-11ec-ac2c-da7ad0900001" type: string type: $ref: "#/components/schemas/CaseTypeResourceType" type: object CaseTypeResourceAttributes: description: "Attributes of a work item type, which define a classification category for work items. Organizations use work item types to model different workflows (for example, Security Incident, Bug Report, Change Request)." properties: deleted_at: description: Timestamp when the work item type was marked as deleted. A null value indicates the work item type is active. format: date-time nullable: true readOnly: true type: string description: description: A detailed description explaining when this work item type should be used. example: "Investigations done in case management" type: string emoji: description: An emoji icon representing the work item type in the UI. example: "🕵🏻‍♂️" type: string name: description: The display name of the work item type, shown in the Work Management UI when creating or viewing work items. example: "Investigation" type: string required: - name type: object CaseTypeResourceType: default: case_type description: JSON:API resource type for work item types. enum: - case_type example: case_type type: string x-enum-varnames: - CASE_TYPE CaseTypeResponse: description: Response containing a single work item type. properties: data: $ref: "#/components/schemas/CaseTypeResource" type: object CaseTypeUpdate: description: Data object for updating a work item type. properties: attributes: $ref: "#/components/schemas/CaseTypeResourceAttributes" type: $ref: "#/components/schemas/CaseTypeResourceType" required: - type type: object CaseTypeUpdateRequest: description: Request payload for updating a work item type. properties: data: $ref: "#/components/schemas/CaseTypeUpdate" required: - data type: object CaseTypesResponse: description: Response containing a list of work item types. properties: data: description: List of work item types items: $ref: "#/components/schemas/CaseTypeResource" type: array type: object CaseUpdateAttributes: description: Work item update attributes properties: attributes: $ref: "#/components/schemas/CaseUpdateAttributesAttributes" type: $ref: "#/components/schemas/CaseResourceType" required: - attributes - type type: object CaseUpdateAttributesAttributes: description: Work item update attributes. properties: attributes: $ref: "#/components/schemas/CaseObjectAttributes" required: - attributes type: object CaseUpdateAttributesRequest: description: Work item update attributes request properties: data: $ref: "#/components/schemas/CaseUpdateAttributes" required: - data type: object CaseUpdateComment: description: Data object for updating a work item comment. properties: attributes: $ref: "#/components/schemas/CaseUpdateCommentAttributes" type: $ref: "#/components/schemas/CaseResourceType" required: - type - attributes type: object CaseUpdateCommentAttributes: description: Attributes for updating a comment. properties: comment: description: The updated comment message. example: "Updated comment text" type: string required: - comment type: object CaseUpdateCommentRequest: description: Request payload for updating a comment on a work item timeline. properties: data: $ref: "#/components/schemas/CaseUpdateComment" required: - data type: object CaseUpdateCustomAttribute: description: Work item update custom attribute properties: attributes: $ref: "#/components/schemas/CustomAttributeValue" type: $ref: "#/components/schemas/CaseResourceType" required: - attributes - type type: object CaseUpdateCustomAttributeRequest: description: Work item update custom attribute request properties: data: $ref: "#/components/schemas/CaseUpdateCustomAttribute" required: - data type: object CaseUpdateDescription: description: Work item update description properties: attributes: $ref: "#/components/schemas/CaseUpdateDescriptionAttributes" type: $ref: "#/components/schemas/CaseResourceType" required: - attributes - type type: object CaseUpdateDescriptionAttributes: description: Work item update description attributes properties: description: description: Work item new description example: "Seeing some weird memory increase... We shouldn't ignore this" type: string required: - description type: object CaseUpdateDescriptionRequest: description: Work item update description request properties: data: $ref: "#/components/schemas/CaseUpdateDescription" required: - data type: object CaseUpdateDueDate: description: Data object for updating a work item's due date. properties: attributes: $ref: "#/components/schemas/CaseUpdateDueDateAttributes" type: $ref: "#/components/schemas/CaseResourceType" required: - attributes - type type: object CaseUpdateDueDateAttributes: description: Attributes for setting or clearing a work item's due date. properties: due_date: description: "The target resolution date for the work item, in `YYYY-MM-DD` format. Set to `null` to clear the due date." example: "2026-12-31" type: string required: - due_date type: object CaseUpdateDueDateRequest: description: Request payload for updating a work item's due date. properties: data: $ref: "#/components/schemas/CaseUpdateDueDate" required: - data type: object CaseUpdatePriority: description: Work item priority status properties: attributes: $ref: "#/components/schemas/CaseUpdatePriorityAttributes" type: $ref: "#/components/schemas/CaseResourceType" required: - attributes - type type: object CaseUpdatePriorityAttributes: description: Work item update priority attributes properties: priority: $ref: "#/components/schemas/CasePriority" required: - priority type: object CaseUpdatePriorityRequest: description: Work item update priority request properties: data: $ref: "#/components/schemas/CaseUpdatePriority" required: - data type: object CaseUpdateResolvedReason: description: Data object for updating a work item's resolved reason. properties: attributes: $ref: "#/components/schemas/CaseUpdateResolvedReasonAttributes" type: $ref: "#/components/schemas/CaseResourceType" required: - attributes - type type: object CaseUpdateResolvedReasonAttributes: description: Attributes for setting the resolution reason on a security work item. properties: security_resolved_reason: description: "The reason the security work item was resolved (for example, `FALSE_POSITIVE`, `TRUE_POSITIVE`, `BENIGN_POSITIVE`)." example: "FALSE_POSITIVE" type: string required: - security_resolved_reason type: object CaseUpdateResolvedReasonRequest: description: Request payload for updating the resolution reason on a closed security work item. properties: data: $ref: "#/components/schemas/CaseUpdateResolvedReason" required: - data type: object CaseUpdateStatus: description: Work item update status properties: attributes: $ref: "#/components/schemas/CaseUpdateStatusAttributes" type: $ref: "#/components/schemas/CaseResourceType" required: - attributes - type type: object CaseUpdateStatusAttributes: description: Work item update status attributes properties: status: $ref: "#/components/schemas/CaseStatus" deprecated: true status_name: $ref: "#/components/schemas/CaseStatusName" type: object CaseUpdateStatusRequest: description: Work item update status request properties: data: $ref: "#/components/schemas/CaseUpdateStatus" required: - data type: object CaseUpdateTitle: description: Work item update title properties: attributes: $ref: "#/components/schemas/CaseUpdateTitleAttributes" type: $ref: "#/components/schemas/CaseResourceType" required: - attributes - type type: object CaseUpdateTitleAttributes: description: Work item update title attributes properties: title: description: Work item new title example: "Memory leak investigation on API" type: string required: - title type: object CaseUpdateTitleRequest: description: Work item update title request properties: data: $ref: "#/components/schemas/CaseUpdateTitle" required: - data type: object CaseView: description: A saved work item view that provides a filtered, reusable list of work items matching a specific query. Views act as persistent dashboards for monitoring work item subsets. properties: attributes: $ref: "#/components/schemas/CaseViewAttributes" id: description: The view's identifier. example: a1b2c3d4-e5f6-7890-abcd-ef1234567890 type: string relationships: $ref: "#/components/schemas/CaseViewRelationships" type: $ref: "#/components/schemas/CaseViewResourceType" required: - id - type - attributes type: object CaseViewAttributes: description: Attributes of a work item view, including the filter query and optional notification rule. properties: created_at: description: Timestamp when the view was created. example: "2024-01-01T00:00:00.000Z" format: date-time readOnly: true type: string modified_at: description: Timestamp when the view was last modified. format: date-time readOnly: true type: string name: description: A human-readable name for the view, displayed in the Work Management UI. example: Open bugs type: string np_rule_id: description: The identifier of a notification rule linked to this view. When set, users subscribed to the view receive alerts for matching work items. type: string query: description: "The search query that determines which work items appear in this view. Uses the same syntax as the Work Management search bar (for example, `status:open priority:P1`)." example: "status:open type:bug" type: string required: - name - query - created_at type: object CaseViewCreate: description: Data object for creating a work item view. properties: attributes: $ref: "#/components/schemas/CaseViewCreateAttributes" type: $ref: "#/components/schemas/CaseViewResourceType" required: - type - attributes type: object CaseViewCreateAttributes: description: Attributes required to create a work item view. properties: name: description: The name of the view. example: Open bugs type: string np_rule_id: description: The identifier of a notification rule linked to this view. When set, users subscribed to the view receive alerts for matching work items. type: string project_id: description: The UUID of the project this view belongs to. Views are scoped to a single project. example: e555e290-ed65-49bd-ae18-8acbfcf18db7 type: string query: description: The query used to filter work items in this view. example: "status:open type:bug" type: string required: - name - query - project_id type: object CaseViewCreateRequest: description: Request payload for creating a work item view. properties: data: $ref: "#/components/schemas/CaseViewCreate" required: - data type: object CaseViewRelationships: description: Related resources for the work item view, including the creator, last modifier, and associated project. properties: created_by: $ref: "#/components/schemas/NullableUserRelationship" modified_by: $ref: "#/components/schemas/NullableUserRelationship" project: $ref: "#/components/schemas/ProjectRelationship" type: object CaseViewResourceType: default: view description: "JSON:API resource type for work item views." enum: - view example: view type: string x-enum-varnames: - VIEW CaseViewResponse: description: Response containing a single work item view. properties: data: $ref: "#/components/schemas/CaseView" required: - data type: object CaseViewUpdate: description: Data object for updating a work item view. properties: attributes: $ref: "#/components/schemas/CaseViewUpdateAttributes" type: $ref: "#/components/schemas/CaseViewResourceType" required: - type type: object CaseViewUpdateAttributes: description: Attributes that can be updated on a work item view. All fields are optional; only provided fields are changed. properties: name: description: The name of the view. type: string np_rule_id: description: The identifier of a notification rule linked to this view. When set, users subscribed to the view receive alerts for matching work items. type: string query: description: The query used to filter work items in this view. type: string type: object CaseViewUpdateRequest: description: Request payload for updating a work item view. properties: data: $ref: "#/components/schemas/CaseViewUpdate" required: - data type: object CaseViewsResponse: description: Response containing a list of work item views. properties: data: description: A list of work item views. items: $ref: "#/components/schemas/CaseView" type: array required: - data type: object CaseWatcher: description: Represents a user who is subscribed to notifications for a work item. Watchers receive updates when the work item's status, priority, assignee, or comments change. properties: id: description: The primary identifier of the work item watcher. example: "8146583c-0b5f-11ec-abf8-da7ad0900001" type: string relationships: $ref: "#/components/schemas/CaseWatcherRelationships" type: $ref: "#/components/schemas/CaseWatcherResourceType" required: - id - type - relationships type: object CaseWatcherRelationships: description: Relationships for a work item watcher, linking to the underlying user resource. properties: user: $ref: "#/components/schemas/CaseWatcherUserRelationship" required: - user type: object CaseWatcherResourceType: default: watcher description: JSON:API resource type for work item watchers. enum: - watcher example: watcher type: string x-enum-varnames: - WATCHER CaseWatcherUserRelationship: description: The user relationship for a work item watcher. properties: data: $ref: "#/components/schemas/UserRelationshipData" required: - data type: object CaseWatchersResponse: description: Response containing the list of users watching a work item. properties: data: description: List of work item watchers. items: $ref: "#/components/schemas/CaseWatcher" type: array required: - data type: object CasesResponse: description: Response with work items properties: data: description: Work items response data items: $ref: "#/components/schemas/Case" type: array meta: $ref: "#/components/schemas/CasesResponseMeta" type: object CasesResponseMeta: description: Work items response metadata properties: page: $ref: "#/components/schemas/CasesResponseMetaPagination" type: object CasesResponseMetaPagination: description: Pagination metadata properties: current: description: Current page number format: int64 type: integer size: description: Number of work items in current page format: int64 type: integer total: description: Total number of pages format: int64 type: integer type: object ChangeEventAttributes: description: Change event attributes. properties: aggregation_key: $ref: "#/components/schemas/V2EventAggregationKey" author: $ref: "#/components/schemas/ChangeEventAttributesAuthor" change_metadata: description: JSON object of change metadata. example: dd: team: "datadog_team" user_email: "datadog@datadog.com" user_id: "datadog_user_id" user_name: "datadog_username" type: object changed_resource: $ref: "#/components/schemas/ChangeEventAttributesChangedResource" evt: $ref: "#/components/schemas/EventSystemAttributes" impacted_resources: description: A list of resources impacted by this change. example: [{"name": "service-name", "type": "service"}] items: $ref: "#/components/schemas/ChangeEventAttributesImpactedResourcesItem" type: array new_value: description: The new state of the changed resource. example: enabled: true percentage: "50%" rule: datacenter: "devcycle.us1.prod" type: object prev_value: description: The previous state of the changed resource. example: enabled: true percentage: "10%" rule: datacenter: "devcycle.us1.prod" type: object service: $ref: "#/components/schemas/V2EventService" timestamp: $ref: "#/components/schemas/V2EventTimestamp" title: $ref: "#/components/schemas/V2EventTitle" type: object ChangeEventAttributesAuthor: description: The entity that made the change. properties: name: description: The name of the user or system that made the change. example: "example@datadog.com" type: string type: $ref: "#/components/schemas/ChangeEventAttributesAuthorType" type: object ChangeEventAttributesAuthorType: description: The type of the author. enum: - user - system - api - automation example: "user" type: string x-enum-varnames: - USER - SYSTEM - API - AUTOMATION ChangeEventAttributesChangedResource: description: A uniquely identified resource. properties: name: description: The name of the changed resource. type: string type: $ref: "#/components/schemas/ChangeEventAttributesChangedResourceType" type: object ChangeEventAttributesChangedResourceType: description: The type of the changed resource. enum: - feature_flag - configuration example: "feature_flag" type: string x-enum-varnames: - FEATURE_FLAG - CONFIGURATION ChangeEventAttributesImpactedResourcesItem: description: A uniquely identified resource. properties: name: description: The name of the impacted resource. type: string type: $ref: "#/components/schemas/ChangeEventAttributesImpactedResourcesItemType" type: object ChangeEventAttributesImpactedResourcesItemType: description: The type of the impacted resource. enum: - service type: string x-enum-varnames: - SERVICE ChangeEventCustomAttributes: additionalProperties: false description: |- Change event attributes. properties: author: $ref: "#/components/schemas/ChangeEventCustomAttributesAuthor" change_metadata: additionalProperties: {} description: |- Free form JSON object with information related to the `change` event. Supports up to 100 properties per object and a maximum nesting depth of 10 levels. example: dd: team: "datadog_team" user_email: "datadog@datadog.com" user_id: "datadog_user_id" user_name: "datadog_username" resource_link: "datadog.com/feature/fallback_payments_test" type: object changed_resource: $ref: "#/components/schemas/ChangeEventCustomAttributesChangedResource" impacted_resources: description: |- A list of resources impacted by this change. It is recommended to provide an impacted resource to display the change event at the correct location. Only resources of type `service` are supported. Maximum of 100 impacted resources allowed. example: - name: payments_api type: service items: $ref: "#/components/schemas/ChangeEventCustomAttributesImpactedResourcesItems" maxItems: 100 type: array new_value: additionalProperties: {} description: |- Free form JSON object representing the new state of the changed resource. example: enabled: true percentage: "50%" rule: datacenter: "devcycle.us1.prod" type: object prev_value: additionalProperties: {} description: |- Free form JSON object representing the previous state of the changed resource. example: enabled: true percentage: "10%" rule: datacenter: "devcycle.us1.prod" type: object required: - changed_resource type: object ChangeEventCustomAttributesAuthor: additionalProperties: false description: |- The entity that made the change. Optional, if provided it must include `type` and `name`. properties: name: description: The name of the user or system that made the change. Limited to 128 characters. example: "example@datadog.com" maxLength: 128 minLength: 1 type: string type: $ref: "#/components/schemas/ChangeEventCustomAttributesAuthorType" required: - name - type type: object ChangeEventCustomAttributesAuthorType: description: Author's type. enum: - user - system - api - automation example: user type: string x-enum-varnames: - USER - SYSTEM - API - AUTOMATION ChangeEventCustomAttributesChangedResource: additionalProperties: false description: |- A uniquely identified resource. properties: name: description: The name of the resource that was changed. Limited to 128 characters. Must contain at least one non-whitespace character. example: "fallback_payments_test" maxLength: 128 minLength: 1 pattern: ".*\\S.*" type: string type: $ref: "#/components/schemas/ChangeEventCustomAttributesChangedResourceType" required: - type - name type: object ChangeEventCustomAttributesChangedResourceType: description: The type of the resource that was changed. enum: - feature_flag - configuration example: "feature_flag" type: string x-enum-varnames: - FEATURE_FLAG - CONFIGURATION ChangeEventCustomAttributesImpactedResourcesItems: additionalProperties: false description: |- Object representing a uniquely identified resource. properties: name: description: The name of the impacted resource. Limited to 128 characters. example: "payments_api" maxLength: 128 minLength: 1 type: string type: $ref: "#/components/schemas/ChangeEventCustomAttributesImpactedResourcesItemsType" required: - type - name type: object ChangeEventCustomAttributesImpactedResourcesItemsType: description: The type of the impacted resource. enum: - service example: "service" type: string x-enum-varnames: - SERVICE ChangeEventTriggerWrapper: description: "Schema for a Change Event-based trigger." properties: changeEventTrigger: description: "Trigger a workflow from a Change Event." type: object startStepNames: $ref: "#/components/schemas/StartStepNames" required: - changeEventTrigger type: object ChangeRequestBranchCreateAttributes: description: Attributes for creating a change request branch. properties: branch_name: description: The name of the branch to create. example: "chm/CHM-1234" type: string repo_id: description: The repository identifier in the format owner/repository. example: "DataDog/dd-source" type: string required: - repo_id - branch_name type: object ChangeRequestBranchCreateData: description: Data object to create a change request branch. properties: attributes: $ref: "#/components/schemas/ChangeRequestBranchCreateAttributes" type: $ref: "#/components/schemas/ChangeRequestBranchResourceType" required: - type - attributes type: object ChangeRequestBranchCreateRequest: description: Request object to create a branch for a change request. properties: data: $ref: "#/components/schemas/ChangeRequestBranchCreateData" required: - data type: object ChangeRequestBranchResourceType: description: Change request branch resource type. enum: - change_request_branch example: change_request_branch type: string x-enum-varnames: - CHANGE_REQUEST_BRANCH ChangeRequestChangeType: description: The type of the change request. enum: - NORMAL - STANDARD - EMERGENCY example: NORMAL type: string x-enum-varnames: - NORMAL - STANDARD - EMERGENCY ChangeRequestCreateAttributes: description: Attributes for creating a change request. properties: change_request_linked_incident_uuid: description: The UUID of an incident to link to the change request. example: "00000000-0000-0000-0000-000000000000" type: string change_request_maintenance_window_query: description: The maintenance window query for the change request. example: "" type: string change_request_plan: description: The plan associated with the change request. example: "1. Deploy to staging 2. Run tests 3. Deploy to production" type: string change_request_risk: $ref: "#/components/schemas/ChangeRequestRiskLevel" change_request_type: $ref: "#/components/schemas/ChangeRequestChangeType" description: description: The description of the change request. example: "Deploying new payment service v2.1" type: string end_date: description: The planned end date of the change request. example: "2024-01-02T15:00:00Z" format: date-time type: string project_id: description: The project UUID to associate with the change request. example: "d4bbe1af-f36e-42f1-87c1-493ca35c320e" type: string requested_teams: description: A list of team handles to request decisions from. example: - "team-handle-1" items: description: A team handle to request decisions from. type: string type: array start_date: description: The planned start date of the change request. example: "2024-01-01T03:00:00Z" format: date-time type: string title: description: The title of the change request. example: "Deploy new payment service" type: string required: - title type: object ChangeRequestCreateData: description: Data object to create a change request. properties: attributes: $ref: "#/components/schemas/ChangeRequestCreateAttributes" type: $ref: "#/components/schemas/ChangeRequestResourceType" required: - type - attributes type: object ChangeRequestCreateRequest: description: Request object to create a change request. properties: data: $ref: "#/components/schemas/ChangeRequestCreateData" required: - data type: object ChangeRequestDecisionCreateAttributes: description: Attributes for creating a change request decision. properties: change_request_status: $ref: "#/components/schemas/ChangeRequestDecisionStatusType" request_reason: description: The reason for requesting the decision. example: "Please review and approve this change" type: string type: object ChangeRequestDecisionCreateItem: description: An included change request decision for a create or update operation. properties: attributes: $ref: "#/components/schemas/ChangeRequestDecisionCreateAttributes" id: description: The decision identifier. example: "decision-id-0" type: string relationships: $ref: "#/components/schemas/ChangeRequestDecisionCreateRelationships" type: $ref: "#/components/schemas/ChangeRequestDecisionResourceType" required: - type - id type: object ChangeRequestDecisionCreateRelationships: description: Relationships for creating a change request decision. properties: requested_user: $ref: "#/components/schemas/ChangeRequestUserRelationship" type: object ChangeRequestDecisionRelationshipData: description: Change request decision relationship data. properties: id: description: The decision UUID. example: "decision-id-0" type: string type: $ref: "#/components/schemas/ChangeRequestDecisionResourceType" required: - id - type type: object ChangeRequestDecisionRelationships: description: Relationships of a change request decision. properties: modified_by: $ref: "#/components/schemas/ChangeRequestUserRelationship" requested_by_user: $ref: "#/components/schemas/ChangeRequestUserRelationship" requested_user: $ref: "#/components/schemas/ChangeRequestUserRelationship" required: - requested_user - requested_by_user - modified_by type: object ChangeRequestDecisionResourceType: description: Change request decision resource type. enum: - change_request_decision example: change_request_decision type: string x-enum-varnames: - CHANGE_REQUEST_DECISION ChangeRequestDecisionResponseAttributes: description: Attributes of a change request decision in a response. properties: change_request_status: $ref: "#/components/schemas/ChangeRequestDecisionStatusType" decided_at: description: Timestamp of when the decision was made. example: "2024-01-02T00:00:00Z" format: date-time type: string decision_reason: description: The reason for the decision. example: "LGTM" type: string deleted_at: description: Timestamp of when the decision was deleted. example: "0001-01-01T00:00:00Z" format: date-time type: string request_reason: description: The reason for requesting the decision. example: "Please review this change" type: string requested_at: description: Timestamp of when the decision was requested. example: "2024-01-01T00:00:00Z" format: date-time type: string required: - change_request_status - request_reason - decision_reason - requested_at - decided_at - deleted_at type: object ChangeRequestDecisionStatusType: description: The status of a change request decision. enum: - REQUESTED - APPROVED - DECLINED example: REQUESTED type: string x-enum-varnames: - REQUESTED - APPROVED - DECLINED ChangeRequestDecisionUpdateData: description: Data object to update a change request decision. properties: attributes: $ref: "#/components/schemas/ChangeRequestDecisionUpdateDataAttributes" relationships: $ref: "#/components/schemas/ChangeRequestDecisionUpdateDataRelationships" type: $ref: "#/components/schemas/ChangeRequestResourceType" required: - type type: object ChangeRequestDecisionUpdateDataAttributes: description: Attributes of the parent change request for a decision update. properties: id: description: The identifier of the change request. example: "CHM-1234" type: string type: object ChangeRequestDecisionUpdateDataRelationships: description: Relationships for updating a change request decision. properties: change_request_decisions: $ref: "#/components/schemas/ChangeRequestDecisionsRelationship" required: - change_request_decisions type: object ChangeRequestDecisionUpdateRequest: description: Request object to update a change request decision. properties: data: $ref: "#/components/schemas/ChangeRequestDecisionUpdateData" included: $ref: "#/components/schemas/ChangeRequestUpdateIncluded" required: - data type: object ChangeRequestDecisionsRelationship: description: Relationship to change request decisions. properties: data: description: Array of decision relationship data. items: $ref: "#/components/schemas/ChangeRequestDecisionRelationshipData" type: array required: - data type: object ChangeRequestIncluded: description: Included resources related to the change request. items: $ref: "#/components/schemas/ChangeRequestIncludedItem" type: array ChangeRequestIncludedDecision: description: An included change request decision resource. properties: attributes: $ref: "#/components/schemas/ChangeRequestDecisionResponseAttributes" id: description: The decision UUID. example: "decision-id-0" type: string relationships: $ref: "#/components/schemas/ChangeRequestDecisionRelationships" type: $ref: "#/components/schemas/ChangeRequestDecisionResourceType" required: - type - id - attributes type: object ChangeRequestIncludedItem: description: An included resource item in the change request response. oneOf: - $ref: "#/components/schemas/ChangeRequestIncludedUser" - $ref: "#/components/schemas/ChangeRequestIncludedDecision" ChangeRequestIncludedUser: description: An included user resource. properties: attributes: $ref: "#/components/schemas/ChangeRequestIncludedUserAttributes" id: description: The user UUID. example: "00000000-0000-0000-0000-000000000000" type: string type: description: The resource type. example: "user" type: string required: - type - id - attributes type: object ChangeRequestIncludedUserAttributes: description: Attributes of an included user. properties: email: description: The email of the user. example: "john.doe@example.com" type: string handle: description: The handle of the user. example: "john.doe@example.com" type: string name: description: The name of the user. example: "John Doe" type: string required: - name - email - handle type: object ChangeRequestObjectAttributes: additionalProperties: items: description: An attribute value. type: string type: array description: Custom attributes of the change request as key-value pairs. type: object ChangeRequestRelationships: description: Relationships of a change request. properties: change_request_decisions: $ref: "#/components/schemas/ChangeRequestDecisionsRelationship" created_by: $ref: "#/components/schemas/ChangeRequestUserRelationship" modified_by: $ref: "#/components/schemas/ChangeRequestUserRelationship" required: - created_by - modified_by - change_request_decisions type: object ChangeRequestResourceType: description: Change request resource type. enum: - change_request example: change_request type: string x-enum-varnames: - CHANGE_REQUEST ChangeRequestResponse: description: Response object for a change request. properties: data: $ref: "#/components/schemas/ChangeRequestResponseData" included: $ref: "#/components/schemas/ChangeRequestIncluded" required: - data type: object ChangeRequestResponseAttributes: description: Attributes of a change request response. properties: archived_at: description: Timestamp of when the change request was archived. format: date-time nullable: true readOnly: true type: string attributes: $ref: "#/components/schemas/ChangeRequestObjectAttributes" change_request_linked_incident_uuid: description: The UUID of the linked incident. example: "" type: string change_request_maintenance_window_query: description: The maintenance window query for the change request. example: "" type: string change_request_plan: description: The plan associated with the change request. example: "" type: string change_request_risk: $ref: "#/components/schemas/ChangeRequestRiskLevel" change_request_type: $ref: "#/components/schemas/ChangeRequestChangeType" closed_at: description: Timestamp of when the change request was closed. format: date-time nullable: true readOnly: true type: string created_at: description: Timestamp of when the change request was created. example: "2024-01-01T00:00:00Z" format: date-time readOnly: true type: string creation_source: description: The source from which the change request was created. example: "CS_MANUAL" type: string description: description: The description of the change request. example: "Deploying new payment service v2.1" type: string end_date: description: The planned end date of the change request. example: "2024-01-02T15:00:00Z" format: date-time type: string key: description: The human-readable key of the change request. example: "CHM-1234" type: string modified_at: description: Timestamp of when the change request was last modified. example: "2024-01-01T00:00:00Z" format: date-time readOnly: true type: string plan_notebook_id: description: The notebook ID associated with the change request plan. example: 0 format: int64 type: integer priority: description: The priority of the change request. example: "NOT_DEFINED" type: string project_id: description: The project UUID associated with the change request. example: "d4bbe1af-f36e-42f1-87c1-493ca35c320e" type: string start_date: description: The planned start date of the change request. example: "2024-01-01T03:00:00Z" format: date-time type: string status: description: The current status of the change request. example: "OPEN" type: string title: description: The title of the change request. example: "Deploy new payment service" type: string type: description: The case type. example: "CHANGE_REQUEST" type: string required: - key - title - type - priority - status - description - creation_source - plan_notebook_id - project_id - attributes - created_at - modified_at - change_request_type - change_request_risk - change_request_plan - change_request_linked_incident_uuid - change_request_maintenance_window_query type: object ChangeRequestResponseData: description: Data object for a change request response. properties: attributes: $ref: "#/components/schemas/ChangeRequestResponseAttributes" id: description: The identifier of the change request. example: "CHM-1234" type: string relationships: $ref: "#/components/schemas/ChangeRequestRelationships" type: $ref: "#/components/schemas/ChangeRequestResourceType" required: - id - type - attributes type: object ChangeRequestRiskLevel: description: The risk level of the change request. enum: - UNDEFINED - LOW - MEDIUM - HIGH example: LOW type: string x-enum-varnames: - UNDEFINED - LOW - MEDIUM - HIGH ChangeRequestUpdateAttributes: description: Attributes for updating a change request. properties: change_request_plan: description: The plan associated with the change request. example: "Updated deployment plan" type: string change_request_risk: $ref: "#/components/schemas/ChangeRequestRiskLevel" change_request_type: $ref: "#/components/schemas/ChangeRequestChangeType" end_date: description: The planned end date of the change request. example: "2024-01-02T15:00:00Z" format: date-time type: string id: description: The identifier of the change request to update. example: "CHM-1234" type: string start_date: description: The planned start date of the change request. example: "2024-01-01T03:00:00Z" format: date-time type: string type: object ChangeRequestUpdateData: description: Data object to update a change request. properties: attributes: $ref: "#/components/schemas/ChangeRequestUpdateAttributes" relationships: $ref: "#/components/schemas/ChangeRequestUpdateRelationships" type: $ref: "#/components/schemas/ChangeRequestResourceType" required: - type type: object ChangeRequestUpdateIncluded: description: Included resources for the change request update. items: $ref: "#/components/schemas/ChangeRequestDecisionCreateItem" type: array ChangeRequestUpdateRelationships: description: Relationships for updating a change request. properties: change_request_decisions: $ref: "#/components/schemas/ChangeRequestDecisionsRelationship" type: object ChangeRequestUpdateRequest: description: Request object to update a change request. properties: data: $ref: "#/components/schemas/ChangeRequestUpdateData" included: $ref: "#/components/schemas/ChangeRequestUpdateIncluded" required: - data type: object ChangeRequestUserRelationship: description: Relationship to a user. properties: data: $ref: "#/components/schemas/ChangeRequestUserRelationshipData" required: - data type: object ChangeRequestUserRelationshipData: description: User relationship data. nullable: true properties: id: description: The user UUID. example: "00000000-0000-0000-0000-000000000000" type: string type: description: The user resource type. example: "user" type: string required: - id - type type: object ChargebackBreakdown: description: Charges breakdown. properties: charge_type: description: The type of charge for a particular product. example: on_demand type: string cost: description: The cost for a particular product and charge type during a given month. format: double type: number product_name: description: The product for which cost is being reported. example: infra_host type: string type: object CircleCIAPIKey: description: The definition of the `CircleCIAPIKey` object. properties: api_token: $ref: "#/components/schemas/CircleCIAPIKeyApiToken" type: $ref: "#/components/schemas/CircleCIAPIKeyType" required: - type - api_token type: object CircleCIAPIKeyApiToken: description: The `CircleCIAPIKey` `api_token`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" CircleCIAPIKeyType: description: The definition of the `CircleCIAPIKey` object. enum: - CircleCIAPIKey example: CircleCIAPIKey type: string x-enum-varnames: - CIRCLECIAPIKEY CircleCIAPIKeyUpdate: description: The definition of the `CircleCIAPIKey` object. properties: api_token: $ref: "#/components/schemas/CircleCIAPIKeyUpdateApiToken" type: $ref: "#/components/schemas/CircleCIAPIKeyType" required: - type type: object CircleCIAPIKeyUpdateApiToken: description: The `CircleCIAPIKeyUpdate` `api_token`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" CircleCICredentials: description: The definition of the `CircleCICredentials` object. oneOf: - $ref: "#/components/schemas/CircleCIAPIKey" CircleCICredentialsUpdate: description: The definition of the `CircleCICredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/CircleCIAPIKeyUpdate" CircleCIIntegration: description: The definition of the `CircleCIIntegration` object. properties: credentials: $ref: "#/components/schemas/CircleCICredentials" type: $ref: "#/components/schemas/CircleCIIntegrationType" required: - type - credentials type: object CircleCIIntegrationType: description: The definition of the `CircleCIIntegrationType` object. enum: - CircleCI example: CircleCI type: string x-enum-varnames: - CIRCLECI CircleCIIntegrationUpdate: description: The definition of the `CircleCIIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/CircleCICredentialsUpdate" type: $ref: "#/components/schemas/CircleCIIntegrationType" required: - type type: object ClickupAPIKey: description: The definition of the `ClickupAPIKey` object. properties: api_token: $ref: "#/components/schemas/ClickupAPIKeyApiToken" type: $ref: "#/components/schemas/ClickupAPIKeyType" required: - type - api_token type: object ClickupAPIKeyApiToken: description: The `ClickupAPIKey` `api_token`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" ClickupAPIKeyType: description: The definition of the `ClickupAPIKey` object. enum: - ClickupAPIKey example: ClickupAPIKey type: string x-enum-varnames: - CLICKUPAPIKEY ClickupAPIKeyUpdate: description: The definition of the `ClickupAPIKey` object. properties: api_token: $ref: "#/components/schemas/ClickupAPIKeyUpdateApiToken" type: $ref: "#/components/schemas/ClickupAPIKeyType" required: - type type: object ClickupAPIKeyUpdateApiToken: description: The `ClickupAPIKeyUpdate` `api_token`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" ClickupCredentials: description: The definition of the `ClickupCredentials` object. oneOf: - $ref: "#/components/schemas/ClickupAPIKey" ClickupCredentialsUpdate: description: The definition of the `ClickupCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/ClickupAPIKeyUpdate" ClickupIntegration: description: The definition of the `ClickupIntegration` object. properties: credentials: $ref: "#/components/schemas/ClickupCredentials" type: $ref: "#/components/schemas/ClickupIntegrationType" required: - type - credentials type: object ClickupIntegrationType: description: The definition of the `ClickupIntegrationType` object. enum: - Clickup example: Clickup type: string x-enum-varnames: - CLICKUP ClickupIntegrationUpdate: description: The definition of the `ClickupIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/ClickupCredentialsUpdate" type: $ref: "#/components/schemas/ClickupIntegrationType" required: - type type: object CloneFormData: description: The data for cloning a form. properties: attributes: $ref: "#/components/schemas/CloneFormDataAttributes" type: $ref: "#/components/schemas/FormType" required: - type type: object CloneFormDataAttributes: description: The attributes for cloning a form. properties: name: description: The name for the cloned form. Defaults to "Copy of (source form name)" if not provided. example: Copy of My Form type: string type: object CloneFormRequest: description: A request to clone a form. properties: data: $ref: "#/components/schemas/CloneFormData" required: - data type: object CloudAssetType: description: The cloud asset type enum: - Host - HostImage - Image example: Host type: string x-enum-varnames: - HOST - HOST_IMAGE - IMAGE CloudConfigurationComplianceRuleOptions: additionalProperties: {} description: "Options for cloud_configuration rules.\nFields `resourceType` and `regoRule` are mandatory when managing custom `cloud_configuration` rules." properties: complexRule: description: "Whether the rule is a complex one.\nMust be set to true if `regoRule.resourceTypes` contains more than one item. Defaults to false." type: boolean regoRule: $ref: "#/components/schemas/CloudConfigurationRegoRule" resourceType: description: "Main resource type to be checked by the rule. It should be specified again in `regoRule.resourceTypes`." example: aws_acm type: string type: object CloudConfigurationRegoRule: description: Rule details. properties: policy: description: "The policy written in `rego`, see: https://www.openpolicyagent.org/docs/latest/policy-language/" example: "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}" type: string resourceTypes: description: List of resource types that will be evaluated upon. Must have at least one element. example: - gcp_iam_service_account - gcp_iam_policy items: description: A cloud resource type identifier. type: string type: array required: - policy - resourceTypes type: object CloudConfigurationRuleCaseCreate: description: Description of signals. properties: notifications: description: Notification targets for each rule case. items: description: Notification. type: string type: array status: $ref: "#/components/schemas/SecurityMonitoringRuleSeverity" required: - status type: object CloudConfigurationRuleComplianceSignalOptions: description: How to generate compliance signals. Useful for cloud_configuration rules only. properties: defaultActivationStatus: description: The default activation status. nullable: true type: boolean defaultGroupByFields: description: The default group by fields. items: description: A field name used for default grouping. type: string nullable: true type: array userActivationStatus: description: Whether signals will be sent. nullable: true type: boolean userGroupByFields: description: Fields to use to group findings by when sending signals. items: description: A field name to group findings by. type: string nullable: true type: array type: object CloudConfigurationRuleCreatePayload: description: Create a new cloud configuration rule. properties: cases: description: "Description of generated findings and signals (severity and channels to be notified in case of a signal). Must contain exactly one item." items: $ref: "#/components/schemas/CloudConfigurationRuleCaseCreate" type: array complianceSignalOptions: $ref: "#/components/schemas/CloudConfigurationRuleComplianceSignalOptions" filters: description: Additional queries to filter matched events before they are processed. items: $ref: "#/components/schemas/SecurityMonitoringFilter" type: array isEnabled: description: Whether the rule is enabled. example: true type: boolean message: description: Message in markdown format for generated findings and signals. example: "#Description\nExplanation of the rule.\n\n#Remediation\nHow to fix the security issue." type: string name: description: The name of the rule. example: My security monitoring rule. type: string options: $ref: "#/components/schemas/CloudConfigurationRuleOptions" tags: description: Tags for generated findings and signals. example: - env:prod - team:security items: description: Tag. type: string type: array type: $ref: "#/components/schemas/CloudConfigurationRuleType" required: - name - isEnabled - options - complianceSignalOptions - cases - message type: object CloudConfigurationRuleOptions: description: Options on cloud configuration rules. properties: complianceRuleOptions: $ref: "#/components/schemas/CloudConfigurationComplianceRuleOptions" required: - complianceRuleOptions type: object CloudConfigurationRulePayload: description: The payload of a cloud configuration rule. properties: cases: description: "Description of generated findings and signals (severity and channels to be notified in case of a signal). Must contain exactly one item." items: $ref: "#/components/schemas/CloudConfigurationRuleCaseCreate" type: array complianceSignalOptions: $ref: "#/components/schemas/CloudConfigurationRuleComplianceSignalOptions" customMessage: description: Custom/Overridden message for generated signals (used in case of Default rule update). type: string customName: description: Custom/Overridden name of the rule (used in case of Default rule update). type: string filters: description: Additional queries to filter matched events before they are processed. items: $ref: "#/components/schemas/SecurityMonitoringFilter" type: array isEnabled: description: Whether the rule is enabled. example: true type: boolean message: description: Message in markdown format for generated findings and signals. example: "#Description\nExplanation of the rule.\n\n#Remediation\nHow to fix the security issue." type: string name: description: The name of the rule. example: My security monitoring rule. type: string options: $ref: "#/components/schemas/CloudConfigurationRuleOptions" tags: description: Tags for generated findings and signals. example: - env:prod - team:security items: description: Tag. type: string type: array type: $ref: "#/components/schemas/CloudConfigurationRuleType" required: - name - isEnabled - options - complianceSignalOptions - cases - message type: object CloudConfigurationRuleType: description: The rule type. enum: - cloud_configuration type: string x-enum-varnames: - CLOUD_CONFIGURATION CloudCostAccount: description: A Cloud Cost Management account. properties: attributes: $ref: "#/components/schemas/CloudCostAccountAttributes" id: description: The Datadog cloud account ID used by the account filters API. example: "534" type: string type: $ref: "#/components/schemas/CloudCostAccountType" required: - attributes - id - type type: object CloudCostAccountAttributes: description: Read-only status and identifiers for a cloud cost account. properties: account_id: description: The cloud provider account identifier, such as an OCI tenancy OCID or AWS account ID. example: "ocid1.tenancy.oc1..example" type: string cloud: description: The cloud provider and cost report type. Currently supports `oci` and `aws_cur2`. example: "oci" type: string created_at: description: The timestamp when the cloud account was created. example: "2026-01-01T12:00:00Z" type: string error_messages: description: Validation errors for the cloud account. Empty when there are no errors. example: [] items: description: An error message. type: string type: array status: description: The cloud account status, one of `active`, `warn`, `error`, or `disabled`. example: "active" type: string status_updated_at: description: The timestamp when the cloud account status was last updated. example: "2026-01-01T12:00:00Z" type: string updated_at: description: The timestamp when the cloud account was last updated. example: "2026-01-01T12:00:00Z" type: string required: - account_id - cloud - created_at - error_messages - status - status_updated_at - updated_at type: object CloudCostAccountType: default: cloud_account description: Type of a cloud cost account. enum: - cloud_account example: cloud_account type: string x-enum-varnames: - CLOUD_ACCOUNT CloudCostAccountsResponse: description: List of cloud cost accounts. properties: data: description: The cloud cost accounts matching the filter. items: $ref: "#/components/schemas/CloudCostAccount" type: array required: - data type: object CloudInventoryCloudProviderId: description: |- Cloud provider for this sync configuration (`aws`, `gcp`, or `azure`). For requests, must match the provider block supplied under `attributes`. enum: - aws - gcp - azure example: aws type: string x-enum-varnames: - AWS - GCP - AZURE CloudInventoryCloudProviderRequestType: description: Always `cloud_provider`. enum: - cloud_provider example: cloud_provider type: string x-enum-varnames: - CLOUD_PROVIDER CloudInventorySyncConfigAWSRequestAttributes: description: AWS settings for the S3 bucket Storage Management reads inventory reports from. properties: aws_account_id: description: AWS account ID that owns the inventory bucket. example: "123456789012" type: string destination_bucket_name: description: Name of the S3 bucket containing inventory files. example: my-inventory-bucket type: string destination_bucket_region: description: AWS Region of the inventory bucket. example: us-east-1 type: string destination_prefix: description: Object key prefix where inventory reports are written. Omit or set to `/` when reports are written at the bucket root. example: logs/ type: string required: - aws_account_id - destination_bucket_name - destination_bucket_region type: object CloudInventorySyncConfigAttributes: description: Attributes for a Storage Management configuration. Fields other than `id` may be empty in the response immediately after a create or update; subsequent reads return the full configuration. properties: aws_account_id: description: AWS account ID for the inventory bucket. example: "123456789012" type: string aws_bucket_name: description: AWS S3 bucket name for inventory files. example: my-inventory-bucket type: string aws_region: description: AWS Region for the inventory bucket. example: us-east-1 type: string azure_client_id: description: Azure AD application (client) ID. example: 11111111-1111-1111-1111-111111111111 type: string azure_container_name: description: Azure blob container name. example: inventory-container type: string azure_storage_account_name: description: Azure storage account name. example: mystorageaccount type: string azure_tenant_id: description: Azure AD tenant ID. example: 22222222-2222-2222-2222-222222222222 type: string cloud_provider: $ref: "#/components/schemas/CloudInventoryCloudProviderId" error: description: Human-readable error detail when sync is unhealthy. example: "" readOnly: true type: string error_code: description: Machine-readable error code when sync is unhealthy. example: "" readOnly: true type: string gcp_bucket_name: description: GCS bucket name for inventory files Datadog reads. example: my-inventory-reports type: string gcp_project_id: description: GCP project ID. example: my-gcp-project type: string gcp_service_account_email: description: Service account email for bucket access. example: reader@my-gcp-project.iam.gserviceaccount.com type: string prefix: description: Object key prefix where inventory reports are written. Returns `/` when reports are written at the bucket root. example: logs/ readOnly: true type: string required: - aws_bucket_name - aws_account_id - aws_region - azure_storage_account_name - azure_container_name - azure_client_id - azure_tenant_id - gcp_bucket_name - gcp_project_id - gcp_service_account_email - cloud_provider - prefix - error - error_code type: object CloudInventorySyncConfigAzureRequestAttributes: description: Azure settings for the storage account and container with inventory data. properties: client_id: description: Azure AD application (client) ID used for access. example: 11111111-1111-1111-1111-111111111111 type: string container: description: Blob container name. example: inventory-container type: string resource_group: description: Resource group containing the storage account. example: my-resource-group type: string storage_account: description: Storage account name. example: mystorageaccount type: string subscription_id: description: Azure subscription ID. example: 33333333-3333-3333-3333-333333333333 type: string tenant_id: description: Azure AD tenant ID. example: 22222222-2222-2222-2222-222222222222 type: string required: - client_id - tenant_id - subscription_id - resource_group - storage_account - container type: object CloudInventorySyncConfigGCPRequestAttributes: description: GCP settings for buckets involved in inventory reporting. properties: destination_bucket_name: description: GCS bucket name where Datadog reads inventory reports. example: my-inventory-reports type: string project_id: description: GCP project ID for the inventory destination bucket. example: my-gcp-project type: string service_account_email: description: Service account email used to read the destination bucket. example: reader@my-gcp-project.iam.gserviceaccount.com type: string source_bucket_name: description: GCS bucket name that inventory reports are generated for. example: my-monitored-bucket type: string required: - project_id - destination_bucket_name - source_bucket_name - service_account_email type: object CloudInventorySyncConfigResourceType: description: Always `sync_configs`. enum: - sync_configs example: sync_configs type: string x-enum-varnames: - SYNC_CONFIGS CloudInventorySyncConfigResponse: description: Storage Management configuration returned after a create or update. Additional read-only fields appear on list and get responses. properties: data: $ref: "#/components/schemas/CloudInventorySyncConfigResponseData" required: - data type: object CloudInventorySyncConfigResponseData: description: Storage Management configuration data. properties: attributes: $ref: "#/components/schemas/CloudInventorySyncConfigAttributes" id: description: Unique identifier for this Storage Management configuration. example: abc123 type: string type: $ref: "#/components/schemas/CloudInventorySyncConfigResourceType" required: - id - type - attributes type: object CloudWorkloadSecurityAgentPoliciesListResponse: description: "Response object that includes a list of Agent policies" properties: data: description: "A list of Agent policy objects" items: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPolicyData" type: array type: object CloudWorkloadSecurityAgentPolicyAttributes: description: "A Cloud Workload Security Agent policy returned by the API" properties: blockingRulesCount: description: "The number of rules with the blocking feature in this policy" example: 100 format: int32 maximum: 2147483647 type: integer contentPackUpdateAvailable: description: "Whether an update is available for the content pack. Only set for activated content packs, `null` otherwise" example: false nullable: true type: boolean datadogManaged: description: "Whether the policy is managed by Datadog" example: false type: boolean description: description: "The description of the policy" example: "My agent policy" type: string disabledRulesCount: description: "The number of rules that are disabled in this policy" example: 100 format: int32 maximum: 2147483647 type: integer enabled: description: "Whether the Agent policy is enabled" example: true type: boolean hostTags: description: "The host tags defining where this policy is deployed" items: description: "A host tag used to identify where this policy is deployed." type: string type: array hostTagsLists: description: "The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR" items: description: "A list of host tags linked with AND logic." items: description: "A host tag used to filter the deployment scope." type: string type: array type: array monitoringRulesCount: description: "The number of rules in the monitoring state in this policy" example: 100 format: int32 maximum: 2147483647 type: integer name: description: "The name of the policy" example: "my_agent_policy" type: string pinned: description: "Whether the policy is pinned" example: false type: boolean policyType: description: "The type of the policy" example: "policy" type: string policyVersion: description: "The version of the policy" example: "1" type: string priority: description: "The priority of the policy" example: 10 format: int64 type: integer ruleCount: description: "The number of rules in this policy" example: 100 format: int32 maximum: 2147483647 type: integer sourceDefaultPolicyId: description: "The ID of the Datadog-managed default policy this policy is derived from" example: "xxx-yyy-zzz" type: string updateDate: description: "Timestamp in milliseconds when the policy was last updated" example: 1624366480320 format: int64 type: integer updatedAt: description: "When the policy was last updated, timestamp in milliseconds" example: 1624366480320 format: int64 type: integer updater: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPolicyUpdaterAttributes" versions: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPolicyVersions" type: object CloudWorkloadSecurityAgentPolicyCreateAttributes: description: "Create a new Cloud Workload Security Agent policy" properties: description: description: "The description of the policy" example: "My agent policy" type: string enabled: description: "Whether the policy is enabled" example: true type: boolean hostTags: description: "The host tags defining where this policy is deployed" items: description: "A host tag used to identify where this policy is deployed." type: string type: array hostTagsLists: description: "The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR" items: description: "A list of host tags linked with AND logic." items: description: "A host tag used to filter the deployment scope." type: string type: array type: array name: description: "The name of the policy" example: "my_agent_policy" type: string required: - name type: object CloudWorkloadSecurityAgentPolicyCreateData: description: "Object for a single Agent rule" properties: attributes: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPolicyCreateAttributes" type: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPolicyType" required: - attributes - type type: object CloudWorkloadSecurityAgentPolicyCreateRequest: description: "Request object that includes the Agent policy to create" properties: data: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPolicyCreateData" required: - data type: object CloudWorkloadSecurityAgentPolicyData: description: "Object for a single Agent policy" properties: attributes: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPolicyAttributes" id: description: "The ID of the Agent policy" example: "6517fcc1-cec7-4394-a655-8d6e9d085255" type: string type: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPolicyType" type: object CloudWorkloadSecurityAgentPolicyID: description: "The ID of the Agent policy" example: "6517fcc1-cec7-4394-a655-8d6e9d085255" type: string CloudWorkloadSecurityAgentPolicyResponse: description: "Response object that includes an Agent policy" properties: data: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPolicyData" type: object CloudWorkloadSecurityAgentPolicyType: default: policy description: "The type of the resource, must always be `policy`" enum: - policy example: policy type: string x-enum-varnames: ["POLICY"] CloudWorkloadSecurityAgentPolicyUpdateAttributes: description: "Update an existing Cloud Workload Security Agent policy" properties: description: description: "The description of the policy" example: "My agent policy" type: string enabled: description: "Whether the policy is enabled" example: true type: boolean hostTags: description: "The host tags defining where this policy is deployed" items: description: "A host tag used to identify where this policy is deployed." type: string type: array hostTagsLists: description: "The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR" items: description: "A list of host tags linked with AND logic." items: description: "A host tag used to filter the deployment scope." type: string type: array type: array name: description: "The name of the policy" example: "my_agent_policy" type: string type: object CloudWorkloadSecurityAgentPolicyUpdateData: description: "Object for a single Agent policy" properties: attributes: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPolicyUpdateAttributes" id: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPolicyID" type: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPolicyType" required: - attributes - type type: object CloudWorkloadSecurityAgentPolicyUpdateRequest: description: "Request object that includes the Agent policy with the attributes to update" properties: data: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPolicyUpdateData" required: - data type: object CloudWorkloadSecurityAgentPolicyUpdaterAttributes: description: "The attributes of the user who last updated the policy" properties: handle: description: "The handle of the user" example: "datadog.user@example.com" type: string name: description: "The name of the user" example: "Datadog User" nullable: true type: string type: object CloudWorkloadSecurityAgentPolicyVersion: description: "The versions of the policy" properties: date: description: "The date and time the version was created" nullable: true type: string name: description: "The version of the policy" example: "1.47.0-rc2" type: string type: object CloudWorkloadSecurityAgentPolicyVersions: description: "The versions of the policy" items: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPolicyVersion" type: array CloudWorkloadSecurityAgentRuleAction: description: "The action the rule can perform if triggered" properties: coredump: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleActionCoreDump" disabled: description: "Whether the action is disabled" example: false type: boolean filter: description: "SECL expression used to target the container to apply the action on" type: string hash: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleActionHash" kill: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleKill" log: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleActionLog" metadata: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleActionMetadata" network_filter: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleActionNetworkFilter" set: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleActionSet" type: object CloudWorkloadSecurityAgentRuleActionCoreDump: description: "The core dump action applied on the process matching the rule." properties: dentry: description: "Whether the directory entry information is included in the core dump." type: boolean mount: description: "Whether the mount information is included in the core dump." type: boolean no_compression: description: "Whether the core dump is left uncompressed." type: boolean process: description: "Whether the process memory is included in the core dump." type: boolean type: object CloudWorkloadSecurityAgentRuleActionHash: description: "Hash file specified by the field attribute" properties: field: description: "The field of the hash action" type: string max_file_size: description: "The maximum size of the files to hash, in bytes." format: int64 type: integer type: object CloudWorkloadSecurityAgentRuleActionLog: description: "The log action applied when the rule is triggered." properties: level: description: "The level of the log action." type: string message: description: "The message of the log action." type: string type: object CloudWorkloadSecurityAgentRuleActionMetadata: description: "The metadata action applied on the scope matching the rule" properties: image_tag: description: "The image tag of the metadata action" type: string service: description: "The service of the metadata action" type: string short_image: description: "The short image of the metadata action" type: string type: object CloudWorkloadSecurityAgentRuleActionNetworkFilter: description: "The network filter action applied on the network traffic matching the rule." properties: filter: description: "The filter expression of the network filter action." type: string policy: description: "The policy of the network filter action." type: string scope: description: "The scope of the network filter action." type: string type: object CloudWorkloadSecurityAgentRuleActionSet: description: "The set action applied on the scope matching the rule" properties: append: description: "Whether the value should be appended to the field." type: boolean default_value: description: "The default value of the set action" type: string expression: description: "The expression of the set action." type: string field: description: "The field of the set action" type: string inherited: description: "Whether the value should be inherited." type: boolean name: description: "The name of the set action" type: string private: description: "Whether the value of the set action is private." type: boolean scope: description: "The scope of the set action." type: string scope_field: description: "The scope field of the set action." type: string size: description: "The size of the set action." format: int64 type: integer ttl: description: "The time to live of the set action." format: int64 type: integer value: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleActionSetValue" type: object CloudWorkloadSecurityAgentRuleActionSetValue: description: "The value of the set action" oneOf: - type: string - format: int32 maximum: 2147483647 type: integer - type: boolean CloudWorkloadSecurityAgentRuleActions: description: "The array of actions the rule can perform if triggered" items: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleAction" nullable: true type: array CloudWorkloadSecurityAgentRuleAttributes: description: "A Cloud Workload Security Agent rule returned by the API" properties: actions: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleActions" agentConstraint: description: "The version of the Agent" type: string agent_version: description: "The version constraint of the Datadog Agent the rule applies to" example: ">=7.62" type: string blocking: description: "The blocking policies that the rule belongs to" items: description: "The ID of a blocking policy that this rule belongs to." type: string type: array category: description: "The category of the Agent rule" example: "Process Activity" type: string creationAuthorUuId: description: "The ID of the user who created the rule" example: e51c9744-d158-11ec-ad23-da7ad0900002 type: string creationDate: description: "When the Agent rule was created, timestamp in milliseconds" example: 1624366480320 format: int64 type: integer creator: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleCreatorAttributes" defaultRule: description: "Whether the rule is included by default" example: false type: boolean description: description: "The description of the Agent rule" example: "My Agent rule" type: string disabled: description: "The disabled policies that the rule belongs to" items: description: "The ID of a disabled policy that this rule belongs to." type: string type: array enabled: description: "Whether the Agent rule is enabled" example: true type: boolean every: description: "The rate limiting duration of the Agent rule, in nanoseconds" example: 60000000000 format: int64 type: integer expression: description: "The SECL expression of the Agent rule" example: 'exec.file.name == "sh"' type: string filters: description: "The platforms the Agent rule is supported on" items: description: "A platform filter that the Agent rule is supported on." type: string type: array group_id: description: "The group of rules the Agent rule belongs to" example: "group_id" type: string monitoring: description: "The monitoring policies that the rule belongs to" items: description: "The ID of a monitoring policy that this rule belongs to." type: string type: array name: description: "The name of the Agent rule" example: "my_agent_rule" type: string product_tags: description: "The list of product tags associated with the rule" items: description: "A product tag associated with the rule." type: string type: array silent: description: "Whether the rule is silent." example: false type: boolean updateAuthorUuId: description: "The ID of the user who updated the rule" example: e51c9744-d158-11ec-ad23-da7ad0900002 type: string updateDate: description: "Timestamp in milliseconds when the Agent rule was last updated" example: 1624366480320 format: int64 type: integer updatedAt: description: "When the Agent rule was last updated, timestamp in milliseconds" example: 1624366480320 format: int64 type: integer updater: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleUpdaterAttributes" version: description: "The version of the Agent rule" example: 23 format: int64 type: integer type: object CloudWorkloadSecurityAgentRuleCreateAttributes: description: "Create a new Cloud Workload Security Agent rule." properties: actions: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleActions" agent_version: description: "Constrain the rule to specific versions of the Datadog Agent." type: string blocking: description: "The blocking policies that the rule belongs to." items: description: "The ID of a blocking policy that this rule belongs to." type: string type: array description: description: "The description of the Agent rule." example: "My Agent rule" type: string disabled: description: "The disabled policies that the rule belongs to." items: description: "The ID of a disabled policy that this rule belongs to." type: string type: array enabled: description: "Whether the Agent rule is enabled." example: true type: boolean expression: description: "The SECL expression of the Agent rule." example: 'exec.file.name == "sh"' type: string filters: description: "The platforms the Agent rule is supported on." items: description: "A platform filter that the Agent rule is supported on." type: string type: array monitoring: description: "The monitoring policies that the rule belongs to." items: description: "The ID of a monitoring policy that this rule belongs to." type: string type: array name: description: "The name of the Agent rule." example: "my_agent_rule" type: string policy_id: description: "The ID of the policy where the Agent rule is saved." example: "a8c8e364-6556-434d-b798-a4c23de29c0b" type: string product_tags: description: "The list of product tags associated with the rule." items: description: "A product tag associated with the rule." type: string type: array silent: description: "Whether the rule is silent." example: false type: boolean required: - name - expression type: object CloudWorkloadSecurityAgentRuleCreateData: description: "Object for a single Agent rule" properties: attributes: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleCreateAttributes" type: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleType" required: - attributes - type type: object CloudWorkloadSecurityAgentRuleCreateRequest: description: "Request object that includes the Agent rule to create" properties: data: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleCreateData" required: - data type: object CloudWorkloadSecurityAgentRuleCreatorAttributes: description: "The attributes of the user who created the Agent rule" properties: handle: description: "The handle of the user" example: "datadog.user@example.com" type: string name: description: "The name of the user" example: "Datadog User" nullable: true type: string type: object CloudWorkloadSecurityAgentRuleData: description: "Object for a single Agent rule" properties: attributes: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleAttributes" id: description: "The ID of the Agent rule" example: "3dd-0uc-h1s" type: string type: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleType" type: object CloudWorkloadSecurityAgentRuleID: description: "The ID of the Agent rule" example: "3dd-0uc-h1s" type: string CloudWorkloadSecurityAgentRuleKill: description: "Kill system call applied on the container matching the rule" properties: disable_container_disarmer: description: "Whether the automatic container safeguard of the kill action is disabled." type: boolean disable_executable_disarmer: description: "Whether the automatic executable safeguard of the kill action is disabled." type: boolean scope: description: "The scope of the kill action." type: string signal: description: "Supported signals for the kill system call" type: string type: object CloudWorkloadSecurityAgentRuleResponse: description: "Response object that includes an Agent rule" properties: data: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleData" type: object CloudWorkloadSecurityAgentRuleType: default: agent_rule description: "The type of the resource, must always be `agent_rule`" enum: - agent_rule example: agent_rule type: string x-enum-varnames: ["AGENT_RULE"] CloudWorkloadSecurityAgentRuleUpdateAttributes: description: "Update an existing Cloud Workload Security Agent rule" properties: actions: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleActions" agent_version: description: "Constrain the rule to specific versions of the Datadog Agent" type: string blocking: description: "The blocking policies that the rule belongs to" items: description: "The ID of a blocking policy that this rule belongs to." type: string type: array description: description: "The description of the Agent rule" example: "My Agent rule" type: string disabled: description: "The disabled policies that the rule belongs to" items: description: "The ID of a disabled policy that this rule belongs to." type: string type: array enabled: description: "Whether the Agent rule is enabled" example: true type: boolean expression: description: "The SECL expression of the Agent rule" example: 'exec.file.name == "sh"' type: string monitoring: description: "The monitoring policies that the rule belongs to" items: description: "The ID of a monitoring policy that this rule belongs to." type: string type: array policy_id: description: "The ID of the policy where the Agent rule is saved" example: "a8c8e364-6556-434d-b798-a4c23de29c0b" type: string product_tags: description: "The list of product tags associated with the rule" items: description: "A product tag associated with the rule." type: string type: array silent: description: "Whether the rule is silent." example: false type: boolean type: object CloudWorkloadSecurityAgentRuleUpdateData: description: "Object for a single Agent rule" properties: attributes: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleUpdateAttributes" id: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleID" type: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleType" required: - attributes - type type: object CloudWorkloadSecurityAgentRuleUpdateRequest: description: "Request object that includes the Agent rule with the attributes to update" properties: data: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleUpdateData" required: - data type: object CloudWorkloadSecurityAgentRuleUpdaterAttributes: description: "The attributes of the user who last updated the Agent rule" properties: handle: description: "The handle of the user" example: "datadog.user@example.com" type: string name: description: "The name of the user" example: "Datadog User" nullable: true type: string type: object CloudWorkloadSecurityAgentRulesListResponse: description: "Response object that includes a list of Agent rule" properties: data: description: "A list of Agent rules objects" items: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleData" type: array type: object CloudflareAPIToken: description: The definition of the `CloudflareAPIToken` object. properties: api_token: $ref: "#/components/schemas/CloudflareAPITokenApiToken" type: $ref: "#/components/schemas/CloudflareAPITokenType" required: - type - api_token type: object CloudflareAPITokenApiToken: description: The `CloudflareAPIToken` `api_token`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" CloudflareAPITokenType: description: The definition of the `CloudflareAPIToken` object. enum: - CloudflareAPIToken example: CloudflareAPIToken type: string x-enum-varnames: - CLOUDFLAREAPITOKEN CloudflareAPITokenUpdate: description: The definition of the `CloudflareAPIToken` object. properties: api_token: $ref: "#/components/schemas/CloudflareAPITokenUpdateApiToken" type: $ref: "#/components/schemas/CloudflareAPITokenType" required: - type type: object CloudflareAPITokenUpdateApiToken: description: The `CloudflareAPITokenUpdate` `api_token`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" CloudflareAccountCreateRequest: description: Payload schema when adding a Cloudflare account. properties: data: $ref: "#/components/schemas/CloudflareAccountCreateRequestData" required: - data type: object CloudflareAccountCreateRequestAttributes: description: Attributes object for creating a Cloudflare account. properties: api_key: description: The API key (or token) for the Cloudflare account. example: "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3" type: string email: description: The email associated with the Cloudflare account. If an API key is provided (and not a token), this field is also required. example: "test-email@example.com" type: string name: description: The name of the Cloudflare account. example: "test-name" type: string resources: description: An allowlist of resources to restrict pulling metrics for including `'web', 'dns', 'lb' (load balancer), 'worker'`. example: ["web", "dns", "lb", "worker"] items: description: A Cloudflare resource type (for example, `web`, `dns`, `lb`, `worker`). type: string type: array zones: description: An allowlist of zones to restrict pulling metrics for. example: ["zone_id_1", "zone_id_2"] items: description: A Cloudflare zone ID to restrict pulling metrics for. type: string type: array required: - api_key - name type: object CloudflareAccountCreateRequestData: description: Data object for creating a Cloudflare account. properties: attributes: $ref: "#/components/schemas/CloudflareAccountCreateRequestAttributes" type: $ref: "#/components/schemas/CloudflareAccountType" required: - attributes - type type: object CloudflareAccountResponse: description: The expected response schema when getting a Cloudflare account. properties: data: $ref: "#/components/schemas/CloudflareAccountResponseData" type: object CloudflareAccountResponseAttributes: description: Attributes object of a Cloudflare account. properties: email: description: The email associated with the Cloudflare account. example: "test-email@example.com" type: string name: description: The name of the Cloudflare account. example: "test-name" type: string resources: description: An allowlist of resources, such as `web`, `dns`, `lb` (load balancer), `worker`, that restricts pulling metrics from those resources. example: ["web", "dns", "lb", "worker"] items: description: A Cloudflare resource type (for example, `web`, `dns`, `lb`, `worker`). type: string type: array zones: description: An allowlist of zones to restrict pulling metrics for. example: ["zone_id_1", "zone_id_2"] items: description: A Cloudflare zone ID to restrict pulling metrics for. type: string type: array required: - name type: object CloudflareAccountResponseData: description: Data object of a Cloudflare account. properties: attributes: $ref: "#/components/schemas/CloudflareAccountResponseAttributes" id: description: The ID of the Cloudflare account, a hash of the account name. example: "c1a8e059bfd1e911cf10b626340c9a54" type: string type: $ref: "#/components/schemas/CloudflareAccountType" required: - attributes - id - type type: object CloudflareAccountType: default: cloudflare-accounts description: The JSON:API type for this API. Should always be `cloudflare-accounts`. enum: - cloudflare-accounts example: cloudflare-accounts type: string x-enum-varnames: - CLOUDFLARE_ACCOUNTS CloudflareAccountUpdateRequest: description: Payload schema when updating a Cloudflare account. properties: data: $ref: "#/components/schemas/CloudflareAccountUpdateRequestData" required: - data type: object CloudflareAccountUpdateRequestAttributes: description: Attributes object for updating a Cloudflare account. properties: api_key: description: The API key of the Cloudflare account. example: "a94a8fe5ccb19ba61c4c0873d391e987982fbbd3" type: string email: description: The email associated with the Cloudflare account. If an API key is provided (and not a token), this field is also required. example: "test-email@example.com" type: string name: description: The name of the Cloudflare account. type: string resources: description: An allowlist of resources to restrict pulling metrics for including `'web', 'dns', 'lb' (load balancer), 'worker'`. example: ["web", "dns", "lb", "worker"] items: description: A Cloudflare resource type (for example, `web`, `dns`, `lb`, `worker`). type: string type: array zones: description: An allowlist of zones to restrict pulling metrics for. example: ["zone_id_1", "zone_id_2"] items: description: A Cloudflare zone ID to restrict pulling metrics for. type: string type: array required: - api_key type: object CloudflareAccountUpdateRequestData: description: Data object for updating a Cloudflare account. properties: attributes: $ref: "#/components/schemas/CloudflareAccountUpdateRequestAttributes" type: $ref: "#/components/schemas/CloudflareAccountType" type: object CloudflareAccountsResponse: description: The expected response schema when getting Cloudflare accounts. properties: data: description: The JSON:API data schema. items: $ref: "#/components/schemas/CloudflareAccountResponseData" type: array type: object CloudflareCredentials: description: The definition of the `CloudflareCredentials` object. oneOf: - $ref: "#/components/schemas/CloudflareAPIToken" - $ref: "#/components/schemas/CloudflareGlobalAPIToken" CloudflareCredentialsUpdate: description: The definition of the `CloudflareCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/CloudflareAPITokenUpdate" - $ref: "#/components/schemas/CloudflareGlobalAPITokenUpdate" CloudflareGlobalAPIToken: description: The definition of the `CloudflareGlobalAPIToken` object. properties: auth_email: $ref: "#/components/schemas/CloudflareGlobalAPITokenAuthEmail" global_api_key: $ref: "#/components/schemas/CloudflareGlobalAPITokenGlobalApiKey" type: $ref: "#/components/schemas/CloudflareGlobalAPITokenType" required: - type - auth_email - global_api_key type: object CloudflareGlobalAPITokenAuthEmail: description: The `CloudflareGlobalAPIToken` `auth_email`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" CloudflareGlobalAPITokenGlobalApiKey: description: The `CloudflareGlobalAPIToken` `global_api_key`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" CloudflareGlobalAPITokenType: description: The definition of the `CloudflareGlobalAPIToken` object. enum: - CloudflareGlobalAPIToken example: CloudflareGlobalAPIToken type: string x-enum-varnames: - CLOUDFLAREGLOBALAPITOKEN CloudflareGlobalAPITokenUpdate: description: The definition of the `CloudflareGlobalAPIToken` object. properties: auth_email: $ref: "#/components/schemas/CloudflareGlobalAPITokenUpdateAuthEmail" global_api_key: $ref: "#/components/schemas/CloudflareGlobalAPITokenUpdateGlobalApiKey" type: $ref: "#/components/schemas/CloudflareGlobalAPITokenType" required: - type type: object CloudflareGlobalAPITokenUpdateAuthEmail: description: The `CloudflareGlobalAPITokenUpdate` `auth_email`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" CloudflareGlobalAPITokenUpdateGlobalApiKey: description: The `CloudflareGlobalAPITokenUpdate` `global_api_key`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" CloudflareIntegration: description: The definition of the `CloudflareIntegration` object. properties: credentials: $ref: "#/components/schemas/CloudflareCredentials" type: $ref: "#/components/schemas/CloudflareIntegrationType" required: - type - credentials type: object CloudflareIntegrationType: description: The definition of the `CloudflareIntegrationType` object. enum: - Cloudflare example: Cloudflare type: string x-enum-varnames: - CLOUDFLARE CloudflareIntegrationUpdate: description: The definition of the `CloudflareIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/CloudflareCredentialsUpdate" type: $ref: "#/components/schemas/CloudflareIntegrationType" required: - type type: object CodeLocation: description: Code vulnerability location. properties: file_path: description: Vulnerability location file path. example: "src/Class.java:100" type: string location: description: Vulnerability extracted location. example: "com.example.Class:100" type: string method: description: Vulnerability location method. example: FooBar type: string required: - location type: object CommitCoverageSummaryRequest: description: Request object for getting code coverage summary for a commit. properties: data: $ref: "#/components/schemas/CommitCoverageSummaryRequestData" required: - data type: object CommitCoverageSummaryRequestAttributes: description: Attributes for requesting code coverage summary for a commit. properties: commit_sha: description: The commit SHA (40-character hexadecimal string). example: 66adc9350f2cc9b250b69abddab733dd55e1a588 pattern: "^[a-fA-F0-9]{40}$" type: string repository_id: deprecated: true description: "Deprecated: use `repository_url` instead. The repository URL." example: github.com/datadog/shopist minLength: 1 type: string repository_url: description: The repository URL. Accepts a full URL with or without a scheme (for example, `https://github.com/org/repo` or `github.com/org/repo`). example: https://github.com/datadog/shopist minLength: 1 type: string required: - commit_sha type: object CommitCoverageSummaryRequestData: description: Data object for commit summary request. properties: attributes: $ref: "#/components/schemas/CommitCoverageSummaryRequestAttributes" type: $ref: "#/components/schemas/CommitCoverageSummaryRequestType" required: - type - attributes type: object CommitCoverageSummaryRequestType: description: JSON:API type for commit coverage summary request. The value must always be `ci_app_coverage_commit_summary_request`. enum: - ci_app_coverage_commit_summary_request example: ci_app_coverage_commit_summary_request type: string x-enum-varnames: - CI_APP_COVERAGE_COMMIT_SUMMARY_REQUEST CommitmentsAwsEC2RICommitment: description: AWS EC2 Reserved Instance commitment details. properties: availability_zone: description: The availability zone of the reservation. example: us-east-1a type: string commitment_id: description: The unique identifier of the Reserved Instance. example: ri-0123456789abcdef0 type: string expiration_date: description: The expiration date of the commitment. example: "2025-12-31T00:00:00Z" type: string instance_type: description: The EC2 instance type. example: m5.xlarge type: string number_of_nfus: description: The number of Normalized Capacity Units. example: 8 format: double nullable: true type: number number_of_reservations: description: The number of reserved instances. example: 2 format: double nullable: true type: number offering_class: description: The offering class of the Reserved Instance. example: standard type: string operating_system: description: The operating system of the Reserved Instance. example: Linux type: string purchase_option: description: The payment option for the Reserved Instance. example: All Upfront type: string region: description: The AWS region of the Reserved Instance. example: us-east-1 type: string start_date: description: The start date of the commitment. example: "2023-01-01T00:00:00Z" type: string term_length_months: description: The commitment term in whole months. Omitted when the term is unknown. example: 12 format: int64 type: integer utilization: description: The utilization percentage of the commitment, from 0 to 100. example: 85.5 format: double type: number required: - commitment_id - instance_type - offering_class - operating_system - purchase_option - region type: object CommitmentsAwsElasticacheRICommitment: description: AWS ElastiCache Reserved Instance commitment details. properties: cache_engine: description: The cache engine type of the Reserved Instance. example: Redis type: string commitment_id: description: The unique identifier of the Reserved Instance. example: ri-0123456789abcdef0 type: string expiration_date: description: The expiration date of the commitment. example: "2025-12-31T00:00:00Z" type: string instance_type: description: The ElastiCache instance type. example: cache.m5.xlarge type: string number_of_nfus: description: The number of Normalized Capacity Units. example: 8 format: double nullable: true type: number number_of_reservations: description: The number of reserved instances. example: 2 format: double nullable: true type: number purchase_option: description: The payment option for the Reserved Instance. example: All Upfront type: string region: description: The AWS region of the Reserved Instance. example: us-east-1 type: string start_date: description: The start date of the commitment. example: "2023-01-01T00:00:00Z" type: string term_length_months: description: The commitment term in whole months. Omitted when the term is unknown. example: 12 format: int64 type: integer utilization: description: The utilization percentage of the commitment, from 0 to 100. example: 85.5 format: double type: number required: - cache_engine - commitment_id - instance_type - purchase_option - region type: object CommitmentsAwsRDSRICommitment: description: AWS RDS Reserved Instance commitment details. properties: commitment_id: description: The unique identifier of the Reserved Instance. example: ri-0123456789abcdef0 type: string database_engine: description: The database engine of the Reserved Instance. example: MySQL type: string expiration_date: description: The expiration date of the commitment. example: "2025-12-31T00:00:00Z" type: string instance_type: description: The RDS instance type. example: db.m5.xlarge type: string is_multi_az: description: Whether the Reserved Instance is Multi-AZ. example: false type: boolean number_of_nfus: description: The number of Normalized Capacity Units. example: 8 format: double nullable: true type: number number_of_reservations: description: The number of reserved instances. example: 2 format: double nullable: true type: number purchase_option: description: The payment option for the Reserved Instance. example: All Upfront type: string region: description: The AWS region of the Reserved Instance. example: us-east-1 type: string start_date: description: The start date of the commitment. example: "2023-01-01T00:00:00Z" type: string term_length_months: description: The commitment term in whole months. Omitted when the term is unknown. example: 12 format: int64 type: integer utilization: description: The utilization percentage of the commitment, from 0 to 100. example: 85.5 format: double type: number required: - commitment_id - database_engine - instance_type - purchase_option - region type: object CommitmentsAwsSPCommitment: description: AWS Savings Plan commitment details. properties: commitment_id: description: The unique identifier of the Savings Plan. example: arn:aws:savingsplans::123456789:savingsplan/abc123 type: string committed_spend_per_hour: description: The hourly committed spend for the Savings Plan. example: 1.5 format: double type: number expiration_date: description: The expiration date of the commitment. example: "2025-12-31T00:00:00Z" type: string instance_type_family: description: |- The EC2 instance family covered by the Savings Plan. Returned only for EC2 Instance Savings Plans. example: m5 type: string purchase_option: description: The payment option for the Savings Plan. example: All Upfront type: string region: description: The AWS region covered by the Savings Plan. Returned only for EC2 Instance Savings Plans. example: us-east-1 type: string savings_plan_type: description: The Savings Plan type. example: ComputeSavingsPlans type: string start_date: description: The start date of the commitment. example: "2023-01-01T00:00:00Z" type: string term_length_months: description: The commitment term in whole months. Omitted when the term is unknown. example: 12 format: int64 type: integer utilization: description: The utilization percentage of the commitment, from 0 to 100. example: 85.5 format: double type: number required: - commitment_id - purchase_option - savings_plan_type type: object CommitmentsAzureComputeSPCommitment: description: Azure Compute Savings Plan commitment details. properties: benefit_name: description: The display name of the Azure Savings Plan. example: my-compute-savings-plan type: string commitment_id: description: The unique identifier of the Savings Plan. example: /subscriptions/abc123/providers/Microsoft.BillingBenefits/savingsPlanOrders/xyz789 type: string committed_spend_per_hour: description: The hourly committed spend for the Savings Plan. example: 2.5 format: double type: number expiration_date: description: The expiration date of the commitment. example: "2025-12-31T00:00:00Z" type: string savings_plan_type: description: |- The Azure Savings Plan type, `Compute` or `Database`, based on the product order name. Omitted when the type can't be classified. example: Compute type: string start_date: description: The start date of the commitment. example: "2023-01-01T00:00:00Z" type: string term_length_months: description: The commitment term in whole months. Omitted when the term is unknown. example: 12 format: int64 type: integer utilization: description: The utilization percentage of the commitment, from 0 to 100. example: 85.5 format: double type: number required: - benefit_name - commitment_id type: object CommitmentsAzureVMRICommitment: description: Azure Virtual Machine Reserved Instance commitment details. properties: benefit_name: description: The display name of the Azure reservation. example: my-vm-reservation type: string commitment_id: description: The unique identifier of the Reserved Instance. example: /subscriptions/abc123/providers/Microsoft.Capacity/reservationOrders/xyz789 type: string expiration_date: description: The expiration date of the commitment. example: "2025-12-31T00:00:00Z" type: string instance_type: description: The Azure VM instance type. example: Standard_D4s_v3 type: string meter_sub_category: description: The Azure meter sub-category for the reservation. example: D4s v3 type: string product: description: The Azure product of the reservation. Omitted when it cannot be classified. example: VirtualMachines type: string region: description: The Azure region of the Reserved Instance. example: eastus type: string start_date: description: The start date of the commitment. example: "2023-01-01T00:00:00Z" type: string status: $ref: "#/components/schemas/CommitmentsAzureVMRIStatus" term_length_months: description: The commitment term in whole months. Omitted when the term is unknown. example: 12 format: int64 type: integer utilization: description: The utilization percentage of the commitment, from 0 to 100. example: 85.5 format: double type: number required: - benefit_name - commitment_id - instance_type - meter_sub_category - region - status type: object CommitmentsAzureVMRIStatus: description: Status of an Azure VM Reserved Instance. enum: - running - expired - cancelled example: running type: string x-enum-varnames: - RUNNING - EXPIRED - CANCELLED CommitmentsCommitmentType: description: Type of commitment. ri for Reserved Instances, sp for Savings Plans. enum: - ri - sp example: ri type: string x-enum-varnames: - RESERVED_INSTANCES - SAVINGS_PLANS CommitmentsCoverageScalarResponse: description: Response containing scalar coverage metrics for cloud commitment programs. properties: columns: $ref: "#/components/schemas/CommitmentsScalarColumns" required: - columns type: object CommitmentsCoverageTimeseriesResponse: description: Response containing timeseries coverage metrics for cloud commitment programs. properties: cost: $ref: "#/components/schemas/CommitmentsTimeseriesMetric" hours: $ref: "#/components/schemas/CommitmentsTimeseriesMetric" required: - cost - hours type: object CommitmentsListItem: description: A commitment item, which varies based on the provider, product, and commitment type. oneOf: - $ref: "#/components/schemas/CommitmentsAwsEC2RICommitment" - $ref: "#/components/schemas/CommitmentsAwsRDSRICommitment" - $ref: "#/components/schemas/CommitmentsAwsElasticacheRICommitment" - $ref: "#/components/schemas/CommitmentsAwsSPCommitment" - $ref: "#/components/schemas/CommitmentsAzureVMRICommitment" - $ref: "#/components/schemas/CommitmentsAzureComputeSPCommitment" CommitmentsListItems: description: Array of commitment items. example: - commitment_id: ri-0123456789abcdef0 instance_type: m5.xlarge offering_class: standard operating_system: Linux purchase_option: All Upfront region: us-east-1 items: $ref: "#/components/schemas/CommitmentsListItem" type: array CommitmentsListMeta: description: Metadata for a commitments list response. properties: committed_spend_unit: $ref: "#/components/schemas/CommitmentsUnit" unused_cost_unavailable: description: |- Whether Azure cost data lacks the unused cost of some commitments, for example when an export is scoped below the billing profile. When `true`, utilization is overstated. example: true type: boolean type: object CommitmentsListResponse: description: Response containing a list of cloud commitment details. properties: data: $ref: "#/components/schemas/CommitmentsListResponseData" required: - data type: object CommitmentsListResponseAttributes: description: Attributes of a commitments list response. properties: commitments: $ref: "#/components/schemas/CommitmentsListItems" meta: $ref: "#/components/schemas/CommitmentsListMeta" query_definition: $ref: "#/components/schemas/CommitmentsQueryDefinition" required: - commitments type: object CommitmentsListResponseData: description: The commitments list resource. properties: attributes: $ref: "#/components/schemas/CommitmentsListResponseAttributes" id: description: The identifier of the commitments list response. example: commitments_list_response type: string type: $ref: "#/components/schemas/CommitmentsListResponseType" required: - attributes - id - type type: object CommitmentsListResponseType: default: commitments_list_response description: Type of the commitments list response resource. enum: - commitments_list_response example: commitments_list_response type: string x-enum-varnames: - COMMITMENTS_LIST_RESPONSE CommitmentsOnDemandHotspotsScalarMeta: description: Metadata for the on-demand hot-spots scalar response. properties: on_demand_filters: description: Active on-demand filters applied to the response. example: "region:us-east-1" type: string required: - on_demand_filters type: object CommitmentsOnDemandHotspotsScalarResponse: description: Response containing scalar on-demand hot-spots data for cloud commitment programs. properties: columns: $ref: "#/components/schemas/CommitmentsScalarColumns" meta: $ref: "#/components/schemas/CommitmentsOnDemandHotspotsScalarMeta" total: $ref: "#/components/schemas/CommitmentsScalarColumns" required: - columns - total type: object CommitmentsProvider: description: Cloud provider for commitment programs. enum: - aws - azure example: aws type: string x-enum-varnames: - AWS - AZURE CommitmentsQueryDefinition: description: |- The query that produces the response values, in the same format as dashboard and notebook widget requests, so a client can graph the values in a widget. Each formula's `id` names the response value that it produces. properties: formulas: $ref: "#/components/schemas/CommitmentsQueryDefinitionFormulas" queries: $ref: "#/components/schemas/CommitmentsQueryDefinitionQueries" required: - formulas - queries type: object CommitmentsQueryDefinitionAggregator: description: The reducer a scalar widget applies to the query. enum: - sum - avg - min - max example: sum type: string x-enum-varnames: - SUM - AVG - MIN - MAX CommitmentsQueryDefinitionDataSource: description: The data source of the query. enum: - cloud_cost - metrics example: cloud_cost type: string x-enum-varnames: - CLOUD_COST - METRICS CommitmentsQueryDefinitionFormula: description: A formula of a query definition. properties: formula: description: The formula expression over the named queries. example: used / (used + unused) * 100 type: string id: description: The name of the response value the formula produces. example: utilization type: string required: - formula - id type: object CommitmentsQueryDefinitionFormulas: description: The formulas of a query definition. items: $ref: "#/components/schemas/CommitmentsQueryDefinitionFormula" type: array CommitmentsQueryDefinitionQueries: description: The metric queries of a query definition. items: $ref: "#/components/schemas/CommitmentsQueryDefinitionQuery" type: array CommitmentsQueryDefinitionQuery: description: A metric query of a query definition. properties: aggregator: $ref: "#/components/schemas/CommitmentsQueryDefinitionAggregator" data_source: $ref: "#/components/schemas/CommitmentsQueryDefinitionDataSource" name: description: The name formulas use to reference the query. example: used type: string query: description: The metric query. example: "sum:aws.cost.amortized{aws_cost_type:SavingsPlanCoveredUsage}.rollup(sum, daily)" type: string required: - aggregator - data_source - name - query type: object CommitmentsSavingsScalarResponse: description: Response containing scalar savings metrics for cloud commitment programs. properties: columns: $ref: "#/components/schemas/CommitmentsScalarColumns" required: - columns type: object CommitmentsSavingsTimeseriesResponse: description: Response containing timeseries savings metrics for cloud commitment programs. properties: actual_cost: $ref: "#/components/schemas/CommitmentsTimeseriesMetric" effective_savings_rate: $ref: "#/components/schemas/CommitmentsTimeseriesMetric" on_demand_equivalent_cost: $ref: "#/components/schemas/CommitmentsTimeseriesMetric" realized_savings: $ref: "#/components/schemas/CommitmentsTimeseriesMetric" required: - actual_cost - effective_savings_rate - on_demand_equivalent_cost - realized_savings type: object CommitmentsScalarColumn: description: A column in a scalar response. When type is "group", values contains arrays of strings. When type is "number", values contains numeric values. properties: meta: $ref: "#/components/schemas/CommitmentsScalarColumnMeta" name: description: The column name. example: utilization type: string type: $ref: "#/components/schemas/CommitmentsScalarColumnType" values: $ref: "#/components/schemas/CommitmentsScalarColumnValueItems" required: - name - type - values type: object CommitmentsScalarColumnMeta: description: Metadata for a scalar column, including unit information. properties: unit: $ref: "#/components/schemas/CommitmentsUnit" required: - unit type: object CommitmentsScalarColumnType: description: The column type. "group" for dimension columns, "number" for metric columns. enum: - group - number example: group type: string x-enum-varnames: - GROUP - NUMBER CommitmentsScalarColumnValueItems: description: Values for a scalar column. Arrays of strings for group columns, numbers for value columns. example: - 0.85 - 0.72 items: description: A scalar column value, either a group key (string) or a numeric metric. type: array CommitmentsScalarColumns: description: Array of scalar columns in the response. items: $ref: "#/components/schemas/CommitmentsScalarColumn" type: array CommitmentsTimeseriesMetric: description: A timeseries metric containing timestamps, series values, and optional unit metadata. properties: series: $ref: "#/components/schemas/CommitmentsTimeseriesSeries" times: $ref: "#/components/schemas/CommitmentsTimestamps" unit: $ref: "#/components/schemas/CommitmentsUnit" required: - series - times type: object CommitmentsTimeseriesSeries: additionalProperties: $ref: "#/components/schemas/CommitmentsTimeseriesValues" description: Timeseries data as a map of series names to their corresponding value arrays. type: object CommitmentsTimeseriesValues: description: A series of numeric values for a timeseries metric. items: description: A single numeric value in the timeseries. format: double type: number type: array CommitmentsTimestamps: description: Unix timestamps in seconds for the timeseries data points. example: - 1693526400 - 1693612800 items: description: A Unix timestamp in seconds. format: int64 type: integer type: array CommitmentsUnit: description: Unit metadata for a numeric metric. properties: family: description: The unit family (for example, percentage or money). example: percentage type: string id: description: The unit identifier. example: 17 format: int64 type: integer name: description: The unit name (for example, percent or dollar). example: percent type: string plural: description: The plural form of the unit name. example: percent type: string scale_factor: description: The scale factor for the unit. example: 1 format: double type: number short_name: description: The abbreviated unit name (for example, % or $). example: "%" type: string required: - family - id - name - plural - scale_factor - short_name type: object CommitmentsUtilizationScalarProductBreakdown: description: Array of per-product utilization breakdown entries. items: $ref: "#/components/schemas/CommitmentsUtilizationScalarProductBreakdownEntry" type: array CommitmentsUtilizationScalarProductBreakdownEntry: description: Per-product utilization data in a scalar utilization response. properties: product: description: The cloud product name. example: ec2 type: string utilization: description: The utilization percentage for the product. example: 0.85 format: double type: number required: - product - utilization type: object CommitmentsUtilizationScalarResponse: description: Response containing scalar utilization metrics for cloud commitment programs. properties: columns: $ref: "#/components/schemas/CommitmentsScalarColumns" product_breakdown: $ref: "#/components/schemas/CommitmentsUtilizationScalarProductBreakdown" required: - columns type: object CommitmentsUtilizationTimeseriesResponse: description: Response containing timeseries utilization metrics for cloud commitment programs. properties: series: $ref: "#/components/schemas/CommitmentsTimeseriesSeries" times: $ref: "#/components/schemas/CommitmentsTimestamps" unit: $ref: "#/components/schemas/CommitmentsUnit" required: - series - times type: object CompletionCondition: additionalProperties: false description: The definition of `CompletionCondition` object. properties: operand1: description: The `CompletionCondition` `operand1`. operand2: description: The `CompletionCondition` `operand2`. operator: $ref: "#/components/schemas/CompletionConditionOperator" required: - operand1 - operator type: object CompletionConditionOperator: description: The definition of `CompletionConditionOperator` object. enum: - OPERATOR_EQUAL - OPERATOR_NOT_EQUAL - OPERATOR_GREATER_THAN - OPERATOR_LESS_THAN - OPERATOR_GREATER_THAN_OR_EQUAL_TO - OPERATOR_LESS_THAN_OR_EQUAL_TO - OPERATOR_CONTAINS - OPERATOR_DOES_NOT_CONTAIN - OPERATOR_IS_NULL - OPERATOR_IS_NOT_NULL - OPERATOR_IS_EMPTY - OPERATOR_IS_NOT_EMPTY example: OPERATOR_EQUAL type: string x-enum-varnames: - OPERATOR_EQUAL - OPERATOR_NOT_EQUAL - OPERATOR_GREATER_THAN - OPERATOR_LESS_THAN - OPERATOR_GREATER_THAN_OR_EQUAL_TO - OPERATOR_LESS_THAN_OR_EQUAL_TO - OPERATOR_CONTAINS - OPERATOR_DOES_NOT_CONTAIN - OPERATOR_IS_NULL - OPERATOR_IS_NOT_NULL - OPERATOR_IS_EMPTY - OPERATOR_IS_NOT_EMPTY CompletionGate: additionalProperties: false description: Used to create conditions before running subsequent actions. properties: completionCondition: $ref: "#/components/schemas/CompletionCondition" retryStrategy: $ref: "#/components/schemas/RetryStrategy" required: - completionCondition - retryStrategy type: object Component: description: "[Definition of a UI component in the app](https://docs.datadoghq.com/service_management/app_builder/components/)" properties: events: description: Events to listen for on the UI component. items: $ref: "#/components/schemas/AppBuilderEvent" type: array id: description: The ID of the UI component. This property is deprecated; use `name` to identify individual components instead. nullable: true type: string name: description: A unique identifier for this UI component. This name is also visible in the app editor. example: "" type: string properties: $ref: "#/components/schemas/ComponentProperties" type: $ref: "#/components/schemas/ComponentType" required: - name - type - properties type: object ComponentGrid: description: A grid component. The grid component is the root canvas for an app and contains all other components. properties: events: description: Events to listen for on the grid component. items: $ref: "#/components/schemas/AppBuilderEvent" type: array id: description: The ID of the grid component. This property is deprecated; use `name` to identify individual components instead. type: string name: description: A unique identifier for this grid component. This name is also visible in the app editor. example: "" type: string properties: $ref: "#/components/schemas/ComponentGridProperties" type: $ref: "#/components/schemas/ComponentGridType" required: - name - type - properties type: object ComponentGridProperties: description: Properties of a grid component. properties: backgroundColor: default: default description: The background color of the grid. type: string children: description: The child components of the grid. items: $ref: "#/components/schemas/Component" type: array isVisible: $ref: "#/components/schemas/ComponentGridPropertiesIsVisible" type: object ComponentGridPropertiesIsVisible: description: Whether the grid component and its children are visible. If a string, it must be a valid JavaScript expression that evaluates to a boolean. oneOf: - type: string - default: true type: boolean ComponentGridType: default: grid description: The grid component type. enum: - grid example: grid type: string x-enum-varnames: - GRID ComponentProperties: additionalProperties: {} description: Properties of a UI component. Different component types can have their own additional unique properties. See the [components documentation](https://docs.datadoghq.com/service_management/app_builder/components/) for more detail on each component type and its properties. properties: children: description: The child components of the UI component. items: $ref: "#/components/schemas/Component" type: array isVisible: $ref: "#/components/schemas/ComponentPropertiesIsVisible" type: object ComponentPropertiesIsVisible: description: Whether the UI component is visible. If this is a string, it must be a valid JavaScript expression that evaluates to a boolean. oneOf: - type: boolean - description: "If this is a string, it must be a valid JavaScript expression that evaluates to a boolean." example: "${true}" type: string ComponentType: description: The UI component type. enum: - table - textInput - textArea - button - text - select - modal - schemaForm - checkbox - tabs - vegaChart - radioButtons - numberInput - fileInput - jsonInput - gridCell - dateRangePicker - search - container - calloutValue example: text type: string x-enum-varnames: - TABLE - TEXTINPUT - TEXTAREA - BUTTON - TEXT - SELECT - MODAL - SCHEMAFORM - CHECKBOX - TABS - VEGACHART - RADIOBUTTONS - NUMBERINPUT - FILEINPUT - JSONINPUT - GRIDCELL - DATERANGEPICKER - SEARCH - CONTAINER - CALLOUTVALUE Condition: description: |- Targeting condition details. A condition is either an inline predicate with `operator`, `attribute`, and `value`, or a reference to a saved filter with `saved_filter_id`. The inline fields are omitted for saved-filter references. properties: attribute: description: The user or request attribute to evaluate. Omitted for saved-filter references. example: "country" type: string created_at: description: The timestamp when the condition was created. example: "2024-01-01T12:00:00Z" format: date-time type: string id: description: The unique identifier of the condition. example: "550e8400-e29b-41d4-a716-446655440070" format: uuid type: string operator: $ref: "#/components/schemas/ConditionOperator" saved_filter_id: description: The ID of the saved filter referenced by this condition, or null for inline conditions. example: "550e8400-e29b-41d4-a716-446655440090" format: uuid nullable: true type: string updated_at: description: The timestamp when the condition was last updated. example: "2024-01-01T12:00:00Z" format: date-time type: string value: description: Values used by the selected operator. Omitted for saved-filter references. example: ["US", "CA"] items: description: Target value for the selected operator. type: string type: array required: - id - created_at - updated_at type: object ConditionOperator: description: The operator used in a targeting condition. enum: - LT - LTE - GT - GTE - MATCHES - NOT_MATCHES - ONE_OF - NOT_ONE_OF - IS_NULL - EQUALS example: "ONE_OF" type: string x-enum-varnames: - LT - LTE - GT - GTE - MATCHES - NOT_MATCHES - ONE_OF - NOT_ONE_OF - IS_NULL - EQUALS ConditionRequest: description: |- Condition request payload for targeting rules. A condition is either an inline predicate with `operator`, `attribute`, and `value`, or a reference to a saved filter with `saved_filter_id`. The two shapes are mutually exclusive. properties: attribute: description: The user or request attribute to evaluate. Required for inline conditions; omit when `saved_filter_id` is set. example: "user_tier" type: string operator: $ref: "#/components/schemas/ConditionOperator" saved_filter_id: description: |- The ID of a saved filter to reference as this condition. Mutually exclusive with `operator`, `attribute`, and `value`. When set, the saved filter's targeting rules are evaluated in place of an inline predicate. example: "550e8400-e29b-41d4-a716-446655440090" format: uuid type: string value: description: Values used by the selected operator. Required for inline conditions; omit when `saved_filter_id` is set. example: ["premium", "enterprise"] items: description: Target value for the selected operator. type: string type: array type: object ConfigCatCredentials: description: The definition of the `ConfigCatCredentials` object. oneOf: - $ref: "#/components/schemas/ConfigCatSDKKey" ConfigCatCredentialsUpdate: description: The definition of the `ConfigCatCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/ConfigCatSDKKeyUpdate" ConfigCatIntegration: description: The definition of the `ConfigCatIntegration` object. properties: credentials: $ref: "#/components/schemas/ConfigCatCredentials" type: $ref: "#/components/schemas/ConfigCatIntegrationType" required: - type - credentials type: object ConfigCatIntegrationType: description: The definition of the `ConfigCatIntegrationType` object. enum: - ConfigCat example: ConfigCat type: string x-enum-varnames: - CONFIGCAT ConfigCatIntegrationUpdate: description: The definition of the `ConfigCatIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/ConfigCatCredentialsUpdate" type: $ref: "#/components/schemas/ConfigCatIntegrationType" required: - type type: object ConfigCatSDKKey: description: The definition of the `ConfigCatSDKKey` object. properties: api_password: $ref: "#/components/schemas/ConfigCatSDKKeyApiPassword" api_username: $ref: "#/components/schemas/ConfigCatSDKKeyApiUsername" sdk_key: $ref: "#/components/schemas/ConfigCatSDKKeySdkKey" type: $ref: "#/components/schemas/ConfigCatSDKKeyType" required: - type - sdk_key - api_username - api_password type: object ConfigCatSDKKeyApiPassword: description: The `ConfigCatSDKKey` `api_password`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" ConfigCatSDKKeyApiUsername: description: The `ConfigCatSDKKey` `api_username`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" ConfigCatSDKKeySdkKey: description: The `ConfigCatSDKKey` `sdk_key`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" ConfigCatSDKKeyType: description: The definition of the `ConfigCatSDKKey` object. enum: - ConfigCatSDKKey example: ConfigCatSDKKey type: string x-enum-varnames: - CONFIGCATSDKKEY ConfigCatSDKKeyUpdate: description: The definition of the `ConfigCatSDKKey` object. properties: api_password: $ref: "#/components/schemas/ConfigCatSDKKeyUpdateApiPassword" api_username: $ref: "#/components/schemas/ConfigCatSDKKeyUpdateApiUsername" sdk_key: $ref: "#/components/schemas/ConfigCatSDKKeyUpdateSdkKey" type: $ref: "#/components/schemas/ConfigCatSDKKeyType" required: - type type: object ConfigCatSDKKeyUpdateApiPassword: description: The `ConfigCatSDKKeyUpdate` `api_password`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" ConfigCatSDKKeyUpdateApiUsername: description: The `ConfigCatSDKKeyUpdate` `api_username`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" ConfigCatSDKKeyUpdateSdkKey: description: The `ConfigCatSDKKeyUpdate` `sdk_key`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" ConfiguredSchedule: description: "Full resource representation of a configured schedule target with position (previous, current, or next)." properties: attributes: $ref: "#/components/schemas/ConfiguredScheduleTargetAttributes" id: description: "Specifies the unique identifier of the configured schedule target." example: "00000000-aba1-0000-0000-000000000000_previous" type: string relationships: $ref: "#/components/schemas/ConfiguredScheduleTargetRelationships" type: $ref: "#/components/schemas/ConfiguredScheduleTargetType" required: - type - id - attributes - relationships type: object ConfiguredScheduleTarget: description: "Relationship reference to a configured schedule target." properties: id: description: "Specifies the unique identifier of the configured schedule target." example: "00000000-aba1-0000-0000-000000000000_previous" type: string type: $ref: "#/components/schemas/ConfiguredScheduleTargetType" required: - type - id type: object ConfiguredScheduleTargetAttributes: description: "Attributes for a configured schedule target, including position." example: position: previous properties: position: $ref: "#/components/schemas/ScheduleTargetPosition" required: - position type: object ConfiguredScheduleTargetRelationships: description: "Represents the relationships of a configured schedule target." properties: schedule: $ref: "#/components/schemas/ConfiguredScheduleTargetRelationshipsSchedule" required: - schedule type: object ConfiguredScheduleTargetRelationshipsSchedule: description: "Holds the schedule reference for a configured schedule target." properties: data: $ref: "#/components/schemas/ScheduleTarget" required: - data type: object ConfiguredScheduleTargetType: default: schedule_target description: "Indicates that the resource is of type `schedule_target`." enum: - schedule_target example: schedule_target type: string x-enum-varnames: - SCHEDULE_TARGET ConfluencePostmortemSettings: description: Settings for a postmortem template stored in Confluence. Required when `location` is `confluence`. properties: account_id: description: The ID of the Confluence integration account. example: "123456" type: string parent_id: description: The ID of the parent Confluence page under which postmortems are created. example: "345678" nullable: true type: string space_id: description: The ID of the Confluence space where postmortems are created. example: "789012" type: string required: - account_id - space_id type: object ConfluentAccountCreateRequest: description: Payload schema when adding a Confluent account. properties: data: $ref: "#/components/schemas/ConfluentAccountCreateRequestData" required: - data type: object ConfluentAccountCreateRequestAttributes: description: Attributes associated with the account creation request. properties: api_key: description: The API key associated with your Confluent account. example: "TESTAPIKEY123" type: string api_secret: description: The API secret associated with your Confluent account. example: "test-api-secret-123" type: string resources: description: A list of Confluent resources associated with the Confluent account. items: $ref: "#/components/schemas/ConfluentAccountResourceAttributes" type: array tags: description: A list of strings representing tags. Can be a single key, or key-value pairs separated by a colon. example: - myTag - myTag2:myValue items: description: A tag for the Confluent resource. Can be a single key or a key-value pair separated by a colon. type: string type: array required: - api_key - api_secret type: object ConfluentAccountCreateRequestData: description: The data body for adding a Confluent account. properties: attributes: $ref: "#/components/schemas/ConfluentAccountCreateRequestAttributes" type: $ref: "#/components/schemas/ConfluentAccountType" required: - attributes - type type: object ConfluentAccountResourceAttributes: description: Attributes object for updating a Confluent resource. properties: enable_custom_metrics: default: false description: Enable the `custom.consumer_lag_offset` metric, which contains extra metric tags. example: false type: boolean id: description: The ID associated with a Confluent resource. example: "resource-id-123" type: string resource_type: description: The resource type of the Resource. Can be `kafka`, `connector`, `ksql`, `schema_registry`, or `flink`. example: kafka type: string tags: description: A list of strings representing tags. Can be a single key, or key-value pairs separated by a colon. example: - myTag - myTag2:myValue items: description: A tag for the Confluent resource. Can be a single key or a key-value pair separated by a colon. type: string type: array required: - resource_type type: object ConfluentAccountResponse: description: The expected response schema when getting a Confluent account. properties: data: $ref: "#/components/schemas/ConfluentAccountResponseData" type: object ConfluentAccountResponseAttributes: description: The attributes of a Confluent account. properties: api_key: description: The API key associated with your Confluent account. example: "TESTAPIKEY123" type: string resources: description: A list of Confluent resources associated with the Confluent account. items: $ref: "#/components/schemas/ConfluentResourceResponseAttributes" type: array tags: description: A list of strings representing tags. Can be a single key, or key-value pairs separated by a colon. example: - myTag - myTag2:myValue items: description: A tag for the Confluent resource. Can be a single key or a key-value pair separated by a colon. type: string type: array required: - api_key type: object ConfluentAccountResponseData: description: An API key and API secret pair that represents a Confluent account. properties: attributes: $ref: "#/components/schemas/ConfluentAccountResponseAttributes" id: description: A randomly generated ID associated with a Confluent account. example: "account_id_abc123" type: string type: $ref: "#/components/schemas/ConfluentAccountType" required: - attributes - id - type type: object ConfluentAccountType: default: confluent-cloud-accounts description: The JSON:API type for this API. Should always be `confluent-cloud-accounts`. enum: - confluent-cloud-accounts example: confluent-cloud-accounts type: string x-enum-varnames: - "CONFLUENT_CLOUD_ACCOUNTS" ConfluentAccountUpdateRequest: description: The JSON:API request for updating a Confluent account. properties: data: $ref: "#/components/schemas/ConfluentAccountUpdateRequestData" required: - data type: object ConfluentAccountUpdateRequestAttributes: description: Attributes object for updating a Confluent account. properties: api_key: description: The API key associated with your Confluent account. example: "TESTAPIKEY123" type: string api_secret: description: The API secret associated with your Confluent account. example: "test-api-secret-123" type: string tags: description: A list of strings representing tags. Can be a single key, or key-value pairs separated by a colon. example: - myTag - myTag2:myValue items: description: A tag for the Confluent resource. Can be a single key or a key-value pair separated by a colon. type: string type: array required: - api_key - api_secret type: object ConfluentAccountUpdateRequestData: description: Data object for updating a Confluent account. properties: attributes: $ref: "#/components/schemas/ConfluentAccountUpdateRequestAttributes" type: $ref: "#/components/schemas/ConfluentAccountType" required: - attributes - type type: object ConfluentAccountsResponse: description: Confluent account returned by the API. properties: data: description: The Confluent account. items: $ref: "#/components/schemas/ConfluentAccountResponseData" type: array type: object ConfluentResourceRequest: description: The JSON:API request for updating a Confluent resource. properties: data: $ref: "#/components/schemas/ConfluentResourceRequestData" required: - data type: object ConfluentResourceRequestAttributes: description: Attributes object for updating a Confluent resource. properties: enable_custom_metrics: default: false description: Enable the `custom.consumer_lag_offset` metric, which contains extra metric tags. example: false type: boolean resource_type: description: The resource type of the Resource. Can be `kafka`, `connector`, `ksql`, `schema_registry`, or `flink`. example: kafka type: string tags: description: A list of strings representing tags. Can be a single key, or key-value pairs separated by a colon. example: - myTag - myTag2:myValue items: description: A tag for the Confluent resource. Can be a single key or a key-value pair separated by a colon. type: string type: array required: - resource_type type: object ConfluentResourceRequestData: description: JSON:API request for updating a Confluent resource. properties: attributes: $ref: "#/components/schemas/ConfluentResourceRequestAttributes" id: description: The ID associated with a Confluent resource. example: "resource-id-123" type: string type: $ref: "#/components/schemas/ConfluentResourceType" required: - attributes - type - id type: object ConfluentResourceResponse: description: Response schema when interacting with a Confluent resource. properties: data: $ref: "#/components/schemas/ConfluentResourceResponseData" type: object ConfluentResourceResponseAttributes: description: Model representation of a Confluent Cloud resource. properties: enable_custom_metrics: default: false description: Enable the `custom.consumer_lag_offset` metric, which contains extra metric tags. example: false type: boolean id: description: The ID associated with the Confluent resource. example: "resource_id_abc123" type: string resource_type: description: The resource type of the Resource. Can be `kafka`, `connector`, `ksql`, `schema_registry`, or `flink`. example: kafka type: string tags: description: A list of strings representing tags. Can be a single key, or key-value pairs separated by a colon. example: - myTag - myTag2:myValue items: description: A tag for the Confluent resource. Can be a single key or a key-value pair separated by a colon. type: string type: array required: - resource_type type: object ConfluentResourceResponseData: description: Confluent Cloud resource data. properties: attributes: $ref: "#/components/schemas/ConfluentResourceResponseAttributes" id: description: The ID associated with the Confluent resource. example: "resource_id_abc123" type: string type: $ref: "#/components/schemas/ConfluentResourceType" required: - attributes - type - id type: object ConfluentResourceType: default: confluent-cloud-resources description: The JSON:API type for this request. enum: - confluent-cloud-resources example: "confluent-cloud-resources" type: string x-enum-varnames: - "CONFLUENT_CLOUD_RESOURCES" ConfluentResourcesResponse: description: Response schema when interacting with a list of Confluent resources. properties: data: description: The JSON:API data attribute. items: $ref: "#/components/schemas/ConfluentResourceResponseData" type: array type: object ConnectedTeamRef: description: Reference to a team from an external system. properties: data: $ref: "#/components/schemas/ConnectedTeamRefData" type: object ConnectedTeamRefData: description: Reference to connected external team. properties: id: description: |- The connected team ID as it is referenced throughout the Datadog ecosystem. For GitHub teams, this is `@/`. For ServiceNow groups, this is `/`. example: "@GitHubOrg/team-handle" type: string type: $ref: "#/components/schemas/ConnectedTeamRefDataType" required: - id - type type: object ConnectedTeamRefDataType: default: "github_team" description: External team resource type. enum: - github_team - servicenow_team example: "github_team" type: string x-enum-varnames: - GITHUB_TEAM - SERVICENOW_TEAM Connection: description: The definition of `Connection` object. properties: connectionId: description: The `Connection` `connectionId`. example: "" type: string label: description: The `Connection` `label`. example: "" type: string required: - connectionId - label type: object ConnectionEnv: description: "A list of connections or connection groups used in the workflow." properties: connectionGroups: description: The `ConnectionEnv` `connectionGroups`. items: $ref: "#/components/schemas/ConnectionGroup" type: array connections: description: The `ConnectionEnv` `connections`. items: $ref: "#/components/schemas/Connection" type: array env: $ref: "#/components/schemas/ConnectionEnvEnv" required: - env type: object ConnectionEnvEnv: description: The definition of `ConnectionEnvEnv` object. enum: - default example: default type: string x-enum-varnames: - DEFAULT ConnectionGroup: description: The definition of `ConnectionGroup` object. properties: connectionGroupId: description: The `ConnectionGroup` `connectionGroupId`. example: "" type: string label: description: The `ConnectionGroup` `label`. example: "" type: string tags: description: The `ConnectionGroup` `tags`. example: - "" items: description: A tag string in `key:value` format. type: string type: array required: - connectionGroupId - label - tags type: object ConnectionsPagePagination: description: Page-based pagination metadata. properties: first_number: description: The first page number. format: int64 type: integer first_offset: description: The first offset. format: int64 type: integer last_number: description: The last page number. format: int64 type: integer last_offset: description: The last offset. format: int64 nullable: true type: integer limit: description: The page limit, when offset pagination is used. format: int64 type: integer next_number: description: The next page number. format: int64 nullable: true type: integer next_offset: description: The next offset. format: int64 nullable: true type: integer number: description: The current page number. format: int64 type: integer offset: description: The current offset, when offset pagination is used. format: int64 type: integer prev_number: description: The previous page number. format: int64 nullable: true type: integer prev_offset: description: The previous offset. format: int64 nullable: true type: integer size: description: The page size. format: int64 type: integer total: description: Total connections matching request. format: int64 type: integer type: description: Pagination type. example: "number_size" type: string type: object ConnectionsResponseMeta: description: Connections response metadata. properties: page: $ref: "#/components/schemas/ConnectionsPagePagination" type: object Container: description: Container object. properties: attributes: $ref: "#/components/schemas/ContainerAttributes" id: description: Container ID. type: string type: $ref: "#/components/schemas/ContainerType" type: object ContainerAttributes: description: |- Attributes for a container. For CPU or memory metrics, use its full `container_id` as `container_id:` in `tag_filters` with the `container` data source. properties: container_id: description: The ID of the container. type: string created_at: description: Time the container was created. type: string host: description: Hostname of the host running the container. type: string image_digest: description: Digest of the compressed image manifest. nullable: true type: string image_name: description: Name of the associated container image. type: string image_tags: description: List of image tags associated with the container image. items: description: An image tag associated with the container. type: string nullable: true type: array name: description: Name of the container. type: string started_at: description: Time the container was started. type: string state: description: State of the container. This depends on the container runtime. type: string tags: description: List of tags associated with the container. items: description: A tag associated with the container. type: string type: array type: object ContainerDataSource: default: container description: A data source for container-level infrastructure metrics. enum: - container example: container type: string x-enum-varnames: - CONTAINER ContainerGroup: description: Container group object. properties: attributes: $ref: "#/components/schemas/ContainerGroupAttributes" id: description: Container Group ID. type: string relationships: $ref: "#/components/schemas/ContainerGroupRelationships" type: $ref: "#/components/schemas/ContainerGroupType" type: object ContainerGroupAttributes: description: Attributes for a container group. properties: count: description: >- Number of containers in the group. A container with multiple values for a grouping tag can appear in multiple groups. Summing group counts can overcount distinct containers. format: int64 type: integer tags: description: Tags from the group name parsed in key/value format. type: object type: object ContainerGroupRelationships: description: Relationships to containers inside a container group. properties: containers: $ref: "#/components/schemas/ContainerGroupRelationshipsLink" type: object ContainerGroupRelationshipsData: description: |- This array is always empty, even when the group includes containers. To retrieve the containers in this group, make a new request to this endpoint with the `filter[tags]` value from `links.related`, using your site's API host. items: description: A link data. type: string type: array ContainerGroupRelationshipsLink: description: Relationships to Containers inside a Container Group. properties: data: $ref: "#/components/schemas/ContainerGroupRelationshipsData" links: $ref: "#/components/schemas/ContainerGroupRelationshipsLinks" type: object ContainerGroupRelationshipsLinks: description: Links attributes. properties: related: description: Link to related containers. type: string type: object ContainerGroupType: default: container_group description: Type of container group. enum: - container_group example: container_group type: string x-enum-varnames: - CONTAINER_GROUP ContainerImage: description: Container Image object. properties: attributes: $ref: "#/components/schemas/ContainerImageAttributes" id: description: |- Opaque Container Image ID. Often contains a registry, repository, and digest, but the format varies by collection source. Preserve the returned value rather than constructing an ID. type: string type: $ref: "#/components/schemas/ContainerImageType" type: object ContainerImageAttributes: description: Attributes for a Container Image. properties: container_count: description: Number of containers running the image. format: int64 type: integer image_flavors: description: |- Platform-specific image metadata, including size in bytes and available build and operating system details. Use these objects to associate sizes with platforms when platform information is available. items: $ref: "#/components/schemas/ContainerImageFlavor" type: array image_tags: description: |- Image version tags, such as `latest` or `v1.2.3`. Tags can change; use the returned `id` to identify an image record. The corresponding filter and grouping key is `image_tag`. items: description: An image tag associated with the Container Image. type: string type: array images_built_at: description: |- List of build times associated with the Container Image. The list contains more than 1 entry for multi-architecture images. items: description: Time the platform-specific Container Image was built. type: string type: array name: description: Name of the Container Image. type: string os_architectures: description: List of Operating System architectures supported by the Container Image. items: description: Operating System architecture supported by the Container Image. example: amd64 type: string type: array os_names: description: List of Operating System names supported by the Container Image. items: description: Operating System supported by the Container Image. example: linux type: string type: array os_versions: description: List of Operating System versions supported by the Container Image. items: description: Operating System version supported by the Container Image. type: string type: array published_at: description: Time the image was pushed to the container registry. type: string registry: description: Registry where the image is stored. Use the `image_registry` tag key for filtering and grouping. type: string repo_digest: description: |- Digest of the compressed image manifest. Use the `repo_digest` tag key to filter by this value. type: string repository: description: |- Repository where the image is stored. Use the `image_repository` tag key for filtering and grouping. type: string short_image: description: Short version of the Container Image name. type: string sizes: description: |- Reported sizes in bytes of platform-specific images, with multiple values possible for multi-architecture images. Use `image_flavors` for available platform associations; use `size` as the sort key. items: description: Size of the platform-specific Container Image in bytes. format: int64 type: integer type: array sources: description: Collection sources, such as `live_containers`, `image_check`, `aws_ecr`, or `agentless_scanner`. items: description: Source where the Container Image was collected from. type: string type: array tags: description: |- Image tags in `key:value` form, such as `image_registry:docker.io` or `status:running`. Use tag keys in `group_by`. Tags used in `filter[tags]` must satisfy its syntax restrictions. items: description: A tag associated with the Container Image. type: string type: array vulnerability_count: $ref: "#/components/schemas/ContainerImageVulnerabilities" type: object ContainerImageFlavor: description: Container Image breakdown by supported platform. properties: built_at: description: Time the platform-specific Container Image was built. type: string os_architecture: description: Operating System architecture supported by the Container Image. type: string os_name: description: Operating System name supported by the Container Image. type: string os_version: description: Operating System version supported by the Container Image. type: string size: description: Size of the platform-specific Container Image in bytes. format: int64 type: integer type: object ContainerImageGroup: description: Container Image Group object. properties: attributes: $ref: "#/components/schemas/ContainerImageGroupAttributes" id: description: Container Image Group ID. type: string relationships: $ref: "#/components/schemas/ContainerImageGroupRelationships" type: $ref: "#/components/schemas/ContainerImageGroupType" type: object ContainerImageGroupAttributes: description: Attributes for a Container Image Group. properties: count: description: |- Number of images in the group. An image with multiple values for a grouping tag can appear in multiple groups. Images missing a grouping key are excluded. Summing group counts does not give a reliable inventory total. format: int64 type: integer name: description: Name of the Container Image group. type: string tags: description: Tags from the group name parsed in key/value format. type: object type: object ContainerImageGroupImagesRelationshipsLink: description: Relationships to Container Images inside a Container Image Group. properties: data: $ref: "#/components/schemas/ContainerImageGroupRelationshipsData" links: $ref: "#/components/schemas/ContainerImageGroupRelationshipsLinks" type: object ContainerImageGroupRelationships: description: Relationships inside a Container Image Group. properties: container_images: $ref: "#/components/schemas/ContainerImageGroupImagesRelationshipsLink" type: object ContainerImageGroupRelationshipsData: description: |- This array is always empty, even when the group includes images. To retrieve the images in this group, make a new request without `group_by`, using the `filter[tags]` value from `links.related` and your site's API host. The tags must satisfy `filter[tags]` syntax restrictions. items: description: A link data. type: string type: array ContainerImageGroupRelationshipsLinks: description: Links attributes. properties: related: description: |- Link containing the original filters combined with the group tags, without `group_by`. Use its `filter[tags]` value in a new request to your site's API host. The tags must satisfy `filter[tags]` syntax restrictions. type: string type: object ContainerImageGroupType: default: container_image_group description: Type of Container Image Group. enum: - container_image_group example: container_image_group type: string x-enum-varnames: - CONTAINER_IMAGE_GROUP ContainerImageItem: description: Possible Container Image models. oneOf: - $ref: "#/components/schemas/ContainerImage" - $ref: "#/components/schemas/ContainerImageGroup" ContainerImageMeta: description: Response metadata object. properties: pagination: $ref: "#/components/schemas/ContainerImageMetaPage" type: object ContainerImageMetaPage: description: Paging attributes. properties: cursor: description: The cursor used to get the current results, if any. type: string limit: description: Maximum number of results requested. format: int32 maximum: 10000 minimum: 0 type: integer next_cursor: description: |- The cursor used to get the next results, if any. To make the next request, use the same parameters with the addition of `page[cursor]`. Always empty for grouped results, even when additional groups exist. type: string prev_cursor: description: The cursor used to get the previous results, if any. nullable: true type: string total: description: |- Total number of images that match the query. Always `0` for grouped results. format: int64 type: integer type: $ref: "#/components/schemas/ContainerImageMetaPageType" type: object ContainerImageMetaPageType: default: cursor_limit description: Type of Container Image pagination. enum: - cursor_limit example: cursor_limit type: string x-enum-varnames: - CURSOR_LIMIT ContainerImageType: default: container_image description: Type of Container Image. enum: - container_image example: container_image type: string x-enum-varnames: - CONTAINER_IMAGE ContainerImageVulnerabilities: description: |- Vulnerability counts by severity, when available. An absent `vulnerability_count` does not mean the image has no vulnerabilities. properties: asset_id: description: ID of the Container Image. type: string critical: description: Number of vulnerabilities with CVSS Critical severity. format: int64 type: integer high: description: Number of vulnerabilities with CVSS High severity. format: int64 type: integer low: description: Number of vulnerabilities with CVSS Low severity. format: int64 type: integer medium: description: Number of vulnerabilities with CVSS Medium severity. format: int64 type: integer none: description: Number of vulnerabilities with CVSS None severity. format: int64 type: integer unknown: description: Number of vulnerabilities with an unknown CVSS severity. format: int64 type: integer type: object ContainerImagesResponse: description: List of Container Images or Container Image groups. properties: data: description: |- Array of `container_image` objects, or `container_image_group` objects when `group_by` is specified. items: $ref: "#/components/schemas/ContainerImageItem" type: array links: $ref: "#/components/schemas/ContainerImagesResponseLinks" meta: $ref: "#/components/schemas/ContainerImageMeta" type: object ContainerImagesResponseLinks: description: Pagination links. properties: first: description: Link to the first page. type: string last: description: Link to the last page. nullable: true type: string next: description: Link to the next page. nullable: true type: string prev: description: Link to previous page. nullable: true type: string self: description: Link to current page. type: string type: object ContainerItem: description: Possible Container models. oneOf: - $ref: "#/components/schemas/Container" - $ref: "#/components/schemas/ContainerGroup" ContainerMeta: description: Response metadata object. properties: pagination: $ref: "#/components/schemas/ContainerMetaPage" type: object ContainerMetaPage: description: Paging attributes. properties: cursor: description: The cursor used to get the current results, if any. type: string limit: description: Maximum number of results requested. format: int32 maximum: 10000 minimum: 0 type: integer next_cursor: description: |- The cursor used to get the next results, if any. To make the next request, use the same parameters with the addition of the `page[cursor]`. Empty for grouped results. type: string prev_cursor: description: The cursor used to get the previous results, if any. nullable: true type: string total: description: Total number of containers that match the query. Always `0` for grouped results. format: int64 type: integer type: $ref: "#/components/schemas/ContainerMetaPageType" type: object ContainerMetaPageType: default: cursor_limit description: Type of Container pagination. enum: - cursor_limit example: cursor_limit type: string x-enum-varnames: - CURSOR_LIMIT ContainerScalarQuery: description: A query for container-level metrics such as CPU and memory usage. properties: aggregator: $ref: "#/components/schemas/MetricsAggregator" cross_org_uuids: $ref: "#/components/schemas/CrossOrgUuids" data_source: $ref: "#/components/schemas/ContainerDataSource" is_normalized_cpu: description: Whether CPU metrics should be normalized by core count. type: boolean limit: description: Maximum number of results to return. format: int64 type: integer metric: description: The container metric to query. example: process.stat.container.cpu.total_pct type: string name: description: The variable name for use in formulas. example: query1 type: string sort: $ref: "#/components/schemas/QuerySortOrder" tag_filters: description: Tag filters to narrow down containers. items: description: A tag filter value. example: "env:prod" type: string type: array text_filter: description: A full-text search filter to match container names. type: string required: - data_source - name - metric type: object ContainerTimeseriesQuery: description: A query for container-level metrics such as CPU and memory usage. properties: cross_org_uuids: $ref: "#/components/schemas/CrossOrgUuids" data_source: $ref: "#/components/schemas/ContainerDataSource" is_normalized_cpu: description: Whether CPU metrics should be normalized by core count. type: boolean limit: description: Maximum number of results to return. format: int64 type: integer metric: description: The container metric to query. example: process.stat.container.cpu.total_pct type: string name: description: The variable name for use in formulas. example: query1 type: string sort: $ref: "#/components/schemas/QuerySortOrder" tag_filters: description: Tag filters to narrow down containers. items: description: A tag filter value. example: "env:prod" type: string type: array text_filter: description: A full-text search filter to match container names. type: string required: - data_source - name - metric type: object ContainerType: default: container description: Type of container. enum: - container example: container type: string x-enum-varnames: - CONTAINER ContainersResponse: description: List of containers. properties: data: description: Array of containers or container group objects. items: $ref: "#/components/schemas/ContainerItem" type: array links: $ref: "#/components/schemas/ContainersResponseLinks" meta: $ref: "#/components/schemas/ContainerMeta" type: object ContainersResponseLinks: description: Pagination links. properties: first: description: Link to the first page. type: string last: description: Link to the last page. nullable: true type: string next: description: Link to the next page. nullable: true type: string prev: description: Link to previous page. nullable: true type: string self: description: Link to current page. type: string type: object ContentEncoding: description: HTTP header used to compress the media-type. enum: - identity - gzip - deflate type: string x-enum-varnames: - IDENTITY - GZIP - DEFLATE ControlNotificationEventSetting: description: The notification settings for a single event type on a control. properties: enabled: description: Whether notifications are enabled for this event type. example: true type: boolean event_type: description: The event type the notification settings apply to, such as `new_detection`. example: "new_detection" type: string targets: $ref: "#/components/schemas/ControlNotificationTargetArray" required: - event_type - enabled - targets type: object ControlNotificationEventSettingsArray: description: The notification settings for each supported event type on the control. items: $ref: "#/components/schemas/ControlNotificationEventSetting" type: array ControlNotificationSettingsAttributes: description: The attributes of a governance control's notification settings. properties: event_settings: $ref: "#/components/schemas/ControlNotificationEventSettingsArray" required: - event_settings type: object ControlNotificationSettingsData: description: A control notification settings resource. properties: attributes: $ref: "#/components/schemas/ControlNotificationSettingsAttributes" id: description: The detection type the notification settings apply to. example: "unused_api_keys" type: string type: $ref: "#/components/schemas/ControlNotificationSettingsResourceType" required: - id - type - attributes type: object ControlNotificationSettingsResourceType: description: Control notification settings resource type. enum: - control_notification_settings example: "control_notification_settings" type: string x-enum-varnames: - CONTROL_NOTIFICATION_SETTINGS ControlNotificationSettingsResponse: description: The notification settings for a governance control. properties: data: $ref: "#/components/schemas/ControlNotificationSettingsData" required: - data type: object ControlNotificationSettingsUpdateAttributes: description: The attributes of a governance control's notification settings that can be updated. properties: event_settings: $ref: "#/components/schemas/ControlNotificationEventSettingsArray" type: object ControlNotificationSettingsUpdateData: description: The data of a control notification settings update request. properties: attributes: $ref: "#/components/schemas/ControlNotificationSettingsUpdateAttributes" type: $ref: "#/components/schemas/ControlNotificationSettingsResourceType" required: - type type: object ControlNotificationSettingsUpdateRequest: description: A request to update the notification settings for a governance control. properties: data: $ref: "#/components/schemas/ControlNotificationSettingsUpdateData" required: - data type: object ControlNotificationTarget: description: A destination that receives notifications for an event type. properties: handle: description: The destination handle, such as an email address, Slack channel, or user handle. example: "#governance-alerts" type: string type: $ref: "#/components/schemas/ControlNotificationTargetType" required: - type - handle type: object ControlNotificationTargetArray: description: The destinations that receive notifications for an event type. items: $ref: "#/components/schemas/ControlNotificationTarget" type: array ControlNotificationTargetType: description: The type of notification destination. enum: - email - slack - at_mention - case example: "slack" type: string x-enum-varnames: - EMAIL - SLACK - AT_MENTION - CASE ConvertJobResultsToSignalsAttributes: description: Attributes for converting historical job results to signals. properties: jobResultIds: description: Job result IDs. example: - "" items: description: A job result ID. type: string type: array notifications: description: Notifications sent. example: - "" items: description: A notification recipient handle. type: string type: array signalMessage: description: Message of generated signals. example: A large number of failed login attempts. type: string signalSeverity: $ref: "#/components/schemas/SecurityMonitoringRuleSeverity" required: - jobResultIds - signalSeverity - signalMessage - notifications type: object ConvertJobResultsToSignalsData: description: Data for converting historical job results to signals. properties: attributes: $ref: "#/components/schemas/ConvertJobResultsToSignalsAttributes" type: $ref: "#/components/schemas/ConvertJobResultsToSignalsDataType" type: object ConvertJobResultsToSignalsDataType: description: Type of payload. enum: - historicalDetectionsJobResultSignalConversion type: string x-enum-varnames: - HISTORICALDETECTIONSJOBRESULTSIGNALCONVERSION ConvertJobResultsToSignalsRequest: description: Request for converting historical job results to signals. properties: data: $ref: "#/components/schemas/ConvertJobResultsToSignalsData" type: object CostAggregationType: description: "Controls how costs are aggregated when using `start_date`. The `cumulative` option returns month-to-date running totals." enum: - cumulative type: string x-enum-varnames: - CUMULATIVE CostAnomaliesResponse: description: Response object containing a list of detected Cloud Cost Management anomalies and aggregated totals. properties: data: $ref: "#/components/schemas/CostAnomaliesResponseData" type: object CostAnomaliesResponseData: description: Resource wrapper for the list of cost anomalies and aggregated totals. properties: attributes: $ref: "#/components/schemas/CostAnomaliesResponseDataAttributes" id: description: Static identifier of the cost anomalies collection resource. example: anomalies type: string type: $ref: "#/components/schemas/CostAnomaliesResponseDataType" required: - id - type - attributes type: object CostAnomaliesResponseDataAttributes: description: Cost anomaly results and aggregated totals for the queried window. properties: anomalies: description: The list of cost anomalies that match the request. items: $ref: "#/components/schemas/CostAnomaly" type: array avg_daily_anomalous_cost: description: Average daily anomalous cost change across the queried window. example: 625.375 format: double type: number total_actual_cost: description: Total actual cost spent across the queried window for the matching providers. example: 3001.24 format: double type: number total_anomalous_cost: description: Sum of the anomalous cost change across all returned anomalies. example: 1250.75 format: double type: number total_count: description: Total number of anomalies that match the request. example: 1 format: int64 type: integer required: - anomalies - total_count - total_anomalous_cost - total_actual_cost - avg_daily_anomalous_cost type: object CostAnomaliesResponseDataType: default: anomalies description: Type of the cost anomalies collection resource. Must be `anomalies`. enum: - anomalies example: anomalies type: string x-enum-varnames: - ANOMALIES CostAnomaly: description: A single detected Cloud Cost Management anomaly. properties: actual_cost: description: Actual cost incurred during the anomaly window. example: 3001.24 format: double type: number anomalous_cost_change: description: Anomalous cost change relative to the expected baseline. example: 1250.75 format: double type: number anomaly_end: description: Anomaly end timestamp in Unix milliseconds. example: 1730429150000 format: int64 type: integer anomaly_start: description: Anomaly start timestamp in Unix milliseconds. example: 1730259950000 format: int64 type: integer correlated_tags: $ref: "#/components/schemas/CostAnomalyCorrelatedTags" dimensions: $ref: "#/components/schemas/CostAnomalyDimensions" dismissal: $ref: "#/components/schemas/CostAnomalyDismissal" max_cost: description: Maximum cost observed during the anomaly window. example: 5000.5 format: double type: number provider: description: Cloud or SaaS provider associated with the anomaly (for example `aws`, `gcp`, `azure`). example: aws type: string query: description: The metrics query that detected the anomaly. example: sum:aws.cost.net.amortized{aws_cost_type IN (Usage,DiscountedUsage,SavingsPlanCoveredUsage) AND aws_product NOT IN (supportenterprise) AND service:"ec2"}.rollup(sum, daily) type: string uuid: description: The unique identifier of the anomaly. example: b0a6aaa9-3c4c-48cb-9447-a0d1338b3e09 type: string required: - uuid - anomaly_start - anomaly_end - query - dimensions - correlated_tags - anomalous_cost_change - actual_cost - max_cost - provider type: object CostAnomalyCorrelatedTags: additionalProperties: description: The list of correlated values for the tag key. items: description: A correlated tag value. type: string type: array description: Map of correlated tag keys to the list of correlated tag values. example: region: - us-east-1 - us-west-2 nullable: true type: object CostAnomalyDimensions: additionalProperties: description: The dimension value. type: string description: Map of cost dimension keys to their values for the anomaly grouping. example: service: ec2 type: object CostAnomalyDismissal: description: Resolution metadata for an anomaly that has been dismissed. properties: cause: description: Reason the anomaly was dismissed. example: false_positive type: string dismissal_id: description: Unique identifier of the dismissal record. example: 12345678-1234-1234-1234-123456789abc type: string message: description: Optional message explaining the dismissal. example: This was expected due to planned infrastructure changes. type: string updated_at: description: Timestamp of the last dismissal update in Unix milliseconds. example: 1730344150000 format: int64 type: integer updated_by: description: Identifier of the user that last updated the dismissal. example: user@example.com type: string required: - dismissal_id - cause - message - updated_at - updated_by type: object CostAnomalyResponse: description: Response object containing a single Cloud Cost Management anomaly. properties: data: $ref: "#/components/schemas/CostAnomalyResponseData" type: object CostAnomalyResponseData: description: Resource wrapper for a single cost anomaly. properties: attributes: $ref: "#/components/schemas/CostAnomaly" id: description: The unique identifier of the anomaly. example: b0a6aaa9-3c4c-48cb-9447-a0d1338b3e09 type: string type: $ref: "#/components/schemas/CostAnomaliesResponseDataType" required: - id - type - attributes type: object CostAttributionAggregates: description: An array of available aggregates. items: $ref: "#/components/schemas/CostAttributionAggregatesBody" type: array CostAttributionAggregatesBody: description: The object containing the aggregates. properties: agg_type: description: The aggregate type. example: "sum" type: string field: description: The field. example: "infra_host_committed_cost" type: string value: description: The value for a given field. format: double type: number type: object CostAttributionTagNames: additionalProperties: description: |- A list of values that are associated with each tag key. - An empty list means the resource use wasn't tagged with the respective tag. - Multiple values means the respective tag was applied multiple times on the resource. - An `` value means the resource was tagged with the respective tag but did not have a value. items: description: A given tag in a list. example: "datadog-integrations-lab" type: string type: array description: |- Tag keys and values. A `null` value here means that the requested tag breakdown cannot be applied because it does not match the [tags configured for usage attribution](https://docs.datadoghq.com/account_management/billing/usage_attribution/#getting-started). In this scenario the API returns the total cost, not broken down by tags. nullable: true type: object CostAttributionType: default: cost_by_tag description: Type of cost attribution data. enum: - cost_by_tag example: cost_by_tag type: string x-enum-varnames: - COST_BY_TAG CostByOrg: description: Cost data. properties: attributes: $ref: "#/components/schemas/CostByOrgAttributes" id: description: Unique ID of the response. type: string type: $ref: "#/components/schemas/CostByOrgType" type: object CostByOrgAttributes: description: Cost attributes data. properties: account_name: description: The account name. type: string account_public_id: description: The account public ID. type: string charges: description: List of charges data reported for the requested month. items: $ref: "#/components/schemas/ChargebackBreakdown" type: array date: description: The month requested. format: date-time type: string org_name: description: The organization name. type: string public_id: description: The organization public ID. type: string region: description: The region of the Datadog instance that the organization belongs to. type: string total_cost: description: The total cost of products for the month. format: double type: number type: object CostByOrgResponse: description: Chargeback Summary response. properties: data: description: Response containing Chargeback Summary. items: $ref: "#/components/schemas/CostByOrg" type: array type: object CostByOrgType: default: cost_by_org description: Type of cost data. enum: - cost_by_org example: cost_by_org type: string x-enum-varnames: - COST_BY_ORG CostCurrency: description: A Cloud Cost Management billing currency entry. properties: id: description: The currency code (for example, `USD`). example: USD type: string type: $ref: "#/components/schemas/CostCurrencyType" required: - id - type type: object CostCurrencyResponse: description: The dominant Cloud Cost Management billing currency for the requested period. The `data` array contains at most one entry, and is empty when no currency data is available. example: data: - id: USD type: cost_currency properties: data: description: The dominant billing currency. Empty when no data is available, or a single entry otherwise. items: $ref: "#/components/schemas/CostCurrency" type: array required: - data type: object CostCurrencyType: default: cost_currency description: Type of the Cloud Cost Management billing currency resource. enum: - cost_currency example: cost_currency type: string x-enum-varnames: - COST_CURRENCY CostMetric: description: A Cloud Cost Management metric that has data for the requested period. properties: id: description: The metric name, for example `aws.cost.net.amortized`. example: aws.cost.net.amortized type: string type: $ref: "#/components/schemas/CostMetricType" required: - id - type type: object CostMetricType: default: cost_metric description: Type of the Cloud Cost Management available metric resource. enum: - cost_metric example: cost_metric type: string x-enum-varnames: - COST_METRIC CostMetricsResponse: description: List of available Cloud Cost Management metrics for the requested period. example: data: - id: aws.cost.net.amortized type: cost_metric - id: gcp.cost.amortized type: cost_metric properties: data: description: List of available metrics. items: $ref: "#/components/schemas/CostMetric" type: array required: - data type: object CostOrchestrator: description: A container orchestrator detected in Cloud Cost Management data. properties: id: description: The orchestrator name, for example `kubernetes` or `ecs`. example: kubernetes type: string type: $ref: "#/components/schemas/CostOrchestratorType" required: - id - type type: object CostOrchestratorType: default: cost_orchestrator description: Type of the Cloud Cost Management orchestrator resource. enum: - cost_orchestrator example: cost_orchestrator type: string x-enum-varnames: - COST_ORCHESTRATOR CostOrchestratorsResponse: description: List of container orchestrators detected in Cloud Cost Management data for the requested period. example: data: - id: ecs type: cost_orchestrator - id: kubernetes type: cost_orchestrator properties: data: description: List of detected container orchestrators. items: $ref: "#/components/schemas/CostOrchestrator" type: array required: - data type: object CostRecommendationArray: description: A page of cost recommendations with pagination metadata. properties: data: description: The list of cost recommendations on this page. items: $ref: "#/components/schemas/CostRecommendationData" type: array meta: $ref: "#/components/schemas/RecommendationsPageMeta" required: - data type: object CostRecommendationData: description: A single cost recommendation entry in JSON:API form. properties: attributes: $ref: "#/components/schemas/CostRecommendationDataAttributes" id: description: Unique identifier for the recommendation. type: string type: $ref: "#/components/schemas/CostRecommendationDataType" required: - type type: object CostRecommendationDataAttributes: description: Attributes describing a single cost recommendation. properties: dd_resource_key: description: Datadog resource key identifying the recommended resource. type: string potential_daily_savings: $ref: "#/components/schemas/CostRecommendationDataAttributesPotentialDailySavings" recommendation_type: description: The kind of recommendation (for example, `terminate` or `rightsize`). type: string resource_id: description: Cloud provider identifier of the resource. type: string resource_type: description: Resource type (for example, `aws_ec2_instance`). type: string tags: description: Tags attached to the recommended resource. items: description: A single resource tag. type: string type: array type: object CostRecommendationDataAttributesPotentialDailySavings: description: Estimated daily savings if the recommendation is applied. properties: amount: description: Numeric amount of the potential daily savings. format: double type: number currency: description: ISO 4217 currency code for the savings amount. type: string type: object CostRecommendationDataType: default: recommendation description: Recommendation resource type. enum: - recommendation example: recommendation type: string x-enum-varnames: - RECOMMENDATION CostTag: description: A Cloud Cost Management tag. properties: attributes: $ref: "#/components/schemas/CostTagAttributes" id: description: The tag identifier, equal to its `key:value` representation. example: providername:aws type: string type: $ref: "#/components/schemas/CostTagType" required: - attributes - id - type type: object CostTagAttributes: description: Attributes of a Cloud Cost Management tag. properties: sources: description: List of sources that define this tag. example: - focus items: description: A tag source. type: string type: array value: description: The tag value in `key:value` format. example: providername:aws type: string required: - sources - value type: object CostTagDescription: description: A Cloud Cost Management tag key description, either cross-cloud or scoped to a single cloud provider. properties: attributes: $ref: "#/components/schemas/CostTagDescriptionAttributes" id: description: Stable identifier of the tag description. Equals the tag key when the description is the cross-cloud default; encodes both the cloud and the tag key when the description is cloud-specific. example: account_id type: string type: $ref: "#/components/schemas/CostTagDescriptionType" required: - attributes - id - type type: object CostTagDescriptionAttributes: description: Human-readable description and metadata attached to a Cloud Cost Management tag key, optionally scoped to a single cloud provider. properties: cloud: description: Cloud provider this description applies to (for example, `aws`). Empty when the description is the cross-cloud default for the tag key. example: aws type: string created_at: description: Timestamp when the description was created, in RFC 3339 format. example: "2026-01-01T12:00:00Z" type: string description: description: The human-readable description for the tag key. example: AWS account that owns this cost. type: string source: $ref: "#/components/schemas/CostTagDescriptionSource" tag_key: description: The tag key this description applies to. example: account_id type: string updated_at: description: Timestamp when the description was last updated, in RFC 3339 format. example: "2026-01-01T12:00:00Z" type: string required: - cloud - created_at - description - source - tag_key - updated_at type: object CostTagDescriptionResponse: description: Single Cloud Cost Management tag key description returned by the get-by-key endpoint. example: data: attributes: cloud: aws created_at: "2026-01-01T12:00:00Z" description: AWS account that owns this cost. source: human tag_key: account_id updated_at: "2026-01-01T12:00:00Z" id: account_id type: cost_tag_description properties: data: $ref: "#/components/schemas/CostTagDescription" required: - data type: object CostTagDescriptionSource: description: Origin of the description. `human` indicates the description was written by a user, `ai_generated` was produced by AI, and `datadog` is a default supplied by Datadog. enum: - human - ai_generated - datadog example: human type: string x-enum-varnames: - HUMAN - AI_GENERATED - DATADOG CostTagDescriptionType: default: cost_tag_description description: Type of the Cloud Cost Management tag description resource. enum: - cost_tag_description example: cost_tag_description type: string x-enum-varnames: - COST_TAG_DESCRIPTION CostTagDescriptionUpsertRequest: description: Request body for creating or updating a Cloud Cost Management tag key description. example: data: attributes: cloud: aws description: AWS account that owns this cost. id: account_id type: cost_tag_description properties: data: $ref: "#/components/schemas/CostTagDescriptionUpsertRequestData" required: - data type: object CostTagDescriptionUpsertRequestData: description: Resource envelope carrying the tag key description being upserted. The `id` is informational; the authoritative tag key is taken from the URL path. properties: attributes: $ref: "#/components/schemas/CostTagDescriptionUpsertRequestDataAttributes" id: description: Identifier of the tag key the description applies to. Matches the `tag_key` path parameter. example: account_id type: string type: $ref: "#/components/schemas/CostTagDescriptionType" required: - attributes - type type: object CostTagDescriptionUpsertRequestDataAttributes: description: Mutable attributes set when creating or updating a Cloud Cost Management tag key description. properties: cloud: description: Cloud provider this description applies to (for example, `aws`). Omit to set the cross-cloud default for the tag key. example: aws type: string description: description: The human-readable description for the tag key. example: AWS account that owns this cost. type: string required: - description type: object CostTagDescriptionsResponse: description: List of Cloud Cost Management tag key descriptions for the organization, optionally filtered to a single cloud provider. example: data: - attributes: cloud: aws created_at: "2026-01-01T12:00:00Z" description: AWS account that owns this cost. source: human tag_key: account_id updated_at: "2026-01-01T12:00:00Z" id: account_id type: cost_tag_description properties: data: description: List of tag key descriptions. items: $ref: "#/components/schemas/CostTagDescription" type: array required: - data type: object CostTagKey: description: A Cloud Cost Management tag key. properties: attributes: $ref: "#/components/schemas/CostTagKeyAttributes" id: description: The tag key identifier. example: providername type: string type: $ref: "#/components/schemas/CostTagKeyType" required: - attributes - id - type type: object CostTagKeyAttributes: description: Attributes of a Cloud Cost Management tag key. properties: details: $ref: "#/components/schemas/CostTagKeyDetails" sources: description: List of sources that define this tag key. example: - focus items: description: A tag key source. type: string type: array value: description: The tag key name. example: providername type: string required: - sources - value type: object CostTagKeyDetails: description: Additional details for a Cloud Cost Management tag key, including its description and example tag values. properties: description: description: Description of the tag key. example: The cloud provider name reported for the cost line item. type: string tag_values: description: Example tag values observed for this tag key. example: - aws - gcp - azure items: description: A tag value observed for this tag key. type: string type: array required: - description - tag_values type: object CostTagKeyMetadata: description: A Cloud Cost Management tag key metadata entry, aggregating coverage and example values for a single tag key, metric, and period. properties: attributes: $ref: "#/components/schemas/CostTagKeyMetadataAttributes" id: description: A composite identifier of the form `tag_key:metric` for monthly roll-ups, or `tag_key:metric:YYYY-MM-DD` when `filter[daily]=true`. example: env:aws.cost.net.amortized type: string type: $ref: "#/components/schemas/CostTagKeyMetadataType" required: - attributes - id - type type: object CostTagKeyMetadataAttributes: description: Attributes of a Cloud Cost Management tag key metadata entry. properties: cardinality_by_account: $ref: "#/components/schemas/CostTagKeyMetadataCardinalityByAccount" cost_covered: description: Total cost (in the report currency) of cost line items that carry this tag key for the requested period. example: 1234.56 format: double type: number date: description: The day this row corresponds to, in `YYYY-MM-DD` format. Present only when `filter[daily]=true`; omitted for the monthly roll-up returned by default. example: "2026-02-15" type: string metric: description: The Cloud Cost Management metric this row aggregates, for example `aws.cost.net.amortized`. example: aws.cost.net.amortized type: string row_count: description: Number of cost rows that carry this tag key over the requested period. example: 100 format: int64 type: integer tag_sources: description: Origins where this tag key was observed (for example, `aws-user-defined`). example: - aws-user-defined items: description: A tag source. type: string type: array top_values_by_account: $ref: "#/components/schemas/CostTagKeyMetadataTopValuesByAccount" required: - cardinality_by_account - cost_covered - metric - row_count - tag_sources - top_values_by_account type: object CostTagKeyMetadataCardinalityByAccount: additionalProperties: description: Number of unique tag values observed in the account. format: int64 type: integer description: Number of unique tag values observed for this tag key, keyed by cloud account ID. example: "123456789012": 42 type: object CostTagKeyMetadataResponse: description: List of Cloud Cost Management tag key metadata entries for the requested period. example: data: - attributes: cardinality_by_account: "123456789012": 42 cost_covered: 1234.56 metric: aws.cost.net.amortized row_count: 100 tag_sources: - aws-user-defined top_values_by_account: "123456789012": - prod - staging id: env:aws.cost.net.amortized type: cost_tag_key_metadata properties: data: description: List of tag key metadata entries. items: $ref: "#/components/schemas/CostTagKeyMetadata" type: array required: - data type: object CostTagKeyMetadataTopValuesByAccount: additionalProperties: description: A sample of the most frequent tag values observed in the account. items: description: A tag value observed for this tag key. type: string type: array description: A sample of the most frequent tag values observed for this tag key, keyed by cloud account ID. example: "123456789012": - prod - staging type: object CostTagKeyMetadataType: default: cost_tag_key_metadata description: Type of the Cloud Cost Management tag key metadata resource. enum: - cost_tag_key_metadata example: cost_tag_key_metadata type: string x-enum-varnames: - COST_TAG_KEY_METADATA CostTagKeyResponse: description: A single Cloud Cost Management tag key. example: data: attributes: details: description: The cloud provider name reported for the cost line item. tag_values: - aws - gcp - azure sources: - focus value: providername id: providername type: cost_tag_key properties: data: $ref: "#/components/schemas/CostTagKey" required: - data type: object CostTagKeySource: description: A Cloud Cost Management tag key paired with the sources that produced it. properties: attributes: $ref: "#/components/schemas/CostTagKeySourceAttributes" id: description: The tag key identifier. Equal to the empty-tag sentinel `__empty_tag_key__` when the tag key is empty. example: env type: string type: $ref: "#/components/schemas/CostTagKeySourceType" required: - attributes - id - type type: object CostTagKeySourceAttributes: description: Attributes of a Cloud Cost Management tag source. properties: tag_key: description: The tag key name. example: env type: string tag_sources: description: Origins where this tag key was observed (for example, `aws-user-defined`). example: - aws-user-defined - custom items: description: A tag source. type: string type: array required: - tag_key - tag_sources type: object CostTagKeySourceType: default: cost_tag_key_source description: Type of the Cloud Cost Management tag source resource. enum: - cost_tag_key_source example: cost_tag_key_source type: string x-enum-varnames: - COST_TAG_KEY_SOURCE CostTagKeySourcesResponse: description: List of Cloud Cost Management tag keys with their origin sources for the requested period. example: data: - attributes: tag_key: env tag_sources: - aws-user-defined - custom id: env type: cost_tag_key_source - attributes: tag_key: service tag_sources: - aws id: service type: cost_tag_key_source properties: data: description: List of tag keys with their origin sources. items: $ref: "#/components/schemas/CostTagKeySource" type: array required: - data type: object CostTagKeyType: default: cost_tag_key description: Type of the Cloud Cost Management tag key resource. enum: - cost_tag_key example: cost_tag_key type: string x-enum-varnames: - COST_TAG_KEY CostTagKeysResponse: description: A list of Cloud Cost Management tag keys. example: data: - attributes: sources: - focus value: providername id: providername type: cost_tag_key - attributes: sources: [] value: service id: service type: cost_tag_key properties: data: description: The list of Cloud Cost Management tag keys. items: $ref: "#/components/schemas/CostTagKey" type: array required: - data type: object CostTagMetadataDailyFilter: description: Granularity for tag metadata results. `true` returns one row per day, `false` (or omitted) returns the monthly roll-up. enum: - "true" - "false" example: "true" type: string x-enum-varnames: - "TRUE" - "FALSE" CostTagMetadataMonth: description: A month that has Cloud Cost Management tag metadata available for a given provider. properties: id: description: The month, in `YYYY-MM` format. example: "2026-04" type: string type: $ref: "#/components/schemas/CostTagMetadataMonthType" required: - id - type type: object CostTagMetadataMonthType: default: cost_tag_metadata_month description: Type of the Cloud Cost Management tag metadata month resource. enum: - cost_tag_metadata_month example: cost_tag_metadata_month type: string x-enum-varnames: - COST_TAG_METADATA_MONTH CostTagMetadataMonthsResponse: description: List of months that have Cloud Cost Management tag metadata for the requested provider, ordered most-recent first and capped at 36 months. example: data: - id: "2026-04" type: cost_tag_metadata_month - id: "2026-03" type: cost_tag_metadata_month properties: data: description: List of months that have tag metadata available. items: $ref: "#/components/schemas/CostTagMetadataMonth" type: array required: - data type: object CostTagType: default: cost_tag description: Type of the Cloud Cost Management tag resource. enum: - cost_tag example: cost_tag type: string x-enum-varnames: - COST_TAG CostTagsResponse: description: A list of Cloud Cost Management tags. example: data: - attributes: sources: - focus value: providername:aws id: providername:aws type: cost_tag - attributes: sources: - focus value: providername:gcp id: providername:gcp type: cost_tag properties: data: description: The list of Cloud Cost Management tags. items: $ref: "#/components/schemas/CostTag" type: array required: - data type: object CoverageSummaryAttributes: description: Attributes object for code coverage summary response. properties: codeowners: additionalProperties: $ref: "#/components/schemas/CoverageSummaryCodeownerStats" description: Coverage statistics broken down by code owner. nullable: true type: object evaluated_flags_count: description: Total number of coverage flags evaluated. example: 8 format: int64 type: integer evaluated_reports_count: description: Total number of coverage reports evaluated. example: 12 format: int64 type: integer patch_coverage: description: Overall patch coverage percentage. example: 70.1 format: double nullable: true type: number services: additionalProperties: $ref: "#/components/schemas/CoverageSummaryServiceStats" description: Coverage statistics broken down by service. nullable: true type: object total_coverage: description: Overall total coverage percentage. example: 82.4 format: double nullable: true type: number type: object CoverageSummaryCodeownerStats: description: Coverage statistics for a specific code owner. properties: evaluated_flags_count: description: Number of coverage flags evaluated for the code owner. example: 2 format: int64 type: integer evaluated_reports_count: description: Number of coverage reports evaluated for the code owner. example: 4 format: int64 type: integer patch_coverage: description: Patch coverage percentage for the code owner. example: 75.2 format: double nullable: true type: number total_coverage: description: Total coverage percentage for the code owner. example: 88.7 format: double nullable: true type: number type: object CoverageSummaryData: description: Data object for coverage summary response. properties: attributes: $ref: "#/components/schemas/CoverageSummaryAttributes" id: description: Unique identifier for the coverage summary (base64-hashed). example: ZGQxMjM0NV9tYWluXzE3MDk1NjQwMDA= type: string type: $ref: "#/components/schemas/CoverageSummaryType" type: object CoverageSummaryResponse: description: Response object containing code coverage summary. properties: data: $ref: "#/components/schemas/CoverageSummaryData" type: object CoverageSummaryServiceStats: description: Coverage statistics for a specific service. properties: evaluated_flags_count: description: Number of coverage flags evaluated for the service. example: 3 format: int64 type: integer evaluated_reports_count: description: Number of coverage reports evaluated for the service. example: 5 format: int64 type: integer patch_coverage: description: Patch coverage percentage for the service. example: 72.3 format: double nullable: true type: number total_coverage: description: Total coverage percentage for the service. example: 85.5 format: double nullable: true type: number type: object CoverageSummaryType: description: JSON:API type for coverage summary response. The value must always be `ci_app_coverage_summary`. enum: - ci_app_coverage_summary example: ci_app_coverage_summary type: string x-enum-varnames: - CI_APP_COVERAGE_SUMMARY CreateActionConnectionRequest: description: Request used to create an action connection. properties: data: $ref: "#/components/schemas/ActionConnectionData" required: - data type: object CreateActionConnectionResponse: description: The response for a created connection properties: data: $ref: "#/components/schemas/ActionConnectionData" type: object CreateAllocationsRequest: description: Request to create targeting rules (allocations) for a feature flag in an environment. properties: data: $ref: "#/components/schemas/AllocationDataRequest" required: - data type: object CreateAppRequest: description: A request object for creating a new app. example: data: attributes: components: - events: [] name: grid0 properties: children: - events: [] name: gridCell0 properties: children: - events: [] name: calloutValue0 properties: isDisabled: false isLoading: false isVisible: true label: CPU Usage size: sm style: vivid_yellow unit: kB value: "42" type: calloutValue isVisible: "true" layout: default: height: 8 width: 2 x: 0 "y": 0 type: gridCell type: grid description: "This is a simple example app" name: "Example App" queries: [] rootInstanceName: grid0 type: appDefinitions properties: data: $ref: "#/components/schemas/CreateAppRequestData" type: object CreateAppRequestData: description: The data object containing the app definition. properties: attributes: $ref: "#/components/schemas/CreateAppRequestDataAttributes" type: $ref: "#/components/schemas/AppDefinitionType" required: - type type: object CreateAppRequestDataAttributes: description: App definition attributes such as name, description, and components. properties: components: description: The UI components that make up the app. items: $ref: "#/components/schemas/ComponentGrid" type: array description: description: A human-readable description for the app. type: string name: description: The name of the app. type: string queries: description: An array of queries, such as external actions and state variables, that the app uses. items: $ref: "#/components/schemas/Query" type: array rootInstanceName: description: The name of the root component of the app. This must be a `grid` component that contains all other components. type: string tags: description: A list of tags for the app, which can be used to filter apps. example: - "service:webshop-backend" - "team:webshop" items: description: An individual tag for the app. type: string type: array type: object CreateAppResponse: description: The response object after a new app is successfully created, with the app ID. properties: data: $ref: "#/components/schemas/CreateAppResponseData" type: object CreateAppResponseData: description: The data object containing the app ID. properties: id: description: The ID of the created app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string type: $ref: "#/components/schemas/AppDefinitionType" required: - id - type type: object CreateAppsDatastoreRequest: description: Request to create a new datastore with specified configuration and metadata. properties: data: $ref: "#/components/schemas/CreateAppsDatastoreRequestData" type: object CreateAppsDatastoreRequestData: description: Data wrapper containing the configuration needed to create a new datastore. properties: attributes: $ref: "#/components/schemas/CreateAppsDatastoreRequestDataAttributes" id: description: Optional ID for the new datastore. If not provided, one will be generated automatically. type: string type: $ref: "#/components/schemas/DatastoreDataType" required: - type type: object CreateAppsDatastoreRequestDataAttributes: description: Configuration and metadata to create a new datastore. properties: description: description: A human-readable description about the datastore. type: string name: description: The display name for the new datastore. example: "datastore-name" type: string org_access: $ref: "#/components/schemas/CreateAppsDatastoreRequestDataAttributesOrgAccess" primary_column_name: $ref: "#/components/schemas/DatastoreAttributesPrimaryColumnName" primary_key_generation_strategy: $ref: "#/components/schemas/DatastorePrimaryKeyGenerationStrategy" required: - name - primary_column_name type: object CreateAppsDatastoreRequestDataAttributesOrgAccess: description: The organization access level for the datastore. For example, 'contributor'. enum: - contributor - viewer - manager type: string x-enum-varnames: - CONTRIBUTOR - VIEWER - MANAGER CreateAppsDatastoreResponse: description: Response after successfully creating a new datastore, containing the datastore's assigned ID. properties: data: $ref: "#/components/schemas/CreateAppsDatastoreResponseData" type: object CreateAppsDatastoreResponseData: description: The newly created datastore's data. properties: id: description: The unique identifier assigned to the newly created datastore. type: string type: $ref: "#/components/schemas/DatastoreDataType" required: - type type: object CreateAttachmentRequest: description: Create request for an attachment. properties: data: $ref: "#/components/schemas/CreateAttachmentRequestData" type: object CreateAttachmentRequestData: description: Attachment data for a create request. properties: attributes: $ref: "#/components/schemas/CreateAttachmentRequestDataAttributes" id: description: The unique identifier of the attachment. type: string type: $ref: "#/components/schemas/IncidentAttachmentType" required: - type type: object CreateAttachmentRequestDataAttributes: description: The attributes for creating an attachment. properties: attachment: $ref: "#/components/schemas/CreateAttachmentRequestDataAttributesAttachment" attachment_type: $ref: "#/components/schemas/AttachmentDataAttributesAttachmentType" type: object CreateAttachmentRequestDataAttributesAttachment: description: The attachment object for creating an attachment. properties: documentUrl: description: The URL of the attachment. example: https://app.datadoghq.com/notebook/123/Postmortem-IR-123 type: string title: description: The title of the attachment. example: Postmortem-IR-123 type: string type: object CreateBackfilledDegradationRequest: description: Request object for creating a backfilled degradation. example: data: attributes: title: Past API Outage updates: - components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: degraded description: We detected elevated error rates in the API. started_at: "2026-04-27T13:37:31.038001628Z" status: investigating - components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: degraded description: Root cause identified as a misconfigured deployment. started_at: "2026-04-27T14:07:31.038001628Z" status: identified - components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: operational description: The issue has been resolved and API is operating normally. started_at: "2026-04-27T14:37:31.038001628Z" status: resolved type: degradations properties: data: $ref: "#/components/schemas/CreateBackfilledDegradationRequestData" type: object CreateBackfilledDegradationRequestData: description: The data object for creating a backfilled degradation. properties: attributes: $ref: "#/components/schemas/CreateBackfilledDegradationRequestDataAttributes" relationships: $ref: "#/components/schemas/CreateBackfilledDegradationRequestDataRelationships" type: $ref: "#/components/schemas/PatchDegradationRequestDataType" required: - type type: object CreateBackfilledDegradationRequestDataAttributes: description: The supported attributes for creating a backfilled degradation. properties: title: description: The title of the backfilled degradation. example: "" type: string updates: description: The list of status updates describing the timeline of the degradation. items: $ref: "#/components/schemas/CreateBackfilledDegradationRequestDataAttributesUpdatesItems" type: array required: - title - updates type: object CreateBackfilledDegradationRequestDataAttributesUpdatesItems: description: A backfilled degradation update entry. properties: components_affected: description: The components affected. items: $ref: "#/components/schemas/CreateDegradationRequestDataAttributesComponentsAffectedItems" type: array description: description: A description of the update. type: string started_at: description: Timestamp of when the update occurred. example: "" format: date-time type: string status: $ref: "#/components/schemas/CreateDegradationRequestDataAttributesStatus" required: - started_at - status type: object CreateBackfilledDegradationRequestDataRelationships: description: The supported relationships for creating a backfilled degradation. properties: template: $ref: "#/components/schemas/CreateBackfilledDegradationRequestDataRelationshipsTemplate" description: The template used to create the backfilled degradation. type: object CreateBackfilledDegradationRequestDataRelationshipsTemplate: description: The template used to create the backfilled degradation. properties: data: $ref: "#/components/schemas/CreateBackfilledDegradationRequestDataRelationshipsTemplateData" required: - data type: object CreateBackfilledDegradationRequestDataRelationshipsTemplateData: description: The data object identifying the template used to create the backfilled degradation. properties: id: description: The ID of the degradation template. example: "" type: string type: $ref: "#/components/schemas/PatchDegradationTemplateRequestDataType" required: - type - id type: object CreateBackfilledMaintenanceRequest: description: Request object for creating a backfilled maintenance. example: data: attributes: title: Past Database Maintenance updates: - components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: maintenance description: Database maintenance is in progress. started_at: "2026-04-27T13:37:31.038003786Z" status: in_progress - components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: operational description: Database maintenance has been completed successfully. started_at: "2026-04-27T14:37:31.038003786Z" status: completed type: maintenances properties: data: $ref: "#/components/schemas/CreateBackfilledMaintenanceRequestData" type: object CreateBackfilledMaintenanceRequestData: description: The data object for creating a backfilled maintenance. properties: attributes: $ref: "#/components/schemas/CreateBackfilledMaintenanceRequestDataAttributes" relationships: $ref: "#/components/schemas/CreateBackfilledMaintenanceRequestDataRelationships" type: $ref: "#/components/schemas/PatchMaintenanceRequestDataType" required: - type type: object CreateBackfilledMaintenanceRequestDataAttributes: description: The supported attributes for creating a backfilled maintenance. properties: title: description: The title of the backfilled maintenance. example: "" type: string updates: description: "The list of updates. Exactly two updates are required: the start (`in_progress`) and the end (`completed`)." items: $ref: "#/components/schemas/CreateBackfilledMaintenanceRequestDataAttributesUpdatesItems" maxItems: 2 minItems: 2 type: array required: - title - updates type: object CreateBackfilledMaintenanceRequestDataAttributesUpdatesItems: description: A backfilled maintenance update entry. properties: components_affected: description: The components affected. items: $ref: "#/components/schemas/CreateMaintenanceRequestDataAttributesComponentsAffectedItems" type: array description: description: A description of the update. example: "" type: string started_at: description: Timestamp of when the update occurred. example: "" format: date-time type: string status: $ref: "#/components/schemas/CreateMaintenanceRequestDataAttributesUpdatesItemsStatus" required: - description - started_at - status type: object CreateBackfilledMaintenanceRequestDataRelationships: description: The supported relationships for creating a backfilled maintenance. properties: template: $ref: "#/components/schemas/CreateBackfilledMaintenanceRequestDataRelationshipsTemplate" description: The template used to create the backfilled maintenance. type: object CreateBackfilledMaintenanceRequestDataRelationshipsTemplate: description: The template used to create the backfilled maintenance. properties: data: $ref: "#/components/schemas/CreateBackfilledMaintenanceRequestDataRelationshipsTemplateData" required: - data type: object CreateBackfilledMaintenanceRequestDataRelationshipsTemplateData: description: The data object identifying the template used to create the backfilled maintenance. properties: id: description: The ID of the maintenance template. example: "" type: string type: $ref: "#/components/schemas/PatchMaintenanceTemplateRequestDataType" required: - type - id type: object CreateCampaignRequest: description: Request to create a new campaign. properties: data: $ref: "#/components/schemas/CreateCampaignRequestData" required: - data type: object CreateCampaignRequestAttributes: description: Attributes for creating a new campaign. properties: description: description: The description of the campaign. example: Campaign to improve security posture for Q1 2024. type: string due_date: description: The due date of the campaign. example: "2024-03-31T23:59:59Z" format: date-time type: string entity_scope: description: Entity scope query to filter entities for this campaign. example: kind:service AND team:platform type: string guidance: description: Guidance for the campaign. example: Please ensure all services pass the security requirements. type: string key: description: The unique key for the campaign. example: q1-security-2024 type: string name: description: The name of the campaign. example: Q1 Security Campaign type: string owner_id: description: The UUID of the campaign owner. example: 550e8400-e29b-41d4-a716-446655440000 type: string rule_ids: description: Array of rule IDs associated with this campaign. example: ["q8MQxk8TCqrHnWkx", "r9NRyl9UDrsIoXly"] items: description: The unique ID of a scorecard rule. type: string type: array start_date: description: The start date of the campaign. example: "2024-01-01T00:00:00Z" format: date-time type: string status: $ref: "#/components/schemas/CampaignStatus" required: - name - key - owner_id - start_date - rule_ids type: object CreateCampaignRequestData: description: Data for creating a new campaign. properties: attributes: $ref: "#/components/schemas/CreateCampaignRequestAttributes" type: $ref: "#/components/schemas/CampaignType" required: - type - attributes type: object CreateCaseRequestArray: description: List of requests to create cases for security findings. properties: data: description: Array of case creation request data objects. items: $ref: "#/components/schemas/CreateCaseRequestData" type: array required: - data type: object CreateCaseRequestData: description: Data of the case to create. properties: attributes: $ref: "#/components/schemas/CreateCaseRequestDataAttributes" relationships: $ref: "#/components/schemas/CreateCaseRequestDataRelationships" type: $ref: "#/components/schemas/CaseDataType" required: - type type: object CreateCaseRequestDataAttributes: description: Attributes of the case to create. properties: assignee_id: description: Unique identifier of the user assigned to the case. example: "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0" type: string description: description: Description of the case. If not provided, the description will be automatically generated. example: "A description of the case." type: string priority: $ref: "#/components/schemas/CasePriority" description: Priority of the case. If not provided, the priority will be automatically set to "NOT_DEFINED". example: "P4" title: description: Title of the case. If not provided, the title will be automatically generated. example: "A title for the case." type: string type: object CreateCaseRequestDataRelationships: description: Relationships of the case to create. properties: findings: $ref: "#/components/schemas/Findings" description: Security findings to create a case for. project: $ref: "#/components/schemas/CaseManagementProject" description: Case management project in which the case will be created. required: - findings - project type: object CreateComponentRequest: description: Request object for creating a component. example: data: attributes: name: Metrics Intake position: 0 type: component relationships: group: data: type: components properties: data: $ref: "#/components/schemas/CreateComponentRequestData" type: object CreateComponentRequestData: description: The data object for creating a component. properties: attributes: $ref: "#/components/schemas/CreateComponentRequestDataAttributes" relationships: $ref: "#/components/schemas/CreateComponentRequestDataRelationships" type: $ref: "#/components/schemas/StatusPagesComponentGroupType" required: - attributes - type type: object CreateComponentRequestDataAttributes: description: The supported attributes for creating a component. properties: components: description: If creating a component of type `group`, the components to create within the group. example: - name: Login position: 0 type: component - name: Settings position: 1 type: component items: $ref: "#/components/schemas/CreateComponentRequestDataAttributesComponentsItems" type: array name: description: The name of the component. example: Web App type: string position: description: The zero-indexed position of the component. example: 0 format: int64 type: integer type: $ref: "#/components/schemas/CreateComponentRequestDataAttributesType" description: The type of the component. example: group required: - name - position - type type: object CreateComponentRequestDataAttributesComponentsItems: description: A component to be created within a group. properties: name: description: The name of the grouped component. example: "" type: string position: description: The zero-indexed position of the grouped component relative to the other components in the group. example: 0 format: int64 type: integer type: $ref: "#/components/schemas/StatusPagesComponentGroupAttributesComponentsItemsType" required: - name - position - type type: object CreateComponentRequestDataAttributesType: description: The type of the component. enum: - component - group example: component type: string x-enum-varnames: - COMPONENT - GROUP CreateComponentRequestDataRelationships: description: The supported relationships for creating a component. properties: group: $ref: "#/components/schemas/CreateComponentRequestDataRelationshipsGroup" description: The group to create the component within. type: object CreateComponentRequestDataRelationshipsGroup: description: The group to create the component within. properties: data: $ref: "#/components/schemas/CreateComponentRequestDataRelationshipsGroupData" required: - data type: object CreateComponentRequestDataRelationshipsGroupData: description: The data object identifying the group to create the component within. nullable: true properties: id: description: The ID of the group. example: "1234abcd-12ab-34cd-56ef-123456abcdef" format: uuid type: string type: $ref: "#/components/schemas/StatusPagesComponentGroupType" required: - type - id type: object CreateConnectionRequest: description: Request body for creating a new data source connection for an entity. example: data: attributes: fields: - description: Customer subscription tier from `CRM` display_name: Customer Tier id: customer_tier source_name: subscription_tier type: string - description: Customer lifetime value in `USD` display_name: Lifetime Value id: lifetime_value source_name: ltv type: number join_attribute: user_email join_type: email type: ref_table id: crm-integration type: connection_id properties: data: $ref: "#/components/schemas/CreateConnectionRequestData" type: object CreateConnectionRequestData: description: The data object containing the resource type and attributes for creating a new connection. properties: attributes: $ref: "#/components/schemas/CreateConnectionRequestDataAttributes" id: description: Unique identifier for the new connection resource. type: string type: $ref: "#/components/schemas/UpdateConnectionRequestDataType" required: - type type: object CreateConnectionRequestDataAttributes: description: Attributes defining the data source connection, including join configuration and custom fields. properties: details: $ref: "#/components/schemas/ListConnectionsResponseDataAttributesConnectionsItemsDetails" fields: description: List of custom attribute fields to import from the data source. items: $ref: "#/components/schemas/CreateConnectionRequestDataAttributesFieldsItems" type: array join_attribute: description: The attribute in the data source used to join records with the entity. example: "" type: string join_type: description: The type of join key used to link the data source to the entity (for example, email or user_id). example: "" type: string metadata: additionalProperties: type: string description: Additional key-value metadata associated with the connection. type: object name: description: Display name of the connection. maxLength: 255 type: string type: description: The type of data source connection (for example, ref_table). example: "" type: string required: - join_attribute - join_type - type type: object CreateConnectionRequestDataAttributesFieldsItems: description: Definition of a custom attribute field to import from a data source connection. properties: description: description: Human-readable explanation of what the field represents. type: string display_name: description: The human-readable label for the field shown in the UI. type: string groups: description: List of group labels used to categorize the field. items: description: A group label name for categorizing the field. type: string type: array id: description: The unique identifier for the field within the connection. example: "" type: string source_name: description: The name of the column or attribute in the source data system that maps to this field. example: "" type: string type: description: The data type of the field (for example, string or number). example: "" type: string required: - id - source_name - type type: object CreateCustomFrameworkRequest: description: Request object to create a custom framework. properties: data: $ref: "#/components/schemas/CustomFrameworkData" required: - data type: object CreateCustomFrameworkResponse: description: Response object to create a custom framework. properties: data: $ref: "#/components/schemas/FrameworkHandleAndVersionResponseData" required: - data type: object CreateDataDeletionRequestBody: description: Object needed to create a data deletion request. properties: data: $ref: "#/components/schemas/CreateDataDeletionRequestBodyData" required: - data type: object CreateDataDeletionRequestBodyAttributes: description: Attributes for creating a data deletion request. properties: displayed_total: description: Total number of elements to be deleted as displayed to the user. example: 100 format: int64 minimum: 1 type: integer from: description: Start of requested time window, milliseconds since Unix epoch. example: 1672527600000 format: int64 type: integer indexes: description: List of indexes for the search. If not provided, the search is performed in all indexes. example: ["test-index", "test-index-2"] items: description: Individual index. type: string type: array query: additionalProperties: type: string description: Query for creating a data deletion request. example: {"host": "abc", "service": "xyz"} type: object to: description: End of requested time window, milliseconds since Unix epoch. example: 1704063600000 format: int64 type: integer required: - query - from - to - displayed_total type: object CreateDataDeletionRequestBodyData: description: Data needed to create a data deletion request. properties: attributes: $ref: "#/components/schemas/CreateDataDeletionRequestBodyAttributes" type: $ref: "#/components/schemas/CreateDataDeletionRequestBodyDataType" required: - attributes - type type: object CreateDataDeletionRequestBodyDataType: description: The deletion request type. enum: - create_deletion_req example: "create_deletion_req" type: string x-enum-varnames: - CREATE_DELETION_REQ CreateDataDeletionResponseBody: description: The response from the create data deletion request endpoint. properties: data: $ref: "#/components/schemas/DataDeletionResponseItem" meta: $ref: "#/components/schemas/DataDeletionResponseMeta" type: object CreateDegradationRequest: description: Request object for creating a degradation. example: data: attributes: components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: degraded description: Our API is experiencing elevated latency. We are investigating the issue. status: investigating title: Elevated API Latency type: degradations properties: data: $ref: "#/components/schemas/CreateDegradationRequestData" meta: $ref: "#/components/schemas/DegradationRequestMeta" description: The supported metadata for creating a degradation. type: object CreateDegradationRequestData: description: The data object for creating a degradation. properties: attributes: $ref: "#/components/schemas/CreateDegradationRequestDataAttributes" relationships: $ref: "#/components/schemas/CreateDegradationRequestDataRelationships" type: $ref: "#/components/schemas/PatchDegradationRequestDataType" required: - attributes - type type: object CreateDegradationRequestDataAttributes: description: The supported attributes for creating a degradation. properties: components_affected: description: The components affected by the degradation. example: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: degraded items: $ref: "#/components/schemas/CreateDegradationRequestDataAttributesComponentsAffectedItems" type: array description: description: The description of the degradation. example: Our API is experiencing elevated latency. We are investigating the issue. type: string status: $ref: "#/components/schemas/CreateDegradationRequestDataAttributesStatus" description: The status of the degradation. example: investigating title: description: The title of the degradation. example: Elevated API Latency type: string required: - components_affected - status - title type: object CreateDegradationRequestDataAttributesComponentsAffectedItems: description: A component affected by a degradation. properties: id: description: The ID of the component. Must be a component of type `component`. example: "1234abcd-12ab-34cd-56ef-123456abcdef" format: uuid type: string name: description: The name of the component. readOnly: true type: string status: $ref: "#/components/schemas/StatusPagesComponentDataAttributesStatus" required: - id - status type: object CreateDegradationRequestDataAttributesStatus: description: The status of the degradation. enum: - investigating - identified - monitoring - resolved example: investigating type: string x-enum-varnames: - INVESTIGATING - IDENTIFIED - MONITORING - RESOLVED CreateDegradationRequestDataRelationships: description: The supported relationships for creating a degradation. properties: template: $ref: "#/components/schemas/CreateDegradationRequestDataRelationshipsTemplate" description: The template used to create the degradation. type: object CreateDegradationRequestDataRelationshipsTemplate: description: The template used to create the degradation. properties: data: $ref: "#/components/schemas/CreateDegradationRequestDataRelationshipsTemplateData" required: - data type: object CreateDegradationRequestDataRelationshipsTemplateData: description: The data object identifying the template used to create the degradation. properties: id: description: The ID of the degradation template. example: "" type: string type: $ref: "#/components/schemas/PatchDegradationTemplateRequestDataType" required: - type - id type: object CreateDegradationTemplateRequest: description: Request object for creating a degradation template. properties: data: $ref: "#/components/schemas/CreateDegradationTemplateRequestData" type: object CreateDegradationTemplateRequestData: description: The data object for creating a degradation template. properties: attributes: $ref: "#/components/schemas/CreateDegradationTemplateRequestDataAttributes" type: $ref: "#/components/schemas/PatchDegradationTemplateRequestDataType" required: - type type: object CreateDegradationTemplateRequestDataAttributes: description: The attributes for creating a degradation template. properties: components_affected: description: The components affected by a degradation created from this template. items: $ref: "#/components/schemas/CreateDegradationTemplateRequestDataAttributesComponentsAffectedItems" type: array degradation_title: description: The title used for a degradation created from this template. type: string name: description: The name of the degradation template. example: "" type: string updates: description: The pre-filled updates for a degradation created from this template. items: $ref: "#/components/schemas/CreateDegradationTemplateRequestDataAttributesUpdatesItems" type: array required: - name type: object CreateDegradationTemplateRequestDataAttributesComponentsAffectedItems: description: A component affected by a degradation created from this template. properties: id: description: The ID of the component. Must be a component of type `component`. example: "" type: string name: description: The name of the component. readOnly: true type: string status: $ref: "#/components/schemas/PatchDegradationTemplateRequestDataAttributesComponentsAffectedItemsStatus" required: - id - status type: object CreateDegradationTemplateRequestDataAttributesUpdatesItems: description: A pre-filled update for a degradation created from this template. properties: message: description: The message of the update. type: string status: $ref: "#/components/schemas/CreateDegradationRequestDataAttributesStatus" required: - status type: object CreateDeploymentGateParams: description: Parameters for creating a deployment gate. properties: data: $ref: "#/components/schemas/CreateDeploymentGateParamsData" required: - data type: object CreateDeploymentGateParamsData: description: Parameters for creating a deployment gate. properties: attributes: $ref: "#/components/schemas/CreateDeploymentGateParamsDataAttributes" type: $ref: "#/components/schemas/DeploymentGateDataType" required: - type - attributes type: object CreateDeploymentGateParamsDataAttributes: description: Parameters for creating a deployment gate. properties: dry_run: default: false description: Whether this gate is run in dry-run mode. example: false type: boolean env: description: The environment of the deployment gate. example: "production" type: string identifier: default: default description: The identifier of the deployment gate. example: "pre" type: string service: description: The service of the deployment gate. example: "my-service" type: string required: - env - service type: object CreateDeploymentRuleParams: description: Parameters for creating a deployment rule. properties: data: $ref: "#/components/schemas/CreateDeploymentRuleParamsData" type: object CreateDeploymentRuleParamsData: description: Parameters for creating a deployment rule. properties: attributes: $ref: "#/components/schemas/CreateDeploymentRuleParamsDataAttributes" type: $ref: "#/components/schemas/DeploymentRuleDataType" required: - type - attributes type: object CreateDeploymentRuleParamsDataAttributes: description: Parameters for creating a deployment rule. properties: dry_run: default: false description: Whether this rule is run in dry-run mode. example: false type: boolean name: description: The name of the deployment rule. example: "My deployment rule" type: string options: $ref: "#/components/schemas/DeploymentRulesOptions" type: description: The type of the deployment rule (faulty_deployment_detection or monitor). example: "faulty_deployment_detection" type: string required: - name - options - type type: object CreateEmailNotificationChannelConfig: description: "Configuration to create an e-mail notification channel" properties: address: description: "The e-mail address to be notified" example: "" type: string formats: description: Preferred content formats for notifications. example: - html items: $ref: "#/components/schemas/NotificationChannelEmailFormatType" type: array type: $ref: "#/components/schemas/NotificationChannelEmailConfigType" required: - type - address - formats type: object CreateEnvironmentAttributes: description: Attributes for creating a new environment. properties: is_production: default: false description: Indicates whether this is a production environment. example: false type: boolean name: description: The name of the environment. example: "env-search-term" type: string queries: description: List of queries to define the environment scope. example: ["staging", "test"] items: description: A query string used to match the environment scope. type: string minItems: 1 type: array require_feature_flag_approval: default: false description: Indicates whether feature flag changes require approval in this environment. example: false type: boolean required: - name - queries type: object CreateEnvironmentData: description: Data for creating a new environment. properties: attributes: $ref: "#/components/schemas/CreateEnvironmentAttributes" type: $ref: "#/components/schemas/CreateEnvironmentDataType" required: - type - attributes type: object CreateEnvironmentDataType: description: The resource type. enum: - "environments" example: "environments" type: string x-enum-varnames: - ENVIRONMENTS CreateEnvironmentRequest: description: Request to create a new environment. properties: data: $ref: "#/components/schemas/CreateEnvironmentData" required: - data type: object CreateFeatureFlagAttributes: description: Attributes for creating a new feature flag. properties: default_variant_key: description: The key of the default variant. example: "variant-abc123" nullable: true type: string description: description: The description of the feature flag. example: "This is an example feature flag for demonstration" type: string distribution_channel: $ref: "#/components/schemas/FeatureFlagDistributionChannel" json_schema: description: JSON schema for validation when value_type is JSON. example: '{"type": "object", "properties": {"enabled": {"type": "boolean"}}}' nullable: true type: string key: description: The unique key of the feature flag. example: "feature-flag-abc123" type: string name: description: The name of the feature flag. example: "Feature Flag ABC123" type: string require_approval: description: Indicates whether this feature flag requires approval for changes. example: false type: boolean staleness_status: $ref: "#/components/schemas/CreateFeatureFlagStalenessStatus" tags: description: Tags associated with the feature flag. example: [] items: description: A tag associated with the feature flag. type: string type: array value_type: $ref: "#/components/schemas/ValueType" variants: description: The variants of the feature flag. items: $ref: "#/components/schemas/CreateVariant" type: array required: - key - name - value_type - variants type: object CreateFeatureFlagData: description: Data for creating a new feature flag. properties: attributes: $ref: "#/components/schemas/CreateFeatureFlagAttributes" type: $ref: "#/components/schemas/CreateFeatureFlagDataType" required: - type - attributes type: object CreateFeatureFlagDataType: description: The resource type. enum: - "feature-flags" example: "feature-flags" type: string x-enum-varnames: - FEATURE_FLAGS CreateFeatureFlagRequest: description: Request to create a new feature flag. properties: data: $ref: "#/components/schemas/CreateFeatureFlagData" required: - data type: object CreateFeatureFlagStalenessStatus: description: The staleness status for the feature flag at creation. enum: - ACTIVE - PERMANENT example: "ACTIVE" type: string x-enum-varnames: - ACTIVE - PERMANENT CreateFormData: description: The data for creating a form. properties: attributes: $ref: "#/components/schemas/CreateFormDataAttributes" type: $ref: "#/components/schemas/FormType" required: - attributes - type type: object CreateFormDataAttributes: description: The attributes for creating a form. properties: anonymous: default: false description: Whether the form accepts anonymous submissions. example: false type: boolean data_definition: $ref: "#/components/schemas/FormDataDefinition" description: description: The description of the form. example: A form to collect user feedback. type: string idp_survey: default: false description: Whether the form is an IDP survey. example: false type: boolean name: description: The name of the form. example: User Feedback Form type: string single_response: default: false description: Whether each user can only submit one response. example: false type: boolean ui_definition: $ref: "#/components/schemas/FormUiDefinition" required: - data_definition - name - ui_definition type: object CreateFormRequest: description: A request to create a form. properties: data: $ref: "#/components/schemas/CreateFormData" required: - data type: object CreateIncidentNotificationRuleRequest: description: Create request for a notification rule. properties: data: $ref: "#/components/schemas/IncidentNotificationRuleCreateData" required: - data type: object CreateIncidentNotificationTemplateRequest: description: Create request for a notification template. properties: data: $ref: "#/components/schemas/IncidentNotificationTemplateCreateData" required: - data type: object CreateJiraIssueRequestArray: description: List of requests to create Jira issues for security findings. properties: data: description: Array of Jira issue creation request data objects. items: $ref: "#/components/schemas/CreateJiraIssueRequestData" type: array required: - data type: object CreateJiraIssueRequestData: description: Data of the Jira issue to create. properties: attributes: $ref: "#/components/schemas/CreateJiraIssueRequestDataAttributes" relationships: $ref: "#/components/schemas/CreateJiraIssueRequestDataRelationships" type: $ref: "#/components/schemas/JiraIssuesDataType" required: - type type: object CreateJiraIssueRequestDataAttributes: description: Attributes of the Jira issue to create. properties: assignee_id: description: Unique identifier of the Datadog user assigned to the Jira issue. example: "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0" type: string description: description: Description of the Jira issue. If not provided, the description will be automatically generated. example: "A description of the Jira issue." type: string fields: additionalProperties: {} description: Custom fields of the Jira issue to create. For the list of available fields, see [Jira documentation](https://developer.atlassian.com/cloud/jira/platform/rest/v2/api-group-issues/#api-rest-api-2-issue-createmeta-projectidorkey-issuetypes-issuetypeid-get). example: {"key1": "value", "key2": ["value"], "key3": {"key4": "value"}} type: object priority: $ref: "#/components/schemas/CasePriority" description: Datadog case priority mapped to the Jira issue priority. If not provided, the priority will be automatically set to "NOT_DEFINED". To configure the mapping, see [Bidirectional ticket syncing with Jira](https://docs.datadoghq.com/security/ticketing_integrations/#bidirectional-ticket-syncing-with-jira). example: "P4" title: description: Title of the Jira issue. If not provided, the title will be automatically generated. example: "A title for the Jira issue." type: string type: object CreateJiraIssueRequestDataRelationships: description: Relationships of the Jira issue to create. properties: findings: $ref: "#/components/schemas/Findings" description: Security findings to create a Jira issue for. project: $ref: "#/components/schemas/CaseManagementProject" description: Case management project configured with the Jira integration. It is used to create the Jira issue. To configure the Jira integration, see [Bidirectional ticket syncing with Jira](https://docs.datadoghq.com/security/ticketing_integrations/#bidirectional-ticket-syncing-with-jira). required: - findings - project type: object CreateLinearIssueRequestArray: description: List of requests to create Linear issues for security findings. properties: data: description: Array of Linear issue creation request data objects. items: $ref: "#/components/schemas/CreateLinearIssueRequestData" type: array required: - data type: object CreateLinearIssueRequestData: description: Data of the Linear issue to create. properties: attributes: $ref: "#/components/schemas/CreateLinearIssueRequestDataAttributes" relationships: $ref: "#/components/schemas/CreateLinearIssueRequestDataRelationships" type: $ref: "#/components/schemas/LinearIssuesDataType" required: - type type: object CreateLinearIssueRequestDataAttributes: description: Attributes of the Linear issue to create. properties: assignee_id: description: Unique identifier of the Datadog user assigned to the Linear issue. example: "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0" type: string description: description: Description of the Linear issue. If not provided, the description will be automatically generated. example: "A description of the Linear issue." type: string label_ids: description: Linear label IDs to set on the created issue. example: - "a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d" items: description: A Linear label ID. type: string type: array linear_project_id: description: Unique identifier of the Linear project to pin the issue to. If not provided, the issue is not associated with a Linear project. example: "d4c3b2a1-6f5e-8b7a-0d9c-2f1e4a3b6c5d" type: string priority: $ref: "#/components/schemas/CasePriority" description: Datadog case priority mapped to the Linear issue priority. If not provided, the priority will be automatically set to "NOT_DEFINED". example: "P4" title: description: Title of the Linear issue. If not provided, the title will be automatically generated. example: "A title for the Linear issue." type: string type: object CreateLinearIssueRequestDataRelationships: description: Relationships of the Linear issue to create. properties: findings: $ref: "#/components/schemas/Findings" description: Security findings to create a Linear issue for. project: $ref: "#/components/schemas/CaseManagementProject" description: Case management project configured with the Linear integration. It is used to create the Linear issue. required: - findings - project type: object CreateMaintenanceRequest: description: Request object for creating a maintenance. example: data: attributes: completed_date: "2026-02-18T19:51:13.332360075Z" completed_description: We have completed maintenance on the API to improve performance. components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: operational in_progress_description: We are currently performing maintenance on the API to improve performance. scheduled_description: We will be performing maintenance on the API to improve performance. start_date: "2026-02-18T19:21:13.332360075Z" title: API Maintenance type: maintenances properties: data: $ref: "#/components/schemas/CreateMaintenanceRequestData" type: object CreateMaintenanceRequestData: description: The data object for creating a maintenance. properties: attributes: $ref: "#/components/schemas/CreateMaintenanceRequestDataAttributes" relationships: $ref: "#/components/schemas/CreateMaintenanceRequestDataRelationships" type: $ref: "#/components/schemas/PatchMaintenanceRequestDataType" required: - attributes - type type: object CreateMaintenanceRequestDataAttributes: description: The supported attributes for creating a maintenance. properties: completed_date: description: Timestamp of when the maintenance was completed. example: "2026-02-18T19:51:13.332360075Z" format: date-time type: string completed_description: description: The description shown when the maintenance is completed. example: "We have completed maintenance on the API to improve performance." type: string components_affected: description: The components affected by the maintenance. items: $ref: "#/components/schemas/CreateMaintenanceRequestDataAttributesComponentsAffectedItems" type: array in_progress_description: description: The description shown while the maintenance is in progress. example: "We are currently performing maintenance on the API to improve performance." type: string scheduled_description: description: The description shown when the maintenance is scheduled. example: "We will be performing maintenance on the API to improve performance." type: string start_date: description: Timestamp of when the maintenance is scheduled to start. example: "2026-02-18T19:21:13.332360075Z" format: date-time type: string title: description: The title of the maintenance. example: "API Maintenance" type: string required: - title - completed_date - completed_description - scheduled_description - start_date - in_progress_description type: object CreateMaintenanceRequestDataAttributesComponentsAffectedItems: description: A component affected by a maintenance. properties: id: description: The ID of the component. Must be a component of type `component`. example: "1234abcd-12ab-34cd-56ef-123456abcdef" format: uuid type: string name: description: The name of the component. readOnly: true type: string status: $ref: "#/components/schemas/PatchMaintenanceRequestDataAttributesComponentsAffectedItemsStatus" required: - id - status type: object CreateMaintenanceRequestDataAttributesUpdatesItemsStatus: description: The status of a maintenance update. enum: - in_progress - completed example: in_progress type: string x-enum-varnames: - IN_PROGRESS - COMPLETED CreateMaintenanceRequestDataRelationships: description: The supported relationships for creating a maintenance. properties: template: $ref: "#/components/schemas/CreateMaintenanceRequestDataRelationshipsTemplate" description: The template used to create the maintenance. type: object CreateMaintenanceRequestDataRelationshipsTemplate: description: The template used to create the maintenance. properties: data: $ref: "#/components/schemas/CreateMaintenanceRequestDataRelationshipsTemplateData" required: - data type: object CreateMaintenanceRequestDataRelationshipsTemplateData: description: The data object identifying the template used to create the maintenance. properties: id: description: The ID of the maintenance template. example: "" type: string type: $ref: "#/components/schemas/PatchMaintenanceTemplateRequestDataType" required: - type - id type: object CreateMaintenanceTemplateRequest: description: Request object for creating a maintenance template. properties: data: $ref: "#/components/schemas/CreateMaintenanceTemplateRequestData" type: object CreateMaintenanceTemplateRequestData: description: The data object for creating a maintenance template. properties: attributes: $ref: "#/components/schemas/CreateMaintenanceTemplateRequestDataAttributes" type: $ref: "#/components/schemas/PatchMaintenanceTemplateRequestDataType" required: - type type: object CreateMaintenanceTemplateRequestDataAttributes: description: The attributes for creating a maintenance template. properties: completed_description: description: The description shown when a maintenance created from this template is completed. type: string component_ids: description: The IDs of the components affected by a maintenance created from this template. items: type: string type: array in_progress_description: description: The description shown while a maintenance created from this template is in progress. type: string maintenance_title: description: The title used for a maintenance created from this template. type: string name: description: The name of the maintenance template. example: "" type: string scheduled_description: description: The description shown when a maintenance created from this template is scheduled. type: string required: - name type: object CreateNotificationChannelAttributes: description: Attributes for creating an on-call notification channel. properties: config: $ref: "#/components/schemas/CreateNotificationChannelConfig" description: Notification channel configuration type: object CreateNotificationChannelConfig: description: "Defines the configuration for creating an On-Call notification channel" oneOf: - $ref: "#/components/schemas/CreatePhoneNotificationChannelConfig" - $ref: "#/components/schemas/CreateEmailNotificationChannelConfig" CreateNotificationChannelData: description: Data for creating an on-call notification channel properties: attributes: $ref: "#/components/schemas/CreateNotificationChannelAttributes" type: $ref: "#/components/schemas/NotificationChannelType" required: - type type: object CreateNotificationRuleParameters: description: Body of the notification rule create request. properties: data: $ref: "#/components/schemas/CreateNotificationRuleParametersData" type: object CreateNotificationRuleParametersData: description: |- Data of the notification rule create request: the rule type, and the rule attributes. All fields are required. properties: attributes: $ref: "#/components/schemas/CreateNotificationRuleParametersDataAttributes" type: $ref: "#/components/schemas/NotificationRulesType" required: - attributes - type type: object CreateNotificationRuleParametersDataAttributes: description: |- Attributes of the notification rule create request. properties: enabled: $ref: "#/components/schemas/Enabled" name: $ref: "#/components/schemas/RuleName" routing: $ref: "#/components/schemas/NotificationRuleRouting" selectors: $ref: "#/components/schemas/Selectors" targets: $ref: "#/components/schemas/Targets" time_aggregation: $ref: "#/components/schemas/TimeAggregation" required: - selectors - name - targets type: object CreateOnCallNotificationRuleRequest: description: A top-level wrapper for creating a notification rule for a user example: data: attributes: "category": "high_urgency" channel_settings: method: "sms" type: "phone" "delay_minutes": 1 relationships: channel: data: id: 1562fab3-a8c2-49e2-8f3a-28dcda2405e2 type: notification_channels type: notification_rules properties: data: $ref: "#/components/schemas/CreateOnCallNotificationRuleRequestData" required: - data type: object CreateOnCallNotificationRuleRequestData: description: Data for creating an on-call notification rule properties: attributes: $ref: "#/components/schemas/OnCallNotificationRuleRequestAttributes" relationships: $ref: "#/components/schemas/OnCallNotificationRuleRelationships" type: $ref: "#/components/schemas/OnCallNotificationRuleType" required: - type type: object CreateOpenAPIResponse: description: Response for `CreateOpenAPI` operation. properties: data: $ref: "#/components/schemas/CreateOpenAPIResponseData" type: object CreateOpenAPIResponseAttributes: description: Attributes for `CreateOpenAPI`. properties: failed_endpoints: description: List of endpoints which couldn't be parsed. items: $ref: "#/components/schemas/OpenAPIEndpoint" type: array type: object CreateOpenAPIResponseData: description: Data envelope for `CreateOpenAPIResponse`. properties: attributes: $ref: "#/components/schemas/CreateOpenAPIResponseAttributes" id: $ref: "#/components/schemas/ApiID" type: object CreateOrUpdateWidgetRequest: description: Request body for creating or updating a widget. properties: data: $ref: "#/components/schemas/CreateOrUpdateWidgetRequestData" required: - data type: object CreateOrUpdateWidgetRequestAttributes: description: Attributes for creating or updating a widget. properties: definition: $ref: "#/components/schemas/WidgetDefinition" tags: description: User-defined tags for organizing the widget. items: description: A single user-defined tag. type: string nullable: true type: array required: - definition type: object CreateOrUpdateWidgetRequestData: description: Data for creating or updating a widget. properties: attributes: $ref: "#/components/schemas/CreateOrUpdateWidgetRequestAttributes" type: description: Widgets resource type. example: widgets type: string required: - type - attributes type: object CreateOverrideRequestAttributes: description: Attributes for creating an on-call schedule override. properties: end: description: The end time of the override. example: "2024-01-08T02:53:01.000000000Z" format: date-time type: string start: description: The start time of the override. example: "2024-01-07T02:53:01.000000000Z" format: date-time type: string required: - start - end type: object CreateOverrideRequestData: description: Data for creating an on-call schedule override. properties: attributes: $ref: "#/components/schemas/CreateOverrideRequestAttributes" relationships: $ref: "#/components/schemas/CreateOverrideRequestRelationships" type: $ref: "#/components/schemas/OverrideDataType" required: - type - attributes type: object CreateOverrideRequestRelationships: description: Relationships to set when creating an on-call schedule override. properties: overridden_user: $ref: "#/components/schemas/OverrideRelationshipsUser" user: $ref: "#/components/schemas/OverrideRelationshipsUser" type: object CreateOverridesRequest: description: Request to create one or more on-call schedule overrides. You can create up to 25 overrides in a single request. properties: data: description: A list of on-call schedule overrides to create. items: $ref: "#/components/schemas/CreateOverrideRequestData" maxItems: 25 minItems: 1 type: array required: - data type: object CreatePageRequest: description: Full request to trigger an On-Call Page. example: data: attributes: description: Page details. tags: - service:test target: identifier: my-team type: team_handle title: Page title urgency: low type: pages properties: data: $ref: "#/components/schemas/CreatePageRequestData" type: object CreatePageRequestData: description: The main request body, including attributes and resource type. properties: attributes: $ref: "#/components/schemas/CreatePageRequestDataAttributes" type: $ref: "#/components/schemas/CreatePageRequestDataType" required: - type type: object CreatePageRequestDataAttributes: description: Details about the On-Call Page you want to create. properties: description: description: A short summary of the issue or context. type: string tags: description: Tags to help categorize or filter the page. items: description: A single tag for categorizing the page. type: string type: array target: $ref: "#/components/schemas/CreatePageRequestDataAttributesTarget" title: description: The title of the page. example: "Service: Test is down" type: string urgency: $ref: "#/components/schemas/PageUrgency" required: - target - title - urgency type: object CreatePageRequestDataAttributesTarget: description: Information about the target to notify (such as a team or user). properties: identifier: description: Identifier for the target (for example, team handle or user ID). type: string type: $ref: "#/components/schemas/OnCallPageTargetType" type: object CreatePageRequestDataType: default: pages description: The type of resource used when creating an On-Call Page. enum: - pages example: pages type: string x-enum-varnames: - PAGES CreatePageResponse: description: The full response object after creating a new On-Call Page. example: data: id: 15e74b8b-f865-48d0-bcc5-453323ed2c8f type: pages properties: data: $ref: "#/components/schemas/CreatePageResponseData" type: object CreatePageResponseData: description: The information returned after successfully creating a page. properties: id: description: The unique ID of the created page. type: string type: $ref: "#/components/schemas/CreatePageResponseDataType" required: - type type: object CreatePageResponseDataType: default: pages description: The type of resource used when creating an On-Call Page. enum: - pages example: pages type: string x-enum-varnames: - PAGES CreatePhoneNotificationChannelConfig: description: "Configuration to create a phone notification channel" properties: number: description: "The E-164 formatted phone number (e.g. +3371234567)" example: "" type: string type: $ref: "#/components/schemas/NotificationChannelPhoneConfigType" required: - type - number type: object CreatePublishRequestRequest: description: A request to ask for approval to publish an app whose protection level is `approval_required`. example: data: attributes: description: Adds new dashboard widgets and a few bug fixes. title: Release v1.2 to production type: publishRequest properties: data: $ref: "#/components/schemas/CreatePublishRequestRequestData" type: object CreatePublishRequestRequestData: description: Data for creating a publish request. properties: attributes: $ref: "#/components/schemas/CreatePublishRequestRequestDataAttributes" type: $ref: "#/components/schemas/PublishRequestType" type: object CreatePublishRequestRequestDataAttributes: description: Attributes for creating a publish request. properties: description: description: An optional description of the changes in this publish request. example: Adds new dashboard widgets and a few bug fixes. type: string title: description: A short title for the publish request. example: Release v1.2 to production type: string required: - title type: object CreateRuleRequest: description: Scorecard create rule request. properties: data: $ref: "#/components/schemas/CreateRuleRequestData" type: object CreateRuleRequestData: description: Scorecard create rule request data. properties: attributes: $ref: "#/components/schemas/RuleAttributesRequest" type: $ref: "#/components/schemas/RuleType" type: object CreateRuleResponse: description: Created rule in response. properties: data: $ref: "#/components/schemas/CreateRuleResponseData" type: object CreateRuleResponseData: description: Create rule response data. properties: attributes: $ref: "#/components/schemas/RuleAttributes" id: $ref: "#/components/schemas/RuleId" relationships: $ref: "#/components/schemas/RelationshipToRule" type: $ref: "#/components/schemas/RuleType" type: object CreateRulesetRequest: description: The definition of `CreateRulesetRequest` object. example: data: attributes: enabled: true rules: - enabled: true mapping: metadata: name: Add Cost Center Tag query: addition: key: cost_center value: engineering case_insensitivity: false if_tag_exists: do_not_apply query: account_id:"123456789" AND service:"web-api" reference_table: id: New Ruleset type: create_ruleset properties: data: $ref: "#/components/schemas/CreateRulesetRequestData" type: object CreateRulesetRequestData: description: The definition of `CreateRulesetRequestData` object. properties: attributes: $ref: "#/components/schemas/CreateRulesetRequestDataAttributes" id: description: The `CreateRulesetRequestData` `id`. type: string type: $ref: "#/components/schemas/CreateRulesetRequestDataType" required: - type type: object CreateRulesetRequestDataAttributes: description: The definition of `CreateRulesetRequestDataAttributes` object. properties: enabled: description: The `attributes` `enabled`. type: boolean rules: description: The `attributes` `rules`. items: $ref: "#/components/schemas/CreateRulesetRequestDataAttributesRulesItems" type: array required: - rules type: object CreateRulesetRequestDataAttributesRulesItems: description: The definition of `CreateRulesetRequestDataAttributesRulesItems` object. properties: enabled: description: The `items` `enabled`. example: false type: boolean mapping: $ref: "#/components/schemas/DataAttributesRulesItemsMapping" metadata: $ref: "#/components/schemas/RulesetItemMetadata" name: description: The `items` `name`. example: "" type: string query: $ref: "#/components/schemas/CreateRulesetRequestDataAttributesRulesItemsQuery" reference_table: $ref: "#/components/schemas/CreateRulesetRequestDataAttributesRulesItemsReferenceTable" required: - enabled - name type: object CreateRulesetRequestDataAttributesRulesItemsQuery: description: The definition of `CreateRulesetRequestDataAttributesRulesItemsQuery` object. nullable: true properties: addition: $ref: "#/components/schemas/CreateRulesetRequestDataAttributesRulesItemsQueryAddition" case_insensitivity: description: The `query` `case_insensitivity`. type: boolean if_not_exists: deprecated: true description: Deprecated. Use `if_tag_exists` instead. The `query` `if_not_exists`. type: boolean if_tag_exists: $ref: "#/components/schemas/DataAttributesRulesItemsIfTagExists" query: description: The `query` `query`. example: "" type: string required: - addition - query type: object CreateRulesetRequestDataAttributesRulesItemsQueryAddition: description: The definition of `CreateRulesetRequestDataAttributesRulesItemsQueryAddition` object. nullable: true properties: key: description: The `addition` `key`. example: "" type: string value: description: The `addition` `value`. example: "" type: string required: - key - value type: object CreateRulesetRequestDataAttributesRulesItemsReferenceTable: description: The definition of `CreateRulesetRequestDataAttributesRulesItemsReferenceTable` object. nullable: true properties: case_insensitivity: description: The `reference_table` `case_insensitivity`. type: boolean field_pairs: description: The `reference_table` `field_pairs`. items: $ref: "#/components/schemas/CreateRulesetRequestDataAttributesRulesItemsReferenceTableFieldPairsItems" type: array if_not_exists: deprecated: true description: Deprecated. Use `if_tag_exists` instead. The `reference_table` `if_not_exists`. type: boolean if_tag_exists: $ref: "#/components/schemas/DataAttributesRulesItemsIfTagExists" source_keys: description: The `reference_table` `source_keys`. example: - "" items: description: A source key for the reference table lookup. type: string type: array table_name: description: The `reference_table` `table_name`. example: "" type: string required: - field_pairs - source_keys - table_name type: object CreateRulesetRequestDataAttributesRulesItemsReferenceTableFieldPairsItems: description: The definition of `CreateRulesetRequestDataAttributesRulesItemsReferenceTableFieldPairsItems` object. properties: input_column: description: The `items` `input_column`. example: "" type: string output_key: description: The `items` `output_key`. example: "" type: string required: - input_column - output_key type: object CreateRulesetRequestDataType: default: create_ruleset description: Create ruleset resource type. enum: - create_ruleset example: create_ruleset type: string x-enum-varnames: - CREATE_RULESET CreateServiceNowTicketRequestArray: description: List of requests to create ServiceNow tickets for security findings. properties: data: description: Array of ServiceNow ticket creation request data objects. items: $ref: "#/components/schemas/CreateServiceNowTicketRequestData" type: array required: - data type: object CreateServiceNowTicketRequestData: description: Data of the ServiceNow ticket to create. properties: attributes: $ref: "#/components/schemas/CreateServiceNowTicketRequestDataAttributes" relationships: $ref: "#/components/schemas/CreateServiceNowTicketRequestDataRelationships" type: $ref: "#/components/schemas/ServiceNowTicketsDataType" required: - relationships - type type: object CreateServiceNowTicketRequestDataAttributes: description: Attributes of the ServiceNow ticket to create. properties: assignee_id: description: Unique identifier of the Datadog user assigned to the case backing the ServiceNow ticket. example: "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0" type: string description: description: Description of the ServiceNow ticket. If not provided, the description will be automatically generated. example: "A description of the ServiceNow ticket." type: string priority: $ref: "#/components/schemas/CasePriority" description: Datadog case priority mapped to the ServiceNow ticket priority. If not provided, the priority will be automatically set to "NOT_DEFINED". example: "P4" title: description: Title of the ServiceNow ticket. If not provided, the title will be automatically generated. example: "A title for the ServiceNow ticket." type: string type: object CreateServiceNowTicketRequestDataRelationships: description: Relationships of the ServiceNow ticket to create. properties: findings: $ref: "#/components/schemas/Findings" description: Security findings to create a ServiceNow ticket for. project: $ref: "#/components/schemas/CaseManagementProject" description: Case management project configured with the ServiceNow integration. It is used to create the ServiceNow ticket. required: - findings - project type: object CreateSnapshotAdditionalConfig: description: Additional configuration options for snapshot creation. properties: template_variables: $ref: "#/components/schemas/CreateSnapshotTemplateVariables" timeseries_legend_type: $ref: "#/components/schemas/CreateSnapshotTimeseriesLegendType" timezone_offset_minutes: description: Timezone offset in minutes from UTC. Positive values are west of UTC (for example, `300` for UTC-5). Use `0` for UTC. example: 300 format: int64 type: integer type: object CreateSnapshotDataAttributesRequest: description: Attributes for snapshot creation. properties: additional_config: $ref: "#/components/schemas/CreateSnapshotAdditionalConfig" end: description: End of the time window for the snapshot, in milliseconds since Unix epoch. example: 1692464800000 format: int64 type: integer height: description: The height of the rendered snapshot in pixels. example: 185 format: int64 type: integer is_authenticated: description: Whether the snapshot requires authentication to view. Authenticated snapshots are scoped to the creating organization. example: false type: boolean start: description: Start of the time window for the snapshot, in milliseconds since Unix epoch. example: 1692464000000 format: int64 type: integer ttl: $ref: "#/components/schemas/CreateSnapshotTTL" widget_definition: additionalProperties: {} description: The widget definition to render as a snapshot. Must include a valid `type` field and non-empty `requests` array. example: requests: - q: "avg:system.cpu.user{*}" type: timeseries type: object width: description: The width of the rendered snapshot in pixels. example: 300 format: int64 type: integer required: - widget_definition - start - end type: object CreateSnapshotDataAttributesResponse: description: Attributes of the created snapshot. properties: url: description: The URL to access the rendered snapshot image. example: https://app.datadoghq.com/api/v2/snapshot/view/public/60d/00000000-0000-0000-0000-000000000000/1692464400000-12345678-1234-5678-9abc-def123456789.png type: string required: - url type: object CreateSnapshotDataRequest: description: Data envelope for snapshot creation. properties: attributes: $ref: "#/components/schemas/CreateSnapshotDataAttributesRequest" type: $ref: "#/components/schemas/CreateSnapshotType" required: - type - attributes type: object CreateSnapshotDataResponse: description: Data envelope for the snapshot creation response. properties: attributes: $ref: "#/components/schemas/CreateSnapshotDataAttributesResponse" id: description: The unique identifier of the created snapshot. example: 12345678-1234-5678-9abc-def123456789 type: string type: $ref: "#/components/schemas/CreateSnapshotType" required: - id - type - attributes type: object CreateSnapshotRequest: description: Request body for creating a graph snapshot. properties: data: $ref: "#/components/schemas/CreateSnapshotDataRequest" required: - data type: object CreateSnapshotResponse: description: Response body for a snapshot creation request. properties: data: $ref: "#/components/schemas/CreateSnapshotDataResponse" required: - data type: object CreateSnapshotTTL: description: The time-to-live for the snapshot. This value corresponds to storage lifecycle policies that automatically delete the snapshot after the specified period. enum: - 30d - 60d - 90d - 1y - 2y - inf example: 60d type: string x-enum-varnames: - THIRTY_DAYS - SIXTY_DAYS - NINETY_DAYS - ONE_YEAR - TWO_YEARS - INFINITE CreateSnapshotTemplateVariable: description: A template variable definition for snapshot rendering. properties: name: description: The template variable name. example: host type: string prefix: description: The tag prefix associated with the template variable. For example, a prefix of `host` with a value of `web-server-1` scopes the snapshot to `host:web-server-1`. example: host type: string values: description: The list of scoped values for this template variable. example: - web-server-1 - web-server-2 items: description: A single scoped value for the template variable. type: string type: array required: - name - prefix - values type: object CreateSnapshotTemplateVariables: description: List of template variable definitions for snapshot rendering. items: $ref: "#/components/schemas/CreateSnapshotTemplateVariable" type: array CreateSnapshotTimeseriesLegendType: description: The legend display type for timeseries widgets. A value of `none` hides the legend entirely; omitting the field lets the frontend choose automatically. enum: - compact - expanded - none example: expanded type: string x-enum-varnames: - COMPACT - EXPANDED - NONE CreateSnapshotType: description: The type identifier for snapshot creation resources. enum: - create_snapshot example: create_snapshot type: string x-enum-varnames: - CREATE_SNAPSHOT CreateStatusPageRequest: description: Request object for creating a status page. example: data: attributes: company_logo: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAIKMMMM components: - name: API position: 0 type: component - components: - name: Login position: 0 type: component - name: Settings position: 1 type: component name: Web App position: 1 type: group - name: Webhooks position: 2 type: component domain_prefix: status-page-us1 email_header_image: data:image/png;base64,pQSLAw0KGgoAAAANSUhEUgAAAQ4AASJKFF favicon: data:image/png;base64,kWMRNw0KGgoAAAANSUhEUgAAAEAAAABACA name: Status Page US1 subscriptions_enabled: true type: public visualization_type: bars_and_uptime_percentage type: status_pages properties: data: $ref: "#/components/schemas/CreateStatusPageRequestData" type: object CreateStatusPageRequestData: description: The data object for creating a status page. properties: attributes: $ref: "#/components/schemas/CreateStatusPageRequestDataAttributes" type: $ref: "#/components/schemas/StatusPageDataType" required: - attributes - type type: object CreateStatusPageRequestDataAttributes: description: The supported attributes for creating a status page. properties: company_logo: description: The base64-encoded image data displayed on the status page. example: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAIKMMMM type: string components: description: The components displayed on the status page. example: - components: - name: Login position: 0 type: component - name: Settings position: 1 type: component name: Web App position: 0 type: group - name: API position: 1 type: component - name: Webhooks position: 2 type: component items: $ref: "#/components/schemas/CreateStatusPageRequestDataAttributesComponentsItems" type: array domain_prefix: description: The subdomain of the status page's url taking the form `https://{domain_prefix}.statuspage.datadoghq.com`. Globally unique across Datadog Status Pages. example: status-page-us1 type: string email_header_image: description: Base64-encoded image data included in email notifications sent to status page subscribers. example: data:image/png;base64,pQSLAw0KGgoAAAANSUhEUgAAAQ4AASJKFF type: string favicon: description: Base64-encoded image data displayed in the browser tab. example: data:image/png;base64,kWMRNw0KGgoAAAANSUhEUgAAAEAAAABACA type: string name: description: The name of the status page. example: Status Page US1 type: string rss_feed_enabled: description: Whether the RSS feed is enabled for the status page. type: boolean slack_app_icon: description: The Slack app icon URL for the status page. type: string slack_subscriptions_enabled: description: Whether Slack subscriptions are enabled for the status page. type: boolean subscriptions_enabled: description: Whether users can subscribe to the status page. example: true type: boolean type: $ref: "#/components/schemas/CreateStatusPageRequestDataAttributesType" example: public visualization_layout: $ref: "#/components/schemas/CreateStatusPageRequestDataAttributesVisualizationLayout" example: list visualization_type: $ref: "#/components/schemas/CreateStatusPageRequestDataAttributesVisualizationType" example: bars_and_uptime_percentage required: - domain_prefix - name - type - visualization_type type: object CreateStatusPageRequestDataAttributesComponentsItems: description: A component to be created on a status page. properties: components: description: If creating a component of type `group`, the components to create within the group. items: $ref: "#/components/schemas/CreateStatusPageRequestDataAttributesComponentsItemsComponentsItems" type: array id: description: The ID of the component. format: uuid readOnly: true type: string name: description: The name of the component. type: string position: description: The zero-indexed position of the component. format: int64 type: integer status: $ref: "#/components/schemas/StatusPagesComponentGroupAttributesComponentsItemsStatus" type: $ref: "#/components/schemas/CreateComponentRequestDataAttributesType" type: object CreateStatusPageRequestDataAttributesComponentsItemsComponentsItems: description: A grouped component to be created within a status page component group. properties: id: description: The ID of the grouped component. format: uuid readOnly: true type: string name: description: The name of the grouped component. type: string position: description: The zero-indexed position of the grouped component. Relative to the other components in the group. format: int64 type: integer status: $ref: "#/components/schemas/StatusPagesComponentGroupAttributesComponentsItemsStatus" type: $ref: "#/components/schemas/StatusPagesComponentGroupAttributesComponentsItemsType" type: object CreateStatusPageRequestDataAttributesType: description: The type of the status page controlling how the status page is accessed. enum: - public - internal example: public type: string x-enum-varnames: - PUBLIC - INTERNAL CreateStatusPageRequestDataAttributesVisualizationLayout: description: The layout of components on the status page. Defaults to `list`. `grid` requires `visualization_type` to be `component_name_only`; changing `visualization_type` to any other value resets the layout to `list`. enum: - list - grid example: list type: string x-enum-varnames: - LIST - GRID CreateStatusPageRequestDataAttributesVisualizationType: description: The visualization type of the status page. enum: - bars_and_uptime_percentage - bars_only - component_name_only example: bars_and_uptime_percentage type: string x-enum-varnames: - BARS_AND_UPTIME_PERCENTAGE - BARS_ONLY - COMPONENT_NAME_ONLY CreateTableRequest: description: Request body for creating a new reference table from a local file or cloud storage. properties: data: $ref: "#/components/schemas/CreateTableRequestData" type: object CreateTableRequestData: additionalProperties: false description: The data object containing the table definition. properties: attributes: $ref: "#/components/schemas/CreateTableRequestDataAttributes" type: $ref: "#/components/schemas/CreateTableRequestDataType" required: - type type: object CreateTableRequestDataAttributes: description: Attributes that define the reference table's configuration and properties. properties: description: description: Optional text describing the purpose or contents of this reference table. type: string file_metadata: $ref: "#/components/schemas/CreateTableRequestDataAttributesFileMetadata" schema: $ref: "#/components/schemas/CreateTableRequestDataAttributesSchema" source: $ref: "#/components/schemas/ReferenceTableCreateSourceType" table_name: description: Name to identify this reference table. example: "table_1" type: string tags: description: Tags for organizing and filtering reference tables. example: - "tag_1" - "tag_2" items: description: A tag associated with the reference table. type: string type: array required: - table_name - schema - source type: object CreateTableRequestDataAttributesFileMetadata: description: Metadata specifying where and how to access the reference table's data file. oneOf: - $ref: "#/components/schemas/CreateTableRequestDataAttributesFileMetadataCloudStorage" - $ref: "#/components/schemas/CreateTableRequestDataAttributesFileMetadataLocalFile" CreateTableRequestDataAttributesFileMetadataCloudStorage: additionalProperties: false description: Cloud storage file metadata for create requests. Both access_details and sync_enabled are required. properties: access_details: $ref: "#/components/schemas/CreateTableRequestDataAttributesFileMetadataOneOfAccessDetails" sync_enabled: description: Whether this table is synced automatically. example: false type: boolean required: - access_details - sync_enabled title: CloudFileMetadataV2 type: object CreateTableRequestDataAttributesFileMetadataLocalFile: additionalProperties: false description: Local file metadata for create requests using the upload ID. properties: upload_id: description: The upload ID. example: "00000000-0000-0000-0000-000000000000" type: string required: - upload_id title: LocalFileMetadataV2 type: object CreateTableRequestDataAttributesFileMetadataOneOfAccessDetails: description: Cloud storage access configuration for the reference table data file. properties: aws_detail: $ref: "#/components/schemas/CreateTableRequestDataAttributesFileMetadataOneOfAccessDetailsAwsDetail" azure_detail: $ref: "#/components/schemas/CreateTableRequestDataAttributesFileMetadataOneOfAccessDetailsAzureDetail" gcp_detail: $ref: "#/components/schemas/CreateTableRequestDataAttributesFileMetadataOneOfAccessDetailsGcpDetail" type: object CreateTableRequestDataAttributesFileMetadataOneOfAccessDetailsAwsDetail: description: Amazon Web Services S3 storage access configuration. properties: aws_account_id: description: AWS account ID where the S3 bucket is located. example: "123456789000" type: string aws_bucket_name: description: S3 bucket containing the CSV file. example: "example-data-bucket" type: string file_path: description: The relative file path from the S3 bucket root to the CSV file. example: "reference-tables/users.csv" type: string required: - aws_account_id - aws_bucket_name - file_path type: object x-oneOf-parent: - AwsDetail CreateTableRequestDataAttributesFileMetadataOneOfAccessDetailsAzureDetail: description: Azure Blob Storage access configuration. properties: azure_client_id: description: Azure service principal (application) client ID with permissions to read from the container. example: "aaaaaaaa-1111-2222-3333-bbbbbbbbbbbb" type: string azure_container_name: description: Azure Blob Storage container containing the CSV file. example: "reference-data" type: string azure_storage_account_name: description: Azure storage account where the container is located. example: "examplestorageaccount" type: string azure_tenant_id: description: Azure Active Directory tenant ID. example: "cccccccc-4444-5555-6666-dddddddddddd" type: string file_path: description: The relative file path from the Azure container root to the CSV file. example: "tables/users.csv" type: string required: - azure_client_id - azure_container_name - azure_storage_account_name - azure_tenant_id - file_path type: object x-oneOf-parent: - AzureDetail CreateTableRequestDataAttributesFileMetadataOneOfAccessDetailsGcpDetail: description: Google Cloud Platform storage access configuration. properties: file_path: description: The relative file path from the GCS bucket root to the CSV file. example: "data/reference_tables/users.csv" type: string gcp_bucket_name: description: GCP bucket containing the CSV file. example: "example-data-bucket" type: string gcp_project_id: description: GCP project ID where the bucket is located. example: "example-gcp-project-12345" type: string gcp_service_account_email: description: Service account email with read permissions for the GCS bucket. example: "example-service@example-gcp-project-12345.iam.gserviceaccount.com" type: string required: - file_path - gcp_bucket_name - gcp_project_id - gcp_service_account_email type: object x-oneOf-parent: - GcpDetail CreateTableRequestDataAttributesSchema: description: Schema defining the structure and columns of the reference table. properties: fields: description: The schema fields. Maximum of 200 columns. items: $ref: "#/components/schemas/CreateTableRequestDataAttributesSchemaFieldsItems" maxItems: 200 minItems: 1 type: array primary_keys: description: >- List of field names that serve as primary keys for the table. Only one primary key is supported, and it is used as an ID to retrieve rows. example: - "field_1" items: description: A field name used as a primary key. type: string type: array required: - fields - primary_keys type: object CreateTableRequestDataAttributesSchemaFieldsItems: description: A single field (column) in the reference table schema to be created. properties: name: description: The field name. example: "field_1" type: string type: $ref: "#/components/schemas/ReferenceTableSchemaFieldType" required: - name - type type: object CreateTableRequestDataType: default: reference_table description: Reference table resource type. enum: - reference_table example: reference_table type: string x-enum-varnames: - REFERENCE_TABLE CreateTenancyConfigData: description: The data object for creating a new OCI tenancy integration configuration, including the tenancy ID, type, and configuration attributes. properties: attributes: $ref: "#/components/schemas/CreateTenancyConfigDataAttributes" id: description: The OCID of the OCI tenancy to configure. example: "" type: string type: $ref: "#/components/schemas/UpdateTenancyConfigDataType" required: - type - id type: object CreateTenancyConfigDataAttributes: description: Attributes for creating a new OCI tenancy integration configuration, including credentials, region settings, and collection options. properties: auth_credentials: $ref: "#/components/schemas/CreateTenancyConfigDataAttributesAuthCredentials" config_version: description: Version number of the integration the tenancy is integrated with format: int64 nullable: true type: integer cost_collection_enabled: description: Whether cost data collection from OCI is enabled for the tenancy. type: boolean dd_compartment_id: description: The OCID of the OCI compartment used by the Datadog integration stack. type: string dd_stack_id: description: The OCID of the OCI Resource Manager stack used by the Datadog integration. type: string home_region: description: The home region of the OCI tenancy (for example, us-ashburn-1). example: "" type: string logs_config: $ref: "#/components/schemas/CreateTenancyConfigDataAttributesLogsConfig" metrics_config: $ref: "#/components/schemas/CreateTenancyConfigDataAttributesMetricsConfig" regions_config: $ref: "#/components/schemas/CreateTenancyConfigDataAttributesRegionsConfig" resource_collection_enabled: description: Whether resource collection from OCI is enabled for the tenancy. type: boolean user_ocid: description: The OCID of the OCI user used by the Datadog integration for authentication. example: "" type: string required: - auth_credentials - home_region - user_ocid type: object CreateTenancyConfigDataAttributesAuthCredentials: description: OCI API signing key credentials used to authenticate the Datadog integration with the OCI tenancy. properties: fingerprint: description: The fingerprint of the OCI API signing key used for authentication. type: string private_key: description: The PEM-encoded private key corresponding to the OCI API signing key fingerprint. example: "" type: string required: - private_key type: object CreateTenancyConfigDataAttributesLogsConfig: description: Log collection configuration for an OCI tenancy, controlling which compartments and services have log collection enabled. properties: compartment_tag_filters: description: List of compartment tag filters to scope log collection to specific compartments. items: description: A compartment tag filter in key:value format (for example, datadog:true). type: string type: array enabled: description: Whether log collection is enabled for the tenancy. type: boolean enabled_services: description: List of OCI service names for which log collection is enabled. items: description: An OCI service name for which log collection is enabled (for example, compute). type: string type: array type: object CreateTenancyConfigDataAttributesMetricsConfig: description: Metrics collection configuration for an OCI tenancy, controlling which compartments and services are included or excluded. properties: compartment_tag_filters: description: List of compartment tag filters to scope metrics collection to specific compartments. items: description: A compartment tag filter in key:value format (for example, datadog:true). type: string type: array enabled: description: Whether metrics collection is enabled for the tenancy. type: boolean excluded_services: description: List of OCI service names to exclude from metrics collection. items: description: An OCI service name to exclude from metrics collection (for example, compute). type: string type: array type: object CreateTenancyConfigDataAttributesRegionsConfig: description: Region configuration for an OCI tenancy, specifying which regions are available, enabled, or disabled for data collection. properties: available: description: List of OCI regions available for data collection in the tenancy. items: description: An OCI region identifier (for example, us-ashburn-1). type: string type: array disabled: description: List of OCI regions explicitly disabled for data collection. items: description: An OCI region identifier (for example, us-phoenix-1). type: string type: array enabled: description: List of OCI regions enabled for data collection. items: description: An OCI region identifier (for example, us-ashburn-1). type: string type: array type: object CreateTenancyConfigRequest: description: Request body for creating a new OCI tenancy integration configuration. example: data: attributes: auth_credentials: fingerprint: "" private_key: |- ----BEGIN PRIVATE KEY----- MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCdvSMmlfLyeD4M QsA3WlrWBqKdWa5eVV3/uODyqT3wWMEMIJHcG3/quNs8nh9xrK1/JkQT2qoKEHqR C5k59jN6Vp8em8ARJthMgam9K37ELt+IQ/G8ySTSuqZG8T4cHp/cs3fAclNqttOl YnGr4RbVAgMBAAECggEAGZNLGbyCUbIRTW6Kh4d8ZVC+eZtJMqGmGJ3KfVaW8Pjn QGWfSuJCEe2o2Y8G3phlidFauICnZ44enXA17Rhi+I/whnr7FIyQk2bR7rv+1Uhc mOJygWX5eFFMsledgVAdIAl9Luk2nykx7Un3g6rtbl/Vs+5k4m7ITLFMpCHzsJLU nm8kBzDOqY2JUkMd08nL88KL6QywWtal05UESzQpNFXd0e5kxYfexeMCsLsWP0mc quMLRbn7NuBjCbe9VU2kmIvcfDDaWjurT7d5m1OXx1cc8p6P4PFZTVyCjdhiWOr3 LQXZ4/vdZNR3zgEHypRoM6D9Yq99LWUOUEMrdiSLQQKBgQDQkh7C1OtAXnpy7F6R W+/I3zBHici2p7A57UT7VECQ1IVGg37/uus83DkuOtdZ33JmHLAVrwLFJvUlbyjx l6dc/1ms40L5HFdLgaVtd4k0rSPFeOSDr6evz0lX4yBuzlP0fEh+o3XHW7mwe2G+ rWCULF/Uqza66fjbCSKMNgLIXQKBgQDBm9nZg/s4S0THWCFNWcB1tXBG0p/sH5eY PC1H/VmTEINIixStrS4ufczf31X8rcoSjSbO7+vZDTTATdk7OLn1I2uGFVYl8M59 86BYT2Hi7cwp7YVzOc/cJigVeBAqSRW/iYYyWBEUTiW1gbkV0sRWwhPp67m+c0sP XpY/iEZA2QKBgB1w8tynt4l/jKNaUEMOijt9ndALWATIiOy0XG9pxi9rgGCiwTOS DBCsOXoYHjv2eayGUijNaoOv6xzcoxfvQ1WySdNIxTRq1ru20kYwgHKqGgmO9hrM mcwMY5r/WZ2qjFlPjeAqbL62aPDLidGjoaVo2iIoBPK/gjxQ/5f0MS4N/YQ0zWoYBueSQ0DGs -----END PRIVATE KEY----- config_version: cost_collection_enabled: true dd_compartment_id: ocid.compartment.test dd_stack_id: ocid.stack.test home_region: us-ashburn-1 logs_config: compartment_tag_filters: - datadog:true - env:prod enabled: true enabled_services: - service_1 - service_2 metrics_config: compartment_tag_filters: - datadog:true - env:prod enabled: true excluded_services: - service_1 - service_2 regions_config: available: - us-ashburn-1 - us-phoenix-1 disabled: - us-phoenix-1 enabled: - us-ashburn-1 resource_collection_enabled: true user_ocid: ocid.user.test id: ocid.tenancy.test type: oci_tenancy properties: data: $ref: "#/components/schemas/CreateTenancyConfigData" required: - data type: object CreateUploadRequest: description: Request to create an upload for a file to be ingested into a reference table. example: data: attributes: headers: - product_id - product_name - price part_count: 3 part_size: 10000000 table_name: my_products_table type: upload properties: data: $ref: "#/components/schemas/CreateUploadRequestData" type: object CreateUploadRequestData: additionalProperties: false description: Request data for creating an upload for a file to be ingested into a reference table. properties: attributes: $ref: "#/components/schemas/CreateUploadRequestDataAttributes" type: $ref: "#/components/schemas/CreateUploadRequestDataType" required: - type type: object CreateUploadRequestDataAttributes: description: >- Upload configuration specifying how data is uploaded by the user, and properties of the table to associate the upload with. properties: headers: description: >- The CSV file headers that define the schema fields, provided in the same order as the columns in the uploaded file. Maximum of 200 columns. example: - "field_1" - "field_2" items: description: A column header name from the CSV file. type: string maxItems: 200 type: array part_count: description: Number of parts to split the file into for multipart upload. example: 3 format: int32 maximum: 20 type: integer part_size: description: >- The size of each part in the upload in bytes. All parts except the last one must be at least 5,000,000 bytes. example: 10000000 format: int64 type: integer table_name: description: Name of the table to associate with this upload. example: "" type: string required: - headers - table_name - part_count - part_size type: object CreateUploadRequestDataType: default: upload description: Upload resource type. enum: - upload example: upload type: string x-enum-varnames: - UPLOAD CreateUploadResponse: description: >- Information about the upload created containing the upload ID and pre-signed URLs to PUT chunks of the CSV file to. properties: data: $ref: "#/components/schemas/CreateUploadResponseData" type: object CreateUploadResponseData: additionalProperties: false description: Upload ID and attributes of the created upload. properties: attributes: $ref: "#/components/schemas/CreateUploadResponseDataAttributes" id: description: Unique identifier for this upload. Use this ID when creating the reference table. type: string type: $ref: "#/components/schemas/CreateUploadResponseDataType" required: - type type: object CreateUploadResponseDataAttributes: description: Pre-signed URLs for uploading parts of the file. properties: part_urls: description: The pre-signed URLs for uploading parts. These URLs expire after 5 minutes. items: description: A pre-signed URL for uploading a single file part. type: string type: array type: object CreateUploadResponseDataType: default: upload description: Upload resource type. enum: - upload example: upload type: string x-enum-varnames: - UPLOAD CreateUserNotificationChannelRequest: description: A top-level wrapper for creating a notification channel for a user example: data: attributes: config: address: "foo@bar.com" formats: ["html"] type: "email" type: notification_channels properties: data: $ref: "#/components/schemas/CreateNotificationChannelData" required: - data type: object CreateVariant: description: Attributes for creating a variant. properties: key: description: The unique key of the variant. example: "variant-abc123" type: string name: description: The name of the variant. example: "Variant ABC123" type: string value: description: The value of the variant as a string. example: "true" type: string required: - key - name - value type: object CreateVariantData: description: Data for adding a variant to a feature flag. properties: attributes: $ref: "#/components/schemas/CreateVariant" type: $ref: "#/components/schemas/VariantDataType" required: - type - attributes type: object CreateVariantRequest: description: Request to add a variant to a feature flag. properties: data: $ref: "#/components/schemas/CreateVariantData" required: - data type: object CreateWorkflowRequest: description: A request object for creating a new workflow. example: data: attributes: description: "A sample workflow." name: "Example Workflow" published: true runAs: type: owner spec: annotations: - display: bounds: height: 150 width: 300 x: -375 y: -0.5 id: 99999999-9999-9999-9999-999999999999 markdownTextAnnotation: text: "Example annotation." connectionEnvs: - connections: - connectionId: "e1e64943-c7c5-4487-aece-25aaec7d3aad" label: "INTEGRATION_DATADOG" env: "default" handle: "my-handle" inputSchema: parameters: - defaultValue: "default" name: "input" type: "STRING" outputSchema: parameters: - name: "output" type: "ARRAY_OBJECT" value: "{{ Steps.Step1 }}" steps: - actionId: "com.datadoghq.dd.monitor.listMonitors" connectionLabel: "INTEGRATION_DATADOG" name: "Step1" outboundEdges: - branchName: "main" nextStepName: "Step2" parameters: - name: "tags" value: "service:monitoring" - actionId: "com.datadoghq.core.noop" name: "Step2" triggers: - monitorTrigger: rateLimit: count: 1 interval: "3600s" startStepNames: ["Step1"] - githubWebhookTrigger: {} startStepNames: ["Step1"] tags: - "team:infra" - "service:monitoring" - "foo:bar" type: "workflows" properties: data: $ref: "#/components/schemas/WorkflowData" required: - data type: object CreateWorkflowResponse: description: The response object after creating a new workflow. properties: data: $ref: "#/components/schemas/WorkflowData" required: - data type: object Creator: description: Creator of the object. properties: email: description: Email of the creator. type: string handle: description: Handle of the creator. type: string name: description: Name of the creator. nullable: true type: string type: object CrossOrgUuids: description: >- Organization UUIDs to query when using [cross-organization visibility](/account_management/org_settings/cross_org_visibility/). Limited to one organization UUID. items: description: An organization UUID. type: string maxItems: 1 type: array CsmAgentData: description: Single Agent Data. properties: attributes: $ref: "#/components/schemas/CsmAgentsAttributes" id: description: "The ID of the Agent." example: "fffffc5505f6a006fdf7cf5aae053653" type: string type: $ref: "#/components/schemas/CSMAgentsType" type: object CsmAgentlessHostAttributes: description: Attributes of an agentless host. properties: account_id: description: The ID of the cloud account that the host belongs to. example: "123456789012" type: string cloud_provider: $ref: "#/components/schemas/CsmCloudProvider" has_posture_management: description: Whether CSM Misconfigurations is enabled for this host. `true` if enabled; `false` if disabled. example: true type: boolean has_vulnerability_scanning: description: Whether CSM Vulnerabilities is enabled for this host. `true` if enabled; `false` if disabled. example: true type: boolean resource_type: $ref: "#/components/schemas/CsmAgentlessHostResourceType" required: - account_id - cloud_provider - resource_type - has_posture_management - has_vulnerability_scanning type: object CsmAgentlessHostData: description: A single agentless host resource. properties: attributes: $ref: "#/components/schemas/CsmAgentlessHostAttributes" id: description: The resource identifier of the agentless host. example: i-0123456789abcdef0 type: string type: $ref: "#/components/schemas/CsmAgentlessHostType" required: - id - type - attributes type: object CsmAgentlessHostFacetAttributes: description: Attributes of an agentless host facet. properties: bounded: description: Whether the facet has a bounded set of allowed values. `true` indicates a fixed value set and `false` indicates free-form values. example: true type: boolean bundled: description: Whether the facet is bundled as part of the default facet set. `true` indicates bundled and `false` indicates custom. example: true type: boolean bundledAndUsed: description: Whether the facet is both bundled and actively used. `true` indicates in use; `false` indicates unused. example: true type: boolean defaultValues: $ref: "#/components/schemas/CsmHostFacetDefaultValues" description: description: A human-readable description of what the facet represents. example: The cloud provider of the resource type: string editable: description: Whether the facet can be edited by users. `true` indicates editable; `false` indicates read-only. example: false type: boolean facetType: description: The UI display type for the facet, such as `list`. example: list type: string groups: $ref: "#/components/schemas/CsmHostFacetGroups" name: description: The display name of the facet. example: Cloud Provider type: string path: description: The field path used when filtering by this facet. example: cloud_provider type: string source: description: The data source that provides the facet values. example: core type: string type: description: The data type of the facet values. example: string type: string values: $ref: "#/components/schemas/CsmHostFacetValues" required: - name - path - description - groups - bounded - bundled - bundledAndUsed - defaultValues - editable - facetType - source - type - values type: object CsmAgentlessHostFacetData: description: A single agentless host facet resource. properties: attributes: $ref: "#/components/schemas/CsmAgentlessHostFacetAttributes" id: description: The identifier of the facet, corresponding to the field path. example: cloud_provider type: string type: $ref: "#/components/schemas/CsmAgentlessHostFacetType" required: - id - type - attributes type: object CsmAgentlessHostFacetItems: description: The list of available facets for agentless hosts. items: $ref: "#/components/schemas/CsmAgentlessHostFacetData" type: array CsmAgentlessHostFacetType: default: agentless_host_facet description: The JSON:API type for agentless host facet resources. The value should always be `agentless_host_facet`. enum: - agentless_host_facet example: agentless_host_facet type: string x-enum-varnames: - AGENTLESS_HOST_FACET CsmAgentlessHostFacetsResponse: description: The response returned when listing facets for agentless hosts. properties: data: $ref: "#/components/schemas/CsmAgentlessHostFacetItems" required: - data type: object CsmAgentlessHostItems: description: The list of agentless hosts for the current page. items: $ref: "#/components/schemas/CsmAgentlessHostData" type: array CsmAgentlessHostResourceType: description: The type of cloud resource for an agentless host. enum: - aws_ec2_instance - azure_virtual_machine_instance - gcp_compute_instance - oci_instance example: aws_ec2_instance type: string x-enum-varnames: - AWS_EC2_INSTANCE - AZURE_VIRTUAL_MACHINE_INSTANCE - GCP_COMPUTE_INSTANCE - OCI_INSTANCE CsmAgentlessHostType: default: agentless_host description: The JSON:API type for agentless host resources. The value should always be `agentless_host`. enum: - agentless_host example: agentless_host type: string x-enum-varnames: - AGENTLESS_HOST CsmAgentlessHostsResponse: description: The response returned when listing agentless hosts. properties: data: $ref: "#/components/schemas/CsmAgentlessHostItems" meta: $ref: "#/components/schemas/CsmSettingsMeta" required: - data - meta type: object CsmAgentsAttributes: description: "A CSM Agent returned by the API." properties: agent_version: description: Version of the Datadog Agent. type: string aws_fargate: description: AWS Fargate details. type: string cluster_name: description: List of cluster names associated with the Agent. items: description: A cluster name associated with the Agent. type: string type: array datadog_agent: description: Unique identifier for the Datadog Agent. type: string ecs_fargate_task_arn: description: ARN of the ECS Fargate task. type: string envs: description: List of environments associated with the Agent. items: description: An environment name associated with the Agent. type: string nullable: true type: array host_id: description: ID of the host. format: int64 type: integer hostname: description: Name of the host. type: string install_method_installer_version: description: Version of the installer used for installing the Datadog Agent. type: string install_method_tool: description: Tool used for installing the Datadog Agent. type: string is_csm_vm_containers_enabled: description: Indicates if CSM VM Containers is enabled. nullable: true type: boolean is_csm_vm_hosts_enabled: description: Indicates if CSM VM Hosts is enabled. nullable: true type: boolean is_cspm_enabled: description: Indicates if CSPM is enabled. nullable: true type: boolean is_cws_enabled: description: Indicates if CWS is enabled. nullable: true type: boolean is_cws_remote_configuration_enabled: description: Indicates if CWS Remote Configuration is enabled. nullable: true type: boolean is_remote_configuration_enabled: description: Indicates if Remote Configuration is enabled. nullable: true type: boolean os: description: Operating system of the host. type: string type: object CsmAgentsResponse: description: Response object that includes a list of CSM Agents. properties: data: description: A list of Agents. items: $ref: "#/components/schemas/CsmAgentData" type: array meta: $ref: "#/components/schemas/CSMAgentsMetadata" type: object CsmCloudAccountsCoverageAnalysisAttributes: description: CSM Cloud Accounts Coverage Analysis attributes. properties: aws_coverage: $ref: "#/components/schemas/CsmCoverageAnalysis" azure_coverage: $ref: "#/components/schemas/CsmCoverageAnalysis" gcp_coverage: $ref: "#/components/schemas/CsmCoverageAnalysis" org_id: description: The ID of your organization. example: 123456 format: int64 type: integer total_coverage: $ref: "#/components/schemas/CsmCoverageAnalysis" type: object CsmCloudAccountsCoverageAnalysisData: description: CSM Cloud Accounts Coverage Analysis data. properties: attributes: $ref: "#/components/schemas/CsmCloudAccountsCoverageAnalysisAttributes" id: description: "The ID of your organization." example: "66b3c6b5-5c9a-457e-b1c3-f247ca23afa3" type: string type: default: "get_cloud_accounts_coverage_analysis_response_public_v0" description: "The type of the resource. The value should always be `get_cloud_accounts_coverage_analysis_response_public_v0`." example: "get_cloud_accounts_coverage_analysis_response_public_v0" type: string type: object CsmCloudAccountsCoverageAnalysisResponse: description: CSM Cloud Accounts Coverage Analysis response. properties: data: $ref: "#/components/schemas/CsmCloudAccountsCoverageAnalysisData" type: object CsmCloudProvider: description: The cloud provider of a host resource. enum: - aws - gcp - azure - oci example: aws type: string x-enum-varnames: - AWS - GCP - AZURE - OCI CsmCoverageAnalysis: description: CSM Coverage Analysis. properties: configured_resources_count: description: The number of fully configured resources. example: 8 format: int64 type: integer coverage: description: The coverage percentage. example: 0.8 format: double type: number partially_configured_resources_count: description: The number of partially configured resources. example: 0 format: int64 type: integer total_resources_count: description: The total number of resources. example: 10 format: int64 type: integer type: object CsmFacetInfoType: default: facet_info description: The JSON:API type for facet info resources. The value should always be `facet_info`. enum: - facet_info example: facet_info type: string x-enum-varnames: - FACET_INFO CsmHostFacetDefaultValues: description: The list of default filter values for the facet. example: [] items: type: string type: array CsmHostFacetGroups: description: The list of UI groups that this facet belongs to. example: - agentless items: type: string type: array CsmHostFacetInfoAttributes: description: Attributes of a facet info response, containing the value distribution for the requested facet. properties: items: $ref: "#/components/schemas/CsmHostFacetInfoItems" required: - items type: object CsmHostFacetInfoData: description: The data wrapper for a facet info response. properties: attributes: $ref: "#/components/schemas/CsmHostFacetInfoAttributes" id: description: The identifier of the facet. example: cloud_provider type: string meta: $ref: "#/components/schemas/CsmHostFacetInfoMeta" type: $ref: "#/components/schemas/CsmFacetInfoType" required: - id - type - attributes - meta type: object CsmHostFacetInfoItem: description: A single value and its occurrence count for a facet. properties: count: description: The number of resources with this facet value. example: 100 format: int64 type: integer value: description: The facet value. example: aws type: string required: - value - count type: object CsmHostFacetInfoItems: description: The list of facet value entries for the current page. items: $ref: "#/components/schemas/CsmHostFacetInfoItem" type: array CsmHostFacetInfoMeta: description: Metadata for the facet info response. properties: total_count: description: The total number of distinct values for this facet. example: 4 format: int64 type: integer required: - total_count type: object CsmHostFacetInfoResponse: description: The response returned when requesting value distribution for a specific facet. properties: data: $ref: "#/components/schemas/CsmHostFacetInfoData" required: - data type: object CsmHostFacetValues: description: The list of allowed filter values for bounded facets. Empty for unbounded facets. example: - aws - gcp items: type: string type: array CsmHostsAndContainersCoverageAnalysisAttributes: description: CSM Hosts and Containers Coverage Analysis attributes. properties: cspm_coverage: $ref: "#/components/schemas/CsmCoverageAnalysis" cws_coverage: $ref: "#/components/schemas/CsmCoverageAnalysis" org_id: description: The ID of your organization. example: 123456 format: int64 type: integer total_coverage: $ref: "#/components/schemas/CsmCoverageAnalysis" vm_coverage: $ref: "#/components/schemas/CsmCoverageAnalysis" type: object CsmHostsAndContainersCoverageAnalysisData: description: CSM Hosts and Containers Coverage Analysis data. properties: attributes: $ref: "#/components/schemas/CsmHostsAndContainersCoverageAnalysisAttributes" id: description: "The ID of your organization." example: "66b3c6b5-5c9a-457e-b1c3-f247ca23afa3" type: string type: default: "get_hosts_and_containers_coverage_analysis_response_public_v0" description: "The type of the resource. The value should always be `get_hosts_and_containers_coverage_analysis_response_public_v0`." example: "get_hosts_and_containers_coverage_analysis_response_public_v0" type: string type: object CsmHostsAndContainersCoverageAnalysisResponse: description: CSM Hosts and Containers Coverage Analysis response. properties: data: $ref: "#/components/schemas/CsmHostsAndContainersCoverageAnalysisData" type: object CsmServerlessCoverageAnalysisAttributes: description: CSM Serverless Resources Coverage Analysis attributes. properties: cws_coverage: $ref: "#/components/schemas/CsmCoverageAnalysis" org_id: description: The ID of your organization. example: 123456 format: int64 type: integer total_coverage: $ref: "#/components/schemas/CsmCoverageAnalysis" type: object CsmServerlessCoverageAnalysisData: description: CSM Serverless Resources Coverage Analysis data. properties: attributes: $ref: "#/components/schemas/CsmServerlessCoverageAnalysisAttributes" id: description: "The ID of your organization." example: "66b3c6b5-5c9a-457e-b1c3-f247ca23afa3" type: string type: default: "get_serverless_coverage_analysis_response_public_v0" description: "The type of the resource. The value should always be `get_serverless_coverage_analysis_response_public_v0`." example: "get_serverless_coverage_analysis_response_public_v0" type: string type: object CsmServerlessCoverageAnalysisResponse: description: CSM Serverless Resources Coverage Analysis response. properties: data: $ref: "#/components/schemas/CsmServerlessCoverageAnalysisData" type: object CsmSettingsMeta: description: Pagination metadata for a CSM settings list response. properties: page_index: description: The current page index (zero-based). example: 0 format: int64 type: integer page_size: description: The number of resources returned per page. example: 10 format: int64 type: integer total_filtered: description: The total number of resources matching the filter criteria. example: 100 format: int64 type: integer required: - total_filtered - page_index - page_size type: object CsmUnifiedHostAttributes: description: Attributes of a unified host, combining data from agent and agentless sources. properties: account_id: description: The ID of the cloud account that the host belongs to. Present only when the host was discovered through agentless scanning. example: "123456789012" nullable: true type: string agent_csm_vm_containers_enabled: description: Whether CSM Vulnerabilities is enabled for containers through the Datadog Agent. `true` if enabled; `false` if disabled. example: false nullable: true type: boolean agent_csm_vm_hosts_enabled: description: Whether CSM Vulnerabilities is enabled for hosts through the Datadog Agent. `true` if enabled; `false` if disabled. example: true nullable: true type: boolean agent_cws_enabled: description: Whether CSM Threats is enabled for this host through the Datadog Agent. `true` if enabled; `false` if disabled. example: false nullable: true type: boolean agent_posture_management: description: Whether CSM Misconfigurations is enabled for this host through the Datadog Agent. `true` if enabled; `false` if disabled. example: true nullable: true type: boolean agent_version: description: The version of the Datadog Agent running on this host. example: 7.50.0 nullable: true type: string agentless_posture_management: description: Whether CSM Misconfigurations is enabled for this host via agentless scanning. `true` if enabled; `false` if disabled. example: false nullable: true type: boolean agentless_vulnerability_scanning: description: Whether CSM Vulnerabilities is enabled for this host via agentless scanning. `true` if enabled; `false` if disabled. example: true nullable: true type: boolean cloud_provider: $ref: "#/components/schemas/CsmCloudProvider" cluster_name: description: The name of the Kubernetes cluster the host belongs to, if applicable. example: my-cluster nullable: true type: string datadog_agent_key: description: The Datadog Agent key associated with this host. Present only for agent-sourced hosts. example: key123 nullable: true type: string env: description: The list of environment tags associated with this host. example: - prod items: type: string nullable: true type: array host_id: description: The internal Datadog host identifier. Present only for agent-sourced hosts. example: 12345678 format: int64 nullable: true type: integer install_method_tool: description: The tool used to install the Datadog Agent on this host. example: helm nullable: true type: string os: description: The operating system of the host. Present only for agent-sourced hosts. example: linux nullable: true type: string resource_type: $ref: "#/components/schemas/CsmAgentlessHostResourceType" source: $ref: "#/components/schemas/CsmUnifiedHostSource" required: - source type: object CsmUnifiedHostData: description: A single unified host resource, combining agent and agentless data. properties: attributes: $ref: "#/components/schemas/CsmUnifiedHostAttributes" id: description: The resource identifier of the unified host. example: i-0123456789abcdef0 type: string type: $ref: "#/components/schemas/CsmUnifiedHostType" required: - id - type - attributes type: object CsmUnifiedHostFacetData: description: A single unified host facet resource. properties: attributes: $ref: "#/components/schemas/CsmAgentlessHostFacetAttributes" id: description: The identifier of the facet, corresponding to the field path. example: cloud_provider type: string type: $ref: "#/components/schemas/CsmUnifiedHostFacetType" required: - id - type - attributes type: object CsmUnifiedHostFacetItems: description: The list of available facets for unified hosts. items: $ref: "#/components/schemas/CsmUnifiedHostFacetData" type: array CsmUnifiedHostFacetType: default: unified_host_facet description: The JSON:API type for unified host facet resources. The value should always be `unified_host_facet`. enum: - unified_host_facet example: unified_host_facet type: string x-enum-varnames: - UNIFIED_HOST_FACET CsmUnifiedHostFacetsResponse: description: The response returned when listing facets for unified hosts. properties: data: $ref: "#/components/schemas/CsmUnifiedHostFacetItems" required: - data type: object CsmUnifiedHostItems: description: The list of unified hosts for the current page. items: $ref: "#/components/schemas/CsmUnifiedHostData" type: array CsmUnifiedHostSource: description: The source of a unified host entry, indicating whether it was discovered via agent, agentless scanning, or both. enum: - agent - agentless - both example: agent type: string x-enum-varnames: - AGENT - AGENTLESS - BOTH CsmUnifiedHostType: default: unified_host description: The JSON:API type for unified host resources. The value should always be `unified_host`. enum: - unified_host example: unified_host type: string x-enum-varnames: - UNIFIED_HOST CsmUnifiedHostsMeta: description: Pagination metadata for a unified hosts list response. properties: page_index: description: The current page index (zero-based). example: 0 format: int64 type: integer page_size: description: The number of hosts returned per page. example: 10 format: int64 type: integer total_filtered: description: The total number of hosts matching the filter criteria. example: 100 format: int64 type: integer total_pages: description: The total number of pages available. example: 10 format: int64 type: integer required: - total_filtered - page_index - page_size - total_pages type: object CsmUnifiedHostsResponse: description: The response returned when listing unified hosts. properties: data: $ref: "#/components/schemas/CsmUnifiedHostItems" meta: $ref: "#/components/schemas/CsmUnifiedHostsMeta" required: - data - meta type: object CustomAttributeConfig: description: "A custom attribute configuration that defines an organization-specific metadata field on work items. Custom attributes are scoped to a work item type and can hold text, URLs, numbers, or predefined select options." properties: attributes: $ref: "#/components/schemas/CustomAttributeConfigResourceAttributes" id: description: Custom attribute configs identifier example: "aeadc05e-98a8-11ec-ac2c-da7ad0900001" type: string type: $ref: "#/components/schemas/CustomAttributeConfigResourceType" type: object CustomAttributeConfigAttributesCreate: description: Attributes required to create a custom attribute configuration. properties: description: description: A description explaining the purpose and expected values for this custom attribute. example: "AWS Region, must be a valid region supported by AWS" type: string display_name: description: The human-readable label shown in the Work Management UI for this custom attribute. example: "AWS Region" type: string is_multi: description: "If `true`, this attribute accepts an array of values. If `false`, only a single value is allowed." example: true type: boolean key: description: The programmatic key used to reference this custom attribute in search queries and API calls. example: "aws_region" type: string type: $ref: "#/components/schemas/CustomAttributeType" required: - display_name - key - type - is_multi type: object CustomAttributeConfigCreate: description: Data object for creating a custom attribute configuration. properties: attributes: $ref: "#/components/schemas/CustomAttributeConfigAttributesCreate" type: $ref: "#/components/schemas/CustomAttributeConfigResourceType" required: - attributes - type type: object CustomAttributeConfigCreateRequest: description: Request payload for creating a custom attribute configuration. properties: data: $ref: "#/components/schemas/CustomAttributeConfigCreate" required: - data type: object CustomAttributeConfigResourceAttributes: description: "Attributes of a custom attribute configuration, defining an organization-specific metadata field that can be added to work items of a given type." properties: case_type_id: description: The UUID of the work item type this custom attribute belongs to. example: "aeadc05e-98a8-11ec-ac2c-da7ad0900001" type: string description: description: A description explaining the purpose and expected values for this custom attribute. example: "AWS Region, must be a valid region supported by AWS" type: string display_name: description: The human-readable label shown in the Work Management UI for this custom attribute. example: "AWS Region" type: string is_multi: description: "If `true`, this attribute accepts an array of values. If `false`, only a single value is allowed." example: true type: boolean key: description: The programmatic key used to reference this custom attribute in search queries and API calls. example: "aws_region" type: string type: $ref: "#/components/schemas/CustomAttributeType" required: - case_type_id - display_name - key - type - is_multi type: object CustomAttributeConfigResourceType: default: custom_attribute description: JSON:API resource type for custom attribute configurations. enum: - custom_attribute example: custom_attribute type: string x-enum-varnames: - CUSTOM_ATTRIBUTE CustomAttributeConfigResponse: description: Response containing a single custom attribute configuration. properties: data: $ref: "#/components/schemas/CustomAttributeConfig" type: object CustomAttributeConfigUpdate: description: Data object for updating a custom attribute configuration. properties: attributes: $ref: "#/components/schemas/CustomAttributeConfigUpdateAttributes" type: $ref: "#/components/schemas/CustomAttributeConfigResourceType" required: - type type: object CustomAttributeConfigUpdateAttributes: description: Attributes that can be updated on a custom attribute configuration. All fields are optional; only provided fields are changed. properties: description: description: A description explaining the purpose and expected values for this custom attribute. example: "Updated description." type: string display_name: description: The human-readable label shown in the Work Management UI for this custom attribute. example: "AWS Region" type: string map_from: description: An external field identifier to auto-populate this attribute from (used for integrations with external systems). type: string type: $ref: "#/components/schemas/CustomAttributeType" type_data: $ref: "#/components/schemas/CustomAttributeTypeData" type: object CustomAttributeConfigUpdateRequest: description: Request payload for updating a custom attribute configuration. properties: data: $ref: "#/components/schemas/CustomAttributeConfigUpdate" required: - data type: object CustomAttributeConfigsResponse: description: Response containing a list of custom attribute configurations. properties: data: description: List of custom attribute configs of work item type items: $ref: "#/components/schemas/CustomAttributeConfig" type: array type: object CustomAttributeMultiNumberValue: description: An array of numeric values for a multi-value NUMBER-type custom attribute. items: description: NUMBER value format: double type: number type: array CustomAttributeMultiStringValue: description: An array of string values for a multi-value TEXT, URL, or SELECT-type custom attribute. items: description: TEXT/URL/NUMBER/SELECT Value type: string type: array CustomAttributeNumberValue: description: A numeric value for a NUMBER-type custom attribute. format: double type: number CustomAttributeSelectOption: description: A selectable option for a SELECT-type custom attribute. properties: value: description: Option value. example: "us-east-1" type: string required: - value type: object CustomAttributeStringValue: description: A string value for a TEXT, URL, or SELECT-type custom attribute. type: string CustomAttributeType: description: "The data type of the custom attribute, which determines the allowed values and UI input control." enum: - URL - TEXT - NUMBER - SELECT example: NUMBER type: string x-enum-varnames: - URL - TEXT - NUMBER - SELECT CustomAttributeTypeData: description: "Type-specific configuration for the custom attribute. For SELECT-type attributes, this contains the list of allowed options." properties: options: description: Options for SELECT type custom attributes. items: $ref: "#/components/schemas/CustomAttributeSelectOption" type: array type: object CustomAttributeValue: description: A typed value for a custom attribute on a specific work item. properties: is_multi: description: If true, value must be an array example: false type: boolean type: $ref: "#/components/schemas/CustomAttributeType" value: $ref: "#/components/schemas/CustomAttributeValuesUnion" required: - type - is_multi - value type: object CustomAttributeValuesUnion: description: The value of a custom attribute. The accepted format depends on the attribute's type and whether it accepts multiple values. example: "" oneOf: - $ref: "#/components/schemas/CustomAttributeStringValue" - $ref: "#/components/schemas/CustomAttributeMultiStringValue" - $ref: "#/components/schemas/CustomAttributeNumberValue" - $ref: "#/components/schemas/CustomAttributeMultiNumberValue" CustomConnection: description: A custom connection used by an app. properties: attributes: $ref: "#/components/schemas/CustomConnectionAttributes" id: description: The ID of the custom connection. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string type: $ref: "#/components/schemas/CustomConnectionType" type: object CustomConnectionAttributes: description: The custom connection attributes. properties: name: description: The name of the custom connection. type: string onPremRunner: $ref: "#/components/schemas/CustomConnectionAttributesOnPremRunner" type: object CustomConnectionAttributesOnPremRunner: description: Information about the Private Action Runner used by the custom connection, if the custom connection is associated with a Private Action Runner. properties: id: description: The Private Action Runner ID. type: string url: description: The URL of the Private Action Runner. type: string type: object CustomConnectionType: default: custom_connections description: The custom connection type. enum: - custom_connections example: custom_connections type: string x-enum-varnames: - CUSTOM_CONNECTIONS CustomCostGetResponseMeta: description: Meta for the response from the Get Custom Costs endpoints. properties: version: description: Version of Custom Costs file type: string type: object CustomCostListResponseMeta: description: Meta for the response from the List Custom Costs endpoints. properties: count_by_status: additionalProperties: format: int64 type: integer description: Number of Custom Costs files per status. type: object providers: description: List of available providers. items: description: A provider name. type: string type: array total_filtered_count: description: Number of Custom Costs files returned by the List Custom Costs endpoint format: int64 type: integer version: description: Version of Custom Costs file type: string type: object CustomCostUploadResponseMeta: description: Meta for the response from the Upload Custom Costs endpoints. properties: version: description: Version of Custom Costs file type: string type: object CustomCostsFileGetResponse: description: Response for Get Custom Costs files. properties: data: $ref: "#/components/schemas/CustomCostsFileMetadataWithContentHighLevel" meta: $ref: "#/components/schemas/CustomCostGetResponseMeta" type: object CustomCostsFileLineItem: description: Line item details from a Custom Costs file. properties: BilledCost: description: Total cost in the cost file. example: 100.50 format: double type: number BillingCurrency: description: Currency used in the Custom Costs file. example: "USD" type: string ChargeDescription: description: Description for the line item cost. example: "Monthly usage charge for my service" type: string ChargePeriodEnd: description: End date of the usage charge. example: "2023-02-28" pattern: ^\d{4}-\d{2}-\d{2}$ type: string ChargePeriodStart: description: Start date of the usage charge. example: "2023-02-01" pattern: ^\d{4}-\d{2}-\d{2}$ type: string ProviderName: description: Name of the provider for the line item. type: string Tags: additionalProperties: type: string description: Additional tags for the line item. type: object type: object CustomCostsFileListResponse: description: Response for List Custom Costs files. properties: data: description: List of Custom Costs files. items: $ref: "#/components/schemas/CustomCostsFileMetadataHighLevel" type: array meta: $ref: "#/components/schemas/CustomCostListResponseMeta" type: object CustomCostsFileMetadata: description: Schema of a Custom Costs metadata. properties: ai_provider: description: Whether the Custom Costs file contains the costs of an AI provider. example: false type: boolean billed_cost: description: Total cost in the cost file. example: 100.50 format: double type: number billing_currency: description: Currency used in the Custom Costs file. example: "USD" type: string charge_period: $ref: "#/components/schemas/CustomCostsFileUsageChargePeriod" name: description: Name of the Custom Costs file. example: "my_file.json" type: string provider_names: description: Providers contained in the Custom Costs file. items: description: Name of the provider. example: "my_provider" type: string type: array status: description: Status of the Custom Costs file. example: "active" type: string uploaded_at: description: Timestamp, in millisecond, of the upload time of the Custom Costs file. example: 1704067200000 format: double type: number uploaded_by: $ref: "#/components/schemas/CustomCostsUser" type: object CustomCostsFileMetadataHighLevel: description: JSON API format for a Custom Costs file. properties: attributes: $ref: "#/components/schemas/CustomCostsFileMetadata" id: description: ID of the Custom Costs metadata. type: string type: description: Type of the Custom Costs file metadata. type: string type: object CustomCostsFileMetadataWithContent: description: Schema of a cost file's metadata. properties: ai_provider: description: Whether the Custom Costs file contains the costs of an AI provider. example: false type: boolean billed_cost: description: Total cost in the cost file. example: 100.50 format: double type: number billing_currency: description: Currency used in the Custom Costs file. example: "USD" type: string charge_period: $ref: "#/components/schemas/CustomCostsFileUsageChargePeriod" content: description: Detail of the line items from the Custom Costs file. items: $ref: "#/components/schemas/CustomCostsFileLineItem" type: array name: description: Name of the Custom Costs file. example: "my_file.json" type: string provider_names: description: Providers contained in the Custom Costs file. items: description: Name of a provider. example: "my_provider" type: string type: array status: description: Status of the Custom Costs file. example: "active" type: string uploaded_at: description: Timestamp in millisecond of the upload time of the Custom Costs file. example: 1704067200000 format: double type: number uploaded_by: $ref: "#/components/schemas/CustomCostsUser" type: object CustomCostsFileMetadataWithContentHighLevel: description: JSON API format of for a Custom Costs file with content. properties: attributes: $ref: "#/components/schemas/CustomCostsFileMetadataWithContent" id: description: ID of the Custom Costs metadata. type: string type: description: Type of the Custom Costs file metadata. type: string type: object CustomCostsFileUploadRequest: description: Request for uploading a Custom Costs file. items: $ref: "#/components/schemas/CustomCostsFileLineItem" type: array CustomCostsFileUploadResponse: description: Response for Uploaded Custom Costs files. properties: data: $ref: "#/components/schemas/CustomCostsFileMetadataHighLevel" meta: $ref: "#/components/schemas/CustomCostUploadResponseMeta" type: object CustomCostsFileUsageChargePeriod: description: Usage charge period of a Custom Costs file. properties: end: description: End of the usage of the Custom Costs file. example: 1706745600000 format: double type: number start: description: Start of the usage of the Custom Costs file. example: 1704067200000 format: double type: number type: object CustomCostsUser: description: Metadata of the user that has uploaded the Custom Costs file. properties: email: description: The name of the Custom Costs file. example: "email.test@datadohq.com" type: string icon: description: The name of the Custom Costs file. example: "icon.png" type: string name: description: Name of the user. example: "Test User" type: string type: object CustomDestinationAttributeTagsRestrictionListType: default: ALLOW_LIST description: |- How `forward_tags_restriction_list` parameter should be interpreted. If `ALLOW_LIST`, then only tags whose keys on the forwarded logs match the ones on the restriction list are forwarded. `BLOCK_LIST` works the opposite way. It does not forward the tags matching the ones on the list. enum: - ALLOW_LIST - BLOCK_LIST example: ALLOW_LIST type: string x-enum-varnames: - ALLOW_LIST - BLOCK_LIST CustomDestinationCreateRequest: description: The custom destination. properties: data: $ref: "#/components/schemas/CustomDestinationCreateRequestDefinition" type: object CustomDestinationCreateRequestAttributes: description: The attributes associated with the custom destination. properties: enabled: default: true description: Whether logs matching this custom destination should be forwarded or not. example: true type: boolean forward_tags: default: true description: Whether tags from the forwarded logs should be forwarded or not. example: true type: boolean forward_tags_restriction_list: default: [] description: |- List of [keys of tags](https://docs.datadoghq.com/getting_started/tagging/#define-tags) to be filtered. An empty list represents no restriction is in place and either all or no tags will be forwarded depending on `forward_tags_restriction_list_type` parameter. example: ["datacenter", "host"] items: description: The [key part of a tag](https://docs.datadoghq.com/getting_started/tagging/#define-tags). type: string maxItems: 10 minItems: 0 type: array forward_tags_restriction_list_type: $ref: "#/components/schemas/CustomDestinationAttributeTagsRestrictionListType" forwarder_destination: $ref: "#/components/schemas/CustomDestinationForwardDestination" name: description: The custom destination name. example: Nginx logs type: string query: default: "" description: The custom destination query and filter. Logs matching this query are forwarded to the destination. example: source:nginx type: string required: - name - forwarder_destination type: object CustomDestinationCreateRequestDefinition: description: The definition of a custom destination. properties: attributes: $ref: "#/components/schemas/CustomDestinationCreateRequestAttributes" type: $ref: "#/components/schemas/CustomDestinationType" required: - type - attributes type: object CustomDestinationElasticsearchDestinationAuth: description: Basic access authentication. properties: password: description: The password of the authentication. This field is not returned by the API. example: datadog-custom-destination-password type: string writeOnly: true username: description: The username of the authentication. This field is not returned by the API. example: datadog-custom-destination-username type: string writeOnly: true required: - username - password type: object CustomDestinationForwardDestination: description: A custom destination's location to forward logs. oneOf: - $ref: "#/components/schemas/CustomDestinationForwardDestinationHttp" - $ref: "#/components/schemas/CustomDestinationForwardDestinationSplunk" - $ref: "#/components/schemas/CustomDestinationForwardDestinationElasticsearch" - $ref: "#/components/schemas/CustomDestinationForwardDestinationMicrosoftSentinel" CustomDestinationForwardDestinationElasticsearch: description: The Elasticsearch destination. properties: auth: $ref: "#/components/schemas/CustomDestinationElasticsearchDestinationAuth" endpoint: description: |- The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed. example: https://example.com type: string index_name: description: Name of the Elasticsearch index (must follow [Elasticsearch's criteria](https://www.elastic.co/guide/en/elasticsearch/reference/8.11/indices-create-index.html#indices-create-api-path-params)). example: nginx-logs type: string index_rotation: description: |- Date pattern with US locale and UTC timezone to be appended to the index name after adding `-` (that is, `${index_name}-${indexPattern}`). You can customize the index rotation naming pattern by choosing one of these options: - Hourly: `yyyy-MM-dd-HH` (as an example, it would render: `2022-10-19-09`) - Daily: `yyyy-MM-dd` (as an example, it would render: `2022-10-19`) - Weekly: `yyyy-'W'ww` (as an example, it would render: `2022-W42`) - Monthly: `yyyy-MM` (as an example, it would render: `2022-10`) If this field is missing or is blank, it means that the index name will always be the same (that is, no rotation). example: yyyy-MM-dd type: string type: $ref: "#/components/schemas/CustomDestinationForwardDestinationElasticsearchType" required: - type - endpoint - auth - index_name type: object CustomDestinationForwardDestinationElasticsearchType: default: elasticsearch description: Type of the Elasticsearch destination. enum: - elasticsearch example: elasticsearch type: string x-enum-varnames: - ELASTICSEARCH CustomDestinationForwardDestinationHttp: description: The HTTP destination. properties: auth: $ref: "#/components/schemas/CustomDestinationHttpDestinationAuth" endpoint: description: |- The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed. example: https://example.com type: string type: $ref: "#/components/schemas/CustomDestinationForwardDestinationHttpType" required: - type - endpoint - auth type: object CustomDestinationForwardDestinationHttpType: default: http description: Type of the HTTP destination. enum: - http example: http type: string x-enum-varnames: - HTTP CustomDestinationForwardDestinationMicrosoftSentinel: description: The Microsoft Sentinel destination. properties: client_id: description: Client ID from the Datadog Azure integration. example: 9a2f4d83-2b5e-429e-a35a-2b3c4182db71 type: string data_collection_endpoint: description: Azure data collection endpoint. example: https://my-dce-5kyl.eastus-1.ingest.monitor.azure.com type: string data_collection_rule_id: description: Azure data collection rule ID. example: dcr-000a00a000a00000a000000aa000a0aa type: string stream_name: description: Azure stream name. example: Custom-MyTable type: string writeOnly: true tenant_id: description: Tenant ID from the Datadog Azure integration. example: f3c9a8a1-4c2e-4d2e-b911-9f3c28c3c8b2 type: string type: $ref: "#/components/schemas/CustomDestinationForwardDestinationMicrosoftSentinelType" required: - type - tenant_id - client_id - data_collection_endpoint - data_collection_rule_id - stream_name type: object CustomDestinationForwardDestinationMicrosoftSentinelType: default: microsoft_sentinel description: Type of the Microsoft Sentinel destination. enum: - microsoft_sentinel example: microsoft_sentinel type: string x-enum-varnames: - MICROSOFT_SENTINEL CustomDestinationForwardDestinationSplunk: description: The Splunk HTTP Event Collector (HEC) destination. properties: access_token: description: Access token of the Splunk HTTP Event Collector. This field is not returned by the API. example: splunk_access_token type: string writeOnly: true endpoint: description: |- The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed. example: https://example.com type: string sourcetype: description: |- The Splunk sourcetype for the events sent to this Splunk destination. If the field is absent from the request and no sourcetype has been previously set on this destination, the default sourcetype `_json` is used. On update, if the field is absent from the request but a sourcetype was previously set, the previous value is kept. If set to `null`, the sourcetype field is omitted from the forwarded event entirely. Otherwise, the provided string value is used as the sourcetype. example: my-source nullable: true type: string type: $ref: "#/components/schemas/CustomDestinationForwardDestinationSplunkType" required: - type - endpoint - access_token type: object CustomDestinationForwardDestinationSplunkType: default: splunk_hec description: Type of the Splunk HTTP Event Collector (HEC) destination. enum: - splunk_hec example: splunk_hec type: string x-enum-varnames: - SPLUNK_HEC CustomDestinationHttpDestinationAuth: description: Authentication method of the HTTP requests. oneOf: - $ref: "#/components/schemas/CustomDestinationHttpDestinationAuthBasic" - $ref: "#/components/schemas/CustomDestinationHttpDestinationAuthCustomHeader" CustomDestinationHttpDestinationAuthBasic: description: Basic access authentication. properties: password: description: The password of the authentication. This field is not returned by the API. example: datadog-custom-destination-password type: string writeOnly: true type: $ref: "#/components/schemas/CustomDestinationHttpDestinationAuthBasicType" username: description: The username of the authentication. This field is not returned by the API. example: datadog-custom-destination-username type: string writeOnly: true required: - type - username - password type: object CustomDestinationHttpDestinationAuthBasicType: default: basic description: Type of the basic access authentication. enum: - basic example: basic type: string x-enum-varnames: - BASIC CustomDestinationHttpDestinationAuthCustomHeader: description: Custom header access authentication. properties: header_name: description: The header name of the authentication. example: CUSTOM-HEADER-NAME type: string header_value: description: The header value of the authentication. This field is not returned by the API. example: CUSTOM-HEADER-AUTHENTICATION-VALUE type: string writeOnly: true type: $ref: "#/components/schemas/CustomDestinationHttpDestinationAuthCustomHeaderType" required: - type - header_name - header_value type: object CustomDestinationHttpDestinationAuthCustomHeaderType: default: custom_header description: Type of the custom header access authentication. enum: - custom_header example: custom_header type: string x-enum-varnames: - CUSTOM_HEADER CustomDestinationResponse: description: The custom destination. properties: data: $ref: "#/components/schemas/CustomDestinationResponseDefinition" type: object CustomDestinationResponseAttributes: description: The attributes associated with the custom destination. properties: enabled: default: true description: Whether logs matching this custom destination should be forwarded or not. example: true type: boolean forward_tags: default: true description: Whether tags from the forwarded logs should be forwarded or not. example: true type: boolean forward_tags_restriction_list: default: [] description: |- List of [keys of tags](https://docs.datadoghq.com/getting_started/tagging/#define-tags) to be filtered. An empty list represents no restriction is in place and either all or no tags will be forwarded depending on `forward_tags_restriction_list_type` parameter. example: ["datacenter", "host"] items: description: The [key part of a tag](https://docs.datadoghq.com/getting_started/tagging/#define-tags). type: string maxItems: 10 minItems: 0 type: array forward_tags_restriction_list_type: $ref: "#/components/schemas/CustomDestinationAttributeTagsRestrictionListType" forwarder_destination: $ref: "#/components/schemas/CustomDestinationResponseForwardDestination" name: description: The custom destination name. example: Nginx logs type: string query: default: "" description: The custom destination query filter. Logs matching this query are forwarded to the destination. example: source:nginx type: string type: object CustomDestinationResponseDefinition: description: The definition of a custom destination. properties: attributes: $ref: "#/components/schemas/CustomDestinationResponseAttributes" id: description: The custom destination ID. example: be5d7a69-d0c8-4d4d-8ee8-bba292d98139 readOnly: true type: string type: $ref: "#/components/schemas/CustomDestinationType" type: object CustomDestinationResponseElasticsearchDestinationAuth: additionalProperties: description: Basic access authentication. description: Basic access authentication. type: object CustomDestinationResponseForwardDestination: description: A custom destination's location to forward logs. oneOf: - $ref: "#/components/schemas/CustomDestinationResponseForwardDestinationHttp" - $ref: "#/components/schemas/CustomDestinationResponseForwardDestinationSplunk" - $ref: "#/components/schemas/CustomDestinationResponseForwardDestinationElasticsearch" - $ref: "#/components/schemas/CustomDestinationResponseForwardDestinationMicrosoftSentinel" CustomDestinationResponseForwardDestinationElasticsearch: description: The Elasticsearch destination. properties: auth: $ref: "#/components/schemas/CustomDestinationResponseElasticsearchDestinationAuth" endpoint: description: |- The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed. example: https://example.com type: string index_name: description: Name of the Elasticsearch index (must follow [Elasticsearch's criteria](https://www.elastic.co/guide/en/elasticsearch/reference/8.11/indices-create-index.html#indices-create-api-path-params)). example: nginx-logs type: string index_rotation: description: |- Date pattern with US locale and UTC timezone to be appended to the index name after adding `-` (that is, `${index_name}-${indexPattern}`). You can customize the index rotation naming pattern by choosing one of these options: - Hourly: `yyyy-MM-dd-HH` (as an example, it would render: `2022-10-19-09`) - Daily: `yyyy-MM-dd` (as an example, it would render: `2022-10-19`) - Weekly: `yyyy-'W'ww` (as an example, it would render: `2022-W42`) - Monthly: `yyyy-MM` (as an example, it would render: `2022-10`) If this field is missing or is blank, it means that the index name will always be the same (that is, no rotation). example: yyyy-MM-dd type: string type: $ref: "#/components/schemas/CustomDestinationResponseForwardDestinationElasticsearchType" required: - type - endpoint - auth - index_name type: object CustomDestinationResponseForwardDestinationElasticsearchType: default: elasticsearch description: Type of the Elasticsearch destination. enum: - elasticsearch example: elasticsearch type: string x-enum-varnames: - ELASTICSEARCH CustomDestinationResponseForwardDestinationHttp: description: The HTTP destination. properties: auth: $ref: "#/components/schemas/CustomDestinationResponseHttpDestinationAuth" endpoint: description: |- The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed. example: https://example.com type: string type: $ref: "#/components/schemas/CustomDestinationResponseForwardDestinationHttpType" required: - type - endpoint - auth type: object CustomDestinationResponseForwardDestinationHttpType: default: http description: Type of the HTTP destination. enum: - http example: http type: string x-enum-varnames: - HTTP CustomDestinationResponseForwardDestinationMicrosoftSentinel: description: The Microsoft Sentinel destination. properties: client_id: description: Client ID from the Datadog Azure integration. example: 9a2f4d83-2b5e-429e-a35a-2b3c4182db71 type: string data_collection_endpoint: description: Azure data collection endpoint. example: https://my-dce-5kyl.eastus-1.ingest.monitor.azure.com type: string data_collection_rule_id: description: Azure data collection rule ID. example: dcr-000a00a000a00000a000000aa000a0aa type: string stream_name: description: Azure stream name. example: Custom-MyTable type: string writeOnly: true tenant_id: description: Tenant ID from the Datadog Azure integration. example: f3c9a8a1-4c2e-4d2e-b911-9f3c28c3c8b2 type: string type: $ref: "#/components/schemas/CustomDestinationResponseForwardDestinationMicrosoftSentinelType" required: - type - tenant_id - client_id - data_collection_endpoint - data_collection_rule_id - stream_name type: object CustomDestinationResponseForwardDestinationMicrosoftSentinelType: default: microsoft_sentinel description: Type of the Microsoft Sentinel destination. enum: - microsoft_sentinel example: microsoft_sentinel type: string x-enum-varnames: - MICROSOFT_SENTINEL CustomDestinationResponseForwardDestinationSplunk: description: The Splunk HTTP Event Collector (HEC) destination. properties: endpoint: description: |- The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed. example: https://example.com type: string sourcetype: description: |- The Splunk sourcetype for the events sent to this Splunk destination. If the field is absent from the request and no sourcetype has been previously set on this destination, the default sourcetype `_json` is used. On update, if the field is absent from the request but a sourcetype was previously set, the previous value is kept. If set to `null`, the sourcetype field is omitted from the forwarded event entirely. Otherwise, the provided string value is used as the sourcetype. example: my-source nullable: true type: string type: $ref: "#/components/schemas/CustomDestinationResponseForwardDestinationSplunkType" required: - type - endpoint type: object CustomDestinationResponseForwardDestinationSplunkType: default: splunk_hec description: Type of the Splunk HTTP Event Collector (HEC) destination. enum: - splunk_hec example: splunk_hec type: string x-enum-varnames: - SPLUNK_HEC CustomDestinationResponseHttpDestinationAuth: description: Authentication method of the HTTP requests. oneOf: - $ref: "#/components/schemas/CustomDestinationResponseHttpDestinationAuthBasic" - $ref: "#/components/schemas/CustomDestinationResponseHttpDestinationAuthCustomHeader" CustomDestinationResponseHttpDestinationAuthBasic: description: Basic access authentication. properties: type: $ref: "#/components/schemas/CustomDestinationResponseHttpDestinationAuthBasicType" required: - type type: object CustomDestinationResponseHttpDestinationAuthBasicType: default: basic description: Type of the basic access authentication. enum: - basic example: basic type: string x-enum-varnames: - BASIC CustomDestinationResponseHttpDestinationAuthCustomHeader: description: Custom header access authentication. properties: header_name: description: The header name of the authentication. example: CUSTOM-HEADER-NAME type: string type: $ref: "#/components/schemas/CustomDestinationResponseHttpDestinationAuthCustomHeaderType" required: - type - header_name type: object CustomDestinationResponseHttpDestinationAuthCustomHeaderType: default: custom_header description: Type of the custom header access authentication. enum: - custom_header example: custom_header type: string x-enum-varnames: - CUSTOM_HEADER CustomDestinationType: default: custom_destination description: The type of the resource. The value should always be `custom_destination`. enum: - custom_destination example: custom_destination type: string x-enum-varnames: - CUSTOM_DESTINATION CustomDestinationUpdateRequest: description: The custom destination. properties: data: $ref: "#/components/schemas/CustomDestinationUpdateRequestDefinition" type: object CustomDestinationUpdateRequestAttributes: description: The attributes associated with the custom destination. properties: enabled: default: true description: Whether logs matching this custom destination should be forwarded or not. example: true type: boolean forward_tags: default: true description: Whether tags from the forwarded logs should be forwarded or not. example: true type: boolean forward_tags_restriction_list: default: [] description: |- List of [keys of tags](https://docs.datadoghq.com/getting_started/tagging/#define-tags) to be restricted from being forwarded. An empty list represents no restriction is in place and either all or no tags will be forwarded depending on `forward_tags_restriction_list_type` parameter. example: ["datacenter", "host"] items: description: The [key part of a tag](https://docs.datadoghq.com/getting_started/tagging/#define-tags). type: string maxItems: 10 minItems: 0 type: array forward_tags_restriction_list_type: $ref: "#/components/schemas/CustomDestinationAttributeTagsRestrictionListType" forwarder_destination: $ref: "#/components/schemas/CustomDestinationForwardDestination" name: description: The custom destination name. example: Nginx logs type: string query: default: "" description: The custom destination query and filter. Logs matching this query are forwarded to the destination. example: source:nginx type: string type: object CustomDestinationUpdateRequestDefinition: description: The definition of a custom destination. properties: attributes: $ref: "#/components/schemas/CustomDestinationUpdateRequestAttributes" id: description: The custom destination ID. example: be5d7a69-d0c8-4d4d-8ee8-bba292d98139 type: string type: $ref: "#/components/schemas/CustomDestinationType" required: - type - id type: object CustomDestinationsResponse: description: The available custom destinations. properties: data: description: A list of custom destinations. items: $ref: "#/components/schemas/CustomDestinationResponseDefinition" type: array type: object CustomForecastEntry: description: A monthly entry of a custom budget forecast. properties: amount: description: Forecast amount for the month. example: 400 format: double type: number month: description: Month the custom forecast entry applies to, in `YYYYMM` format. example: 202501 format: int64 type: integer tag_filters: description: Tag filters that scope this custom forecast entry to specific resources. items: $ref: "#/components/schemas/CustomForecastEntryTagFilter" type: array required: - month - amount - tag_filters type: object CustomForecastEntryTagFilter: description: A tag filter that scopes a custom forecast entry to specific resource tags. properties: tag_key: description: The tag key to filter on. example: service type: string tag_value: description: The tag value to filter on. example: ec2 type: string required: - tag_key - tag_value type: object CustomForecastResponse: description: Response object containing the custom forecast for a budget. properties: data: $ref: "#/components/schemas/CustomForecastResponseData" required: - data type: object CustomForecastResponseData: description: Custom forecast resource wrapper in a response. properties: attributes: $ref: "#/components/schemas/CustomForecastResponseDataAttributes" id: description: The unique identifier of the custom forecast. example: 11111111-1111-1111-1111-111111111111 type: string type: $ref: "#/components/schemas/CustomForecastType" required: - id - type - attributes type: object CustomForecastResponseDataAttributes: description: Attributes of a custom forecast. properties: budget_uid: description: The UUID of the budget that this custom forecast belongs to. example: 00000000-0000-0000-0000-000000000001 type: string created_at: description: Timestamp the custom forecast was created, in Unix milliseconds. example: 1738258683590 format: int64 type: integer created_by: description: The id of the user that created the custom forecast. example: 00000000-0a0a-0a0a-aaa0-00000000000a type: string entries: description: Monthly custom forecast entries. items: $ref: "#/components/schemas/CustomForecastEntry" type: array updated_at: description: Timestamp the custom forecast was last updated, in Unix milliseconds. example: 1738258683590 format: int64 type: integer updated_by: description: The id of the user that last updated the custom forecast. example: 00000000-0a0a-0a0a-aaa0-00000000000a type: string required: - budget_uid - created_at - updated_at - created_by - updated_by - entries type: object CustomForecastType: default: custom_forecast description: The type of the custom forecast resource. Must be `custom_forecast`. enum: - custom_forecast example: custom_forecast type: string x-enum-varnames: - CUSTOM_FORECAST CustomForecastUpsertRequest: description: Request body to upsert (create or replace) the custom forecast for a budget. properties: data: $ref: "#/components/schemas/CustomForecastUpsertRequestData" required: - data type: object CustomForecastUpsertRequestData: description: Custom forecast resource wrapper in an upsert request. properties: attributes: $ref: "#/components/schemas/CustomForecastUpsertRequestDataAttributes" id: description: Unused on upsert; the resource is keyed by `budget_uid`. Send an empty string. example: "" type: string type: $ref: "#/components/schemas/CustomForecastType" required: - type - attributes type: object CustomForecastUpsertRequestDataAttributes: description: Attributes of a custom forecast upsert request. properties: budget_uid: description: The UUID of the budget that this custom forecast belongs to. example: 00000000-0000-0000-0000-000000000001 type: string entries: description: |- Monthly custom forecast entries. An empty list deletes any existing custom forecast for the budget. items: $ref: "#/components/schemas/CustomForecastEntry" type: array required: - budget_uid - entries type: object CustomFrameworkControl: description: Framework Control. properties: name: description: Control Name. example: A1.2 type: string rules_id: description: Rule IDs. example: - '["def-000-abc"]' items: description: A rule ID associated with the control. type: string type: array required: - name - rules_id type: object CustomFrameworkData: description: Contains type and attributes for custom frameworks. properties: attributes: $ref: "#/components/schemas/CustomFrameworkDataAttributes" type: $ref: "#/components/schemas/CustomFrameworkType" required: - type - attributes type: object CustomFrameworkDataAttributes: description: Framework Data Attributes. properties: description: description: Framework Description type: string handle: description: Framework Handle example: sec2 type: string icon_url: description: Framework Icon URL type: string name: description: Framework Name example: security-framework type: string requirements: description: Framework Requirements items: $ref: "#/components/schemas/CustomFrameworkRequirement" type: array version: description: Framework Version example: "2" type: string required: - handle - version - name - requirements type: object CustomFrameworkDataHandleAndVersion: description: Framework Handle and Version. properties: handle: description: Framework Handle example: sec2 type: string version: description: Framework Version example: "2" type: string type: object CustomFrameworkMetadata: description: Metadata for custom frameworks. properties: attributes: $ref: "#/components/schemas/CustomFrameworkWithoutRequirements" id: description: The ID of the custom framework. example: handle-version type: string type: $ref: "#/components/schemas/CustomFrameworkType" type: object CustomFrameworkRequirement: description: Framework Requirement. properties: controls: description: Requirement Controls. items: $ref: "#/components/schemas/CustomFrameworkControl" type: array name: description: Requirement Name. example: criteria type: string required: - name - controls type: object CustomFrameworkType: default: custom_framework description: The type of the resource. The value must be `custom_framework`. enum: - custom_framework example: custom_framework type: string x-enum-varnames: - CUSTOM_FRAMEWORK CustomFrameworkWithoutRequirements: description: Framework without requirements. properties: description: description: Framework Description example: this is a security description type: string handle: description: Framework Handle example: sec2 type: string icon_url: description: Framework Icon URL example: https://example.com/icon.png type: string name: description: Framework Name example: security-framework type: string version: description: Framework Version example: "2" type: string required: - handle - version - name type: object CustomRule: additionalProperties: false description: |- A custom static analysis rule within a ruleset, as supplied in a create or update request. Nested rules are sent flat, without a `data`/`type`/`attributes` envelope. `id` and `name` are client-supplied and must match each other. The remaining members are server-assigned and read-only; they are declared so that a ruleset previously read back can be supplied unchanged. properties: created_at: description: Creation timestamp example: "2026-01-09T13:00:57.473141Z" format: date-time readOnly: true type: string created_by: description: Creator identifier example: foobarbaz readOnly: true type: string id: description: Rule identifier, which is the same as the rule name. example: my-rule type: string last_revision: $ref: "#/components/schemas/CustomRuleRevisionInput" description: Most recent revision nullable: true name: description: Rule name example: my-rule type: string revisions: description: Revision history of the rule. items: $ref: "#/components/schemas/CustomRuleRevisionInput" nullable: true type: array required: - id - name type: object CustomRuleAttributes: description: Attributes of a custom static analysis rule, including its most recent revision and revision history. properties: created_at: description: Creation timestamp example: "2026-01-09T13:00:57.473141Z" format: date-time type: string created_by: description: Creator identifier example: foobarbaz type: string last_revision: $ref: "#/components/schemas/CustomRuleNullableRevisionEmbedded" name: description: Rule name example: my-rule type: string revisions: description: Revision history of the rule. items: $ref: "#/components/schemas/CustomRuleRevisionEmbedded" nullable: true type: array required: - name - created_at - created_by - last_revision - revisions type: object CustomRuleDataType: description: Resource type enum: [custom_rule] example: custom_rule type: string x-enum-varnames: - CUSTOM_RULE CustomRuleNullableRevisionEmbedded: description: The most recent revision of the rule, or null when the rule has no revisions. nullable: true properties: arguments: description: Rule arguments items: $ref: "#/components/schemas/Argument" nullable: true type: array category: $ref: "#/components/schemas/CustomRuleRevisionAttributesCategory" checksum: description: Code checksum example: 8a66c4e4e631099ad71be3c1ea3ea8fc2d57193e56db2c296e2dd8a508b26b99 type: string code: description: Rule code example: Y29uZHVjdG9yOgogICAgLSBkZXBsb3lfb25seTogdHJ1ZQ== type: string created_at: description: Creation timestamp example: "2026-01-09T13:00:57.473141Z" format: date-time type: string created_by: description: Creator identifier example: foobarbaz type: string creation_message: description: Revision creation message example: Initial revision type: string cve: description: Associated CVE. Omitted when the revision has no associated CVE. example: CVE-2024-1234 type: string cwe: description: Associated CWE. Omitted when the revision has no associated CWE. example: CWE-79 type: string description: description: Full description example: bG9uZyBkZXNjcmlwdGlvbg== type: string documentation_url: description: Documentation URL. Omitted when the revision has no documentation URL. example: https://docs.example.com/rules/my-rule type: string id: description: Revision identifier example: revision-123 type: string is_published: description: Whether the revision is published example: false type: boolean is_testing: description: Whether this is a testing revision example: false type: boolean language: $ref: "#/components/schemas/Language" severity: $ref: "#/components/schemas/CustomRuleRevisionAttributesSeverity" short_description: description: Short description example: c2hvcnQgZGVzY3JpcHRpb24= type: string should_use_ai_fix: description: Whether to use AI for fixes example: false type: boolean tags: description: Rule tags example: - security - custom items: description: A tag attached to the rule. type: string nullable: true type: array tests: description: Rule tests items: $ref: "#/components/schemas/CustomRuleRevisionTest" nullable: true type: array tree_sitter_query: description: Tree-sitter query example: Y29uZHVjdG9yOgogICAgLSBkZXBsb3lfb25seTogdHJ1ZQ== type: string version_id: description: Monotonically increasing version number of the revision. example: 1 format: int64 type: integer required: - id - version_id - creation_message - short_description - description - code - checksum - language - tree_sitter_query - created_at - created_by - severity - category - arguments - tests - tags - is_published - should_use_ai_fix - is_testing type: object CustomRuleRequest: description: Request body for creating or updating a custom rule. properties: _authentication_token: description: CSRF token for security, sent by browser-based clients. Ignored by the API when absent. type: string data: $ref: "#/components/schemas/CustomRuleRequestData" type: object CustomRuleRequestData: description: Data object for a custom rule create or update request. properties: attributes: $ref: "#/components/schemas/CustomRuleRequestDataAttributes" id: description: Rule identifier type: string type: $ref: "#/components/schemas/CustomRuleDataType" type: object CustomRuleRequestDataAttributes: description: Attributes for creating or updating a custom rule. properties: name: description: Rule name type: string type: object CustomRuleResponse: description: Response containing a single custom rule. properties: data: $ref: "#/components/schemas/CustomRuleResponseData" required: - data type: object CustomRuleResponseData: description: Data object returned in a custom rule response, including its ID, type, and attributes. properties: attributes: $ref: "#/components/schemas/CustomRuleAttributes" id: description: Rule identifier example: my-rule type: string type: $ref: "#/components/schemas/CustomRuleDataType" required: - id - type - attributes type: object CustomRuleRevision: description: A specific revision of a custom static analysis rule. properties: attributes: $ref: "#/components/schemas/CustomRuleRevisionAttributes" id: description: Revision identifier example: revision-123 type: string type: $ref: "#/components/schemas/CustomRuleRevisionDataType" required: - id - type - attributes type: object CustomRuleRevisionAttributes: description: Attributes of a custom rule revision, including code, metadata, and test cases. properties: arguments: description: Rule arguments items: $ref: "#/components/schemas/Argument" nullable: true type: array category: $ref: "#/components/schemas/CustomRuleRevisionAttributesCategory" checksum: description: Code checksum example: 8a66c4e4e631099ad71be3c1ea3ea8fc2d57193e56db2c296e2dd8a508b26b99 type: string code: description: Rule code example: Y29uZHVjdG9yOgogICAgLSBkZXBsb3lfb25seTogdHJ1ZQ== type: string created_at: description: Creation timestamp example: "2026-01-09T13:00:57.473141Z" format: date-time type: string created_by: description: Creator identifier example: foobarbaz type: string creation_message: description: Revision creation message example: Initial revision type: string cve: description: Associated CVE example: CVE-2024-1234 nullable: true type: string cwe: description: Associated CWE example: CWE-79 nullable: true type: string description: description: Full description example: bG9uZyBkZXNjcmlwdGlvbg== type: string documentation_url: description: Documentation URL example: https://docs.example.com/rules/my-rule nullable: true type: string is_published: description: Whether the revision is published example: false type: boolean is_testing: description: Whether this is a testing revision example: false type: boolean language: $ref: "#/components/schemas/Language" severity: $ref: "#/components/schemas/CustomRuleRevisionAttributesSeverity" short_description: description: Short description example: c2hvcnQgZGVzY3JpcHRpb24= type: string should_use_ai_fix: description: Whether to use AI for fixes example: false type: boolean tags: description: Rule tags example: - security - custom items: description: A tag attached to the rule. type: string nullable: true type: array tests: description: Rule tests items: $ref: "#/components/schemas/CustomRuleRevisionTest" nullable: true type: array tree_sitter_query: description: Tree-sitter query example: Y29uZHVjdG9yOgogICAgLSBkZXBsb3lfb25seTogdHJ1ZQ== type: string version_id: description: Monotonically increasing version number of the revision. example: 1 format: int64 type: integer required: - version_id - creation_message - short_description - description - code - checksum - language - tree_sitter_query - created_at - created_by - severity - category - arguments - tests - tags - is_published - should_use_ai_fix - is_testing type: object CustomRuleRevisionAttributesCategory: description: Rule category enum: [SECURITY, BEST_PRACTICES, CODE_STYLE, ERROR_PRONE, PERFORMANCE] example: SECURITY type: string x-enum-varnames: - SECURITY - BEST_PRACTICES - CODE_STYLE - ERROR_PRONE - PERFORMANCE CustomRuleRevisionAttributesSeverity: description: Rule severity enum: [ERROR, WARNING, NOTICE, NONE] example: ERROR type: string x-enum-varnames: - ERROR - WARNING - NOTICE - NONE CustomRuleRevisionDataType: description: Resource type enum: [custom_rule_revision] example: custom_rule_revision type: string x-enum-varnames: - CUSTOM_RULE_REVISION CustomRuleRevisionEmbedded: description: A revision of a custom static analysis rule as embedded in a rule or ruleset response. properties: arguments: description: Rule arguments items: $ref: "#/components/schemas/Argument" nullable: true type: array category: $ref: "#/components/schemas/CustomRuleRevisionAttributesCategory" checksum: description: Code checksum example: 8a66c4e4e631099ad71be3c1ea3ea8fc2d57193e56db2c296e2dd8a508b26b99 type: string code: description: Rule code example: Y29uZHVjdG9yOgogICAgLSBkZXBsb3lfb25seTogdHJ1ZQ== type: string created_at: description: Creation timestamp example: "2026-01-09T13:00:57.473141Z" format: date-time type: string created_by: description: Creator identifier example: foobarbaz type: string creation_message: description: Revision creation message example: Initial revision type: string cve: description: Associated CVE. Omitted when the revision has no associated CVE. example: CVE-2024-1234 type: string cwe: description: Associated CWE. Omitted when the revision has no associated CWE. example: CWE-79 type: string description: description: Full description example: bG9uZyBkZXNjcmlwdGlvbg== type: string documentation_url: description: Documentation URL. Omitted when the revision has no documentation URL. example: https://docs.example.com/rules/my-rule type: string id: description: Revision identifier example: revision-123 type: string is_published: description: Whether the revision is published example: false type: boolean is_testing: description: Whether this is a testing revision example: false type: boolean language: $ref: "#/components/schemas/Language" severity: $ref: "#/components/schemas/CustomRuleRevisionAttributesSeverity" short_description: description: Short description example: c2hvcnQgZGVzY3JpcHRpb24= type: string should_use_ai_fix: description: Whether to use AI for fixes example: false type: boolean tags: description: Rule tags example: - security - custom items: description: A tag attached to the rule. type: string nullable: true type: array tests: description: Rule tests items: $ref: "#/components/schemas/CustomRuleRevisionTest" nullable: true type: array tree_sitter_query: description: Tree-sitter query example: Y29uZHVjdG9yOgogICAgLSBkZXBsb3lfb25seTogdHJ1ZQ== type: string version_id: description: Monotonically increasing version number of the revision. example: 1 format: int64 type: integer required: - id - version_id - creation_message - short_description - description - code - checksum - language - tree_sitter_query - created_at - created_by - severity - category - arguments - tests - tags - is_published - should_use_ai_fix - is_testing type: object CustomRuleRevisionInput: additionalProperties: false description: |- A revision of a custom static analysis rule as embedded in a rule supplied by a create or update request. Nested revisions are sent flat, without a `data`/`type`/`attributes` envelope. `id`, `version_id`, `checksum`, `created_at` and `created_by` are server-assigned and read-only; they are declared so that a ruleset previously read back can be supplied unchanged. properties: arguments: description: Rule arguments items: $ref: "#/components/schemas/Argument" nullable: true type: array category: $ref: "#/components/schemas/CustomRuleRevisionAttributesCategory" checksum: description: Code checksum example: 8a66c4e4e631099ad71be3c1ea3ea8fc2d57193e56db2c296e2dd8a508b26b99 readOnly: true type: string code: description: Rule code example: Y29uZHVjdG9yOgogICAgLSBkZXBsb3lfb25seTogdHJ1ZQ== type: string created_at: description: Creation timestamp example: "2026-01-09T13:00:57.473141Z" format: date-time readOnly: true type: string created_by: description: Creator identifier example: foobarbaz readOnly: true type: string creation_message: description: Revision creation message example: Initial revision type: string cve: description: Associated CVE example: CVE-2024-1234 nullable: true type: string cwe: description: Associated CWE example: CWE-79 nullable: true type: string description: description: Base64-encoded full description example: bG9uZyBkZXNjcmlwdGlvbg== type: string documentation_url: description: Documentation URL example: https://docs.example.com/rules/my-rule nullable: true type: string id: description: Revision identifier example: revision-123 readOnly: true type: string is_published: description: Whether the revision should be published example: false type: boolean is_testing: description: Whether this is a testing revision example: false type: boolean language: $ref: "#/components/schemas/Language" severity: $ref: "#/components/schemas/CustomRuleRevisionAttributesSeverity" short_description: description: Base64-encoded short description example: c2hvcnQgZGVzY3JpcHRpb24= type: string should_use_ai_fix: description: Whether to use AI for fixes example: false type: boolean tags: description: Rule tags example: - security - custom items: description: A tag attached to the rule. type: string nullable: true type: array tests: description: Rule tests items: $ref: "#/components/schemas/CustomRuleRevisionTest" nullable: true type: array tree_sitter_query: description: Tree-sitter query example: Y29uZHVjdG9yOgogICAgLSBkZXBsb3lfb25seTogdHJ1ZQ== type: string version_id: description: Monotonically increasing version number of the revision. example: 1 format: int64 readOnly: true type: integer type: object CustomRuleRevisionInputAttributes: description: Input attributes for creating or updating a custom rule revision. properties: arguments: description: Rule arguments items: $ref: "#/components/schemas/Argument" nullable: true type: array category: $ref: "#/components/schemas/CustomRuleRevisionAttributesCategory" checksum: description: Code checksum. Derived by the API from `code`; ignored on write. example: 8a66c4e4e631099ad71be3c1ea3ea8fc2d57193e56db2c296e2dd8a508b26b99 readOnly: true type: string code: description: Rule code example: Y29uZHVjdG9yOgogICAgLSBkZXBsb3lfb25seTogdHJ1ZQ== type: string created_at: description: Creation timestamp. Set by the API; ignored on write. example: "2026-01-09T13:00:57.473141Z" format: date-time readOnly: true type: string created_by: description: Creator identifier. Set by the API from the caller; ignored on write. example: foobarbaz readOnly: true type: string creation_message: description: Revision creation message example: Initial revision type: string cve: description: Associated CVE example: CVE-2024-1234 nullable: true type: string cwe: description: Associated CWE example: CWE-79 nullable: true type: string description: description: Full description example: bG9uZyBkZXNjcmlwdGlvbg== type: string documentation_url: description: Documentation URL example: https://docs.example.com/rules/my-rule nullable: true type: string is_published: description: Whether the revision is published example: false type: boolean is_testing: description: Whether this is a testing revision example: false type: boolean language: $ref: "#/components/schemas/Language" severity: $ref: "#/components/schemas/CustomRuleRevisionAttributesSeverity" short_description: description: Short description example: c2hvcnQgZGVzY3JpcHRpb24= type: string should_use_ai_fix: description: Whether to use AI for fixes example: false type: boolean tags: description: Rule tags example: - security - custom items: description: A tag attached to the rule. type: string nullable: true type: array tests: description: Rule tests items: $ref: "#/components/schemas/CustomRuleRevisionTest" nullable: true type: array tree_sitter_query: description: Tree-sitter query example: Y29uZHVjdG9yOgogICAgLSBkZXBsb3lfb25seTogdHJ1ZQ== type: string version_id: description: Monotonically increasing version number of the revision. Assigned by the API; ignored on write. example: 1 format: int64 readOnly: true type: integer required: - creation_message - short_description - description - code - language - tree_sitter_query - severity - category - arguments - tests - tags - is_published - should_use_ai_fix - is_testing type: object CustomRuleRevisionRequest: description: Request body for creating a new custom rule revision. properties: _authentication_token: description: CSRF token for security, sent by browser-based clients. Ignored by the API when absent. type: string data: $ref: "#/components/schemas/CustomRuleRevisionRequestData" type: object CustomRuleRevisionRequestData: description: Data object for a custom rule revision create request. properties: attributes: $ref: "#/components/schemas/CustomRuleRevisionInputAttributes" id: description: Revision identifier type: string type: $ref: "#/components/schemas/CustomRuleRevisionDataType" type: object CustomRuleRevisionResponse: description: Response containing a single custom rule revision. properties: data: $ref: "#/components/schemas/CustomRuleRevision" required: - data type: object CustomRuleRevisionTest: description: A test case associated with a custom rule revision, used to validate rule behavior. properties: annotation_count: description: Expected violation count example: 1 format: int64 maximum: 65535 minimum: 0 type: integer code: description: Test code example: Y29uZHVjdG9yOgogICAgLSBkZXBsb3lfb25seTogdHJ1ZQ== type: string filename: description: Test filename example: test.yaml type: string required: - filename - code - annotation_count type: object CustomRuleRevisionsResponse: description: Response containing a paginated list of custom rule revisions. properties: data: description: List of custom rule revisions. items: $ref: "#/components/schemas/CustomRuleRevision" type: array type: object CustomRuleset: description: A custom static analysis ruleset containing a set of user-defined rules. properties: attributes: $ref: "#/components/schemas/CustomRulesetAttributes" id: description: Ruleset identifier example: my-ruleset type: string type: $ref: "#/components/schemas/CustomRulesetDataType" required: - id - type - attributes type: object CustomRulesetAttributes: description: Attributes of a custom ruleset, including its name, description, and rules. properties: created_at: description: Creation timestamp example: "2026-01-09T13:00:57.473141Z" format: date-time type: string created_by: description: Creator identifier example: foobarbaz type: string description: description: Base64-encoded full description example: bG9uZyBkZXNjcmlwdGlvbg== type: string name: description: Ruleset name example: my-ruleset type: string rules: description: Rules in the ruleset items: $ref: "#/components/schemas/CustomRulesetRuleEmbedded" nullable: true type: array short_description: description: Base64-encoded short description example: c2hvcnQgZGVzY3JpcHRpb24= type: string required: - name - short_description - description - created_at - created_by - rules type: object CustomRulesetDataType: description: Resource type enum: [custom_ruleset] example: custom_ruleset type: string x-enum-varnames: - CUSTOM_RULESET CustomRulesetListResponse: description: Response containing a list of custom rulesets for the authenticated organization. properties: data: description: The list of custom rulesets. items: $ref: "#/components/schemas/CustomRuleset" type: array required: - data type: object CustomRulesetRequest: description: Request body for creating or updating a custom ruleset. properties: data: $ref: "#/components/schemas/CustomRulesetRequestData" type: object CustomRulesetRequestData: description: |- Data object for a custom ruleset create or update request. The resource `id` is required and must equal both `attributes.name` and, on update, the `ruleset_name` path parameter; a request that omits it or supplies a different value is rejected with a 412 response. properties: attributes: $ref: "#/components/schemas/CustomRulesetRequestDataAttributes" id: description: Ruleset identifier, which is the same as the ruleset name. example: my-ruleset type: string type: $ref: "#/components/schemas/CustomRulesetDataType" required: - id - type - attributes type: object CustomRulesetRequestDataAttributes: description: |- Attributes for creating or updating a custom ruleset. `name` is required and must equal the resource `id`; the server rejects a mismatch with a 412 response. properties: description: description: Base64-encoded full description example: bG9uZyBkZXNjcmlwdGlvbg== type: string name: description: Ruleset name, which must be the same as the resource identifier. example: my-ruleset type: string rules: description: Rules in the ruleset items: $ref: "#/components/schemas/CustomRule" nullable: true type: array short_description: description: Base64-encoded short description example: c2hvcnQgZGVzY3JpcHRpb24= type: string required: - name type: object CustomRulesetResponse: description: Response containing a single custom ruleset. properties: data: $ref: "#/components/schemas/CustomRuleset" required: - data type: object CustomRulesetRuleEmbedded: description: A custom static analysis rule as embedded in the rules list of a ruleset response. properties: created_at: description: Creation timestamp example: "2026-01-09T13:00:57.473141Z" format: date-time type: string created_by: description: Creator identifier example: foobarbaz type: string id: description: Rule identifier, which is the same as the rule name. example: my-rule type: string last_revision: $ref: "#/components/schemas/CustomRuleNullableRevisionEmbedded" name: description: Rule name example: my-rule type: string revisions: description: Revision history of the rule. items: $ref: "#/components/schemas/CustomRuleRevisionEmbedded" nullable: true type: array required: - id - name - created_at - created_by - last_revision - revisions type: object CustomerOrgDisableRequest: description: Request payload for disabling the authenticated customer organization. properties: data: $ref: "#/components/schemas/CustomerOrgDisableRequestData" required: - data type: object CustomerOrgDisableRequestAttributes: description: |- Optional attributes for a customer org disable request. When supplied, `org_uuid` must match the authenticated organization or the request is rejected. properties: org_uuid: description: |- Datadog organization UUID. If supplied, must match the authenticated organization. example: "abcdef01-2345-6789-abcd-ef0123456789" type: string type: object CustomerOrgDisableRequestData: description: Data object for a customer org disable request. properties: attributes: $ref: "#/components/schemas/CustomerOrgDisableRequestAttributes" id: description: |- Optional client-supplied identifier for the request. Useful for client-side correlation; the server does not use this value. example: "1" type: string type: $ref: "#/components/schemas/CustomerOrgDisableType" required: - type type: object CustomerOrgDisableResponse: description: Response describing the outcome of disabling the customer organization. properties: data: $ref: "#/components/schemas/CustomerOrgDisableResponseData" required: - data type: object CustomerOrgDisableResponseAttributes: description: Attributes describing the outcome of the disable action on the customer organization. properties: status: $ref: "#/components/schemas/CustomerOrgDisableStatus" required: - status type: object CustomerOrgDisableResponseData: description: Data object returned after disabling the customer organization. properties: attributes: $ref: "#/components/schemas/CustomerOrgDisableResponseAttributes" id: description: Identifier of the disabled organization. example: "abcdef01-2345-6789-abcd-ef0123456789" type: string type: $ref: "#/components/schemas/CustomerOrgDisableResponseType" required: - type - id - attributes type: object CustomerOrgDisableResponseType: description: JSON:API resource type for a customer org disable response. enum: - org_disable example: "org_disable" type: string x-enum-varnames: - ORG_DISABLE CustomerOrgDisableStatus: description: Resulting lifecycle status of the organization after the disable action. enum: - disabled - pending_disable example: "disabled" type: string x-enum-varnames: - DISABLED - PENDING_DISABLE CustomerOrgDisableType: description: JSON:API resource type for a customer org disable request. enum: - customer_org_disable example: "customer_org_disable" type: string x-enum-varnames: - CUSTOMER_ORG_DISABLE CycloneDXBom: description: A CycloneDX 1.5 Bill of Materials (BOM) document containing vulnerability data. properties: bomFormat: description: The BOM format identifier. Must be `CycloneDX`. example: CycloneDX type: string components: description: The list of scanned software components. Cannot be empty. items: $ref: "#/components/schemas/CycloneDXComponent" type: array metadata: $ref: "#/components/schemas/CycloneDXMetadata" specVersion: description: The CycloneDX specification version. Must be `1.5`. example: "1.5" type: string version: description: The version number of the BOM document. example: 1 format: int64 type: integer vulnerabilities: description: The list of detected vulnerabilities. Cannot be empty. items: $ref: "#/components/schemas/CycloneDXVulnerability" type: array required: - bomFormat - specVersion - metadata - components - vulnerabilities type: object CycloneDXComponent: description: A software component identified during scanning. properties: bom-ref: description: A unique reference identifier used to link vulnerabilities to this component. example: a3390fca-c315-41ae-ae05-af5e7859cdee type: string name: description: The name of the component. example: lodash type: string purl: description: The Package URL (PURL) of the component. Required when `type` is `library`. example: "pkg:npm/lodash@4.17.21" type: string type: $ref: "#/components/schemas/CycloneDXComponentType" version: description: The version of the component. example: 4.17.21 type: string required: - bom-ref - type - name - version type: object CycloneDXComponentType: description: The type of the scanned component. enum: - library - application - operating-system example: library type: string x-enum-varnames: - LIBRARY - APPLICATION - OPERATING_SYSTEM CycloneDXMetadata: description: Metadata about the BOM, including the scanned asset and the scanner tool. properties: component: $ref: "#/components/schemas/CycloneDXMetadataComponent" tools: $ref: "#/components/schemas/CycloneDXMetadataTools" required: - component - tools type: object CycloneDXMetadataComponent: description: The asset that was scanned (for example, a host or container image). properties: bom-ref: description: >- A unique reference identifier for this metadata component. If set, must match a `bom-ref` in `components`. example: host-ref-abc123 type: string name: description: The name or identifier of the scanned asset (for example, an instance ID or hostname). example: i-12345 type: string type: description: The type of the scanned asset. example: operating-system type: string required: - name type: object CycloneDXMetadataTools: description: Information about the scanner tool that produced this BOM. properties: components: description: The scanner tool components. Must contain exactly one element. items: $ref: "#/components/schemas/CycloneDXToolComponent" type: array required: - components type: object CycloneDXToolComponent: description: A scanner tool component. properties: name: description: The name of the scanner tool. example: my-scanner type: string type: description: The type of the tool component. example: application type: string required: - name type: object CycloneDXVulnerability: description: A security vulnerability affecting one or more components. properties: advisories: description: External advisory references for the vulnerability. items: $ref: "#/components/schemas/CycloneDXVulnerabilityAdvisory" type: array affects: description: >- The components affected by this vulnerability. Must be non-empty. Each `ref` must match a `bom-ref` in `components`. items: $ref: "#/components/schemas/CycloneDXVulnerabilityAffects" type: array analysis: $ref: "#/components/schemas/CycloneDXVulnerabilityAnalysis" cwes: description: CWE identifiers associated with the vulnerability. example: [123, 345] items: format: int64 type: integer type: array description: description: A short description of the vulnerability. example: "Sample vulnerability detected in the application." type: string detail: description: Detailed information about the vulnerability. example: "Details about the vulnerability." type: string id: description: The vulnerability identifier (for example, a CVE ID). example: CVE-2021-1234 type: string ratings: description: The severity ratings for the vulnerability. Must contain exactly one element. items: $ref: "#/components/schemas/CycloneDXVulnerabilityRating" type: array references: description: External reference identifiers for the vulnerability. items: $ref: "#/components/schemas/CycloneDXVulnerabilityReference" type: array required: - id - ratings - affects type: object CycloneDXVulnerabilityAdvisory: description: An external advisory reference for a vulnerability. properties: url: description: The URL of the advisory. example: "https://example.com/advisory/CVE-2021-1234" type: string type: object CycloneDXVulnerabilityAffects: description: A reference to a component affected by a vulnerability. properties: ref: description: The `bom-ref` of the affected component. example: a3390fca-c315-41ae-ae05-af5e7859cdee type: string required: - ref type: object CycloneDXVulnerabilityAnalysis: description: |- The exploitability analysis for the vulnerability. When `state` is set to `resolved` or `resolved_with_pedigree`, the vulnerability is closed in Datadog. Other state values are accepted but have no effect on the vulnerability status. properties: state: description: The vulnerability analysis state. example: resolved type: string type: object CycloneDXVulnerabilityRating: description: A severity rating for a vulnerability. properties: score: description: The CVSS score. example: 9.0 format: double type: number severity: description: The severity level. example: high type: string vector: description: The CVSS vector string. example: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N" type: string type: object CycloneDXVulnerabilityReference: description: An external reference identifier for a vulnerability. properties: id: description: The identifier of the external reference (for example, a GHSA ID). example: GHSA-35m5-8cvj-8783 type: string source: $ref: "#/components/schemas/CycloneDXVulnerabilityReferenceSource" type: object CycloneDXVulnerabilityReferenceSource: description: The source of an external vulnerability reference. properties: url: description: The URL of the reference source. example: "https://example.com" type: string type: object DORACustomTags: description: A list of user-defined tags. The tags must follow the `key:value` pattern. Up to 100 may be added per event. example: - language:java - department:engineering items: description: Tags in the form of `key:value`. type: string nullable: true type: array DORADeploymentFetchResponse: description: Response for fetching a single deployment event. properties: data: $ref: "#/components/schemas/DORADeploymentObject" type: object DORADeploymentObject: description: A DORA deployment event. example: attributes: custom_tags: - "language:java" - "department:engineering" - "region:us-east-1" env: "production" finished_at: "2023-08-31T14:26:24Z" git: commit_sha: "66adc9350f2cc9b250b69abddab733dd55e1a588" repository_id: "github.com/organization/example-repository" service: "shopist" started_at: "2023-08-31T14:26:14Z" team: "backend" version: "v1.12.07" id: "4242fcdd31586083" type: "dora_deployment" properties: attributes: $ref: "#/components/schemas/DORADeploymentObjectAttributes" id: description: The ID of the deployment event. type: string type: $ref: "#/components/schemas/DORADeploymentType" type: object DORADeploymentObjectAttributes: description: The attributes of the deployment event. properties: custom_tags: $ref: "#/components/schemas/DORACustomTags" env: description: Environment name to where the service was deployed. example: production type: string finished_at: description: The time when the deployment finished. example: "2023-08-31T14:26:24Z" format: date-time type: string git: $ref: "#/components/schemas/DORAGitInfoResponse" service: description: Service name. example: shopist type: string started_at: description: The time when the deployment started. example: "2023-08-31T14:26:14Z" format: date-time type: string team: description: Name of the team owning the deployed service. example: backend type: string version: description: Version to correlate with APM Deployment Tracking. example: v1.12.07 type: string required: - service - started_at type: object DORADeploymentPatchByVersionRemediation: description: Remediation details for the deployment. Optional, but required to calculate failed deployment recovery time. Specify either `id` or `version` to identify the remediation deployment, but not both. oneOf: - $ref: "#/components/schemas/DORADeploymentPatchByVersionRemediationByID" - $ref: "#/components/schemas/DORADeploymentPatchByVersionRemediationByVersion" DORADeploymentPatchByVersionRemediationByID: additionalProperties: false description: Remediation details identified by the ID of the remediation deployment. properties: id: description: The ID of the remediation deployment. example: eG42zNIkVjM type: string type: $ref: "#/components/schemas/DORADeploymentPatchRemediationType" required: - id - type type: object DORADeploymentPatchByVersionRemediationByVersion: additionalProperties: false description: Remediation details identified by the version of the remediation deployment, matched against the same service and environment as the failed deployment. properties: type: $ref: "#/components/schemas/DORADeploymentPatchRemediationType" version: description: The version of the remediation deployment. example: v1.2.4 type: string required: - version - type type: object DORADeploymentPatchByVersionRequest: description: Request to patch a DORA deployment event identified by service, environment, and version. example: data: attributes: change_failure: true env: "production" remediation: type: "rollback" version: "v1.2.2" service: "my-service" version: "v1.2.3" type: "dora_deployment_patch_request" properties: data: $ref: "#/components/schemas/DORADeploymentPatchByVersionRequestData" required: - data type: object DORADeploymentPatchByVersionRequestAttributes: description: Attributes for patching a DORA deployment event identified by service, environment, and version. properties: change_failure: description: Indicates whether the deployment resulted in a change failure. example: true type: boolean env: description: The environment the deployment was performed in. example: prod type: string remediation: $ref: "#/components/schemas/DORADeploymentPatchByVersionRemediation" service: description: The name of the service that was deployed. example: my-service type: string version: description: "The version deployed. This can be seen in the Service Catalog or in the APM Deployment Tracking." example: v1.2.3 type: string required: - service - env - version - change_failure type: object DORADeploymentPatchByVersionRequestData: description: The JSON:API data for patching a deployment identified by service, environment, and version. properties: attributes: $ref: "#/components/schemas/DORADeploymentPatchByVersionRequestAttributes" type: $ref: "#/components/schemas/DORADeploymentPatchRequestDataType" required: - type - attributes type: object DORADeploymentPatchRemediation: description: Remediation details for the deployment. Optional, but required to calculate failed deployment recovery time. Specify either `id` or `version` to identify the remediation deployment, but not both. properties: id: description: The ID of the remediation deployment. Use this or `version` to identify the remediation deployment, but not both. example: eG42zNIkVjM type: string type: $ref: "#/components/schemas/DORADeploymentPatchRemediationType" version: description: The version of the remediation deployment, matched against the same service and environment as the failed deployment. Use this or `id` to identify the remediation deployment, but not both. example: v1.2.4 type: string type: object DORADeploymentPatchRemediationType: description: The type of remediation action taken. Required when the failed deployment must be linked to a remediation deployment. enum: - rollback - rollforward example: rollback type: string x-enum-varnames: - ROLLBACK - ROLLFORWARD DORADeploymentPatchRequest: description: Request to patch a DORA deployment event. example: data: attributes: change_failure: true remediation: id: "eG42zNIkVjM" type: "rollback" id: "z_RwVLi7v4Y" type: "dora_deployment_patch_request" properties: data: $ref: "#/components/schemas/DORADeploymentPatchRequestData" required: - data type: object DORADeploymentPatchRequestAttributes: description: Attributes for patching a DORA deployment event. properties: change_failure: description: Indicates whether the deployment resulted in a change failure. example: true type: boolean remediation: $ref: "#/components/schemas/DORADeploymentPatchRemediation" type: object DORADeploymentPatchRequestData: description: The JSON:API data for patching a deployment. example: attributes: change_failure: true remediation: id: "eG42zNIkVjM" type: "rollback" id: "z_RwVLi7v4Y" type: "dora_deployment_patch_request" properties: attributes: $ref: "#/components/schemas/DORADeploymentPatchRequestAttributes" id: description: The ID of the deployment to patch. example: z_RwVLi7v4Y type: string type: $ref: "#/components/schemas/DORADeploymentPatchRequestDataType" required: - type - id - attributes type: object DORADeploymentPatchRequestDataType: default: dora_deployment_patch_request description: JSON:API type for DORA deployment patch request. enum: - dora_deployment_patch_request example: dora_deployment_patch_request type: string x-enum-varnames: - DORA_DEPLOYMENT_PATCH_REQUEST DORADeploymentRequest: description: Request to create a DORA deployment event. properties: data: $ref: "#/components/schemas/DORADeploymentRequestData" required: - data type: object DORADeploymentRequestAttributes: description: Attributes to create a DORA deployment event. properties: custom_tags: $ref: "#/components/schemas/DORACustomTags" env: description: Environment name to where the service was deployed. example: staging type: string finished_at: description: Unix timestamp when the deployment finished. It must be in nanoseconds, milliseconds, or seconds. example: 1693491984000000000 format: int64 type: integer git: $ref: "#/components/schemas/DORAGitInfo" id: description: Deployment ID. Must be 16-128 characters and contain only alphanumeric characters, hyphens, underscores, periods, and colons (a-z, A-Z, 0-9, -, _, ., :). type: string service: description: Service name. example: shopist type: string started_at: description: Unix timestamp when the deployment started. It must be in nanoseconds, milliseconds, or seconds. example: 1693491974000000000 format: int64 type: integer team: description: Name of the team owning the deployed service. If not provided, this is automatically populated with the team associated with the service in the Service Catalog. example: backend type: string version: description: "Version to correlate with [APM Deployment Tracking](https://docs.datadoghq.com/tracing/services/deployment_tracking/)." example: v1.12.07 type: string required: - service - started_at - finished_at type: object DORADeploymentRequestData: description: The JSON:API data. properties: attributes: $ref: "#/components/schemas/DORADeploymentRequestAttributes" required: - attributes type: object DORADeploymentResponse: description: Response after receiving a DORA deployment event. properties: data: $ref: "#/components/schemas/DORADeploymentResponseData" required: - data type: object DORADeploymentResponseData: description: The JSON:API data. properties: id: description: The ID of the received DORA deployment event. example: 4242fcdd31586083 type: string type: $ref: "#/components/schemas/DORADeploymentType" required: - id type: object DORADeploymentType: default: dora_deployment description: JSON:API type for DORA deployment events. enum: - dora_deployment example: dora_deployment type: string x-enum-varnames: - DORA_DEPLOYMENT DORADeploymentsListResponse: description: Response for the list deployments endpoint. example: data: - attributes: custom_tags: - "language:java" - "department:engineering" - "region:us-east-1" env: "production" finished_at: "2023-08-31T14:26:24Z" git: commit_sha: "66adc9350f2cc9b250b69abddab733dd55e1a588" repository_id: "github.com/organization/example-repository" service: "shopist" started_at: "2023-08-31T14:26:14Z" team: "backend" version: "v1.12.07" id: "4242fcdd31586083" type: "dora_deployment" - attributes: custom_tags: - "language:go" - "department:platform" env: "production" finished_at: "2023-08-31T14:28:04Z" git: commit_sha: "77bdc9350f2cc9b250b69abddab733dd55e1a599" repository_id: "github.com/organization/api-service" service: "api-service" started_at: "2023-08-31T14:27:54Z" team: "backend" version: "v2.1.0" id: "4242fcdd31586084" type: "dora_deployment" properties: data: description: The list of DORA deployment events. items: $ref: "#/components/schemas/DORADeploymentObject" type: array type: object DORAFailureFetchResponse: description: Response for fetching a single incident event. properties: data: $ref: "#/components/schemas/DORAIncidentObject" type: object DORAFailureRequest: description: Request to create a DORA incident event. properties: data: $ref: "#/components/schemas/DORAFailureRequestData" required: - data type: object DORAFailureRequestAttributes: description: Attributes to create a DORA incident event. properties: custom_tags: $ref: "#/components/schemas/DORACustomTags" env: description: Environment name that was impacted by the incident. example: staging type: string finished_at: description: Unix timestamp when the incident finished. It must be in nanoseconds, milliseconds, or seconds. example: 1693491984000000000 format: int64 type: integer git: $ref: "#/components/schemas/DORAGitInfo" id: description: Incident ID. Must be 16-128 characters and contain only alphanumeric characters, hyphens, underscores, periods, and colons (a-z, A-Z, 0-9, -, _, ., :). type: string name: description: Incident name. example: Webserver is down failing all requests. type: string services: description: Service names impacted by the incident. If possible, use names registered in the Service Catalog. Required when the team field is not provided. example: [shopist] items: description: A service name impacted by the incident. type: string type: array severity: description: Incident severity. example: High type: string started_at: description: Unix timestamp when the incident started. It must be in nanoseconds, milliseconds, or seconds. example: 1693491974000000000 format: int64 type: integer team: description: Name of the team owning the services impacted. If possible, use team handles registered in Datadog. Required when the services field is not provided. example: backend type: string version: description: "Version to correlate with [APM Deployment Tracking](https://docs.datadoghq.com/tracing/services/deployment_tracking/)." example: v1.12.07 type: string required: - started_at type: object DORAFailureRequestData: description: The JSON:API data. properties: attributes: $ref: "#/components/schemas/DORAFailureRequestAttributes" required: - attributes type: object DORAFailureResponse: description: Response after receiving a DORA incident event. properties: data: $ref: "#/components/schemas/DORAFailureResponseData" required: - data type: object DORAFailureResponseData: description: Response after receiving a DORA incident event. properties: id: description: The ID of the received DORA incident event. example: 4242fcdd31586083 type: string type: $ref: "#/components/schemas/DORAFailureType" required: - id type: object DORAFailureType: default: dora_failure description: JSON:API type for DORA incident events. enum: - dora_failure example: dora_failure type: string x-enum-varnames: - DORA_FAILURE DORAFailuresListResponse: description: Response for the list incidents endpoint. example: data: - attributes: custom_tags: - "incident_type:database" - "department:engineering" env: "production" finished_at: "2023-08-31T14:31:14Z" name: "Database outage" services: - "shopist" severity: "SEV-1" started_at: "2023-08-31T14:29:34Z" team: "backend" id: "4242fcdd31586085" type: "dora_incident" - attributes: custom_tags: - "incident_type:service_down" - "department:platform" env: "production" finished_at: "2023-08-31T14:34:34Z" name: "API service outage" services: - "api-service" - "payment-service" severity: "SEV-2" started_at: "2023-08-31T14:32:54Z" team: "backend" id: "4242fcdd31586086" type: "dora_incident" properties: data: description: The list of DORA incident events. items: $ref: "#/components/schemas/DORAIncidentObject" type: array type: object DORAGitInfo: description: "Git info for DORA Metrics events." properties: commit_sha: $ref: "#/components/schemas/GitCommitSHA" repository_url: $ref: "#/components/schemas/GitRepositoryURL" required: - repository_url - commit_sha type: object DORAGitInfoResponse: description: "Git info returned by DORA Metrics events." properties: commit_sha: $ref: "#/components/schemas/GitCommitSHA" repository_id: $ref: "#/components/schemas/GitRepositoryID" required: - repository_id - commit_sha type: object DORAIncidentObject: description: A DORA incident event. example: attributes: custom_tags: - "incident_type:database" - "department:engineering" env: "production" finished_at: "2023-08-31T14:31:14Z" git: commit_sha: "66adc9350f2cc9b250b69abddab733dd55e1a588" repository_url: "https://github.com/organization/example-repository" name: "Database outage" services: - "shopist" severity: "SEV-1" started_at: "2023-08-31T14:29:34Z" team: "backend" id: "4242fcdd31586085" type: "dora_incident" properties: attributes: $ref: "#/components/schemas/DORAIncidentObjectAttributes" id: description: The ID of the incident event. type: string type: $ref: "#/components/schemas/DORAFailureType" type: object DORAIncidentObjectAttributes: description: The attributes of the incident event. properties: custom_tags: $ref: "#/components/schemas/DORACustomTags" env: description: Environment name that was impacted by the incident. example: production type: string finished_at: description: The time when the incident finished. example: "2023-08-31T14:26:24Z" format: date-time type: string git: $ref: "#/components/schemas/DORAGitInfo" name: description: Incident name. example: Database outage type: string services: description: Service names impacted by the incident. example: ["shopist"] items: description: A service name impacted by the incident. type: string type: array severity: description: Incident severity. example: SEV-1 type: string started_at: description: The time when the incident started. example: "2023-08-31T14:26:14Z" format: date-time type: string team: description: Name of the team owning the services impacted. example: backend type: string version: description: Version to correlate with APM Deployment Tracking. example: v1.12.07 type: string type: object DORAListDeploymentsRequest: description: Request to get a list of deployments. example: data: attributes: from: "2025-01-01T00:00:00Z" limit: 100 query: "service:(shopist OR api-service) env:production team:backend" sort: "-finished_at" to: "2025-01-31T23:59:59Z" type: "dora_deployments_list_request" properties: data: $ref: "#/components/schemas/DORAListDeploymentsRequestData" required: - data type: object DORAListDeploymentsRequestAttributes: description: Attributes to get a list of deployments. properties: from: description: Minimum timestamp for requested events. example: "2025-01-01T00:00:00Z" format: date-time type: string limit: default: 10 description: Maximum number of events in the response. example: 500 format: int32 maximum: 1000 type: integer query: description: Search query with event platform syntax. example: "service:(shopist OR api-service OR payment-service) env:(production OR staging) team:(backend OR platform)" type: string sort: description: Sort order (prefixed with `-` for descending). example: "-finished_at" type: string to: description: Maximum timestamp for requested events. example: "2025-01-31T23:59:59Z" format: date-time type: string type: object DORAListDeploymentsRequestData: description: The JSON:API data. example: attributes: from: "2025-01-15T08:00:00Z" limit: 200 query: "env:production service:payment-service version:*v2*" sort: "-finished_at" to: "2025-01-15T18:00:00Z" type: "dora_deployments_list_request" properties: attributes: $ref: "#/components/schemas/DORAListDeploymentsRequestAttributes" type: $ref: "#/components/schemas/DORAListDeploymentsRequestDataType" required: - attributes type: object DORAListDeploymentsRequestDataType: default: dora_deployments_list_request description: The definition of `DORAListDeploymentsRequestDataType` object. enum: - dora_deployments_list_request example: dora_deployments_list_request type: string x-enum-varnames: - DORA_DEPLOYMENTS_LIST_REQUEST DORAListFailuresRequest: description: Request to get a list of incidents. example: data: attributes: from: "2025-01-01T00:00:00Z" limit: 100 query: "severity:(SEV-1 OR SEV-2) env:production team:backend" sort: "-started_at" to: "2025-01-31T23:59:59Z" type: "dora_failures_list_request" properties: data: $ref: "#/components/schemas/DORAListFailuresRequestData" required: - data type: object DORAListFailuresRequestAttributes: description: Attributes to get a list of incidents. properties: from: description: Minimum timestamp for requested events. example: "2025-01-01T00:00:00Z" format: date-time type: string limit: default: 10 description: Maximum number of events in the response. example: 500 format: int32 maximum: 1000 type: integer query: description: Search query with event platform syntax. example: "severity:(SEV-1 OR SEV-2) env:(production OR staging) service:(shopist OR api-service OR payment-service) team:(backend OR platform OR payments)" type: string sort: description: Sort order (prefixed with `-` for descending). example: "-started_at" type: string to: description: Maximum timestamp for requested events. example: "2025-01-31T23:59:59Z" format: date-time type: string type: object DORAListFailuresRequestData: description: The JSON:API data. example: attributes: from: "2025-01-15T00:00:00Z" limit: 200 query: "severity:SEV-1 service:(api-service OR payment-service) env:production" sort: "-finished_at" to: "2025-01-15T23:59:59Z" type: "dora_failures_list_request" properties: attributes: $ref: "#/components/schemas/DORAListFailuresRequestAttributes" type: $ref: "#/components/schemas/DORAListFailuresRequestDataType" required: - attributes type: object DORAListFailuresRequestDataType: default: dora_failures_list_request description: The definition of `DORAListFailuresRequestDataType` object. enum: - dora_failures_list_request example: dora_failures_list_request type: string x-enum-varnames: - DORA_FAILURES_LIST_REQUEST DashboardListAddItemsRequest: description: Request containing a list of dashboards to add. properties: dashboards: description: List of dashboards to add the dashboard list. items: $ref: "#/components/schemas/DashboardListItemRequest" type: array type: object DashboardListAddItemsResponse: description: Response containing a list of added dashboards. properties: added_dashboards_to_list: description: List of dashboards added to the dashboard list. items: $ref: "#/components/schemas/DashboardListItemResponse" type: array type: object DashboardListDeleteItemsRequest: description: Request containing a list of dashboards to delete. properties: dashboards: description: List of dashboards to delete from the dashboard list. items: $ref: "#/components/schemas/DashboardListItemRequest" type: array type: object DashboardListDeleteItemsResponse: description: Response containing a list of deleted dashboards. properties: deleted_dashboards_from_list: description: List of dashboards deleted from the dashboard list. items: $ref: "#/components/schemas/DashboardListItemResponse" type: array type: object DashboardListItem: description: A dashboard within a list. properties: author: $ref: "#/components/schemas/Creator" created: description: Date of creation of the dashboard. format: date-time readOnly: true type: string icon: description: URL to the icon of the dashboard. nullable: true readOnly: true type: string id: description: ID of the dashboard. example: "q5j-nti-fv6" type: string integration_id: description: The short name of the integration. nullable: true readOnly: true type: string is_favorite: description: Whether or not the dashboard is in the favorites. readOnly: true type: boolean is_read_only: description: Whether or not the dashboard is read only. readOnly: true type: boolean is_shared: description: Whether the dashboard is publicly shared or not. readOnly: true type: boolean modified: description: Date of last edition of the dashboard. format: date-time readOnly: true type: string popularity: description: Popularity of the dashboard. format: int32 maximum: 5 readOnly: true type: integer tags: description: List of team names representing ownership of a dashboard. items: description: The name of a Datadog team, formatted as `team:` type: string maxItems: 5 nullable: true readOnly: true type: array title: description: Title of the dashboard. readOnly: true type: string type: $ref: "#/components/schemas/DashboardType" url: description: URL path to the dashboard. readOnly: true type: string required: - type - id type: object DashboardListItemRequest: description: A dashboard within a list. properties: id: description: ID of the dashboard. example: "q5j-nti-fv6" type: string type: $ref: "#/components/schemas/DashboardType" required: - type - id type: object DashboardListItemResponse: description: A dashboard within a list. properties: id: description: ID of the dashboard. example: "q5j-nti-fv6" readOnly: true type: string type: $ref: "#/components/schemas/DashboardType" required: - type - id type: object DashboardListItems: description: Dashboards within a list. properties: dashboards: description: List of dashboards in the dashboard list. example: [] items: $ref: "#/components/schemas/DashboardListItem" type: array total: description: Number of dashboards in the dashboard list. format: int64 readOnly: true type: integer required: - dashboards type: object DashboardListUpdateItemsRequest: description: Request containing the list of dashboards to update to. properties: dashboards: description: List of dashboards to update the dashboard list to. items: $ref: "#/components/schemas/DashboardListItemRequest" type: array type: object DashboardListUpdateItemsResponse: description: Response containing a list of updated dashboards. properties: dashboards: description: List of dashboards in the dashboard list. items: $ref: "#/components/schemas/DashboardListItemResponse" type: array type: object DashboardTriggerWrapper: description: "Schema for a Dashboard-based trigger." properties: dashboardTrigger: description: "Trigger a workflow from a Dashboard." type: object startStepNames: $ref: "#/components/schemas/StartStepNames" required: - dashboardTrigger type: object DashboardType: description: The type of the dashboard. enum: - custom_timeboard - custom_screenboard - integration_screenboard - integration_timeboard - host_timeboard example: host_timeboard type: string x-enum-varnames: - CUSTOM_TIMEBOARD - CUSTOM_SCREENBOARD - INTEGRATION_SCREENBOARD - INTEGRATION_TIMEBOARD - HOST_TIMEBOARD DashboardUsage: description: A single dashboard usage record. properties: attributes: $ref: "#/components/schemas/DashboardUsageAttributes" id: description: The dashboard ID. example: "q5j-nti-fv6" type: string type: $ref: "#/components/schemas/DashboardUsageType" required: - id - type - attributes type: object DashboardUsageAttributes: description: Usage statistics for a dashboard. The `viewer` field and all view-count fields (`total_views`, `viewed_at`, `total_views_by_type`) are populated only when Real User Monitoring (RUM) is active for the org. properties: author: $ref: "#/components/schemas/DashboardUsageUser" created_at: description: When the dashboard was created. example: "2026-01-15T09:30:00.000Z" format: date-time nullable: true type: string dashboard_quality_score: description: |- The dashboard quality score ranges from 0 to 1, with higher scores indicating stronger signals of quality and usefulness. The value is `null` when no score is available. The score considers the following factors: - Dashboard and widget naming, including whether the dashboard uses a default or templated name - The number of data widgets, excluding container and text widgets - Confirmed broken queries - Recent activity, based on the last view date or, when no view date is available, the last edit or creation date Dashboards linked from monitors do not receive lower scores because of their naming or lack of recent activity. An age-based adjustment helps prevent newly created dashboards from receiving disproportionately low scores. Queries lower the score only when confirmed broken. example: 0.85 format: double nullable: true type: number edited_at: description: When the dashboard was most recently edited. example: "2026-04-20T11:05:00.000Z" format: date-time nullable: true type: string org_id: description: The Datadog organization that owns the dashboard. example: 100 format: int64 type: integer teams: description: Teams the dashboard is tagged with. items: description: A team handle. type: string nullable: true type: array title: description: The dashboard title. example: My production overview type: string total_views: description: Total view count for the dashboard. Counts only views captured by Real User Monitoring (RUM); `0` in orgs without RUM. example: 42 format: int64 type: integer total_views_by_type: additionalProperties: description: View count for that view type. format: int64 type: integer description: View counts keyed by view type (`in_app`, `embed`, `public`, `shared`, `api`, `unknown`). Counts only views captured by Real User Monitoring (RUM); empty in orgs without RUM. nullable: true type: object viewed_at: description: When the dashboard was most recently viewed. Populated only when Real User Monitoring (RUM) is active for the org; `null` in orgs without RUM. example: "2026-05-01T14:22:10.000Z" format: date-time nullable: true type: string viewer: $ref: "#/components/schemas/DashboardUsageUser" widget_count: description: The total number of widgets on the dashboard. example: 12 format: int64 nullable: true type: integer widget_count_by_type: additionalProperties: description: Widget count for that widget type. format: int64 type: integer description: Widget counts keyed by widget type. The map includes group widgets and widgets without requests. nullable: true type: object required: - org_id type: object DashboardUsageResponse: description: Response containing usage statistics for a single dashboard. properties: data: $ref: "#/components/schemas/DashboardUsage" required: - data type: object DashboardUsageType: default: dashboards-usages description: The type of the resource. Always `dashboards-usages`. enum: - dashboards-usages example: dashboards-usages type: string x-enum-varnames: - DASHBOARDS_USAGES DashboardUsageUser: description: A user referenced from a dashboard usage record (author or viewer). nullable: true properties: handle: description: Datadog handle (login) of the user. example: jane.doe@example.com type: string id: description: The user ID. example: "00000000-0000-0000-0000-000000000000" type: string is_disabled: description: Whether the user account is disabled. type: boolean name: description: Display name of the user. example: Jane Doe type: string type: object DataAttributesRulesItemsIfTagExists: description: The behavior when the tag already exists. enum: - append - do_not_apply - replace type: string x-enum-varnames: - APPEND - DO_NOT_APPLY - REPLACE DataAttributesRulesItemsMapping: description: The definition of `DataAttributesRulesItemsMapping` object. nullable: true properties: destination_key: description: The `mapping` `destination_key`. example: "" type: string if_not_exists: deprecated: true description: Deprecated. Use `if_tag_exists` instead. The `mapping` `if_not_exists`. type: boolean if_tag_exists: $ref: "#/components/schemas/DataAttributesRulesItemsIfTagExists" source_keys: description: The `mapping` `source_keys`. example: - "" items: description: A source key for the mapping rule. type: string type: array required: - destination_key - source_keys type: object DataDeletionResponseItem: description: The created data deletion request information. properties: attributes: $ref: "#/components/schemas/DataDeletionResponseItemAttributes" id: description: The ID of the created data deletion request. example: "1" type: string type: description: The type of the request created. example: "deletion_request" type: string required: - id - type - attributes type: object DataDeletionResponseItemAttributes: description: Deletion attribute for data deletion response. properties: created_at: description: Creation time of the deletion request. example: "2024-01-01T00:00:00.000000Z" type: string created_by: description: User who created the deletion request. example: "test.user@datadoghq.com" type: string customer_message: description: A message for the customer regarding the deletion request, if any. example: "Your deletion request is being processed." type: string displayed_total: description: Total number of elements to be deleted as displayed to the user. example: 100 format: int64 type: integer error_category: description: The category of the error for the deletion request, if any. example: "validation_error" type: string from_time: description: Start of requested time window, milliseconds since Unix epoch. example: 1672527600000 format: int64 type: integer indexes: description: List of indexes for the search. If not provided, the search is performed in all indexes. example: ["test-index", "test-index-2"] items: description: Individual index. type: string type: array is_created: description: Whether the deletion request is fully created or not. It can take several minutes to fully create a deletion request depending on the target query and timeframe. example: true type: boolean org_id: description: Organization ID. example: 321813 format: int64 type: integer product: description: Product name. example: "logs" type: string query: description: Query for creating a data deletion request. example: "service:xyz host:abc" type: string recoverable_until: description: |- Time when the recovery period for the deletion request ends. Before this time, you can cancel the request and recover the data. After this time, permanent deletion begins, and the status changes to `deleting` within a few minutes. This field is returned only for `in_progress` requests when listing deletion requests, and is omitted if the value cannot be determined. example: "2024-01-11T02:00:00.000000Z" type: string source: description: The source of the deletion request. example: "standard" type: string starting_at: description: Starting time of the process to delete the requested data. example: "2024-01-01T02:00:00.000000Z" type: string status: description: Status of the deletion request. example: "pending" type: string to_time: description: End of requested time window, milliseconds since Unix epoch. example: 1704063600000 format: int64 type: integer total_unrestricted: description: Total number of elements to be deleted. Only the data accessible to the current user that matches the query and timeframe provided will be deleted. example: 100 format: int64 type: integer updated_at: description: Update time of the deletion request. example: "2024-01-01T00:00:00.000000Z" type: string required: - created_at - created_by - from_time - is_created - org_id - product - query - starting_at - status - to_time - total_unrestricted - displayed_total - updated_at type: object DataDeletionResponseMeta: description: The metadata of the data deletion response. properties: available_slots: description: |- Number of additional deletion requests the current organization can create before reaching the concurrency limit. Requests with a `pending`, `in_progress`, or `deleting` status count toward the limit. This field is returned only when listing deletion requests, and is omitted if the value cannot be determined. example: 3 format: int64 type: integer count_product: additionalProperties: format: int64 type: integer description: The total deletion requests created by product. example: {"logs": 8} type: object count_status: additionalProperties: format: int64 type: integer description: The total deletion requests created by status. example: {"completed": 10, "pending": 5} type: object max_concurrent_requests: description: |- Maximum number of deletion requests with a `pending`, `in_progress`, or `deleting` status that the current organization can have at the same time. This field is returned only when listing deletion requests, and is omitted if the value cannot be determined. example: 5 format: int64 type: integer next_page: description: The next page when searching deletion requests created in the current organization. example: "cGFnZTI=" type: string product: description: The product of the deletion request. example: "logs" type: string request_status: description: The status of the executed request. example: "canceled" type: string type: object DataExportConfig: description: AWS Cost and Usage Report data export configuration. properties: bucket_name: description: Name of the S3 bucket where the Cost and Usage Report is stored. example: "billing" type: string bucket_region: description: AWS region of the S3 bucket. example: "us-east-1" type: string report_name: description: Name of the Cost and Usage Report. example: "cost-and-usage-report" type: string report_prefix: description: S3 prefix where the Cost and Usage Report is stored. example: "reports" type: string report_type: description: |- Type of the Cost and Usage Report. Currently only `CUR2.0` is supported. example: "CUR2.0" type: string required: - report_name - report_prefix - report_type - bucket_name - bucket_region type: object DataObservabilityMonitorRunStatus: description: The status of a data observability monitor run. enum: - pending - ok - warn - alert - error example: pending type: string x-enum-varnames: - PENDING - OK - WARN - ALERT - ERROR DataObservabilityMonitorRunType: default: monitor_run description: The JSON:API resource type for a data observability monitor run. enum: - monitor_run example: monitor_run type: string x-enum-varnames: - MONITOR_RUN DataRelationshipsTeams: description: Associates teams with this schedule in a data structure. properties: data: description: An array of team references for this schedule. items: $ref: "#/components/schemas/DataRelationshipsTeamsDataItems" type: array type: object DataRelationshipsTeamsDataItems: description: |- Relates a team to this schedule, identified by `id` and `type` (must be `teams`). properties: id: description: The unique identifier of the team in this relationship. example: "00000000-da3a-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/DataRelationshipsTeamsDataItemsType" required: - type - id type: object DataRelationshipsTeamsDataItemsType: default: teams description: |- Teams resource type. enum: - teams example: teams type: string x-enum-varnames: - TEAMS DataScalarColumn: description: A column containing the numerical results for a formula or query. properties: meta: $ref: "#/components/schemas/ScalarMeta" name: description: The name referencing the formula or query for this column. example: a type: string type: $ref: "#/components/schemas/ScalarColumnTypeNumber" values: description: The array of numerical values for one formula or query. example: [0.5] items: description: An individual value for a given column and group-by. example: 0.5 format: double nullable: true type: number type: array type: object DataTransform: description: A data transformer, which is custom JavaScript code that executes and transforms data when its inputs change. properties: id: description: The ID of the data transformer. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string name: description: A unique identifier for this data transformer. This name is also used to access the transformer's result throughout the app. example: "combineTwoOrders" type: string properties: $ref: "#/components/schemas/DataTransformProperties" type: $ref: "#/components/schemas/DataTransformType" required: - id - name - type - properties type: object DataTransformProperties: description: The properties of the data transformer. properties: outputs: description: A JavaScript function that returns the transformed data. example: "${(() => {return {\n allItems: [...fetchOrder1.outputs.items, ...fetchOrder2.outputs.items],\n}})()}" type: string type: object DataTransformType: default: dataTransform description: The data transform type. enum: - dataTransform example: dataTransform type: string x-enum-varnames: - DATATRANSFORM DatabaseMonitoringTriggerWrapper: description: "Schema for a Database Monitoring-based trigger." properties: databaseMonitoringTrigger: description: "Trigger a workflow from Database Monitoring." type: object startStepNames: $ref: "#/components/schemas/StartStepNames" required: - databaseMonitoringTrigger type: object DatabricksCloudCostMetricsIntegrationDataflowRequest: additionalProperties: false description: >- Cost data collected from your Databricks system tables. [Cloud Cost Management](https://docs.datadoghq.com/cloud_cost_management/) must be enabled for your organization while this dataflow is on; any request that leaves it enabled without that is rejected with a `422` response. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean settings: $ref: "#/components/schemas/DatabricksCloudCostMetricsIntegrationDataflowSettingsRequest" type: object DatabricksCloudCostMetricsIntegrationDataflowResponse: description: >- Cost data collected from your Databricks system tables. Requires [Cloud Cost Management](https://docs.datadoghq.com/cloud_cost_management/) to be set up for your organization. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean settings: $ref: "#/components/schemas/DatabricksCloudCostMetricsIntegrationDataflowSettingsResponse" type: object DatabricksCloudCostMetricsIntegrationDataflowSettingsRequest: additionalProperties: false description: Settings of the Cloud Cost Management dataflow. Only the fields provided are changed. properties: ccm_collect_all_workspaces: description: >- Whether cost data is collected for every workspace in the Databricks account rather than this workspace only. This takes effect across the Databricks account: if any one workspace enables it, Datadog collects cost data for all of them regardless of their individual settings, and every covered workspace incurs Cloud Cost Management charges. Defaults to `true`. example: true type: boolean type: object DatabricksCloudCostMetricsIntegrationDataflowSettingsResponse: description: Settings of the Cloud Cost Management dataflow. properties: ccm_collect_all_workspaces: description: >- Whether cost data is collected for every workspace in the Databricks account rather than this workspace only. This takes effect across the Databricks account: if any one workspace enables it, Datadog collects cost data for all of them regardless of their individual settings, and every covered workspace incurs Cloud Cost Management charges. example: true type: boolean type: object DatabricksDataObservabilityJobsMonitoringIntegrationDataflowRequest: additionalProperties: false description: >- Data Jobs Monitoring, which collects performance, reliability, and cost data for your Databricks jobs. properties: enabled: description: Whether Datadog collects this data. Defaults to `true`; set to `false` to stop collection. example: true type: boolean settings: $ref: "#/components/schemas/DatabricksDataObservabilityJobsMonitoringIntegrationDataflowSettingsRequest" type: object DatabricksDataObservabilityJobsMonitoringIntegrationDataflowResponse: description: >- Data Jobs Monitoring, which collects performance, reliability, and cost data for your Databricks jobs. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean settings: $ref: "#/components/schemas/DatabricksDataObservabilityJobsMonitoringIntegrationDataflowSettingsResponse" type: object DatabricksDataObservabilityJobsMonitoringIntegrationDataflowSettingsRequest: additionalProperties: false description: Settings of the Data Jobs Monitoring dataflow. Only the fields provided are changed. properties: dd_api_key_id: description: >- ID of the Datadog API key the global init script uses to submit data. Setting or changing it requires `dd_api_key_secret` in the same request. example: fe383f4e-09fc-46bf-8e10-4efdd453a646 type: string dd_api_key_secret: description: Secret value of the Datadog API key identified by `dd_api_key_id`. example: your-datadog-api-key type: string writeOnly: true djm_global_init_script_enabled: description: >- Whether Datadog installs and manages the Agent on your Databricks clusters through a global init script. Installation can take up to 15 minutes and requires Databricks Workspace Admin permissions. The script does not apply to clusters in Standard access mode. Leave this `false` to install the Agent yourself. Defaults to `false`. example: true type: boolean script_gpum_enabled: description: >- Whether GPU metrics are collected from your Databricks clusters. The Agent installed by the global init script performs the collection, so this requires the dataflow to be enabled with `djm_global_init_script_enabled` set to `true`. Defaults to `false`. example: true type: boolean script_logs_enabled: description: >- Whether driver and worker logs are collected from your Databricks clusters. The Agent installed by the global init script performs the collection, so this requires the dataflow to be enabled with `djm_global_init_script_enabled` set to `true`. Defaults to `false`. example: true type: boolean serverless_jobs_enabled: description: >- Whether health and cost data is collected for jobs running on Serverless or SQL Warehouse compute. This compute has no clusters for the global init script to target, so collection reads the Databricks system tables and requires `system_tables_sql_warehouse_id`. Defaults to `true`. example: true type: boolean type: object DatabricksDataObservabilityJobsMonitoringIntegrationDataflowSettingsResponse: description: Settings of the Data Jobs Monitoring dataflow. properties: dd_api_key_id: description: ID of the Datadog API key the global init script uses to submit data. example: fe383f4e-09fc-46bf-8e10-4efdd453a646 type: string djm_global_init_script_enabled: description: >- Whether Datadog installs and manages the Agent on your Databricks clusters through a global init script. The script does not apply to clusters in Standard access mode. When `false`, the Agent is installed manually. example: true type: boolean script_gpum_enabled: description: >- Whether GPU metrics are collected from your Databricks clusters. The Agent installed by the global init script performs the collection, so this requires the dataflow to be enabled with `djm_global_init_script_enabled` set to `true`. example: true type: boolean script_logs_enabled: description: >- Whether driver and worker logs are collected from your Databricks clusters. The Agent installed by the global init script performs the collection, so this requires the dataflow to be enabled with `djm_global_init_script_enabled` set to `true`. example: true type: boolean serverless_jobs_enabled: description: >- Whether health and cost data is collected for jobs running on Serverless or SQL Warehouse compute. This compute has no clusters for the global init script to target, so collection reads the Databricks system tables and requires `system_tables_sql_warehouse_id`. example: true type: boolean type: object DatabricksDataObservabilityQualityMonitoringIntegrationDataflowRequest: additionalProperties: false description: >- Data Observability, which collects lineage and data quality information from your Databricks catalogs so you can explore how data flows and detect, resolve, and prevent quality issues. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean settings: $ref: "#/components/schemas/DatabricksDataObservabilityQualityMonitoringIntegrationDataflowSettingsRequest" type: object DatabricksDataObservabilityQualityMonitoringIntegrationDataflowResponse: description: >- Data Observability, which collects lineage and data quality information from your Databricks catalogs so you can explore how data flows and detect, resolve, and prevent quality issues. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean settings: $ref: "#/components/schemas/DatabricksDataObservabilityQualityMonitoringIntegrationDataflowSettingsResponse" type: object DatabricksDataObservabilityQualityMonitoringIntegrationDataflowSettingsRequest: additionalProperties: false description: Settings of the Data Observability dataflow. Only the fields provided are changed. properties: do_crawlers_cron: description: >- Cron expression setting how often Datadog connects to your Databricks warehouse to collect metadata. Currently, only hourly (`0 * * * *`) and daily (`0 0 * * *`) are supported. Defaults to hourly (`0 * * * *`). example: "0 * * * *" type: string sync_system_catalog: description: >- Whether metadata from the Databricks `system` catalog is included in Data Observability alongside your data catalogs. Defaults to `false`. example: true type: boolean type: object DatabricksDataObservabilityQualityMonitoringIntegrationDataflowSettingsResponse: description: Settings of the Data Observability dataflow. properties: do_crawlers_cron: description: >- Cron expression setting how often Datadog connects to your Databricks warehouse to collect metadata. Currently, only hourly (`0 * * * *`) and daily (`0 0 * * *`) are supported. example: "0 * * * *" type: string sync_system_catalog: description: >- Whether metadata from the Databricks `system` catalog is included in Data Observability alongside your data catalogs. example: true type: boolean type: object DatabricksIntegrationAccountAuthenticationRequest: description: >- Authentication for creating the Databricks integration account. Exactly one method is set. Choosing `private_action_runner` leaves the `databricks-model-serving-metrics` dataflow unable to collect data. `bearer_token` is not available on creation: Databricks accepts it only on accounts that already use it, so it can only appear on read and update. oneOf: - $ref: "#/components/schemas/DatabricksIntegrationAccountOAuthAuthRequest" - $ref: "#/components/schemas/DatabricksIntegrationAccountPrivateActionRunnerAuthRequest" DatabricksIntegrationAccountAuthenticationResponse: description: >- Authentication configured on the Databricks integration account. A `bearer_token` method indicates an account still on token authentication, which Databricks accepts only on accounts that already use it. oneOf: - $ref: "#/components/schemas/DatabricksIntegrationAccountOAuthAuthResponse" - $ref: "#/components/schemas/DatabricksIntegrationAccountPrivateActionRunnerAuthResponse" - $ref: "#/components/schemas/DatabricksIntegrationAccountBearerTokenAuthResponse" DatabricksIntegrationAccountAuthenticationUpdate: description: >- Authentication for updating the Databricks integration account. Exactly one method is set. Choosing `private_action_runner` leaves the `databricks-model-serving-metrics` dataflow unable to collect data. `bearer_token` is deprecated on Databricks: it is accepted only on accounts that already use it and never on creation, so it cannot move an account onto token authentication. Migrate those accounts to `databricks_oauth` or `private_action_runner`. oneOf: - $ref: "#/components/schemas/DatabricksIntegrationAccountOAuthAuthUpdate" - $ref: "#/components/schemas/DatabricksIntegrationAccountPrivateActionRunnerAuthUpdate" - $ref: "#/components/schemas/DatabricksIntegrationAccountBearerTokenAuthUpdate" DatabricksIntegrationAccountBearerTokenAuthResponse: description: The bearer token authentication method configured on the account. properties: auth_type: $ref: "#/components/schemas/DatabricksIntegrationAccountBearerTokenAuthType" required: - auth_type type: object DatabricksIntegrationAccountBearerTokenAuthType: default: bearer_token description: The authentication method type. enum: - bearer_token example: bearer_token type: string x-enum-varnames: - BEARER_TOKEN DatabricksIntegrationAccountBearerTokenAuthUpdate: additionalProperties: false description: >- Bearer token authentication. The credential is a single opaque secret, a Databricks personal access token, with no accompanying non-secret identifier. The method is deprecated: Databricks accepts it only on accounts that already use it, and never on creation. Only the fields provided are changed; omit `token` to keep the stored one. properties: auth_type: $ref: "#/components/schemas/DatabricksIntegrationAccountBearerTokenAuthType" token: description: Secret token used to authenticate with Databricks. example: your-token type: string writeOnly: true required: - auth_type type: object DatabricksIntegrationAccountCreateAttributes: description: Writable attributes used to create a Databricks integration account. properties: authentication: $ref: "#/components/schemas/DatabricksIntegrationAccountAuthenticationRequest" dataflows: $ref: "#/components/schemas/DatabricksIntegrationDataflowsRequest" name: description: Human-readable name of the Databricks integration account. example: My Databricks Workspace type: string settings: $ref: "#/components/schemas/DatabricksIntegrationAccountSettingsRequest" required: - name - authentication - settings type: object DatabricksIntegrationAccountCreateData: description: Data envelope for creating a Databricks integration account. properties: attributes: $ref: "#/components/schemas/DatabricksIntegrationAccountCreateAttributes" type: $ref: "#/components/schemas/IntegrationAccountType" required: - type - attributes type: object DatabricksIntegrationAccountCreateRequest: description: Request payload to create a Databricks integration account. properties: data: $ref: "#/components/schemas/DatabricksIntegrationAccountCreateData" required: - data type: object DatabricksIntegrationAccountOAuthAuthRequest: additionalProperties: false description: >- Databricks OAuth machine-to-machine authentication using a service principal. properties: auth_type: $ref: "#/components/schemas/DatabricksIntegrationAccountOAuthAuthType" azure_tenant_id: description: Microsoft Entra ID tenant of the service principal, for Azure Databricks workspaces. example: 4d3bac44-0230-4732-9e70-cc00736f0a97 type: string client_id: description: Client ID of the Databricks service principal. example: 5c10654a-b3a3-4840-b37f-f477590c70a0 type: string client_secret: description: >- Secret of the Databricks service principal. Generate it under User management > Service principals > Credentials & secrets in Databricks. example: your-client-secret type: string writeOnly: true required: - auth_type - client_id - client_secret type: object DatabricksIntegrationAccountOAuthAuthResponse: description: The Databricks OAuth authentication method and service principal configured on the account. properties: auth_type: $ref: "#/components/schemas/DatabricksIntegrationAccountOAuthAuthType" azure_tenant_id: description: Microsoft Entra ID tenant of the service principal, for Azure Databricks workspaces. example: 4d3bac44-0230-4732-9e70-cc00736f0a97 type: string client_id: description: Client ID of the Databricks service principal. example: 5c10654a-b3a3-4840-b37f-f477590c70a0 type: string required: - auth_type - client_id type: object DatabricksIntegrationAccountOAuthAuthType: default: databricks_oauth description: The authentication method type. enum: - databricks_oauth example: databricks_oauth type: string x-enum-varnames: - DATABRICKS_OAUTH DatabricksIntegrationAccountOAuthAuthUpdate: additionalProperties: false description: >- Databricks OAuth machine-to-machine authentication using a service principal. Only the fields provided are changed; omit `client_secret` to keep the stored one. properties: auth_type: $ref: "#/components/schemas/DatabricksIntegrationAccountOAuthAuthType" azure_tenant_id: description: >- Microsoft Entra ID tenant of the service principal, for Azure Databricks workspaces. Omit it to keep the stored tenant, send `null` or an empty string to remove it, or send a value to replace it. example: 4d3bac44-0230-4732-9e70-cc00736f0a97 nullable: true type: string client_id: description: Client ID of the Databricks service principal. example: 5c10654a-b3a3-4840-b37f-f477590c70a0 type: string client_secret: description: >- Secret of the Databricks service principal. Generate it under User management > Service principals > Credentials & secrets in Databricks. example: your-client-secret type: string writeOnly: true required: - auth_type type: object DatabricksIntegrationAccountPrivateActionRunnerAuthRequest: additionalProperties: false description: >- Private Action Runner authentication. The runner holds the Databricks credentials, so this method carries no secrets. properties: auth_type: $ref: "#/components/schemas/DatabricksIntegrationAccountPrivateActionRunnerAuthType" connection_id: description: Unique identifier of the Private Action Runner connection holding the credentials. example: 08356fb7-3ae3-4ea2-913e-b4cb1b7e7ec2 format: uuid type: string secret_path: description: >- Path of the credential inside the secret backend configured on the runner. example: /vault/databricks/prod type: string user_uuid: description: Unique identifier of the user the Private Action Runner connection belongs to. example: ac470ea4-aa08-11f0-994d-da9212322ca2 format: uuid type: string required: - auth_type - connection_id - user_uuid type: object DatabricksIntegrationAccountPrivateActionRunnerAuthResponse: description: The Private Action Runner authentication method configured on the account. properties: auth_type: $ref: "#/components/schemas/DatabricksIntegrationAccountPrivateActionRunnerAuthType" connection_id: description: Unique identifier of the Private Action Runner connection holding the credentials. example: 08356fb7-3ae3-4ea2-913e-b4cb1b7e7ec2 format: uuid type: string secret_path: description: Path of the credential inside the secret backend configured on the runner. example: /vault/databricks/prod type: string user_uuid: description: Unique identifier of the user the Private Action Runner connection belongs to. example: ac470ea4-aa08-11f0-994d-da9212322ca2 format: uuid type: string required: - auth_type - connection_id - user_uuid type: object DatabricksIntegrationAccountPrivateActionRunnerAuthType: default: private_action_runner description: The authentication method type. enum: - private_action_runner example: private_action_runner type: string x-enum-varnames: - PRIVATE_ACTION_RUNNER DatabricksIntegrationAccountPrivateActionRunnerAuthUpdate: additionalProperties: false description: >- Private Action Runner authentication. The runner holds the Databricks credentials, so this method carries no secrets. Only the fields provided are changed. properties: auth_type: $ref: "#/components/schemas/DatabricksIntegrationAccountPrivateActionRunnerAuthType" connection_id: description: Unique identifier of the Private Action Runner connection holding the credentials. example: 08356fb7-3ae3-4ea2-913e-b4cb1b7e7ec2 format: uuid type: string secret_path: description: >- Path of the credential inside the secret backend configured on the runner. Omit it to keep the stored path, send `null` or an empty string to remove it, or send a value to replace it. example: /vault/databricks/prod nullable: true type: string user_uuid: description: Unique identifier of the user the Private Action Runner connection belongs to. example: ac470ea4-aa08-11f0-994d-da9212322ca2 format: uuid type: string required: - auth_type type: object DatabricksIntegrationAccountResponse: description: Response payload for a single Databricks integration account. properties: data: $ref: "#/components/schemas/DatabricksIntegrationAccountResponseData" required: - data type: object DatabricksIntegrationAccountResponseAttributes: description: Attributes of a Databricks integration account returned in responses. properties: authentication: $ref: "#/components/schemas/DatabricksIntegrationAccountAuthenticationResponse" dataflows: $ref: "#/components/schemas/DatabricksIntegrationDataflowsResponse" name: description: Human-readable name of the Databricks integration account. example: My Databricks Workspace type: string settings: $ref: "#/components/schemas/DatabricksIntegrationAccountSettingsResponse" required: - name - settings type: object DatabricksIntegrationAccountResponseData: description: Data envelope of a Databricks integration account, including server-assigned identity. properties: attributes: $ref: "#/components/schemas/DatabricksIntegrationAccountResponseAttributes" id: description: Server-generated unique identifier of the Databricks integration account. example: a9a69c2e-4f8d-4e42-9c1a-2a7a2d3b7c6f readOnly: true type: string type: $ref: "#/components/schemas/IntegrationAccountType" required: - id - attributes - type type: object DatabricksIntegrationAccountSettingsRequest: additionalProperties: false description: Settings for creating the Databricks integration account. properties: system_tables_sql_warehouse_id: description: >- ID of the SQL warehouse used to query the Databricks system tables. Find it at the end of the HTTP Path under Warehouses > Connection Details in the Databricks console. Required when the cloud cost metrics or the Data Observability dataflow is enabled, or when `serverless_jobs_enabled` is on; since serverless jobs are on unless explicitly disabled, omitting this field otherwise causes the request to be rejected with a `422` response. example: aba7c023d4172910 type: string workspace_url: description: URL of the Databricks workspace. example: "https://dbc-1234abcd.cloud.databricks.com" type: string required: - workspace_url type: object DatabricksIntegrationAccountSettingsResponse: description: Settings configured on the Databricks integration account. properties: system_tables_sql_warehouse_id: description: ID of the SQL warehouse used to query the Databricks system tables. example: aba7c023d4172910 type: string workspace_url: description: URL of the Databricks workspace. example: "https://dbc-1234abcd.cloud.databricks.com" type: string required: - workspace_url type: object DatabricksIntegrationAccountSettingsUpdate: additionalProperties: false description: Settings for updating the Databricks integration account. Only the fields provided are changed. properties: system_tables_sql_warehouse_id: description: >- ID of the SQL warehouse used to query the Databricks system tables. Find it at the end of the HTTP Path under Warehouses > Connection Details in the Databricks console. Required once the cloud cost metrics or the Data Observability dataflow is enabled, or while `serverless_jobs_enabled` is on; an update that leaves the account without one is rejected with a `422` response. example: aba7c023d4172910 type: string workspace_url: description: URL of the Databricks workspace. example: "https://dbc-1234abcd.cloud.databricks.com" type: string type: object DatabricksIntegrationAccountUpdateAttributes: description: >- Writable attributes used to update a Databricks integration account. Every field is optional; only the fields provided are changed. When `dataflows` is provided, only the dataflow ids included in the request are modified; dataflows omitted from the map keep their current configuration, as do the settings of an included dataflow that provides only `enabled`. properties: authentication: $ref: "#/components/schemas/DatabricksIntegrationAccountAuthenticationUpdate" dataflows: $ref: "#/components/schemas/DatabricksIntegrationDataflowsRequest" name: description: Human-readable name of the Databricks integration account. example: My Databricks Workspace type: string settings: $ref: "#/components/schemas/DatabricksIntegrationAccountSettingsUpdate" type: object DatabricksIntegrationAccountUpdateData: description: Data envelope for updating a Databricks integration account. properties: attributes: $ref: "#/components/schemas/DatabricksIntegrationAccountUpdateAttributes" id: description: Unique identifier of the Databricks integration account to update. example: a9a69c2e-4f8d-4e42-9c1a-2a7a2d3b7c6f type: string type: $ref: "#/components/schemas/IntegrationAccountType" required: - id - type - attributes type: object DatabricksIntegrationAccountUpdateRequest: description: Request payload to update a Databricks integration account. properties: data: $ref: "#/components/schemas/DatabricksIntegrationAccountUpdateData" required: - data type: object DatabricksIntegrationAccountsResponse: description: Response payload for a list of Databricks integration accounts. properties: data: description: List of Databricks integration accounts. items: $ref: "#/components/schemas/DatabricksIntegrationAccountResponseData" type: array required: - data type: object DatabricksIntegrationDataflowsRequest: additionalProperties: false description: >- Data Datadog collects from Databricks, keyed by dataflow id. Each dataflow turns on a distinct kind of collection: set `enabled` to start or stop it, and use `settings` to configure what it collects. Defaults listed on each dataflow apply when the account is created; on update, omitted fields keep their current values. Some dataflows have prerequisites, noted on each; unless one is documented as rejecting the request, it is not verified, so a dataflow enabled without it is stored but collects no data. properties: databricks-cloud-cost-metrics: $ref: "#/components/schemas/DatabricksCloudCostMetricsIntegrationDataflowRequest" databricks-data-observability-jobs-monitoring: $ref: "#/components/schemas/DatabricksDataObservabilityJobsMonitoringIntegrationDataflowRequest" databricks-data-observability-quality-monitoring: $ref: "#/components/schemas/DatabricksDataObservabilityQualityMonitoringIntegrationDataflowRequest" databricks-model-serving-metrics: $ref: "#/components/schemas/DatabricksModelServingMetricsIntegrationDataflowRequest" type: object DatabricksIntegrationDataflowsResponse: description: Data Datadog collects from Databricks, keyed by dataflow id. properties: databricks-cloud-cost-metrics: $ref: "#/components/schemas/DatabricksCloudCostMetricsIntegrationDataflowResponse" databricks-data-observability-jobs-monitoring: $ref: "#/components/schemas/DatabricksDataObservabilityJobsMonitoringIntegrationDataflowResponse" databricks-data-observability-quality-monitoring: $ref: "#/components/schemas/DatabricksDataObservabilityQualityMonitoringIntegrationDataflowResponse" databricks-model-serving-metrics: $ref: "#/components/schemas/DatabricksModelServingMetricsIntegrationDataflowResponse" type: object DatabricksModelServingMetricsIntegrationDataflowRequest: additionalProperties: false description: >- Health and usage metrics for your Databricks model serving endpoints. Not supported on accounts that authenticate with `private_action_runner`; on those accounts this dataflow collects no data. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean type: object DatabricksModelServingMetricsIntegrationDataflowResponse: description: >- Health and usage metrics for your Databricks model serving endpoints. Not supported on accounts that authenticate with `private_action_runner`; on those accounts this dataflow collects no data. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean type: object DatadogAPIKey: description: The definition of the `DatadogAPIKey` object. properties: api_key: $ref: "#/components/schemas/DatadogAPIKeyApiKey" app_key: $ref: "#/components/schemas/DatadogAPIKeyAppKey" datacenter: $ref: "#/components/schemas/DatadogAPIKeyDatacenter" subdomain: $ref: "#/components/schemas/DatadogAPIKeySubdomain" type: $ref: "#/components/schemas/DatadogAPIKeyType" required: - type - datacenter - api_key - app_key type: object DatadogAPIKeyApiKey: description: The `DatadogAPIKey` `api_key`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" DatadogAPIKeyAppKey: description: The `DatadogAPIKey` `app_key`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" DatadogAPIKeyDatacenter: description: The `DatadogAPIKey` `datacenter`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" DatadogAPIKeySubdomain: description: Custom subdomain used for Datadog URLs generated with this Connection. For example, if this org uses `https://acme.datadoghq.com` to access Datadog, set this field to `acme`. If this field is omitted, generated URLs will use the default site URL for its datacenter (see [https://docs.datadoghq.com/getting_started/site](https://docs.datadoghq.com/getting_started/site)). oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" DatadogAPIKeyType: description: The definition of the `DatadogAPIKey` object. enum: - DatadogAPIKey example: DatadogAPIKey type: string x-enum-varnames: - DATADOGAPIKEY DatadogAPIKeyUpdate: description: The definition of the `DatadogAPIKey` object. properties: api_key: $ref: "#/components/schemas/DatadogAPIKeyUpdateApiKey" app_key: $ref: "#/components/schemas/DatadogAPIKeyUpdateAppKey" datacenter: $ref: "#/components/schemas/DatadogAPIKeyUpdateDatacenter" subdomain: $ref: "#/components/schemas/DatadogAPIKeySubdomain" type: $ref: "#/components/schemas/DatadogAPIKeyType" required: - type type: object DatadogAPIKeyUpdateApiKey: description: The `DatadogAPIKeyUpdate` `api_key`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" DatadogAPIKeyUpdateAppKey: description: The `DatadogAPIKeyUpdate` `app_key`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" DatadogAPIKeyUpdateDatacenter: description: The `DatadogAPIKeyUpdate` `datacenter`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" DatadogCredentials: description: The definition of the `DatadogCredentials` object. oneOf: - $ref: "#/components/schemas/DatadogAPIKey" DatadogCredentialsUpdate: description: The definition of the `DatadogCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/DatadogAPIKeyUpdate" DatadogIntegration: description: The definition of the `DatadogIntegration` object. properties: credentials: $ref: "#/components/schemas/DatadogCredentials" type: $ref: "#/components/schemas/DatadogIntegrationType" required: - type - credentials type: object DatadogIntegrationType: description: The definition of the `DatadogIntegrationType` object. enum: - Datadog example: Datadog type: string x-enum-varnames: - DATADOG DatadogIntegrationUpdate: description: The definition of the `DatadogIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/DatadogCredentialsUpdate" type: $ref: "#/components/schemas/DatadogIntegrationType" required: - type type: object DatasetAttributesRequest: description: Dataset metadata and configurations. properties: name: description: Name of the dataset. example: "Security Audit Dataset" type: string principals: description: |- List of access principals, formatted as `principal_type:id`. Principal can be 'team' or 'role'. example: - "role:94172442-be03-11e9-a77a-3b7612558ac1" items: description: An access principal identifier formatted as `principal_type:id`. example: "role:94172442-be03-11e9-a77a-3b7612558ac1" type: string type: array product_filters: description: List of product-specific filters. items: $ref: "#/components/schemas/FiltersPerProduct" type: array required: - name - product_filters - principals type: object DatasetAttributesResponse: description: Dataset metadata and configuration(s). properties: created_at: description: Timestamp when the dataset was created. format: date-time nullable: true type: string created_by: description: Unique ID of the user who created the dataset. format: uuid type: string name: description: Name of the dataset. example: "Security Audit Dataset" type: string principals: description: |- List of access principals, formatted as `principal_type:id`. Principal can be 'team' or 'role'. example: - "role:86245fce-0a4e-11f0-92bd-da7ad0900002" items: description: An access principal identifier formatted as `principal_type:id`. example: "role:86245fce-0a4e-11f0-92bd-da7ad0900002" type: string type: array product_filters: description: List of product-specific filters. items: $ref: "#/components/schemas/FiltersPerProduct" type: array type: object DatasetCreateRequest: description: Create request for a dataset. properties: data: $ref: "#/components/schemas/DatasetRequest" required: - data type: object DatasetReportScheduleListResponse: description: Response containing a list of report schedules for a published dataset. properties: data: description: A list of report schedules for the dataset. items: $ref: "#/components/schemas/DatasetReportScheduleResponseData" type: array included: description: Related resources included with the report schedules, such as authors. items: $ref: "#/components/schemas/ReportScheduleIncludedResource" type: array required: - data type: object DatasetReportScheduleResourceType: description: The type of resource targeted by a dataset report schedule. enum: - widget_dataset_list example: widget_dataset_list type: string x-enum-varnames: - WIDGET_DATASET_LIST DatasetReportScheduleResponseAttributes: description: The configuration and derived state of a report schedule for a published dataset. properties: cell_id: description: The identifier of the notebook cell that published the dataset, or `null` if not set. example: "sevhjcis" nullable: true type: string dataset_id: description: The identifier of the dataset, or `null` if not set. example: "MW5vdGVib29rX2NlbGw6ZDI0ZTM2MWMtZDFlNC00NDYwLWIyOWUtNTg3YTczMzA3MDFm" nullable: true type: string description: description: The description of the report. example: "This is a scheduled notebook dataset report." type: string file_row_limit: description: The maximum number of rows included in the attached CSV file, or `null` if not set. example: 5000 format: int64 nullable: true type: integer inline_row_limit: description: The maximum number of rows included inline in the email body, or `null` if not set. example: 10 format: int64 nullable: true type: integer next_recurrence: description: |- The Unix timestamp, in milliseconds, of the next scheduled delivery, or `null` if none is scheduled. example: 1725859200000 format: int64 nullable: true type: integer notebook_id: description: The identifier of the notebook containing the dataset cell, or `null` if not set. example: 1 format: int64 nullable: true type: integer recipients: description: |- The recipients of the report (email addresses, Slack channel references, or Microsoft Teams channel references). example: - "test@datadoghq.com" items: description: |- A single recipient (email address, Slack channel reference, or Microsoft Teams channel reference). type: string type: array resource_id: description: The identifier of the widget containing the dataset. example: "aaaabbbb-1111-2222-3333-444455556666" type: string resource_type: $ref: "#/components/schemas/DatasetReportScheduleResourceType" rrule: description: The recurrence rule for the schedule, expressed as an iCalendar `RRULE` string. example: "DTSTART;TZID=America/New_York:20240912T090000\nRRULE:FREQ=DAILY;BYHOUR=9;BYMINUTE=0" type: string status: $ref: "#/components/schemas/ReportScheduleStatus" timeframe: description: The relative timeframe of data included in the report. example: "calendar_day" type: string timezone: description: The IANA time zone identifier the recurrence rule is evaluated in. example: "America/New_York" type: string title: description: The title of the report. example: "My Cool Dataset Report" type: string required: - status - resource_id - resource_type - recipients - rrule - timezone - title - description - timeframe - file_row_limit - inline_row_limit - next_recurrence - notebook_id - cell_id - dataset_id type: object DatasetReportScheduleResponseData: description: The JSON:API data object representing a dataset report schedule. properties: attributes: $ref: "#/components/schemas/DatasetReportScheduleResponseAttributes" id: description: The unique identifier of the dataset report schedule. example: "e1234567-1234-1234-1234-123456789012" format: uuid type: string relationships: $ref: "#/components/schemas/ReportScheduleResponseRelationships" type: $ref: "#/components/schemas/ReportScheduleType" required: - id - type - attributes - relationships type: object DatasetRequest: description: |- **Datasets Object Constraints** - **Tag limit per dataset**: - Each restricted dataset supports a maximum of 10 key:value pairs per product. - **Tag key rules per telemetry type**: - Only one tag key or attribute may be used to define access within a single telemetry type. - The same or different tag key may be used across different telemetry types. - **Tag value uniqueness**: - Tag values must be unique within a single dataset. - A tag value used in one dataset cannot be reused in another dataset of the same telemetry type. properties: attributes: $ref: "#/components/schemas/DatasetAttributesRequest" type: $ref: "#/components/schemas/DatasetType" required: - type - attributes type: object DatasetResponse: description: |- **Datasets Object Constraints** - **Tag Limit per Dataset**: - Each restricted dataset supports a maximum of 10 key:value pairs per product. - **Tag Key Rules per Telemetry Type**: - Only one tag key or attribute may be used to define access within a single telemetry type. - The same or different tag key may be used across different telemetry types. - **Tag Value Uniqueness**: - Tag values must be unique within a single dataset. - A tag value used in one dataset cannot be reused in another dataset of the same telemetry type. properties: attributes: $ref: "#/components/schemas/DatasetAttributesResponse" id: description: Unique identifier for the dataset. example: "123e4567-e89b-12d3-a456-426614174000" type: string type: $ref: "#/components/schemas/DatasetType" type: object DatasetResponseMulti: description: Response containing a list of datasets. properties: data: description: The list of datasets returned in response. items: $ref: "#/components/schemas/DatasetResponse" type: array type: object DatasetResponseSingle: description: Response containing a single dataset object. properties: data: $ref: "#/components/schemas/DatasetResponse" type: object DatasetType: default: dataset description: Resource type, always set to `dataset`. enum: - dataset example: dataset type: string x-enum-varnames: - DATASET DatasetUpdateRequest: description: Edit request for a dataset. properties: data: $ref: "#/components/schemas/DatasetRequest" required: - data type: object Datastore: description: A datastore's complete configuration and metadata. properties: data: $ref: "#/components/schemas/DatastoreData" type: object DatastoreArray: description: A collection of datastores returned by list operations. properties: data: description: An array of datastore objects containing their configurations and metadata. items: $ref: "#/components/schemas/DatastoreData" type: array required: - data type: object DatastoreAttributesPrimaryColumnName: description: >- The name of the primary key column for this datastore. Primary column names: - Must abide by both [PostgreSQL naming conventions](https://www.postgresql.org/docs/7.0/syntax525.htm) - Cannot exceed 63 characters example: "" maxLength: 63 type: string DatastoreData: description: Core information about a datastore, including its unique identifier and attributes. properties: attributes: $ref: "#/components/schemas/DatastoreDataAttributes" id: description: The unique identifier of the datastore. type: string type: $ref: "#/components/schemas/DatastoreDataType" required: - type type: object DatastoreDataAttributes: description: Detailed information about a datastore. properties: created_at: description: Timestamp when the datastore was created. format: date-time type: string creator_user_id: description: The numeric ID of the user who created the datastore. format: int64 type: integer creator_user_uuid: description: The UUID of the user who created the datastore. type: string description: description: A human-readable description about the datastore. type: string modified_at: description: Timestamp when the datastore was last modified. format: date-time type: string name: description: The display name of the datastore. type: string org_id: description: The ID of the organization that owns this datastore. format: int64 type: integer primary_column_name: $ref: "#/components/schemas/DatastoreAttributesPrimaryColumnName" primary_key_generation_strategy: $ref: "#/components/schemas/DatastorePrimaryKeyGenerationStrategy" type: object DatastoreDataType: default: datastores description: The resource type for datastores. enum: - datastores example: datastores type: string x-enum-varnames: - DATASTORES DatastoreItemConflictMode: description: How to handle conflicts when inserting items that already exist in the datastore. enum: - fail_on_conflict - overwrite_on_conflict example: overwrite_on_conflict type: string x-enum-varnames: - FAIL_ON_CONFLICT - OVERWRITE_ON_CONFLICT DatastoreItemValues: description: An array of items to add to the datastore, where each item is a set of key-value pairs representing the item's data. Up to 100 items can be updated in a single request. example: - data: "example data" key: "value" - data: "example data2" key: "value2" items: additionalProperties: {} description: A single item's data as key-value pairs. Key names cannot exceed 63 characters. type: object maxItems: 100 type: array DatastoreItemsDataType: default: items description: The resource type for datastore items. enum: - items example: items type: string x-enum-varnames: - ITEMS DatastorePrimaryKeyGenerationStrategy: description: Can be set to `uuid` to automatically generate primary keys when new items are added. Default value is `none`, which requires you to supply a primary key for each new item. enum: - none - uuid type: string x-enum-varnames: - NONE - UUID DatastoreTrigger: description: "Trigger a workflow from a Datastore. For automatic triggering a handle must be configured and the workflow must be published." properties: rateLimit: $ref: "#/components/schemas/TriggerRateLimit" type: object DatastoreTriggerWrapper: description: "Schema for a Datastore-based trigger." properties: datastoreTrigger: $ref: "#/components/schemas/DatastoreTrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - datastoreTrigger type: object Date: description: Date as Unix timestamp in milliseconds. example: 1722439510282 format: int64 type: integer DdsqlTabularQueryColumn: description: A single column of a DDSQL tabular query result. properties: name: description: Name of the column as projected by the SQL statement. example: service type: string type: description: |- DDSQL data type of the column's values, for example `VARCHAR`, `BIGINT`, `DECIMAL`, `BOOLEAN`, `TIMESTAMP`, `JSON`, or an array variant such as `VARCHAR[]`. See the [DDSQL data-types reference](https://docs.datadoghq.com/ddsql_reference/#data-types) for the full, up-to-date list. example: VARCHAR type: string values: description: |- Column values in row order, one entry per result row. The element type follows the column's `type`. The following serialization rules should be taken into account: - `BIGINT` values are encoded as JSON numbers in the signed 64-bit integer range. - `DECIMAL` values are encoded as JSON numbers with 64-bit double precision. - `TIMESTAMP` and `DATE` values are encoded as Unix-millisecond integers; a `DATE` resolves to midnight UTC. - `JSON` values are returned as a JSON-encoded string. `null` is allowed for any column type where a value is missing. example: - web-store - checkout items: {} type: array required: - name - type - values type: object DdsqlTabularQueryColumns: description: |- Column-major result set. Each element carries one column's name, type, and values, with one value per row of the result. Set when `state` is `completed`. items: $ref: "#/components/schemas/DdsqlTabularQueryColumn" type: array DdsqlTabularQueryFetchRequest: description: Wrapper for a DDSQL tabular query fetch request. properties: data: $ref: "#/components/schemas/DdsqlTabularQueryFetchRequestData" required: - data type: object DdsqlTabularQueryFetchRequestAttributes: description: Attributes describing which previously submitted DDSQL query to fetch. properties: query_id: description: |- Opaque token returned by an earlier execute or fetch response that carried `state: running`. Identifies the query to poll for results. example: "eyJxdWVyeSI6ICJTRUxFQ1QgKiBGUk9NIGxvZ3MifQ==" type: string required: - query_id type: object DdsqlTabularQueryFetchRequestData: description: JSON:API resource object for a DDSQL tabular query fetch request. properties: attributes: $ref: "#/components/schemas/DdsqlTabularQueryFetchRequestAttributes" type: $ref: "#/components/schemas/DdsqlTabularQueryFetchRequestType" required: - type - attributes type: object DdsqlTabularQueryFetchRequestType: default: ddsql_query_fetch_request description: JSON:API resource type for a DDSQL tabular query fetch request. enum: - ddsql_query_fetch_request example: ddsql_query_fetch_request type: string x-enum-varnames: - DDSQL_QUERY_FETCH_REQUEST DdsqlTabularQueryRequest: description: Wrapper for a DDSQL tabular query execution request. properties: data: $ref: "#/components/schemas/DdsqlTabularQueryRequestData" required: - data type: object DdsqlTabularQueryRequestAttributes: description: Attributes describing the DDSQL query to execute. properties: query: description: |- The DDSQL statement to execute. DDSQL is Datadog's SQL dialect, which is a subset of PostgreSQL, scoped to Datadog data sources. example: "SELECT cloud_provider, count(*) FROM dd.hosts group by cloud_provider" type: string row_limit: description: |- Cap on the number of rows returned. Defaults to 5,000 when omitted. Must be between 1 and 10,000 inclusive; values outside this range are rejected with 400. example: 1000 format: int64 maximum: 10000 minimum: 1 type: integer time: $ref: "#/components/schemas/DdsqlTabularQueryTimeWindow" required: - query - time type: object DdsqlTabularQueryRequestData: description: JSON:API resource object for a DDSQL tabular query execution request. properties: attributes: $ref: "#/components/schemas/DdsqlTabularQueryRequestAttributes" type: $ref: "#/components/schemas/DdsqlTabularQueryRequestType" required: - type - attributes type: object DdsqlTabularQueryRequestType: default: ddsql_query_request description: JSON:API resource type for a DDSQL tabular query request. enum: - ddsql_query_request example: ddsql_query_request type: string x-enum-varnames: - DDSQL_QUERY_REQUEST DdsqlTabularQueryResponse: description: |- Response envelope for both the execute and fetch DDSQL tabular query endpoints. Carries the JSON:API primary resource and a top-level `meta` block with request-scoped observability handles. properties: data: $ref: "#/components/schemas/DdsqlTabularQueryResponseData" meta: $ref: "#/components/schemas/DdsqlTabularQueryResponseMeta" required: - data - meta type: object DdsqlTabularQueryResponseAttributes: description: |- Attributes of a DDSQL tabular query response. `query_id` is set when `state` is `running`; `columns` is set when `state` is `completed`. properties: columns: $ref: "#/components/schemas/DdsqlTabularQueryColumns" query_id: description: |- Opaque token to pass to the fetch endpoint to poll for results. Set when `state` is `running` and absent when `state` is `completed`. example: "eyJxdWVyeSI6ICJTRUxFQ1QgKiBGUk9NIGxvZ3MifQ==" type: string state: $ref: "#/components/schemas/DdsqlTabularQueryState" warnings: $ref: "#/components/schemas/DdsqlTabularQueryWarnings" required: - state type: object DdsqlTabularQueryResponseData: description: JSON:API resource object for a DDSQL tabular query response. properties: attributes: $ref: "#/components/schemas/DdsqlTabularQueryResponseAttributes" id: description: Stable identifier for the query response resource. example: "00000000-0000-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/DdsqlTabularQueryResponseType" required: - id - type - attributes type: object DdsqlTabularQueryResponseMeta: description: |- Top-level JSON:API meta block accompanying every DDSQL tabular query response. Carries standard observability handles for client-side correlation. properties: elapsed: description: Server-side time spent serving this request, in milliseconds. example: 87 format: int64 type: integer request_id: description: |- Echo of the `DD-Request-ID` header assigned by Datadog's edge to this request, for support correlation. example: "req-7f3e7d2c-1a0b-4d3e-9b2a-3c4d5e6f7082" type: string required: - elapsed - request_id type: object DdsqlTabularQueryResponseType: default: ddsql_query_response description: JSON:API resource type for a DDSQL tabular query response. enum: - ddsql_query_response example: ddsql_query_response type: string x-enum-varnames: - DDSQL_QUERY_RESPONSE DdsqlTabularQueryState: description: |- Lifecycle state of a DDSQL tabular query response. `running` means the query is still executing and the client should poll the fetch endpoint with the returned `query_id`. `completed` means the result set is inlined in `columns` and no further polling is required. enum: - running - completed example: completed type: string x-enum-varnames: - RUNNING - COMPLETED DdsqlTabularQueryTimeWindow: description: |- Time window scoping the underlying data sources, expressed in Unix milliseconds since the epoch. Inclusive on `from_timestamp`, exclusive on `to_timestamp`. Results from static tables (for example, `dd.hosts`) are not affected by the time window, but the field must still be provided. properties: from_timestamp: description: Start of the query window (inclusive), in Unix milliseconds since the epoch. example: 1736942400000 format: int64 type: integer to_timestamp: description: End of the query window (exclusive), in Unix milliseconds since the epoch. example: 1736946000000 format: int64 type: integer required: - from_timestamp - to_timestamp type: object DdsqlTabularQueryWarnings: description: Non-fatal messages emitted by the query engine while serving this response. items: description: A single non-fatal warning message. example: "Query result was truncated at the configured row_limit." type: string type: array DefaultInboxRuleAttributesResponse: description: Attributes of a default inbox rule returned by the API. properties: action: $ref: "#/components/schemas/InboxRuleAction" created_at: description: The Unix timestamp in milliseconds when the rule definition was created. The definition is authored by Datadog. example: 1722439510282 format: int64 type: integer created_by: $ref: "#/components/schemas/AutomationRuleCreatedBy" enabled: description: Whether the default inbox rule is enabled for the organization. example: true type: boolean modified_at: description: The Unix timestamp in milliseconds when the rule was last modified. example: 1722439510282 format: int64 type: integer modified_by: $ref: "#/components/schemas/AutomationRuleModifiedBy" name: description: The name of the default inbox rule. example: "Secrets" maxLength: 255 minLength: 1 type: string rule: $ref: "#/components/schemas/AutomationRuleScope" required: - name - enabled - rule - action - created_at - created_by - modified_at - modified_by type: object DefaultInboxRuleDataResponse: description: The data object for a default inbox rule returned by the API. properties: attributes: $ref: "#/components/schemas/DefaultInboxRuleAttributesResponse" id: description: |- The ID of the default inbox rule. Known default rule IDs include: `identity_risk_default_rule`, `secret_default_rule`, `library_vulnerability_default_rule`, `attack_path_default_rule`, `host_and_container_vulnerability_default_rule`, `runtime_code_vulnerability_default_rule`, `iac_misconfiguration_default_rule`, and `misconfiguration_default_rule`. Datadog can add new default rules over time. example: "secret_default_rule" type: string type: $ref: "#/components/schemas/DefaultInboxRuleType" required: - id - type - attributes type: object DefaultInboxRuleResponse: description: A single default inbox rule response. properties: data: $ref: "#/components/schemas/DefaultInboxRuleDataResponse" required: - data type: object DefaultInboxRuleType: description: The JSON:API type for default inbox rules. enum: - default_inbox_rules example: default_inbox_rules type: string x-enum-varnames: - DEFAULT_INBOX_RULES DefaultInboxRulesDataList: description: A list of default inbox rule data objects. items: $ref: "#/components/schemas/DefaultInboxRuleDataResponse" type: array DefaultInboxRulesResponse: description: A list of default inbox rules. properties: data: $ref: "#/components/schemas/DefaultInboxRulesDataList" required: - data type: object DefaultRulesetsPerLanguageData: description: The primary data object in the default rulesets per language response. properties: attributes: $ref: "#/components/schemas/DefaultRulesetsPerLanguageDataAttributes" id: description: The language identifier used as the resource identifier. example: python type: string type: $ref: "#/components/schemas/DefaultRulesetsPerLanguageDataType" required: - id - type - attributes type: object DefaultRulesetsPerLanguageDataAttributes: description: The attributes of the default rulesets per language response, containing the list of default ruleset names. properties: rulesets: description: The list of default ruleset names for the specified programming language. example: - python-best-practices items: type: string type: array required: - rulesets type: object DefaultRulesetsPerLanguageDataType: default: defaultRulesetsPerLanguage description: Default rulesets per language resource type. enum: - defaultRulesetsPerLanguage example: defaultRulesetsPerLanguage type: string x-enum-varnames: - DEFAULT_RULESETS_PER_LANGUAGE DefaultRulesetsPerLanguageResponse: description: The response payload containing the default ruleset names for a programming language. properties: data: $ref: "#/components/schemas/DefaultRulesetsPerLanguageData" required: - data type: object Degradation: description: Response object for a single degradation. properties: data: $ref: "#/components/schemas/DegradationData" included: description: The included related resources of a degradation. Client must explicitly request these resources by name in the `include` query parameter. items: $ref: "#/components/schemas/DegradationIncluded" type: array type: object DegradationArray: description: Response object for a list of degradations. properties: data: description: A list of degradation data objects. items: $ref: "#/components/schemas/DegradationData" type: array included: description: The included related resources of a degradation. Client must explicitly request these resources by name in the `include` query parameter. items: $ref: "#/components/schemas/DegradationIncluded" type: array meta: $ref: "#/components/schemas/PaginationMeta" required: - data type: object DegradationData: description: The data object for a degradation. properties: attributes: $ref: "#/components/schemas/DegradationDataAttributes" id: description: The ID of the degradation. format: uuid type: string relationships: $ref: "#/components/schemas/DegradationDataRelationships" type: $ref: "#/components/schemas/PatchDegradationRequestDataType" required: - type type: object DegradationDataAttributes: description: The attributes of a degradation. properties: components_affected: description: Components affected by the degradation. items: $ref: "#/components/schemas/DegradationDataAttributesComponentsAffectedItems" type: array created_at: description: Timestamp of when the degradation was created. format: date-time type: string description: description: Description of the degradation. type: string is_backfilled: description: Whether the degradation was backfilled. type: boolean modified_at: description: Timestamp of when the degradation was last modified. format: date-time type: string source: $ref: "#/components/schemas/DegradationDataAttributesSource" status: $ref: "#/components/schemas/CreateDegradationRequestDataAttributesStatus" title: description: Title of the degradation. type: string updates: description: Past updates made to the degradation. items: $ref: "#/components/schemas/DegradationDataAttributesUpdatesItems" type: array type: object DegradationDataAttributesComponentsAffectedItems: description: A component affected by a degradation. properties: id: description: The ID of the component. example: "1234abcd-12ab-34cd-56ef-123456abcdef" format: uuid type: string name: description: The name of the component. readOnly: true type: string status: $ref: "#/components/schemas/StatusPagesComponentDataAttributesStatus" required: - id - status type: object DegradationDataAttributesSource: description: The source of the degradation. properties: created_at: description: Timestamp of when the source was created. example: "" format: date-time type: string source_id: description: The ID of the source. example: "" type: string type: $ref: "#/components/schemas/DegradationDataAttributesSourceType" required: - created_at - source_id - type type: object DegradationDataAttributesSourceType: description: The type of the source. enum: - incident example: incident type: string x-enum-varnames: - INCIDENT DegradationDataAttributesUpdatesItems: description: A status update recorded during a degradation. properties: components_affected: description: The components affected at the time of the update. items: $ref: "#/components/schemas/DegradationDataAttributesUpdatesItemsComponentsAffectedItems" type: array created_at: description: Timestamp of when the update was created. format: date-time readOnly: true type: string deleted_at: description: The date and time the resource was deleted. type: string deleted_by_user_uuid: description: UUID of the user who deleted the resource. type: string description: description: Description of the update. type: string id: description: Identifier of the update. format: uuid readOnly: true type: string last_modified_by_user_uuid: description: UUID of the user who last modified the resource. type: string modified_at: description: Timestamp of when the update was last modified. format: date-time readOnly: true type: string started_at: description: Timestamp of when the update started. format: date-time type: string status: $ref: "#/components/schemas/CreateDegradationRequestDataAttributesStatus" type: object DegradationDataAttributesUpdatesItemsComponentsAffectedItems: description: A component affected at the time of a degradation update. properties: id: description: Identifier of the component affected at the time of the update. example: "1234abcd-12ab-34cd-56ef-123456abcdef" format: uuid type: string name: description: The name of the component affected at the time of the update. readOnly: true type: string status: $ref: "#/components/schemas/StatusPagesComponentDataAttributesStatus" description: The status of the component affected at the time of the update. required: - id - status type: object DegradationDataRelationships: description: The relationships of a degradation. properties: created_by_user: $ref: "#/components/schemas/DegradationDataRelationshipsCreatedByUser" description: The Datadog user who created the degradation. last_modified_by_user: $ref: "#/components/schemas/DegradationDataRelationshipsLastModifiedByUser" description: The Datadog user who last modified the degradation. status_page: $ref: "#/components/schemas/DegradationDataRelationshipsStatusPage" description: The status page the degradation belongs to. template: $ref: "#/components/schemas/DegradationDataRelationshipsTemplate" description: The template the degradation was created from. type: object DegradationDataRelationshipsCreatedByUser: description: The Datadog user who created the degradation. properties: data: $ref: "#/components/schemas/DegradationDataRelationshipsCreatedByUserData" required: - data type: object DegradationDataRelationshipsCreatedByUserData: description: The data object identifying the Datadog user who created the degradation. properties: id: description: The ID of the Datadog user who created the degradation. example: "" type: string type: $ref: "#/components/schemas/StatusPagesUserType" required: - type - id type: object DegradationDataRelationshipsLastModifiedByUser: description: The Datadog user who last modified the degradation. properties: data: $ref: "#/components/schemas/DegradationDataRelationshipsLastModifiedByUserData" required: - data type: object DegradationDataRelationshipsLastModifiedByUserData: description: The data object identifying the Datadog user who last modified the degradation. properties: id: description: The ID of the Datadog user who last modified the degradation. example: "" type: string type: $ref: "#/components/schemas/StatusPagesUserType" required: - type - id type: object DegradationDataRelationshipsStatusPage: description: The status page the degradation belongs to. properties: data: $ref: "#/components/schemas/DegradationDataRelationshipsStatusPageData" required: - data type: object DegradationDataRelationshipsStatusPageData: description: The data object identifying the status page the degradation belongs to. properties: id: description: The ID of the status page. example: "1234abcd-12ab-34cd-56ef-123456abcdef" format: uuid type: string type: $ref: "#/components/schemas/StatusPageDataType" required: - type - id type: object DegradationDataRelationshipsTemplate: description: The template the degradation was created from. properties: data: $ref: "#/components/schemas/DegradationDataRelationshipsTemplateData" required: - data type: object DegradationDataRelationshipsTemplateData: description: The data object identifying the template the degradation was created from. properties: id: description: The ID of the degradation template. example: "" type: string type: $ref: "#/components/schemas/PatchDegradationTemplateRequestDataType" required: - type - id type: object DegradationIncluded: description: An included resource related to a degradation or maintenance. oneOf: - $ref: "#/components/schemas/StatusPagesUser" - $ref: "#/components/schemas/StatusPageAsIncluded" DegradationRequestMeta: description: The supported metadata for a degradation request. properties: idempotency_key: description: A unique key used to ensure idempotent requests. example: 1e6a4b8e-4c2f-4a3d-8f1a-9c7d2e5b6f10 format: uuid type: string type: object DegradationTemplate: description: Response object for a single degradation template. properties: data: $ref: "#/components/schemas/DegradationTemplateData" included: description: The included related resources of a degradation template. Client must explicitly request these resources by name in the `include` query parameter. items: $ref: "#/components/schemas/DegradationIncluded" type: array type: object DegradationTemplateArray: description: Response object for a list of degradation templates. properties: data: description: A list of degradation template data objects. items: $ref: "#/components/schemas/DegradationTemplateData" type: array included: description: The included related resources of a degradation template. Client must explicitly request these resources by name in the `include` query parameter. items: $ref: "#/components/schemas/DegradationIncluded" type: array required: - data type: object DegradationTemplateData: description: The data object for a degradation template. properties: attributes: $ref: "#/components/schemas/DegradationTemplateDataAttributes" id: description: The ID of the degradation template. type: string relationships: $ref: "#/components/schemas/DegradationTemplateDataRelationships" type: $ref: "#/components/schemas/PatchDegradationTemplateRequestDataType" required: - type type: object DegradationTemplateDataAttributes: description: The attributes of a degradation template. properties: components_affected: description: The components affected by a degradation created from this template. items: $ref: "#/components/schemas/DegradationTemplateDataAttributesComponentsAffectedItems" type: array created_at: description: Timestamp of when the degradation template was created. format: date-time type: string degradation_title: description: The title used for a degradation created from this template. type: string modified_at: description: Timestamp of when the degradation template was last modified. format: date-time type: string name: description: The name of the degradation template. type: string updates: description: The pre-filled updates for a degradation created from this template. items: $ref: "#/components/schemas/DegradationTemplateDataAttributesUpdatesItems" type: array type: object DegradationTemplateDataAttributesComponentsAffectedItems: description: A component affected by a degradation created from this template. properties: id: description: The ID of the component. example: "" type: string name: description: The name of the component. readOnly: true type: string status: $ref: "#/components/schemas/PatchDegradationTemplateRequestDataAttributesComponentsAffectedItemsStatus" required: - id - status type: object DegradationTemplateDataAttributesUpdatesItems: description: A pre-filled update for a degradation created from this template. properties: message: description: The message of the update. type: string status: $ref: "#/components/schemas/CreateDegradationRequestDataAttributesStatus" required: - status type: object DegradationTemplateDataRelationships: description: The relationships of a degradation template. properties: created_by_user: $ref: "#/components/schemas/DegradationTemplateDataRelationshipsCreatedByUser" description: The Datadog user who created the degradation template. last_modified_by_user: $ref: "#/components/schemas/DegradationTemplateDataRelationshipsLastModifiedByUser" description: The Datadog user who last modified the degradation template. status_page: $ref: "#/components/schemas/DegradationTemplateDataRelationshipsStatusPage" description: The status page the degradation template belongs to. type: object DegradationTemplateDataRelationshipsCreatedByUser: description: The Datadog user who created the degradation template. properties: data: $ref: "#/components/schemas/DegradationTemplateDataRelationshipsCreatedByUserData" required: - data type: object DegradationTemplateDataRelationshipsCreatedByUserData: description: The data object identifying the Datadog user who created the degradation template. properties: id: description: The ID of the Datadog user who created the degradation template. example: "" type: string type: $ref: "#/components/schemas/StatusPagesUserType" required: - type - id type: object DegradationTemplateDataRelationshipsLastModifiedByUser: description: The Datadog user who last modified the degradation template. properties: data: $ref: "#/components/schemas/DegradationTemplateDataRelationshipsLastModifiedByUserData" required: - data type: object DegradationTemplateDataRelationshipsLastModifiedByUserData: description: The data object identifying the Datadog user who last modified the degradation template. properties: id: description: The ID of the Datadog user who last modified the degradation template. example: "" type: string type: $ref: "#/components/schemas/StatusPagesUserType" required: - type - id type: object DegradationTemplateDataRelationshipsStatusPage: description: The status page the degradation template belongs to. properties: data: $ref: "#/components/schemas/DegradationTemplateDataRelationshipsStatusPageData" required: - data type: object DegradationTemplateDataRelationshipsStatusPageData: description: The data object identifying the status page associated with a degradation template. properties: id: description: The ID of the status page. example: "" type: string type: $ref: "#/components/schemas/StatusPageDataType" required: - type - id type: object DegradationUpdate: description: Response object for a degradation update. properties: data: $ref: "#/components/schemas/DegradationUpdateData" included: description: Resources related to the degradation update. items: $ref: "#/components/schemas/DegradationUpdateIncluded" type: array type: object DegradationUpdateData: description: The data object for a degradation update. properties: attributes: $ref: "#/components/schemas/DegradationUpdateDataAttributes" id: description: The ID of the degradation update. type: string relationships: $ref: "#/components/schemas/DegradationUpdateDataRelationships" type: $ref: "#/components/schemas/PatchDegradationUpdateRequestDataType" required: - type type: object DegradationUpdateDataAttributes: description: Attributes of a degradation update resource. properties: components_affected: description: Components affected by this update. items: $ref: "#/components/schemas/DegradationUpdateDataAttributesComponentsAffectedItems" type: array created_at: description: The date and time the update was created. format: date-time type: string deleted_at: description: The date and time the update was soft-deleted. format: date-time type: string description: description: The message body of the update. type: string modified_at: description: The date and time the update was last modified. format: date-time type: string started_at: description: The date and time the update started. format: date-time type: string status: $ref: "#/components/schemas/CreateDegradationRequestDataAttributesStatus" type: object DegradationUpdateDataAttributesComponentsAffectedItems: description: A component affected by a degradation update. properties: id: description: The ID of the affected component. example: "" type: string name: description: The name of the affected component. readOnly: true type: string status: $ref: "#/components/schemas/StatusPagesComponentDataAttributesStatus" required: - id - status type: object DegradationUpdateDataRelationships: description: Relationships of a degradation update resource. properties: created_by_user: $ref: "#/components/schemas/DegradationUpdateDataRelationshipsUser" degradation: $ref: "#/components/schemas/DegradationUpdateDataRelationshipsDegradation" deleted_by_user: $ref: "#/components/schemas/DegradationUpdateDataRelationshipsUser" last_modified_by_user: $ref: "#/components/schemas/DegradationUpdateDataRelationshipsUser" status_page: $ref: "#/components/schemas/DegradationUpdateDataRelationshipsStatusPage" type: object DegradationUpdateDataRelationshipsDegradation: description: The degradation relationship of a degradation update. properties: data: $ref: "#/components/schemas/DegradationUpdateDataRelationshipsDegradationData" required: - data type: object DegradationUpdateDataRelationshipsDegradationData: description: The degradation linked to a degradation update. properties: id: description: The ID of the degradation. example: "" type: string type: $ref: "#/components/schemas/PatchDegradationRequestDataType" required: - type - id type: object DegradationUpdateDataRelationshipsStatusPage: description: The status page relationship of a degradation update. properties: data: $ref: "#/components/schemas/DegradationUpdateDataRelationshipsStatusPageData" required: - data type: object DegradationUpdateDataRelationshipsStatusPageData: description: The status page linked to a degradation update. properties: id: description: The ID of the status page. example: "" type: string type: $ref: "#/components/schemas/StatusPageDataType" required: - type - id type: object DegradationUpdateDataRelationshipsUser: description: A user relationship of a degradation update. properties: data: $ref: "#/components/schemas/DegradationUpdateDataRelationshipsUserData" required: - data type: object DegradationUpdateDataRelationshipsUserData: description: A Datadog user linked to a degradation update. properties: id: description: The ID of the user. example: "" type: string type: $ref: "#/components/schemas/StatusPagesUserType" required: - type - id type: object DegradationUpdateIncluded: description: Resources included in a degradation update response. oneOf: - $ref: "#/components/schemas/StatusPagesUser" - $ref: "#/components/schemas/Degradation" - $ref: "#/components/schemas/StatusPageAsIncluded" DeleteAppResponse: description: The response object after an app is successfully deleted. properties: data: $ref: "#/components/schemas/DeleteAppResponseData" type: object DeleteAppResponseData: description: The definition of `DeleteAppResponseData` object. properties: id: description: The ID of the deleted app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string type: $ref: "#/components/schemas/AppDefinitionType" required: - id - type type: object DeleteAppsDatastoreItemRequest: description: Request to delete a specific item from a datastore by its primary key. properties: data: $ref: "#/components/schemas/DeleteAppsDatastoreItemRequestData" type: object DeleteAppsDatastoreItemRequestData: description: Data wrapper containing the information needed to identify and delete a specific datastore item. properties: attributes: $ref: "#/components/schemas/DeleteAppsDatastoreItemRequestDataAttributes" type: $ref: "#/components/schemas/DatastoreItemsDataType" required: - type type: object DeleteAppsDatastoreItemRequestDataAttributes: description: Attributes specifying which datastore item to delete by its primary key. properties: id: description: Optional unique identifier of the item to delete. example: "a7656bcc-51d4-4884-adf7-4d0d9a3e0633" type: string item_key: description: The primary key value that identifies the item to delete. Cannot exceed 256 characters. example: "primaryKey" maxLength: 256 type: string required: - item_key type: object DeleteAppsDatastoreItemResponse: description: Response from successfully deleting a datastore item. properties: data: $ref: "#/components/schemas/DeleteAppsDatastoreItemResponseData" type: object DeleteAppsDatastoreItemResponseArray: description: The definition of `DeleteAppsDatastoreItemResponseArray` object. properties: data: description: The `DeleteAppsDatastoreItemResponseArray` `data`. items: $ref: "#/components/schemas/DeleteAppsDatastoreItemResponseData" type: array required: - data type: object DeleteAppsDatastoreItemResponseData: description: Data containing the identifier of the datastore item that was successfully deleted. properties: id: description: The unique identifier of the item that was deleted. type: string type: $ref: "#/components/schemas/DatastoreItemsDataType" required: - type type: object DeleteAppsRequest: description: A request object for deleting multiple apps by ID. example: data: - id: aea2ed17-b45f-40d0-ba59-c86b7972c901 type: appDefinitions - id: f69bb8be-6168-4fe7-a30d-370256b6504a type: appDefinitions - id: ab1ed73e-13ad-4426-b0df-a0ff8876a088 type: appDefinitions properties: data: description: An array of objects containing the IDs of the apps to delete. items: $ref: "#/components/schemas/DeleteAppsRequestDataItems" type: array type: object DeleteAppsRequestDataItems: description: An object containing the ID of an app to delete. properties: id: description: The ID of the app to delete. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string type: $ref: "#/components/schemas/AppDefinitionType" required: - id - type type: object DeleteAppsResponse: description: The response object after multiple apps are successfully deleted. properties: data: description: An array of objects containing the IDs of the deleted apps. items: $ref: "#/components/schemas/DeleteAppsResponseDataItems" type: array type: object DeleteAppsResponseDataItems: description: An object containing the ID of a deleted app. properties: id: description: The ID of the deleted app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string type: $ref: "#/components/schemas/AppDefinitionType" required: - id - type type: object DeleteCustomFrameworkResponse: description: Response object to delete a custom framework. properties: data: $ref: "#/components/schemas/CustomFrameworkMetadata" required: - data type: object DeleteFormData: description: The data returned when a form is deleted. properties: id: description: The ID of the deleted form. example: 844dfd88-aa84-4db4-8979-e7bdbb9c1dc3 format: uuid type: string type: $ref: "#/components/schemas/FormType" required: - id - type type: object DeleteFormResponse: description: A response returned after deleting a form. properties: data: $ref: "#/components/schemas/DeleteFormData" type: object DeletedSuiteResponseData: description: Data object for a deleted Synthetic test suite. properties: attributes: $ref: "#/components/schemas/DeletedSuiteResponseDataAttributes" id: description: The public ID of the deleted Synthetic test suite. type: string type: $ref: "#/components/schemas/SyntheticsSuiteTypes" type: object DeletedSuiteResponseDataAttributes: description: Attributes of a deleted Synthetic test suite, including deletion timestamp and public ID. properties: deleted_at: description: Deletion timestamp of the Synthetic suite ID. type: string public_id: description: The Synthetic suite ID deleted. type: string type: object DeletedSuitesRequestDelete: description: Data object for a bulk delete Synthetic test suites request. properties: attributes: $ref: "#/components/schemas/DeletedSuitesRequestDeleteAttributes" id: description: An optional identifier for the delete request. type: string type: $ref: "#/components/schemas/DeletedSuitesRequestType" required: - attributes type: object DeletedSuitesRequestDeleteAttributes: description: Attributes for a bulk delete Synthetic test suites request. properties: force_delete_dependencies: description: Whether to force deletion of suites that have dependent resources. type: boolean public_ids: description: List of public IDs of the Synthetic test suites to delete. example: - "" items: description: The public ID of a Synthetic test suite to delete. type: string type: array required: - public_ids type: object DeletedSuitesRequestDeleteRequest: description: Request body for bulk deleting Synthetic test suites. properties: data: $ref: "#/components/schemas/DeletedSuitesRequestDelete" required: - data type: object DeletedSuitesRequestType: default: delete_suites_request description: Type for the bulk delete Synthetic suites request, `delete_suites_request`. enum: - delete_suites_request example: delete_suites_request type: string x-enum-varnames: - DELETE_SUITES_REQUEST DeletedSuitesResponse: description: Response containing the list of deleted Synthetic test suites. properties: data: description: List of deleted Synthetic suite data objects. items: $ref: "#/components/schemas/DeletedSuiteResponseData" type: array type: object DeletedTestResponseData: description: Data object for a deleted Synthetic test. properties: attributes: $ref: "#/components/schemas/DeletedTestResponseDataAttributes" id: description: The public ID of the deleted Synthetic test. type: string type: $ref: "#/components/schemas/DeletedTestsResponseType" type: object DeletedTestResponseDataAttributes: description: Attributes of a deleted Synthetic test, including deletion timestamp and public ID. properties: deleted_at: description: Deletion timestamp of the Synthetic test ID. type: string public_id: description: The Synthetic test ID deleted. type: string type: object DeletedTestsRequestDelete: description: Data object for a bulk delete Synthetic tests request. properties: attributes: $ref: "#/components/schemas/DeletedTestsRequestDeleteAttributes" id: description: An optional identifier for the delete request. type: string type: $ref: "#/components/schemas/DeletedTestsRequestType" required: - attributes type: object DeletedTestsRequestDeleteAttributes: description: Attributes for a bulk delete Synthetic tests request. properties: force_delete_dependencies: description: Whether to force deletion of tests that have dependent resources. type: boolean public_ids: description: List of public IDs of the Synthetic tests to delete. example: - abc-def-123 items: description: The public ID of a Synthetic test to delete. type: string type: array required: - public_ids type: object DeletedTestsRequestDeleteRequest: description: Request body for bulk deleting Synthetic tests. properties: data: $ref: "#/components/schemas/DeletedTestsRequestDelete" required: - data type: object DeletedTestsRequestType: default: delete_tests_request description: Type for the bulk delete Synthetic tests request, `delete_tests_request`. enum: - delete_tests_request example: delete_tests_request type: string x-enum-varnames: - DELETE_TESTS_REQUEST DeletedTestsResponse: description: Response containing the list of deleted Synthetic tests. properties: data: description: List of deleted Synthetic test data objects. items: $ref: "#/components/schemas/DeletedTestResponseData" type: array type: object DeletedTestsResponseType: default: delete_tests description: Type for the bulk delete Synthetic tests response, `delete_tests`. enum: - delete_tests example: delete_tests type: string x-enum-varnames: - DELETE_TESTS DemBatchGetJourneysAttributes: description: Attributes for a batch get journeys request. properties: test_suite_ids: $ref: "#/components/schemas/DemTestSuiteIDs" required: - test_suite_ids type: object DemBatchGetJourneysData: description: Data object for a batch get journeys request. properties: attributes: $ref: "#/components/schemas/DemBatchGetJourneysAttributes" type: $ref: "#/components/schemas/DemBatchGetJourneysRequestType" required: - type - attributes type: object DemBatchGetJourneysRequest: description: Request body for retrieving DEM journeys by test suite IDs. properties: data: $ref: "#/components/schemas/DemBatchGetJourneysData" example: attributes: test_suite_ids: - "suite-abc123" - "suite-def456" type: "batch_get_journeys_by_test_suite_ids_request" required: - data type: object DemBatchGetJourneysRequestType: description: The resource type for a request to retrieve DEM journeys by test suite IDs. enum: - batch_get_journeys_by_test_suite_ids_request example: batch_get_journeys_by_test_suite_ids_request type: string x-enum-varnames: - BATCH_GET_JOURNEYS_BY_TEST_SUITE_IDS_REQUEST DemCreateJourneyTestSuiteAttributes: description: Attributes for creating a test suite for a DEM journey. properties: include_tests_from_journey_coverage: description: Whether to populate the test suite based on journey coverage data. example: true nullable: true type: boolean test_suite_name: description: An optional custom name for the auto-created test suite. example: "My Custom Suite" nullable: true type: string type: object DemCreateJourneyTestSuiteData: description: Data object for a create test suite request. properties: attributes: $ref: "#/components/schemas/DemCreateJourneyTestSuiteAttributes" type: $ref: "#/components/schemas/DemCreateJourneyTestSuiteRequestType" required: - type type: object DemCreateJourneyTestSuiteRequest: description: Request body for creating a test suite for a DEM journey. properties: data: $ref: "#/components/schemas/DemCreateJourneyTestSuiteData" example: attributes: test_suite_name: "My Custom Suite" type: "create_test_suite_for_journey_request" required: - data type: object DemCreateJourneyTestSuiteRequestType: description: The resource type for a request to create a DEM journey test suite. enum: - create_test_suite_for_journey_request example: create_test_suite_for_journey_request type: string x-enum-varnames: - CREATE_TEST_SUITE_FOR_JOURNEY_REQUEST DemInferredJourneyCandidateAttributes: additionalProperties: false description: Attributes of an inferred journey candidate. properties: created_at: description: Timestamp when the inferred journey was first observed. example: "2024-01-15T10:30:00Z" format: date-time readOnly: true type: string description: description: An optional description of the inferred journey. example: nullable: true type: string journey_rum: $ref: "#/components/schemas/DemJourneyRum" name: description: The name of the inferred journey. example: "Checkout Flow" type: string org_id: description: The organization ID that owns this inferred journey. example: 12345 format: int64 readOnly: true type: integer rank: description: Ranking score of the inferred journey candidate. example: 1 format: int64 nullable: true readOnly: true type: integer tags: $ref: "#/components/schemas/DemTags" test_suite: $ref: "#/components/schemas/DemTestSuiteNested" nullable: true readOnly: true variants: $ref: "#/components/schemas/DemVariants" required: - name - tags - org_id - journey_rum - variants - created_at type: object DemInferredJourneyCandidateData: description: Data object for an inferred journey candidate. properties: attributes: $ref: "#/components/schemas/DemInferredJourneyCandidateAttributes" id: description: The unique identifier of the inferred journey. example: "inferred-journey-abc123" type: string type: $ref: "#/components/schemas/DemJourneyType" required: - id - type - attributes type: object DemInferredJourneyIgnoredAttributes: additionalProperties: false description: Attributes of an ignored inferred journey. properties: created_at: description: Timestamp when the inferred journey was first observed. example: "2024-01-15T10:30:00Z" format: date-time readOnly: true type: string description: description: An optional description of the inferred journey. example: nullable: true type: string ignored_at: description: Timestamp when the inferred journey was ignored. example: "2024-01-15T10:30:00Z" format: date-time readOnly: true type: string journey_rum: $ref: "#/components/schemas/DemJourneyRum" name: description: The name of the inferred journey. example: "Checkout Flow" type: string org_id: description: The organization ID that owns this inferred journey. example: 12345 format: int64 readOnly: true type: integer tags: $ref: "#/components/schemas/DemTags" test_suite: $ref: "#/components/schemas/DemTestSuiteNested" nullable: true readOnly: true variants: $ref: "#/components/schemas/DemVariants" required: - name - tags - org_id - journey_rum - variants - ignored_at - created_at type: object DemInferredJourneyIgnoredData: description: Data object for an ignored inferred journey. properties: attributes: $ref: "#/components/schemas/DemInferredJourneyIgnoredAttributes" id: description: The unique identifier of the ignored inferred journey. example: "inferred-journey-abc123" type: string type: $ref: "#/components/schemas/DemJourneyType" required: - id - type - attributes type: object DemInferredJourneyItem: description: A single inferred journey item, either a candidate or an ignored journey. oneOf: - $ref: "#/components/schemas/DemInferredJourneyCandidateData" - $ref: "#/components/schemas/DemInferredJourneyIgnoredData" DemInferredJourneyStatus: default: candidate description: The status of an inferred DEM journey. enum: - candidate - ignored example: candidate type: string x-enum-varnames: - CANDIDATE - IGNORED DemJourneyCreateAttributes: description: Attributes for creating or updating a DEM journey. properties: description: description: An optional human-readable description of the journey. example: "Tracks the user checkout flow from cart to confirmation." type: string journey_rum: $ref: "#/components/schemas/DemJourneyRum" name: description: The name of the DEM journey. example: "Checkout Flow" type: string tags: $ref: "#/components/schemas/DemTags" variants: $ref: "#/components/schemas/DemVariants" required: - name - tags - journey_rum type: object DemJourneyCreateData: description: Data object for a DEM journey create or update request. properties: attributes: $ref: "#/components/schemas/DemJourneyCreateAttributes" type: $ref: "#/components/schemas/DemJourneyType" required: - type - attributes type: object DemJourneyCreateRequest: description: Request body for creating or updating a DEM journey. properties: data: $ref: "#/components/schemas/DemJourneyCreateData" example: attributes: journey_rum: rum_steps: - nodes: - query: "action.name:'checkout'" type: start - nodes: - query: "action.name:'confirmation'" type: stop name: "Checkout Flow" tags: - "team:synthetics" type: journeys required: - data type: object DemJourneyResponse: description: Response body for a single DEM journey. properties: data: $ref: "#/components/schemas/DemJourneyResponseData" required: - data type: object DemJourneyResponseAttributes: description: Attributes returned in a DEM journey response. properties: created_at: description: The timestamp when the journey was created. example: "2024-01-15T10:30:00Z" format: date-time readOnly: true type: string created_by: $ref: "#/components/schemas/DemUser" nullable: true readOnly: true description: description: An optional human-readable description of the journey. example: "Tracks the user checkout flow from cart to confirmation." nullable: true type: string journey_rum: $ref: "#/components/schemas/DemJourneyRum" name: description: The name of the DEM journey. example: "Checkout Flow" type: string org_id: description: The organization ID that owns this journey. example: 12345 format: int64 readOnly: true type: integer tags: $ref: "#/components/schemas/DemTags" test_suite: $ref: "#/components/schemas/DemTestSuiteNested" nullable: true readOnly: true updated_at: description: The timestamp when the journey was last updated. example: "2024-01-16T08:00:00Z" format: date-time nullable: true readOnly: true type: string updated_by: $ref: "#/components/schemas/DemUser" nullable: true readOnly: true variants: $ref: "#/components/schemas/DemVariants" required: - name - description - tags - org_id - journey_rum - test_suite - variants - created_by - created_at - updated_by - updated_at type: object DemJourneyResponseData: description: Data object in a DEM journey response. properties: attributes: $ref: "#/components/schemas/DemJourneyResponseAttributes" id: description: The unique identifier of the DEM journey. example: "journey-abc123" type: string type: $ref: "#/components/schemas/DemJourneyType" required: - id - type - attributes type: object DemJourneyRum: description: The RUM definition for a DEM journey. properties: filter: description: An optional RUM query filter applied to the entire journey. example: "env:prod" type: string rum_steps: $ref: "#/components/schemas/DemRumSteps" example: - nodes: - query: "action.name:'checkout'" type: start - nodes: - query: "action.name:'confirmation'" type: stop variants: $ref: "#/components/schemas/DemVariants" required: - rum_steps type: object DemJourneyTestSuiteResponse: description: Response body for a DEM journey test suite. properties: data: $ref: "#/components/schemas/DemJourneyTestSuiteResponseData" required: - data type: object DemJourneyTestSuiteResponseAttributes: description: Attributes of a DEM journey test suite response. properties: created_at: description: The timestamp when the test suite was created. example: "2024-01-15T10:30:00Z" format: date-time readOnly: true type: string dropped_test_ids: description: Test IDs omitted because the caller lacks read access. items: type: string type: array name: description: The name of the test suite. example: "Checkout Flow Suite" type: string required: - name - created_at type: object DemJourneyTestSuiteResponseData: description: Data object in a DEM test suite response. properties: attributes: $ref: "#/components/schemas/DemJourneyTestSuiteResponseAttributes" id: description: The public ID of the test suite. example: "suite-abc123" type: string type: $ref: "#/components/schemas/DemJourneyTestSuiteType" required: - id - type - attributes type: object DemJourneyTestSuiteType: description: The type identifier for DEM journey test suites. enum: - journey_test_suite example: journey_test_suite type: string x-enum-varnames: - JOURNEY_TEST_SUITE DemJourneyType: description: The type identifier for DEM journeys. enum: - journeys example: journeys type: string x-enum-varnames: - JOURNEYS DemJourneysListData: description: List of DEM journey data objects. items: $ref: "#/components/schemas/DemJourneyResponseData" type: array DemJourneysListResponse: description: Response body for a list of DEM journeys. properties: data: $ref: "#/components/schemas/DemJourneysListData" example: - attributes: created_at: "2024-01-15T10:30:00Z" created_by: email: "jane.doe@example.com" handle: "jane.doe" name: "Jane Doe" uuid: "00000000-0000-0000-0000-000000000001" description: "Tracks checkout flow." journey_rum: rum_steps: - nodes: - query: "action.name:'checkout'" type: start - nodes: - query: "action.name:'confirmation'" type: stop name: "Checkout Flow" org_id: 12345 tags: - "team:synthetics" test_suite: updated_at: updated_by: variants: [] id: "journey-abc123" type: journeys required: - data type: object DemRecommendedTestAttributes: description: Attributes of an AI-recommended synthetic test for a DEM journey. properties: config: $ref: "#/components/schemas/DemRecommendedTestConfig" created_at: description: The time when the recommendation was generated. example: "2026-08-31T16:00:00Z" format: date-time type: string name: description: The display name of the recommended test. example: "Checkout journey" type: string result_id: description: The identifier of the validating sample run, when available. example: "result-abc123" type: string session_id: description: The RUM session identifier for the validating sample run, when available. example: "session-abc123" type: string source: description: The pipeline that produced the recommendation. example: gbt type: string type: description: The type of synthetic test. example: browser type: string variant_id: description: The variant associated with the recommendation, when applicable. example: "variant-001" type: string required: - type - name - source - config - created_at type: object DemRecommendedTestConfig: additionalProperties: {} description: The browser test configuration that can be used to create the recommended test. example: name: "Checkout journey" type: browser type: object DemRecommendedTestData: description: Data object for a recommended synthetic test. properties: attributes: $ref: "#/components/schemas/DemRecommendedTestAttributes" id: description: The identifier of the journey associated with the recommendation. example: "journey-abc123" type: string type: $ref: "#/components/schemas/DemRecommendedTestType" required: - id - type - attributes type: object DemRecommendedTestType: description: The type identifier for a recommended synthetic test. enum: - recommended_tests example: recommended_tests type: string x-enum-varnames: - RECOMMENDED_TESTS DemRecommendedTests: description: Recommended synthetic tests for a DEM journey. items: $ref: "#/components/schemas/DemRecommendedTestData" type: array DemRecommendedTestsResponse: description: Response containing recommended synthetic tests for a DEM journey. properties: data: $ref: "#/components/schemas/DemRecommendedTests" required: - data type: object DemRumNode: description: A RUM node within a journey step. properties: app_id: description: The application ID associated with this node. example: "app-xyz789" type: string id: description: The ID of the RUM node element. example: "element-id-123" type: string query: description: The RUM query for matching this node. example: "action.name:'checkout'" type: string required: - query type: object DemRumNodes: description: List of RUM nodes within a journey step. example: - query: "action.name:'checkout'" items: $ref: "#/components/schemas/DemRumNode" type: array DemRumStep: description: A single step in a RUM journey definition. properties: nodes: $ref: "#/components/schemas/DemRumNodes" example: - query: "action.name:'checkout'" type: $ref: "#/components/schemas/DemRumStepType" required: - type - nodes type: object DemRumStepType: description: The type of a RUM journey step. enum: - start - stop - step example: start type: string x-enum-varnames: - START - STOP - STEP DemRumSteps: description: List of RUM journey steps. example: - nodes: - query: "action.name:'checkout'" type: start - nodes: - query: "action.name:'confirmation'" type: stop items: $ref: "#/components/schemas/DemRumStep" type: array DemSearchInferredJourneysResponse: description: >- Response body for searching inferred journeys. Contains either candidate or ignored items depending on the `status` query parameter. properties: data: description: List of inferred journey items matching the search criteria. items: $ref: "#/components/schemas/DemInferredJourneyItem" type: array required: - data type: object DemTags: description: List of tags associated with a DEM resource. example: - "team:synthetics" - "env:prod" items: description: A tag in the format `key:value`. type: string type: array DemTestSuiteIDs: description: List of test suite IDs. example: - "suite-abc123" - "suite-def456" items: description: A test suite ID. type: string type: array DemTestSuiteNested: description: A test suite associated with a DEM resource. properties: id: description: The ID of the test suite. example: "suite-abc123" type: string name: description: The name of the test suite. example: "My Journey Suite" type: string required: - id - name type: object DemUser: description: A Datadog user associated with a DEM operation. properties: email: description: The email address of the user. example: "jane.doe@example.com" type: string handle: description: The handle of the user. example: "jane.doe" type: string name: description: The display name of the user. example: "Jane Doe" type: string uuid: description: The UUID of the user. example: "00000000-0000-0000-0000-000000000001" type: string required: - uuid - name - email - handle type: object DemVariant: description: A variant (sub-funnel) of a DEM journey with its own steps. properties: filter: description: An optional RUM query filter to scope this variant. example: "device.type:mobile" type: string id: description: The unique identifier of the variant. example: "variant-001" readOnly: true type: string name: description: The name of the variant. example: "Mobile checkout" type: string rum_steps: $ref: "#/components/schemas/DemRumSteps" example: - nodes: - query: "action.name:'checkout'" type: start - nodes: - query: "action.name:'confirmation'" type: stop required: - name - rum_steps type: object DemVariantAttributes: description: Attributes of a DEM journey variant. properties: filter: description: An optional RUM query filter to scope this variant. example: "device.type:mobile" type: string name: description: The name of the variant. example: "Mobile checkout" type: string rum_steps: $ref: "#/components/schemas/DemRumSteps" required: - name - rum_steps type: object DemVariantRequest: description: Request to create or update a DEM journey variant. properties: data: $ref: "#/components/schemas/DemVariantRequestData" required: - data type: object DemVariantRequestData: description: Data object for a DEM journey variant request. properties: attributes: $ref: "#/components/schemas/DemVariantAttributes" type: $ref: "#/components/schemas/DemVariantType" required: - type - attributes type: object DemVariantResponse: description: Response containing a DEM journey variant. properties: data: $ref: "#/components/schemas/DemVariantResponseData" required: - data type: object DemVariantResponseData: description: Data object returned for a DEM journey variant. properties: attributes: $ref: "#/components/schemas/DemVariantAttributes" id: description: The unique identifier of the variant. example: "variant-001" type: string type: $ref: "#/components/schemas/DemVariantType" required: - id - type - attributes type: object DemVariantType: description: The type identifier for DEM journey variants. enum: - variants example: variants type: string x-enum-varnames: - VARIANTS DemVariants: description: List of variants associated with a DEM journey. example: - name: "Mobile checkout" rum_steps: - nodes: - query: "action.name:'checkout'" type: start - nodes: - query: "action.name:'confirmation'" type: stop items: $ref: "#/components/schemas/DemVariant" type: array DependencyLocation: description: Static library vulnerability location. properties: column_end: description: Location column end. example: 140 format: int64 type: integer column_start: description: Location column start. example: 5 format: int64 type: integer file_name: description: Location file name. example: src/go.mod type: string line_end: description: Location line end. example: 10 format: int64 type: integer line_start: description: Location line start. example: 1 format: int64 type: integer required: - file_name - line_start - line_end - column_start - column_end type: object Deployment: description: The version of the app that was published. properties: attributes: $ref: "#/components/schemas/DeploymentAttributes" id: description: The deployment ID. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string meta: $ref: "#/components/schemas/DeploymentMetadata" type: $ref: "#/components/schemas/AppDeploymentType" type: object DeploymentAttributes: description: The attributes object containing the version ID of the published app. properties: app_version_id: description: The version ID of the app that was published. For an unpublished app, this is always the nil UUID (`00000000-0000-0000-0000-000000000000`). example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string type: object DeploymentGateDataType: description: Deployment gate resource type. enum: - deployment_gate example: deployment_gate type: string x-enum-varnames: - DEPLOYMENT_GATE DeploymentGateEvaluationAttributes: description: Attributes of a deployment gate evaluation. properties: dry_run: description: Whether this evaluation used gate-level dry run. example: true type: boolean duration_seconds: description: Evaluation duration in seconds. Null while it is in progress. example: 900 format: int64 nullable: true type: integer env: description: Deployment environment evaluated by the gate. example: prod type: string evaluation_id: description: Gate evaluation UUID. Matches the resource `id`. example: 7853af70-e6bf-49d8-a6cc-1b9b50ef0537 format: uuid type: string finished_at: description: Time the evaluation finished. Null while it is in progress. example: "2026-09-14T08:15:00Z" format: date-time nullable: true type: string gate_id: description: Configured deployment gate UUID. Null for just-in-time evaluations. example: e7cd2af1-b67b-11ee-8d0d-2a7caf4aa214 format: uuid nullable: true type: string identifier: description: Deployment gate identifier. example: default type: string service: description: Service evaluated by the deployment gate. example: checkout type: string started_at: description: Time the evaluation started. example: "2026-09-14T08:00:00Z" format: date-time type: string status: $ref: "#/components/schemas/DeploymentGatesEvaluationResultResponseAttributesGateStatus" version: description: Evaluated deployment version. Empty when no version was provided. example: "2026.09.14.1" type: string required: - evaluation_id - gate_id - service - env - identifier - version - status - dry_run - started_at - finished_at - duration_seconds type: object DeploymentGateEvaluationData: description: JSON:API deployment gate evaluation resource. properties: attributes: $ref: "#/components/schemas/DeploymentGateEvaluationAttributes" id: description: Deployment gate evaluation UUID. example: 7853af70-e6bf-49d8-a6cc-1b9b50ef0537 format: uuid type: string type: $ref: "#/components/schemas/DeploymentGateEvaluationDataType" required: [id, type, attributes] type: object DeploymentGateEvaluationDataType: default: deployment_gate_evaluation description: JSON:API type for a deployment gate evaluation. enum: [deployment_gate_evaluation] example: deployment_gate_evaluation type: string x-enum-varnames: [DEPLOYMENT_GATE_EVALUATION] DeploymentGateEvaluationListMeta: description: Pagination metadata. properties: page: $ref: "#/components/schemas/DeploymentGateEvaluationPage" required: [page] type: object DeploymentGateEvaluationPage: description: Cursor pagination information. properties: next_cursor: description: Opaque cursor for the next page. Absent on the final page. type: string size: description: Requested maximum number of resources in this page. example: 1 format: int64 maximum: 100 minimum: 1 type: integer required: [size] type: object DeploymentGateEvaluationsResponse: description: Paginated deployment gate evaluations. properties: data: items: $ref: "#/components/schemas/DeploymentGateEvaluationData" type: array meta: $ref: "#/components/schemas/DeploymentGateEvaluationListMeta" required: [data, meta] type: object DeploymentGateResponse: description: Response for a deployment gate. properties: data: $ref: "#/components/schemas/DeploymentGateResponseData" type: object DeploymentGateResponseData: description: Data for a deployment gate. properties: attributes: $ref: "#/components/schemas/DeploymentGateResponseDataAttributes" id: description: Unique identifier of the deployment gate. example: "1111-2222-3333-4444-555566667777" type: string type: $ref: "#/components/schemas/DeploymentGateDataType" required: - type - attributes - id type: object DeploymentGateResponseDataAttributes: description: Basic information about a deployment gate. properties: created_at: description: The timestamp when the deployment gate was created. example: "2021-01-01T00:00:00Z" format: date-time type: string created_by: $ref: "#/components/schemas/DeploymentGateResponseDataAttributesCreatedBy" dry_run: description: Whether this gate is run in dry-run mode. example: false type: boolean env: description: The environment of the deployment gate. example: "production" type: string identifier: description: The identifier of the deployment gate. example: "pre" type: string service: description: The service of the deployment gate. example: "my-service" type: string updated_at: description: The timestamp when the deployment gate was last updated. example: "2021-01-01T00:00:00Z" format: date-time type: string updated_by: $ref: "#/components/schemas/DeploymentGateResponseDataAttributesUpdatedBy" required: - created_at - created_by - dry_run - env - identifier - service type: object DeploymentGateResponseDataAttributesCreatedBy: description: Information about the user who created the deployment gate. properties: handle: description: The handle of the user who created the deployment rule. example: "test-user" type: string id: description: The ID of the user who created the deployment rule. example: "1111-2222-3333-4444-555566667777" type: string name: description: The name of the user who created the deployment rule. example: "Test User" type: string required: - id type: object DeploymentGateResponseDataAttributesUpdatedBy: description: Information about the user who updated the deployment gate. properties: handle: description: The handle of the user who updated the deployment rule. example: "test-user" type: string id: description: The ID of the user who updated the deployment rule. example: "1111-2222-3333-4444-555566667777" type: string name: description: The name of the user who updated the deployment rule. example: "Test User" type: string required: - id type: object DeploymentGateRuleEvaluationAttributes: description: Attributes of a deployment gate rule evaluation. properties: configuration: $ref: "#/components/schemas/DeploymentGateRuleEvaluationConfiguration" dry_run: description: Whether this rule is non-enforcing. A failed dry-run rule is ignored when computing the gate outcome. Independent of `gate_dry_run`. example: false type: boolean duration_seconds: description: Rule evaluation duration in seconds. Null while it is in progress. example: 0 format: int64 nullable: true type: integer env: description: Evaluated environment. example: prod type: string evaluation_id: description: Rule evaluation UUID. Matches the resource `id`. example: 4f66c1c6-8346-59e5-be44-238214133260 format: uuid type: string failures: $ref: "#/components/schemas/DeploymentGateRuleFailures" finished_at: description: Time the rule evaluation finished. Null while it is in progress. example: "2026-09-14T08:15:00Z" format: date-time nullable: true type: string gate_dry_run: description: Whether the parent gate is dry-run. A failed dry-run gate blocks but does not stop deployment. Independent of rule-level `dry_run`. example: false type: boolean gate_evaluation_id: description: Deployment gate evaluation UUID. example: 426a8f7b-b3e8-45f9-9d99-a1ed2f7fea04 format: uuid type: string gate_id: description: Configured deployment gate UUID. Null for just-in-time evaluations. example: e7cd2af1-b67b-11ee-8d0d-2a7caf4aa214 format: uuid nullable: true type: string identifier: description: Deployment gate identifier. example: default type: string name: description: Rule name. example: APM faulty deployment detection type: string reason: description: Reason for the rule result. example: A faulty resource was detected. type: string rule_id: description: Configured deployment rule UUID. Null for just-in-time rules. example: 5cb4e76f-2937-47d7-80c8-7255ce2b76a4 format: uuid nullable: true type: string service: description: Evaluated service. example: checkout type: string started_at: description: Time the rule evaluation started. example: "2026-09-14T08:00:00Z" format: date-time type: string status: $ref: "#/components/schemas/DeploymentGatesEvaluationResultResponseAttributesGateStatus" type: $ref: "#/components/schemas/DeploymentGateRuleEvaluationType" version: description: Evaluated deployment version. Empty when no version was provided. example: "2026.09.14.1" type: string required: - evaluation_id - gate_evaluation_id - gate_id - rule_id - service - env - identifier - version - gate_dry_run - name - type - status - dry_run - reason - started_at - finished_at - duration_seconds - configuration - failures type: object DeploymentGateRuleEvaluationConfiguration: additionalProperties: false description: |- Evaluated rule configuration. Fields depend on rule type and unset fields are omitted. Monitor rules can include `duration`, `query`, `monitor_ids`, `warmup`, `fail_on_no_groups_found`, and `fail_on_no_data`. Faulty deployment detection rules can include `duration`, `allowed_resources`, and `excluded_resources`. properties: allowed_resources: description: APM resources explicitly allowed by faulty deployment detection. items: type: string type: array duration: description: Evaluation duration configured for this rule. format: int64 type: integer excluded_resources: description: APM resources excluded from faulty deployment detection. items: type: string type: array fail_on_no_data: description: Whether a monitor rule fails when no data is found. type: boolean fail_on_no_groups_found: description: Whether a monitor rule fails when no groups are found. type: boolean monitor_ids: description: Monitor IDs evaluated by a monitor rule. items: type: string type: array query: description: Monitor query used by a monitor rule. type: string warmup: description: Warm-up duration in seconds for a monitor rule. Omitted when zero. format: int64 type: integer type: object DeploymentGateRuleEvaluationData: description: JSON:API deployment gate rule evaluation resource. properties: attributes: $ref: "#/components/schemas/DeploymentGateRuleEvaluationAttributes" id: description: Rule evaluation UUID. example: 4f66c1c6-8346-59e5-be44-238214133260 format: uuid type: string type: $ref: "#/components/schemas/DeploymentGateRuleEvaluationDataType" required: [id, type, attributes] type: object DeploymentGateRuleEvaluationDataType: default: deployment_gate_rule_evaluation description: JSON:API type for a deployment gate rule evaluation. enum: [deployment_gate_rule_evaluation] example: deployment_gate_rule_evaluation type: string x-enum-varnames: [DEPLOYMENT_GATE_RULE_EVALUATION] DeploymentGateRuleEvaluationType: description: Type of deployment gate rule. enum: [monitor, faulty_deployment_detection] example: faulty_deployment_detection type: string x-enum-varnames: [MONITOR, FAULTY_DEPLOYMENT_DETECTION] DeploymentGateRuleEvaluationsResponse: description: Paginated deployment gate rule evaluations. properties: data: items: $ref: "#/components/schemas/DeploymentGateRuleEvaluationData" type: array meta: $ref: "#/components/schemas/DeploymentGateEvaluationListMeta" required: [data, meta] type: object DeploymentGateRuleFailureMonitor: description: Failed monitor reference. properties: id: description: Monitor ID. example: "12345678" type: string state: description: Monitor state that caused the failure. example: alert type: string url: description: URL for inspecting the monitor during the evaluation window. example: https://app.datadoghq.com/monitors/12345678 type: string required: [id, url, state] type: object DeploymentGateRuleFailureNarrative: description: Faulty deployment detection narrative reference. properties: hostgroup: description: Host group associated with the narrative. example: service:checkout,env:prod type: string id: description: Narrative ID. example: narrative-123 type: string required: [id, hostgroup] type: object DeploymentGateRuleFailures: description: Rule failure details. properties: faulty_apm_resources: description: Names of faulty APM resources. example: - GET /checkout items: type: string type: array monitors: items: $ref: "#/components/schemas/DeploymentGateRuleFailureMonitor" type: array narratives: items: $ref: "#/components/schemas/DeploymentGateRuleFailureNarrative" type: array required: [monitors, faulty_apm_resources, narratives] type: object DeploymentGateRulesResponse: description: Response for a deployment gate rules. properties: data: $ref: "#/components/schemas/ListDeploymentRuleResponseData" type: object DeploymentGatesEvaluationConfiguration: description: |- Inline rule definitions for a deployment gate evaluation. When provided, rules are evaluated directly from this configuration instead of using the preconfigured gate rules. At least one rule is required. properties: dry_run: description: Gate-level dry run. When enabled, the rules are evaluated normally but the gate always returns `pass`. The real result is visible in the Datadog UI. example: false type: boolean rules: description: The list of rules to evaluate. At least one rule is required. items: $ref: "#/components/schemas/DeploymentGatesEvaluationRule" minItems: 1 type: array required: - rules type: object DeploymentGatesEvaluationRequest: description: Request body for triggering a deployment gate evaluation. properties: data: $ref: "#/components/schemas/DeploymentGatesEvaluationRequestData" required: - data type: object DeploymentGatesEvaluationRequestAttributes: description: |- Attributes for a deployment gate evaluation request. When `configuration` is provided, rules are evaluated inline from that configuration. When omitted, rules are resolved from the preconfigured gate for the given service and environment. properties: configuration: $ref: "#/components/schemas/DeploymentGatesEvaluationConfiguration" env: description: The environment of the deployment. example: "staging" type: string identifier: default: default description: The identifier of the deployment gate. Defaults to "default". example: "pre-deploy" type: string primary_tag: description: A primary tag to scope APM Faulty Deployment Detection rules. example: "region:us-east-1" type: string service: description: The service being deployed. example: "transaction-backend" type: string version: description: The version of the deployment. Required for APM Faulty Deployment Detection rules. example: "v1.2.3" type: string required: - env - service type: object DeploymentGatesEvaluationRequestData: description: Data for a deployment gate evaluation request. properties: attributes: $ref: "#/components/schemas/DeploymentGatesEvaluationRequestAttributes" type: $ref: "#/components/schemas/DeploymentGatesEvaluationRequestDataType" required: - type - attributes type: object DeploymentGatesEvaluationRequestDataType: default: deployment_gates_evaluation_request description: JSON:API type for a deployment gate evaluation request. enum: - deployment_gates_evaluation_request example: deployment_gates_evaluation_request type: string x-enum-varnames: - DEPLOYMENT_GATES_EVALUATION_REQUEST DeploymentGatesEvaluationResponse: description: Response for a deployment gate evaluation request. properties: data: $ref: "#/components/schemas/DeploymentGatesEvaluationResponseData" type: object DeploymentGatesEvaluationResponseAttributes: description: Attributes for a deployment gate evaluation response. properties: evaluation_id: description: The unique identifier of the gate evaluation. example: "e9d2f04f-4f4b-494b-86e5-52f03e10c8e9" type: string required: - evaluation_id type: object DeploymentGatesEvaluationResponseData: description: Data for a deployment gate evaluation response. properties: attributes: $ref: "#/components/schemas/DeploymentGatesEvaluationResponseAttributes" id: description: The unique identifier of the evaluation response. example: "e9d2f04f-4f4b-494b-86e5-52f03e10c8e9" format: uuid type: string type: $ref: "#/components/schemas/DeploymentGatesEvaluationResponseDataType" required: - type - attributes - id type: object DeploymentGatesEvaluationResponseDataType: default: deployment_gates_evaluation_response description: JSON:API type for a deployment gate evaluation response. enum: - deployment_gates_evaluation_response example: deployment_gates_evaluation_response type: string x-enum-varnames: - DEPLOYMENT_GATES_EVALUATION_RESPONSE DeploymentGatesEvaluationResultResponse: description: Response containing the result of a deployment gate evaluation. properties: data: $ref: "#/components/schemas/DeploymentGatesEvaluationResultResponseData" type: object DeploymentGatesEvaluationResultResponseAttributes: description: Attributes for a deployment gate evaluation result response. properties: dry_run: description: Whether the gate was evaluated in dry-run mode. example: false type: boolean evaluation_id: description: The unique identifier of the gate evaluation. example: "e9d2f04f-4f4b-494b-86e5-52f03e10c8e9" type: string evaluation_url: description: A URL to view the evaluation details in the Datadog UI. example: "https://app.datadoghq.com/ci/deployment-gates/evaluations?index=cdgates&query=level%3Agate+%40evaluation_id%3Ae9d2f04f-4f4b-494b-86e5-52f03e10c8e9" type: string gate_id: description: The unique identifier of the deployment gate. example: "e140302e-0cba-40d2-978c-6780647f8f1c" format: uuid type: string gate_status: $ref: "#/components/schemas/DeploymentGatesEvaluationResultResponseAttributesGateStatus" rules: description: The results of individual rule evaluations. items: $ref: "#/components/schemas/DeploymentGatesRuleResponse" type: array required: - dry_run - evaluation_id - evaluation_url - gate_id - gate_status - rules type: object DeploymentGatesEvaluationResultResponseAttributesGateStatus: description: |- The recorded result of a gate or rule evaluation. - `in_progress`: The evaluation is still running. - `pass`: All rules passed successfully. - `fail`: One or more rules did not pass. enum: - in_progress - pass - fail example: "pass" type: string x-enum-varnames: - IN_PROGRESS - PASS - FAIL DeploymentGatesEvaluationResultResponseData: description: Data for a deployment gate evaluation result response. properties: attributes: $ref: "#/components/schemas/DeploymentGatesEvaluationResultResponseAttributes" id: description: The unique identifier of the evaluation. example: "e9d2f04f-4f4b-494b-86e5-52f03e10c8e9" type: string type: $ref: "#/components/schemas/DeploymentGatesEvaluationResultResponseDataType" required: - type - attributes - id type: object DeploymentGatesEvaluationResultResponseDataType: default: deployment_gates_evaluation_result_response description: JSON:API type for a deployment gate evaluation result response. enum: - deployment_gates_evaluation_result_response example: deployment_gates_evaluation_result_response type: string x-enum-varnames: - DEPLOYMENT_GATES_EVALUATION_RESULT_RESPONSE DeploymentGatesEvaluationRule: description: A rule to evaluate as part of a deployment gate evaluation. oneOf: - $ref: "#/components/schemas/DeploymentGatesMonitorRule" - $ref: "#/components/schemas/DeploymentGatesFDDRule" DeploymentGatesFDDRule: description: A faulty deployment detection rule to evaluate as part of a deployment gate evaluation. properties: dry_run: description: Rule-level dry run. When enabled, the rule is evaluated normally but it always returns `pass`. The real result is visible in the Datadog UI. example: false type: boolean name: description: Human-readable name for this rule. example: "apm faulty deployment" type: string options: $ref: "#/components/schemas/DeploymentGatesFDDRuleOptions" type: $ref: "#/components/schemas/DeploymentGatesFDDRuleType" required: - type - name type: object DeploymentGatesFDDRuleOptions: description: Options for a `faulty_deployment_detection` rule. properties: allowed_resources: description: APM resource names to include in analysis. Mutually exclusive with `excluded_resources`. example: - "GET /healthcheck" items: type: string type: array duration: description: Evaluation window in seconds. Maximum 7200 (2 hours). example: 900 format: int64 maximum: 7200 type: integer excluded_resources: description: APM resource names to exclude from analysis. example: - "GET /healthcheck" items: type: string type: array type: object DeploymentGatesFDDRuleType: description: The type identifier for a faulty deployment detection rule. enum: - faulty_deployment_detection example: faulty_deployment_detection type: string x-enum-varnames: - FAULTY_DEPLOYMENT_DETECTION DeploymentGatesListResponse: description: Response containing a paginated list of deployment gates. properties: data: description: Array of deployment gates. items: $ref: "#/components/schemas/DeploymentGateResponseData" type: array meta: $ref: "#/components/schemas/DeploymentGatesListResponseMeta" type: object DeploymentGatesListResponseMeta: description: Metadata for a list of deployment gates response. properties: page: $ref: "#/components/schemas/DeploymentGatesListResponseMetaPage" type: object DeploymentGatesListResponseMetaPage: description: Pagination information for a list of deployment gates. properties: cursor: description: The cursor used for the current page. type: string next_cursor: description: The cursor to use to fetch the next page. This is absent when there are no more pages. type: string size: default: 50 description: The number of results per page. format: int64 maximum: 1000 minimum: 1 type: integer type: object DeploymentGatesMonitorRule: description: A monitor rule to evaluate as part of a deployment gate evaluation. properties: dry_run: description: Rule-level dry run. When enabled, the rule is evaluated normally but always returns `pass`. The real result is visible in the Datadog UI. example: false type: boolean name: description: Human-readable name for this rule. example: "error rate monitors" type: string options: $ref: "#/components/schemas/DeploymentGatesMonitorRuleOptions" type: $ref: "#/components/schemas/DeploymentGatesMonitorRuleType" required: - type - name type: object DeploymentGatesMonitorRuleOptions: description: Options for a `monitor` rule. properties: duration: description: Evaluation window in seconds. Maximum 7200 (2 hours). example: 300 format: int64 maximum: 7200 type: integer query: description: Monitor search query. example: "service:transaction-backend env:production" type: string required: - query type: object DeploymentGatesMonitorRuleType: description: The type identifier for a monitor rule. enum: - monitor example: monitor type: string x-enum-varnames: - MONITOR DeploymentGatesRuleResponse: description: The result of a single rule evaluation. properties: dry_run: description: Whether this rule was evaluated in dry-run mode. example: false type: boolean name: description: The name of the rule. example: "Check service monitors" type: string reason: description: The reason for the rule result, if applicable. example: "One or more monitors in ALERT state" type: string status: $ref: "#/components/schemas/DeploymentGatesEvaluationResultResponseAttributesGateStatus" type: object DeploymentMetadata: description: Metadata object containing the publication creation information. properties: created_at: description: Timestamp of when the app was published. format: date-time type: string user_id: description: The ID of the user who published the app. format: int64 type: integer user_name: description: The name (or email address) of the user who published the app. type: string user_uuid: description: The UUID of the user who published the app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string type: object DeploymentRelationship: description: Information pointing to the app's publication status. properties: data: $ref: "#/components/schemas/DeploymentRelationshipData" meta: $ref: "#/components/schemas/DeploymentMetadata" type: object DeploymentRelationshipData: description: Data object containing the deployment ID. properties: id: description: The deployment ID. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string type: $ref: "#/components/schemas/AppDeploymentType" type: object DeploymentRuleDataType: description: Deployment rule resource type. enum: - deployment_rule example: deployment_rule type: string x-enum-varnames: - DEPLOYMENT_RULE DeploymentRuleOptionsFaultyDeploymentDetection: additionalProperties: false description: Faulty deployment detection options for deployment rules. properties: allowed_resources: description: Resources to include in faulty deployment detection. Mutually exclusive with `excluded_resources`. example: ["resource1", "resource2"] items: description: A resource name to include in faulty deployment detection. type: string type: array duration: description: The duration for faulty deployment detection. example: 3600 format: int64 type: integer excluded_resources: description: Resources to exclude from faulty deployment detection. example: ["resource1", "resource2"] items: description: A resource name to exclude from faulty deployment detection. type: string type: array type: object DeploymentRuleOptionsMonitor: additionalProperties: false description: Monitor query options for deployment rules. properties: duration: description: Seconds the monitor needs to stay in OK status for the rule to pass. example: 3600 format: int64 type: integer fail_on_no_data: default: true description: Whether the rule should fail if a matching monitor group is in a NO DATA state. example: false type: boolean fail_on_no_groups_found: default: false description: Whether the rule should fail if no monitor groups are found for the query. example: false type: boolean query: description: A query that selects the monitors to evaluate. example: "service:my-service env:prod" type: string warmup: default: 0 description: Seconds to wait after a deployment starts before evaluating the monitor's status. example: 0 format: int64 minimum: 0 type: integer required: - query type: object DeploymentRuleOptionsMonitorId: additionalProperties: false description: A specific monitor and the groups to evaluate for it. properties: groups: description: The exact monitor group names to evaluate. An empty array evaluates all groups. example: [] items: description: An exact monitor group name. minLength: 1 type: string type: array uniqueItems: true id: description: The monitor's decimal ID. example: "123456" pattern: "^[1-9][0-9]*$" type: string required: - id - groups type: object DeploymentRuleOptionsMonitorIds: additionalProperties: false description: Specific monitor options for deployment rules. properties: duration: description: Seconds the monitors need to stay in OK status for the rule to pass. example: 3600 format: int64 type: integer fail_on_no_data: default: true description: Whether the rule should fail if a selected monitor group is in a NO DATA state. example: false type: boolean fail_on_no_groups_found: default: false description: Whether the rule should fail if no monitor groups are found for the selected monitors. example: false type: boolean monitor_ids: description: A non-empty list of specific monitors to evaluate. example: - groups: [] id: "123456" items: $ref: "#/components/schemas/DeploymentRuleOptionsMonitorId" minItems: 1 type: array warmup: default: 0 description: Seconds to wait after a deployment starts before evaluating the monitors' statuses. example: 0 format: int64 minimum: 0 type: integer required: - monitor_ids type: object DeploymentRuleResponse: description: Response for a deployment rule. properties: data: $ref: "#/components/schemas/DeploymentRuleResponseData" type: object DeploymentRuleResponseData: description: Data for a deployment rule. properties: attributes: $ref: "#/components/schemas/DeploymentRuleResponseDataAttributes" id: description: Unique identifier of the deployment rule. example: "1111-2222-3333-4444-555566667777" type: string type: $ref: "#/components/schemas/DeploymentRuleDataType" required: - type - attributes - id type: object DeploymentRuleResponseDataAttributes: description: Basic information about a deployment rule. properties: created_at: description: The timestamp when the deployment rule was created. example: "2021-01-01T00:00:00Z" format: date-time type: string created_by: $ref: "#/components/schemas/DeploymentRuleResponseDataAttributesCreatedBy" dry_run: description: Whether this rule is run in dry-run mode. example: false type: boolean gate_id: description: The ID of the deployment gate. example: "1111-2222-3333-4444-555566667777" type: string name: description: The name of the deployment rule. example: "My deployment rule" type: string options: $ref: "#/components/schemas/DeploymentRulesOptions" type: $ref: "#/components/schemas/DeploymentRuleResponseDataAttributesType" updated_at: description: The timestamp when the deployment rule was last updated. format: date-time type: string updated_by: $ref: "#/components/schemas/DeploymentRuleResponseDataAttributesUpdatedBy" required: - created_at - created_by - dry_run - gate_id - name - options - type type: object DeploymentRuleResponseDataAttributesCreatedBy: description: Information about the user who created the deployment rule. properties: handle: description: The handle of the user who created the deployment rule. example: "test-user" type: string id: description: The ID of the user who created the deployment rule. example: "1111-2222-3333-4444-555566667777" type: string name: description: The name of the user who created the deployment rule. example: "Test User" type: string required: - id type: object DeploymentRuleResponseDataAttributesType: description: The type of the deployment rule. enum: - faulty_deployment_detection - monitor example: faulty_deployment_detection type: string x-enum-varnames: - FAULTY_DEPLOYMENT_DETECTION - MONITOR DeploymentRuleResponseDataAttributesUpdatedBy: description: Information about the user who updated the deployment rule. properties: handle: description: The handle of the user who updated the deployment rule. example: "test-user" type: string id: description: The ID of the user who updated the deployment rule. example: "1111-2222-3333-4444-555566667777" type: string name: description: The name of the user who updated the deployment rule. example: "Test User" type: string required: - id type: object DeploymentRulesOptions: description: Options for deployment rule response representing either faulty deployment detection or monitor options. oneOf: - $ref: "#/components/schemas/DeploymentRuleOptionsFaultyDeploymentDetection" - $ref: "#/components/schemas/DeploymentRuleOptionsMonitor" - $ref: "#/components/schemas/DeploymentRuleOptionsMonitorIds" DerivedMetricAttributes: description: Attributes of a derived metric. properties: definition: $ref: "#/components/schemas/DerivedMetricDefinition" required: - definition type: object DerivedMetricCreateData: description: Data object for creating or updating a derived metric. properties: attributes: $ref: "#/components/schemas/DerivedMetricAttributes" id: description: The derived metric name used as the resource ID. example: my.derived.metric type: string type: $ref: "#/components/schemas/DerivedMetricsType" required: - id - type - attributes type: object DerivedMetricCreateRequest: description: Request body for creating or updating a derived metric. properties: data: $ref: "#/components/schemas/DerivedMetricCreateData" required: - data type: object DerivedMetricData: description: A derived metric resource object. properties: attributes: $ref: "#/components/schemas/DerivedMetricAttributes" id: description: The derived metric name used as the resource ID. example: my.derived.metric type: string type: $ref: "#/components/schemas/DerivedMetricsType" required: - id - type - attributes type: object DerivedMetricDefinition: description: The definition of a derived metric as a formula over one or more queries. properties: formula: description: The formula that combines the queries into the value of the derived metric. example: a type: string queries: description: The list of queries referenced by the formula. items: $ref: "#/components/schemas/DerivedMetricQuery" minItems: 1 type: array required: - formula - queries type: object DerivedMetricQuery: description: A single query used in the definition of a derived metric. properties: data_source: description: The data source that the query is run against. example: metrics type: string name: description: The name used to reference this query from the formula. example: a type: string query: description: The query string executed against the data source. example: avg:system.cpu.user{*} type: string required: - data_source - name - query type: object DerivedMetricResponse: description: Response containing a single derived metric. properties: data: $ref: "#/components/schemas/DerivedMetricData" readOnly: true required: - data type: object DerivedMetricsType: default: derived_metrics description: The derived metric resource type. enum: - derived_metrics example: derived_metrics type: string x-enum-varnames: - DERIVED_METRICS DetachCaseRequest: description: Request for detaching security findings from their case. properties: data: $ref: "#/components/schemas/DetachCaseRequestData" type: object DetachCaseRequestData: description: Data for detaching security findings from their case. properties: id: description: Unique identifier of the detachment request. example: "c1234567-89ab-cdef-0123-456789abcdef" type: string relationships: $ref: "#/components/schemas/DetachCaseRequestDataRelationships" type: $ref: "#/components/schemas/CaseDataType" required: - type type: object DetachCaseRequestDataRelationships: description: Relationships detaching security findings from their case. properties: findings: $ref: "#/components/schemas/Findings" description: Security findings to detach from their case. required: - findings type: object DetailedFinding: description: A single finding with with message and resource configuration. properties: attributes: $ref: "#/components/schemas/DetailedFindingAttributes" id: $ref: "#/components/schemas/FindingID" type: $ref: "#/components/schemas/DetailedFindingType" type: object DetailedFindingAttributes: description: The JSON:API attributes of the detailed finding. properties: evaluation: $ref: "#/components/schemas/FindingEvaluation" evaluation_changed_at: $ref: "#/components/schemas/FindingEvaluationChangedAt" message: description: The remediation message for this finding. example: "## Remediation\n\n### From the console\n\n1. Go to Storage Account\n2. For each Storage Account, navigate to Data Protection\n3. Select Set soft delete enabled and enter the number of days to retain soft deleted data." type: string mute: $ref: "#/components/schemas/FindingMute" resource: $ref: "#/components/schemas/FindingResource" resource_configuration: description: The resource configuration for this finding. type: object resource_discovery_date: $ref: "#/components/schemas/FindingResourceDiscoveryDate" resource_type: $ref: "#/components/schemas/FindingResourceType" rule: $ref: "#/components/schemas/FindingRule" status: $ref: "#/components/schemas/FindingStatus" tags: $ref: "#/components/schemas/FindingTags" type: object DetailedFindingType: default: detailed_finding description: The JSON:API type for findings that have the message and resource configuration. enum: - detailed_finding example: detailed_finding type: string x-enum-varnames: ["DETAILED_FINDING"] DeviceAttributes: description: The device attributes properties: description: description: The device description example: a device monitored with NDM type: string device_type: description: The device type example: other type: string integration: description: The device integration example: snmp type: string interface_statuses: $ref: "#/components/schemas/DeviceAttributesInterfaceStatuses" ip_address: description: The device IP address example: 1.2.3.4 type: string location: description: The device location example: paris type: string model: description: The device model example: xx-123 type: string name: description: The device name example: example device type: string os_hostname: description: The device OS hostname type: string os_name: description: The device OS name example: example OS type: string os_version: description: The device OS version example: 1.0.2 type: string ping_status: description: The device ping status example: unmonitored type: string product_name: description: The device product name example: example device type: string serial_number: description: The device serial number example: X12345 type: string status: description: The device SNMP status example: ok type: string subnet: description: The device subnet example: 1.2.3.4/24 type: string sys_object_id: description: The device `sys_object_id` example: 1.3.6.1.4.1.99999 type: string tags: description: The list of device tags example: ["device_ip:1.2.3.4", "device_id:example:1.2.3.4"] items: description: A tag string in `key:value` format. type: string type: array vendor: description: The device vendor example: example vendor type: string version: description: The device version example: 1.2.3 type: string type: object DeviceAttributesInterfaceStatuses: description: Count of the device interfaces by status example: down: 1 "off": 2 up: 12 warning: 5 properties: down: description: The number of interfaces that are down format: int64 type: integer "off": description: The number of interfaces that are off format: int64 type: integer up: description: The number of interfaces that are up format: int64 type: integer warning: description: The number of interfaces that are in a warning state format: int64 type: integer type: object DeviceTagsBySource: description: Tags associated with a device from a specific source. properties: source: description: The source of the tags. example: user type: string tags: description: The list of tags for the source. example: ["tag:test", "tag:testbis"] items: description: A tag string in `key:value` format. type: string type: array type: object DevicesListData: description: The devices list data properties: attributes: $ref: "#/components/schemas/DeviceAttributes" id: description: The device ID example: example:1.2.3.4 type: string type: description: The type of the resource. The value should always be device. type: string type: object DnsMetricKey: description: The metric key for DNS metrics. enum: - dns_total_requests - dns_failures - dns_successful_responses - dns_failed_responses - dns_timeouts - dns_responses.nxdomain - dns_responses.servfail - dns_responses.other - dns_success_latency_percentile - dns_failure_latency_percentile type: string x-enum-descriptions: - The total number of DNS requests made by the client. - The total number of timeouts and errors in DNS requests. - The total number of successful DNS responses. - The total number of failed DNS responses. - The total number of DNS timeouts. - The total number of DNS responses with the NXDOMAIN error code. - The total number of DNS responses with the SERVFAIL error code. - The total number of DNS responses with other error codes. - The latency percentile for successful DNS responses. - The latency percentile for failed DNS responses. x-enum-varnames: - DNS_TOTAL_REQUESTS - DNS_FAILURES - DNS_SUCCESSFUL_RESPONSES - DNS_FAILED_RESPONSES - DNS_TIMEOUTS - DNS_RESPONSES_NXDOMAIN - DNS_RESPONSES_SERVFAIL - DNS_RESPONSES_OTHER - DNS_SUCCESS_LATENCY_PERCENTILE - DNS_FAILURE_LATENCY_PERCENTILE DomainAllowlist: description: The email domain allowlist for an org. properties: attributes: $ref: "#/components/schemas/DomainAllowlistAttributes" id: description: The unique identifier of the org. nullable: true type: string type: $ref: "#/components/schemas/DomainAllowlistType" required: - type type: object DomainAllowlistAttributes: description: The details of the email domain allowlist. properties: domains: description: The list of domains in the email domain allowlist. items: description: An email domain in the allowlist. type: string type: array enabled: description: Whether the email domain allowlist is enabled for the org. type: boolean type: object DomainAllowlistRequest: description: Request containing the desired email domain allowlist configuration. properties: data: $ref: "#/components/schemas/DomainAllowlist" required: - data type: object DomainAllowlistResponse: description: Response containing information about the email domain allowlist. properties: data: $ref: "#/components/schemas/DomainAllowlistResponseData" type: object DomainAllowlistResponseData: description: The email domain allowlist response for an org. properties: attributes: $ref: "#/components/schemas/DomainAllowlistResponseDataAttributes" id: description: The unique identifier of the org. nullable: true type: string type: $ref: "#/components/schemas/DomainAllowlistType" required: - type type: object DomainAllowlistResponseDataAttributes: description: The details of the email domain allowlist. properties: domains: description: The list of domains in the email domain allowlist. items: description: An email domain in the allowlist. type: string type: array enabled: description: Whether the email domain allowlist is enabled for the org. type: boolean type: object DomainAllowlistType: default: domain_allowlist description: Email domain allowlist allowlist type. enum: - domain_allowlist example: domain_allowlist type: string x-enum-varnames: - DOMAIN_ALLOWLIST DowntimeCreateRequest: description: Request for creating a downtime. properties: data: $ref: "#/components/schemas/DowntimeCreateRequestData" required: - data type: object DowntimeCreateRequestAttributes: description: Downtime details. properties: display_timezone: $ref: "#/components/schemas/DowntimeDisplayTimezone" message: $ref: "#/components/schemas/DowntimeMessage" monitor_identifier: $ref: "#/components/schemas/DowntimeMonitorIdentifier" mute_first_recovery_notification: $ref: "#/components/schemas/DowntimeMuteFirstRecoveryNotification" notify_end_states: $ref: "#/components/schemas/DowntimeNotifyEndStates" notify_end_types: $ref: "#/components/schemas/DowntimeNotifyEndTypes" schedule: $ref: "#/components/schemas/DowntimeScheduleCreateRequest" scope: $ref: "#/components/schemas/DowntimeScope" required: - scope - monitor_identifier type: object DowntimeCreateRequestData: description: Object to create a downtime. properties: attributes: $ref: "#/components/schemas/DowntimeCreateRequestAttributes" type: $ref: "#/components/schemas/DowntimeResourceType" required: - type - attributes type: object DowntimeDisplayTimezone: default: "UTC" description: |- The timezone in which to display the downtime's start and end times in Datadog applications. This is not used as an offset for scheduling. example: "America/New_York" nullable: true type: string DowntimeIncludedMonitorType: default: monitors description: Monitor resource type. enum: - monitors example: "monitors" type: string x-enum-varnames: - MONITORS DowntimeMessage: description: |- A message to include with notifications for this downtime. Email notifications can be sent to specific users by using the same `@username` notation as events. example: "Message about the downtime" nullable: true type: string DowntimeMeta: description: Pagination metadata returned by the API. properties: page: $ref: "#/components/schemas/DowntimeMetaPage" type: object DowntimeMetaPage: description: Object containing the total filtered count. properties: total_filtered_count: description: Total count of elements matched by the filter. format: int64 type: integer type: object DowntimeMonitorIdentifier: description: Monitor identifier for the downtime. oneOf: - $ref: "#/components/schemas/DowntimeMonitorIdentifierId" - $ref: "#/components/schemas/DowntimeMonitorIdentifierTags" DowntimeMonitorIdentifierId: additionalProperties: {} description: Object of the monitor identifier. properties: monitor_id: description: ID of the monitor to prevent notifications. example: 123 format: int64 type: integer required: - monitor_id type: object DowntimeMonitorIdentifierTags: additionalProperties: {} description: Object of the monitor tags. properties: monitor_tags: description: |- A list of monitor tags. For example, tags that are applied directly to monitors, not tags that are used in monitor queries (which are filtered by the scope parameter), to which the downtime applies. The resulting downtime applies to monitors that match **all** provided monitor tags. Setting `monitor_tags` to `[*]` configures the downtime to mute all monitors for the given scope. example: ["service:postgres", "team:frontend"] items: description: A list of monitor tags. example: "service:postgres" type: string minItems: 1 type: array required: - monitor_tags type: object DowntimeMonitorIncludedAttributes: description: Attributes of the monitor identified by the downtime. properties: name: description: The name of the monitor identified by the downtime. example: "A monitor name" type: string type: object DowntimeMonitorIncludedItem: description: Information about the monitor identified by the downtime. properties: attributes: $ref: "#/components/schemas/DowntimeMonitorIncludedAttributes" id: description: ID of the monitor identified by the downtime. example: 12345 format: int64 type: integer type: $ref: "#/components/schemas/DowntimeIncludedMonitorType" type: object DowntimeMuteFirstRecoveryNotification: description: If the first recovery notification during a downtime should be muted. example: false type: boolean DowntimeNotifyEndStateActions: description: Action that will trigger a monitor notification if the downtime is in the `notify_end_types` state. enum: - canceled - expired example: "canceled" type: string x-enum-varnames: - CANCELED - EXPIRED DowntimeNotifyEndStateTypes: description: State that will trigger a monitor notification when the `notify_end_types` action occurs. enum: - alert - no data - warn example: "alert" type: string x-enum-varnames: - ALERT - NO_DATA - WARN DowntimeNotifyEndStates: description: States that will trigger a monitor notification when the `notify_end_types` action occurs. example: ["alert", "warn"] items: $ref: "#/components/schemas/DowntimeNotifyEndStateTypes" type: array DowntimeNotifyEndTypes: description: Actions that will trigger a monitor notification if the downtime is in the `notify_end_types` state. example: ["canceled", "expired"] items: $ref: "#/components/schemas/DowntimeNotifyEndStateActions" type: array DowntimeRelationships: description: All relationships associated with downtime. properties: created_by: $ref: "#/components/schemas/DowntimeRelationshipsCreatedBy" monitor: $ref: "#/components/schemas/DowntimeRelationshipsMonitor" type: object DowntimeRelationshipsCreatedBy: description: The user who created the downtime. properties: data: $ref: "#/components/schemas/DowntimeRelationshipsCreatedByData" type: object DowntimeRelationshipsCreatedByData: description: Data for the user who created the downtime. nullable: true properties: id: description: User ID of the downtime creator. example: "00000000-0000-1234-0000-000000000000" type: string type: $ref: "#/components/schemas/UsersType" type: object DowntimeRelationshipsMonitor: description: The monitor identified by the downtime. properties: data: $ref: "#/components/schemas/DowntimeRelationshipsMonitorData" type: object DowntimeRelationshipsMonitorData: description: Data for the monitor. nullable: true properties: id: description: Monitor ID of the downtime. example: "12345" type: string type: $ref: "#/components/schemas/DowntimeIncludedMonitorType" type: object DowntimeResourceType: default: downtime description: Downtime resource type. enum: - downtime example: "downtime" type: string x-enum-varnames: - DOWNTIME DowntimeResponse: description: |- Downtiming gives you greater control over monitor notifications by allowing you to globally exclude scopes from alerting. Downtime settings, which can be scheduled with start and end times, prevent all alerting related to specified Datadog tags. properties: data: $ref: "#/components/schemas/DowntimeResponseData" included: description: Array of objects related to the downtime that the user requested. items: $ref: "#/components/schemas/DowntimeResponseIncludedItem" type: array type: object DowntimeResponseAttributes: description: Downtime details. properties: canceled: description: Time that the downtime was canceled. example: "2020-01-02T03:04:05.282979+0000" format: date-time nullable: true type: string created: description: Creation time of the downtime. example: "2020-01-02T03:04:05.282979+0000" format: date-time type: string display_timezone: $ref: "#/components/schemas/DowntimeDisplayTimezone" message: $ref: "#/components/schemas/DowntimeMessage" modified: description: Time that the downtime was last modified. example: "2020-01-02T03:04:05.282979+0000" format: date-time type: string monitor_identifier: $ref: "#/components/schemas/DowntimeMonitorIdentifier" mute_first_recovery_notification: $ref: "#/components/schemas/DowntimeMuteFirstRecoveryNotification" notify_end_states: $ref: "#/components/schemas/DowntimeNotifyEndStates" notify_end_types: $ref: "#/components/schemas/DowntimeNotifyEndTypes" run_as: $ref: "#/components/schemas/DowntimeRunAs" schedule: $ref: "#/components/schemas/DowntimeScheduleResponse" scope: $ref: "#/components/schemas/DowntimeScope" status: $ref: "#/components/schemas/DowntimeStatus" type: object DowntimeResponseData: description: Downtime data. properties: attributes: $ref: "#/components/schemas/DowntimeResponseAttributes" id: description: The downtime ID. example: "00000000-0000-1234-0000-000000000000" type: string relationships: $ref: "#/components/schemas/DowntimeRelationships" type: $ref: "#/components/schemas/DowntimeResourceType" type: object DowntimeResponseIncludedItem: description: An object related to a downtime. oneOf: - $ref: "#/components/schemas/User" - $ref: "#/components/schemas/DowntimeMonitorIncludedItem" DowntimeRunAs: description: |- The principals (users, roles, or teams) allowed to act on behalf of the downtime. **Note**: This feature is currently in Preview and may not be available for all organizations. items: $ref: "#/components/schemas/DowntimeRunAsItem" readOnly: true type: array DowntimeRunAsItem: description: A set of principals allowed to act on behalf of the downtime. properties: principals: description: List of principals allowed to act on behalf of the downtime. items: $ref: "#/components/schemas/DowntimeRunAsPrincipal" type: array type: object DowntimeRunAsPrincipal: description: A principal (user, role, or team) allowed to act on behalf of the downtime. properties: id: description: The ID of the principal. example: "00000000-0000-1234-0000-000000000000" type: string type: $ref: "#/components/schemas/DowntimeRunAsPrincipalType" required: - id - type type: object DowntimeRunAsPrincipalType: description: The type of principal allowed to act on behalf of the downtime. enum: - user - role - team example: "user" type: string x-enum-varnames: - USER - ROLE - TEAM DowntimeScheduleCreateRequest: description: Schedule for the downtime. oneOf: - $ref: "#/components/schemas/DowntimeScheduleRecurrencesCreateRequest" - $ref: "#/components/schemas/DowntimeScheduleOneTimeCreateUpdateRequest" DowntimeScheduleCurrentDowntimeResponse: description: |- The most recent actual start and end dates for a recurring downtime. For a canceled downtime, this is the previously occurring downtime. For active downtimes, this is the ongoing downtime, and for scheduled downtimes it is the upcoming downtime. properties: end: description: The end of the current downtime. example: 2020-01-02 03:04:00+00:00 format: date-time nullable: true type: string start: description: The start of the current downtime. example: 2020-01-02 03:04:00+00:00 format: date-time type: string type: object DowntimeScheduleOneTimeCreateUpdateRequest: additionalProperties: false description: A one-time downtime definition. properties: end: description: |- ISO-8601 Datetime to end the downtime. Must include a UTC offset of zero. If not provided, the downtime continues forever. example: 2020-01-02 03:04:00+00:00 format: date-time nullable: true type: string start: description: |- ISO-8601 Datetime to start the downtime. Must include a UTC offset of zero. If not provided, the downtime starts the moment it is created. example: 2020-01-02 03:04:00+00:00 format: date-time nullable: true type: string type: object DowntimeScheduleOneTimeResponse: description: A one-time downtime definition. properties: end: description: ISO-8601 Datetime to end the downtime. example: 2020-01-02 03:04:00+00:00 format: date-time nullable: true type: string start: description: ISO-8601 Datetime to start the downtime. example: 2020-01-02 03:04:00+00:00 format: date-time type: string required: - start type: object DowntimeScheduleRecurrenceCreateUpdateRequest: additionalProperties: {} description: An object defining the recurrence of the downtime. properties: duration: $ref: "#/components/schemas/DowntimeScheduleRecurrenceDuration" rrule: $ref: "#/components/schemas/DowntimeScheduleRecurrenceRrule" start: description: |- ISO-8601 Datetime to start the downtime. Must not include a UTC offset. If not provided, the downtime starts the moment it is created. example: 2020-01-02T03:04 nullable: true type: string required: - duration - rrule type: object DowntimeScheduleRecurrenceDuration: description: The length of the downtime. Must begin with an integer and end with one of 'm', 'h', d', or 'w'. example: 123d type: string DowntimeScheduleRecurrenceResponse: description: An RRULE-based recurring downtime. properties: duration: $ref: "#/components/schemas/DowntimeScheduleRecurrenceDuration" rrule: $ref: "#/components/schemas/DowntimeScheduleRecurrenceRrule" start: description: |- ISO-8601 Datetime to start the downtime. Must not include a UTC offset. If not provided, the downtime starts the moment it is created. example: 2020-01-02T03:04 type: string type: object DowntimeScheduleRecurrenceRrule: description: |- The `RRULE` standard for defining recurring events. For example, to have a recurring event on the first day of each month, set the type to `rrule` and set the `FREQ` to `MONTHLY` and `BYMONTHDAY` to `1`. Most common `rrule` options from the [iCalendar Spec](https://tools.ietf.org/html/rfc5545) are supported. **Note**: Attributes specifying the duration in `RRULE` are not supported (for example, `DTSTART`, `DTEND`, `DURATION`). More examples available in this [downtime guide](https://docs.datadoghq.com/monitors/guide/suppress-alert-with-downtimes/?tab=api). example: FREQ=MONTHLY;BYSETPOS=3;BYDAY=WE;INTERVAL=1 type: string DowntimeScheduleRecurrencesCreateRequest: description: A recurring downtime schedule definition. properties: recurrences: description: A list of downtime recurrences. items: $ref: "#/components/schemas/DowntimeScheduleRecurrenceCreateUpdateRequest" type: array timezone: default: UTC description: The timezone in which to schedule the downtime. example: America/New_York type: string required: - recurrences type: object DowntimeScheduleRecurrencesResponse: description: A recurring downtime schedule definition. properties: current_downtime: $ref: "#/components/schemas/DowntimeScheduleCurrentDowntimeResponse" recurrences: description: A list of downtime recurrences. items: $ref: "#/components/schemas/DowntimeScheduleRecurrenceResponse" maxItems: 5 minItems: 1 type: array timezone: default: UTC description: |- The timezone in which to schedule the downtime. This affects recurring start and end dates. Must match `display_timezone`. example: "America/New_York" type: string required: - recurrences type: object DowntimeScheduleRecurrencesUpdateRequest: additionalProperties: false description: A recurring downtime schedule definition. properties: recurrences: description: A list of downtime recurrences. items: $ref: "#/components/schemas/DowntimeScheduleRecurrenceCreateUpdateRequest" type: array timezone: default: UTC description: The timezone in which to schedule the downtime. example: America/New_York type: string type: object DowntimeScheduleResponse: description: |- The schedule that defines when the monitor starts, stops, and recurs. There are two types of schedules: one-time and recurring. Recurring schedules may have up to five RRULE-based recurrences. If no schedules are provided, the downtime will begin immediately and never end. oneOf: - $ref: "#/components/schemas/DowntimeScheduleRecurrencesResponse" - $ref: "#/components/schemas/DowntimeScheduleOneTimeResponse" DowntimeScheduleUpdateRequest: description: Schedule for the downtime. oneOf: - $ref: "#/components/schemas/DowntimeScheduleRecurrencesUpdateRequest" - $ref: "#/components/schemas/DowntimeScheduleOneTimeCreateUpdateRequest" DowntimeScope: description: |- The scope to which the downtime applies. Must follow the [common search syntax](https://docs.datadoghq.com/logs/explorer/search_syntax/). example: "env:(staging OR prod) AND datacenter:us-east-1" type: string DowntimeStatus: description: The current status of the downtime. enum: - active - canceled - ended - scheduled example: "active" type: string x-enum-varnames: - ACTIVE - CANCELED - ENDED - SCHEDULED DowntimeUpdateRequest: description: Request for editing a downtime. properties: data: $ref: "#/components/schemas/DowntimeUpdateRequestData" required: - data type: object DowntimeUpdateRequestAttributes: description: Attributes of the downtime to update. properties: display_timezone: $ref: "#/components/schemas/DowntimeDisplayTimezone" message: $ref: "#/components/schemas/DowntimeMessage" monitor_identifier: $ref: "#/components/schemas/DowntimeMonitorIdentifier" mute_first_recovery_notification: $ref: "#/components/schemas/DowntimeMuteFirstRecoveryNotification" notify_end_states: $ref: "#/components/schemas/DowntimeNotifyEndStates" notify_end_types: $ref: "#/components/schemas/DowntimeNotifyEndTypes" schedule: $ref: "#/components/schemas/DowntimeScheduleUpdateRequest" scope: $ref: "#/components/schemas/DowntimeScope" type: object DowntimeUpdateRequestData: description: Object to update a downtime. properties: attributes: $ref: "#/components/schemas/DowntimeUpdateRequestAttributes" id: description: ID of this downtime. example: "00000000-0000-1234-0000-000000000000" type: string type: $ref: "#/components/schemas/DowntimeResourceType" required: - id - type - attributes type: object DueDateFrom: description: The reference point from which the due date is calculated. When `fix_available` is selected but not applicable to the finding type, `first_seen` is used instead. enum: - first_seen - fix_available example: first_seen type: string x-enum-varnames: - FIRST_SEEN - FIX_AVAILABLE DueDatePerSeverityItem: description: A mapping of a severity level to the number of days until a finding is due. properties: due_in_days: description: The number of days from the reference point until the finding is due. example: 7 format: int64 maximum: 365 minimum: 1 type: integer severity: $ref: "#/components/schemas/DueDateSeverity" required: - severity - due_in_days type: object DueDatePerSeverityList: description: A list of severity-to-due-date mappings. Each severity may appear at most once. items: $ref: "#/components/schemas/DueDatePerSeverityItem" type: array DueDateRuleAction: description: The action to take when the due date rule matches a finding. properties: due_days_per_severity: $ref: "#/components/schemas/DueDatePerSeverityList" due_from: $ref: "#/components/schemas/DueDateFrom" reason_description: description: An optional description providing more context for the due date assignment. example: "Applied for production findings only" maxLength: 20000 type: string required: - due_days_per_severity - due_from type: object DueDateRuleAttributesCreate: description: Attributes for creating or updating a due date rule. properties: action: $ref: "#/components/schemas/DueDateRuleAction" enabled: description: Whether the due date rule is enabled. example: true type: boolean name: description: The name of the due date rule. example: "Critical findings due in 7 days" maxLength: 255 minLength: 1 type: string rule: $ref: "#/components/schemas/AutomationRuleScope" required: - name - rule - action type: object DueDateRuleAttributesResponse: description: Attributes of a due date rule returned by the API. properties: action: $ref: "#/components/schemas/DueDateRuleAction" created_at: description: The Unix timestamp in milliseconds when the rule was created. example: 1722439510282 format: int64 type: integer created_by: $ref: "#/components/schemas/AutomationRuleCreatedBy" enabled: description: Whether the due date rule is enabled. example: true type: boolean modified_at: description: The Unix timestamp in milliseconds when the rule was last modified. example: 1722439510282 format: int64 type: integer modified_by: $ref: "#/components/schemas/AutomationRuleModifiedBy" name: description: The name of the due date rule. example: "Critical findings due in 7 days" maxLength: 255 minLength: 1 type: string rule: $ref: "#/components/schemas/AutomationRuleScope" required: - name - enabled - rule - action - created_at - created_by - modified_at - modified_by type: object DueDateRuleCreateRequest: description: The body of a due date rule create request. properties: data: $ref: "#/components/schemas/DueDateRuleDataCreate" required: - data type: object DueDateRuleDataCreate: description: The data object for a due date rule create request. properties: attributes: $ref: "#/components/schemas/DueDateRuleAttributesCreate" type: $ref: "#/components/schemas/DueDateRuleType" required: - type - attributes type: object DueDateRuleDataResponse: description: The data object for a due date rule returned by the API. properties: attributes: $ref: "#/components/schemas/DueDateRuleAttributesResponse" id: description: The ID of the due date rule. example: "00000000-0000-0000-0000-000000000000" format: uuid type: string type: $ref: "#/components/schemas/DueDateRuleType" required: - id - type - attributes type: object DueDateRuleDataUpdate: description: The data object for a due date rule update request. The `id` must match the `rule_id` path parameter. properties: attributes: $ref: "#/components/schemas/DueDateRuleAttributesCreate" id: description: The ID of the due date rule to update. example: "00000000-0000-0000-0000-000000000000" format: uuid type: string type: $ref: "#/components/schemas/DueDateRuleType" required: - id - type - attributes type: object DueDateRuleReorderData: description: The ordered list of all due date rules. Every rule must be included. items: $ref: "#/components/schemas/DueDateRuleReorderItem" type: array DueDateRuleReorderItem: description: A reference to a due date rule used for reordering. properties: id: description: The ID of the due date rule. example: "00000000-0000-0000-0000-000000000000" format: uuid type: string type: $ref: "#/components/schemas/DueDateRuleType" required: - type - id type: object DueDateRuleReorderRequest: description: The body of a due date rule reorder request. properties: data: $ref: "#/components/schemas/DueDateRuleReorderData" required: - data type: object DueDateRuleReorderResponse: description: The response of a due date rule reorder request. properties: data: $ref: "#/components/schemas/DueDateRuleReorderData" required: - data type: object DueDateRuleResponse: description: A single due date rule response. properties: data: $ref: "#/components/schemas/DueDateRuleDataResponse" required: - data type: object DueDateRuleType: description: The JSON:API type for due date rules. enum: - due_date_rules example: due_date_rules type: string x-enum-varnames: - DUE_DATE_RULES DueDateRuleUpdateRequest: description: The body of a due date rule update request. properties: data: $ref: "#/components/schemas/DueDateRuleDataUpdate" required: - data type: object DueDateRulesDataList: description: A list of due date rule data objects. items: $ref: "#/components/schemas/DueDateRuleDataResponse" type: array DueDateRulesResponse: description: A list of due date rules with pagination metadata. properties: data: $ref: "#/components/schemas/DueDateRulesDataList" links: $ref: "#/components/schemas/SecurityAutomationRulesLinks" meta: $ref: "#/components/schemas/SecurityAutomationRulesMeta" required: - data - meta - links type: object DueDateSeverity: description: A severity level used to configure due date thresholds. enum: - critical - high - medium - low - info - none - unknown example: critical type: string x-enum-varnames: - CRITICAL - HIGH - MEDIUM - LOW - INFO - NONE - UNKNOWN ELFSourcemapAttributes: description: Attributes of an ELF symbol file. properties: arch: description: The target CPU architecture. example: arm64 type: string created_at: description: The timestamp when the symbol file was created. example: "2024-01-01T00:00:00Z" format: date-time type: string file_hash: description: The SHA256 hash of the ELF file. example: abc123def456 type: string file_name: description: The ELF file name. example: libmyapp.so type: string gnu_build_id: description: The GNU build ID (UUID format). example: 550e8400-e29b-41d4-a716-446655440000 type: string go_build_id: description: The Go build ID (UUID format). example: 550e8400-e29b-41d4-a716-446655440001 type: string mapkind: $ref: "#/components/schemas/ELFSourcemapMapKind" origin: description: The origin of the ELF file. example: debian type: string origin_version: description: The version of the origin package. example: 1.0.0 type: string size: description: The size of the ELF file in bytes. example: 16384 format: int64 type: integer symbol_source: description: The source of the debug symbols. example: debuginfo type: string required: - mapkind - size - created_at type: object ELFSourcemapData: description: ELF symbol file data object. properties: attributes: $ref: "#/components/schemas/ELFSourcemapAttributes" id: description: The unique identifier of the source map. example: "6" type: string type: $ref: "#/components/schemas/SourcemapDataType" required: - id - type - attributes type: object ELFSourcemapMapKind: description: The type of source map. Always `elf` for ELF source maps. enum: - elf example: elf type: string x-enum-varnames: - ELF EPSS: description: Vulnerability EPSS severity. properties: score: description: Vulnerability EPSS severity score. example: 0.2 format: double type: number severity: $ref: "#/components/schemas/VulnerabilitySeverity" required: - score - severity type: object ElasticCloudDetailedIndexStatsIntegrationDataflowRequest: additionalProperties: false description: Primary shard metrics broken down per index, rather than aggregated across the cluster. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean type: object ElasticCloudDetailedIndexStatsIntegrationDataflowResponse: description: Primary shard metrics broken down per index, rather than aggregated across the cluster. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean status: $ref: "#/components/schemas/IntegrationAccountDataflowStatus" type: object ElasticCloudIndexStatsIntegrationDataflowRequest: additionalProperties: false description: >- Metrics for individual indices. Only the indices granted to the role of the user in `authentication` are collected. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean type: object ElasticCloudIndexStatsIntegrationDataflowResponse: description: >- Metrics for individual indices. Only the indices granted to the role of the user in `authentication` are collected. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean status: $ref: "#/components/schemas/IntegrationAccountDataflowStatus" type: object ElasticCloudIntegrationAccountAuthenticationRequest: description: Authentication for creating the Elastic Cloud integration account. Exactly one method is set. oneOf: - $ref: "#/components/schemas/ElasticCloudIntegrationAccountBasicAuthRequest" ElasticCloudIntegrationAccountAuthenticationResponse: description: Authentication configured on the Elastic Cloud integration account. oneOf: - $ref: "#/components/schemas/ElasticCloudIntegrationAccountBasicAuthResponse" ElasticCloudIntegrationAccountAuthenticationUpdate: description: Authentication for updating the Elastic Cloud integration account. Exactly one method is set. oneOf: - $ref: "#/components/schemas/ElasticCloudIntegrationAccountBasicAuthUpdate" ElasticCloudIntegrationAccountBasicAuthRequest: additionalProperties: false description: Username and password authentication. properties: auth_type: $ref: "#/components/schemas/ElasticCloudIntegrationAccountBasicAuthType" password: description: Secret password or private key. example: your-password type: string writeOnly: true username: description: Non-secret username or public identifier for the credential pair. example: datadog type: string required: - auth_type - username - password type: object ElasticCloudIntegrationAccountBasicAuthResponse: description: The basic authentication method and username configured on the account. properties: auth_type: $ref: "#/components/schemas/ElasticCloudIntegrationAccountBasicAuthType" username: description: Non-secret username or public identifier for the credential pair. example: datadog type: string required: - auth_type - username type: object ElasticCloudIntegrationAccountBasicAuthType: default: basic description: The authentication method type. enum: - basic example: basic type: string x-enum-varnames: - BASIC ElasticCloudIntegrationAccountBasicAuthUpdate: additionalProperties: false description: Username and password authentication. Only the fields provided are changed; omit `password` to keep the stored one. properties: auth_type: $ref: "#/components/schemas/ElasticCloudIntegrationAccountBasicAuthType" password: description: Secret password or private key. example: your-password type: string writeOnly: true username: description: Non-secret username or public identifier for the credential pair. example: datadog type: string required: - auth_type type: object ElasticCloudIntegrationAccountCreateAttributes: description: Writable attributes used to create an Elastic Cloud integration account. properties: authentication: $ref: "#/components/schemas/ElasticCloudIntegrationAccountAuthenticationRequest" dataflows: $ref: "#/components/schemas/ElasticCloudIntegrationDataflowsRequest" name: description: Human-readable name of the Elastic Cloud integration account. example: elastic-cloud-prod type: string settings: $ref: "#/components/schemas/ElasticCloudIntegrationAccountSettingsRequest" required: - name - authentication - settings type: object ElasticCloudIntegrationAccountCreateData: description: Data envelope for creating an Elastic Cloud integration account. properties: attributes: $ref: "#/components/schemas/ElasticCloudIntegrationAccountCreateAttributes" type: $ref: "#/components/schemas/IntegrationAccountType" required: - type - attributes type: object ElasticCloudIntegrationAccountCreateRequest: description: Request payload to create an Elastic Cloud integration account. properties: data: $ref: "#/components/schemas/ElasticCloudIntegrationAccountCreateData" required: - data type: object ElasticCloudIntegrationAccountResponse: description: Response payload for a single Elastic Cloud integration account. properties: data: $ref: "#/components/schemas/ElasticCloudIntegrationAccountResponseData" required: - data type: object ElasticCloudIntegrationAccountResponseAttributes: description: Attributes of an Elastic Cloud integration account returned in responses. properties: authentication: $ref: "#/components/schemas/ElasticCloudIntegrationAccountAuthenticationResponse" dataflows: $ref: "#/components/schemas/ElasticCloudIntegrationDataflowsResponse" name: description: Human-readable name of the Elastic Cloud integration account. example: elastic-cloud-prod type: string settings: $ref: "#/components/schemas/ElasticCloudIntegrationAccountSettingsResponse" required: - name - settings type: object ElasticCloudIntegrationAccountResponseData: description: Data envelope of an Elastic Cloud integration account, including server-assigned identity. properties: attributes: $ref: "#/components/schemas/ElasticCloudIntegrationAccountResponseAttributes" id: description: Server-generated unique identifier of the Elastic Cloud integration account. example: 953a0060-81ec-4221-aed4-d4733b59cd96 readOnly: true type: string type: $ref: "#/components/schemas/IntegrationAccountType" required: - id - attributes - type type: object ElasticCloudIntegrationAccountSettingsRequest: additionalProperties: false description: Settings for creating the Elastic Cloud integration account. properties: tags: description: Comma-separated list of custom tags for this Elastic Cloud deployment. example: "env:prod,team:saasint" type: string url: description: Elastic Cloud deployment URL. example: "https://example.es.us-central1.gcp.cloud.es.io:9243" type: string required: - url type: object ElasticCloudIntegrationAccountSettingsResponse: description: Settings configured on the Elastic Cloud integration account. properties: tags: description: Comma-separated list of custom tags for this Elastic Cloud deployment. example: "env:prod,team:saasint" type: string url: description: Elastic Cloud deployment URL. example: "https://example.es.us-central1.gcp.cloud.es.io:9243" type: string required: - url type: object ElasticCloudIntegrationAccountSettingsUpdate: additionalProperties: false description: Settings for updating the Elastic Cloud integration account. Only the fields provided are changed. properties: tags: description: Comma-separated list of custom tags for this Elastic Cloud deployment. example: "env:prod,team:saasint" type: string url: description: Elastic Cloud deployment URL. example: "https://example.es.us-central1.gcp.cloud.es.io:9243" type: string type: object ElasticCloudIntegrationAccountUpdateAttributes: description: >- Writable attributes used to update an Elastic Cloud integration account. Every field is optional; only the fields provided are changed. When `dataflows` is provided, only the dataflow ids included in the request are modified; dataflows omitted from the map keep their current configuration. properties: authentication: $ref: "#/components/schemas/ElasticCloudIntegrationAccountAuthenticationUpdate" dataflows: $ref: "#/components/schemas/ElasticCloudIntegrationDataflowsRequest" name: description: Human-readable name of the Elastic Cloud integration account. example: elastic-cloud-prod type: string settings: $ref: "#/components/schemas/ElasticCloudIntegrationAccountSettingsUpdate" type: object ElasticCloudIntegrationAccountUpdateData: description: Data envelope for updating an Elastic Cloud integration account. properties: attributes: $ref: "#/components/schemas/ElasticCloudIntegrationAccountUpdateAttributes" id: description: Unique identifier of the Elastic Cloud integration account to update. example: 953a0060-81ec-4221-aed4-d4733b59cd96 type: string type: $ref: "#/components/schemas/IntegrationAccountType" required: - id - type - attributes type: object ElasticCloudIntegrationAccountUpdateRequest: description: Request payload to update an Elastic Cloud integration account. properties: data: $ref: "#/components/schemas/ElasticCloudIntegrationAccountUpdateData" required: - data type: object ElasticCloudIntegrationAccountsResponse: description: Response payload for a list of Elastic Cloud integration accounts. properties: data: description: List of Elastic Cloud integration accounts. items: $ref: "#/components/schemas/ElasticCloudIntegrationAccountResponseData" type: array required: - data type: object ElasticCloudIntegrationDataflowsRequest: additionalProperties: false description: >- Data Datadog collects from Elastic Cloud, keyed by dataflow id. Node-level cluster statistics are always collected; each dataflow here adds a further set of metrics on top of that baseline, so set `enabled` to start or stop it. Defaults listed on each dataflow apply when the account is created; on update, omitted fields keep their current values. Every dataflow queries the deployment as the user in `authentication`, so that user's role must hold the required Elasticsearch privileges; a dataflow enabled without them is stored but collects no data. properties: elastic-cloud-detailed-index-stats: $ref: "#/components/schemas/ElasticCloudDetailedIndexStatsIntegrationDataflowRequest" elastic-cloud-index-stats: $ref: "#/components/schemas/ElasticCloudIndexStatsIntegrationDataflowRequest" elastic-cloud-pending-task-stats: $ref: "#/components/schemas/ElasticCloudPendingTaskStatsIntegrationDataflowRequest" elastic-cloud-primary-shard-graceful-timeout: $ref: "#/components/schemas/ElasticCloudPrimaryShardGracefulTimeoutIntegrationDataflowRequest" elastic-cloud-primary-shard-stats: $ref: "#/components/schemas/ElasticCloudPrimaryShardStatsIntegrationDataflowRequest" elastic-cloud-shard-allocation-stats: $ref: "#/components/schemas/ElasticCloudShardAllocationStatsIntegrationDataflowRequest" elastic-cloud-slm-stats: $ref: "#/components/schemas/ElasticCloudSlmStatsIntegrationDataflowRequest" type: object ElasticCloudIntegrationDataflowsResponse: description: Data Datadog collects from Elastic Cloud, keyed by dataflow id. properties: elastic-cloud-detailed-index-stats: $ref: "#/components/schemas/ElasticCloudDetailedIndexStatsIntegrationDataflowResponse" elastic-cloud-index-stats: $ref: "#/components/schemas/ElasticCloudIndexStatsIntegrationDataflowResponse" elastic-cloud-metrics: $ref: "#/components/schemas/ElasticCloudMetricsIntegrationDataflowResponse" elastic-cloud-pending-task-stats: $ref: "#/components/schemas/ElasticCloudPendingTaskStatsIntegrationDataflowResponse" elastic-cloud-primary-shard-graceful-timeout: $ref: "#/components/schemas/ElasticCloudPrimaryShardGracefulTimeoutIntegrationDataflowResponse" elastic-cloud-primary-shard-stats: $ref: "#/components/schemas/ElasticCloudPrimaryShardStatsIntegrationDataflowResponse" elastic-cloud-shard-allocation-stats: $ref: "#/components/schemas/ElasticCloudShardAllocationStatsIntegrationDataflowResponse" elastic-cloud-slm-stats: $ref: "#/components/schemas/ElasticCloudSlmStatsIntegrationDataflowResponse" type: object ElasticCloudMetricsIntegrationDataflowResponse: description: >- Node-level statistics for the clusters in your deployment, such as the number of nodes and the number of documents on each node. This is the integration's baseline collection: it is always on and cannot be turned off, which is why it appears in responses only. properties: enabled: description: Whether Datadog collects this data. Always `true`, because this collection cannot be turned off. example: true readOnly: true type: boolean status: $ref: "#/components/schemas/IntegrationAccountDataflowStatus" type: object ElasticCloudPendingTaskStatsIntegrationDataflowRequest: additionalProperties: false description: Metrics for cluster-level changes that have been submitted but not yet executed. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean type: object ElasticCloudPendingTaskStatsIntegrationDataflowResponse: description: Metrics for cluster-level changes that have been submitted but not yet executed. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean status: $ref: "#/components/schemas/IntegrationAccountDataflowStatus" type: object ElasticCloudPrimaryShardGracefulTimeoutIntegrationDataflowRequest: additionalProperties: false description: >- Tolerance for slow primary shard requests. Primary shard metrics can grow large enough for the request to time out; enabling this keeps the rest of the collection running when that happens instead of failing the run. Only has an effect alongside `elastic-cloud-primary-shard-stats`. properties: enabled: description: Whether this tolerance is applied. Defaults to `false`; set to `true` to apply it. example: true type: boolean type: object ElasticCloudPrimaryShardGracefulTimeoutIntegrationDataflowResponse: description: >- Tolerance for slow primary shard requests, keeping the rest of the collection running when a primary shard request times out instead of failing the run. Only has an effect alongside `elastic-cloud-primary-shard-stats`. properties: enabled: description: Whether this tolerance is applied. example: true type: boolean status: $ref: "#/components/schemas/IntegrationAccountDataflowStatus" type: object ElasticCloudPrimaryShardStatsIntegrationDataflowRequest: additionalProperties: false description: Metrics covering only the cluster's primary shards. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean type: object ElasticCloudPrimaryShardStatsIntegrationDataflowResponse: description: Metrics covering only the cluster's primary shards. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean status: $ref: "#/components/schemas/IntegrationAccountDataflowStatus" type: object ElasticCloudShardAllocationStatsIntegrationDataflowRequest: additionalProperties: false description: Metrics for how many shards are allocated to each data node, and the disk space they use. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean type: object ElasticCloudShardAllocationStatsIntegrationDataflowResponse: description: Metrics for how many shards are allocated to each data node, and the disk space they use. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean status: $ref: "#/components/schemas/IntegrationAccountDataflowStatus" type: object ElasticCloudSlmStatsIntegrationDataflowRequest: additionalProperties: false description: >- Metrics about the actions taken by snapshot lifecycle management. Requires the `read_slm` Elasticsearch cluster privilege on the role of the user in `authentication`; without it this dataflow collects no data. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean type: object ElasticCloudSlmStatsIntegrationDataflowResponse: description: >- Metrics about the actions taken by snapshot lifecycle management. Requires the `read_slm` Elasticsearch cluster privilege on the role of the user in `authentication`; without it this dataflow collects no data. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean status: $ref: "#/components/schemas/IntegrationAccountDataflowStatus" type: object Enabled: description: Field used to enable or disable the rule. example: true type: boolean EntityAttributes: description: Entity attributes. properties: apiVersion: description: The API version. type: string description: description: The description. type: string displayName: description: The display name. type: string kind: description: The kind. type: string name: description: The name. type: string namespace: description: The namespace. type: string owner: description: The owner. type: string tags: description: The tags. items: description: A tag string in the format key:value. type: string type: array type: object EntityContextEntity: description: A single entity returned by the entity context endpoint. properties: attributes: $ref: "#/components/schemas/EntityContextEntityAttributes" id: description: The unique identifier of the entity. example: user@example.com type: string type: $ref: "#/components/schemas/SecurityMonitoringEntityContextEntityType" required: - id - type - attributes type: object EntityContextEntityAttributes: description: The attributes of an entity context entry, grouping all the historical revisions of the entity. properties: revisions: description: The historical revisions of the entity, ordered chronologically. items: $ref: "#/components/schemas/EntityContextRevision" type: array required: - revisions type: object EntityContextEntityType: default: siem_entity_identity description: The type of entity to retrieve. Only `siem_entity_identity` is currently supported. enum: [siem_entity_identity] example: siem_entity_identity type: string x-enum-varnames: [SIEM_ENTITY_IDENTITY] EntityContextPage: description: Pagination metadata for the entity context response. properties: next_token: description: An opaque token to pass as `page_token` in a subsequent request to retrieve the next page of results. Empty when there are no more results. example: "" type: string required: - next_token type: object EntityContextResponse: description: Response from the entity context endpoint, containing the matching entities and pagination metadata. properties: data: description: The list of entities matching the query. items: $ref: "#/components/schemas/EntityContextEntity" type: array meta: $ref: "#/components/schemas/EntityContextResponseMeta" required: - data - meta type: object EntityContextResponseMeta: description: Metadata returned alongside the entity context response. properties: page: $ref: "#/components/schemas/EntityContextPage" total_count: description: The total number of entities matching the query, irrespective of pagination. example: 1 format: int32 maximum: 2147483647 type: integer required: - page - total_count type: object EntityContextRevision: description: A single historical revision of an entity, including the time range during which the revision was observed. properties: attributes: $ref: "#/components/schemas/EntityContextRevisionAttributes" first_seen_at: description: The first time the entity was observed at this revision. example: "2026-04-01T00:00:00Z" format: date-time type: string last_seen_at: description: The last time the entity was observed at this revision. example: "2026-05-01T00:00:00Z" format: date-time type: string required: - attributes - first_seen_at - last_seen_at type: object EntityContextRevisionAttributes: additionalProperties: {} description: The set of attributes recorded for the entity at this revision. The keys depend on the kind of entity. example: accounts: - linked-account-123 display_name: Test User email: user@example.com principal_id: user@example.com type: object EntityContextRevisionsMode: default: latest description: |- Which revisions to return for each entity: `latest` returns only the latest revision of each entity as of `to`, and `all` returns every revision in the requested time range. enum: [latest, all] example: latest type: string x-enum-varnames: [LATEST, ALL] EntityData: description: Entity data. properties: attributes: $ref: "#/components/schemas/EntityAttributes" id: description: Entity ID. type: string meta: $ref: "#/components/schemas/EntityMeta" relationships: $ref: "#/components/schemas/EntityRelationships" type: description: Entity. type: string type: object EntityIntegrationConfigAttributes: description: The organization ID, integration identifier, and integration-specific configuration payload for an entity integration configuration. properties: config: $ref: "#/components/schemas/EntityIntegrationConfigPayload" integration_id: description: The identifier of the integration this configuration applies to (for example, `github`, `jira`, or `pagerduty`). example: github type: string org_id: description: The Datadog organization identifier that owns this configuration. example: 1234 format: int64 type: integer required: - org_id - integration_id - config type: object EntityIntegrationConfigData: description: JSON:API resource object for an entity integration configuration. properties: attributes: $ref: "#/components/schemas/EntityIntegrationConfigAttributes" id: description: Unique identifier of the entity integration configuration. example: 01HJABCD12345678ABCDEFGHIJ type: string type: $ref: "#/components/schemas/EntityIntegrationConfigType" required: - id - type - attributes type: object EntityIntegrationConfigPayload: additionalProperties: {} description: Integration-specific configuration payload. The shape of this object depends on the integration identified by the path parameter. For `github`, the object must contain an `enabled_repos` array. For `jira`, it must contain an `enabled_projects` array. For `pagerduty`, it must contain an `accounts` array. example: enabled_repos: - github_org_name: myorg hostname: github.com repo_name: myrepo type: object EntityIntegrationConfigRequest: description: Request body used to create or replace the configuration for a given integration. properties: data: $ref: "#/components/schemas/EntityIntegrationConfigRequestData" required: - data type: object EntityIntegrationConfigRequestAttributes: description: Attributes used to create or update an entity integration configuration. properties: config: $ref: "#/components/schemas/EntityIntegrationConfigPayload" required: - config type: object EntityIntegrationConfigRequestData: description: JSON:API resource object used in a request to create or update an entity integration configuration. properties: attributes: $ref: "#/components/schemas/EntityIntegrationConfigRequestAttributes" type: $ref: "#/components/schemas/EntityIntegrationConfigRequestType" required: - type - attributes type: object EntityIntegrationConfigRequestType: default: entity_integration_config_requests description: JSON:API resource type for the entity integration configuration create or update request. Always `entity_integration_config_requests`. enum: - entity_integration_config_requests example: entity_integration_config_requests type: string x-enum-varnames: - ENTITY_INTEGRATION_CONFIG_REQUESTS EntityIntegrationConfigResponse: description: JSON:API document containing a single entity integration configuration resource. properties: data: $ref: "#/components/schemas/EntityIntegrationConfigData" required: - data type: object EntityIntegrationConfigType: default: entity_integration_configs description: JSON:API resource type for an entity integration configuration. Always `entity_integration_configs`. enum: - entity_integration_configs example: entity_integration_configs type: string x-enum-varnames: - ENTITY_INTEGRATION_CONFIGS EntityMeta: description: Entity metadata. properties: createdAt: description: The creation time. type: string ingestionSource: description: The ingestion source. type: string modifiedAt: description: The modification time. type: string origin: description: The origin. type: string type: object EntityRaw: description: Entity definition in raw JSON or YAML representation. example: |- apiVersion: v3 kind: service metadata: name: myservice type: string EntityReference: description: The unique reference for an IDP entity. example: "service:my-service" type: string EntityRelationships: description: Entity relationships. properties: incidents: $ref: "#/components/schemas/EntityToIncidents" oncall: $ref: "#/components/schemas/EntityToOncalls" rawSchema: $ref: "#/components/schemas/EntityToRawSchema" relatedEntities: $ref: "#/components/schemas/EntityToRelatedEntities" schema: $ref: "#/components/schemas/EntityToSchema" type: object EntityResponseArray: description: Response object containing an array of entity data items. properties: data: description: Array of entity response data items. items: $ref: "#/components/schemas/PreviewEntityResponseData" type: array required: - data type: object EntityResponseData: description: List of entity data. items: $ref: "#/components/schemas/EntityData" type: array EntityResponseDataAttributes: description: Entity response attributes containing core entity metadata fields. properties: apiVersion: description: The API version of the entity schema. type: string description: description: A short description of the entity. type: string displayName: description: The user-friendly display name of the entity. type: string kind: description: The kind of the entity (e.g. service, datastore, queue). type: string name: description: The unique name of the entity within its kind and namespace. type: string namespace: description: The namespace the entity belongs to. type: string owner: description: The owner of the entity, usually a team. type: string properties: additionalProperties: {} description: Additional custom properties for the entity. type: object tags: description: A set of custom tags assigned to the entity. items: description: A tag string in the format key:value. type: string type: array type: object EntityResponseDataRelationships: description: Entity relationships including incidents, oncalls, schemas, and related entities. properties: incidents: $ref: "#/components/schemas/EntityResponseDataRelationshipsIncidents" oncalls: $ref: "#/components/schemas/EntityResponseDataRelationshipsOncalls" rawSchema: $ref: "#/components/schemas/EntityResponseDataRelationshipsRawSchema" relatedEntities: $ref: "#/components/schemas/EntityResponseDataRelationshipsRelatedEntities" schema: $ref: "#/components/schemas/EntityResponseDataRelationshipsSchema" type: object EntityResponseDataRelationshipsIncidents: description: Incidents relationship containing a list of incident resources associated with this entity. properties: data: description: List of incident relationship data items. items: $ref: "#/components/schemas/EntityResponseDataRelationshipsIncidentsDataItems" type: array type: object EntityResponseDataRelationshipsIncidentsDataItems: description: Incident relationship data item containing the incident resource identifier and type. properties: id: description: Incident resource unique identifier. example: "" type: string type: $ref: "#/components/schemas/EntityResponseDataRelationshipsIncidentsDataItemsType" required: - type - id type: object EntityResponseDataRelationshipsIncidentsDataItemsType: default: incident description: Incident resource type. enum: - incident example: incident type: string x-enum-varnames: - INCIDENT EntityResponseDataRelationshipsOncalls: description: Oncalls relationship containing a list of oncall resources associated with this entity. properties: data: description: List of oncall relationship data items. items: $ref: "#/components/schemas/EntityResponseDataRelationshipsOncallsDataItems" type: array type: object EntityResponseDataRelationshipsOncallsDataItems: description: Oncall relationship data item containing the oncall resource identifier and type. properties: id: description: Oncall resource unique identifier. example: "" type: string type: $ref: "#/components/schemas/EntityResponseDataRelationshipsOncallsDataItemsType" required: - type - id type: object EntityResponseDataRelationshipsOncallsDataItemsType: default: oncall description: Oncall resource type. enum: - oncall example: oncall type: string x-enum-varnames: - ONCALL EntityResponseDataRelationshipsRawSchema: description: Raw schema relationship linking an entity to its raw schema resource. properties: data: $ref: "#/components/schemas/EntityResponseDataRelationshipsRawSchemaData" required: - data type: object EntityResponseDataRelationshipsRawSchemaData: description: Raw schema relationship data containing the raw schema resource identifier and type. properties: id: description: Raw schema unique identifier. example: "" type: string type: $ref: "#/components/schemas/EntityResponseDataRelationshipsRawSchemaDataType" required: - type - id type: object EntityResponseDataRelationshipsRawSchemaDataType: default: rawSchema description: Raw schema resource type. enum: - rawSchema example: rawSchema type: string x-enum-varnames: - RAWSCHEMA EntityResponseDataRelationshipsRelatedEntities: description: Related entities relationship containing a list of entity references related to this entity. properties: data: description: List of related entity relationship data items. items: $ref: "#/components/schemas/EntityResponseDataRelationshipsRelatedEntitiesDataItems" type: array type: object EntityResponseDataRelationshipsRelatedEntitiesDataItems: description: Related entity relationship data item containing the related entity resource identifier and type. properties: id: description: Related entity unique identifier. example: "" type: string type: $ref: "#/components/schemas/EntityResponseDataRelationshipsRelatedEntitiesDataItemsType" required: - type - id type: object EntityResponseDataRelationshipsRelatedEntitiesDataItemsType: default: relatedEntity description: Related entity resource type. enum: - relatedEntity example: relatedEntity type: string x-enum-varnames: - RELATEDENTITY EntityResponseDataRelationshipsSchema: description: Schema relationship linking an entity to its associated schema resource. properties: data: $ref: "#/components/schemas/EntityResponseDataRelationshipsSchemaData" required: - data type: object EntityResponseDataRelationshipsSchemaData: description: Schema relationship data containing the schema resource identifier and type. properties: id: description: Entity schema unique identifier. example: "" type: string type: $ref: "#/components/schemas/EntityResponseDataRelationshipsSchemaDataType" required: - type - id type: object EntityResponseDataRelationshipsSchemaDataType: default: schema description: Schema resource type. enum: - schema example: schema type: string x-enum-varnames: - SCHEMA EntityResponseDataType: default: entity description: Entity resource type. enum: - entity example: entity type: string x-enum-varnames: - ENTITY EntityResponseIncludedIncident: description: Included incident. properties: attributes: $ref: "#/components/schemas/EntityResponseIncludedRelatedIncidentAttributes" id: description: Incident ID. type: string type: $ref: "#/components/schemas/EntityResponseIncludedIncidentType" type: object EntityResponseIncludedIncidentType: description: Incident description. enum: - incident type: string x-enum-varnames: - INCIDENT EntityResponseIncludedOncall: description: Included oncall. properties: attributes: $ref: "#/components/schemas/EntityResponseIncludedRelatedOncallAttributes" id: description: Oncall ID. type: string type: $ref: "#/components/schemas/EntityResponseIncludedOncallType" type: object EntityResponseIncludedOncallType: description: Oncall type. enum: - oncall type: string x-enum-varnames: - ONCALL EntityResponseIncludedRawSchema: description: Included raw schema. properties: attributes: $ref: "#/components/schemas/EntityResponseIncludedRawSchemaAttributes" id: description: Raw schema ID. type: string type: $ref: "#/components/schemas/EntityResponseIncludedRawSchemaType" type: object EntityResponseIncludedRawSchemaAttributes: description: Included raw schema attributes. properties: rawSchema: description: Schema from user input in base64 encoding. type: string type: object EntityResponseIncludedRawSchemaType: description: Raw schema type. enum: - rawSchema type: string x-enum-varnames: - RAW_SCHEMA EntityResponseIncludedRelatedEntity: description: Included related entity. properties: attributes: $ref: "#/components/schemas/EntityResponseIncludedRelatedEntityAttributes" id: description: Entity UUID. type: string meta: $ref: "#/components/schemas/EntityResponseIncludedRelatedEntityMeta" type: $ref: "#/components/schemas/EntityResponseIncludedRelatedEntityType" type: object EntityResponseIncludedRelatedEntityAttributes: description: Related entity attributes. properties: kind: description: Entity kind. type: string name: description: Entity name. type: string namespace: description: Entity namespace. type: string type: description: Entity relation type to the associated entity. type: string type: object EntityResponseIncludedRelatedEntityMeta: description: Included related entity meta. properties: createdAt: description: Entity creation time. format: date-time type: string defined_by: description: Entity relation defined by. type: string modifiedAt: description: Entity modification time. format: date-time type: string source: description: Entity relation source. type: string type: object EntityResponseIncludedRelatedEntityType: description: Related entity. enum: - relatedEntity type: string x-enum-varnames: - RELATED_ENTITY EntityResponseIncludedRelatedIncidentAttributes: description: Incident attributes. properties: createdAt: description: Incident creation time. format: date-time type: string htmlURL: description: Incident URL. type: string provider: description: Incident provider. type: string status: description: Incident status. type: string title: description: Incident title. type: string type: object EntityResponseIncludedRelatedOncallAttributes: description: Included related oncall attributes. properties: escalations: $ref: "#/components/schemas/EntityResponseIncludedRelatedOncallEscalations" provider: description: Oncall provider. type: string type: object EntityResponseIncludedRelatedOncallEscalationItem: description: Oncall escalation. properties: email: description: Oncall email. type: string escalationLevel: description: Oncall level. format: int64 type: integer name: description: Oncall name. type: string type: object EntityResponseIncludedRelatedOncallEscalations: description: Oncall escalations. items: $ref: "#/components/schemas/EntityResponseIncludedRelatedOncallEscalationItem" type: array EntityResponseIncludedSchema: description: Included detail entity schema. properties: attributes: $ref: "#/components/schemas/EntityResponseIncludedSchemaAttributes" id: description: Entity ID. type: string type: $ref: "#/components/schemas/EntityResponseIncludedSchemaType" type: object EntityResponseIncludedSchemaAttributes: description: Included schema. properties: schema: $ref: "#/components/schemas/EntityV3" type: object EntityResponseIncludedSchemaType: description: Schema type. enum: - schema type: string x-enum-varnames: - SCHEMA EntityResponseMeta: description: Entity metadata. properties: count: description: Total entities count. format: int64 type: integer includeCount: description: Total included data count. format: int64 type: integer type: object EntityToIncidents: description: Entity to incidents relationship. properties: data: $ref: "#/components/schemas/RelationshipArray" type: object EntityToOncalls: description: Entity to oncalls relationship. properties: data: $ref: "#/components/schemas/RelationshipArray" type: object EntityToRawSchema: description: Entity to raw schema relationship. properties: data: $ref: "#/components/schemas/RelationshipItem" type: object EntityToRelatedEntities: description: Entity to related entities relationship. properties: data: $ref: "#/components/schemas/RelationshipArray" type: object EntityToSchema: description: Entity to detail schema relationship. properties: data: $ref: "#/components/schemas/RelationshipItem" type: object EntityV3: description: Entity schema v3. oneOf: - $ref: "#/components/schemas/EntityV3Service" - $ref: "#/components/schemas/EntityV3Datastore" - $ref: "#/components/schemas/EntityV3Queue" - $ref: "#/components/schemas/EntityV3System" - $ref: "#/components/schemas/EntityV3API" EntityV3API: additionalProperties: false description: Schema for API entities. properties: apiVersion: $ref: "#/components/schemas/EntityV3APIVersion" datadog: $ref: "#/components/schemas/EntityV3APIDatadog" extensions: additionalProperties: {} description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field. type: object integrations: $ref: "#/components/schemas/EntityV3Integrations" kind: $ref: "#/components/schemas/EntityV3APIKind" metadata: $ref: "#/components/schemas/EntityV3Metadata" spec: $ref: "#/components/schemas/EntityV3APISpec" required: - apiVersion - kind - metadata type: object EntityV3APIDatadog: additionalProperties: false description: Datadog product integrations for the API entity. properties: codeLocations: $ref: "#/components/schemas/EntityV3DatadogCodeLocations" events: $ref: "#/components/schemas/EntityV3DatadogEvents" logs: $ref: "#/components/schemas/EntityV3DatadogLogs" performanceData: $ref: "#/components/schemas/EntityV3DatadogPerformance" pipelines: $ref: "#/components/schemas/EntityV3DatadogPipelines" type: object EntityV3APIKind: description: The definition of Entity V3 API Kind object. enum: - api example: api type: string x-enum-varnames: - API EntityV3APISpec: additionalProperties: false description: The definition of Entity V3 API Spec object. properties: implementedBy: description: Services which implemented the API. items: description: A service entity reference string. type: string type: array interface: $ref: "#/components/schemas/EntityV3APISpecInterface" lifecycle: description: The lifecycle state of the component. minLength: 1 type: string tier: description: The importance of the component. minLength: 1 type: string type: description: The type of API. type: string type: object EntityV3APISpecInterface: additionalProperties: false description: The API definition. oneOf: - $ref: "#/components/schemas/EntityV3APISpecInterfaceFileRef" - $ref: "#/components/schemas/EntityV3APISpecInterfaceDefinition" EntityV3APISpecInterfaceDefinition: additionalProperties: false description: The definition of `EntityV3APISpecInterfaceDefinition` object. properties: definition: description: The API definition. type: object type: object EntityV3APISpecInterfaceFileRef: additionalProperties: false description: The definition of `EntityV3APISpecInterfaceFileRef` object. properties: fileRef: description: The reference to the API definition file. type: string type: object EntityV3APIVersion: description: The version of the schema data that was used to populate this entity's data. This could be via the API, Terraform, or YAML file in a repository. The field is known as schema-version in the previous version. enum: - v3 - v2.2 - v2.1 - v2 example: v3 type: string x-enum-varnames: - V3 - V2_2 - V2_1 - V2 EntityV3DatadogCodeLocationItem: additionalProperties: false description: Code location item. properties: paths: description: The paths (glob) to the source code of the service. items: description: A glob pattern path to source code files. type: string type: array repositoryURL: description: The repository path of the source code of the entity. type: string type: object EntityV3DatadogCodeLocations: additionalProperties: false description: Schema for mapping source code locations to an entity. items: $ref: "#/components/schemas/EntityV3DatadogCodeLocationItem" type: array EntityV3DatadogEventItem: additionalProperties: false description: Events association item. properties: name: description: The name of the query. type: string query: description: The query to run. type: string type: object EntityV3DatadogEvents: additionalProperties: false description: Events associations. items: $ref: "#/components/schemas/EntityV3DatadogEventItem" type: array EntityV3DatadogIntegrationOpsgenie: additionalProperties: false description: An Opsgenie integration schema. properties: region: description: The region for the Opsgenie integration. minLength: 1 type: string serviceURL: description: The service URL for the Opsgenie integration. example: "https://www.opsgenie.com/service/shopping-cart" minLength: 1 type: string required: - serviceURL type: object EntityV3DatadogIntegrationPagerduty: additionalProperties: false description: A PagerDuty integration schema. properties: serviceURL: description: The service URL for the PagerDuty integration. example: "https://www.pagerduty.com/service-directory/Pshopping-cart" minLength: 1 type: string required: - serviceURL type: object EntityV3DatadogLogItem: additionalProperties: false description: Log association item. properties: name: description: The name of the query. type: string query: description: The query to run. type: string type: object EntityV3DatadogLogs: additionalProperties: false description: Logs association. items: $ref: "#/components/schemas/EntityV3DatadogLogItem" type: array EntityV3DatadogPerformance: additionalProperties: false description: Performance stats association. properties: tags: description: A list of APM entity tags that associates the APM Stats data with the entity. items: description: An APM tag string in the format key:value. type: string type: array type: object EntityV3DatadogPipelines: additionalProperties: false description: CI Pipelines association. properties: fingerprints: description: A list of CI Fingerprints that associate CI Pipelines with the entity. items: description: A CI pipeline fingerprint string. type: string type: array type: object EntityV3Datastore: additionalProperties: false description: Schema for datastore entities. properties: apiVersion: $ref: "#/components/schemas/EntityV3APIVersion" datadog: $ref: "#/components/schemas/EntityV3DatastoreDatadog" extensions: additionalProperties: {} description: Custom extensions. This is the free-formed field to send client side metadata. No Datadog features are affected by this field. type: object integrations: $ref: "#/components/schemas/EntityV3Integrations" kind: $ref: "#/components/schemas/EntityV3DatastoreKind" metadata: $ref: "#/components/schemas/EntityV3Metadata" spec: $ref: "#/components/schemas/EntityV3DatastoreSpec" required: - apiVersion - kind - metadata type: object EntityV3DatastoreDatadog: additionalProperties: false description: Datadog product integrations for the datastore entity. properties: events: $ref: "#/components/schemas/EntityV3DatadogEvents" logs: $ref: "#/components/schemas/EntityV3DatadogLogs" performanceData: $ref: "#/components/schemas/EntityV3DatadogPerformance" type: object EntityV3DatastoreKind: description: The definition of Entity V3 Datastore Kind object. enum: - datastore example: datastore type: string x-enum-varnames: - DATASTORE EntityV3DatastoreSpec: additionalProperties: false description: The definition of Entity V3 Datastore Spec object. properties: componentOf: description: A list of components the datastore is a part of items: description: A component entity reference string. type: string type: array lifecycle: description: The lifecycle state of the datastore. minLength: 1 type: string tier: description: The importance of the datastore. minLength: 1 type: string type: description: The type of datastore. type: string type: object EntityV3Integrations: additionalProperties: false description: A base schema for defining third-party integrations. properties: opsgenie: $ref: "#/components/schemas/EntityV3DatadogIntegrationOpsgenie" pagerduty: $ref: "#/components/schemas/EntityV3DatadogIntegrationPagerduty" type: object EntityV3Metadata: additionalProperties: false description: The definition of Entity V3 Metadata object. properties: additionalOwners: additionalProperties: false description: The additional owners of the entity, usually a team. items: $ref: "#/components/schemas/EntityV3MetadataAdditionalOwnersItems" type: array contacts: additionalProperties: false description: A list of contacts for the entity. items: $ref: "#/components/schemas/EntityV3MetadataContactsItems" type: array description: description: Short description of the entity. The UI can leverage the description for display. type: string displayName: description: User friendly name of the entity. The UI can leverage the display name for display. type: string id: description: A read-only globally unique identifier for the entity generated by Datadog. User supplied values are ignored. example: 4b163705-23c0-4573-b2fb-f6cea2163fcb minLength: 1 type: string inheritFrom: description: The entity reference from which to inherit metadata example: application:default/myapp type: string links: additionalProperties: false description: A list of links for the entity. items: $ref: "#/components/schemas/EntityV3MetadataLinksItems" type: array managed: additionalProperties: {} description: A read-only set of Datadog managed attributes generated by Datadog. User supplied values are ignored. type: object name: description: "Unique name given to an entity under the kind/namespace." example: myService minLength: 1 type: string namespace: description: "Namespace is a part of unique identifier. It has a default value of 'default'." example: default minLength: 1 type: string owner: description: The owner of the entity, usually a team. type: string tags: description: A set of custom tags. example: [this:tag, that:tag] items: description: A tag string in the format key:value. type: string type: array required: - name type: object EntityV3MetadataAdditionalOwnersItems: description: The definition of Entity V3 Metadata Additional Owners Items object. properties: name: description: Team name. example: "" type: string type: description: Team type. type: string required: - name type: object EntityV3MetadataContactsItems: additionalProperties: false description: The definition of Entity V3 Metadata Contacts Items object. properties: contact: description: Contact value. example: "https://slack/" type: string name: description: Contact name. minLength: 2 type: string type: description: Contact type. example: slack type: string required: - type - contact type: object EntityV3MetadataLinksItems: additionalProperties: false description: The definition of Entity V3 Metadata Links Items object. properties: name: description: Link name. example: mylink type: string provider: description: Link provider. type: string type: default: other description: Link type. example: link type: string url: description: Link URL. example: "https://mylink" type: string required: - name - type - url type: object EntityV3Queue: additionalProperties: false description: Schema for queue entities. properties: apiVersion: $ref: "#/components/schemas/EntityV3APIVersion" datadog: $ref: "#/components/schemas/EntityV3QueueDatadog" extensions: additionalProperties: {} description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field. type: object integrations: $ref: "#/components/schemas/EntityV3Integrations" kind: $ref: "#/components/schemas/EntityV3QueueKind" metadata: $ref: "#/components/schemas/EntityV3Metadata" spec: $ref: "#/components/schemas/EntityV3QueueSpec" required: - apiVersion - kind - metadata type: object EntityV3QueueDatadog: additionalProperties: false description: Datadog product integrations for the datastore entity. properties: events: $ref: "#/components/schemas/EntityV3DatadogEvents" logs: $ref: "#/components/schemas/EntityV3DatadogLogs" performanceData: $ref: "#/components/schemas/EntityV3DatadogPerformance" type: object EntityV3QueueKind: description: The definition of Entity V3 Queue Kind object. enum: - queue example: queue type: string x-enum-varnames: - QUEUE EntityV3QueueSpec: additionalProperties: false description: The definition of Entity V3 Queue Spec object. properties: componentOf: description: A list of components the queue is a part of items: description: A component entity reference string. type: string type: array lifecycle: description: The lifecycle state of the queue. minLength: 1 type: string tier: description: The importance of the queue. minLength: 1 type: string type: description: The type of queue. type: string type: object EntityV3Service: additionalProperties: false description: Schema for service entities. properties: apiVersion: $ref: "#/components/schemas/EntityV3APIVersion" datadog: $ref: "#/components/schemas/EntityV3ServiceDatadog" extensions: additionalProperties: {} description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field. type: object integrations: $ref: "#/components/schemas/EntityV3Integrations" kind: $ref: "#/components/schemas/EntityV3ServiceKind" metadata: $ref: "#/components/schemas/EntityV3Metadata" spec: $ref: "#/components/schemas/EntityV3ServiceSpec" required: - apiVersion - kind - metadata type: object EntityV3ServiceDatadog: additionalProperties: false description: Datadog product integrations for the service entity. properties: codeLocations: $ref: "#/components/schemas/EntityV3DatadogCodeLocations" events: $ref: "#/components/schemas/EntityV3DatadogEvents" logs: $ref: "#/components/schemas/EntityV3DatadogLogs" performanceData: $ref: "#/components/schemas/EntityV3DatadogPerformance" pipelines: $ref: "#/components/schemas/EntityV3DatadogPipelines" type: object EntityV3ServiceKind: description: The definition of Entity V3 Service Kind object. enum: - service example: service type: string x-enum-varnames: - SERVICE EntityV3ServiceSpec: additionalProperties: false description: The definition of Entity V3 Service Spec object. properties: componentOf: description: A list of components the service is a part of items: description: A component entity reference string. type: string type: array dependsOn: description: A list of components the service depends on. items: description: A component entity reference string. type: string type: array languages: description: The service's programming language. items: description: A programming language name. type: string type: array lifecycle: description: The lifecycle state of the component. minLength: 1 type: string tier: description: The importance of the component. minLength: 1 type: string type: description: The type of service. type: string type: object EntityV3System: additionalProperties: false description: Schema for system entities. properties: apiVersion: $ref: "#/components/schemas/EntityV3APIVersion" datadog: $ref: "#/components/schemas/EntityV3SystemDatadog" extensions: additionalProperties: {} description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field. type: object integrations: $ref: "#/components/schemas/EntityV3Integrations" kind: $ref: "#/components/schemas/EntityV3SystemKind" metadata: $ref: "#/components/schemas/EntityV3Metadata" spec: $ref: "#/components/schemas/EntityV3SystemSpec" required: - apiVersion - kind - metadata type: object EntityV3SystemDatadog: additionalProperties: false description: Datadog product integrations for the service entity. properties: events: $ref: "#/components/schemas/EntityV3DatadogEvents" logs: $ref: "#/components/schemas/EntityV3DatadogLogs" performanceData: $ref: "#/components/schemas/EntityV3DatadogPerformance" pipelines: $ref: "#/components/schemas/EntityV3DatadogPipelines" type: object EntityV3SystemKind: description: The definition of Entity V3 System Kind object. enum: - system example: system type: string x-enum-varnames: - SYSTEM EntityV3SystemSpec: additionalProperties: false description: The definition of Entity V3 System Spec object. properties: components: description: A list of components belongs to the system. items: description: A component entity reference string. type: string type: array lifecycle: description: The lifecycle state of the component. minLength: 1 type: string tier: description: An entity reference to the owner of the component. minLength: 1 type: string type: object Environment: description: A feature flag environment resource. properties: attributes: $ref: "#/components/schemas/EnvironmentAttributes" id: description: The unique identifier of the environment. example: "550e8400-e29b-41d4-a716-446655440001" format: uuid type: string type: $ref: "#/components/schemas/CreateEnvironmentDataType" required: - id - type - attributes type: object EnvironmentAttributes: description: Attributes of an environment. properties: created_at: description: The timestamp when the environment was created. example: "2023-01-01T00:00:00Z" format: date-time type: string description: description: The description of the environment. example: "Test environment XYZ789" nullable: true type: string is_production: description: Indicates whether this is a production environment. example: false type: boolean key: description: The unique key of the environment. example: "env-search-term" type: string name: description: The name of the environment. example: "env-search-term" type: string observe_full_evaluation_data: description: >- Indicates whether feature flag evaluation events include original targeting identifiers and full evaluation context. example: false type: boolean queries: description: List of queries to define the environment scope. example: ["staging", "test"] items: description: A query string used to match the environment scope. type: string minItems: 1 type: array require_feature_flag_approval: description: Indicates whether feature flag changes require approval in this environment. example: false type: boolean updated_at: description: The timestamp when the environment was last updated. example: "2023-01-01T00:00:00Z" format: date-time type: string required: - name type: object EnvironmentResponse: description: Response containing an environment. properties: data: $ref: "#/components/schemas/Environment" required: - data type: object EnvironmentsPaginationMeta: description: Pagination metadata for environments. properties: page: $ref: "#/components/schemas/EnvironmentsPaginationMetaPage" type: object EnvironmentsPaginationMetaPage: description: Pagination metadata for environments list responses. properties: total_count: description: Total number of items. example: 10 format: int64 type: integer total_filtered_count: description: Total number of items matching the filter. example: 5 format: int64 type: integer type: object ErrorHandler: additionalProperties: false description: Used to handle errors in an action. properties: fallbackStepName: description: The `ErrorHandler` `fallbackStepName`. example: "" type: string retryStrategy: $ref: "#/components/schemas/RetryStrategy" required: - retryStrategy - fallbackStepName type: object Escalation: description: Represents an escalation policy step. properties: id: description: Unique identifier of the escalation step. type: string relationships: $ref: "#/components/schemas/EscalationRelationships" type: $ref: "#/components/schemas/EscalationType" required: - type type: object EscalationPolicies: description: "A paginated list of escalation policies, with any related resources requested through `include`." properties: data: description: "A list of escalation policies." items: $ref: "#/components/schemas/EscalationPolicyListItem" type: array included: description: "Provides any included related resources, such as teams, steps, or targets, returned with the policies." items: $ref: "#/components/schemas/EscalationPolicyIncluded" type: array meta: $ref: "#/components/schemas/EscalationPoliciesResponseMeta" required: - data type: object EscalationPoliciesResponseMeta: description: Metadata included in the response when listing escalation policies. properties: page: $ref: "#/components/schemas/EscalationPoliciesResponseMetaPage" type: object EscalationPoliciesResponseMetaPage: description: Pagination metadata included in the response when listing escalation policies. properties: first_number: description: First page number. format: int64 type: integer last_number: description: Last page number. format: int64 type: integer next_number: description: Next page number. format: int64 nullable: true type: integer number: description: Page number. format: int64 type: integer prev_number: description: Previous page number. format: int64 nullable: true type: integer size: description: Page size. format: int64 type: integer total: description: Total number of results. format: int64 type: integer type: description: Pagination type. example: "number_size" type: string type: object EscalationPolicy: description: "Represents a complete escalation policy response, including policy data and optionally included related resources." example: data: attributes: name: Escalation Policy 1 resolve_page_on_policy_end: true retries: 2 id: 00000000-aba1-0000-0000-000000000000 relationships: steps: data: - id: 00000000-aba1-0000-0000-000000000000 type: steps teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: policies included: - attributes: avatar: "" description: Team 1 description handle: team1 name: Team 1 id: 00000000-da3a-0000-0000-000000000000 type: teams - attributes: assignment: default escalate_after_seconds: 3600 id: 00000000-aba1-0000-0000-000000000000 relationships: targets: data: - id: 00000000-aba1-0000-0000-000000000000 type: users - id: 00000000-aba2-0000-0000-000000000000 type: schedules - id: 00000000-aba2-0000-0000-000000000000_previous type: schedule_target - id: 00000000-aba3-0000-0000-000000000000 type: teams type: steps - id: 00000000-aba1-0000-0000-000000000000 type: users - id: 00000000-aba2-0000-0000-000000000000 type: schedules - attributes: position: previous id: 00000000-aba2-0000-0000-000000000000_previous relationships: schedule: data: id: 00000000-aba2-0000-0000-000000000000 type: schedules type: schedule_target - id: 00000000-aba3-0000-0000-000000000000 type: teams properties: data: $ref: "#/components/schemas/EscalationPolicyData" included: description: "Provides any included related resources, such as steps or targets, returned with the policy." items: $ref: "#/components/schemas/EscalationPolicyIncluded" type: array type: object EscalationPolicyCreateRequest: description: "Represents a request to create a new escalation policy, including the policy data." example: data: attributes: name: Escalation Policy 1 resolve_page_on_policy_end: true retries: 2 steps: - assignment: default escalate_after_seconds: 3600 targets: - id: 00000000-aba1-0000-0000-000000000000 type: users - config: schedule: position: previous id: 00000000-aba2-0000-0000-000000000000 type: schedules - id: 00000000-aba3-0000-0000-000000000000 type: teams - assignment: round-robin escalate_after_seconds: 3600 targets: - id: 00000000-aba1-0000-0000-000000000000 type: users - id: 00000000-abb1-0000-0000-000000000000 type: users relationships: teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: policies properties: data: $ref: "#/components/schemas/EscalationPolicyCreateRequestData" required: - data type: object EscalationPolicyCreateRequestData: description: "Represents the data for creating an escalation policy, including its attributes, relationships, and resource type." properties: attributes: $ref: "#/components/schemas/EscalationPolicyCreateRequestDataAttributes" relationships: $ref: "#/components/schemas/EscalationPolicyCreateRequestDataRelationships" type: $ref: "#/components/schemas/EscalationPolicyCreateRequestDataType" required: - type - attributes type: object EscalationPolicyCreateRequestDataAttributes: description: "Defines the attributes for creating an escalation policy, including its description, name, resolution behavior, retries, and steps." properties: name: description: "Specifies the name for the new escalation policy." example: "On-Call Escalation Policy" minLength: 1 type: string resolve_page_on_policy_end: description: "Indicates whether the Page is automatically resolved when the policy ends." type: boolean retries: description: "Specifies how many times the escalation sequence is retried if there is no response." format: int64 maximum: 10 minimum: 0 type: integer steps: description: "A list of escalation steps, each defining assignment, escalation timeout, and targets for the new policy." items: $ref: "#/components/schemas/EscalationPolicyCreateRequestDataAttributesStepsItems" maxItems: 10 minItems: 1 type: array required: - name - steps type: object EscalationPolicyCreateRequestDataAttributesStepsItems: description: "Defines a single escalation step within an escalation policy creation request. Contains assignment strategy, escalation timeout, and a list of targets." properties: assignment: $ref: "#/components/schemas/EscalationPolicyStepAttributesAssignment" escalate_after_seconds: description: "Defines how many seconds to wait before escalating to the next step." example: 3600 format: int64 maximum: 36000 minimum: 60 type: integer targets: description: "Specifies the collection of escalation targets for this step." example: - "users" items: $ref: "#/components/schemas/EscalationPolicyStepTarget" type: array required: - targets type: object EscalationPolicyCreateRequestDataRelationships: description: "Represents relationships in an escalation policy creation request, including references to teams." properties: teams: $ref: "#/components/schemas/DataRelationshipsTeams" type: object EscalationPolicyCreateRequestDataType: default: policies description: "Indicates that the resource is of type `policies`." enum: - policies example: policies type: string x-enum-varnames: - POLICIES EscalationPolicyData: description: "Represents the data for a single escalation policy, including its attributes, ID, relationships, and resource type." properties: attributes: $ref: "#/components/schemas/EscalationPolicyDataAttributes" id: description: "Specifies the unique identifier of the escalation policy." example: "ab000000-0000-0000-0000-000000000000" type: string relationships: $ref: "#/components/schemas/EscalationPolicyDataRelationships" type: $ref: "#/components/schemas/EscalationPolicyDataType" required: - type type: object EscalationPolicyDataAttributes: description: "Defines the main attributes of an escalation policy, such as its name and behavior on policy end." properties: name: description: "Specifies the name of the escalation policy." example: "On-Call Escalation Policy" minLength: 1 type: string resolve_page_on_policy_end: description: "Indicates whether the Page is automatically resolved when the policy ends." type: boolean retries: description: "Specifies how many times the escalation sequence is retried if there is no response." format: int64 maximum: 10 minimum: 0 type: integer tags: description: "A list of tags attached to the escalation policy, in `key:value` format." example: - "env:prod" items: description: "A tag in `key:value` format." type: string type: array required: - name type: object EscalationPolicyDataRelationships: description: "Represents the relationships for an escalation policy, including references to steps and teams." properties: steps: $ref: "#/components/schemas/EscalationPolicyDataRelationshipsSteps" teams: $ref: "#/components/schemas/DataRelationshipsTeams" required: - steps type: object EscalationPolicyDataRelationshipsSteps: description: "Defines the relationship to a collection of steps within an escalation policy. Contains an array of step data references." properties: data: description: "An array of references to the steps defined in this escalation policy." items: $ref: "#/components/schemas/EscalationPolicyDataRelationshipsStepsDataItems" type: array type: object EscalationPolicyDataRelationshipsStepsDataItems: description: "Defines a relationship to a single step within an escalation policy. Contains the step's `id` and `type`." properties: id: description: "Specifies the unique identifier for the step resource." example: "00000000-aba1-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/EscalationPolicyDataRelationshipsStepsDataItemsType" required: - type - id type: object EscalationPolicyDataRelationshipsStepsDataItemsType: default: steps description: "Indicates that the resource is of type `steps`." enum: - steps example: steps type: string x-enum-varnames: - STEPS EscalationPolicyDataType: default: policies description: "Indicates that the resource is of type `policies`." enum: - policies example: policies type: string x-enum-varnames: - POLICIES EscalationPolicyIncluded: description: "Represents included related resources when retrieving an escalation policy, such as teams, steps, or targets." oneOf: - $ref: "#/components/schemas/EscalationPolicyStep" - $ref: "#/components/schemas/EscalationPolicyUser" - $ref: "#/components/schemas/ScheduleData" - $ref: "#/components/schemas/ConfiguredSchedule" - $ref: "#/components/schemas/TeamReference" EscalationPolicyListItem: description: "Represents an escalation policy returned in a list, including its attributes, ID, relationships, and resource type." properties: attributes: $ref: "#/components/schemas/EscalationPolicyDataAttributes" id: description: "Specifies the unique identifier of the escalation policy." example: "ab000000-0000-0000-0000-000000000000" type: string relationships: $ref: "#/components/schemas/EscalationPolicyDataRelationships" type: $ref: "#/components/schemas/EscalationPolicyDataType" required: - id - type type: object EscalationPolicyStep: description: "Represents a single step in an escalation policy, including its attributes, relationships, and resource type." properties: attributes: $ref: "#/components/schemas/EscalationPolicyStepAttributes" id: description: "Specifies the unique identifier of this escalation policy step." type: string relationships: $ref: "#/components/schemas/EscalationPolicyStepRelationships" type: $ref: "#/components/schemas/EscalationPolicyStepType" required: - type type: object EscalationPolicyStepAttributes: description: "Defines attributes for an escalation policy step, such as assignment strategy and escalation timeout." properties: assignment: $ref: "#/components/schemas/EscalationPolicyStepAttributesAssignment" escalate_after_seconds: description: "Specifies how many seconds to wait before escalating to the next step." format: int64 type: integer type: object EscalationPolicyStepAttributesAssignment: description: "Specifies how this escalation step will assign targets (example `default` or `round-robin`)." enum: - default - round-robin type: string x-enum-varnames: - DEFAULT - ROUND_ROBIN EscalationPolicyStepRelationships: description: "Represents the relationship of an escalation policy step to its targets." properties: targets: $ref: "#/components/schemas/EscalationTargets" type: object EscalationPolicyStepTarget: description: "Defines a single escalation target within a step for an escalation policy creation request. Contains `id`, `type`, and optional `config`." properties: config: $ref: "#/components/schemas/EscalationPolicyStepTargetConfig" id: description: "Specifies the unique identifier for this target." example: "00000000-aba1-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/EscalationPolicyStepTargetType" type: object EscalationPolicyStepTargetConfig: description: "Configuration for an escalation target, such as schedule position." properties: schedule: $ref: "#/components/schemas/EscalationPolicyStepTargetConfigSchedule" type: object EscalationPolicyStepTargetConfigSchedule: description: "Schedule-specific configuration for an escalation target." properties: position: $ref: "#/components/schemas/ScheduleTargetPosition" type: object EscalationPolicyStepTargetType: description: "Specifies the type of escalation target (example `users`, `schedules`, or `teams`)." enum: - users - schedules - teams example: "users" type: string x-enum-varnames: - USERS - SCHEDULES - TEAMS EscalationPolicyStepType: default: steps description: "Indicates that the resource is of type `steps`." enum: - steps example: steps type: string x-enum-varnames: - STEPS EscalationPolicyUpdateRequest: description: "Represents a request to update an existing escalation policy, including the updated policy data." example: data: attributes: name: Escalation Policy 1 resolve_page_on_policy_end: false retries: 2 steps: - assignment: default escalate_after_seconds: 3600 id: 00000000-aba1-0000-0000-000000000000 targets: - id: 00000000-aba1-0000-0000-000000000000 type: users - id: 00000000-aba2-0000-0000-000000000000 type: schedules id: a3000000-0000-0000-0000-000000000000 relationships: teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: policies properties: data: $ref: "#/components/schemas/EscalationPolicyUpdateRequestData" required: - data type: object EscalationPolicyUpdateRequestData: description: "Represents the data for updating an existing escalation policy, including its ID, attributes, relationships, and resource type." properties: attributes: $ref: "#/components/schemas/EscalationPolicyUpdateRequestDataAttributes" id: description: "Specifies the unique identifier of the escalation policy being updated." example: "00000000-aba1-0000-0000-000000000000" type: string relationships: $ref: "#/components/schemas/EscalationPolicyUpdateRequestDataRelationships" type: $ref: "#/components/schemas/EscalationPolicyUpdateRequestDataType" required: - type - id - attributes type: object EscalationPolicyUpdateRequestDataAttributes: description: "Defines the attributes that can be updated for an escalation policy, such as description, name, resolution behavior, retries, and steps." properties: name: description: "Specifies the name of the escalation policy." example: "On-Call Escalation Policy" minLength: 1 type: string resolve_page_on_policy_end: description: "Indicates whether the Page is automatically resolved when the policy ends." type: boolean retries: description: "Specifies how many times the escalation sequence is retried if there is no response." format: int64 maximum: 10 minimum: 0 type: integer steps: description: "A list of escalation steps, each defining assignment, escalation timeout, and targets." items: $ref: "#/components/schemas/EscalationPolicyUpdateRequestDataAttributesStepsItems" maxItems: 10 minItems: 1 type: array required: - name - steps type: object EscalationPolicyUpdateRequestDataAttributesStepsItems: description: "Defines a single escalation step within an escalation policy update request. Contains assignment strategy, escalation timeout, an optional step ID, and a list of targets." properties: assignment: $ref: "#/components/schemas/EscalationPolicyStepAttributesAssignment" escalate_after_seconds: description: "Defines how many seconds to wait before escalating to the next step." example: 3600 format: int64 maximum: 36000 minimum: 60 type: integer id: description: "Specifies the unique identifier of this step." example: "00000000-aba1-0000-0000-000000000000" type: string targets: description: "Specifies the collection of escalation targets for this step." items: $ref: "#/components/schemas/EscalationPolicyStepTarget" type: array required: - targets type: object EscalationPolicyUpdateRequestDataRelationships: description: "Represents relationships in an escalation policy update request, including references to teams." properties: teams: $ref: "#/components/schemas/DataRelationshipsTeams" type: object EscalationPolicyUpdateRequestDataType: default: policies description: "Indicates that the resource is of type `policies`." enum: - policies example: policies type: string x-enum-varnames: - POLICIES EscalationPolicyUser: description: Represents a user object in the context of an escalation policy, including their `id`, type, and basic attributes. properties: attributes: $ref: "#/components/schemas/EscalationPolicyUserAttributes" id: description: The unique user identifier. type: string type: $ref: "#/components/schemas/EscalationPolicyUserType" required: - type type: object EscalationPolicyUserAttributes: description: Provides basic user information for an escalation policy, including a name and email address. properties: color: description: "The user's on-call color, as a hex code (for example, `#FF0000`). Included only when `user.color` is requested in the `include` parameter." example: "#FF0000" type: string email: description: The user's email address. example: "jane.doe@example.com" type: string name: description: The user's name. example: "Jane Doe" type: string status: $ref: "#/components/schemas/UserAttributesStatus" type: object EscalationPolicyUserType: default: users description: |- Users resource type. enum: - users example: users type: string x-enum-varnames: - USERS EscalationRelationships: description: Contains the relationships of an escalation object, including its responders. properties: responders: $ref: "#/components/schemas/EscalationRelationshipsResponders" type: object EscalationRelationshipsResponders: description: Lists the users involved in a specific step of the escalation policy. properties: data: description: Array of user references assigned as responders for this escalation step. items: $ref: "#/components/schemas/EscalationRelationshipsRespondersDataItems" type: array type: object EscalationRelationshipsRespondersDataItems: description: Represents a user assigned to an escalation step. properties: id: description: Unique identifier of the user assigned to the escalation step. example: "" type: string type: $ref: "#/components/schemas/EscalationRelationshipsRespondersDataItemsType" required: - type - id type: object EscalationRelationshipsRespondersDataItemsType: default: users description: Represents the resource type for users assigned as responders in an escalation step. enum: - users example: users type: string x-enum-varnames: - USERS EscalationTarget: description: "Represents an escalation target, which can be a team, user, schedule, or configured schedule target." oneOf: - $ref: "#/components/schemas/TeamTarget" - $ref: "#/components/schemas/UserTarget" - $ref: "#/components/schemas/ScheduleTarget" - $ref: "#/components/schemas/ConfiguredScheduleTarget" EscalationTargets: description: "A list of escalation targets for a step" properties: data: description: The `EscalationTargets` `data`. items: $ref: "#/components/schemas/EscalationTarget" type: array type: object EscalationType: default: escalation_policy_steps description: Represents the resource type for individual steps in an escalation policy used during incident response. enum: - escalation_policy_steps example: escalation_policy_steps type: string x-enum-varnames: - ESCALATION_POLICY_STEPS Event: additionalProperties: {} description: The metadata associated with a request. properties: id: description: Event ID. example: "6509751066204996294" type: string integration_id: description: The integration ID of the event. example: "custom-events" type: string name: description: The event name. type: string source_id: description: Event source ID. example: 36 format: int64 type: integer type: description: Event type. example: "error_tracking_alert" type: string uid: description: A unique identifier for the event. You can use this identifier to query or reference the event. example: "AaBJ4QimAABPmEWRwc_8yAAA" type: string type: object EventAttributes: additionalProperties: {} description: Object description of attributes from your event. properties: aggregation_key: description: Aggregation key of the event. type: string date_happened: description: |- POSIX timestamp of the event. Must be sent as an integer (no quotation marks). Limited to events no older than 18 hours. format: int64 type: integer device_name: description: A device name. type: string duration: description: The duration between the triggering of the event and its recovery in nanoseconds. format: int64 type: integer event_object: description: The event title. example: "Did you hear the news today?" type: string evt: $ref: "#/components/schemas/Event" hostname: description: |- Host name to associate with the event. Any tags associated with the host are also applied to this event. type: string monitor: $ref: "#/components/schemas/MonitorType" monitor_groups: description: List of groups referred to in the event. items: description: Group referred to in the event. type: string nullable: true type: array monitor_id: description: ID of the monitor that triggered the event. When an event isn't related to a monitor, this field is empty. format: int64 nullable: true type: integer priority: $ref: "#/components/schemas/EventPriority" related_event_id: description: Related event ID. format: int64 type: integer service: description: Service that triggered the event. example: "datadog-api" type: string source_type_name: description: |- The type of event being posted. For example, `nagios`, `hudson`, `jenkins`, `my_apps`, `chef`, `puppet`, `git` or `bitbucket`. The list of standard source attribute values is [available here](https://docs.datadoghq.com/integrations/faq/list-of-api-source-attribute-value). type: string sourcecategory: description: Identifier for the source of the event, such as a monitor alert, an externally-submitted event, or an integration. type: string status: $ref: "#/components/schemas/EventStatusType" tags: description: A list of tags to apply to the event. example: ["environment:test"] items: description: A tag. type: string type: array timestamp: description: POSIX timestamp of your event in milliseconds. example: 1652274265000 format: int64 type: integer title: description: The event title. example: "Oh boy!" type: string type: object EventCategory: description: |- Event category identifying the type of event. enum: - change - alert example: change type: string x-enum-varnames: - CHANGE - ALERT EventCreateRequest: description: An event object. properties: attributes: $ref: "#/components/schemas/EventPayload" type: $ref: "#/components/schemas/EventCreateRequestType" required: - type - attributes type: object EventCreateRequestPayload: description: Payload for creating an event. properties: data: $ref: "#/components/schemas/EventCreateRequest" required: - data type: object EventCreateRequestType: description: Entity type. enum: - event example: "event" type: string x-enum-varnames: - EVENT EventCreateResponse: description: Event object. properties: attributes: $ref: "#/components/schemas/EventCreateResponseAttributes" type: description: Entity type. example: "event" type: string type: object EventCreateResponseAttributes: description: Event attributes. properties: attributes: $ref: "#/components/schemas/EventCreateResponseAttributesAttributes" type: object EventCreateResponseAttributesAttributes: description: JSON object for category-specific attributes. properties: evt: $ref: "#/components/schemas/EventCreateResponseAttributesAttributesEvt" type: object EventCreateResponseAttributesAttributesEvt: description: JSON object of event system attributes. properties: id: deprecated: true description: |- Event identifier. This field is deprecated and will be removed in a future version. Use the `uid` field instead. type: string uid: description: |- A unique identifier for the event. You can use this identifier to query or reference the event. type: string type: object EventCreateResponsePayload: description: Event creation response. properties: data: $ref: "#/components/schemas/EventCreateResponse" links: $ref: "#/components/schemas/EventCreateResponsePayloadLinks" type: object EventCreateResponsePayloadLinks: description: |- Links to the event. properties: self: description: |- The URL of the event. This link is only functional when using the default subdomain. type: string type: object EventPayload: additionalProperties: false description: Event attributes. properties: aggregation_key: description: |- A string used for aggregation when [correlating](https://docs.datadoghq.com/service_management/events/correlation/) events. If you specify a key, events are deduplicated to alerts based on this key. Limited to 100 characters. example: "aggregation_key_123" maxLength: 100 minLength: 1 type: string attributes: $ref: "#/components/schemas/EventPayloadAttributes" category: $ref: "#/components/schemas/EventCategory" host: description: |- Host name to associate with the event. Any tags associated with the host are also applied to this event. Limited to 255 characters. example: "hostname" maxLength: 255 minLength: 1 type: string integration_id: $ref: "#/components/schemas/EventPayloadIntegrationId" message: description: |- Free formed text associated with the event. It's suggested to use `data.attributes.attributes.custom` for well-structured attributes. Limited to 4000 characters. example: "payment_processed feature flag has been enabled" maxLength: 4000 minLength: 1 type: string tags: description: |- A list of tags associated with the event. Maximum of 100 tags allowed. Refer to [Tags docs](https://docs.datadoghq.com/getting_started/tagging/). example: ["env:api_client_test"] items: description: A tag. maxLength: 200 minLength: 1 type: string maxItems: 100 minItems: 1 type: array timestamp: description: |- Timestamp when the event occurred. Must follow [ISO 8601](https://www.iso.org/iso-8601-date-and-time-format.html) format. For example `"2017-01-15T01:30:15.010000Z"`. Defaults to the timestamp of receipt. Limited to values no older than 18 hours. type: string title: description: The title of the event. Limited to 500 characters. example: "payment_processed feature flag updated" maxLength: 500 minLength: 1 type: string required: - title - category - attributes type: object EventPayloadAttributes: description: |- JSON object for category-specific attributes. Schema is different per event category. oneOf: - $ref: "#/components/schemas/ChangeEventCustomAttributes" - $ref: "#/components/schemas/AlertEventCustomAttributes" EventPayloadIntegrationId: description: |- Integration ID sourced from integration manifests. enum: - custom-events example: "custom-events" type: string x-enum-varnames: - CUSTOM_EVENTS EventPriority: description: |- The priority of the event alert. Legacy events use `normal` or `low`. Alert events use `1` (highest priority) through `5` (lowest priority). enum: - normal - low - "1" - "2" - "3" - "4" - "5" example: "normal" nullable: true type: string x-enum-varnames: - NORMAL - LOW - PRIORITY_ONE - PRIORITY_TWO - PRIORITY_THREE - PRIORITY_FOUR - PRIORITY_FIVE EventResponse: description: The object description of an event after being processed and stored by Datadog. properties: attributes: $ref: "#/components/schemas/EventResponseAttributes" id: description: the unique ID of the event. example: "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA" type: string type: $ref: "#/components/schemas/EventType" type: object EventResponseAttributes: description: The object description of an event response attribute. properties: attributes: $ref: "#/components/schemas/EventAttributes" message: description: The message of the event. type: string tags: description: An array of tags associated with the event. example: ["team:A"] items: description: The tag associated with the event. type: string type: array timestamp: description: The timestamp of the event. example: "2019-01-02T09:42:36.320Z" format: date-time type: string type: object EventStatusType: description: |- The event status. Legacy events can use `failure`, `error`, `warning`, `info`, `success`, `user_update`, `recommendation`, or `snapshot`. Alert events can use `error`, `warn`, or `ok`. enum: - failure - error - warn - warning - ok - info - success - user_update - recommendation - snapshot example: "info" type: string x-enum-varnames: - FAILURE - ERROR - WARN - WARNING - OK - INFO - SUCCESS - USER_UPDATE - RECOMMENDATION - SNAPSHOT EventSystemAttributes: description: JSON object of event system attributes. properties: category: $ref: "#/components/schemas/EventSystemAttributesCategory" id: description: Event identifier. This field is deprecated and will be removed in a future version. Use the `uid` field instead. type: string integration_id: $ref: "#/components/schemas/EventSystemAttributesIntegrationId" source_id: description: The source type ID of the event. format: int64 type: integer uid: description: A unique identifier for the event. You can use this identifier to query or reference the event. type: string type: object EventSystemAttributesCategory: description: Event category identifying the type of event. enum: - change - alert example: "change" type: string x-enum-varnames: - CHANGE - ALERT EventSystemAttributesIntegrationId: description: Integration ID sourced from integration manifests. enum: - custom-events example: "custom-events" type: string x-enum-varnames: - CUSTOM_EVENTS EventType: default: event description: Type of the event. enum: - event example: "event" type: string x-enum-varnames: - EVENT EventsAggregation: default: count description: The type of aggregation that can be performed on events-based queries. enum: - count - cardinality - pc75 - pc90 - pc95 - pc98 - pc99 - sum - min - max - avg example: count type: string x-enum-varnames: - COUNT - CARDINALITY - PC75 - PC90 - PC95 - PC98 - PC99 - SUM - MIN - MAX - AVG EventsCompute: description: The instructions for what to compute for this query. properties: aggregation: $ref: "#/components/schemas/EventsAggregation" interval: description: Interval for compute in milliseconds. example: 60000 format: int64 type: integer metric: description: The "measure" attribute on which to perform the computation. type: string required: - aggregation type: object EventsDataSource: default: logs description: A data source that is powered by the Events Platform. enum: - logs - spans - network - rum - security_signals - profiles - audit - events - ci_tests - ci_pipelines - incident_analytics - product_analytics - on_call_events - dora example: logs type: string x-enum-varnames: - LOGS - SPANS - NETWORK - RUM - SECURITY_SIGNALS - PROFILES - AUDIT - EVENTS - CI_TESTS - CI_PIPELINES - INCIDENT_ANALYTICS - PRODUCT_ANALYTICS - ON_CALL_EVENTS - DORA EventsGroupBy: description: A dimension on which to split a query's results. properties: facet: description: The facet by which to split groups. example: "@error.type" type: string limit: default: 10 description: |- The maximum buckets to return for this group by. Note: at most 10000 buckets are allowed. If grouping by multiple facets, the product of limits must not exceed 10000. example: 10 format: int32 maximum: 10000 type: integer sort: $ref: "#/components/schemas/EventsGroupBySort" required: - facet type: object EventsGroupBySort: description: The dimension by which to sort a query's results. properties: aggregation: $ref: "#/components/schemas/EventsAggregation" metric: description: The metric's calculated value which should be used to define the sort order of a query's results. example: "@duration" type: string order: $ref: "#/components/schemas/QuerySortOrder" type: $ref: "#/components/schemas/EventsSortType" required: - aggregation type: object EventsListRequest: description: |- The object sent with the request to retrieve a list of events from your organization. properties: filter: $ref: "#/components/schemas/EventsQueryFilter" options: $ref: "#/components/schemas/EventsQueryOptions" page: $ref: "#/components/schemas/EventsRequestPage" sort: $ref: "#/components/schemas/EventsSort" type: object EventsListResponse: description: The response object with all events matching the request and pagination information. properties: data: description: An array of events matching the request. items: $ref: "#/components/schemas/EventResponse" type: array links: $ref: "#/components/schemas/EventsListResponseLinks" meta: $ref: "#/components/schemas/EventsResponseMetadata" type: object EventsListResponseLinks: description: Links attributes. properties: next: description: |- Link for the next set of results. Note that the request can also be made using the POST endpoint. example: "https://app.datadoghq.com/api/v2/events?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string type: object EventsQueryFilter: description: The search and filter query settings. properties: from: default: "now-15m" description: |- The minimum time for the requested events. Supports date math and regular timestamps in milliseconds. example: "now-15m" type: string query: default: "*" description: The search query following the event search syntax. example: "service:web* AND @http.status_code:[200 TO 299]" type: string to: default: "now" description: |- The maximum time for the requested events. Supports date math and regular timestamps in milliseconds. example: "now" type: string type: object EventsQueryGroupBys: description: The list of facets on which to split results. items: $ref: "#/components/schemas/EventsGroupBy" type: array EventsQueryOptions: description: |- The global query options that are used. Either provide a timezone or a time offset but not both, otherwise the query fails. properties: timeOffset: description: The time offset to apply to the query in seconds. format: int64 type: integer timezone: default: "UTC" description: |- The timezone can be specified as GMT, UTC, an offset from UTC (like UTC+1), or as a Timezone Database identifier (like America/New_York). example: "GMT" type: string type: object EventsRequestPage: description: Pagination settings. properties: cursor: description: The returned paging point to use to get the next results. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string limit: default: 10 description: The maximum number of events in the response. example: 25 format: int32 maximum: 1000 type: integer type: object EventsResponseMetadata: description: The metadata associated with a request. properties: elapsed: description: The time elapsed in milliseconds. example: 132 format: int64 type: integer page: $ref: "#/components/schemas/EventsResponseMetadataPage" request_id: description: The identifier of the request. example: "MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR" type: string status: description: The request status. example: "done" type: string warnings: description: |- A list of warnings (non-fatal errors) encountered. Partial results might be returned if warnings are present in the response. items: $ref: "#/components/schemas/EventsWarning" type: array type: object EventsResponseMetadataPage: description: Pagination attributes. properties: after: description: |- The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of the `page[cursor]`. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string type: object EventsScalarQuery: description: >- An individual scalar query for logs, RUM, traces, CI pipelines, security signals, and other event-based data sources. Use this query type for any data source powered by the Events Platform. See the data_source field for the full list of supported sources. properties: compute: $ref: "#/components/schemas/EventsCompute" cross_org_uuids: $ref: "#/components/schemas/CrossOrgUuids" data_source: $ref: "#/components/schemas/EventsDataSource" group_by: $ref: "#/components/schemas/EventsQueryGroupBys" indexes: description: The indexes in which to search. example: ["main"] items: description: The unique index name. example: main type: string type: array name: description: The variable name for use in formulas. type: string search: $ref: "#/components/schemas/EventsSearch" required: - data_source - compute type: object EventsSearch: description: Configuration of the search/filter for an events query. properties: query: description: The search/filter string for an events query. example: "status:warn service:foo" type: string type: object EventsSort: description: The sort parameters when querying events. enum: - timestamp - -timestamp type: string x-enum-varnames: - TIMESTAMP_ASCENDING - TIMESTAMP_DESCENDING EventsSortType: description: The type of sort to use on the calculated value. enum: - alphabetical - measure type: string x-enum-varnames: - ALPHABETICAL - MEASURE EventsTimeseriesQuery: description: >- An individual timeseries query for logs, RUM, traces, CI pipelines, security signals, and other event-based data sources. Use this query type for any data source powered by the Events Platform. See the data_source field for the full list of supported sources. properties: compute: $ref: "#/components/schemas/EventsCompute" cross_org_uuids: $ref: "#/components/schemas/CrossOrgUuids" data_source: $ref: "#/components/schemas/EventsDataSource" group_by: $ref: "#/components/schemas/EventsQueryGroupBys" indexes: description: The indexes in which to search. example: ["main"] items: description: The unique index name. example: main type: string type: array name: description: The variable name for use in formulas. type: string search: $ref: "#/components/schemas/EventsSearch" required: - data_source - compute type: object EventsWarning: description: A warning message indicating something is wrong with the query. properties: code: description: A unique code for this type of warning. example: "unknown_index" type: string detail: description: A detailed explanation of this specific warning. example: "indexes: foo, bar" type: string title: description: A short human-readable summary of the warning. example: "One or several indexes are missing or invalid. Results hold data from the other indexes." type: string type: object ExecutionLimit: description: "The maximum number of times to execute a workflow for an incident." properties: count: description: "The maximum number of workflow executions." example: 1 format: int32 maximum: 9999 minimum: 1 type: integer required: - count type: object ExecutionPolicyActionPattern: description: The set of actions this policy applies to. properties: action_fqns: description: |- The fully qualified action names this policy matches. Use `*` to match all actions of the integration, or a fully qualified name prefixed with the integration's action namespace (for example `com.datadoghq.script.*` for the Script integration). example: - "com.datadoghq.script.*" items: type: string type: array integration: $ref: "#/components/schemas/ExecutionPolicyIntegration" required: - integration - action_fqns type: object ExecutionPolicyAttributes: description: An execution policy. properties: action_pattern: $ref: "#/components/schemas/ExecutionPolicyActionPattern" created_at: description: The date and time the execution policy was created. example: "2026-01-15T10:00:00.000Z" format: date-time type: string created_by: description: The ID of the user who created the execution policy. example: "3fa85f64-5717-4562-b3fc-2c963f66afa6" type: string effect: $ref: "#/components/schemas/ExecutionPolicyEffect" name: description: The name of the execution policy. example: "Block prod restarts" type: string scope: $ref: "#/components/schemas/ExecutionPolicyScope" targets: description: The targets this policy applies to. items: $ref: "#/components/schemas/ExecutionPolicyTarget" type: array updated_at: description: The date and time the execution policy was last updated. example: "2026-01-15T10:00:00.000Z" format: date-time type: string updated_by: description: The ID of the user who last updated the execution policy. example: "3fa85f64-5717-4562-b3fc-2c963f66afa6" type: string version: description: The version of the execution policy. Incremented on every update. example: 1 format: int32 maximum: 2147483647 type: integer required: - name - effect - action_pattern - targets - version - created_at - updated_at - created_by - updated_by type: object ExecutionPolicyCreateRequest: description: Request object that includes the execution policy to create. properties: data: $ref: "#/components/schemas/ExecutionPolicyCreateRequestData" required: - data type: object ExecutionPolicyCreateRequestData: description: Object for a single execution policy. properties: attributes: $ref: "#/components/schemas/ExecutionPolicyWriteAttributes" type: $ref: "#/components/schemas/ExecutionPolicyType" required: - type - attributes type: object ExecutionPolicyEffect: description: Whether the policy allows or denies matching actions. enum: - allow - deny example: allow type: string x-enum-varnames: - ALLOW - DENY ExecutionPolicyIntegration: description: The integration the action pattern applies to. enum: - INTEGRATION_KUBERNETES - INTEGRATION_SCRIPT - INTEGRATION_REMOTE_ACTION - INTEGRATION_SLACK example: INTEGRATION_SCRIPT type: string x-enum-varnames: - INTEGRATION_KUBERNETES - INTEGRATION_SCRIPT - INTEGRATION_REMOTE_ACTION - INTEGRATION_SLACK ExecutionPolicyKubernetesScope: description: Restricts the policy to specific Kubernetes namespaces. properties: rules: description: The Kubernetes scope rules. items: $ref: "#/components/schemas/ExecutionPolicyKubernetesScopeRule" type: array required: - rules type: object ExecutionPolicyKubernetesScopeRule: description: A rule restricting a Kubernetes scope to specific namespaces. properties: target_namespaces: description: The Kubernetes namespaces this rule applies to. example: - "default" items: type: string type: array required: - target_namespaces type: object ExecutionPolicyListResponse: description: Response object that includes a list of execution policies. properties: data: description: The execution policies. items: $ref: "#/components/schemas/ExecutionPolicyResponseData" type: array meta: $ref: "#/components/schemas/ExecutionPolicyListResponseMeta" required: - data - meta type: object ExecutionPolicyListResponseMeta: description: Pagination metadata for the list of execution policies. properties: page: $ref: "#/components/schemas/ExecutionPolicyListResponsePage" required: - page type: object ExecutionPolicyListResponsePage: description: Pagination details. properties: total: description: The total number of execution policies matching the query. example: 1 format: int32 maximum: 2147483647 type: integer required: - total type: object ExecutionPolicyRemoteActionRshellAccess: description: The level of remote shell access granted for the target paths. enum: - read_only - read_write example: read_only type: string x-enum-varnames: - READ_ONLY - READ_WRITE ExecutionPolicyRemoteActionRshellScope: description: Restricts the policy to specific remote shell paths. properties: rules: description: The remote shell scope rules. items: $ref: "#/components/schemas/ExecutionPolicyRemoteActionRshellScopeRule" type: array required: - rules type: object ExecutionPolicyRemoteActionRshellScopeRule: description: A rule restricting remote shell access to specific paths. properties: access: $ref: "#/components/schemas/ExecutionPolicyRemoteActionRshellAccess" target_paths: description: The file system paths this rule applies to. example: - "/var/log" items: type: string type: array required: - target_paths - access type: object ExecutionPolicyResponse: description: Response object that includes a single execution policy. properties: data: $ref: "#/components/schemas/ExecutionPolicyResponseData" required: - data type: object ExecutionPolicyResponseData: description: Object for a single execution policy. properties: attributes: $ref: "#/components/schemas/ExecutionPolicyAttributes" id: description: The ID of the execution policy. example: "3fa85f64-5717-4562-b3fc-2c963f66afa6" readOnly: true type: string type: $ref: "#/components/schemas/ExecutionPolicyType" required: - id - type - attributes type: object ExecutionPolicyScope: description: |- Restricts where the policy applies. At most one scope type can be set, and it must match the action pattern's integration. An empty object means the policy has no scope restriction. properties: kubernetes: $ref: "#/components/schemas/ExecutionPolicyKubernetesScope" remote_action_rshell: $ref: "#/components/schemas/ExecutionPolicyRemoteActionRshellScope" scripts: $ref: "#/components/schemas/ExecutionPolicyScriptScope" slack: $ref: "#/components/schemas/ExecutionPolicySlackScope" type: object ExecutionPolicyScriptScope: description: Restricts the policy to specific scripts. properties: rules: description: The script scope rules. items: $ref: "#/components/schemas/ExecutionPolicyScriptScopeRule" type: array required: - rules type: object ExecutionPolicyScriptScopeRule: description: A rule restricting a script scope to specific script names. properties: target_script_names: description: The script names this rule applies to. example: - "restart_service.sh" items: type: string type: array required: - target_script_names type: object ExecutionPolicySlackScope: description: Restricts the policy to specific Slack private channel names. properties: rules: description: The Slack scope rules. items: $ref: "#/components/schemas/ExecutionPolicySlackScopeRule" minItems: 1 type: array required: - rules type: object ExecutionPolicySlackScopeRule: description: A rule restricting a Slack scope to specific private channel names. properties: channel_name_selectors: description: |- The private channel name selectors this rule applies to. Selectors are lowercase private channel names without the leading `#`, and can contain `*` wildcards. Use `*` alone to match any private channel name. example: - "incident-*" items: maxLength: 80 minLength: 1 type: string maxItems: 100 minItems: 1 type: array uniqueItems: true required: - channel_name_selectors type: object ExecutionPolicyTarget: description: A target this policy is scoped to, expressed as a set of tags. properties: agent_tags: description: The tags identifying the target. example: - "env:prod" items: type: string type: array name: description: A human-readable name for the target. example: "Production hosts" nullable: true type: string required: - agent_tags type: object ExecutionPolicyType: default: execution_policy description: The type of the resource. The value should always be `execution_policy`. enum: - execution_policy example: execution_policy type: string x-enum-varnames: - EXECUTION_POLICY ExecutionPolicyUpdateRequest: description: Request object that includes the execution policy to update. properties: data: $ref: "#/components/schemas/ExecutionPolicyUpdateRequestData" required: - data type: object ExecutionPolicyUpdateRequestData: description: Object for a single execution policy. properties: attributes: $ref: "#/components/schemas/ExecutionPolicyWriteAttributes" id: description: The ID of the execution policy. example: "3fa85f64-5717-4562-b3fc-2c963f66afa6" type: string type: $ref: "#/components/schemas/ExecutionPolicyType" required: - id - type - attributes type: object ExecutionPolicyWriteAttributes: description: Attributes used to create or update an execution policy. properties: action_pattern: $ref: "#/components/schemas/ExecutionPolicyActionPattern" effect: $ref: "#/components/schemas/ExecutionPolicyEffect" name: description: The name of the execution policy. example: "Block prod restarts" type: string scope: $ref: "#/components/schemas/ExecutionPolicyScope" targets: description: The targets this policy applies to. items: $ref: "#/components/schemas/ExecutionPolicyTarget" type: array required: - name - effect - action_pattern type: object ExperimentsAnalysisPlanV2DTO: description: "Response containing the analysis settings for an experiment." example: data: attributes: bayesian_prior: degrees_of_freedom: standard_deviation: 0.05 confidence_interval_method: Bayesian confidence_level: 0.95 cuped_lookback_period_days: 30 experiment_auto_end_days: 0 experiment_min_duration: 0 experiment_min_sample_size: 0 has_custom_analysis_settings: false is_cuped_enabled: true is_multiple_testing_correction_enabled: false preferential_bonferroni_primary_metric_weight: 0.5 target_duration_days: 14 id: 550e8400-e29b-41d4-a716-446655440000 type: analysis-plans properties: data: $ref: "#/components/schemas/ExperimentsAnalysisPlanV2DTOData" required: - data type: object ExperimentsAnalysisPlanV2DTOData: description: "Analysis plan resource with its identifier and settings." example: attributes: bayesian_prior: degrees_of_freedom: standard_deviation: 0.05 confidence_interval_method: Bayesian confidence_level: 0.95 cuped_lookback_period_days: 30 experiment_auto_end_days: 0 experiment_min_duration: 0 experiment_min_sample_size: 0 has_custom_analysis_settings: false is_cuped_enabled: true is_multiple_testing_correction_enabled: false preferential_bonferroni_primary_metric_weight: 0.5 target_duration_days: 14 id: 550e8400-e29b-41d4-a716-446655440000 type: analysis-plans properties: attributes: $ref: "#/components/schemas/ExperimentsAnalysisPlanV2MutationResponseDataAttributes" id: description: "Identifier of the experiment whose analysis plan is returned." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string type: $ref: "#/components/schemas/ExperimentsAnalysisPlanWriteV2RequestDataType" required: - id - type type: object ExperimentsAnalysisPlanV2DTODataAttributesConfidenceIntervalMethod: description: "Statistical method used to calculate the experiment results." enum: - Sequential - FixedSample - Bayesian - SequentialFixedHybrid example: Bayesian type: string x-enum-varnames: - SEQUENTIAL - FIXEDSAMPLE - BAYESIAN - SEQUENTIALFIXEDHYBRID ExperimentsAnalysisPlanV2MutationResponse: description: "Response containing the saved analysis plan and result refresh information." properties: data: $ref: "#/components/schemas/ExperimentsAnalysisPlanV2DTOData" meta: $ref: "#/components/schemas/ExperimentsPatchExperimentV2MetaDTO" required: - data type: object ExperimentsAnalysisPlanV2MutationResponseDataAttributes: description: "Statistical settings and duration targets in the saved analysis plan." properties: bayesian_prior: $ref: "#/components/schemas/ExperimentsAnalysisPlanV2MutationResponseDataAttributesBayesianPrior" confidence_interval_method: $ref: "#/components/schemas/ExperimentsAnalysisPlanV2DTODataAttributesConfidenceIntervalMethod" confidence_level: description: "Confidence level used for statistical analysis, expressed as a fraction." format: double type: number cuped_lookback_period_days: description: "Number of days of pre-experiment data used for CUPED variance reduction." format: int64 type: integer experiment_auto_end_days: description: "Number of days configured for the experiment to end automatically." format: int64 type: integer experiment_min_duration: description: "Minimum experiment duration in days configured in the analysis plan." format: int64 type: integer experiment_min_sample_size: description: "Minimum sample size configured in the analysis plan." format: int64 type: integer has_custom_analysis_settings: description: "Whether the experiment has custom analysis settings." type: boolean is_cuped_enabled: description: "Whether CUPED uses pre-experiment data to reduce variance in the analysis." type: boolean is_multiple_testing_correction_enabled: description: "Whether the analysis adjusts for testing multiple hypotheses." type: boolean preferential_bonferroni_primary_metric_weight: description: "Weight assigned to the primary metric in the preferential Bonferroni correction." format: double type: number target_duration_days: description: "Planned experiment duration in days." format: int64 nullable: true type: integer type: object ExperimentsAnalysisPlanV2MutationResponseDataAttributesBayesianPrior: description: "Parameters of the prior distribution used for Bayesian analysis." properties: degrees_of_freedom: description: "Degrees of freedom of the prior distribution." format: double nullable: true type: number standard_deviation: description: "Standard deviation of the prior distribution." format: double type: number type: object ExperimentsAnalysisPlanWriteV2Request: description: "Request to update the analysis settings for an experiment." example: data: attributes: bayesian_prior: degrees_of_freedom: standard_deviation: 0.05 confidence_interval_method: Bayesian confidence_level: 0.95 cuped_lookback_period_days: 30 experiment_auto_end_days: 0 experiment_min_duration: 0 experiment_min_sample_size: 0 is_cuped_enabled: true is_multiple_testing_correction_enabled: false preferential_bonferroni_primary_metric_weight: 0.5 target_duration_days: 14 id: 550e8400-e29b-41d4-a716-446655440000 type: analysis-plans properties: data: $ref: "#/components/schemas/ExperimentsAnalysisPlanWriteV2RequestData" required: - data type: object ExperimentsAnalysisPlanWriteV2RequestData: description: "Analysis plan resource to update." example: attributes: bayesian_prior: degrees_of_freedom: standard_deviation: 0.05 confidence_interval_method: Bayesian confidence_level: 0.95 cuped_lookback_period_days: 30 experiment_auto_end_days: 0 experiment_min_duration: 0 experiment_min_sample_size: 0 is_cuped_enabled: true is_multiple_testing_correction_enabled: false preferential_bonferroni_primary_metric_weight: 0.5 target_duration_days: 14 id: 550e8400-e29b-41d4-a716-446655440000 type: analysis-plans properties: attributes: $ref: "#/components/schemas/ExperimentsAnalysisPlanWriteV2RequestDataAttributes" id: description: "Identifier of the experiment. If supplied, it must match experiment_id in the path." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string type: $ref: "#/components/schemas/ExperimentsAnalysisPlanWriteV2RequestDataType" required: - type type: object ExperimentsAnalysisPlanWriteV2RequestDataAttributes: description: "Statistical settings and duration targets to apply to the experiment." example: bayesian_prior: degrees_of_freedom: standard_deviation: 0.05 confidence_interval_method: Bayesian confidence_level: 0.95 cuped_lookback_period_days: 30 experiment_auto_end_days: 0 experiment_min_duration: 0 experiment_min_sample_size: 0 is_cuped_enabled: true is_multiple_testing_correction_enabled: false preferential_bonferroni_primary_metric_weight: 0.5 target_duration_days: 14 properties: bayesian_prior: $ref: "#/components/schemas/ExperimentsAnalysisPlanWriteV2RequestDataAttributesBayesianPrior" confidence_interval_method: $ref: "#/components/schemas/ExperimentsAnalysisPlanV2DTODataAttributesConfidenceIntervalMethod" confidence_level: description: "Confidence level used for statistical analysis, expressed as a fraction." example: 0.95 format: double type: number cuped_lookback_period_days: description: Only a 30-day CUPED lookback is supported. example: 30 format: int64 maximum: 30 minimum: 30 type: integer experiment_auto_end_days: description: "Number of days configured for the experiment to end automatically." example: 0 format: int64 type: integer experiment_min_duration: description: "Minimum experiment duration in days configured in the analysis plan." example: 0 format: int64 type: integer experiment_min_sample_size: description: "Minimum sample size configured in the analysis plan." example: 0 format: int64 type: integer is_cuped_enabled: description: "Whether CUPED uses pre-experiment data to reduce variance in the analysis." example: true type: boolean is_multiple_testing_correction_enabled: description: "Whether the analysis adjusts for testing multiple hypotheses." example: false type: boolean preferential_bonferroni_primary_metric_weight: description: "Weight assigned to the primary metric in the preferential Bonferroni correction." example: 0.5 format: double type: number target_duration_days: description: "Planned experiment duration in days." example: 14 format: int64 nullable: true type: integer type: object ExperimentsAnalysisPlanWriteV2RequestDataAttributesBayesianPrior: description: "Parameters of the prior distribution to use for Bayesian analysis." example: degrees_of_freedom: standard_deviation: 0.05 properties: degrees_of_freedom: description: "Degrees of freedom of the prior distribution." example: format: double nullable: true type: number standard_deviation: description: "Standard deviation of the prior distribution." example: 0.05 format: double type: number required: - standard_deviation type: object ExperimentsAnalysisPlanWriteV2RequestDataType: default: analysis-plans description: Analysis plans resource type. enum: - analysis-plans example: analysis-plans type: string x-enum-varnames: - ANALYSIS_PLANS ExperimentsCancelExperimentV2Request: description: "Request to cancel an experiment and record a reason." example: data: attributes: reason: Experiment configuration was incorrect type: cancel-experiment-request properties: data: $ref: "#/components/schemas/ExperimentsCancelExperimentV2RequestData" required: - data type: object ExperimentsCancelExperimentV2RequestData: description: "Experiment cancellation resource with the experiment identifier and reason." example: attributes: reason: Experiment configuration was incorrect type: cancel-experiment-request properties: attributes: $ref: "#/components/schemas/ExperimentsCancelExperimentV2RequestDataAttributes" id: description: "Identifier of the experiment to cancel." type: string type: $ref: "#/components/schemas/ExperimentsCancelExperimentV2RequestDataType" required: - type - attributes type: object ExperimentsCancelExperimentV2RequestDataAttributes: description: "Reason to record when canceling the experiment." example: reason: Experiment configuration was incorrect properties: reason: description: |- Reason the experiment was canceled. Stored as the decision reason on the experiment conclusion. Must not be blank. example: Experiment configuration was incorrect minLength: 1 pattern: ".*\\S.*" type: string required: - reason type: object ExperimentsCancelExperimentV2RequestDataType: default: cancel-experiment-request description: Cancel experiment request resource type. enum: - cancel-experiment-request example: cancel-experiment-request type: string x-enum-varnames: - CANCEL_EXPERIMENT_REQUEST ExperimentsConcludeExperimentV2Request: description: "Request to conclude an experiment with a winning variant." example: data: attributes: decision_variant_key: treatment type: conclude-experiment-request properties: data: $ref: "#/components/schemas/ExperimentsConcludeExperimentV2RequestData" required: - data type: object ExperimentsConcludeExperimentV2RequestData: description: "Experiment conclusion resource with the experiment identifier and decision." example: attributes: decision_variant_key: treatment type: conclude-experiment-request properties: attributes: $ref: "#/components/schemas/ExperimentsConcludeExperimentV2RequestDataAttributes" id: description: "Identifier of the experiment to conclude." type: string type: $ref: "#/components/schemas/ExperimentsConcludeExperimentV2RequestDataType" required: - type - attributes type: object ExperimentsConcludeExperimentV2RequestDataAttributes: description: "Decision to record when concluding the experiment." example: decision_variant_key: treatment properties: decision_variant_key: description: Key of the winning variant. Must match a variant on the experiment and must not be blank. example: treatment minLength: 1 pattern: ".*\\S.*" type: string required: - decision_variant_key type: object ExperimentsConcludeExperimentV2RequestDataType: default: conclude-experiment-request description: Conclude experiment request resource type. enum: - conclude-experiment-request example: conclude-experiment-request type: string x-enum-varnames: - CONCLUDE_EXPERIMENT_REQUEST ExperimentsConfidenceInterval: description: "Lower and upper bounds of the reported statistical interval." properties: lower: description: "Lower bound of the reported interval." format: double type: number upper: description: "Upper bound of the reported interval." format: double type: number type: object ExperimentsCreateExperimentMetricGroupV2Request: description: "Request to create a metric group on an experiment." example: data: attributes: metrics: - metric_id: 550e8400-e29b-41d4-a716-446655440021 name: Diagnostics type: experiment-metric-groups properties: data: $ref: "#/components/schemas/ExperimentsCreateExperimentMetricGroupV2RequestData" required: - data type: object ExperimentsCreateExperimentMetricGroupV2RequestData: description: "Metric group resource to create on the experiment." example: attributes: metrics: - metric_id: 550e8400-e29b-41d4-a716-446655440021 name: Diagnostics type: experiment-metric-groups properties: attributes: $ref: "#/components/schemas/ExperimentsCreateExperimentMetricGroupV2RequestDataAttributes" id: description: "Optional JSON:API resource identifier field." type: string type: $ref: "#/components/schemas/ExperimentsPatchExperimentMetricGroupV2RequestDataType" required: - attributes - type type: object ExperimentsCreateExperimentMetricGroupV2RequestDataAttributes: description: "Name and metric selection for the new experiment metric group." example: metrics: - metric_id: 550e8400-e29b-41d4-a716-446655440021 name: Diagnostics properties: metrics: description: "Metrics to include in the experiment metric group." example: - metric_id: 550e8400-e29b-41d4-a716-446655440021 items: $ref: "#/components/schemas/ExperimentsCreateExperimentMetricGroupV2RequestDataAttributesMetricsItems" type: array migration_metadata: description: "Metadata associated with migration of this resource." name: description: "Display name of the experiment metric group." example: Checkout conversion type: string required: - name type: object ExperimentsCreateExperimentMetricGroupV2RequestDataAttributesMetricsItems: description: "Reference to a metric to include in the experiment metric group." example: metric_id: 550e8400-e29b-41d4-a716-446655440021 properties: metric_id: description: "Identifier of the metric to include in the group." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string required: - metric_id type: object ExperimentsCreateExperimentProtocolRequest: description: Create a draft protocol with the organization default subject type. properties: data: $ref: "#/components/schemas/ExperimentsCreateExperimentProtocolRequestData" required: - data type: object ExperimentsCreateExperimentProtocolRequestData: description: JSON:API protocol request resource. properties: attributes: $ref: "#/components/schemas/ExperimentsCreateExperimentProtocolRequestDataAttributes" type: $ref: "#/components/schemas/ExperimentsPublicProtocolResponseDataType" required: - type - attributes type: object ExperimentsCreateExperimentProtocolRequestDataAttributes: description: Create a draft protocol with the organization default subject type. properties: description: description: Optional text that explains the protocol. nullable: true type: string migration_metadata: additionalProperties: {} description: >- Metadata for imported resources. Must encode to at most 4096 bytes. Null clears it; omission preserves it on update. nullable: true type: object name: description: >- Protocol name. Leading and trailing spaces are removed. The trimmed name must contain 1 to 255 characters. example: Checkout conversion minLength: 1 pattern: .*\S.* type: string required: - name type: object ExperimentsCreateExperimentV2Request: description: "Request to create an experiment draft." example: data: attributes: assignments_end_date: "2026-08-15T00:00:00Z" assignments_start_date: "2026-08-01T00:00:00Z" datadog_flag_configuration: entry_point: environment_id: 550e8400-e29b-41d4-a716-446655440005 feature_flag_id: 550e8400-e29b-41d4-a716-446655440004 targeting_rules: [] decision_metrics: - is_primary: true metric_id: b1a2c3d4-0000-0000-0000-000000000000 events_end_date: "2026-08-22T00:00:00Z" events_start_date: "2026-08-01T00:00:00Z" name: Checkout button test structured_metadata: - enum_values: - beta field_key: launch_stage - field_key: notes freetext_value: Checkout redesign subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 traffic_exposure: fraction: 1 mode: STATIC variants: - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440010 is_active: true is_control: true key: control weight: 50 - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440011 is_active: true is_control: false key: treatment weight: 50 type: experiments properties: data: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestData" required: - data type: object ExperimentsCreateExperimentV2RequestData: description: "Experiment resource to create." example: attributes: assignments_end_date: "2026-08-15T00:00:00Z" assignments_start_date: "2026-08-01T00:00:00Z" datadog_flag_configuration: entry_point: environment_id: 550e8400-e29b-41d4-a716-446655440005 feature_flag_id: 550e8400-e29b-41d4-a716-446655440004 targeting_rules: [] decision_metrics: - is_primary: true metric_id: b1a2c3d4-0000-0000-0000-000000000000 events_end_date: "2026-08-22T00:00:00Z" events_start_date: "2026-08-01T00:00:00Z" name: Checkout button test structured_metadata: - enum_values: - beta field_key: launch_stage - field_key: notes freetext_value: Checkout redesign subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 traffic_exposure: fraction: 1 mode: STATIC variants: - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440010 is_active: true is_control: true key: control weight: 50 - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440011 is_active: true is_control: false key: treatment weight: 50 type: experiments properties: attributes: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestDataAttributes" id: description: "Optional JSON:API resource identifier field." type: string type: $ref: "#/components/schemas/ExperimentsPatchExperimentV2ResponseDataType" required: - attributes - type type: object ExperimentsCreateExperimentV2RequestDataAttributes: description: "Configuration and descriptive fields for the new experiment draft." example: assignments_end_date: "2026-08-15T00:00:00Z" assignments_start_date: "2026-08-01T00:00:00Z" datadog_flag_configuration: entry_point: environment_id: 550e8400-e29b-41d4-a716-446655440005 feature_flag_id: 550e8400-e29b-41d4-a716-446655440004 targeting_rules: [] decision_metrics: - is_primary: true metric_id: b1a2c3d4-0000-0000-0000-000000000000 events_end_date: "2026-08-22T00:00:00Z" events_start_date: "2026-08-01T00:00:00Z" name: Checkout button test structured_metadata: - enum_values: - beta field_key: launch_stage - field_key: notes freetext_value: Checkout redesign subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 traffic_exposure: fraction: 1 mode: STATIC variants: - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440010 is_active: true is_control: true key: control weight: 50 - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440011 is_active: true is_control: false key: treatment weight: 50 properties: assignments_end_date: description: End of the window assignments are read from. Optional; must be after assignments_start_date. example: "2026-08-15T00:00:00Z" format: date-time nullable: true type: string assignments_start_date: description: Start of the window assignments are read from. Optional. example: "2026-08-01T00:00:00Z" format: date-time nullable: true type: string datadog_flag_configuration: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestDataAttributesDatadogFlagConfiguration" decision_metrics: description: "Metrics selected to support the experiment decision." example: - is_primary: true metric_id: b1a2c3d4-0000-0000-0000-000000000000 items: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestDataAttributesDecisionMetricsItems" type: array events_end_date: description: End of the window metric events are read from. Optional; must be after events_start_date. example: "2026-08-22T00:00:00Z" format: date-time nullable: true type: string events_start_date: description: >- Start of the window metric events are read from. Optional; must fall within the assignments window. example: "2026-08-01T00:00:00Z" format: date-time nullable: true type: string hypothesis: description: What the experiment is expected to show. Optional and free-form. type: string migration_metadata: description: "Metadata associated with migration of this resource." name: description: >- Display name for the experiment. The only required attribute: a request carrying nothing but a name is accepted. example: Checkout button test type: string protocol_id: description: >- Published protocol whose defaults create this draft. May be combined with hypothesis, tags, teams, related links, and date overrides. Omit subject_type_id, decision_metrics, variants, warehouse_exposure_configuration, datadog_flag_configuration, traffic_exposure, and structured_metadata. type: string related_links: description: "External links associated with the experiment." items: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestDataAttributesRelatedLinksItems" type: array split_by_properties: description: >- Complete Datadog split-by selection. Identify each property by column_name. Omit this field to copy organization defaults. items: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestDataAttributesSplitByPropertiesItems" type: array structured_metadata: description: "Custom metadata fields and their values for the experiment." example: - enum_values: - beta field_key: launch_stage - field_key: notes freetext_value: Checkout redesign items: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestDataAttributesStructuredMetadataItems" type: array subject_type_id: description: Canonical ID of an existing subject type. Optional; defaults to the organization default. example: c2b3d4e5-0000-0000-0000-000000000000 format: uuid type: string summary: description: Summary of the experiment. Optional and free-form. type: string tags: description: Non-team tag names to apply. Optional. items: description: Non-team tag names to apply. Optional. type: string type: array teams: description: Team handles that own the experiment. Optional. items: description: Team handles that own the experiment. Optional. type: string type: array traffic_exposure: $ref: "#/components/schemas/ExperimentsPatchExperimentV2ResponseDataAttributesTrafficExposure" variants: description: "Variants selected for the experiment and their traffic allocations." example: - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440010 is_active: true is_control: true key: control weight: 50 - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440011 is_active: true is_control: false key: treatment weight: 50 items: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestDataAttributesVariantsItems" type: array warehouse_exposure_configuration: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestDataAttributesWarehouseExposureConfiguration" required: - name type: object ExperimentsCreateExperimentV2RequestDataAttributesDatadogFlagConfiguration: description: "Feature flag, environment, and targeting configuration for a Datadog experiment." example: entry_point: environment_id: 550e8400-e29b-41d4-a716-446655440005 feature_flag_id: 550e8400-e29b-41d4-a716-446655440004 targeting_rules: [] nullable: true properties: entry_point: $ref: >- #/components/schemas/ExperimentsPatchExperimentV2ResponseDataAttributesDatadogFlagConfigurationEntryPoint environment_id: description: "Identifier of the feature flag environment." example: 550e8400-e29b-41d4-a716-446655440005 format: uuid type: string feature_flag_id: description: "Identifier of the Datadog feature flag used by the experiment." example: 550e8400-e29b-41d4-a716-446655440004 format: uuid type: string reset_on_feature_flag_change: description: Accepted on create but has no effect. type: boolean targeting_rules: description: Use an empty array when no targeting rules apply. example: [] items: $ref: >- #/components/schemas/ExperimentsTargetingRule type: array required: - entry_point - environment_id - feature_flag_id - targeting_rules type: object ExperimentsCreateExperimentV2RequestDataAttributesDecisionMetricsItems: description: "Metric used to make an experiment decision, with its primary metric designation." example: is_primary: true metric_id: b1a2c3d4-0000-0000-0000-000000000000 properties: is_primary: description: Whether this is the experiment primary metric. example: true type: boolean metric_id: description: Decision metric UUID. example: b1a2c3d4-0000-0000-0000-000000000000 format: uuid type: string required: - is_primary - metric_id type: object ExperimentsCreateExperimentV2RequestDataAttributesRelatedLinksItems: description: "External link associated with an experiment." properties: id: description: Link ID. Omit it when adding a link. nullable: true type: string title: description: Optional display title. nullable: true type: string url: description: Absolute URL. example: https://example.com type: string required: - url type: object ExperimentsCreateExperimentV2RequestDataAttributesSplitByPropertiesItems: description: >- Complete Datadog split-by selection. Identify each property by column_name. Omit this field to copy organization defaults. properties: column_name: description: Exposure field that identifies the property. example: column name type: string column_type: $ref: >- #/components/schemas/ExperimentsDatadogEntryPointFilterColumnType name: description: Optional display name. Defaults to column_name for a new property. type: string required: - column_name type: object ExperimentsCreateExperimentV2RequestDataAttributesStructuredMetadataItems: description: "Metadata field key and values to set on the experiment." example: enum_values: - beta field_key: launch_stage properties: enum_values: description: "Selected values for an enumerated metadata field." example: - beta items: description: "One selected value for the metadata field." example: beta type: string type: array field_key: description: "Key that identifies the metadata field." example: launch_stage type: string freetext_value: description: "Text value for a free-text metadata field." type: string required: - field_key type: object ExperimentsCreateExperimentV2RequestDataAttributesTrafficExposureMode: description: "Whether exposure uses a fixed fraction or a sequence of steps." enum: - STATIC - STEPS example: STATIC type: string x-enum-varnames: - STATIC - STEPS ExperimentsCreateExperimentV2RequestDataAttributesTrafficExposureStepsItems: description: >- Configured exposure plan rather than wall-clock history. At least two steps must have strictly increasing fractions and no gaps. Warehouse steps start at assignments_start_date and can use different durations. New Datadog plans have at most five steps and a first fraction above zero. Their nonfinal durations must be equal and exclude time paused. Datadog steps start with the experiment. Running warehouse experiments can replace step fractions, durations, and the exposure mode. After start, Datadog exposure plans cannot change through the public API. The final duration is null and its fraction holds until assignment ends. properties: duration_ms: description: >- Positive step duration in milliseconds. Datadog durations exclude pauses. Send null for the final step. example: format: int64 nullable: true type: integer fraction: description: "Fraction of traffic exposed during this step." example: 0 format: double type: number required: - duration_ms - fraction type: object ExperimentsCreateExperimentV2RequestDataAttributesVariantsItems: description: "Variant selected for an experiment, with its identity and traffic allocation." example: feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440010 is_active: true is_control: true key: control weight: 50 properties: feature_flag_variant_id: description: >- Stable backing flag variant ID. Required for Datadog-backed experiments and omitted for Warehouse-only experiments. example: 550e8400-e29b-41d4-a716-446655440010 format: uuid type: string is_active: description: >- Whether this variant participates in the experiment. Responses always include this field. On writes an included variant defaults to active; omit its row to remove or unselect it. Explicit false supports sending an unchanged response back. example: true type: boolean is_control: description: Whether this is the single control variant. example: true type: boolean key: description: Assignment value. Datadog flag variant keys are server-owned. example: control type: string name: description: Display name. Datadog flag variant names are server-owned. nullable: true type: string weight: description: >- Traffic allocation percentage. Existing variant weights cannot change through the public API after the experiment starts. example: 50 format: double type: number required: - is_control - key - weight type: object ExperimentsCreateExperimentV2RequestDataAttributesWarehouseExposureConfiguration: description: "Warehouse model and experiment key used to read assignment data." example: entry_point: experiment_key: checkout_button_test exposure_sql_model_id: f5e6a7b8-0000-0000-0000-000000000000 nullable: true properties: entry_point: $ref: >- #/components/schemas/ExperimentsWarehouseEntryPoint experiment_key: description: Warehouse experiment key. Must not be blank. example: checkout_button_test maxLength: 255 minLength: 1 pattern: ".*\\S.*" type: string exposure_sql_model_id: description: ID of the exposure SQL model that provides assignment data. example: f5e6a7b8-0000-0000-0000-000000000000 type: string required: - entry_point - experiment_key - exposure_sql_model_id type: object ExperimentsCreateExposureSQLModelV2Request: description: "Request to create a SQL model for experiment assignment data." example: data: attributes: date_partition_column: experiment_column: experiment_id name: Exposure events properties: - column_name: country column_type: STRING description: name: country sql: SELECT user_id, experiment_id, variant, exposed_at, country FROM analytics.exposures subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: exposed_at variant_column: variant type: exposure-sql-models properties: data: $ref: "#/components/schemas/ExperimentsCreateExposureSQLModelV2RequestData" required: - data type: object ExperimentsCreateExposureSQLModelV2RequestData: description: "Exposure SQL model resource to create." example: attributes: date_partition_column: experiment_column: experiment_id name: Exposure events properties: - column_name: country column_type: STRING description: name: country sql: SELECT user_id, experiment_id, variant, exposed_at, country FROM analytics.exposures subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: exposed_at variant_column: variant type: exposure-sql-models properties: attributes: $ref: "#/components/schemas/ExperimentsUpdateExposureSQLModelV2RequestDataAttributes" id: description: "Optional JSON:API resource identifier field." type: string type: $ref: "#/components/schemas/ExperimentsUpdateExposureSQLModelV2RequestDataType" required: - type - attributes type: object ExperimentsCreateExposureSQLModelV2RequestDataAttributesItemsColumnType: description: "Data type of a column in the SQL model." enum: - STRING - INTEGER - FLOAT - BOOLEAN - DATE - TIMESTAMP example: STRING type: string x-enum-varnames: - STRING - INTEGER - FLOAT - BOOLEAN - DATE - TIMESTAMP ExperimentsCreateExposureSQLModelV2RequestDataAttributesSubjectTypesItems: description: "Mapping between a subject type and its identifier column in the SQL model." example: column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 properties: column_name: description: "SQL result column that contains the subject identifier." example: user_id type: string subject_type_id: description: "Identifier of the subject type mapped to this column." example: 550e8400-e29b-41d4-a716-446655440010 type: string required: - column_name - subject_type_id type: object ExperimentsCreateMetricCollectionV2Request: description: "Request to create a reusable collection of metrics." example: data: attributes: name: Activation type: metric-collections properties: data: $ref: "#/components/schemas/ExperimentsCreateMetricCollectionV2RequestData" required: - data type: object ExperimentsCreateMetricCollectionV2RequestData: description: "Metric collection resource to create." example: attributes: name: Activation type: metric-collections properties: attributes: $ref: "#/components/schemas/ExperimentsCreateMetricCollectionV2RequestDataAttributes" id: description: "Optional JSON:API resource identifier field." type: string type: $ref: "#/components/schemas/ExperimentsPatchMetricCollectionV2RequestDataType" required: - attributes - type type: object ExperimentsCreateMetricCollectionV2RequestDataAttributes: description: "Name, description, and metric selection for the new collection." example: name: Activation properties: description: description: "Description of the metric collection." nullable: true type: string is_guardrail: description: "Whether the collection is designated as a guardrail collection." type: boolean metrics: description: "Metrics to include in the collection." items: $ref: "#/components/schemas/ExperimentsCreateMetricCollectionV2RequestDataAttributesMetricsItems" type: array name: description: "Display name of the metric collection." example: Checkout conversion type: string required: - name type: object ExperimentsCreateMetricCollectionV2RequestDataAttributesMetricsItems: description: "Reference to a metric to include in the collection." properties: metric_id: description: "Identifier of the metric to include in the collection." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string required: - metric_id type: object ExperimentsCreateMetricNumeratorAttributes: additionalProperties: false description: >- Configuration for a metric calculated from a numerator and an optional denominator. Omit percentile_aggregation. Omit denominator_aggregation when unused. example: data_source_type: CUSTOMER_WAREHOUSE description: desired_change: METRIC_INCREASES format_as_percent: true guardrail_cutoff_threshold: name: Checkout conversion numerator_aggregation: operation: sum property_filters: - - operation: IS property_id: 550e8400-e29b-41d4-a716-446655440023 values: - US timeframe_start_value: 0 warehouse_metric_measure: id: 550e8400-e29b-41d4-a716-446655440021 properties: data_source_type: $ref: "#/components/schemas/ExperimentsCreateMetricV2RequestDataAttributesDataSourceType" denominator_aggregation: $ref: "#/components/schemas/ExperimentsCreateMetricV2RequestDataAttributesNumeratorAggregation" description: description: Description of the metric. Send null to leave it unset. example: nullable: true type: string desired_change: $ref: "#/components/schemas/ExperimentsCreateMetricV2RequestDataAttributesDesiredChange" format_as_percent: description: Whether results render as a percentage. Defaults to false when omitted. example: true type: boolean guardrail_cutoff_threshold: description: Guardrail cutoff threshold. Send null to leave it unset. example: format: double nullable: true type: number migration_metadata: description: Metadata associated with migration of this resource. name: description: Name of the metric. example: Checkout conversion type: string numerator_aggregation: $ref: "#/components/schemas/ExperimentsCreateMetricV2RequestDataAttributesNumeratorAggregation" required: - data_source_type - desired_change - name - numerator_aggregation type: object ExperimentsCreateMetricPercentileAttributes: additionalProperties: false description: Configuration for a percentile metric. Omit numerator_aggregation and denominator_aggregation. example: data_source_type: CUSTOMER_WAREHOUSE description: desired_change: METRIC_INCREASES format_as_percent: true guardrail_cutoff_threshold: name: Checkout conversion percentile_aggregation: percentile: 0.95 warehouse_metric_measure: id: 550e8400-e29b-41d4-a716-446655440021 properties: data_source_type: $ref: "#/components/schemas/ExperimentsCreateMetricV2RequestDataAttributesDataSourceType" description: description: Description of the metric. Send null to leave it unset. example: nullable: true type: string desired_change: $ref: "#/components/schemas/ExperimentsCreateMetricV2RequestDataAttributesDesiredChange" format_as_percent: description: Whether results render as a percentage. Defaults to false when omitted. example: true type: boolean guardrail_cutoff_threshold: description: Guardrail cutoff threshold. Send null to leave it unset. example: format: double nullable: true type: number migration_metadata: description: Metadata associated with migration of this resource. name: description: Name of the metric. example: Checkout conversion type: string percentile_aggregation: $ref: "#/components/schemas/ExperimentsCreateMetricV2RequestDataAttributesPercentileAggregation" required: - data_source_type - desired_change - name - percentile_aggregation type: object ExperimentsCreateMetricSQLModelV2Request: description: "Request to create a SQL model that supplies metric data." example: data: attributes: date_partition_column: description: measures: - column_name: revenue column_type: FLOAT description: name: name: Order facts properties: - column_name: item_type column_type: STRING description: name: item_type sql: SELECT user_id, order_id, item_type, revenue, created_at FROM analytics.orders subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: created_at type: metric-sql-models properties: data: $ref: "#/components/schemas/ExperimentsCreateMetricSQLModelV2RequestData" required: - data type: object ExperimentsCreateMetricSQLModelV2RequestData: description: "Metric SQL model resource to create." example: attributes: date_partition_column: description: measures: - column_name: revenue column_type: FLOAT description: name: name: Order facts properties: - column_name: item_type column_type: STRING description: name: item_type sql: SELECT user_id, order_id, item_type, revenue, created_at FROM analytics.orders subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: created_at type: metric-sql-models properties: attributes: $ref: "#/components/schemas/ExperimentsUpdateMetricSQLModelV2RequestDataAttributes" id: description: "Optional JSON:API resource identifier field." type: string type: $ref: "#/components/schemas/ExperimentsUpdateMetricSQLModelV2RequestDataType" required: - type - attributes type: object ExperimentsCreateMetricSQLModelV2RequestDataAttributesMeasuresItems: description: "Column in the SQL model that supplies values for a metric measure." example: column_name: revenue column_type: FLOAT description: name: properties: column_name: description: "SQL result column that contains the measure values." example: revenue type: string column_type: $ref: "#/components/schemas/ExperimentsCreateExposureSQLModelV2RequestDataAttributesItemsColumnType" description: description: "Description of the measure." example: nullable: true type: string migration_metadata: description: "Metadata associated with migration of this resource." name: description: "Display name of the measure." example: nullable: true type: string required: - column_name - column_type type: object ExperimentsCreateMetricV2Request: description: "Request to create an experiment metric." example: data: attributes: data_source_type: CUSTOMER_WAREHOUSE description: desired_change: METRIC_INCREASES format_as_percent: true guardrail_cutoff_threshold: name: Checkout conversion numerator_aggregation: operation: sum property_filters: - - operation: IS property_id: 550e8400-e29b-41d4-a716-446655440023 values: - US timeframe_start_value: 0 warehouse_metric_measure: id: 550e8400-e29b-41d4-a716-446655440021 type: metrics properties: data: $ref: "#/components/schemas/ExperimentsCreateMetricV2RequestData" required: - data type: object ExperimentsCreateMetricV2RequestData: description: "Metric resource to create." example: attributes: data_source_type: CUSTOMER_WAREHOUSE description: desired_change: METRIC_INCREASES format_as_percent: true guardrail_cutoff_threshold: name: Checkout conversion numerator_aggregation: operation: sum property_filters: - - operation: IS property_id: 550e8400-e29b-41d4-a716-446655440023 values: - US timeframe_start_value: 0 warehouse_metric_measure: id: 550e8400-e29b-41d4-a716-446655440021 type: metrics properties: attributes: $ref: "#/components/schemas/ExperimentsCreateMetricV2RequestDataAttributes" type: $ref: "#/components/schemas/MetricType" required: - type - attributes type: object ExperimentsCreateMetricV2RequestDataAttributes: description: >- Configuration for the new metric. Supply either numerator_aggregation or percentile_aggregation. A denominator_aggregation requires numerator_aggregation. Omit unused aggregation fields; do not send them as null. example: data_source_type: CUSTOMER_WAREHOUSE description: desired_change: METRIC_INCREASES format_as_percent: true guardrail_cutoff_threshold: name: Checkout conversion numerator_aggregation: operation: sum property_filters: - - operation: IS property_id: 550e8400-e29b-41d4-a716-446655440023 values: - US timeframe_start_value: 0 warehouse_metric_measure: id: 550e8400-e29b-41d4-a716-446655440021 oneOf: - $ref: "#/components/schemas/ExperimentsCreateMetricNumeratorAttributes" - $ref: "#/components/schemas/ExperimentsCreateMetricPercentileAttributes" ExperimentsCreateMetricV2RequestDataAttributesDataSourceType: description: Source of the data backing this metric. enum: - DATADOG - DATADOG_REFERENCE_TABLE - CUSTOMER_WAREHOUSE example: CUSTOMER_WAREHOUSE type: string x-enum-varnames: - DATADOG - DATADOG_REFERENCE_TABLE - CUSTOMER_WAREHOUSE ExperimentsCreateMetricV2RequestDataAttributesDesiredChange: description: "Direction of change that represents an improvement for this metric." enum: - METRIC_INCREASES - METRIC_DECREASES example: METRIC_INCREASES type: string x-enum-varnames: - METRIC_INCREASES - METRIC_DECREASES ExperimentsCreateMetricV2RequestDataAttributesNumeratorAggregation: description: >- Measure and calculation settings for a numerator or denominator aggregation. Supply exactly one non-null measure. example: operation: sum property_filters: - - operation: IS property_id: 550e8400-e29b-41d4-a716-446655440023 values: - US timeframe_start_value: 0 warehouse_metric_measure: id: 550e8400-e29b-41d4-a716-446655440021 oneOf: - $ref: "#/components/schemas/ExperimentsWarehouseMetricAggregationInput" - $ref: "#/components/schemas/ExperimentsDatadogMetricAggregationInput" ExperimentsCreateMetricV2RequestDataAttributesPercentileAggregation: description: Measure and percentile to calculate for the metric. Supply exactly one non-null measure. oneOf: - $ref: "#/components/schemas/ExperimentsWarehousePercentileAggregationInput" - $ref: "#/components/schemas/ExperimentsDatadogPercentileAggregationInput" ExperimentsCreateSubjectTypeV2Request: description: "Request to create a subject type for experiment assignments." example: data: attributes: name: User product_analytics_attribute: "@usr.id" warehouse_column_names: - user_id - customer_id type: subject-types properties: data: $ref: "#/components/schemas/ExperimentsCreateSubjectTypeV2RequestData" required: - data type: object ExperimentsCreateSubjectTypeV2RequestData: description: "Subject type resource to create." example: attributes: name: User product_analytics_attribute: "@usr.id" warehouse_column_names: - user_id - customer_id type: subject-types properties: attributes: $ref: "#/components/schemas/ExperimentsCreateSubjectTypeV2RequestDataAttributes" id: description: "Optional JSON:API resource identifier field." type: string type: $ref: "#/components/schemas/ExperimentsSubjectTypeV2DTODataType" required: - type - attributes type: object ExperimentsCreateSubjectTypeV2RequestDataAttributes: description: "Name and data field mappings for the new subject type." example: name: User product_analytics_attribute: "@usr.id" warehouse_column_names: - user_id - customer_id properties: migration_metadata: description: "Metadata associated with migration of this resource." name: description: "Display name of the subject type." example: User maxLength: 40 minLength: 3 pattern: ".*\\S.*" type: string product_analytics_attribute: description: "Product Analytics attribute used to identify subjects of this type." example: "@usr.id" type: string warehouse_column_names: description: "Warehouse column names associated with this subject type." example: - user_id - customer_id items: description: "One warehouse column name associated with the subject type." example: user_id type: string type: array required: - name type: object ExperimentsDatadogEntryPointFilter: description: Complete Datadog OR-of-ANDs entry-point filter expression. properties: column: description: "Exposure field evaluated by the entry-point filter." example: column type: string column_type: $ref: >- #/components/schemas/ExperimentsDatadogEntryPointFilterColumnType operation: $ref: >- #/components/schemas/ExperimentsDatadogEntryPointFilterOperation values: description: "Comparison values used by the filter operation." example: [] items: description: "One comparison value for the filter." type: string type: array required: - column - column_type - operation - values type: object ExperimentsDatadogEntryPointFilterColumnType: description: "Data type of the column evaluated by the entry-point filter." enum: - varchar - int - double - boolean - varchar_array - int_array - double_array - raw example: varchar type: string x-enum-varnames: - VARCHAR - INT - DOUBLE - BOOLEAN - VARCHAR_ARRAY - INT_ARRAY - DOUBLE_ARRAY - RAW ExperimentsDatadogEntryPointFilterGroup: description: Entry-point filters combined with AND. items: $ref: "#/components/schemas/ExperimentsDatadogEntryPointFilter" type: array ExperimentsDatadogEntryPointFilterOperation: description: "Comparison applied by the Datadog entry-point filter." enum: - eq - in - neq - not_in - gte - lte - gt - lt example: eq type: string x-enum-varnames: - EQ - IN - NEQ - NOT_IN - GTE - LTE - GT - LT ExperimentsDatadogMetricAggregationInput: description: >- Settings for a metric aggregation that uses a Datadog measure. The other measure must be omitted or null. properties: aging_threshold_days: description: >- Stored aging threshold in days. The subject aging filter uses the aggregation window end and unit. format: int64 type: integer datadog_metric_measure: $ref: "#/components/schemas/ExperimentsDatadogMetricMeasureInput" enable_aging_subject_filter: description: Whether to exclude subjects whose observation time is shorter than the aggregation window. type: boolean operation: description: Calculation applied to the measure values, such as sum. example: sum minLength: 1 pattern: \S type: string property_filters: description: Property filters that select data for this aggregation. example: - - operation: IS property_id: 550e8400-e29b-41d4-a716-446655440023 values: - US items: $ref: "#/components/schemas/ExperimentsPropertyFilterInputGroup" nullable: true type: array threshold_aggregation_type: description: Calculation used to evaluate the threshold. type: string threshold_breach_value: description: Value used to determine whether the threshold is breached. format: double type: number threshold_comparison_operator: description: Operator used to compare the calculated value with the threshold. type: string threshold_timeframe_dimension: description: |- Time unit for the threshold evaluation window. Supports seconds, minutes, hours, days, calendar_days, and weeks. Calendar days start at midnight on the assignment day. Other units start at the assignment time. type: string threshold_timeframe_value: description: End of the threshold evaluation window, measured from assignment in the configured time unit. format: double type: number timeframe_end_value: description: End offset of the aggregation window from assignment, in timeframe_unit. format: double type: number timeframe_start_value: description: Start offset of the aggregation window from assignment, in timeframe_unit. example: 0 format: double type: number timeframe_unit: description: |- Time unit for the aggregation window. Calendar days are measured from midnight on the assignment day. Other units are measured from the assignment time. type: string warehouse_metric_measure: $ref: "#/components/schemas/ExperimentsNullableWarehouseMetricMeasureInput" winsor_lower_fixed_value: description: Fixed lower bound used to cap extreme measure values. format: double type: number winsor_lower_percentile: description: Percentile used to determine the lower bound for extreme measure values. format: double type: number winsor_upper_fixed_value: description: Fixed upper bound used to cap extreme measure values. format: double type: number winsor_upper_percentile: description: Percentile used to determine the upper bound for extreme measure values. format: double type: number winsorization_strategy: description: Method used to cap extreme measure values before aggregation. type: string required: - operation - datadog_metric_measure type: object ExperimentsDatadogMetricMeasureInput: description: Datadog source and query that supply values for the metric. properties: column_name: description: Name of the Datadog event field used by this measure. example: "@view.time_spent" type: string column_type: description: Data type of the source column. example: double minLength: 1 pattern: \S type: string filters: description: Conditions used to select the metric's source data. name: description: Display name of the Datadog measure. example: View duration minLength: 1 pattern: \S type: string query: description: Query used to retrieve the Datadog measure. type: string source_definition_filter: description: Filter applied to the Datadog source definition. source_subtype: description: Subtype of the Datadog data source. example: RUM_VIEWS minLength: 1 pattern: \S type: string source_type: description: Type of Datadog data source used for the measure. example: PRODUCT_ANALYTICS minLength: 1 pattern: \S type: string required: - name - source_type - source_subtype - column_type type: object ExperimentsDatadogPercentileAggregationInput: description: >- Settings for a percentile aggregation that uses a Datadog measure. The other measure must be omitted or null. properties: datadog_metric_measure: $ref: "#/components/schemas/ExperimentsDatadogPercentileMeasureInput" percentile: description: Percentile to calculate from the measure values. example: 0.95 exclusiveMaximum: true exclusiveMinimum: true format: double maximum: 1 minimum: 0 type: number property_filters: description: Property filters that select data for the percentile calculation. items: $ref: "#/components/schemas/ExperimentsPropertyFilterInputGroup" nullable: true type: array warehouse_metric_measure: $ref: "#/components/schemas/ExperimentsNullableWarehouseMetricMeasureInput" required: - percentile - datadog_metric_measure type: object ExperimentsDatadogPercentileMeasureInput: description: Datadog measure used to calculate a percentile. properties: column_name: description: Name of the Datadog event field used by this measure. example: "@view.time_spent" minLength: 1 pattern: \S type: string column_type: description: Data type of the source column. example: double minLength: 1 pattern: \S type: string filters: description: Conditions used to select the metric's source data. name: description: Display name of the Datadog measure. example: View duration minLength: 1 pattern: \S type: string query: description: Query used to retrieve the Datadog measure. type: string source_definition_filter: description: Filter applied to the Datadog source definition. source_subtype: description: Subtype of the Datadog data source. example: RUM_VIEWS minLength: 1 pattern: \S type: string source_type: description: Type of Datadog data source used for the measure. example: PRODUCT_ANALYTICS minLength: 1 pattern: \S type: string required: - name - source_type - source_subtype - column_type - column_name type: object ExperimentsExperimentDiagnosticsV2DTO: description: "Response containing the diagnostic checks for an experiment." properties: data: $ref: "#/components/schemas/ExperimentsExperimentDiagnosticsV2DTOData" required: - data type: object ExperimentsExperimentDiagnosticsV2DTOData: description: "Experiment diagnostics resource with its identifier and check results." properties: attributes: $ref: "#/components/schemas/ExperimentsExperimentDiagnosticsV2DTODataAttributes" id: description: "Identifier of the experiment whose diagnostics are returned." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string type: $ref: "#/components/schemas/ExperimentsExperimentDiagnosticsV2DTODataType" required: - type - id type: object ExperimentsExperimentDiagnosticsV2DTODataAttributes: description: "Diagnostic check results and their evaluation state." properties: diagnostics: description: "Results of individual diagnostic checks." example: [] items: $ref: "#/components/schemas/ExperimentsExperimentDiagnosticsV2DTODataAttributesDiagnosticsItems" type: array evaluated_at: description: "Time when the diagnostic checks were evaluated." format: date-time nullable: true type: string result: $ref: "#/components/schemas/ExperimentsExperimentDiagnosticsV2DTODataAttributesResult" state: $ref: "#/components/schemas/ExperimentsExperimentDiagnosticsV2DTODataAttributesState" required: - diagnostics - state type: object ExperimentsExperimentDiagnosticsV2DTODataAttributesDiagnosticsItems: description: "Result of one diagnostic check for an experiment." properties: message: description: "Explanation of the diagnostic check result." nullable: true type: string metric_id: description: "Identifier of the metric associated with this check." nullable: true type: string skipped_reason: $ref: "#/components/schemas/ExperimentsExperimentDiagnosticsV2DTODataAttributesDiagnosticsItemsSkippedReason" status: $ref: "#/components/schemas/ExperimentsExperimentDiagnosticsV2DTODataAttributesDiagnosticsItemsStatus" title: description: "Short title of the diagnostic check." example: title type: string type: $ref: "#/components/schemas/ExperimentsExperimentDiagnosticsV2DTODataAttributesDiagnosticsItemsType" required: - status - title - type type: object ExperimentsExperimentDiagnosticsV2DTODataAttributesDiagnosticsItemsSkippedReason: description: "Reason the diagnostic check could not be evaluated." enum: - NO_ASSIGNMENTS - NO_DIMENSIONAL_DATA - NO_METRIC_DATA - ZERO_VARIANCE nullable: true type: string x-enum-varnames: - NO_ASSIGNMENTS - NO_DIMENSIONAL_DATA - NO_METRIC_DATA - ZERO_VARIANCE ExperimentsExperimentDiagnosticsV2DTODataAttributesDiagnosticsItemsStatus: description: "Outcome of an individual diagnostic check." enum: - PASS - FAIL - WARN - ERROR - SKIPPED example: PASS type: string x-enum-varnames: - PASS - FAIL - WARN - ERROR - SKIPPED ExperimentsExperimentDiagnosticsV2DTODataAttributesDiagnosticsItemsType: description: "Kind of diagnostic check performed." enum: - EXPERIMENT_HAS_ASSIGNMENTS - METRIC_HAS_DATA - ASSIGNMENT_IMBALANCE - METRIC_WINSORIZE_ZERO - PRE_EXPERIMENT_IMBALANCE - MIXED_ASSIGNMENTS - DIMENSIONAL_ASSIGNMENT_IMBALANCE - FLAG_HAS_EVALUATIONS - IMPLAUSIBLE_PRIOR - DIMENSIONAL_DEGRADATION - PIPELINE_STATUS - MAPPED_ANALYSIS_CONFIGURATION - MAPPED_ANALYSIS_COVERAGE - MAPPED_ANALYSIS_COLLISIONS - MAPPED_ANALYSIS_FANOUT - MAPPED_ANALYSIS_CHANGE example: EXPERIMENT_HAS_ASSIGNMENTS type: string x-enum-varnames: - EXPERIMENT_HAS_ASSIGNMENTS - METRIC_HAS_DATA - ASSIGNMENT_IMBALANCE - METRIC_WINSORIZE_ZERO - PRE_EXPERIMENT_IMBALANCE - MIXED_ASSIGNMENTS - DIMENSIONAL_ASSIGNMENT_IMBALANCE - FLAG_HAS_EVALUATIONS - IMPLAUSIBLE_PRIOR - DIMENSIONAL_DEGRADATION - PIPELINE_STATUS - MAPPED_ANALYSIS_CONFIGURATION - MAPPED_ANALYSIS_COVERAGE - MAPPED_ANALYSIS_COLLISIONS - MAPPED_ANALYSIS_FANOUT - MAPPED_ANALYSIS_CHANGE ExperimentsExperimentDiagnosticsV2DTODataAttributesResult: description: "Overall result of the experiment diagnostic checks." enum: - PASS - FAIL - WARN - NO_DATA nullable: true type: string x-enum-varnames: - PASS - FAIL - WARN - NO_DATA ExperimentsExperimentDiagnosticsV2DTODataAttributesState: description: "Current state of the diagnostic evaluation." enum: - NOT_STARTED - RUNNING - COMPLETED - FAILED example: NOT_STARTED type: string x-enum-varnames: - NOT_STARTED - RUNNING - COMPLETED - FAILED ExperimentsExperimentDiagnosticsV2DTODataType: default: experiment-diagnostics description: Experiment diagnostics resource type. enum: - experiment-diagnostics example: experiment-diagnostics type: string x-enum-varnames: - EXPERIMENT_DIAGNOSTICS ExperimentsExperimentMetricGroupMutationV2: description: "Response containing the saved experiment metric group and result refresh information." properties: data: $ref: "#/components/schemas/ExperimentsExperimentMetricGroupMutationV2Data" meta: $ref: "#/components/schemas/ExperimentsPatchExperimentV2MetaDTO" required: - data type: object ExperimentsExperimentMetricGroupMutationV2Data: description: "Experiment metric group resource with its identifier and metric selection." properties: attributes: $ref: "#/components/schemas/ExperimentsExperimentMetricGroupV2DTODataAttributes" id: description: "Identifier of the experiment metric group." example: "550e8400-e29b-41d4-a716-446655440022" format: uuid type: string type: $ref: "#/components/schemas/ExperimentsPatchExperimentMetricGroupV2RequestDataType" required: - id - type type: object ExperimentsExperimentMetricGroupMutationV2DataAttributesMetricsItems: description: "Metric in an experiment metric group, with its name and primary metric designation." properties: is_primary: description: Whether this is the experiment primary metric. example: false type: boolean metric_id: description: "Identifier of the metric in the group." example: 550e8400-e29b-41d4-a716-446655440000 type: string metric_name: description: "Display name of the metric in the group." example: metric name type: string required: - is_primary - metric_id - metric_name type: object ExperimentsExperimentMetricGroupV2DTOArray: description: "Response containing the metric groups for an experiment." properties: data: description: "Metric groups associated with the experiment." example: [] items: $ref: "#/components/schemas/ExperimentsExperimentMetricGroupMutationV2Data" type: array required: - data type: object ExperimentsExperimentMetricGroupV2DTODataAttributes: description: "Name, purpose, and selected metrics of an experiment metric group." properties: is_decision: description: "Whether this group contains the experiment decision metrics." type: boolean metrics: description: "Metrics selected for this experiment metric group." items: $ref: "#/components/schemas/ExperimentsExperimentMetricGroupMutationV2DataAttributesMetricsItems" type: array migration_metadata: description: "Metadata associated with migration of this resource." name: description: "Display name of the experiment metric group." type: string type: object ExperimentsExperimentResultsV2MetaDTO: description: "Information about when experiment results were updated and whether they are stale." example: is_stale: true results_last_updated: "2026-08-05T09:25:00Z" stale_reasons: - ANALYSIS_PLAN_CHANGED properties: is_stale: description: |- Whether the saved results require a refresh or their freshness cannot be confirmed. See stale_reasons for details. example: true type: boolean results_last_updated: description: "Time when the experiment results were last updated." example: "2026-08-05T09:25:00Z" format: date-time nullable: true type: string stale_reasons: description: "Reasons the saved experiment results are stale." example: - ANALYSIS_PLAN_CHANGED items: description: "One reason the saved experiment results are stale." example: ANALYSIS_PLAN_CHANGED type: string type: array type: object ExperimentsExperimentV2DTO: description: "Response containing an experiment and its configuration." example: data: attributes: assignments_end_date: "2026-08-15T00:00:00Z" assignments_start_date: "2026-08-01T00:00:00Z" concluded_at: "2026-08-05T09:30:00Z" conclusion: decision_reason: The primary metric improved without material regressions outcome: POSITIVE summary: The treatment improved conversion created_at: "2026-08-01T12:00:00Z" datadog_flag_configuration: decision_metrics: - is_primary: true metric_id: b1a2c3d4-0000-0000-0000-000000000000 decision_variant_key: treatment events_end_date: "2026-08-22T00:00:00Z" events_start_date: "2026-08-01T00:00:00Z" experiment_type: STANDARD hypothesis: A clearer checkout button increases purchase conversion name: Checkout button test pipeline_table_suffix: a1b2c3d4 protocol_id: e4d5f6a7-0000-0000-0000-000000000000 related_links: - id: d1d2d3d4-0000-0000-0000-000000000000 title: Experiment design url: https://docs.example.com/checkout-experiment results_last_updated: "2026-08-05T09:25:00Z" split_by_properties: [] status: DECISION_MADE structured_metadata: - enum_values: - beta field_display_name: Launch stage field_key: launch_stage field_type: ENUM - field_display_name: Notes field_key: notes field_type: FREETEXT freetext_value: Checkout redesign subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 summary: The treatment improved conversion tags: - growth teams: - growth traffic_exposure: fraction: 1 mode: STATIC updated_at: "2026-08-05T09:30:00Z" variants: - is_active: true is_control: true key: control name: Control weight: 50 - is_active: true is_control: false key: treatment name: Treatment weight: 50 warehouse_exposure_configuration: entry_point: experiment_key: checkout_button_test exposure_sql_model_id: f5e6a7b8-0000-0000-0000-000000000000 id: 550e8400-e29b-41d4-a716-446655440000 type: experiments properties: data: $ref: "#/components/schemas/ExperimentsExperimentV2DTOData" required: - data type: object ExperimentsExperimentV2DTOData: description: "Experiment resource with its identifier and configuration." example: attributes: assignments_end_date: "2026-08-15T00:00:00Z" assignments_start_date: "2026-08-01T00:00:00Z" concluded_at: "2026-08-05T09:30:00Z" conclusion: decision_reason: The primary metric improved without material regressions outcome: POSITIVE summary: The treatment improved conversion created_at: "2026-08-01T12:00:00Z" datadog_flag_configuration: decision_metrics: - is_primary: true metric_id: b1a2c3d4-0000-0000-0000-000000000000 decision_variant_key: treatment events_end_date: "2026-08-22T00:00:00Z" events_start_date: "2026-08-01T00:00:00Z" experiment_type: STANDARD hypothesis: A clearer checkout button increases purchase conversion name: Checkout button test pipeline_table_suffix: a1b2c3d4 protocol_id: e4d5f6a7-0000-0000-0000-000000000000 related_links: - id: d1d2d3d4-0000-0000-0000-000000000000 title: Experiment design url: https://docs.example.com/checkout-experiment results_last_updated: "2026-08-05T09:25:00Z" split_by_properties: [] status: DECISION_MADE structured_metadata: - enum_values: - beta field_display_name: Launch stage field_key: launch_stage field_type: ENUM - field_display_name: Notes field_key: notes field_type: FREETEXT freetext_value: Checkout redesign subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 summary: The treatment improved conversion tags: - growth teams: - growth traffic_exposure: fraction: 1 mode: STATIC updated_at: "2026-08-05T09:30:00Z" variants: - is_active: true is_control: true key: control name: Control weight: 50 - is_active: true is_control: false key: treatment name: Treatment weight: 50 warehouse_exposure_configuration: entry_point: experiment_key: checkout_button_test exposure_sql_model_id: f5e6a7b8-0000-0000-0000-000000000000 id: 550e8400-e29b-41d4-a716-446655440000 type: experiments properties: attributes: $ref: "#/components/schemas/ExperimentsPatchExperimentV2ResponseDataAttributes" id: description: "Identifier of the experiment." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string type: $ref: "#/components/schemas/ExperimentsPatchExperimentV2ResponseDataType" required: - id - type type: object ExperimentsExperimentV2DTODataAttributesConclusionOutcome: description: Recorded experiment outcome. enum: - POSITIVE - NEGATIVE - NEUTRAL - INCONCLUSIVE - MISCONFIGURED - UNKNOWN example: POSITIVE nullable: true type: string x-enum-varnames: - POSITIVE - NEGATIVE - NEUTRAL - INCONCLUSIVE - MISCONFIGURED - UNKNOWN ExperimentsExperimentV2DTODataAttributesSplitByPropertiesItems: description: "Property used to split experiment results into analysis dimensions." properties: column_name: description: Exposure field or Warehouse column used for the analysis dimension. example: column name type: string column_type: $ref: >- #/components/schemas/ExperimentsPatchExperimentV2ResponseDataAttributesSplitByPropertiesItemsColumnType id: description: Read-only property ID. Omit it from POST and PATCH; writes identify properties by column_name. example: 550e8400-e29b-41d4-a716-446655440000 type: string name: description: Display name for the analysis dimension. example: Checkout conversion type: string required: - column_name - column_type - id - name type: object ExperimentsExperimentV2DTODataAttributesStatus: description: "Current stage in the experiment lifecycle." enum: - DRAFT - SCHEDULED - IN_PROGRESS - READY_FOR_DECISION - DECISION_MADE - CANCELLED - UNKNOWN example: DECISION_MADE type: string x-enum-varnames: - DRAFT - SCHEDULED - IN_PROGRESS - READY_FOR_DECISION - DECISION_MADE - CANCELLED - UNKNOWN ExperimentsExperimentV2DTODataAttributesVariantsItems: description: "Variant in an experiment, with its identity and traffic allocation." example: is_active: true is_control: true key: control name: Control weight: 50 properties: feature_flag_variant_id: description: >- Backing feature flag variant ID. Present for Datadog feature flag experiments and omitted for Warehouse experiments. type: string is_active: description: Whether this variant participates in the experiment. example: true type: boolean is_control: description: Whether this is the single control variant. example: true type: boolean key: description: Value recorded in exposure data for this variant. example: control type: string name: description: "Display name of the experiment variant." example: Control nullable: true type: string weight: description: Traffic allocation percentage. example: 50 format: double type: number required: - is_active - is_control - key - weight type: object ExperimentsExperimentV2ListDTOArray: description: "Response containing a page of experiment summaries." example: data: - attributes: assignments_end_date: "2026-08-15T00:00:00Z" assignments_start_date: "2026-08-01T00:00:00Z" concluded_at: "2026-08-05T09:30:00Z" conclusion: decision_reason: The primary metric improved without material regressions outcome: POSITIVE summary: The treatment improved conversion created_at: "2026-08-01T12:00:00Z" events_end_date: "2026-08-22T00:00:00Z" events_start_date: "2026-08-01T00:00:00Z" experiment_type: STANDARD hypothesis: A clearer checkout button increases purchase conversion name: Checkout button test pipeline_table_suffix: a1b2c3d4 protocol_id: e4d5f6a7-0000-0000-0000-000000000000 related_links: - id: d1d2d3d4-0000-0000-0000-000000000000 title: Experiment design url: https://docs.example.com/checkout-experiment results_last_updated: "2026-08-05T09:25:00Z" status: DECISION_MADE structured_metadata: - enum_values: - beta field_display_name: Launch stage field_key: launch_stage field_type: ENUM - field_display_name: Notes field_key: notes field_type: FREETEXT freetext_value: Checkout redesign subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 summary: The treatment improved conversion tags: - growth teams: - growth updated_at: "2026-08-05T09:30:00Z" id: 550e8400-e29b-41d4-a716-446655440000 type: experiments properties: data: description: "Experiment summaries in the current page." example: - attributes: assignments_end_date: "2026-08-15T00:00:00Z" assignments_start_date: "2026-08-01T00:00:00Z" concluded_at: "2026-08-05T09:30:00Z" conclusion: decision_reason: The primary metric improved without material regressions outcome: POSITIVE summary: The treatment improved conversion created_at: "2026-08-01T12:00:00Z" events_end_date: "2026-08-22T00:00:00Z" events_start_date: "2026-08-01T00:00:00Z" experiment_type: STANDARD hypothesis: A clearer checkout button increases purchase conversion name: Checkout button test pipeline_table_suffix: a1b2c3d4 protocol_id: e4d5f6a7-0000-0000-0000-000000000000 related_links: - id: d1d2d3d4-0000-0000-0000-000000000000 title: Experiment design url: https://docs.example.com/checkout-experiment results_last_updated: "2026-08-05T09:25:00Z" status: DECISION_MADE structured_metadata: - enum_values: - beta field_display_name: Launch stage field_key: launch_stage field_type: ENUM - field_display_name: Notes field_key: notes field_type: FREETEXT freetext_value: Checkout redesign subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 summary: The treatment improved conversion tags: - growth teams: - growth updated_at: "2026-08-05T09:30:00Z" id: 550e8400-e29b-41d4-a716-446655440000 type: experiments items: $ref: "#/components/schemas/ExperimentsExperimentV2ListDTOData" type: array links: $ref: "#/components/schemas/ExperimentsOffsetLinks" meta: $ref: "#/components/schemas/ExperimentsOffsetMeta" required: - data type: object ExperimentsExperimentV2ListDTOData: description: "Experiment resource returned in a list." example: attributes: assignments_end_date: "2026-08-15T00:00:00Z" assignments_start_date: "2026-08-01T00:00:00Z" concluded_at: "2026-08-05T09:30:00Z" conclusion: decision_reason: The primary metric improved without material regressions outcome: POSITIVE summary: The treatment improved conversion created_at: "2026-08-01T12:00:00Z" events_end_date: "2026-08-22T00:00:00Z" events_start_date: "2026-08-01T00:00:00Z" experiment_type: STANDARD hypothesis: A clearer checkout button increases purchase conversion name: Checkout button test pipeline_table_suffix: a1b2c3d4 protocol_id: e4d5f6a7-0000-0000-0000-000000000000 related_links: - id: d1d2d3d4-0000-0000-0000-000000000000 title: Experiment design url: https://docs.example.com/checkout-experiment results_last_updated: "2026-08-05T09:25:00Z" status: DECISION_MADE structured_metadata: - enum_values: - beta field_display_name: Launch stage field_key: launch_stage field_type: ENUM - field_display_name: Notes field_key: notes field_type: FREETEXT freetext_value: Checkout redesign subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 summary: The treatment improved conversion tags: - growth teams: - growth updated_at: "2026-08-05T09:30:00Z" id: 550e8400-e29b-41d4-a716-446655440000 type: experiments properties: attributes: $ref: "#/components/schemas/ExperimentsExperimentV2ListDTODataAttributes" id: description: "Identifier of the experiment." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string type: $ref: "#/components/schemas/ExperimentsPatchExperimentV2ResponseDataType" required: - id - type type: object ExperimentsExperimentV2ListDTODataAttributes: description: "Summary fields for an experiment returned in a list." example: assignments_end_date: "2026-08-15T00:00:00Z" assignments_start_date: "2026-08-01T00:00:00Z" concluded_at: "2026-08-05T09:30:00Z" conclusion: decision_reason: The primary metric improved without material regressions outcome: POSITIVE summary: The treatment improved conversion created_at: "2026-08-01T12:00:00Z" events_end_date: "2026-08-22T00:00:00Z" events_start_date: "2026-08-01T00:00:00Z" experiment_type: STANDARD hypothesis: A clearer checkout button increases purchase conversion name: Checkout button test pipeline_table_suffix: a1b2c3d4 protocol_id: e4d5f6a7-0000-0000-0000-000000000000 related_links: - id: d1d2d3d4-0000-0000-0000-000000000000 title: Experiment design url: https://docs.example.com/checkout-experiment results_last_updated: "2026-08-05T09:25:00Z" status: DECISION_MADE structured_metadata: - enum_values: - beta field_display_name: Launch stage field_key: launch_stage field_type: ENUM - field_display_name: Notes field_key: notes field_type: FREETEXT freetext_value: Checkout redesign subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 summary: The treatment improved conversion tags: - growth teams: - growth updated_at: "2026-08-05T09:30:00Z" properties: assignments_end_date: description: "End of the window used to read experiment assignments." example: "2026-08-15T00:00:00Z" format: date-time nullable: true type: string assignments_start_date: description: "Start of the window used to read experiment assignments." example: "2026-08-01T00:00:00Z" format: date-time nullable: true type: string concluded_at: description: "Time when the experiment was concluded." example: "2026-08-05T09:30:00Z" format: date-time nullable: true type: string conclusion: $ref: "#/components/schemas/ExperimentsPatchExperimentV2ResponseDataAttributesConclusion" created_at: description: "Time when the experiment was created." example: "2026-08-01T12:00:00Z" format: date-time type: string events_end_date: description: "End of the window used to read metric events." example: "2026-08-22T00:00:00Z" format: date-time nullable: true type: string events_start_date: description: "Start of the window used to read metric events." example: "2026-08-01T00:00:00Z" format: date-time nullable: true type: string experiment_type: description: >- Kind of experiment. STANDARD is an ordinary experiment. Other values, such as CANARY and HOLDOUT, identify experiments owned by another workflow. New kinds may be added; treat unknown values as non-standard. example: STANDARD type: string hypothesis: description: "Expected effect that the experiment is designed to test." example: A clearer checkout button increases purchase conversion type: string migration_metadata: description: "Metadata associated with migration of this resource." name: description: "Display name of the experiment." example: Checkout button test type: string pipeline_table_suffix: description: "Suffix used for the experiment tables in the analysis pipeline." example: a1b2c3d4 type: string protocol_id: description: "Identifier of the protocol associated with the experiment." example: e4d5f6a7-0000-0000-0000-000000000000 type: string related_links: description: "External links associated with the experiment." example: - id: d1d2d3d4-0000-0000-0000-000000000000 title: Experiment design url: https://docs.example.com/checkout-experiment items: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestDataAttributesRelatedLinksItems" type: array results_last_updated: description: "Time when the experiment results were last updated." example: "2026-08-05T09:25:00Z" format: date-time nullable: true type: string status: $ref: "#/components/schemas/ExperimentsExperimentV2DTODataAttributesStatus" structured_metadata: description: "Custom metadata fields and their values for the experiment." example: - enum_values: - beta field_display_name: Launch stage field_key: launch_stage field_type: ENUM - field_display_name: Notes field_key: notes field_type: FREETEXT freetext_value: Checkout redesign items: $ref: "#/components/schemas/ExperimentsStructuredMetadataResponse" type: array subject_type_id: description: "Identifier of the subject type used for experiment assignments." example: c2b3d4e5-0000-0000-0000-000000000000 nullable: true type: string summary: description: "Free-form summary of the experiment." example: The treatment improved conversion type: string tags: description: "Tag names associated with the experiment." example: - growth items: description: "One tag name associated with the experiment." example: growth type: string type: array teams: description: "Team handles associated with the experiment." example: - growth items: description: "One team handle associated with the experiment." example: growth type: string type: array updated_at: description: "Time when the experiment was last updated." example: "2026-08-05T09:30:00Z" format: date-time type: string type: object ExperimentsExposureSQLModelV2DTO: description: "Response containing a SQL model for experiment assignment data." example: data: attributes: created_at: "2024-01-01T12:00:00Z" experiment_column: experiment_id name: Exposure events properties: - column_name: country column_type: STRING id: 550e8400-e29b-41d4-a716-446655440031 name: country pipeline_column_suffix: cty001 sql: SELECT user_id, experiment_id, variant, exposed_at, country FROM analytics.exposures subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: exposed_at updated_at: "2024-01-01T12:00:00Z" variant_column: variant id: 550e8400-e29b-41d4-a716-446655440030 type: exposure-sql-models properties: data: $ref: "#/components/schemas/ExperimentsExposureSQLModelV2DTOData" required: - data type: object ExperimentsExposureSQLModelV2DTOArray: description: "Response containing a page of exposure SQL models." example: data: - attributes: created_at: "2024-01-01T12:00:00Z" experiment_column: experiment_id name: Exposure events properties: - column_name: country column_type: STRING id: 550e8400-e29b-41d4-a716-446655440031 name: country pipeline_column_suffix: cty001 sql: SELECT user_id, experiment_id, variant, exposed_at, country FROM analytics.exposures subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: exposed_at updated_at: "2024-01-01T12:00:00Z" variant_column: variant id: 550e8400-e29b-41d4-a716-446655440030 type: exposure-sql-models properties: data: description: "Exposure SQL models in the current page." example: - attributes: created_at: "2024-01-01T12:00:00Z" experiment_column: experiment_id name: Exposure events properties: [] sql: SELECT user_id, experiment_id, variant, exposed_at, country FROM analytics.exposures subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: exposed_at updated_at: "2024-01-01T12:00:00Z" variant_column: variant id: 550e8400-e29b-41d4-a716-446655440030 type: exposure-sql-models items: $ref: "#/components/schemas/ExperimentsExposureSQLModelV2DTOData" type: array links: $ref: "#/components/schemas/ExperimentsOffsetLinks" meta: $ref: "#/components/schemas/ExperimentsOffsetMeta" required: - data type: object ExperimentsExposureSQLModelV2DTOData: description: "Exposure SQL model resource with its identifier and configuration." example: attributes: created_at: "2024-01-01T12:00:00Z" experiment_column: experiment_id name: Exposure events properties: - column_name: country column_type: STRING id: 550e8400-e29b-41d4-a716-446655440031 name: country pipeline_column_suffix: cty001 sql: SELECT user_id, experiment_id, variant, exposed_at, country FROM analytics.exposures subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: exposed_at updated_at: "2024-01-01T12:00:00Z" variant_column: variant id: 550e8400-e29b-41d4-a716-446655440030 type: exposure-sql-models properties: attributes: $ref: "#/components/schemas/ExperimentsExposureSQLModelV2DTODataAttributes" id: description: "Identifier of the exposure SQL model." example: 550e8400-e29b-41d4-a716-446655440030 format: uuid type: string type: $ref: "#/components/schemas/ExperimentsUpdateExposureSQLModelV2RequestDataType" required: - id - type type: object ExperimentsExposureSQLModelV2DTODataAttributes: description: "Query and column mappings used to read experiment assignment data." example: created_at: "2024-01-01T12:00:00Z" experiment_column: experiment_id name: Exposure events properties: - column_name: country column_type: STRING id: 550e8400-e29b-41d4-a716-446655440031 name: country pipeline_column_suffix: cty001 sql: SELECT user_id, experiment_id, variant, exposed_at, country FROM analytics.exposures subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: exposed_at updated_at: "2024-01-01T12:00:00Z" variant_column: variant properties: archived_at: description: "Time when the exposure SQL model was archived." format: date-time nullable: true type: string created_at: description: "Time when the exposure SQL model was created." example: "2024-01-01T12:00:00Z" format: date-time type: string date_partition_column: description: "Column used to identify date partitions in the exposure data." nullable: true type: string experiment_column: description: "SQL result column that contains the experiment key." example: experiment_id type: string experiment_count: description: "Number of experiments associated with the exposure SQL model." format: int64 nullable: true type: integer migration_metadata: description: "Metadata associated with migration of this resource." name: description: "Display name of the exposure SQL model." example: Exposure events type: string properties: description: "Property columns available for filtering or splitting exposure data." example: - column_name: country column_type: STRING id: 550e8400-e29b-41d4-a716-446655440031 name: country pipeline_column_suffix: cty001 items: $ref: "#/components/schemas/ExperimentsExposureSQLModelV2DTODataAttributesItems" type: array sql: description: "SQL query that supplies the experiment assignment data." example: SELECT user_id, experiment_id, variant, exposed_at, country FROM analytics.exposures type: string subject_types: description: "Mappings between subject types and their identifier columns." example: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 items: $ref: "#/components/schemas/ExperimentsCreateExposureSQLModelV2RequestDataAttributesSubjectTypesItems" type: array timestamp_column: description: "SQL result column that contains the assignment timestamp." example: exposed_at type: string updated_at: description: "Time when the exposure SQL model was last updated." example: "2024-01-01T12:00:00Z" format: date-time type: string variant_column: description: "SQL result column that contains the assigned variant." example: variant type: string type: object ExperimentsExposureSQLModelV2DTODataAttributesItems: description: "Property column available from the exposure SQL model." example: column_name: country column_type: STRING id: 550e8400-e29b-41d4-a716-446655440031 name: country pipeline_column_suffix: cty001 properties: column_name: description: "SQL result column that contains this property." example: country type: string column_type: description: "Data type of the property column." example: STRING type: string description: description: "Description of the exposure property." type: string id: description: "Identifier of the exposure property." example: 550e8400-e29b-41d4-a716-446655440031 type: string migration_metadata: description: "Metadata associated with migration of this resource." name: description: "Display name of the exposure property." example: country type: string pipeline_column_suffix: description: "Suffix used for this property column in the analysis pipeline." example: cty001 type: string type: object ExperimentsInlineCondition: description: An inline condition. The saved_filter_id field must be omitted or null. properties: attribute: description: Attribute to evaluate. example: country minLength: 1 type: string operator: $ref: >- #/components/schemas/ExperimentsTargetingRuleOperator value: description: Values used by the operator. Every operator requires at least one value. example: - US items: description: A comparison value. type: string minItems: 1 type: array required: - attribute - operator - value type: object ExperimentsMeasureComparisonFilterInput: description: A measure comparison for metric source data. example: measure_id: 550e8400-e29b-41d4-a716-446655440023 operation: "=" values: - "1" properties: measure_id: description: ID of the measure on the aggregation source. example: 550e8400-e29b-41d4-a716-446655440023 format: uuid minLength: 1 pattern: \S type: string operation: $ref: "#/components/schemas/ExperimentsMeasureComparisonFilterInputOperation" property_id: description: Omit this target or use null or a blank string. example: "" nullable: true pattern: ^\s*$ type: string values: description: Values used by the comparison. example: - "1" items: description: One comparison value. example: "1" type: string maxItems: 1 minItems: 1 type: array required: - measure_id - operation - values type: object ExperimentsMeasureComparisonFilterInputOperation: description: Comparison applied by this filter. enum: - "=" - "!=" - ">" - ">=" - < - <= example: "=" type: string x-enum-varnames: - EQ - NEQ - GT - GT_EQ - LT - LT_EQ ExperimentsMeasureNullFilterInput: description: A measure comparison for metric source data. example: measure_id: 550e8400-e29b-41d4-a716-446655440023 operation: IS_NULL values: [] properties: measure_id: description: ID of the measure on the aggregation source. example: 550e8400-e29b-41d4-a716-446655440023 format: uuid minLength: 1 pattern: \S type: string operation: $ref: "#/components/schemas/ExperimentsPropertyNullFilterInputOperation" property_id: description: Omit this target or use null or a blank string. example: "" nullable: true pattern: ^\s*$ type: string values: description: Values used by the comparison. items: description: One comparison value. type: string maxItems: 0 nullable: true type: array required: - measure_id - operation type: object ExperimentsMeasureRangeFilterInput: description: A measure comparison for metric source data. example: measure_id: 550e8400-e29b-41d4-a716-446655440023 operation: BETWEEN values: - "1" - "2" properties: measure_id: description: ID of the measure on the aggregation source. example: 550e8400-e29b-41d4-a716-446655440023 format: uuid minLength: 1 pattern: \S type: string operation: $ref: "#/components/schemas/ExperimentsMeasureRangeFilterInputOperation" property_id: description: Omit this target or use null or a blank string. example: "" nullable: true pattern: ^\s*$ type: string values: description: Values used by the comparison. example: - "1" - "2" items: description: One comparison value. example: "1" type: string maxItems: 2 minItems: 2 type: array required: - measure_id - operation - values type: object ExperimentsMeasureRangeFilterInputOperation: description: Comparison applied by this filter. enum: - BETWEEN example: BETWEEN type: string x-enum-varnames: - BETWEEN ExperimentsMetricCollectionV2DTO: description: "Response containing the metric collection." example: data: attributes: created_at: "2026-08-01T12:00:00Z" description: Metrics reviewed for every checkout experiment. is_guardrail: false metrics: - metric_id: 550e8400-e29b-41d4-a716-446655440020 metric_name: Checkout conversion name: Checkout metrics updated_at: "2026-08-02T09:30:00Z" id: 550e8400-e29b-41d4-a716-446655440040 type: metric-collections properties: data: $ref: "#/components/schemas/ExperimentsMetricCollectionV2DTOData" required: - data type: object ExperimentsMetricCollectionV2DTOArray: description: "List of metric collection resources with pagination information." properties: data: description: "Resources returned in this response." example: [] items: $ref: "#/components/schemas/ExperimentsMetricCollectionV2DTOData" type: array links: $ref: "#/components/schemas/ExperimentsOffsetLinks" meta: $ref: "#/components/schemas/ExperimentsOffsetMeta" required: - data type: object ExperimentsMetricCollectionV2DTOData: description: "JSON:API resource containing the metric collection identity and fields." properties: attributes: $ref: "#/components/schemas/ExperimentsMetricCollectionV2DTODataAttributes" id: description: "ID of the metric collection." example: "550e8400-e29b-41d4-a716-446655440023" format: uuid type: string type: $ref: "#/components/schemas/ExperimentsPatchMetricCollectionV2RequestDataType" required: - id - type type: object ExperimentsMetricCollectionV2DTODataAttributes: description: "Details of the metric collection." properties: created_at: description: "Time when this resource was created." format: date-time type: string description: description: "Text that explains the metric collection." nullable: true type: string is_guardrail: description: "Whether the collection is used for guardrail metrics." type: boolean metric_count: description: "Number of metrics in this collection." format: int64 type: integer metrics: description: "Metrics included in this collection." items: $ref: "#/components/schemas/ExperimentsMetricCollectionV2DTODataAttributesMetricsItems" type: array name: description: "Display name of the metric collection." type: string updated_at: description: "Time when this resource was last updated." format: date-time type: string type: object ExperimentsMetricCollectionV2DTODataAttributesMetricsItems: description: "A metric included in the collection." properties: metric_id: description: "ID of the metric represented by this entry." type: string metric_name: description: "Display name of the metric represented by this entry." type: string type: object ExperimentsMetricPropertyFilter: description: "A comparison that selects metric data by a property or measure." example: operation: IS property_id: 550e8400-e29b-41d4-a716-446655440023 values: - US properties: measure_id: description: "ID of the measure evaluated by the filter." type: string operation: description: "Comparison applied by the filter." example: IS type: string property_id: description: "ID of the property evaluated by the filter." example: 550e8400-e29b-41d4-a716-446655440023 type: string values: description: "Values used by the filter's comparison." example: - US items: description: "One value used in the filter comparison." example: US type: string type: array type: object ExperimentsMetricPropertyFilterGroup: description: Metric property filters combined with AND. example: - operation: IS property_id: 550e8400-e29b-41d4-a716-446655440023 values: - US items: $ref: "#/components/schemas/ExperimentsMetricPropertyFilter" type: array ExperimentsMetricSQLModelPropertyInput: description: A property column defined by a metric SQL model. example: column_name: item_type column_type: STRING description: name: item_type properties: column_name: description: Name of the SQL result column that supplies this property. example: item_type type: string column_type: $ref: "#/components/schemas/ExperimentsCreateExposureSQLModelV2RequestDataAttributesItemsColumnType" description: description: Optional text that explains what this property represents. example: nullable: true type: string migration_metadata: description: Opaque metadata preserved when this property is migrated. name: description: Name used to identify the property in the model. example: item_type type: string required: - column_name - column_type - name type: object ExperimentsMetricSQLModelV2DTO: description: "Response containing the metric SQL model." example: data: attributes: created_at: "2024-01-01T12:00:00Z" event_count_measure_id: 550e8400-e29b-41d4-a716-446655440024 is_certified: false measures: - column_name: revenue column_type: FLOAT id: 550e8400-e29b-41d4-a716-446655440021 name: revenue name: Order facts properties: - column_name: item_type column_type: STRING id: 550e8400-e29b-41d4-a716-446655440023 name: item_type sql: SELECT user_id, order_id, item_type, revenue, created_at FROM analytics.orders subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 unique_subject_count_measure_id: 550e8400-e29b-41d4-a716-446655440022 timestamp_column: created_at updated_at: "2024-01-01T12:00:00Z" id: 550e8400-e29b-41d4-a716-446655440020 type: metric-sql-models properties: data: $ref: "#/components/schemas/ExperimentsMetricSQLModelV2DTOData" required: - data type: object ExperimentsMetricSQLModelV2DTOArray: description: "List of metric SQL model resources with pagination information." example: data: - attributes: created_at: "2024-01-01T12:00:00Z" event_count_measure_id: 550e8400-e29b-41d4-a716-446655440024 is_certified: false measures: - column_name: revenue column_type: FLOAT id: 550e8400-e29b-41d4-a716-446655440021 name: revenue name: Order facts properties: - column_name: item_type column_type: STRING id: 550e8400-e29b-41d4-a716-446655440023 name: item_type sql: SELECT user_id, order_id, item_type, revenue, created_at FROM analytics.orders subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 unique_subject_count_measure_id: 550e8400-e29b-41d4-a716-446655440022 timestamp_column: created_at updated_at: "2024-01-01T12:00:00Z" id: 550e8400-e29b-41d4-a716-446655440020 type: metric-sql-models properties: data: description: "Resources returned in this response." example: - attributes: created_at: "2024-01-01T12:00:00Z" event_count_measure_id: 550e8400-e29b-41d4-a716-446655440024 is_certified: false measures: - column_name: revenue column_type: FLOAT id: 550e8400-e29b-41d4-a716-446655440021 name: revenue name: Order facts properties: [] sql: SELECT user_id, order_id, item_type, revenue, created_at FROM analytics.orders subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 unique_subject_count_measure_id: 550e8400-e29b-41d4-a716-446655440022 timestamp_column: created_at updated_at: "2024-01-01T12:00:00Z" id: 550e8400-e29b-41d4-a716-446655440020 type: metric-sql-models items: $ref: "#/components/schemas/ExperimentsMetricSQLModelV2DTOData" type: array links: $ref: "#/components/schemas/ExperimentsOffsetLinks" meta: $ref: "#/components/schemas/ExperimentsOffsetMeta" required: - data type: object ExperimentsMetricSQLModelV2DTOData: description: "JSON:API resource containing the metric SQL model identity and fields." example: attributes: created_at: "2024-01-01T12:00:00Z" event_count_measure_id: 550e8400-e29b-41d4-a716-446655440024 is_certified: false measures: - column_name: revenue column_type: FLOAT id: 550e8400-e29b-41d4-a716-446655440021 name: revenue name: Order facts properties: - column_name: item_type column_type: STRING id: 550e8400-e29b-41d4-a716-446655440023 name: item_type sql: SELECT user_id, order_id, item_type, revenue, created_at FROM analytics.orders subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 unique_subject_count_measure_id: 550e8400-e29b-41d4-a716-446655440022 timestamp_column: created_at updated_at: "2024-01-01T12:00:00Z" id: 550e8400-e29b-41d4-a716-446655440020 type: metric-sql-models properties: attributes: $ref: "#/components/schemas/ExperimentsMetricSQLModelV2DTODataAttributes" id: description: "ID of the metric SQL model." example: 550e8400-e29b-41d4-a716-446655440020 format: uuid type: string type: $ref: "#/components/schemas/ExperimentsUpdateMetricSQLModelV2RequestDataType" required: - id - type type: object ExperimentsMetricSQLModelV2DTODataAttributes: description: "Details of the metric SQL model." example: created_at: "2024-01-01T12:00:00Z" event_count_measure_id: 550e8400-e29b-41d4-a716-446655440024 is_certified: false measures: - column_name: revenue column_type: FLOAT id: 550e8400-e29b-41d4-a716-446655440021 name: revenue name: Order facts properties: - column_name: item_type column_type: STRING id: 550e8400-e29b-41d4-a716-446655440023 name: item_type sql: SELECT user_id, order_id, item_type, revenue, created_at FROM analytics.orders subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 unique_subject_count_measure_id: 550e8400-e29b-41d4-a716-446655440022 timestamp_column: created_at updated_at: "2024-01-01T12:00:00Z" properties: certified_at: description: "Time when this resource was certified." format: date-time nullable: true type: string created_at: description: "Time when this resource was created." example: "2024-01-01T12:00:00Z" format: date-time type: string date_partition_column: description: "SQL column used to partition the source data by date." nullable: true type: string description: description: "Text that explains the metric SQL model." nullable: true type: string event_count_measure_id: description: Read-only measure ID. Pass it as warehouse_metric_measure.id when the metric operation is count. example: 550e8400-e29b-41d4-a716-446655440024 type: string experiment_count: description: "Number of experiments that reference this resource." format: int64 nullable: true type: integer is_certified: description: "Whether this resource has been certified." example: false type: boolean measures: description: "Measures available from the SQL model's result columns." example: - column_name: revenue column_type: FLOAT id: 550e8400-e29b-41d4-a716-446655440021 name: revenue items: $ref: "#/components/schemas/ExperimentsMetricSQLModelV2DTODataAttributesMeasuresItems" type: array metric_count: description: "Number of metrics that use this SQL model." format: int64 nullable: true type: integer migration_metadata: description: "Metadata retained for resources imported from another system." name: description: "Display name of the metric SQL model." example: Order facts type: string properties: description: "Property columns exposed by the SQL model." example: - column_name: item_type column_type: STRING id: 550e8400-e29b-41d4-a716-446655440023 name: item_type items: $ref: "#/components/schemas/ExperimentsMetricSQLModelV2DTODataAttributesMeasuresItems" type: array sql: description: "SQL query that produces the model's source data." example: SELECT user_id, order_id, item_type, revenue, created_at FROM analytics.orders type: string subject_types: description: "Subject types mapped to columns in the SQL model." example: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 unique_subject_count_measure_id: 550e8400-e29b-41d4-a716-446655440022 items: $ref: "#/components/schemas/ExperimentsMetricSQLModelV2DTODataAttributesSubjectTypesItems" type: array timestamp_column: description: "SQL column that supplies the event timestamp." example: created_at type: string updated_at: description: "Time when this resource was last updated." example: "2024-01-01T12:00:00Z" format: date-time type: string type: object ExperimentsMetricSQLModelV2DTODataAttributesMeasuresItems: description: "A measure available from a metric SQL model column." example: column_name: revenue column_type: FLOAT id: 550e8400-e29b-41d4-a716-446655440021 name: revenue properties: column_name: description: "Name of the SQL result column that supplies this measure." example: revenue type: string column_type: $ref: "#/components/schemas/ExperimentsCreateExposureSQLModelV2RequestDataAttributesItemsColumnType" description: description: "Text that explains the measure." type: string id: description: "ID of the measure." example: 550e8400-e29b-41d4-a716-446655440021 type: string migration_metadata: description: "Metadata retained for resources imported from another system." name: description: "Display name of the measure." example: revenue type: string type: object ExperimentsMetricSQLModelV2DTODataAttributesSubjectTypesItems: description: "A mapping between a subject type and its identifying SQL column." example: column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 unique_subject_count_measure_id: 550e8400-e29b-41d4-a716-446655440022 properties: column_name: description: "Name of the SQL result column that identifies subjects of this type." example: user_id type: string subject_type_id: description: "ID of the subject type used by this configuration." example: 550e8400-e29b-41d4-a716-446655440010 type: string unique_subject_count_measure_id: description: >- Read-only measure ID. Pass it as warehouse_metric_measure.id when the metric operation is `uniqueSubjects`. example: 550e8400-e29b-41d4-a716-446655440022 type: string type: object ExperimentsMetricV2DTO: description: "Response containing the metric." example: data: attributes: created_at: "2024-01-01T12:00:00Z" data_source_type: CUSTOMER_WAREHOUSE description: Share of sessions that reach the order confirmation page desired_change: METRIC_INCREASES format_as_percent: true metric_type: SIMPLE name: Checkout conversion numerator_aggregation: operation: sum pipeline_column_suffix: agg001 timeframe_start_value: 0 warehouse_metric_measure: id: 550e8400-e29b-41d4-a716-446655440021 pipeline_column_suffix: rev001 reference_url: "" updated_at: "2024-01-01T12:00:00Z" id: 550e8400-e29b-41d4-a716-446655440002 type: metrics properties: data: $ref: "#/components/schemas/ExperimentsMetricV2DTOData" required: - data type: object ExperimentsMetricV2DTOArray: description: "List of metric resources with pagination information." example: data: - attributes: created_at: "2024-01-01T12:00:00Z" data_source_type: CUSTOMER_WAREHOUSE description: Share of sessions that reach the order confirmation page desired_change: METRIC_INCREASES format_as_percent: true metric_type: SIMPLE name: Checkout conversion numerator_aggregation: operation: sum pipeline_column_suffix: agg001 timeframe_start_value: 0 warehouse_metric_measure: id: 550e8400-e29b-41d4-a716-446655440021 pipeline_column_suffix: rev001 reference_url: "" updated_at: "2024-01-01T12:00:00Z" id: 550e8400-e29b-41d4-a716-446655440002 type: metrics properties: data: description: "Resources returned in this response." example: - attributes: created_at: "2024-01-01T12:00:00Z" data_source_type: CUSTOMER_WAREHOUSE description: Share of sessions that reach the order confirmation page desired_change: METRIC_INCREASES format_as_percent: true metric_type: SIMPLE name: Checkout conversion numerator_aggregation: operation: sum pipeline_column_suffix: agg001 timeframe_start_value: 0 warehouse_metric_measure: id: 550e8400-e29b-41d4-a716-446655440021 pipeline_column_suffix: rev001 reference_url: "" updated_at: "2024-01-01T12:00:00Z" id: 550e8400-e29b-41d4-a716-446655440002 type: metrics items: $ref: "#/components/schemas/ExperimentsMetricV2DTOData" type: array links: $ref: "#/components/schemas/ExperimentsOffsetLinks" meta: $ref: "#/components/schemas/ExperimentsOffsetMeta" required: - data type: object ExperimentsMetricV2DTOData: description: "JSON:API resource containing the metric identity and fields." example: attributes: created_at: "2024-01-01T12:00:00Z" data_source_type: CUSTOMER_WAREHOUSE description: Share of sessions that reach the order confirmation page desired_change: METRIC_INCREASES format_as_percent: true metric_type: SIMPLE name: Checkout conversion numerator_aggregation: operation: sum pipeline_column_suffix: agg001 timeframe_start_value: 0 warehouse_metric_measure: id: 550e8400-e29b-41d4-a716-446655440021 pipeline_column_suffix: rev001 reference_url: "" updated_at: "2024-01-01T12:00:00Z" id: 550e8400-e29b-41d4-a716-446655440002 type: metrics properties: attributes: $ref: "#/components/schemas/ExperimentsMetricV2DTODataAttributes" id: description: "ID of the metric." example: 550e8400-e29b-41d4-a716-446655440002 format: uuid type: string type: $ref: "#/components/schemas/MetricType" required: - id - type type: object ExperimentsMetricV2DTODataAttributes: description: "Details of the metric." example: created_at: "2024-01-01T12:00:00Z" data_source_type: CUSTOMER_WAREHOUSE description: Share of sessions that reach the order confirmation page desired_change: METRIC_INCREASES format_as_percent: true metric_type: SIMPLE name: Checkout conversion numerator_aggregation: operation: sum pipeline_column_suffix: agg001 timeframe_start_value: 0 warehouse_metric_measure: id: 550e8400-e29b-41d4-a716-446655440021 pipeline_column_suffix: rev001 reference_url: "" updated_at: "2024-01-01T12:00:00Z" properties: certified_at: description: "Time when this resource was certified." format: date-time nullable: true type: string created_at: description: "Time when this resource was created." example: "2024-01-01T12:00:00Z" format: date-time type: string data_source_type: $ref: "#/components/schemas/ExperimentsMetricV2DTODataAttributesDataSourceType" denominator_aggregation: $ref: "#/components/schemas/ExperimentsMetricV2DTODataAttributesNumeratorAggregation" description: description: "Text that explains the metric." example: Share of sessions that reach the order confirmation page type: string desired_change: $ref: "#/components/schemas/ExperimentsMetricV2DTODataAttributesDesiredChange" experiment_count: description: "Number of experiments that reference this resource." format: int64 nullable: true type: integer format_as_percent: description: "Whether to display the metric value as a percentage." example: true type: boolean guardrail_cutoff_threshold: description: "Threshold used when evaluating this metric as a guardrail." format: double nullable: true type: number metric_type: $ref: "#/components/schemas/ExperimentsMetricV2DTODataAttributesMetricType" migration_metadata: description: "Metadata retained for resources imported from another system." name: description: "Display name of the metric." example: Checkout conversion type: string numerator_aggregation: $ref: "#/components/schemas/ExperimentsMetricV2DTODataAttributesNumeratorAggregation" percentile_aggregation: $ref: "#/components/schemas/ExperimentsMetricV2DTODataAttributesPercentileAggregation" reference_url: description: "URL with supporting information about the metric." example: "" type: string updated_at: description: "Time when this resource was last updated." example: "2024-01-01T12:00:00Z" format: date-time type: string type: object ExperimentsMetricV2DTODataAttributesDataSourceType: description: "Source of the data used to calculate the metric." enum: - DATADOG - DATADOG_REFERENCE_TABLE - CUSTOMER_WAREHOUSE - IMPORTED - UNKNOWN example: CUSTOMER_WAREHOUSE type: string x-enum-varnames: - DATADOG - DATADOG_REFERENCE_TABLE - CUSTOMER_WAREHOUSE - IMPORTED - UNKNOWN ExperimentsMetricV2DTODataAttributesDesiredChange: description: "Direction of metric change considered desirable." enum: - METRIC_INCREASES - METRIC_DECREASES - UNKNOWN example: METRIC_INCREASES type: string x-enum-varnames: - METRIC_INCREASES - METRIC_DECREASES - UNKNOWN ExperimentsMetricV2DTODataAttributesMetricType: description: "Type of metric calculation." enum: - SIMPLE - RATIO - PERCENTILE - UNKNOWN example: SIMPLE type: string x-enum-varnames: - SIMPLE - RATIO - PERCENTILE - UNKNOWN ExperimentsMetricV2DTODataAttributesNumeratorAggregation: description: "Source measure and aggregation settings for a metric value." example: operation: sum pipeline_column_suffix: agg001 timeframe_start_value: 0 warehouse_metric_measure: id: 550e8400-e29b-41d4-a716-446655440021 pipeline_column_suffix: rev001 nullable: true properties: aging_threshold_days: description: |- Stored aging threshold in days. The subject aging filter uses the aggregation window end and unit. format: int64 type: integer datadog_metric_measure: $ref: "#/components/schemas/ExperimentsMetricV2DTODataAttributesPercentileAggregationDatadogMetricMeasure" enable_aging_subject_filter: description: "Whether to exclude subjects whose observation time is shorter than the aggregation window." type: boolean operation: description: "Aggregation applied to the selected measure." example: sum type: string pipeline_column_suffix: description: "Suffix used to identify this value in pipeline output columns." example: agg001 type: string property_filters: description: "Filters applied to the metric aggregation." items: $ref: "#/components/schemas/ExperimentsMetricPropertyFilterGroup" type: array threshold_aggregation_type: description: "Aggregation used to evaluate the threshold." type: string threshold_breach_value: description: "Value used to determine whether the threshold is breached." format: double type: number threshold_comparison_operator: description: "Comparison applied between the aggregated value and the threshold." type: string threshold_timeframe_dimension: description: "Time unit used for the threshold evaluation window." type: string threshold_timeframe_value: description: "Size of the threshold evaluation window." format: double type: number timeframe_end_value: description: "End of the aggregation window in the specified time unit." format: double type: number timeframe_start_value: description: "Start of the aggregation window in the specified time unit." example: 0 format: double type: number timeframe_unit: description: "Time unit used for the aggregation window." type: string warehouse_metric_measure: $ref: "#/components/schemas/ExperimentsMetricV2DTODataAttributesPercentileAggregationWarehouseMetricMeasure" winsor_lower_fixed_value: description: "Fixed lower bound used to cap metric values." format: double type: number winsor_lower_percentile: description: "Percentile used to determine the lower bound for capped metric values." format: double type: number winsor_upper_fixed_value: description: "Fixed upper bound used to cap metric values." format: double type: number winsor_upper_percentile: description: "Percentile used to determine the upper bound for capped metric values." format: double type: number winsorization_strategy: description: "Method used to cap extreme metric values." type: string type: object ExperimentsMetricV2DTODataAttributesPercentileAggregation: description: "Source measure and settings for a percentile metric." nullable: true properties: datadog_metric_measure: $ref: "#/components/schemas/ExperimentsMetricV2DTODataAttributesPercentileAggregationDatadogMetricMeasure" percentile: description: "Percentile calculated from the selected measure." format: double type: number pipeline_column_suffix: description: "Suffix used to identify this value in pipeline output columns." type: string property_filters: description: "Filters applied to the metric aggregation." items: $ref: "#/components/schemas/ExperimentsMetricPropertyFilterGroup" type: array warehouse_metric_measure: $ref: "#/components/schemas/ExperimentsMetricV2DTODataAttributesPercentileAggregationWarehouseMetricMeasure" type: object ExperimentsMetricV2DTODataAttributesPercentileAggregationDatadogMetricMeasure: description: "Datadog source and query that supply values for the metric." properties: column_name: description: "Name of the Datadog event field used by this measure." type: string column_type: description: "Data type of the source column." type: string filters: description: "Conditions used to select the metric's source data." name: description: "Display name of the Datadog measure." type: string query: description: "Query used to retrieve the Datadog measure." type: string source_definition_filter: description: "Filter applied to the Datadog source definition." source_subtype: description: "Subtype of the Datadog data source." type: string source_type: description: "Type of Datadog data source used for the measure." type: string type: object ExperimentsMetricV2DTODataAttributesPercentileAggregationWarehouseMetricMeasure: description: "Warehouse measure that supplies values for the metric." properties: id: description: "ID of the measure." type: string pipeline_column_suffix: description: "Suffix used to identify this value in pipeline output columns." type: string type: object ExperimentsNullableDatadogMetricMeasureInput: description: Optional Datadog measure. Use null when the other measure is selected. nullable: true properties: column_name: description: Name of the Datadog event field used by this measure. example: "@view.time_spent" type: string column_type: description: Data type of the source column. example: double minLength: 1 pattern: \S type: string filters: description: Conditions used to select the metric's source data. name: description: Display name of the Datadog measure. example: View duration minLength: 1 pattern: \S type: string query: description: Query used to retrieve the Datadog measure. type: string source_definition_filter: description: Filter applied to the Datadog source definition. source_subtype: description: Subtype of the Datadog data source. example: RUM_VIEWS minLength: 1 pattern: \S type: string source_type: description: Type of Datadog data source used for the measure. example: PRODUCT_ANALYTICS minLength: 1 pattern: \S type: string required: - name - source_type - source_subtype - column_type type: object ExperimentsNullableDatadogPercentileMeasureInput: description: Optional Datadog percentile measure. Use null when the warehouse measure is selected. nullable: true properties: column_name: description: Name of the Datadog event field used by this measure. example: "@view.time_spent" minLength: 1 pattern: \S type: string column_type: description: Data type of the source column. example: double minLength: 1 pattern: \S type: string filters: description: Conditions used to select the metric's source data. name: description: Display name of the Datadog measure. example: View duration minLength: 1 pattern: \S type: string query: description: Query used to retrieve the Datadog measure. type: string source_definition_filter: description: Filter applied to the Datadog source definition. source_subtype: description: Subtype of the Datadog data source. example: RUM_VIEWS minLength: 1 pattern: \S type: string source_type: description: Type of Datadog data source used for the measure. example: PRODUCT_ANALYTICS minLength: 1 pattern: \S type: string required: - name - source_type - source_subtype - column_type - column_name type: object ExperimentsNullableWarehouseMetricMeasureInput: description: Optional warehouse measure. Use null when the other measure is selected. nullable: true properties: id: description: Identifier of the warehouse metric measure. example: 550e8400-e29b-41d4-a716-446655440021 format: uuid type: string required: - id type: object ExperimentsOffsetLinks: description: "Links for navigating a paginated result set." properties: first: description: "URL of the first page of results." type: string last: description: "URL of the last page of results." type: string next: description: "URL of the next page of results." type: string prev: description: "URL of the previous page of results." type: string self: description: "URL of the current page of results." type: string type: object ExperimentsOffsetMeta: description: "Pagination information for a list response." properties: page: $ref: "#/components/schemas/ExperimentsOffsetMetaPage" type: object ExperimentsOffsetMetaPage: description: "Result counts and offsets for a page of results." properties: first_offset: description: "Offset of the first page of results." format: int64 type: integer last_offset: description: "Offset of the last page of results." format: int64 nullable: true type: integer limit: description: "Maximum number of results returned in one page." format: int64 type: integer next_offset: description: "Offset of the next page of results." format: int64 nullable: true type: integer offset: description: "Number of results skipped before this page." format: int64 type: integer prev_offset: description: "Offset of the previous page of results." format: int64 nullable: true type: integer total: description: "Total number of matching results across all pages." format: int64 nullable: true type: integer type: description: "Pagination method used for this result set." type: string type: object ExperimentsPatchExperimentMetricGroupV2Request: description: "Request to update the experiment metric group." example: data: attributes: metrics: - metric_id: 550e8400-e29b-41d4-a716-446655440021 name: Reliability id: 550e8400-e29b-41d4-a716-446655440022 type: experiment-metric-groups properties: data: $ref: "#/components/schemas/ExperimentsPatchExperimentMetricGroupV2RequestData" required: - data type: object ExperimentsPatchExperimentMetricGroupV2RequestData: description: "JSON:API resource containing the experiment metric group identity and fields." example: attributes: metrics: - metric_id: 550e8400-e29b-41d4-a716-446655440021 name: Reliability id: 550e8400-e29b-41d4-a716-446655440022 type: experiment-metric-groups properties: attributes: $ref: "#/components/schemas/ExperimentsPatchExperimentMetricGroupV2RequestDataAttributes" id: description: "ID of the experiment metric group." example: 550e8400-e29b-41d4-a716-446655440022 format: uuid type: string type: $ref: "#/components/schemas/ExperimentsPatchExperimentMetricGroupV2RequestDataType" required: - type type: object ExperimentsPatchExperimentMetricGroupV2RequestDataAttributes: description: "Fields supplied to update the experiment metric group." example: metrics: - metric_id: 550e8400-e29b-41d4-a716-446655440021 name: Reliability properties: metrics: description: "Metrics included in this group." example: - metric_id: 550e8400-e29b-41d4-a716-446655440021 items: $ref: "#/components/schemas/ExperimentsCreateExperimentMetricGroupV2RequestDataAttributesMetricsItems" type: array migration_metadata: description: "Metadata retained for resources imported from another system." name: description: "Display name of the experiment metric group." example: Reliability type: string type: object ExperimentsPatchExperimentMetricGroupV2RequestDataType: default: experiment-metric-groups description: Experiment metric groups resource type. enum: - experiment-metric-groups example: experiment-metric-groups type: string x-enum-varnames: - EXPERIMENT_METRIC_GROUPS ExperimentsPatchExperimentProtocolRequest: description: >- Partial protocol update. Omitted attributes remain unchanged. Published protocols accept only name, description, and migration_metadata; archived protocols reject updates. properties: data: $ref: "#/components/schemas/ExperimentsPatchExperimentProtocolRequestData" required: - data type: object ExperimentsPatchExperimentProtocolRequestData: description: JSON:API protocol request resource. properties: attributes: $ref: "#/components/schemas/ExperimentsPatchExperimentProtocolRequestDataAttributes" id: description: Protocol ID. If supplied, must match the path protocol_id. example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string type: $ref: "#/components/schemas/ExperimentsPublicProtocolResponseDataType" required: - type type: object ExperimentsPatchExperimentProtocolRequestDataAttributes: description: >- Partial protocol update. Omitted attributes remain unchanged. Published protocols accept only name, description, and migration_metadata; archived protocols reject updates. properties: analysis_plan: $ref: "#/components/schemas/ExperimentsPatchProtocolAnalysisPlanInput" assignment_source_default_properties: description: Assignment properties. Omission or null preserves them; an array replaces them. items: $ref: >- #/components/schemas/ExperimentsPublicProtocolResponseDataAttributesAssignmentSourceDefaultPropertiesItems nullable: true type: array assignment_source_id: description: >- ID of the assignment source selected by the protocol. Omission or null keeps the current value. An empty string clears it. nullable: true pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})?$ type: string default_duration_days: description: >- Default experiment duration supplied by the protocol, in days. Omission preserves it; null clears it. Sets analysis_plan.target_duration_days on experiments created from this protocol. format: int64 minimum: 0 nullable: true type: integer description: description: Description. Empty string clears it; omission or null preserves it. nullable: true type: string enforcement: $ref: "#/components/schemas/ExperimentsPatchProtocolEnforcementInput" environment_id: description: >- ID of the feature flag environment used by the experiment. Omission or null keeps the current value. An empty string clears it. nullable: true pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})?$ type: string exposure_schedule: $ref: "#/components/schemas/ExperimentsPatchProtocolExposureScheduleInput" is_duration_required_to_start: description: >- Whether the protocol requires a duration before an experiment can start. Omission or null preserves it. example: false nullable: true type: boolean is_equal_split_enforced: description: >- Whether the protocol requires equal traffic allocation across variants. Omission or null preserves it. example: false nullable: true type: boolean is_metric_limit_enabled: description: Whether the protocol limits the number of metrics. Omission or null preserves it. example: false nullable: true type: boolean is_minimum_duration_enabled: description: Whether the protocol enforces a minimum experiment duration. Omission or null preserves it. example: false nullable: true type: boolean metric_groups: description: Metric groups. Omission or null preserves them; an array replaces them. items: $ref: "#/components/schemas/ExperimentsProtocolMetricGroupInput" nullable: true type: array metric_limit: description: Maximum number of metrics allowed by the protocol. Omission preserves it; null clears it. format: int64 minimum: 0 nullable: true type: integer migration_metadata: additionalProperties: {} description: >- Metadata for imported resources. Must encode to at most 4096 bytes. Null clears it; omission preserves it on update. nullable: true type: object minimum_duration_unit: description: Minimum duration unit, `DAYS` or `WEEKS`. Empty string clears it. Omission or null preserves it. nullable: true pattern: ^(DAYS|WEEKS)?$ type: string minimum_duration_value: description: Minimum experiment duration in the specified unit. Omission preserves it; null clears it. format: int64 minimum: 0 nullable: true type: integer name: description: >- Protocol name. Leading and trailing spaces are removed. The trimmed name must contain 1 to 255 characters. example: Checkout conversion minLength: 1 nullable: true pattern: .*\S.* type: string primary_metric_id: description: >- ID of the primary metric supplied by the protocol. Omission or null keeps the current value. An empty string clears it. nullable: true pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})?$ type: string subject_type_id: description: >- ID of the subject type used by this configuration. Omission or null keeps the current value. An empty string clears it. nullable: true pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})?$ type: string targeting_rules: description: Targeting rules. Omission or null preserves them; an array replaces them. items: $ref: "#/components/schemas/ExperimentsProtocolTargetingRuleInput" nullable: true type: array type: object ExperimentsPatchExperimentV2MetaDTO: description: "Refresh requirements and warnings returned by an experiment update." properties: needs_pipeline_refresh: description: >- Whether this edit needs a full or non-full pipeline run. This operation does not start the run. A later false value does not clear a refresh required by an earlier edit. example: false type: boolean refresh_endpoint: description: >- POST to this endpoint after finishing your edits. The full_refresh query parameter selects the required run type. Across multiple edits any full_refresh=true requirement takes priority. type: string warnings: description: "Warnings returned after the experiment update." items: $ref: "#/components/schemas/ExperimentsPatchExperimentV2MetaDTOWarningsItems" type: array required: - needs_pipeline_refresh type: object ExperimentsPatchExperimentV2MetaDTOWarningsItems: description: "A warning returned after an experiment update." properties: code: description: "Code that identifies the warning." example: code type: string detail: description: "Explanation of the warning and its effect on the update." example: detail type: string required: - code - detail type: object ExperimentsPatchExperimentV2Request: description: "Request to update the experiment." example: data: attributes: datadog_flag_configuration: entry_point: environment_id: 550e8400-e29b-41d4-a716-446655440005 feature_flag_id: 550e8400-e29b-41d4-a716-446655440014 reset_on_feature_flag_change: true targeting_rules: [] structured_metadata: - enum_values: - general_availability field_key: launch_stage traffic_exposure: fraction: 1 mode: STATIC variants: - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440020 is_active: true is_control: true key: control weight: 50 - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440021 is_active: true is_control: false key: treatment weight: 50 type: experiments properties: data: $ref: "#/components/schemas/ExperimentsPatchExperimentV2RequestData" required: - data type: object ExperimentsPatchExperimentV2RequestData: description: "JSON:API resource containing the experiment identity and fields." example: attributes: datadog_flag_configuration: entry_point: environment_id: 550e8400-e29b-41d4-a716-446655440005 feature_flag_id: 550e8400-e29b-41d4-a716-446655440014 reset_on_feature_flag_change: true targeting_rules: [] structured_metadata: - enum_values: - general_availability field_key: launch_stage traffic_exposure: fraction: 1 mode: STATIC variants: - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440020 is_active: true is_control: true key: control weight: 50 - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440021 is_active: true is_control: false key: treatment weight: 50 type: experiments properties: attributes: $ref: "#/components/schemas/ExperimentsPatchExperimentV2RequestDataAttributes" id: description: "ID of the experiment." type: string type: $ref: "#/components/schemas/ExperimentsPatchExperimentV2ResponseDataType" required: - type type: object ExperimentsPatchExperimentV2RequestDataAttributes: description: "Fields supplied to update the experiment." example: datadog_flag_configuration: entry_point: environment_id: 550e8400-e29b-41d4-a716-446655440005 feature_flag_id: 550e8400-e29b-41d4-a716-446655440014 reset_on_feature_flag_change: true targeting_rules: [] structured_metadata: - enum_values: - general_availability field_key: launch_stage traffic_exposure: fraction: 1 mode: STATIC variants: - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440020 is_active: true is_control: true key: control weight: 50 - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440021 is_active: true is_control: false key: treatment weight: 50 properties: assignments_end_date: description: "End of the time window for experiment assignments." format: date-time nullable: true type: string assignments_start_date: description: "Start of the time window for experiment assignments." format: date-time nullable: true type: string datadog_flag_configuration: $ref: "#/components/schemas/ExperimentsPatchExperimentV2RequestDataAttributesDatadogFlagConfiguration" decision_metrics: description: "Metrics used to decide the experiment outcome." items: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestDataAttributesDecisionMetricsItems" type: array events_end_date: description: "End of the time window for metric events." format: date-time nullable: true type: string events_start_date: description: "Start of the time window for metric events." format: date-time nullable: true type: string hypothesis: description: "Expected effect that the experiment is intended to test." type: string migration_metadata: description: "Metadata retained for resources imported from another system." name: description: "Display name of the experiment." type: string related_links: description: "Links to supporting material for the experiment." items: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestDataAttributesRelatedLinksItems" type: array split_by_properties: description: >- Complete replacement for the Datadog split-by selection. Identify each property by column_name. Omit this field to leave the selection unchanged. items: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestDataAttributesSplitByPropertiesItems" type: array structured_metadata: description: >- Metadata values to update. Omit this field, send null, or send an empty array to leave metadata unchanged. example: - enum_values: - general_availability field_key: launch_stage items: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestDataAttributesStructuredMetadataItems" nullable: true type: array subject_type_id: description: "ID of the subject type used by this configuration." type: string summary: description: "Summary text recorded for the experiment." nullable: true type: string tags: description: "Tags attached to the experiment." items: description: "A tag attached to the experiment." type: string type: array teams: description: "Teams associated with the experiment." items: description: "A team associated with the experiment." type: string type: array traffic_exposure: $ref: "#/components/schemas/ExperimentsPatchExperimentV2ResponseDataAttributesTrafficExposure" variants: description: "Variants configured for the experiment." example: - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440020 is_active: true is_control: true key: control weight: 50 - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440021 is_active: true is_control: false key: treatment weight: 50 items: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestDataAttributesVariantsItems" type: array warehouse_exposure_configuration: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestDataAttributesWarehouseExposureConfiguration" type: object ExperimentsPatchExperimentV2RequestDataAttributesDatadogFlagConfiguration: description: "Feature flag, environment, and targeting configuration for the experiment." example: entry_point: environment_id: 550e8400-e29b-41d4-a716-446655440005 feature_flag_id: 550e8400-e29b-41d4-a716-446655440014 reset_on_feature_flag_change: true targeting_rules: [] nullable: true properties: entry_point: $ref: >- #/components/schemas/ExperimentsPatchExperimentV2ResponseDataAttributesDatadogFlagConfigurationEntryPoint environment_id: description: "ID of the feature flag environment used by the experiment." example: 550e8400-e29b-41d4-a716-446655440005 type: string feature_flag_id: description: "ID of the feature flag linked to the experiment." example: 550e8400-e29b-41d4-a716-446655440014 type: string reset_on_feature_flag_change: description: >- Set true to replace an existing draft allocation when feature_flag_id changes. The replacement resets all flag-bound randomization state. example: true type: boolean targeting_rules: description: Omit to keep the stored rules. Use an empty array to remove targeting rules. example: [] items: $ref: >- #/components/schemas/ExperimentsTargetingRule type: array type: object ExperimentsPatchExperimentV2Response: description: "Response containing the updated experiment, refresh requirements, and warnings." example: data: attributes: assignments_end_date: "2026-08-15T00:00:00Z" assignments_start_date: "2026-08-01T00:00:00Z" concluded_at: "2026-08-05T09:30:00Z" conclusion: decision_reason: The primary metric improved without material regressions outcome: POSITIVE summary: The treatment improved conversion created_at: "2026-08-01T12:00:00Z" datadog_flag_configuration: decision_metrics: - is_primary: true metric_id: b1a2c3d4-0000-0000-0000-000000000000 decision_variant_key: treatment events_end_date: "2026-08-22T00:00:00Z" events_start_date: "2026-08-01T00:00:00Z" experiment_type: STANDARD hypothesis: A clearer checkout button increases purchase conversion name: Checkout button test pipeline_table_suffix: a1b2c3d4 protocol_id: e4d5f6a7-0000-0000-0000-000000000000 related_links: - id: d1d2d3d4-0000-0000-0000-000000000000 title: Experiment design url: https://docs.example.com/checkout-experiment results_last_updated: "2026-08-05T09:25:00Z" split_by_properties: [] status: DECISION_MADE structured_metadata: - enum_values: - beta field_display_name: Launch stage field_key: launch_stage field_type: ENUM - field_display_name: Notes field_key: notes field_type: FREETEXT freetext_value: Checkout redesign subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 summary: The treatment improved conversion tags: - growth teams: - growth traffic_exposure: fraction: 1 mode: STATIC updated_at: "2026-08-05T09:30:00Z" variants: - is_active: true is_control: true key: control name: Control weight: 50 - is_active: true is_control: false key: treatment name: Treatment weight: 50 warehouse_exposure_configuration: entry_point: experiment_key: checkout_button_test exposure_sql_model_id: f5e6a7b8-0000-0000-0000-000000000000 id: 550e8400-e29b-41d4-a716-446655440000 type: experiments properties: data: $ref: "#/components/schemas/ExperimentsExperimentV2DTOData" meta: $ref: "#/components/schemas/ExperimentsPatchExperimentV2MetaDTO" required: - data type: object ExperimentsPatchExperimentV2ResponseDataAttributes: description: "Details of the experiment." example: assignments_end_date: "2026-08-15T00:00:00Z" assignments_start_date: "2026-08-01T00:00:00Z" concluded_at: "2026-08-05T09:30:00Z" conclusion: decision_reason: The primary metric improved without material regressions outcome: POSITIVE summary: The treatment improved conversion created_at: "2026-08-01T12:00:00Z" datadog_flag_configuration: decision_metrics: - is_primary: true metric_id: b1a2c3d4-0000-0000-0000-000000000000 decision_variant_key: treatment events_end_date: "2026-08-22T00:00:00Z" events_start_date: "2026-08-01T00:00:00Z" experiment_type: STANDARD hypothesis: A clearer checkout button increases purchase conversion name: Checkout button test pipeline_table_suffix: a1b2c3d4 protocol_id: e4d5f6a7-0000-0000-0000-000000000000 related_links: - id: d1d2d3d4-0000-0000-0000-000000000000 title: Experiment design url: https://docs.example.com/checkout-experiment results_last_updated: "2026-08-05T09:25:00Z" split_by_properties: [] status: DECISION_MADE structured_metadata: - enum_values: - beta field_display_name: Launch stage field_key: launch_stage field_type: ENUM - field_display_name: Notes field_key: notes field_type: FREETEXT freetext_value: Checkout redesign subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 summary: The treatment improved conversion tags: - growth teams: - growth traffic_exposure: fraction: 1 mode: STATIC updated_at: "2026-08-05T09:30:00Z" variants: - is_active: true is_control: true key: control name: Control weight: 50 - is_active: true is_control: false key: treatment name: Treatment weight: 50 warehouse_exposure_configuration: entry_point: experiment_key: checkout_button_test exposure_sql_model_id: f5e6a7b8-0000-0000-0000-000000000000 properties: assignments_end_date: description: "End of the time window for experiment assignments." example: "2026-08-15T00:00:00Z" format: date-time nullable: true type: string assignments_start_date: description: "Start of the time window for experiment assignments." example: "2026-08-01T00:00:00Z" format: date-time nullable: true type: string concluded_at: description: "Time when the experiment was concluded." example: "2026-08-05T09:30:00Z" format: date-time nullable: true type: string conclusion: $ref: "#/components/schemas/ExperimentsPatchExperimentV2ResponseDataAttributesConclusion" created_at: description: "Time when this resource was created." example: "2026-08-01T12:00:00Z" format: date-time type: string datadog_flag_configuration: $ref: "#/components/schemas/ExperimentsPatchExperimentV2ResponseDataAttributesDatadogFlagConfiguration" decision_metrics: description: "Metrics used to decide the experiment outcome." example: - is_primary: true metric_id: b1a2c3d4-0000-0000-0000-000000000000 items: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestDataAttributesDecisionMetricsItems" type: array decision_variant_key: description: "Key of the variant selected in the experiment decision." example: treatment type: string events_end_date: description: "End of the time window for metric events." example: "2026-08-22T00:00:00Z" format: date-time nullable: true type: string events_start_date: description: "Start of the time window for metric events." example: "2026-08-01T00:00:00Z" format: date-time nullable: true type: string experiment_type: description: >- Kind of experiment. STANDARD is an ordinary experiment. Other values, such as CANARY and HOLDOUT, identify experiments owned by another workflow. New kinds may be added; treat unknown values as non-standard. example: STANDARD type: string hypothesis: description: "Expected effect that the experiment is intended to test." example: A clearer checkout button increases purchase conversion type: string migration_metadata: description: "Metadata retained for resources imported from another system." name: description: "Display name of the experiment." example: Checkout button test type: string pipeline_table_suffix: description: "Suffix used to identify the experiment's pipeline output table." example: a1b2c3d4 type: string protocol_id: description: "ID of the protocol associated with the experiment." example: e4d5f6a7-0000-0000-0000-000000000000 type: string related_links: description: "Links to supporting material for the experiment." example: - id: d1d2d3d4-0000-0000-0000-000000000000 title: Experiment design url: https://docs.example.com/checkout-experiment items: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestDataAttributesRelatedLinksItems" type: array results_last_updated: description: "Time of the most recent update to the experiment's results." example: "2026-08-05T09:25:00Z" format: date-time nullable: true type: string split_by_properties: description: "Properties used to split the experiment results into groups." example: items: $ref: "#/components/schemas/ExperimentsExperimentV2DTODataAttributesSplitByPropertiesItems" type: array status: $ref: "#/components/schemas/ExperimentsExperimentV2DTODataAttributesStatus" structured_metadata: description: "Values of structured metadata fields attached to the experiment." example: - enum_values: - beta field_display_name: Launch stage field_key: launch_stage field_type: ENUM - field_display_name: Notes field_key: notes field_type: FREETEXT freetext_value: Checkout redesign items: $ref: "#/components/schemas/ExperimentsStructuredMetadataResponse" type: array subject_type_id: description: "ID of the subject type used by this configuration." example: c2b3d4e5-0000-0000-0000-000000000000 nullable: true type: string summary: description: "Summary text recorded for the experiment." example: The treatment improved conversion type: string tags: description: "Tags attached to the experiment." example: - growth items: description: "A tag attached to the experiment." example: growth type: string type: array teams: description: "Teams associated with the experiment." example: - growth items: description: "A team associated with the experiment." example: growth type: string type: array traffic_exposure: $ref: "#/components/schemas/ExperimentsPatchExperimentV2ResponseDataAttributesTrafficExposure" updated_at: description: "Time when this resource was last updated." example: "2026-08-05T09:30:00Z" format: date-time type: string variants: description: "Variants configured for the experiment." example: - is_active: true is_control: true key: control name: Control weight: 50 - is_active: true is_control: false key: treatment name: Treatment weight: 50 items: $ref: "#/components/schemas/ExperimentsExperimentV2DTODataAttributesVariantsItems" type: array warehouse_exposure_configuration: $ref: "#/components/schemas/ExperimentsPatchExperimentV2ResponseDataAttributesWarehouseExposureConfiguration" type: object ExperimentsPatchExperimentV2ResponseDataAttributesConclusion: description: "Outcome and supporting text recorded when the experiment is concluded." example: decision_reason: The primary metric improved without material regressions outcome: POSITIVE summary: The treatment improved conversion properties: decision_reason: description: Reason for the recorded decision. example: The primary metric improved without material regressions nullable: true type: string outcome: $ref: "#/components/schemas/ExperimentsExperimentV2DTODataAttributesConclusionOutcome" summary: description: Summary of the experiment conclusion. example: The treatment improved conversion nullable: true type: string type: object ExperimentsPatchExperimentV2ResponseDataAttributesDatadogFlagConfiguration: description: "Feature flag, environment, and targeting configuration for the experiment." example: nullable: true properties: allocation_key: description: "Key of the feature flag allocation linked to the experiment. Matches the allocation key that SDKs report in flag evaluation results and exposure events." type: string entry_point: $ref: >- #/components/schemas/ExperimentsPatchExperimentV2ResponseDataAttributesDatadogFlagConfigurationEntryPoint environment_id: description: "ID of the feature flag environment used by the experiment." type: string feature_flag_id: description: "ID of the feature flag linked to the experiment." type: string targeting_rules: description: "Rules that select subjects for the experiment." items: $ref: >- #/components/schemas/ExperimentsTargetingRule type: array required: - entry_point type: object ExperimentsPatchExperimentV2ResponseDataAttributesDatadogFlagConfigurationEntryPoint: description: "Datadog measure and filters used to select analyzed subjects." nullable: true properties: filters: description: Complete Datadog OR-of-ANDs entry-point filter expression. example: [] items: $ref: "#/components/schemas/ExperimentsDatadogEntryPointFilterGroup" type: array measure_id: description: Datadog measure UUID. example: 550e8400-e29b-41d4-a716-446655440000 type: string required: - filters - measure_id type: object ExperimentsPatchExperimentV2ResponseDataAttributesSplitByPropertiesItemsColumnType: description: Type of the Datadog exposure field or Warehouse column. enum: - varchar - int - double - boolean - varchar_array - int_array - double_array - raw - STRING - INTEGER - FLOAT - BOOLEAN - DATE - TIMESTAMP example: varchar type: string x-enum-varnames: - VARCHAR - INT - DOUBLE - BOOLEAN_DATADOG - VARCHAR_ARRAY - INT_ARRAY - DOUBLE_ARRAY - RAW - STRING - INTEGER - FLOAT - BOOLEAN_WAREHOUSE - DATE - TIMESTAMP ExperimentsPatchExperimentV2ResponseDataAttributesStructuredMetadataItemsFieldType: description: "Type of value stored in the structured metadata field." enum: - FREETEXT - ENUM example: ENUM type: string x-enum-varnames: - FREETEXT - ENUM ExperimentsPatchExperimentV2ResponseDataAttributesTrafficExposure: description: "Traffic exposure fraction or schedule configured for the experiment." example: fraction: 1 mode: STATIC properties: fraction: description: >- STATIC exposure fraction. Draft experiments can change this value. After start only warehouse experiments without a Datadog flag can change a STATIC fraction through the public API. example: 1 format: double type: number mode: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestDataAttributesTrafficExposureMode" steps: description: >- Configured exposure plan rather than wall-clock history. At least two steps must have strictly increasing fractions and no gaps. Warehouse steps start at assignments_start_date and can use different durations. New Datadog plans have at most five steps and a first fraction above zero. Their nonfinal durations must be equal and exclude time paused. Datadog steps start with the experiment. Running warehouse experiments can replace step fractions, durations, and the exposure mode. After start, Datadog exposure plans cannot change through the public API. The final duration is null and its fraction holds until assignment ends. items: $ref: "#/components/schemas/ExperimentsCreateExperimentV2RequestDataAttributesTrafficExposureStepsItems" type: array required: - mode type: object ExperimentsPatchExperimentV2ResponseDataAttributesWarehouseExposureConfiguration: description: "Warehouse exposure model and settings used to identify experiment assignments." example: entry_point: experiment_key: checkout_button_test exposure_sql_model_id: f5e6a7b8-0000-0000-0000-000000000000 nullable: true properties: entry_point: $ref: >- #/components/schemas/ExperimentsWarehouseEntryPoint experiment_key: description: >- Warehouse experiment key. Reads can return null for incomplete configuration; configuration writes require a value. example: checkout_button_test nullable: true type: string exposure_sql_model_id: description: ID of the exposure SQL model that provides assignment data. example: f5e6a7b8-0000-0000-0000-000000000000 type: string required: - entry_point - experiment_key - exposure_sql_model_id type: object ExperimentsPatchExperimentV2ResponseDataType: default: experiments description: Experiments resource type. enum: - experiments example: experiments type: string x-enum-varnames: - EXPERIMENTS ExperimentsPatchMetricCollectionV2Request: description: "Request to update the metric collection." example: data: attributes: metrics: [] type: metric-collections properties: data: $ref: "#/components/schemas/ExperimentsPatchMetricCollectionV2RequestData" required: - data type: object ExperimentsPatchMetricCollectionV2RequestData: description: "JSON:API resource containing the metric collection identity and fields." example: attributes: metrics: [] type: metric-collections properties: attributes: $ref: "#/components/schemas/ExperimentsPatchMetricCollectionV2RequestDataAttributes" id: description: "ID of the metric collection." type: string type: $ref: "#/components/schemas/ExperimentsPatchMetricCollectionV2RequestDataType" required: - type type: object ExperimentsPatchMetricCollectionV2RequestDataAttributes: description: "Fields supplied to update the metric collection." example: metrics: [] properties: description: description: "Text that explains the metric collection." nullable: true type: string is_guardrail: description: "Whether the collection is used for guardrail metrics." type: boolean metrics: description: "Metrics included in this collection." example: [] items: $ref: "#/components/schemas/ExperimentsCreateMetricCollectionV2RequestDataAttributesMetricsItems" type: array name: description: "Display name of the metric collection." type: string type: object ExperimentsPatchMetricCollectionV2RequestDataType: default: metric-collections description: Metric collections resource type. enum: - metric-collections example: metric-collections type: string x-enum-varnames: - METRIC_COLLECTIONS ExperimentsPatchProtocolAnalysisPlanInput: description: >- Partial statistical settings. Omitted fields remain unchanged. Null clears the whole plan. Null clears nullable fields; null or an empty string clears confidence_interval_method. nullable: true properties: compute_cuped: description: Whether to use pre-experiment data to reduce variance with CUPED. nullable: true type: boolean confidence_interval_method: description: >- Confidence interval method: `Sequential`, `FixedSample`, `Bayesian`, or `SequentialFixedHybrid`. An empty string leaves the method unset. nullable: true pattern: ^(Sequential|FixedSample|Bayesian|SequentialFixedHybrid)?$ type: string confidence_level: description: Confidence level used by the statistical analysis. format: double maximum: 1 minimum: 0 nullable: true type: number multiple_testing_correction_method: description: Method used to adjust for testing multiple metrics. nullable: true type: string type: object ExperimentsPatchProtocolEnforcementInput: description: >- Partial lock map. Omitted fields remain unchanged. Null clears the whole map. Empty or null field values become `EDITABLE`, except `subject_type`, `flag_source`, and `confidence_interval_method`, which remain `LOCKED`. nullable: true properties: confidence_interval_method: description: Always `LOCKED`. The server keeps this setting locked regardless of the supplied value. nullable: true pattern: ^(LOCKED|EDITABLE)?$ type: string confidence_level: description: LOCKED prevents changes to confidence level. EDITABLE permits changes. nullable: true pattern: ^(LOCKED|EDITABLE)?$ type: string cuped_calculation: description: LOCKED prevents changes to CUPED variance reduction. EDITABLE permits changes. nullable: true pattern: ^(LOCKED|EDITABLE)?$ type: string default_duration: description: LOCKED prevents changes to default duration. EDITABLE permits changes. nullable: true pattern: ^(LOCKED|EDITABLE)?$ type: string environment: description: LOCKED prevents changes to environment. EDITABLE permits changes. nullable: true pattern: ^(LOCKED|EDITABLE)?$ type: string flag_source: description: Always LOCKED. The server keeps this setting locked regardless of the supplied value. nullable: true pattern: ^(LOCKED|EDITABLE)?$ type: string multiple_testing_correction: description: LOCKED prevents changes to multiple testing correction. EDITABLE permits changes. nullable: true pattern: ^(LOCKED|EDITABLE)?$ type: string notifications: description: LOCKED prevents changes to notifications. EDITABLE permits changes. nullable: true pattern: ^(LOCKED|EDITABLE)?$ type: string primary_metric: description: LOCKED prevents changes to primary metric. EDITABLE permits changes. nullable: true pattern: ^(LOCKED|EDITABLE)?$ type: string secondary_metrics: description: LOCKED prevents changes to secondary metrics. EDITABLE permits changes. nullable: true pattern: ^(LOCKED|EDITABLE)?$ type: string split_by_exploration_dimensions: description: LOCKED prevents changes to result exploration dimensions. EDITABLE permits changes. nullable: true pattern: ^(LOCKED|EDITABLE)?$ type: string subject_type: description: Always LOCKED. The server keeps this setting locked regardless of the supplied value. nullable: true pattern: ^(LOCKED|EDITABLE)?$ type: string targeting_rules: description: LOCKED prevents changes to targeting rules. EDITABLE permits changes. nullable: true pattern: ^(LOCKED|EDITABLE)?$ type: string traffic_exposure: description: LOCKED prevents changes to traffic exposure. EDITABLE permits changes. nullable: true pattern: ^(LOCKED|EDITABLE)?$ type: string warehouse_exposure_source: description: LOCKED prevents changes to warehouse exposure source. EDITABLE permits changes. nullable: true pattern: ^(LOCKED|EDITABLE)?$ type: string type: object ExperimentsPatchProtocolExposureScheduleInput: description: >- Partial traffic schedule. Omitted fields remain unchanged. Null clears the whole schedule. Null clears nullable fields and rollout_steps; null sets strategy to an empty string and `autostart` to false. nullable: true properties: autostart: description: Whether the exposure schedule starts automatically. nullable: true type: boolean guardrail_triggered_action: description: Action taken when a guardrail triggers during the exposure schedule. nullable: true type: string rollout_steps: description: Rollout steps, replaced when supplied. items: $ref: "#/components/schemas/ExperimentsProtocolExposureStepInput" nullable: true type: array selection_interval_ms: description: Interval between traffic selections, in milliseconds. format: int64 minimum: 0 nullable: true type: integer strategy: description: Method used to increase traffic exposure over the schedule. nullable: true type: string type: object ExperimentsPatchSubjectTypeV2Request: description: "Request to update the subject type." example: data: attributes: name: Updated User product_analytics_attribute: "@usr.id" warehouse_column_names: - user_id type: subject-types properties: data: $ref: "#/components/schemas/ExperimentsPatchSubjectTypeV2RequestData" required: - data type: object ExperimentsPatchSubjectTypeV2RequestData: description: "JSON:API resource containing the subject type identity and fields." example: attributes: name: Updated User product_analytics_attribute: "@usr.id" warehouse_column_names: - user_id type: subject-types properties: attributes: $ref: "#/components/schemas/ExperimentsPatchSubjectTypeV2RequestDataAttributes" id: description: "ID of the subject type." type: string type: $ref: "#/components/schemas/ExperimentsSubjectTypeV2DTODataType" required: - type - attributes type: object ExperimentsPatchSubjectTypeV2RequestDataAttributes: description: "Fields supplied to update the subject type." example: name: User product_analytics_attribute: "@usr.id" warehouse_column_names: - user_id - customer_id properties: migration_metadata: description: "Metadata retained for resources imported from another system." name: description: "Display name of the subject type." example: User maxLength: 40 minLength: 3 pattern: ".*\\S.*" type: string product_analytics_attribute: description: "Product Analytics attribute used to identify subjects of this type." example: "@usr.id" type: string warehouse_column_names: description: "Warehouse columns that identify subjects of this type." example: - user_id - customer_id items: description: "Name of a warehouse column that identifies subjects." example: user_id type: string type: array type: object ExperimentsPropertyFilterInput: description: A property comparison for metric source data. example: operation: IS property_id: 550e8400-e29b-41d4-a716-446655440023 values: - US properties: measure_id: description: Omit this target or use null or a blank string. example: "" nullable: true pattern: ^\s*$ type: string operation: $ref: >- #/components/schemas/ExperimentsWarehouseEntryPointFilterOperation property_id: description: ID of the property on the aggregation source. example: 550e8400-e29b-41d4-a716-446655440023 format: uuid minLength: 1 pattern: \S type: string values: description: Values used by the comparison. example: - "" items: description: One comparison value. type: string minItems: 1 type: array required: - property_id - operation - values type: object ExperimentsPropertyFilterInputGroup: description: Metric filters combined with AND. Each group must contain at least one filter. example: - operation: IS property_id: 550e8400-e29b-41d4-a716-446655440023 values: - US items: $ref: "#/components/schemas/ExperimentsPropertyFilterInput" minItems: 1 type: array ExperimentsPropertyNullFilterInput: description: A property comparison for metric source data. example: operation: IS_NULL property_id: 550e8400-e29b-41d4-a716-446655440023 values: [] properties: measure_id: description: Omit this target or use null or a blank string. example: "" nullable: true pattern: ^\s*$ type: string operation: $ref: "#/components/schemas/ExperimentsPropertyNullFilterInputOperation" property_id: description: ID of the property on the aggregation source. example: 550e8400-e29b-41d4-a716-446655440023 format: uuid minLength: 1 pattern: \S type: string values: description: Values used by the comparison. items: description: One comparison value. type: string maxItems: 0 nullable: true type: array required: - property_id - operation type: object ExperimentsPropertyNullFilterInputOperation: description: Comparison applied by this filter. enum: - IS_NULL - IS_NOT_NULL example: IS_NULL type: string x-enum-varnames: - IS_NULL - IS_NOT_NULL ExperimentsProtocolAnalysisPlanInput: description: >- Statistical settings. Use `default_duration_days` for duration; `target_duration_days` is not accepted here. nullable: true properties: compute_cuped: description: Whether to use pre-experiment data to reduce variance with CUPED. nullable: true type: boolean confidence_interval_method: description: >- Confidence interval method: `Sequential`, `FixedSample`, `Bayesian`, or `SequentialFixedHybrid`. An empty string leaves the method unset. pattern: ^(Sequential|FixedSample|Bayesian|SequentialFixedHybrid)?$ type: string confidence_level: description: Confidence level used by the statistical analysis. format: double maximum: 1 minimum: 0 nullable: true type: number multiple_testing_correction_method: description: Method used to adjust for testing multiple metrics. nullable: true type: string type: object ExperimentsProtocolConditionInput: description: >- Protocol targeting condition. Publishing and replacement require a saved filter or a valid inline attribute, operator, and values. properties: attribute: description: Subject attribute evaluated by the targeting condition. type: string operator: description: Comparison applied to the subject attribute. type: string order_position: description: Position of this entry in the ordered configuration. format: int64 minimum: 0 type: integer saved_filter_id: description: >- Saved filter UUID. Null selects an inline condition. An empty string skips the saved-filter lookup. nullable: true pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})?$ type: string value: description: Values compared with the subject attribute in this condition. items: description: One value compared with the subject attribute. type: string nullable: true type: array type: object ExperimentsProtocolExposureScheduleInput: description: >- Traffic schedule. Publishing and replacement require `NO_ROLLOUT` with exactly one step, or `UNIFORM_INTERVALS` with a positive selection interval and at least one step. Requires `environment_id`. nullable: true properties: autostart: description: Whether the exposure schedule starts automatically. type: boolean guardrail_triggered_action: description: Action taken when a guardrail triggers during the exposure schedule. nullable: true type: string rollout_steps: description: Rollout steps, replaced when supplied. items: $ref: "#/components/schemas/ExperimentsProtocolExposureStepInput" nullable: true type: array selection_interval_ms: description: Interval between traffic selections, in milliseconds. format: int64 minimum: 0 nullable: true type: integer strategy: description: Method used to increase traffic exposure over the schedule. type: string type: object ExperimentsProtocolExposureStepInput: description: A traffic exposure step in the protocol template. properties: exposure_ratio: description: Fraction of traffic exposed during this rollout step. format: double maximum: 1 minimum: 0 type: number grouped_step_index: description: Index of the group that contains this rollout step. format: int64 minimum: 0 nullable: true type: integer interval_ms: description: Duration of this rollout step, in milliseconds. format: int64 minimum: 0 nullable: true type: integer is_pause_record: description: Whether this schedule entry represents a pause. type: boolean order_position: description: Position of this entry in the ordered configuration. format: int64 minimum: 0 type: integer type: object ExperimentsProtocolMetricGroupInput: description: A metric group supplied by the protocol. Empty decision groups are removed. properties: is_decision: description: Whether this group contains decision metrics. type: boolean metrics: description: Metrics in the group. items: $ref: "#/components/schemas/ExperimentsProtocolMetricInput" nullable: true type: array name: description: Metric group name. type: string type: object ExperimentsProtocolMetricInput: description: A metric included in a protocol. Select the primary metric with `primary_metric_id`, not `is_primary`. properties: metric_id: description: Metric UUID. example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string required: - metric_id type: object ExperimentsProtocolTargetingRuleInput: description: A targeting rule in the protocol template. properties: conditions: description: Conditions in this rule. items: $ref: "#/components/schemas/ExperimentsProtocolConditionInput" nullable: true type: array type: object ExperimentsPublicProtocolListResponseArray: description: "List of protocol resources with pagination information." properties: data: description: "Resources returned in this response." example: [] items: $ref: "#/components/schemas/ExperimentsPublicProtocolListResponseData" type: array links: $ref: "#/components/schemas/ExperimentsOffsetLinks" meta: $ref: "#/components/schemas/ExperimentsOffsetMeta" required: - data type: object ExperimentsPublicProtocolListResponseData: description: "JSON:API resource containing the protocol identity and fields." properties: attributes: $ref: "#/components/schemas/ExperimentsPublicProtocolListResponseDataAttributes" id: description: "ID of the protocol." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string type: $ref: "#/components/schemas/ExperimentsPublicProtocolResponseDataType" required: - type - id type: object ExperimentsPublicProtocolListResponseDataAttributes: description: "Summary of the protocol and its selected subject type and primary metric." properties: description: description: "Text that explains the protocol." type: string experiment_count: description: >- Number of experiments in the organization that use this protocol, excluding deleted experiments. example: 0 format: int64 minimum: 0 type: integer name: description: "Display name of the protocol." example: Checkout conversion type: string primary_metric: $ref: "#/components/schemas/ExperimentsPublicProtocolResponseDataAttributesSubjectType" primary_metric_id: description: "ID of the primary metric supplied by the protocol." type: string status: $ref: "#/components/schemas/ExperimentsPublicProtocolResponseDataAttributesStatus" subject_type: $ref: "#/components/schemas/ExperimentsPublicProtocolResponseDataAttributesSubjectType" subject_type_id: description: "ID of the subject type used by this configuration." type: string updated_at: description: |- RFC3339 update time. Preserve all fractional seconds when passing this value as `expected_updated_at`. example: "2026-01-01T00:00:00Z" type: string required: - experiment_count - name - status - updated_at type: object ExperimentsPublicProtocolResponse: description: "Response containing the protocol." properties: data: $ref: "#/components/schemas/ExperimentsPublicProtocolResponseData" required: - data type: object ExperimentsPublicProtocolResponseData: description: "JSON:API resource containing the protocol identity and fields." properties: attributes: $ref: "#/components/schemas/ExperimentsPublicProtocolResponseDataAttributes" id: description: "ID of the protocol." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string type: $ref: "#/components/schemas/ExperimentsPublicProtocolResponseDataType" required: - type - id type: object ExperimentsPublicProtocolResponseDataAttributes: description: "Settings and defaults supplied by the protocol." properties: analysis_plan: $ref: "#/components/schemas/ExperimentsPublicProtocolResponseDataAttributesAnalysisPlan" archived_at: description: "Time when the protocol was archived. Omitted if it has not been archived." example: "2026-07-31T14:00:00Z" format: date-time type: string assignment_source_default_properties: description: "Default properties supplied by the protocol's assignment source." items: $ref: >- #/components/schemas/ExperimentsPublicProtocolResponseDataAttributesAssignmentSourceDefaultPropertiesItems type: array assignment_source_id: description: "ID of the assignment source selected by the protocol." type: string created_at: description: "Time when the protocol was created." example: "2026-07-31T12:00:00Z" format: date-time type: string default_duration_days: description: "Default experiment duration supplied by the protocol, in days." format: int64 type: integer description: description: "Text that explains the protocol." type: string enforcement: $ref: "#/components/schemas/ExperimentsPublicProtocolResponseDataAttributesEnforcement" environment_id: description: "ID of the feature flag environment used by the experiment." type: string experiment_count: description: >- Number of experiments in the organization that use this protocol, excluding deleted experiments. Omitted if the count cannot be retrieved. An omitted count does not mean zero. example: 0 format: int64 minimum: 0 type: integer exposure_schedule: $ref: "#/components/schemas/ExperimentsPublicProtocolResponseDataAttributesExposureSchedule" is_duration_required_to_start: description: "Whether the protocol requires a duration before an experiment can start." example: false type: boolean is_equal_split_enforced: description: "Whether the protocol requires equal traffic allocation across variants." example: false type: boolean is_metric_limit_enabled: description: "Whether the protocol limits the number of metrics." example: false type: boolean is_minimum_duration_enabled: description: "Whether the protocol enforces a minimum experiment duration." example: false type: boolean metric_groups: description: "Metric groups supplied by the protocol." example: [] items: $ref: "#/components/schemas/ExperimentsPublicProtocolResponseDataAttributesMetricGroupsItems" type: array metric_limit: description: "Maximum number of metrics allowed by the protocol." format: int64 type: integer migration_metadata: description: "Metadata retained for resources imported from another system." minimum_duration_unit: description: "Unit used to express the protocol's minimum duration." type: string minimum_duration_value: description: "Minimum experiment duration in the specified unit." format: int64 type: integer name: description: "Display name of the protocol." example: Checkout conversion type: string primary_metric: $ref: "#/components/schemas/ExperimentsPublicProtocolResponseDataAttributesSubjectType" primary_metric_id: description: "ID of the primary metric supplied by the protocol." type: string published_at: description: "Time when the protocol was published." format: date-time type: string status: $ref: "#/components/schemas/ExperimentsPublicProtocolResponseDataAttributesStatus" subject_type: $ref: "#/components/schemas/ExperimentsPublicProtocolResponseDataAttributesSubjectType" subject_type_id: description: "ID of the subject type used by this configuration." type: string targeting_rules: description: "Rules that select subjects for the experiment." items: $ref: "#/components/schemas/ExperimentsPublicProtocolResponseDataAttributesTargetingRulesItems" type: array updated_at: description: |- RFC3339 update time. Preserve all fractional seconds when passing this value as `expected_updated_at`. example: "2026-01-01T00:00:00Z" type: string required: - created_at - is_duration_required_to_start - is_equal_split_enforced - is_metric_limit_enabled - is_minimum_duration_enabled - metric_groups - name - status - updated_at type: object ExperimentsPublicProtocolResponseDataAttributesAnalysisPlan: description: "Default statistical settings supplied by the protocol." properties: compute_cuped: description: "Whether to use pre-experiment data to reduce variance with CUPED." type: boolean confidence_interval_method: description: "Statistical method used to calculate confidence intervals." type: string confidence_level: description: "Confidence level used by the statistical analysis." format: double type: number multiple_testing_correction_method: description: "Method used to adjust for testing multiple metrics." type: string type: object ExperimentsPublicProtocolResponseDataAttributesAssignmentSourceDefaultPropertiesItems: description: "A default property supplied by the protocol's assignment source." properties: column_name: description: "Source column that supplies this assignment property." type: string column_type: description: "Data type of the source column." type: string name: description: "Display name of the assignment source property." type: string type: object ExperimentsPublicProtocolResponseDataAttributesEnforcement: description: "Controls that determine which protocol settings can be changed in an experiment." properties: confidence_interval_method: description: "Always LOCKED. The server keeps this setting locked regardless of the supplied value." type: string confidence_level: description: "LOCKED prevents changes to confidence level. EDITABLE permits changes." type: string cuped_calculation: description: "LOCKED prevents changes to CUPED variance reduction. EDITABLE permits changes." type: string default_duration: description: "LOCKED prevents changes to default duration. EDITABLE permits changes." type: string environment: description: "LOCKED prevents changes to environment. EDITABLE permits changes." type: string flag_source: description: "Always LOCKED. The server keeps this setting locked regardless of the supplied value." type: string multiple_testing_correction: description: "LOCKED prevents changes to multiple testing correction. EDITABLE permits changes." type: string notifications: description: "LOCKED prevents changes to notifications. EDITABLE permits changes." type: string primary_metric: description: "LOCKED prevents changes to primary metric. EDITABLE permits changes." type: string secondary_metrics: description: "LOCKED prevents changes to secondary metrics. EDITABLE permits changes." type: string split_by_exploration_dimensions: description: "LOCKED prevents changes to result exploration dimensions. EDITABLE permits changes." type: string subject_type: description: "Always LOCKED. The server keeps this setting locked regardless of the supplied value." type: string targeting_rules: description: "LOCKED prevents changes to targeting rules. EDITABLE permits changes." type: string traffic_exposure: description: "LOCKED prevents changes to traffic exposure. EDITABLE permits changes." type: string warehouse_exposure_source: description: "LOCKED prevents changes to warehouse exposure source. EDITABLE permits changes." type: string type: object ExperimentsPublicProtocolResponseDataAttributesExposureSchedule: description: "Schedule that controls traffic exposure for experiments created from the protocol." properties: autostart: description: "Whether the exposure schedule starts automatically." type: boolean guardrail_triggered_action: description: "Action taken when a guardrail triggers during the exposure schedule." type: string rollout_steps: description: "Ordered steps that define changes in traffic exposure." items: $ref: >- #/components/schemas/ExperimentsPublicProtocolResponseDataAttributesExposureScheduleRolloutStepsItems type: array selection_interval_ms: description: "Interval between traffic selections, in milliseconds." format: int64 type: integer strategy: description: "Method used to increase traffic exposure over the schedule." type: string type: object ExperimentsPublicProtocolResponseDataAttributesExposureScheduleRolloutStepsItems: description: "One step in the protocol's traffic exposure schedule." properties: exposure_ratio: description: "Fraction of traffic exposed during this rollout step." format: double type: number grouped_step_index: description: "Index of the group that contains this rollout step." format: int64 type: integer interval_ms: description: "Duration of this rollout step, in milliseconds." format: int64 type: integer is_pause_record: description: "Whether this schedule entry represents a pause." type: boolean order_position: description: "Position of this entry in the ordered configuration." format: int64 type: integer type: object ExperimentsPublicProtocolResponseDataAttributesMetricGroupsItems: description: "A group of metrics supplied by the protocol." properties: is_decision: description: "Whether the group contains decision metrics." type: boolean metrics: description: "Metrics included in this group." items: $ref: "#/components/schemas/ExperimentsCreateMetricCollectionV2RequestDataAttributesMetricsItems" type: array name: description: "Display name of the metric group." type: string type: object ExperimentsPublicProtocolResponseDataAttributesStatus: description: "Publication status of the protocol." enum: - DRAFT - PUBLISHED - ARCHIVED example: PUBLISHED type: string x-enum-varnames: - DRAFT - PUBLISHED - ARCHIVED ExperimentsPublicProtocolResponseDataAttributesSubjectType: description: "Subject type selected by the protocol." properties: id: description: "ID of the subject type." type: string name: description: "Display name of the subject type." type: string type: object ExperimentsPublicProtocolResponseDataAttributesTargetingRulesItems: description: "A targeting rule supplied by the protocol." properties: conditions: description: "Conditions that define this targeting rule." items: $ref: >- #/components/schemas/ExperimentsPublicProtocolResponseDataAttributesTargetingRulesItemsConditionsItems type: array type: object ExperimentsPublicProtocolResponseDataAttributesTargetingRulesItemsConditionsItems: description: "One condition in a protocol targeting rule." properties: attribute: description: "Subject attribute evaluated by the targeting condition." type: string operator: description: "Comparison applied to the subject attribute." type: string order_position: description: "Position of this entry in the ordered configuration." format: int64 type: integer saved_filter_id: description: "ID of the saved filter used by this targeting condition." type: string value: description: "Values compared with the subject attribute in this condition." items: description: "One value compared with the subject attribute." type: string type: array type: object ExperimentsPublicProtocolResponseDataType: default: protocols description: Protocols resource type. enum: - protocols example: protocols type: string x-enum-varnames: - PROTOCOLS ExperimentsRefreshExperimentResultsBatchMetaV2DTO: description: "Summary of refresh outcomes across the organization's experiments." properties: experiments_updated: description: "Number of experiments updated by the refresh request." format: int64 type: integer results: description: "Refresh outcome reported for each experiment." items: $ref: "#/components/schemas/ExperimentsRefreshExperimentResultsBatchMetaV2DTOResultsItems" type: array type: object ExperimentsRefreshExperimentResultsBatchMetaV2DTOResultsItems: description: "Refresh outcome for one experiment." nullable: true properties: experiment_id: description: "ID of the experiment associated with this result." type: string outcome: $ref: "#/components/schemas/ExperimentsRefreshExperimentResultsBatchMetaV2DTOResultsItemsOutcome" type: object ExperimentsRefreshExperimentResultsBatchMetaV2DTOResultsItemsOutcome: description: "Outcome of attempting to refresh one experiment." enum: - TRIGGERED - SKIPPED_ALREADY_RUNNING - SKIPPED_NOT_EDITABLE - SKIPPED_ORG_AT_CAPACITY - FAILED type: string x-enum-varnames: - TRIGGERED - SKIPPED_ALREADY_RUNNING - SKIPPED_NOT_EDITABLE - SKIPPED_ORG_AT_CAPACITY - FAILED ExperimentsRefreshExperimentResultsV2DTO: description: "Response containing the experiment refresh result." properties: data: $ref: "#/components/schemas/ExperimentsRefreshExperimentResultsV2DTOData" required: - data type: object ExperimentsRefreshExperimentResultsV2DTOArray: description: "List of experiment refresh result resources." properties: data: description: "Resources returned in this response." example: [] items: $ref: "#/components/schemas/ExperimentsRefreshExperimentResultsV2DTOData" type: array meta: $ref: "#/components/schemas/ExperimentsRefreshExperimentResultsBatchMetaV2DTO" required: - data type: object ExperimentsRefreshExperimentResultsV2DTOData: description: "JSON:API resource containing the experiment refresh result identity and fields." properties: attributes: $ref: "#/components/schemas/ExperimentsRefreshExperimentResultsV2DTODataAttributes" id: description: "ID of the experiment whose results were refreshed." example: "550e8400-e29b-41d4-a716-446655440000" format: uuid type: string type: $ref: "#/components/schemas/ExperimentsRefreshExperimentResultsV2DTODataType" required: - id - type type: object ExperimentsRefreshExperimentResultsV2DTODataAttributes: description: "Details of the experiment refresh result." properties: success: description: "Whether the refresh request succeeded." type: boolean type: object ExperimentsRefreshExperimentResultsV2DTODataType: default: experiment-results-refresh description: Experiment results refresh resource type. enum: - experiment-results-refresh example: experiment-results-refresh type: string x-enum-varnames: - EXPERIMENT_RESULTS_REFRESH ExperimentsReplaceExperimentProtocolRequest: description: >- Replace a published protocol template. Omitted optional template fields are cleared. Omitted enforcement and migration_metadata are preserved. Enabled limits require their values; allocation settings require environment_id. properties: data: $ref: "#/components/schemas/ExperimentsReplaceExperimentProtocolRequestData" required: - data type: object ExperimentsReplaceExperimentProtocolRequestData: description: JSON:API protocol request resource. properties: attributes: $ref: "#/components/schemas/ExperimentsReplaceExperimentProtocolRequestDataAttributes" id: description: Protocol ID. If supplied, must match the path protocol_id. example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string type: $ref: "#/components/schemas/ExperimentsPublicProtocolResponseDataType" required: - type - attributes type: object ExperimentsReplaceExperimentProtocolRequestDataAttributes: description: >- Replace a published protocol template. Omitted optional template fields are cleared. Omitted enforcement and migration_metadata are preserved. Enabled limits require their values; allocation settings require environment_id. properties: analysis_plan: $ref: "#/components/schemas/ExperimentsProtocolAnalysisPlanInput" assignment_source_default_properties: description: Assignment properties. items: $ref: >- #/components/schemas/ExperimentsPublicProtocolResponseDataAttributesAssignmentSourceDefaultPropertiesItems type: array assignment_source_id: description: ID of the assignment source selected by the protocol. example: 550e8400-e29b-41d4-a716-446655440000 format: uuid nullable: true type: string default_duration_days: description: Default experiment duration supplied by the protocol, in days. format: int64 minimum: 0 nullable: true type: integer enforcement: $ref: "#/components/schemas/ExperimentsReplaceProtocolEnforcementInput" environment_id: description: ID of the feature flag environment used by the experiment. example: 550e8400-e29b-41d4-a716-446655440000 format: uuid nullable: true type: string exposure_schedule: $ref: "#/components/schemas/ExperimentsProtocolExposureScheduleInput" is_duration_required_to_start: description: Whether the protocol requires a duration before an experiment can start. example: false type: boolean is_equal_split_enforced: description: Whether the protocol requires equal traffic allocation across variants. example: false type: boolean is_metric_limit_enabled: description: Whether the protocol limits the number of metrics. example: false type: boolean is_minimum_duration_enabled: description: Whether the protocol enforces a minimum experiment duration. example: false type: boolean metric_groups: description: Metric groups. example: [] items: $ref: "#/components/schemas/ExperimentsProtocolMetricGroupInput" type: array metric_limit: description: Maximum number of metrics allowed by the protocol. format: int64 minimum: 0 nullable: true type: integer migration_metadata: additionalProperties: {} description: >- Metadata for imported resources. Must encode to at most 4096 bytes. Null clears it; omission preserves it on update. nullable: true type: object minimum_duration_unit: description: Minimum duration unit, DAYS or WEEKS. nullable: true pattern: ^(DAYS|WEEKS)$ type: string minimum_duration_value: description: Minimum experiment duration in the specified unit. format: int64 minimum: 0 nullable: true type: integer primary_metric_id: description: ID of the primary metric supplied by the protocol. example: 550e8400-e29b-41d4-a716-446655440000 format: uuid nullable: true type: string subject_type_id: description: ID of the subject type used by this configuration. example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string targeting_rules: description: Targeting rules. items: $ref: "#/components/schemas/ExperimentsProtocolTargetingRuleInput" type: array required: - subject_type_id - is_equal_split_enforced - is_minimum_duration_enabled - is_duration_required_to_start - is_metric_limit_enabled - metric_groups type: object ExperimentsReplaceProtocolEnforcementInput: description: >- Complete lock map. Omit this object to preserve current locks. Null is rejected; every field is required. properties: confidence_interval_method: description: Always LOCKED. The server keeps this setting locked regardless of the supplied value. example: LOCKED pattern: ^(LOCKED|EDITABLE)$ type: string confidence_level: description: LOCKED prevents changes to confidence level. EDITABLE permits changes. example: EDITABLE pattern: ^(LOCKED|EDITABLE)$ type: string cuped_calculation: description: LOCKED prevents changes to CUPED variance reduction. EDITABLE permits changes. example: EDITABLE pattern: ^(LOCKED|EDITABLE)$ type: string default_duration: description: LOCKED prevents changes to default duration. EDITABLE permits changes. example: EDITABLE pattern: ^(LOCKED|EDITABLE)$ type: string environment: description: LOCKED prevents changes to environment. EDITABLE permits changes. example: EDITABLE pattern: ^(LOCKED|EDITABLE)$ type: string flag_source: description: Always LOCKED. The server keeps this setting locked regardless of the supplied value. example: LOCKED pattern: ^(LOCKED|EDITABLE)$ type: string multiple_testing_correction: description: LOCKED prevents changes to multiple testing correction. EDITABLE permits changes. example: EDITABLE pattern: ^(LOCKED|EDITABLE)$ type: string notifications: description: LOCKED prevents changes to notifications. EDITABLE permits changes. example: EDITABLE pattern: ^(LOCKED|EDITABLE)$ type: string primary_metric: description: LOCKED prevents changes to primary metric. EDITABLE permits changes. example: EDITABLE pattern: ^(LOCKED|EDITABLE)$ type: string secondary_metrics: description: LOCKED prevents changes to secondary metrics. EDITABLE permits changes. example: EDITABLE pattern: ^(LOCKED|EDITABLE)$ type: string split_by_exploration_dimensions: description: LOCKED prevents changes to result exploration dimensions. EDITABLE permits changes. example: EDITABLE pattern: ^(LOCKED|EDITABLE)$ type: string subject_type: description: Always LOCKED. The server keeps this setting locked regardless of the supplied value. example: LOCKED pattern: ^(LOCKED|EDITABLE)$ type: string targeting_rules: description: LOCKED prevents changes to targeting rules. EDITABLE permits changes. example: EDITABLE pattern: ^(LOCKED|EDITABLE)$ type: string traffic_exposure: description: LOCKED prevents changes to traffic exposure. EDITABLE permits changes. example: EDITABLE pattern: ^(LOCKED|EDITABLE)$ type: string warehouse_exposure_source: description: LOCKED prevents changes to warehouse exposure source. EDITABLE permits changes. example: EDITABLE pattern: ^(LOCKED|EDITABLE)$ type: string required: - confidence_interval_method - confidence_level - cuped_calculation - default_duration - environment - flag_source - multiple_testing_correction - notifications - primary_metric - secondary_metrics - split_by_exploration_dimensions - subject_type - targeting_rules - traffic_exposure - warehouse_exposure_source type: object ExperimentsSQLModelPropertyInput: description: A property column defined by an exposure SQL model. example: column_name: country column_type: STRING description: name: country properties: column_name: description: Name of the SQL result column that supplies this property. example: country type: string column_type: $ref: "#/components/schemas/ExperimentsCreateExposureSQLModelV2RequestDataAttributesItemsColumnType" description: description: Optional text that explains what this property represents. example: nullable: true type: string migration_metadata: description: Opaque metadata preserved when this property is migrated. name: description: Name used to identify the property in the model. example: country type: string required: - column_name - name type: object ExperimentsSavedFilterCondition: description: A condition that uses a saved filter. Inline fields must be omitted or null. properties: saved_filter_id: description: Saved-filter UUID. example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string required: - saved_filter_id type: object ExperimentsStartExperimentV2Request: description: "Request to start the experiment." example: data: type: start-experiment-request properties: data: $ref: "#/components/schemas/ExperimentsStartExperimentV2RequestData" required: - data type: object ExperimentsStartExperimentV2RequestData: description: "JSON:API resource containing the experiment identity." example: type: start-experiment-request properties: id: description: "ID of the experiment." type: string type: $ref: "#/components/schemas/ExperimentsStartExperimentV2RequestDataType" required: - type type: object ExperimentsStartExperimentV2RequestDataType: default: start-experiment-request description: Start experiment request resource type. enum: - start-experiment-request example: start-experiment-request type: string x-enum-varnames: - START_EXPERIMENT_REQUEST ExperimentsStructuredMetadataResponse: description: "Metadata field values with their display name and type." example: enum_values: - beta field_key: launch_stage properties: enum_values: description: "Selected values for an enumerated metadata field." example: - beta items: description: "One selected value for the metadata field." example: beta type: string type: array field_display_name: description: "Display name of the metadata field." type: string field_key: description: "Key that identifies the metadata field." example: launch_stage type: string field_type: $ref: >- #/components/schemas/ExperimentsPatchExperimentV2ResponseDataAttributesStructuredMetadataItemsFieldType freetext_value: description: "Text value for a free-text metadata field." type: string required: - field_key type: object ExperimentsSubjectTypeV2DTO: description: "Response containing the subject type." example: data: attributes: created_at: "2024-01-01T12:00:00Z" is_default: true name: User product_analytics_attribute: "@usr.id" updated_at: "2024-01-01T12:00:00Z" warehouse_column_names: - user_id - customer_id id: 550e8400-e29b-41d4-a716-446655440010 type: subject-types properties: data: $ref: "#/components/schemas/ExperimentsSubjectTypeV2DTOData" required: - data type: object ExperimentsSubjectTypeV2DTOArray: description: "List of subject type resources with pagination information." example: data: - attributes: created_at: "2024-01-01T12:00:00Z" is_default: true name: User product_analytics_attribute: "@usr.id" updated_at: "2024-01-01T12:00:00Z" warehouse_column_names: - user_id - customer_id id: 550e8400-e29b-41d4-a716-446655440010 type: subject-types properties: data: description: "Resources returned in this response." example: - attributes: created_at: "2024-01-01T12:00:00Z" is_default: true name: User product_analytics_attribute: "@usr.id" updated_at: "2024-01-01T12:00:00Z" warehouse_column_names: - user_id - customer_id id: 550e8400-e29b-41d4-a716-446655440010 type: subject-types items: $ref: "#/components/schemas/ExperimentsSubjectTypeV2DTOData" type: array links: $ref: "#/components/schemas/ExperimentsOffsetLinks" meta: $ref: "#/components/schemas/ExperimentsOffsetMeta" required: - data type: object ExperimentsSubjectTypeV2DTOData: description: "JSON:API resource containing the subject type identity and fields." example: attributes: created_at: "2024-01-01T12:00:00Z" is_default: true name: User product_analytics_attribute: "@usr.id" updated_at: "2024-01-01T12:00:00Z" warehouse_column_names: - user_id - customer_id id: 550e8400-e29b-41d4-a716-446655440010 type: subject-types properties: attributes: $ref: "#/components/schemas/ExperimentsSubjectTypeV2DTODataAttributes" id: description: "ID of the subject type." example: 550e8400-e29b-41d4-a716-446655440010 format: uuid type: string type: $ref: "#/components/schemas/ExperimentsSubjectTypeV2DTODataType" required: - id - type type: object ExperimentsSubjectTypeV2DTODataAttributes: description: "Details of the subject type." example: created_at: "2024-01-01T12:00:00Z" is_default: true name: User product_analytics_attribute: "@usr.id" updated_at: "2024-01-01T12:00:00Z" warehouse_column_names: - user_id - customer_id properties: created_at: description: "Time when this resource was created." example: "2024-01-01T12:00:00Z" format: date-time type: string experiment_count: description: "Number of experiments that reference this resource." format: int64 nullable: true type: integer exposure_source_count: description: "Number of exposure sources that reference this subject type." format: int64 nullable: true type: integer is_default: description: "Whether this is the organization's default subject type." example: true type: boolean metric_sql_model_count: description: "Number of metric SQL models that reference this subject type." format: int64 nullable: true type: integer migration_metadata: description: "Metadata retained for resources imported from another system." name: description: "Display name of the subject type." example: User type: string product_analytics_attribute: description: "Product Analytics attribute used to identify subjects of this type." example: "@usr.id" type: string protocol_count: description: "Number of protocols that reference this subject type." format: int64 nullable: true type: integer updated_at: description: "Time when this resource was last updated." example: "2024-01-01T12:00:00Z" format: date-time type: string warehouse_column_names: description: "Warehouse columns that identify subjects of this type." example: - user_id - customer_id items: description: "Name of a warehouse column that identifies subjects." example: user_id type: string type: array type: object ExperimentsSubjectTypeV2DTODataType: default: subject-types description: Subject types resource type. enum: - subject-types example: subject-types type: string x-enum-varnames: - SUBJECT_TYPES ExperimentsTargetingRule: description: Use an empty array when no targeting rules apply. properties: conditions: description: >- Conditions that must all match for this rule. Each condition must use exactly one shape: saved_filter_id alone or operator plus attribute plus value. example: [] items: $ref: "#/components/schemas/ExperimentsTargetingRuleCondition" type: array required: - conditions type: object ExperimentsTargetingRuleCondition: description: A saved-filter condition or a complete inline condition. The two forms cannot be combined. oneOf: - $ref: "#/components/schemas/ExperimentsSavedFilterCondition" - $ref: "#/components/schemas/ExperimentsInlineCondition" ExperimentsTargetingRuleOperator: description: Required with attribute and value for an inline condition; omit when saved_filter_id is set. enum: - LT - LTE - GT - GTE - MATCHES - NOT_MATCHES - ONE_OF - NOT_ONE_OF - IS_NULL - EQUALS - SEMVER_EQ - SEMVER_NEQ - SEMVER_LT - SEMVER_LTE - SEMVER_GT - SEMVER_GTE example: LT type: string x-enum-varnames: - LT - LTE - GT - GTE - MATCHES - NOT_MATCHES - ONE_OF - NOT_ONE_OF - IS_NULL - EQUALS - SEMVER_EQ - SEMVER_NEQ - SEMVER_LT - SEMVER_LTE - SEMVER_GT - SEMVER_GTE ExperimentsTrafficSummaryV2DTO: description: "Response containing the experiment traffic summary." properties: data: $ref: "#/components/schemas/ExperimentsTrafficSummaryV2DTOData" required: - data type: object ExperimentsTrafficSummaryV2DTOData: description: "JSON:API resource containing the experiment traffic summary identity and fields." properties: attributes: $ref: "#/components/schemas/ExperimentsTrafficSummaryV2DTODataAttributes" id: description: "Identifier of this traffic summary." example: "traffic-summary-1785542400000-1785628800000" type: string type: $ref: "#/components/schemas/ExperimentsTrafficSummaryV2DTODataType" required: - id - type type: object ExperimentsTrafficSummaryV2DTODataAttributes: description: "Details of the experiment traffic summary." properties: is_traffic_imbalanced: description: "Whether the observed variant traffic is imbalanced." type: boolean total_subjects: description: "Total number of subjects included in the traffic summary." format: int64 type: integer variants: description: "Exposure counts for each experiment variant." items: $ref: "#/components/schemas/ExperimentsTrafficSummaryV2DTODataAttributesVariantsItems" type: array type: object ExperimentsTrafficSummaryV2DTODataAttributesVariantsItems: description: "Exposure count and identity of one experiment variant." properties: exposure_count: description: "Number of recorded exposures for this variant." format: int64 type: integer variant_key: description: "Key that identifies the experiment variant." type: string variant_name: description: "Display name of the experiment variant." type: string type: object ExperimentsTrafficSummaryV2DTODataType: default: traffic-summary description: Traffic summary resource type. enum: - traffic-summary example: traffic-summary type: string x-enum-varnames: - TRAFFIC_SUMMARY ExperimentsUpdateExposureSQLModelV2RequestDataAttributes: description: "Complete column mappings and query used to replace the exposure SQL model." example: date_partition_column: experiment_column: experiment_id name: Exposure events properties: - column_name: country column_type: STRING description: name: country sql: SELECT user_id, experiment_id, variant, exposed_at, country FROM analytics.exposures subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: exposed_at variant_column: variant properties: date_partition_column: description: "SQL column used to partition the source data by date." example: nullable: true type: string experiment_column: description: "SQL column that identifies the experiment for each exposure." example: experiment_id type: string migration_metadata: description: "Metadata retained for resources imported from another system." name: description: "Display name of the exposure SQL model." example: Exposure events type: string properties: description: "Property columns exposed by the SQL model." example: - column_name: country column_type: STRING description: name: country items: $ref: "#/components/schemas/ExperimentsSQLModelPropertyInput" type: array sql: description: "SQL query that produces the model's source data." example: SELECT user_id, experiment_id, variant, exposed_at, country FROM analytics.exposures type: string subject_types: description: "Subject types mapped to columns in the SQL model." example: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 items: $ref: "#/components/schemas/ExperimentsCreateExposureSQLModelV2RequestDataAttributesSubjectTypesItems" maxItems: 10 minItems: 1 type: array timestamp_column: description: "SQL column that supplies the event timestamp." example: exposed_at type: string variant_column: description: "SQL column that identifies the variant for each exposure." example: variant type: string required: - name - sql - experiment_column - variant_column - timestamp_column - subject_types type: object ExperimentsUpdateExposureSQLModelV2RequestDataType: default: exposure-sql-models description: Exposure SQL models resource type. enum: - exposure-sql-models example: exposure-sql-models type: string x-enum-varnames: - EXPOSURE_SQL_MODELS ExperimentsUpdateExposureSQLModelV2Response: description: Updated exposure SQL model and its removed entries. example: data: attributes: created_at: "2024-01-01T12:00:00Z" experiment_column: experiment_id name: Exposure events properties: - column_name: country column_type: STRING id: 550e8400-e29b-41d4-a716-446655440031 name: country pipeline_column_suffix: cty001 sql: SELECT user_id, experiment_id, variant, exposed_at, country FROM analytics.exposures subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: exposed_at updated_at: "2024-01-01T12:00:00Z" variant_column: variant id: 550e8400-e29b-41d4-a716-446655440030 type: exposure-sql-models properties: data: $ref: "#/components/schemas/ExperimentsExposureSQLModelV2DTOData" meta: $ref: "#/components/schemas/ExperimentsUpdateExposureSQLModelV2ResponseMeta" required: - data type: object ExperimentsUpdateExposureSQLModelV2ResponseMeta: description: Removed model entries. Present only when the update removes an entry. properties: removed_property_names: description: Property names removed from the model. items: description: Name of a removed property. type: string type: array removed_subject_type_ids: description: Subject type IDs removed from the model. items: description: ID of a removed subject type. type: string type: array type: object ExperimentsUpdateMetricSQLModelV2RequestDataAttributes: description: "Complete column mappings and query used to replace the metric SQL model." example: date_partition_column: description: measures: - column_name: revenue column_type: FLOAT description: name: name: Order facts properties: - column_name: item_type column_type: STRING description: name: item_type sql: SELECT user_id, order_id, item_type, revenue, created_at FROM analytics.orders subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: created_at properties: date_partition_column: description: "SQL column used to partition the source data by date." example: nullable: true type: string description: description: "Text that explains the metric SQL model." example: nullable: true type: string measures: description: "Measures available from the SQL model's result columns." example: - column_name: revenue column_type: FLOAT description: name: items: $ref: "#/components/schemas/ExperimentsCreateMetricSQLModelV2RequestDataAttributesMeasuresItems" type: array migration_metadata: description: "Metadata retained for resources imported from another system." name: description: "Display name of the metric SQL model." example: Order facts type: string properties: description: "Property columns exposed by the SQL model." example: - column_name: item_type column_type: STRING description: name: item_type items: $ref: "#/components/schemas/ExperimentsMetricSQLModelPropertyInput" type: array sql: description: "SQL query that produces the model's source data." example: SELECT user_id, order_id, item_type, revenue, created_at FROM analytics.orders type: string subject_types: description: "Subject types mapped to columns in the SQL model." example: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 items: $ref: "#/components/schemas/ExperimentsCreateExposureSQLModelV2RequestDataAttributesSubjectTypesItems" maxItems: 10 minItems: 1 type: array timestamp_column: description: "SQL column that supplies the event timestamp." example: created_at type: string required: - name - sql - timestamp_column - subject_types type: object ExperimentsUpdateMetricSQLModelV2RequestDataType: default: metric-sql-models description: Metric SQL models resource type. enum: - metric-sql-models example: metric-sql-models type: string x-enum-varnames: - METRIC_SQL_MODELS ExperimentsUpdateMetricSQLModelV2Response: description: Updated metric SQL model and its removed entries. example: data: attributes: created_at: "2024-01-01T12:00:00Z" event_count_measure_id: 550e8400-e29b-41d4-a716-446655440024 is_certified: false measures: - column_name: revenue column_type: FLOAT id: 550e8400-e29b-41d4-a716-446655440021 name: revenue name: Order facts properties: - column_name: item_type column_type: STRING id: 550e8400-e29b-41d4-a716-446655440023 name: item_type sql: SELECT user_id, order_id, item_type, revenue, created_at FROM analytics.orders subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 unique_subject_count_measure_id: 550e8400-e29b-41d4-a716-446655440022 timestamp_column: created_at updated_at: "2024-01-01T12:00:00Z" id: 550e8400-e29b-41d4-a716-446655440020 type: metric-sql-models properties: data: $ref: "#/components/schemas/ExperimentsMetricSQLModelV2DTOData" meta: $ref: "#/components/schemas/ExperimentsUpdateMetricSQLModelV2ResponseMeta" required: - data type: object ExperimentsUpdateMetricSQLModelV2ResponseMeta: description: Model entries removed by the update. Empty arrays mean no entries were removed. properties: deleted_measures: description: Measure column names removed from the model. items: description: SQL column name of a removed measure. type: string type: array deleted_properties: description: Property names removed from the model. items: description: Name of a removed property. type: string type: array deleted_subject_types: description: Subject type IDs removed from the model. items: description: ID of a removed subject type. type: string type: array type: object ExperimentsUpdateMetricV2Request: description: "Request to update the metric." example: data: attributes: name: Checkout conversion id: 550e8400-e29b-41d4-a716-446655440020 type: metrics properties: data: $ref: "#/components/schemas/ExperimentsUpdateMetricV2RequestData" required: - data type: object ExperimentsUpdateMetricV2RequestData: description: "JSON:API resource containing the metric identity and fields." example: attributes: name: Checkout conversion id: 550e8400-e29b-41d4-a716-446655440020 type: metrics properties: attributes: $ref: "#/components/schemas/ExperimentsUpdateMetricV2RequestDataAttributes" id: description: "ID of the metric." example: 550e8400-e29b-41d4-a716-446655440020 format: uuid type: string type: $ref: "#/components/schemas/MetricType" required: - type type: object ExperimentsUpdateMetricV2RequestDataAttributes: description: |- Fields supplied to update the metric. Every attribute is optional; omit an attribute to leave it unchanged. example: name: Checkout conversion properties: data_source_type: $ref: "#/components/schemas/ExperimentsCreateMetricV2RequestDataAttributesDataSourceType" denominator_aggregation: $ref: "#/components/schemas/ExperimentsCreateMetricV2RequestDataAttributesNumeratorAggregation" description: description: Send null to clear the description. Omit to leave it unchanged. example: nullable: true type: string desired_change: $ref: "#/components/schemas/ExperimentsCreateMetricV2RequestDataAttributesDesiredChange" format_as_percent: description: Whether results render as a percentage. Omit to leave it unchanged. example: true type: boolean guardrail_cutoff_threshold: description: Send null to clear a stored threshold. Omit to leave it unchanged. example: format: double nullable: true type: number migration_metadata: description: "Metadata retained for resources imported from another system." name: description: Name of the metric. Omit to leave it unchanged. example: Checkout conversion type: string numerator_aggregation: $ref: "#/components/schemas/ExperimentsCreateMetricV2RequestDataAttributesNumeratorAggregation" percentile_aggregation: $ref: "#/components/schemas/ExperimentsCreateMetricV2RequestDataAttributesPercentileAggregation" type: object ExperimentsVariantResultsV2DTOArray: description: "List of variant result resources." properties: data: description: "Resources returned in this response." example: [] items: $ref: "#/components/schemas/ExperimentsVariantResultsV2DTOData" type: array meta: $ref: "#/components/schemas/ExperimentsExperimentResultsV2MetaDTO" required: - data type: object ExperimentsVariantResultsV2DTOData: description: "JSON:API resource containing the variant result identity and fields." properties: attributes: $ref: "#/components/schemas/ExperimentsVariantResultsV2DTODataAttributes" id: description: "ID of the variant result." example: "550e8400-e29b-41d4-a716-446655440000:treatment" type: string type: $ref: "#/components/schemas/ExperimentsVariantResultsV2DTODataType" required: - id - type type: object ExperimentsVariantResultsV2DTODataAttributes: description: "Details of the variant result." properties: assignment_count: description: "Number of subjects assigned to this variant." format: int64 type: integer experiment_id: description: "ID of the experiment associated with this result." type: string is_control: description: "Whether this variant is the experiment's control." type: boolean metrics: description: "Metrics reported for this variant." items: $ref: "#/components/schemas/ExperimentsVariantResultsV2DTODataAttributesMetricsItems" type: array variant_key: description: "Key that identifies the experiment variant." type: string variant_name: description: "Display name of the experiment variant." type: string type: object ExperimentsVariantResultsV2DTODataAttributesMetricsItems: description: "Metric values and statistical results for one variant." properties: analyses: description: "Statistical analyses calculated for this metric and variant." items: $ref: "#/components/schemas/ExperimentsVariantResultsV2DTODataAttributesMetricsItemsAnalysesItems" type: array assignment_count: description: "Number of subjects assigned to this variant." format: int64 type: integer coverage: description: |- Estimated share of the global metric total from the eligible population if that population received control. The estimate can exceed 1. format: double type: number coverage_summary: $ref: "#/components/schemas/ExperimentsVariantResultsV2DTODataAttributesMetricsItemsCoverageSummary" coverage_unavailable_reason: description: "Reason that metric coverage could not be calculated." type: string denominator: description: "Aggregated denominator value for this metric and variant." format: double nullable: true type: number desired_change: $ref: "#/components/schemas/ExperimentsMetricV2DTODataAttributesDesiredChange" metric_id: description: "ID of the metric represented by this entry." type: string metric_name: description: "Display name of the metric represented by this entry." type: string numerator: description: "Aggregated numerator value for this metric and variant." format: double nullable: true type: number sub_metric_property_name: description: "Name of the property used to split this metric result." type: string sub_metric_property_value: description: "Property value represented by this split metric result." type: string type: object ExperimentsVariantResultsV2DTODataAttributesMetricsItemsAnalysesItems: description: "One statistical comparison for a metric and variant." properties: confidence_interval: $ref: >- #/components/schemas/ExperimentsConfidenceInterval confidence_level: description: >- Configured nominal confidence level. Interval bounds can use an adjusted level for multiple testing or hybrid methods. format: double type: number evsi: description: "Expected reduction in minimum expected regret from collecting more sample data." format: double type: number expectation_above_zero: description: "Expected effect when the effect is positive." format: double type: number expectation_below_zero: description: "Expected effect when the effect is negative." format: double type: number global_lift: description: |- Estimated lift across the population. Calculated as metric coverage multiplied by the experiment lift. format: double type: number global_lift_lower_bound: description: "Lower bound of the estimated lift across the population." format: double type: number global_lift_upper_bound: description: "Upper bound of the estimated lift across the population." format: double type: number is_cuped_adjusted: description: "Whether CUPED used pre-experiment data to reduce variance in this result." type: boolean is_unreliable: description: "Whether the statistical result is marked as unreliable." type: boolean lift_type: $ref: "#/components/schemas/ExperimentsVariantResultsV2DTODataAttributesMetricsItemsAnalysesItemsLiftType" method: $ref: "#/components/schemas/ExperimentsVariantResultsV2DTODataAttributesMetricsItemsAnalysesItemsMethod" minimum_expected_regret: description: "The smaller expected opportunity cost of choosing treatment or control." format: double type: number p_value: description: |- Probability, under the no-effect hypothesis, of a result at least as extreme as the observed result. format: double type: number point_estimate: description: "Estimated difference between the variant and control for this metric." format: double type: number probability_above_zero: description: "Estimated probability that the effect is greater than zero." format: double type: number probability_below_zero: description: "Estimated probability that the effect is less than zero." format: double type: number standard_error: description: "Estimated uncertainty in the effect estimate." format: double type: number unreliable_reason: $ref: >- #/components/schemas/ExperimentsVariantResultsV2DTODataAttributesMetricsItemsAnalysesItemsUnreliableReason variant_metric_value: description: "Metric value calculated for this variant." format: double nullable: true type: number z_score: description: "Standardized statistic used to compare the observed effect with zero." format: double type: number type: object ExperimentsVariantResultsV2DTODataAttributesMetricsItemsAnalysesItemsLiftType: description: "Whether the reported lift is relative or absolute." enum: - RELATIVE - ABSOLUTE - UNKNOWN type: string x-enum-varnames: - RELATIVE - ABSOLUTE - UNKNOWN ExperimentsVariantResultsV2DTODataAttributesMetricsItemsAnalysesItemsMethod: description: "Statistical method used to calculate this result." enum: - FIXED_SAMPLE - BAYESIAN - SEQUENTIAL - SEQUENTIAL_FIXED_HYBRID - UNKNOWN type: string x-enum-varnames: - FIXED_SAMPLE - BAYESIAN - SEQUENTIAL - SEQUENTIAL_FIXED_HYBRID - UNKNOWN ExperimentsVariantResultsV2DTODataAttributesMetricsItemsAnalysesItemsUnreliableReason: description: "Reason that the statistical result is marked as unreliable." enum: - CONTROL_DENOMINATOR_NEAR_ZERO - TREATMENT_DENOMINATOR_NEAR_ZERO - CONTROL_AND_TREATMENT_DENOMINATORS_NEAR_ZERO - CONTROL_MEAN_NEAR_ZERO - ZERO_VARIANCE - UNKNOWN type: string x-enum-varnames: - CONTROL_DENOMINATOR_NEAR_ZERO - TREATMENT_DENOMINATOR_NEAR_ZERO - CONTROL_AND_TREATMENT_DENOMINATORS_NEAR_ZERO - CONTROL_MEAN_NEAR_ZERO - ZERO_VARIANCE - UNKNOWN ExperimentsVariantResultsV2DTODataAttributesMetricsItemsCoverageSummary: description: "Population totals and allocation used to calculate metric coverage." properties: control_total: description: "Total metric value for the control population in the coverage calculation." format: double type: number coverage: description: |- Estimated share of the global metric total from the eligible population if that population received control. The estimate can exceed 1. format: double type: number coverage_unavailable_reason: description: "Reason that metric coverage could not be calculated." type: string eligible_population_total: description: "Estimated metric total for the eligible population if that population received control." format: double type: number experiment_total: description: "Total metric value for the experiment population in the coverage calculation." format: double type: number global_metric_total: description: "Observed metric total across subjects inside and outside the experiment." format: double type: number traffic_allocation: description: "Fraction of eligible traffic allocated to the experiment, weighted by time." format: double type: number type: object ExperimentsVariantResultsV2DTODataType: default: experiment-variant-results description: Experiment variant results resource type. enum: - experiment-variant-results example: experiment-variant-results type: string x-enum-varnames: - EXPERIMENT_VARIANT_RESULTS ExperimentsWarehouseEntryPoint: description: Optional Warehouse measure that scopes analyzed subjects. example: nullable: true properties: filters: description: Complete ordered Warehouse entry-point filter set. example: [] items: $ref: "#/components/schemas/ExperimentsWarehouseExposureFilter" type: array measure_id: description: Warehouse measure UUID. example: 550e8400-e29b-41d4-a716-446655440000 type: string required: - filters - measure_id type: object ExperimentsWarehouseEntryPointFilterOperation: description: "Comparison applied by the warehouse entry-point filter." enum: - IS - IS_NOT example: IS type: string x-enum-varnames: - IS - IS_NOT ExperimentsWarehouseExposureFilter: description: "A comparison that selects warehouse exposure data by a property." properties: operation: $ref: >- #/components/schemas/ExperimentsWarehouseEntryPointFilterOperation property_id: description: Warehouse property UUID. example: 550e8400-e29b-41d4-a716-446655440000 type: string values: description: Ordered values used by the filter. example: [] items: description: Ordered values used by the filter. type: string type: array required: - operation - property_id - values type: object ExperimentsWarehouseFilterInput: description: >- A property or measure comparison for a Warehouse numerator or denominator. Set exactly one target ID that is not blank. Measure comparisons require numeric measures and numeric values. BETWEEN bounds must be in ascending order. example: operation: IS property_id: 550e8400-e29b-41d4-a716-446655440023 values: - US oneOf: - $ref: "#/components/schemas/ExperimentsPropertyFilterInput" - $ref: "#/components/schemas/ExperimentsPropertyNullFilterInput" - $ref: "#/components/schemas/ExperimentsMeasureComparisonFilterInput" - $ref: "#/components/schemas/ExperimentsMeasureRangeFilterInput" - $ref: "#/components/schemas/ExperimentsMeasureNullFilterInput" ExperimentsWarehouseFilterInputGroup: description: Metric filters combined with AND. Each group must contain at least one filter. example: - operation: IS property_id: 550e8400-e29b-41d4-a716-446655440023 values: - US items: $ref: "#/components/schemas/ExperimentsWarehouseFilterInput" minItems: 1 type: array ExperimentsWarehouseMetricAggregationInput: description: >- Settings for a metric aggregation that uses a Warehouse measure. The other measure must be omitted or null. properties: aging_threshold_days: description: >- Stored aging threshold in days. The subject aging filter uses the aggregation window end and unit. format: int64 type: integer datadog_metric_measure: $ref: "#/components/schemas/ExperimentsNullableDatadogMetricMeasureInput" enable_aging_subject_filter: description: Whether to exclude subjects whose observation time is shorter than the aggregation window. type: boolean operation: description: Calculation applied to the measure values, such as sum. example: sum minLength: 1 pattern: \S type: string property_filters: description: Property filters that select data for this aggregation. example: - - operation: IS property_id: 550e8400-e29b-41d4-a716-446655440023 values: - US items: $ref: "#/components/schemas/ExperimentsWarehouseFilterInputGroup" nullable: true type: array threshold_aggregation_type: description: Calculation used to evaluate the threshold. type: string threshold_breach_value: description: Value used to determine whether the threshold is breached. format: double type: number threshold_comparison_operator: description: Operator used to compare the calculated value with the threshold. type: string threshold_timeframe_dimension: description: |- Time unit for the threshold evaluation window. Supports seconds, minutes, hours, days, calendar_days, and weeks. Calendar days start at midnight on the assignment day. Other units start at the assignment time. type: string threshold_timeframe_value: description: End of the threshold evaluation window, measured from assignment in the configured time unit. format: double type: number timeframe_end_value: description: End offset of the aggregation window from assignment, in timeframe_unit. format: double type: number timeframe_start_value: description: Start offset of the aggregation window from assignment, in timeframe_unit. example: 0 format: double type: number timeframe_unit: description: |- Time unit for the aggregation window. Calendar days are measured from midnight on the assignment day. Other units are measured from the assignment time. type: string warehouse_metric_measure: $ref: >- #/components/schemas/ExperimentsWarehouseMetricMeasure winsor_lower_fixed_value: description: Fixed lower bound used to cap extreme measure values. format: double type: number winsor_lower_percentile: description: Percentile used to determine the lower bound for extreme measure values. format: double type: number winsor_upper_fixed_value: description: Fixed upper bound used to cap extreme measure values. format: double type: number winsor_upper_percentile: description: Percentile used to determine the upper bound for extreme measure values. format: double type: number winsorization_strategy: description: Method used to cap extreme measure values before aggregation. type: string required: - operation - warehouse_metric_measure type: object ExperimentsWarehouseMetricMeasure: description: "Reference to a measure defined in a warehouse metric SQL model." properties: id: description: "Identifier of the warehouse metric measure." example: 550e8400-e29b-41d4-a716-446655440021 format: uuid type: string required: - id type: object ExperimentsWarehousePercentileAggregationInput: description: >- Settings for a percentile aggregation that uses a Warehouse measure. The other measure must be omitted or null. properties: datadog_metric_measure: $ref: "#/components/schemas/ExperimentsNullableDatadogPercentileMeasureInput" percentile: description: Percentile to calculate from the measure values. example: 0.95 exclusiveMaximum: true exclusiveMinimum: true format: double maximum: 1 minimum: 0 type: number property_filters: description: Property filters that select data for the percentile calculation. items: $ref: "#/components/schemas/ExperimentsPropertyFilterInputGroup" nullable: true type: array warehouse_metric_measure: $ref: >- #/components/schemas/ExperimentsWarehouseMetricMeasure required: - percentile - warehouse_metric_measure type: object ExposureRolloutStepRequest: description: Rollout step request payload. properties: exposure_ratio: description: The exposure ratio for this step. example: 0.5 format: double maximum: 1 minimum: 0 type: number grouped_step_index: description: Logical index grouping related steps. example: 1 format: int64 minimum: 0 type: integer id: description: The unique identifier of the progression step. example: "550e8400-e29b-41d4-a716-446655440040" format: uuid type: string interval_ms: description: Step duration in milliseconds. example: 3600000 format: int64 nullable: true type: integer is_pause_record: description: Whether this step represents a pause record. example: false type: boolean required: - exposure_ratio - is_pause_record - grouped_step_index type: object ExposureScheduleRequest: description: Progressive release request payload. properties: absolute_start_time: description: The absolute UTC start time for this schedule. example: "2025-06-13T12:00:00Z" format: date-time nullable: true type: string control_variant_id: description: The control variant ID used for experiment comparisons. example: "550e8400-e29b-41d4-a716-446655440012" nullable: true type: string control_variant_key: description: The control variant key used during creation workflows. example: "control" nullable: true type: string id: description: The unique identifier of the progressive rollout. example: "550e8400-e29b-41d4-a716-446655440010" format: uuid type: string rollout_options: $ref: "#/components/schemas/RolloutOptionsRequest" rollout_steps: description: Ordered progression steps for exposure. items: $ref: "#/components/schemas/ExposureRolloutStepRequest" minItems: 1 type: array required: - rollout_options - rollout_steps type: object FacetInfoRequest: description: Request body for retrieving facet value information for a specified attribute with optional filtering. example: data: attributes: facet_id: first_browser_name limit: 10 search: query: user_org_id:5001 AND first_country_code:US term_search: value: Chrome id: facet_info_request type: users_facet_info_request properties: data: $ref: "#/components/schemas/FacetInfoRequestData" type: object FacetInfoRequestData: description: The data object containing the resource type and attributes for the facet info request. properties: attributes: $ref: "#/components/schemas/FacetInfoRequestDataAttributes" id: description: Unique identifier for the facet info request resource. type: string type: $ref: "#/components/schemas/FacetInfoRequestDataType" required: - type type: object FacetInfoRequestDataAttributes: description: Attributes for the facet info request, specifying which facet to query and optional filters to apply. properties: facet_id: description: The identifier of the facet attribute to retrieve value information for. example: "" type: string limit: description: Maximum number of facet values to return in the response. example: 0 format: int64 type: integer search: $ref: "#/components/schemas/FacetInfoRequestDataAttributesSearch" term_search: $ref: "#/components/schemas/FacetInfoRequestDataAttributesTermSearch" required: - facet_id - limit type: object FacetInfoRequestDataAttributesSearch: description: Query-based search configuration for filtering the audience context when retrieving facet values. properties: query: description: The filter expression used to scope the audience from which facet values are retrieved. type: string type: object FacetInfoRequestDataAttributesTermSearch: description: Term-level search configuration for filtering facet values by an exact or partial term match. properties: value: description: The term string to match against facet values. type: string type: object FacetInfoRequestDataType: default: users_facet_info_request description: Facet info request resource type. enum: - users_facet_info_request - accounts_facet_info_request example: users_facet_info_request type: string x-enum-varnames: - USERS_FACET_INFO_REQUEST - ACCOUNTS_FACET_INFO_REQUEST FacetInfoResponse: description: Response containing facet information for an attribute, including its distinct values and occurrence counts. example: data: attributes: result: values: - count: 4892 value: Chrome - count: 2341 value: Safari - count: 1567 value: Firefox - count: 892 value: Edge - count: 234 value: Opera id: facet_info_response type: users_facet_info properties: data: $ref: "#/components/schemas/FacetInfoResponseData" type: object FacetInfoResponseData: description: The data object containing the resource type and attributes for the facet info response. properties: attributes: $ref: "#/components/schemas/FacetInfoResponseDataAttributes" id: description: Unique identifier for the facet info response resource. type: string type: $ref: "#/components/schemas/FacetInfoResponseDataType" required: - type type: object FacetInfoResponseDataAttributes: description: Attributes of the facet info response, containing the facet result data. properties: result: $ref: "#/components/schemas/FacetInfoResponseDataAttributesResult" type: object FacetInfoResponseDataAttributesResult: description: The facet query result containing discrete value counts or a numeric range for the requested facet. properties: range: $ref: "#/components/schemas/FacetInfoResponseDataAttributesResultRange" values: description: List of discrete facet values with their occurrence counts. items: $ref: "#/components/schemas/FacetInfoResponseDataAttributesResultValuesItems" type: array type: object FacetInfoResponseDataAttributesResultRange: description: The numeric range of a facet attribute, representing the minimum and maximum observed values. properties: max: description: The maximum observed value for the numeric facet attribute. Null when no records match. format: double nullable: true type: number min: description: The minimum observed value for the numeric facet attribute. Null when no records match. format: double nullable: true type: number type: object FacetInfoResponseDataAttributesResultValuesItems: description: A single facet value with its occurrence count in the dataset. properties: count: description: The number of records that have this facet value. format: int64 type: integer value: description: The facet value (for example, a browser name or country code). type: string type: object FacetInfoResponseDataType: default: users_facet_info description: Facet info resource type. enum: - users_facet_info - accounts_facet_info example: users_facet_info type: string x-enum-varnames: - USERS_FACET_INFO - ACCOUNTS_FACET_INFO FastlyAPIKey: description: The definition of the `FastlyAPIKey` object. properties: api_key: $ref: "#/components/schemas/FastlyAPIKeyApiKey" type: $ref: "#/components/schemas/FastlyAPIKeyType" required: - type - api_key type: object FastlyAPIKeyApiKey: description: The `FastlyAPIKey` `api_key`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" FastlyAPIKeyType: description: The definition of the `FastlyAPIKey` object. enum: - FastlyAPIKey example: FastlyAPIKey type: string x-enum-varnames: - FASTLYAPIKEY FastlyAPIKeyUpdate: description: The definition of the `FastlyAPIKey` object. properties: api_key: $ref: "#/components/schemas/FastlyAPIKeyUpdateApiKey" type: $ref: "#/components/schemas/FastlyAPIKeyType" required: - type type: object FastlyAPIKeyUpdateApiKey: description: The `FastlyAPIKeyUpdate` `api_key`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" FastlyAccounResponseAttributes: description: Attributes object of a Fastly account. properties: name: description: The name of the Fastly account. example: "test-name" type: string services: description: A list of services belonging to the parent account. items: $ref: "#/components/schemas/FastlyService" type: array required: - name type: object FastlyAccountCreateRequest: description: Payload schema when adding a Fastly account. properties: data: $ref: "#/components/schemas/FastlyAccountCreateRequestData" required: - data type: object FastlyAccountCreateRequestAttributes: description: Attributes object for creating a Fastly account. properties: api_key: description: The API key for the Fastly account. example: "ABCDEFG123" type: string name: description: The name of the Fastly account. example: "test-name" type: string services: description: A list of services belonging to the parent account. items: $ref: "#/components/schemas/FastlyService" type: array required: - api_key - name type: object FastlyAccountCreateRequestData: description: Data object for creating a Fastly account. properties: attributes: $ref: "#/components/schemas/FastlyAccountCreateRequestAttributes" type: $ref: "#/components/schemas/FastlyAccountType" required: - attributes - type type: object FastlyAccountResponse: description: The expected response schema when getting a Fastly account. properties: data: $ref: "#/components/schemas/FastlyAccountResponseData" type: object FastlyAccountResponseData: description: Data object of a Fastly account. properties: attributes: $ref: "#/components/schemas/FastlyAccounResponseAttributes" id: description: The ID of the Fastly account, a hash of the account name. example: "abc123" type: string type: $ref: "#/components/schemas/FastlyAccountType" required: - attributes - id - type type: object FastlyAccountType: default: fastly-accounts description: The JSON:API type for this API. Should always be `fastly-accounts`. enum: - fastly-accounts example: fastly-accounts type: string x-enum-varnames: - FASTLY_ACCOUNTS FastlyAccountUpdateRequest: description: Payload schema when updating a Fastly account. properties: data: $ref: "#/components/schemas/FastlyAccountUpdateRequestData" required: - data type: object FastlyAccountUpdateRequestAttributes: description: Attributes object for updating a Fastly account. properties: api_key: description: The API key of the Fastly account. example: "ABCDEFG123" type: string name: description: The name of the Fastly account. type: string type: object FastlyAccountUpdateRequestData: description: Data object for updating a Fastly account. properties: attributes: $ref: "#/components/schemas/FastlyAccountUpdateRequestAttributes" type: $ref: "#/components/schemas/FastlyAccountType" type: object FastlyAccountsResponse: description: The expected response schema when getting Fastly accounts. properties: data: description: The JSON:API data schema. items: $ref: "#/components/schemas/FastlyAccountResponseData" type: array type: object FastlyCredentials: description: The definition of the `FastlyCredentials` object. oneOf: - $ref: "#/components/schemas/FastlyAPIKey" FastlyCredentialsUpdate: description: The definition of the `FastlyCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/FastlyAPIKeyUpdate" FastlyIntegration: description: The definition of the `FastlyIntegration` object. properties: credentials: $ref: "#/components/schemas/FastlyCredentials" type: $ref: "#/components/schemas/FastlyIntegrationType" required: - type - credentials type: object FastlyIntegrationType: description: The definition of the `FastlyIntegrationType` object. enum: - Fastly example: Fastly type: string x-enum-varnames: - FASTLY FastlyIntegrationUpdate: description: The definition of the `FastlyIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/FastlyCredentialsUpdate" type: $ref: "#/components/schemas/FastlyIntegrationType" required: - type type: object FastlyService: description: The schema representation of a Fastly service. properties: id: description: The ID of the Fastly service example: 6abc7de6893AbcDe9fghIj type: string tags: description: A list of tags for the Fastly service. example: - myTag - myTag2:myValue items: description: A tag for the Fastly service. type: string type: array required: - id type: object FastlyServiceAttributes: description: Attributes object for Fastly service requests. properties: tags: description: A list of tags for the Fastly service. example: - myTag - myTag2:myValue items: description: A tag for the Fastly service. type: string type: array type: object FastlyServiceData: description: Data object for Fastly service requests. properties: attributes: $ref: "#/components/schemas/FastlyServiceAttributes" id: description: The ID of the Fastly service. example: "abc123" type: string type: $ref: "#/components/schemas/FastlyServiceType" required: - id - type type: object FastlyServiceRequest: description: Payload schema for Fastly service requests. properties: data: $ref: "#/components/schemas/FastlyServiceData" required: - data type: object FastlyServiceResponse: description: The expected response schema when getting a Fastly service. properties: data: $ref: "#/components/schemas/FastlyServiceData" type: object FastlyServiceType: default: fastly-services description: The JSON:API type for this API. Should always be `fastly-services`. enum: - fastly-services example: fastly-services type: string x-enum-varnames: - FASTLY_SERVICES FastlyServicesResponse: description: The expected response schema when getting Fastly services. properties: data: description: The JSON:API data schema. items: $ref: "#/components/schemas/FastlyServiceData" type: array type: object FeatureFlag: description: A feature flag resource. properties: attributes: $ref: "#/components/schemas/FeatureFlagAttributes" id: description: The unique identifier of the feature flag. example: "550e8400-e29b-41d4-a716-446655440000" format: uuid type: string type: $ref: "#/components/schemas/CreateFeatureFlagDataType" required: - id - type - attributes type: object FeatureFlagAttributes: description: Attributes of a feature flag. properties: archived_at: description: The timestamp when the feature flag was archived. example: "2023-01-01T00:00:00Z" format: date-time nullable: true type: string created_at: description: The timestamp when the feature flag was created. example: "2023-01-01T00:00:00Z" format: date-time type: string created_by: description: The ID of the user who created the feature flag. example: "550e8400-e29b-41d4-a716-446655440010" format: uuid type: string description: description: The description of the feature flag. example: "This is an example feature flag for demonstration" type: string distribution_channel: description: Distribution channel for the feature flag. example: "ALL" type: string feature_flag_environments: description: Environment-specific settings for the feature flag. items: $ref: "#/components/schemas/FeatureFlagEnvironment" type: array is_favorite: description: Indicates whether the current user has marked the feature flag as a favorite. example: false type: boolean json_schema: description: JSON schema for validation when value_type is JSON. example: '{"type": "object", "properties": {"enabled": {"type": "boolean"}}}' nullable: true type: string key: description: The unique key of the feature flag. example: "feature-flag-abc123" type: string last_updated_by: description: The ID of the user who last updated the feature flag. example: "550e8400-e29b-41d4-a716-446655440010" format: uuid type: string name: description: The name of the feature flag. example: "Feature Flag ABC123" type: string require_approval: description: Indicates whether this feature flag requires approval for changes. example: false type: boolean staleness_details: $ref: "#/components/schemas/FeatureFlagStalenessDetails" staleness_status: description: Indicates the whether a feature flag is stale or not. example: "ACTIVE" type: string staleness_status_override: $ref: "#/components/schemas/FeatureFlagStalenessStatusOverride" tags: description: Tags associated with the feature flag. example: [] items: description: A tag associated with the feature flag. type: string type: array updated_at: description: The timestamp when the feature flag was last updated. example: "2023-01-01T00:00:00Z" format: date-time type: string value_type: $ref: "#/components/schemas/ValueType" variants: description: The variants of the feature flag. items: $ref: "#/components/schemas/Variant" type: array required: - key - name - description - value_type - variants type: object FeatureFlagDistributionChannel: description: The distribution channel for the feature flag. enum: - ALL - CLIENT - SERVER example: "ALL" type: string x-enum-varnames: - ALL - CLIENT - SERVER FeatureFlagEnvironment: description: Environment-specific settings for a feature flag. properties: allocations: additionalProperties: {} description: Allocation metadata for this environment. nullable: true type: object default_allocation_key: description: "A system-generated allocation key, in the format `allocation-default-`, that SDKs report in flag evaluation results and exposure events when a subject receives the environment's default variant because no targeting rule matched. It has no corresponding allocation ID and cannot be used with the allocation endpoints." example: "allocation-default-123abc" type: string default_variant_id: description: The ID of the default variant for this environment. example: "550e8400-e29b-41d4-a716-446655440002" nullable: true type: string environment_id: description: The ID of the environment. example: "550e8400-e29b-41d4-a716-446655440001" format: uuid type: string environment_name: description: The name of the environment. example: "env-search-term" type: string environment_queries: description: Queries that target this environment. example: - "test-feature-flag" - "env-search-term" items: description: A query string targeting the environment. type: string type: array is_production: description: Indicates whether the environment is production. example: false type: boolean observe_full_evaluation_data: description: >- Indicates whether feature flag evaluation events include original targeting identifiers and full evaluation context. example: false type: boolean override_allocation_key: description: "A system-generated allocation key, in the format `allocation-override-`, that SDKs report in flag evaluation results and exposure events when the environment's override variant is served. It has no corresponding allocation ID and cannot be used with the allocation endpoints." example: "allocation-override-123abc" type: string override_variant_id: description: The ID of the override variant for this environment. example: "550e8400-e29b-41d4-a716-446655440003" nullable: true type: string pending_suggestion_id: description: Pending suggestion identifier, if approval is required. example: "550e8400-e29b-41d4-a716-446655440099" nullable: true type: string require_feature_flag_approval: description: Indicates whether feature flag changes require approval in this environment. example: false type: boolean status: $ref: "#/components/schemas/FeatureFlagStatus" required: - environment_id - status type: object FeatureFlagEnvironmentListItem: description: Environment-specific settings for a feature flag in list responses. properties: default_allocation_key: description: "A system-generated allocation key, in the format `allocation-default-`, that SDKs report in flag evaluation results and exposure events when a subject receives the environment's default variant because no targeting rule matched. It has no corresponding allocation ID and cannot be used with the allocation endpoints." example: "allocation-default-123abc" type: string default_variant_id: description: The ID of the default variant for this environment. example: "550e8400-e29b-41d4-a716-446655440002" nullable: true type: string environment_id: description: The ID of the environment. example: "550e8400-e29b-41d4-a716-446655440001" format: uuid type: string environment_name: description: The name of the environment. example: "env-search-term" type: string environment_queries: description: Queries that target this environment. example: - "test-feature-flag" - "env-search-term" items: description: A query string targeting the environment. type: string type: array is_production: description: Indicates whether the environment is production. example: false type: boolean observe_full_evaluation_data: description: >- Indicates whether feature flag evaluation events include original targeting identifiers and full evaluation context. example: false type: boolean override_allocation_key: description: "A system-generated allocation key, in the format `allocation-override-`, that SDKs report in flag evaluation results and exposure events when the environment's override variant is served. It has no corresponding allocation ID and cannot be used with the allocation endpoints." example: "allocation-override-123abc" type: string override_variant_id: description: The ID of the override variant for this environment. example: "550e8400-e29b-41d4-a716-446655440003" nullable: true type: string pending_suggestion_id: description: Pending suggestion identifier, if approval is required. example: "550e8400-e29b-41d4-a716-446655440099" nullable: true type: string require_feature_flag_approval: description: Indicates whether feature flag changes require approval in this environment. example: false type: boolean status: $ref: "#/components/schemas/FeatureFlagStatus" required: - environment_id - status type: object FeatureFlagListItem: description: A feature flag resource for list responses. properties: attributes: $ref: "#/components/schemas/FeatureFlagListItemAttributes" id: description: The unique identifier of the feature flag. example: "550e8400-e29b-41d4-a716-446655440000" format: uuid type: string type: $ref: "#/components/schemas/CreateFeatureFlagDataType" required: - id - type - attributes type: object FeatureFlagListItemAttributes: description: Attributes of a feature flag in list responses. properties: archived_at: description: The timestamp when the feature flag was archived. example: "2023-01-01T00:00:00Z" format: date-time nullable: true type: string created_at: description: The timestamp when the feature flag was created. example: "2023-01-01T00:00:00Z" format: date-time type: string created_by: description: The ID of the user who created the feature flag. example: "550e8400-e29b-41d4-a716-446655440010" format: uuid type: string description: description: The description of the feature flag. example: "This is an example feature flag for demonstration" type: string distribution_channel: description: Distribution channel for the feature flag. example: "ALL" type: string feature_flag_environments: description: Environment-specific settings for the feature flag. items: $ref: "#/components/schemas/FeatureFlagEnvironmentListItem" type: array is_favorite: description: Indicates whether the current user has marked the feature flag as a favorite. example: false type: boolean json_schema: description: JSON schema for validation when value_type is JSON. example: '{"type": "object", "properties": {"enabled": {"type": "boolean"}}}' nullable: true type: string key: description: The unique key of the feature flag. example: "feature-flag-abc123" type: string last_updated_by: description: The ID of the user who last updated the feature flag. example: "550e8400-e29b-41d4-a716-446655440010" format: uuid type: string name: description: The name of the feature flag. example: "Feature Flag ABC123" type: string require_approval: description: Indicates whether this feature flag requires approval for changes. example: false type: boolean staleness_details: $ref: "#/components/schemas/FeatureFlagStalenessDetails" staleness_status: deprecated: true description: Legacy status retained for compatibility. This field is always `ACTIVE`; use `staleness_details.staleness_status` for the computed status. example: "ACTIVE" type: string staleness_status_override: $ref: "#/components/schemas/FeatureFlagStalenessStatusOverride" tags: description: Tags associated with the feature flag. example: [] items: description: A tag associated with the feature flag. type: string type: array updated_at: description: The timestamp when the feature flag was last updated. example: "2023-01-01T00:00:00Z" format: date-time type: string value_type: $ref: "#/components/schemas/ValueType" variants: description: The variants of the feature flag. items: $ref: "#/components/schemas/Variant" type: array required: - key - name - description - value_type - variants type: object FeatureFlagProductionStatus: description: The status of a feature flag across production environments. enum: - ENABLED - DISABLED - OVERRIDDEN example: ENABLED type: string x-enum-varnames: - ENABLED - DISABLED - OVERRIDDEN FeatureFlagResponse: description: Response containing a feature flag. properties: data: $ref: "#/components/schemas/FeatureFlag" required: - data type: object FeatureFlagStalenessCodeReference: description: A repository and its files that reference the feature flag. properties: files: description: Paths of files that reference the feature flag in this repository. items: description: A file path within the repository. example: "src/feature_flags.ts" type: string type: array repo_url: description: The URL of the source code repository, when available. example: "https://github.com/example/application" type: string scm_repository_id: description: The identifier of the source code repository. example: "repository-1" type: string type: object FeatureFlagStalenessDetails: description: The feature flag's current staleness state and suggested actions. properties: code_references: description: Repositories and files where the flag is referenced in source code. items: $ref: "#/components/schemas/FeatureFlagStalenessCodeReference" nullable: true type: array dismissed_by: description: The ID of the user who dismissed the staleness recommendation. example: "550e8400-e29b-41d4-a716-446655440010" nullable: true type: string id: description: The ID of the feature flag whose staleness state is returned. example: "550e8400-e29b-41d4-a716-446655440000" type: string recommended_actions: description: Suggested actions for the flag. The first action is the primary recommendation. items: $ref: "#/components/schemas/FeatureFlagStalenessRecommendedAction" nullable: true type: array skip_state_check_until: description: Time until which staleness checks are paused for the flag. example: "2026-09-30T12:00:00Z" format: date-time nullable: true type: string stale_reason: description: >- Why the flag is stale or has a manually selected state. Values include `FULLY_ROLLED_OUT`, `NO_EVALUATIONS`, `NO_ACTIVITY`, and `USER_SET`. example: "NO_EVALUATIONS" nullable: true type: string staleness_status: description: The current state, such as `ACTIVE`, `STALE`, or `PERMANENT`. example: "ACTIVE" type: string type: object FeatureFlagStalenessRecommendedAction: description: An action suggested for a feature flag based on its staleness state. properties: action: description: >- The action to consider. Values include `remove_from_code`, `archive_flag`, `mark_as_permanent`, `snooze`, and `check_sdk_config`. example: "archive_flag" type: string description: description: An explanation of the suggested action. example: "Archive the feature flag." type: string type: object FeatureFlagStalenessStatus: description: The computed staleness status of a feature flag. enum: - ACTIVE - STALE - PERMANENT example: ACTIVE type: string x-enum-varnames: - ACTIVE - STALE - PERMANENT FeatureFlagStalenessStatusOverride: description: An explicit staleness status override. Omitted when no override is set. enum: - STALE - PERMANENT example: PERMANENT type: string x-enum-varnames: - STALE - PERMANENT FeatureFlagStatus: description: The status of a feature flag in an environment. enum: - ENABLED - DISABLED example: "ENABLED" type: string x-enum-varnames: - ENABLED - DISABLED FeatureFlagsPaginationLinks: description: Pagination links. Follow `next` with the same authentication to retrieve the next page. Links use `page[limit]` and `page[offset]` and preserve the filters. Navigation links are omitted when not applicable. properties: first: description: Link to the first page. example: https://api.datadoghq.com/api/v2/feature-flags?page%5Blimit%5D=25&page%5Boffset%5D=0 type: string last: description: Link to the last page. example: https://api.datadoghq.com/api/v2/feature-flags?page%5Blimit%5D=25&page%5Boffset%5D=75 type: string next: description: Link to the next page, when available. example: https://api.datadoghq.com/api/v2/feature-flags?page%5Blimit%5D=25&page%5Boffset%5D=25 type: string prev: description: Link to the previous page, when available. example: https://api.datadoghq.com/api/v2/feature-flags?page%5Blimit%5D=25&page%5Boffset%5D=0 type: string self: description: Link to the current page. example: https://api.datadoghq.com/api/v2/feature-flags?page%5Blimit%5D=25&page%5Boffset%5D=0 type: string type: object FeatureFlagsPaginationMeta: description: Pagination metadata for feature flags. properties: page: $ref: "#/components/schemas/FeatureFlagsPaginationMetaPage" type: object FeatureFlagsPaginationMetaPage: description: Pagination metadata for feature flags list responses. properties: first_offset: description: Offset of the first page. example: 0 format: int64 type: integer last_offset: description: Offset of the last page. example: 75 format: int64 nullable: true type: integer limit: description: Maximum number of flags returned on this page. example: 25 format: int64 type: integer next_offset: description: Offset of the next page, or null when there is no next page. example: 25 format: int64 nullable: true type: integer offset: description: Number of matching flags skipped before this page. example: 0 format: int64 type: integer prev_offset: description: Offset of the previous page, or null when there is no previous page. example: 0 format: int64 nullable: true type: integer total: description: Total number of flags matching the filters, independent of the page size. example: 100 format: int64 type: integer total_count: deprecated: true description: Legacy count field. Use `total` for the number of matching flags. example: 100 format: int64 type: integer total_filtered_count: deprecated: true description: Legacy filtered count field. Use `total` for the number of matching flags. example: 25 format: int64 type: integer type: description: The pagination method. Always `offset_limit`. example: offset_limit type: string type: object FileCoverageLines: description: Per-file line coverage data including executable, covered, and added lines. properties: added_lines: description: Line numbers that were added in the specified scope (for example, in a PR diff). example: [11, 12] items: format: int64 type: integer type: array covered_lines: description: Line numbers that were covered by tests. example: [10, 11, 15] items: format: int64 type: integer type: array executable_lines: description: Line numbers that are executable (can be covered). example: [10, 11, 12, 15, 20] items: format: int64 type: integer type: array type: object FilesCoverageAttributes: description: Attributes of the per-file code coverage response. properties: base_commit_sha: description: The SHA of the base commit used for comparison (for example, the merge base for a PR). example: abc1234567890abcdef1234567890abcdef12345 type: string event_timestamp: description: Unix timestamp (milliseconds) of the coverage event. example: 1709564000000 format: int64 type: integer files: additionalProperties: $ref: "#/components/schemas/FileCoverageLines" description: Map of file paths to per-file coverage line data. type: object head_commit_sha: description: The SHA of the head commit for which coverage was evaluated. example: 66adc9350f2cc9b250b69abddab733dd55e1a588 type: string report_count: description: Number of coverage reports evaluated. example: 3 format: int64 type: integer type: object FilesCoverageData: description: Data object for files coverage response. properties: attributes: $ref: "#/components/schemas/FilesCoverageAttributes" id: description: Unique identifier for the files coverage response. example: ZGQxMjM0NV9tYWluXzE3MDk1NjQwMDA= type: string type: $ref: "#/components/schemas/FilesCoverageResponseType" type: object FilesCoverageRequest: description: Request object for getting per-file code coverage data. properties: data: $ref: "#/components/schemas/FilesCoverageRequestData" required: - data type: object FilesCoverageRequestAttributes: description: Attributes for requesting per-file code coverage data. Exactly one of `commit_sha`, `branch`, or `pr_number` must be provided. At most one of `service`, `codeowner`, or `flag` may be provided. properties: branch: description: The branch name. example: main type: string changed_only: description: When true, return coverage data only for files that were changed in the specified scope. example: true type: boolean codeowner: description: Filter coverage by code owner. At most one of `service`, `codeowner`, or `flag` may be provided. example: "@my-team" type: string commit_sha: description: The commit SHA (40-character hexadecimal string). example: 66adc9350f2cc9b250b69abddab733dd55e1a588 pattern: "^[a-fA-F0-9]{40}$" type: string flag: description: Filter coverage by coverage flag. At most one of `service`, `codeowner`, or `flag` may be provided. example: unit-tests type: string pr_number: description: The pull request number. Must be a positive integer. example: 42 format: int64 minimum: 1 type: integer repository_id: deprecated: true description: "Deprecated: use `repository_url` instead. The repository URL." example: github.com/datadog/shopist minLength: 1 type: string repository_url: description: The repository URL. Accepts a full URL with or without a scheme (for example, `https://github.com/org/repo` or `github.com/org/repo`). example: https://github.com/datadog/shopist minLength: 1 type: string service: description: Filter coverage by service name. At most one of `service`, `codeowner`, or `flag` may be provided. example: my-service type: string type: object FilesCoverageRequestData: description: Data object for files coverage request. properties: attributes: $ref: "#/components/schemas/FilesCoverageRequestAttributes" type: $ref: "#/components/schemas/FilesCoverageRequestType" required: - type - attributes type: object FilesCoverageRequestType: description: JSON:API type for files coverage request. The value must always be `ci_app_coverage_files_request`. enum: - ci_app_coverage_files_request example: ci_app_coverage_files_request type: string x-enum-varnames: - CI_APP_COVERAGE_FILES_REQUEST FilesCoverageResponse: description: Response object containing per-file code coverage data. properties: data: $ref: "#/components/schemas/FilesCoverageData" type: object FilesCoverageResponseType: description: JSON:API type for files coverage response. The value must always be `ci_app_coverage_files`. enum: - ci_app_coverage_files example: ci_app_coverage_files type: string x-enum-varnames: - CI_APP_COVERAGE_FILES FiltersPerProduct: description: Product-specific filters for the dataset. properties: filters: description: |- Defines the list of tag-based filters used to restrict access to telemetry data for a specific product. These filters act as access control rules. Each filter must follow the tag query syntax used by Datadog (such as `@tag.key:value`), and only one tag or attribute may be used to define the access strategy per telemetry type. example: - "@application.id:ABCD" items: description: A tag-based filter expression using Datadog tag query syntax. example: "@application.id:ABCD" type: string type: array product: description: |- Name of the product the dataset is for. Possible values are 'apm', 'rum', 'metrics', 'logs', 'error_tracking', 'cloud_cost', 'sd_repoinfo', 'secruntime', and 'signal'. example: "logs" type: string required: - product - filters type: object Finding: description: A single finding without the message and resource configuration. properties: attributes: $ref: "#/components/schemas/FindingAttributes" id: $ref: "#/components/schemas/FindingID" type: $ref: "#/components/schemas/FindingType" type: object FindingAttributes: description: The JSON:API attributes of the finding. properties: datadog_link: $ref: "#/components/schemas/FindingDatadogLink" description: $ref: "#/components/schemas/FindingDescription" evaluation: $ref: "#/components/schemas/FindingEvaluation" evaluation_changed_at: $ref: "#/components/schemas/FindingEvaluationChangedAt" external_id: $ref: "#/components/schemas/FindingExternalId" mute: $ref: "#/components/schemas/FindingMute" resource: $ref: "#/components/schemas/FindingResource" resource_discovery_date: $ref: "#/components/schemas/FindingResourceDiscoveryDate" resource_type: $ref: "#/components/schemas/FindingResourceType" rule: $ref: "#/components/schemas/FindingRule" status: $ref: "#/components/schemas/FindingStatus" tags: $ref: "#/components/schemas/FindingTags" vulnerability_type: $ref: "#/components/schemas/FindingVulnerabilityType" type: object FindingCaseResponse: description: Case response. properties: data: $ref: "#/components/schemas/FindingCaseResponseData" type: object FindingCaseResponseArray: description: List of case responses. properties: data: description: Array of case response data objects. items: $ref: "#/components/schemas/FindingCaseResponseData" type: array required: - data type: object FindingCaseResponseData: description: Data of the case. properties: attributes: $ref: "#/components/schemas/FindingCaseResponseDataAttributes" id: description: Unique identifier of the case. example: "c1234567-89ab-cdef-0123-456789abcdef" type: string relationships: $ref: "#/components/schemas/FindingCaseResponseDataRelationships" type: $ref: "#/components/schemas/CaseDataType" required: - type type: object FindingCaseResponseDataAttributes: description: Attributes of the case. properties: archived_at: description: Timestamp of when the case was archived. example: "2025-01-01T00:00:00.000Z" format: date-time type: string assigned_to: $ref: "#/components/schemas/RelationshipToUser" description: User assigned to the case. attributes: additionalProperties: items: description: A custom attribute value string. type: string type: array description: Custom attributes associated with the case as key-value pairs where values are string arrays. type: object closed_at: description: Timestamp of when the case was closed. example: "2025-01-01T00:00:00.000Z" format: date-time type: string created_at: description: Timestamp of when the case was created. example: "2025-01-01T00:00:00.000Z" format: date-time type: string creation_source: description: Source of the case creation. example: "CS_SECURITY_FINDING" type: string description: description: Description of the case. example: "A description of the case." type: string due_date: description: Due date of the case. example: "2025-01-01" type: string insights: description: Insights of the case. items: $ref: "#/components/schemas/CaseInsightsItems" type: array jira_issue: $ref: "#/components/schemas/FindingJiraIssue" description: Jira issue associated with the case. key: description: Key of the case. example: "PROJ-123" type: string linear_issue: $ref: "#/components/schemas/FindingLinearIssue" description: Linear issue associated with the case. modified_at: description: Timestamp of when the case was last modified. example: "2025-01-01T00:00:00.000Z" format: date-time type: string priority: description: Priority of the case. example: "P4" type: string servicenow_ticket: $ref: "#/components/schemas/FindingServiceNowTicket" description: ServiceNow ticket associated with the case. status: description: Status of the case. example: "OPEN" type: string status_group: description: Status group of the case. example: "SG_OPEN" type: string status_name: description: Status name of the case. example: "Open" type: string title: description: Title of the case. example: "A title for the case." type: string type: description: Type of the case. For security cases, this is always "SECURITY". example: "SECURITY" type: string type: object FindingCaseResponseDataRelationships: description: Relationships of the case. properties: created_by: $ref: "#/components/schemas/RelationshipToUser" description: User who created the case. modified_by: $ref: "#/components/schemas/RelationshipToUser" description: User who last modified the case. project: $ref: "#/components/schemas/CaseManagementProject" description: Project in which the case was created. type: object FindingData: description: Data object representing a security finding. properties: id: description: Unique identifier of the security finding. example: "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==" type: string type: $ref: "#/components/schemas/FindingDataType" required: - type - id type: object FindingDataType: default: findings description: Security findings resource type. enum: - findings example: findings type: string x-enum-varnames: - FINDINGS FindingDatadogLink: description: The Datadog relative link for this finding. example: "/security/compliance?panels=cpfinding%7Cevent%7CruleId%3Adef-000-u5t%7CresourceId%3Ae8c9ab7c52ebd7bf2fdb4db641082d7d%7CtabId%3Aoverview" type: string FindingDescription: description: The description and remediation steps for this finding. example: "## Remediation\n\n1. In the console, go to **Storage Account**.\n2. For each Storage Account, navigate to **Data Protection**.\n3. Select **Set soft delete enabled** and enter the number of days to retain soft deleted data." type: string FindingEvaluation: description: The evaluation of the finding. enum: - pass - fail example: pass type: string x-enum-varnames: ["PASS", "FAIL"] FindingEvaluationChangedAt: description: The date on which the evaluation for this finding changed (Unix ms). example: 1678721573794 format: int64 minimum: 1 type: integer FindingExternalId: description: The cloud-based ID for the resource related to the finding. example: "arn:aws:s3:::my-example-bucket" type: string FindingID: description: The unique ID for this finding. example: ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw== type: string FindingJiraIssue: description: Jira issue associated with the case. properties: error_message: description: Error message if the Jira issue creation failed. example: '{"errorMessages":["An error occured."],"errors":{}}' type: string result: $ref: "#/components/schemas/FindingJiraIssueResult" status: description: Status of the Jira issue creation. Can be "COMPLETED" if the Jira issue was created successfully, or "FAILED" if the Jira issue creation failed. example: "COMPLETED" type: string type: object FindingJiraIssueResult: description: Result of the Jira issue creation. properties: account_id: description: Account ID of the Jira issue. example: "463a8631-680e-455c-bfd3-3ed04d326eb7" type: string issue_id: description: Unique identifier of the Jira issue. example: "2871276" type: string issue_key: description: Key of the Jira issue. example: "PROJ-123" type: string issue_url: description: URL of the Jira issue. example: "https://domain.atlassian.net/browse/PROJ-123" type: string type: object FindingLinearIssue: description: Linear issue associated with the case. properties: error_message: description: Error message if the Linear issue creation failed. example: "Linear issue creation failed." type: string result: $ref: "#/components/schemas/FindingLinearIssueResult" status: description: Status of the Linear issue creation. Can be "COMPLETED" if the Linear issue was created successfully, or "FAILED" if the Linear issue creation failed. example: "COMPLETED" type: string type: object FindingLinearIssueResult: description: Result of the Linear issue creation. properties: account_id: description: Account ID of the Linear workspace. example: "463a8631-680e-455c-bfd3-3ed04d326eb7" type: string issue_id: description: Unique identifier of the Linear issue. example: "9c1e5f8a-2b3d-4c7e-8f6a-1d2e3f4a5b6c" type: string issue_key: description: Key of the Linear issue. example: "ENG-123" type: string team_id: description: Team ID of the Linear issue. example: "b5d3c8a1-7e6f-4d2c-9a8b-3c4d5e6f7a8b" type: string url: description: URL of the Linear issue. example: "https://linear.app/your-workspace/issue/ENG-123" type: string type: object FindingMute: additionalProperties: false description: Information about the mute status of this finding. properties: description: description: Additional information about the reason why this finding is muted or unmuted. example: To be resolved later type: string expiration_date: description: The expiration date of the mute or unmute action (Unix ms). example: 1778721573794 format: int64 type: integer muted: description: Whether this finding is muted or unmuted. example: true type: boolean reason: $ref: "#/components/schemas/FindingMuteReason" start_date: description: The start of the mute period. example: 1678721573794 format: int64 type: integer uuid: description: The ID of the user who muted or unmuted this finding. example: e51c9744-d158-11ec-ad23-da7ad0900002 type: string type: object FindingMuteReason: description: The reason why this finding is muted or unmuted. enum: - PENDING_FIX - FALSE_POSITIVE - ACCEPTED_RISK - NO_PENDING_FIX - HUMAN_ERROR - NO_LONGER_ACCEPTED_RISK - OTHER example: ACCEPTED_RISK type: string x-enum-varnames: ["PENDING_FIX", "FALSE_POSITIVE", "ACCEPTED_RISK", "NO_PENDING_FIX", "HUMAN_ERROR", "NO_LONGER_ACCEPTED_RISK", "OTHER"] FindingResource: description: The resource name of this finding. example: my_resource_name type: string FindingResourceDiscoveryDate: description: The date on which the resource was discovered (Unix ms). example: 1678721573794 format: int64 minimum: 1 type: integer FindingResourceType: description: The resource type of this finding. example: azure_storage_account type: string FindingRule: additionalProperties: false description: The rule that triggered this finding. properties: id: description: The ID of the rule that triggered this finding. example: dv2-jzf-41i type: string name: description: The name of the rule that triggered this finding. example: Soft delete is enabled for Azure Storage type: string type: object FindingServiceNowTicket: description: ServiceNow ticket associated with the case. properties: result: $ref: "#/components/schemas/FindingServiceNowTicketResult" status: description: Status of the ServiceNow ticket operation. Can be "COMPLETED" if successful, or "FAILED" if the operation failed. example: "COMPLETED" type: string type: object FindingServiceNowTicketResult: description: Result of the ServiceNow ticket creation or attachment. properties: instance_name: description: ServiceNow instance name extracted from the ticket URL. example: "example" type: string sys_id: description: Unique identifier of the ServiceNow incident record. example: "abcdef0123456789abcdef0123456789" type: string sys_target_link: description: Direct link to the ServiceNow incident record. example: "https://example.service-now.com/incident.do?sys_id=abcdef0123456789abcdef0123456789" type: string sys_target_sys_id: description: Unique identifier of the target ServiceNow record. example: "abcdef0123456789abcdef0123456789" type: string table_name: description: ServiceNow table containing the incident record. example: "incident" type: string url: description: URL of the ServiceNow incident record. example: "https://example.service-now.com/now/nav/ui/classic/params/target/incident.do?sys_id=abcdef0123456789abcdef0123456789" type: string type: object FindingStatus: description: The status of the finding. enum: - critical - high - medium - low - info example: critical type: string x-enum-varnames: ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"] FindingTags: description: The tags associated with this finding. example: - cloud_provider:aws - myTag:myValue items: description: The list of tags. type: string type: array FindingType: default: finding description: The JSON:API type for findings. enum: - finding example: finding type: string x-enum-varnames: ["FINDING"] FindingVulnerabilityType: description: The vulnerability type of the finding. enum: - misconfiguration - attack_path - identity_risk - api_security example: misconfiguration type: string x-enum-varnames: - MISCONFIGURATION - ATTACK_PATH - IDENTITY_RISK - API_SECURITY Findings: description: A list of security findings. properties: data: description: Array of security finding data objects. items: $ref: "#/components/schemas/FindingData" type: array type: object FlakyTest: description: A flaky test object. properties: attributes: $ref: "#/components/schemas/FlakyTestAttributes" id: description: |- Test's ID. This ID is the hash of the test's Fully Qualified Name and Git repository ID. It is the value of the `@test.fingerprint_fqn` facet on test events, which you can search on in the Test Optimization Explorer to locate a specific test. To filter search results by this ID, use the `fingerprint_fqn` search key. type: string type: $ref: "#/components/schemas/FlakyTestType" type: object FlakyTestAttributes: description: Attributes of a flaky test. properties: attempt_to_fix_id: description: |- Unique identifier for the attempt to fix this flaky test. Use this ID in the Git commit message in order to trigger the attempt to fix workflow. When the workflow is triggered the test is automatically retried by the tracer a certain number of configurable times. When all retries pass, the test is automatically marked as fixed in Flaky Test Management. Test runs are tagged with @test.test_management.attempt_to_fix_passed and @test.test_management.is_attempt_to_fix when the attempt to fix workflow is triggered. example: I42TEO type: string codeowners: description: The name of the test's code owners as inferred from the repository configuration. example: ["@foo", "@bar"] items: description: A code owner of the test as inferred from the repository configuration. type: string type: array envs: description: List of environments where this test has been flaky. example: prod items: description: An environment name where this test has been flaky. type: string type: array first_flaked_branch: description: The branch name where the test exhibited flakiness for the first time. example: main type: string first_flaked_sha: description: The commit SHA where the test exhibited flakiness for the first time. example: 0c6be03165b7f7ffe96e076ffb29afb2825616c3 type: string first_flaked_ts: description: Unix timestamp when the test exhibited flakiness for the first time. example: 1757688149 format: int64 type: integer flaky_category: description: The category of a flaky test. example: Timeout nullable: true type: string flaky_state: $ref: "#/components/schemas/FlakyTestAttributesFlakyState" history: description: |- Chronological history of status changes for this flaky test, ordered from most recent to oldest. Includes state transitions like new -> quarantined -> fixed, along with the associated commit SHA when available. example: - commit_sha: abc123def456 policy_id: ftm_policy.quarantine.failure_rate policy_meta: config: failure_rate: 0.1 required_runs: 100 failure_rate: 0.25 total_runs: 200 status: quarantined timestamp: 1704067200000 - commit_sha: "" policy_id: unknown policy_meta: status: new timestamp: 1703980800000 items: $ref: "#/components/schemas/FlakyTestHistory" type: array impact_level: $ref: "#/components/schemas/FlakyTestImpactLevel" nullable: true impact_score: description: A score from 0 to 1 indicating the impact of this flaky test, based on factors such as how often it fails and how many pipelines it affects. example: 0.78 format: double maximum: 1 minimum: 0 nullable: true type: number last_flaked_branch: description: The branch name where the test exhibited flakiness for the last time. example: main type: string last_flaked_sha: description: The commit SHA where the test exhibited flakiness for the last time. example: 0c6be03165b7f7ffe96e076ffb29afb2825616c3 type: string last_flaked_ts: description: Unix timestamp when the test exhibited flakiness for the last time. example: 1757688149 format: int64 type: integer module: description: |- The name of the test module. The definition of module changes slightly per language: - In .NET, a test module groups every test that is run under the same unit test project. - In Swift, a test module groups every test that is run for a given bundle. - In JavaScript, the test modules map one-to-one to test sessions. - In Java, a test module groups every test that is run by the same Maven Surefire/Failsafe or Gradle Test task execution. - In Python, a test module groups every test that is run under the same `.py` file as part of a test suite, which is typically managed by a framework like `unittest` or `pytest`. - In Ruby, a test module groups every test that is run within the same test file, which is typically managed by a framework like `RSpec` or `Minitest`. example: TestModule nullable: true type: string name: description: The test name. A concise name for a test case. Defined in the test itself. example: TestName type: string pipeline_stats: $ref: "#/components/schemas/FlakyTestPipelineStats" nullable: true services: description: |- List of test service names where this test has been flaky. A test service is a group of tests associated with a project or repository. It contains all the individual tests for your code, optionally organized into test suites, which are like folders for your tests. example: ["foo", "bar"] items: description: A test service name where this test has been flaky. type: string type: array suite: description: The name of the test suite. A group of tests exercising the same unit of code depending on your language and testing framework. example: TestSuite type: string test_run_metadata: $ref: "#/components/schemas/FlakyTestRunMetadata" test_stats: $ref: "#/components/schemas/FlakyTestStats" type: object FlakyTestAttributesFlakyState: description: The current state of the flaky test. enum: [active, fixed, quarantined, disabled] example: active type: string x-enum-varnames: [ACTIVE, FIXED, QUARANTINED, DISABLED] FlakyTestHistory: description: A single history entry representing a status change for a flaky test. properties: commit_sha: description: The commit SHA associated with this status change. Will be an empty string if the commit SHA is not available. example: abc123def456 type: string policy_id: $ref: "#/components/schemas/FlakyTestHistoryPolicyId" policy_meta: $ref: "#/components/schemas/FlakyTestHistoryPolicyMeta" nullable: true status: description: The test status at this point in history. example: quarantined type: string timestamp: description: Unix timestamp in milliseconds when this status change occurred. example: 1704067200000 format: int64 type: integer required: - status - commit_sha - timestamp type: object FlakyTestHistoryPolicyId: description: The policy that triggered this status change. enum: - ftm_policy.manual - ftm_policy.fixed - ftm_policy.disable.failure_rate - ftm_policy.disable.branch_flake - ftm_policy.disable.days_active - ftm_policy.quarantine.failure_rate - ftm_policy.quarantine.branch_flake - ftm_policy.quarantine.days_active - unknown example: ftm_policy.quarantine.failure_rate nullable: false type: string x-enum-varnames: - MANUAL - FIXED - DISABLE_FAILURE_RATE - DISABLE_BRANCH_FLAKE - DISABLE_DAYS_ACTIVE - QUARANTINE_FAILURE_RATE - QUARANTINE_BRANCH_FLAKE - QUARANTINE_DAYS_ACTIVE - UNKNOWN FlakyTestHistoryPolicyMeta: description: Metadata about the policy that triggered this status change. properties: branches: description: Branches where the test was flaky at the time of the status change. example: ["main", "develop"] items: type: string nullable: true type: array config: $ref: "#/components/schemas/FlakyTestHistoryPolicyMetaConfig" nullable: true days_active: description: The number of days the test has been active at the time of the status change. example: 15 format: int32 maximum: 2147483647 nullable: true type: integer days_without_flake: description: The number of days since the test last exhibited flakiness. example: 30 format: int32 maximum: 2147483647 nullable: true type: integer failure_rate: description: The failure rate of the test at the time of the status change. example: 0.25 format: double maximum: 1 minimum: 0 nullable: true type: number state: description: The previous state of the test. example: quarantined nullable: true type: string total_runs: description: The total number of test runs at the time of the status change. example: 200 format: int32 maximum: 2147483647 nullable: true type: integer type: object FlakyTestHistoryPolicyMetaConfig: description: Configuration parameters of the policy that triggered this status change. properties: branches: description: The branches considered by the policy. example: ["main"] items: type: string nullable: true type: array days_active: description: The number of days a test must have been active for the policy to trigger. example: 30 format: int32 maximum: 2147483647 nullable: true type: integer failure_rate: description: The failure rate threshold for the policy to trigger. example: 0.7 format: double maximum: 1 minimum: 0 nullable: true type: number forget_branches: description: Branches excluded from the policy evaluation. example: ["release"] items: type: string nullable: true type: array required_runs: description: The minimum number of test runs required for the policy to trigger. example: 100 format: int32 maximum: 2147483647 nullable: true type: integer state: description: The target state the policy transitions the test from. example: quarantined nullable: true type: string test_services: description: Test services excluded from the policy evaluation. example: ["my-service"] items: type: string nullable: true type: array type: object FlakyTestImpactLevel: description: The impact level of the flaky test, derived from its impact score. enum: [low, medium, high] example: medium type: string x-enum-varnames: [LOW, MEDIUM, HIGH] FlakyTestPipelineStats: description: CI pipeline related statistics for the flaky test. This information is only available if test runs are associated with CI pipeline events from CI Visibility. properties: failed_pipelines: description: The number of pipelines that failed due to this test for the past 7 days. This is computed as the sum of failed CI pipeline events associated with test runs where the flaky test failed. example: 319 format: int64 nullable: true type: integer total_lost_time_ms: description: The total time lost by CI pipelines due to this flaky test in milliseconds. This is computed as the sum of the duration of failed CI pipeline events associated with test runs where the flaky test failed. example: 1527550000 format: int64 nullable: true type: integer type: object FlakyTestRunMetadata: description: Metadata about the latest failed test run of the flaky test. properties: duration_ms: description: The duration of the test run in milliseconds. example: 27398 format: int64 nullable: true type: integer error_message: description: The error message from the test failure. example: "Expecting actual not to be empty" nullable: true type: string error_stack: description: The stack trace from the test failure. example: "Traceback (most recent call last):\n File \"test_foo.py\", line 10, in test_foo\n assert actual == expected\nAssertionError: Expecting actual not to be empty" nullable: true type: string source_end: description: The line number where the test ends in the source file. example: 20 format: int64 nullable: true type: integer source_file: description: The source file where the test is defined. example: test_foo.py nullable: true type: string source_start: description: The line number where the test starts in the source file. example: 10 format: int64 nullable: true type: integer type: object FlakyTestStats: description: Test statistics for the flaky test. properties: failure_rate_pct: description: The failure rate percentage of the test for the past 7 days. This is the number of failed test runs divided by the total number of test runs (excluding skipped test runs). example: 0.1 format: double nullable: true type: number type: object FlakyTestType: description: The type of the flaky test from Flaky Test Management. enum: [flaky_test] type: string x-enum-varnames: [FLAKY_TEST] FlakyTestsPagination: description: Pagination metadata for flaky tests. properties: next_page: description: Cursor for the next page of results. nullable: true type: string type: object FlakyTestsSearchFilter: description: Search filter settings. properties: include_history: default: false description: |- Whether to include the status change history for each flaky test in the response. When set to true, each test will include a `history` array with chronological status changes. Defaults to false. example: true type: boolean query: default: "*" description: |- Search query following log syntax used to filter flaky tests, same as on Flaky Tests Management UI. The supported search keys are: - `flaky_test_state` - `flaky_test_category` - `@test.name` - `@test.suite` - `@test.module` - `@test.service` - `@git.repository.id_v2` - `@git.branch` - `@test.codeowners` - `env` - `fingerprint_fqn` Use `fingerprint_fqn` to filter by a test's stable Fingerprint FQN (the same value as the test's `id`). example: 'flaky_test_state:active @git.repository.id_v2:"github.com/datadog/shopist"' type: string type: object FlakyTestsSearchPageOptions: description: Pagination attributes for listing flaky tests. properties: cursor: description: |- List following results with a cursor provided in the previous request. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string limit: default: 10 description: Maximum number of flaky tests in the response. example: 25 format: int64 maximum: 1000 minimum: 1 type: integer type: object FlakyTestsSearchRequest: description: The request for a flaky tests search. properties: data: $ref: "#/components/schemas/FlakyTestsSearchRequestData" type: object FlakyTestsSearchRequestAttributes: description: Attributes for the flaky tests search request. properties: filter: $ref: "#/components/schemas/FlakyTestsSearchFilter" page: $ref: "#/components/schemas/FlakyTestsSearchPageOptions" sort: $ref: "#/components/schemas/FlakyTestsSearchSort" type: object FlakyTestsSearchRequestData: description: The JSON:API data for flaky tests search request. properties: attributes: $ref: "#/components/schemas/FlakyTestsSearchRequestAttributes" type: $ref: "#/components/schemas/FlakyTestsSearchRequestDataType" type: object FlakyTestsSearchRequestDataType: description: The definition of `FlakyTestsSearchRequestDataType` object. enum: - search_flaky_tests_request type: string x-enum-varnames: - SEARCH_FLAKY_TESTS_REQUEST FlakyTestsSearchResponse: description: Response object with flaky tests matching the search request. properties: data: description: Array of flaky tests matching the request. items: $ref: "#/components/schemas/FlakyTest" type: array meta: $ref: "#/components/schemas/FlakyTestsSearchResponseMeta" type: object FlakyTestsSearchResponseMeta: description: Metadata for the flaky tests search response. properties: pagination: $ref: "#/components/schemas/FlakyTestsPagination" type: object FlakyTestsSearchSort: description: Parameter for sorting flaky test results. The default sort is by ascending Fully Qualified Name (FQN). The FQN is the concatenation of the test module, suite, and name. enum: - fqn - -fqn - first_flaked - -first_flaked - last_flaked - -last_flaked - failure_rate - -failure_rate - pipelines_failed - -pipelines_failed - pipelines_duration_lost - -pipelines_duration_lost example: failure_rate type: string x-enum-varnames: - FQN_ASCENDING - FQN_DESCENDING - FIRST_FLAKED_ASCENDING - FIRST_FLAKED_DESCENDING - LAST_FLAKED_ASCENDING - LAST_FLAKED_DESCENDING - FAILURE_RATE_ASCENDING - FAILURE_RATE_DESCENDING - PIPELINES_FAILED_ASCENDING - PIPELINES_FAILED_DESCENDING - PIPELINES_DURATION_LOST_ASCENDING - PIPELINES_DURATION_LOST_DESCENDING FleetAgentAttributesTagsItems: description: A key-value pair representing a tag associated with a Datadog Agent. properties: key: description: The tag key. type: string value: description: The tag value. type: string type: object FleetAgentConfigurationFilesV2: description: Configuration details for an agent, organized by configuration layer. properties: agent_configuration: $ref: "#/components/schemas/FleetConfigurationLayer" application_monitoring_configuration: $ref: "#/components/schemas/FleetConfigurationLayer" otel_collectors_configuration: description: >- Configuration for OpenTelemetry collectors associated with the agent. Present only when the agent has associated OpenTelemetry collectors. items: $ref: "#/components/schemas/FleetOtelCollectorConfigurationV2" type: array security_agent_configuration: $ref: "#/components/schemas/FleetConfigurationLayer" system_probe_configuration: $ref: "#/components/schemas/FleetConfigurationLayer" type: object FleetAgentDetailV2: description: Detailed information about a specific Datadog Agent. properties: attributes: $ref: "#/components/schemas/FleetAgentDetailV2Attributes" id: description: The unique agent key identifier. example: "a1b2c3d4e5f67890a1b2c3d4e5f67890" type: string type: $ref: "#/components/schemas/FleetAgentV2ResourceType" required: - id - type - attributes type: object FleetAgentDetailV2Attributes: description: Attributes for the v2 agent detail response. properties: agent_infos: $ref: "#/components/schemas/FleetAgentInfoDetailsV2" configuration_files: $ref: "#/components/schemas/FleetAgentConfigurationFilesV2" description: Configuration file details, present only when `configuration_files` is included in the `include` query parameter. integrations: $ref: "#/components/schemas/FleetIntegrationsByStatusV2" description: Integration details, present only when `integrations` is included in the `include` query parameter. required: - agent_infos type: object FleetAgentDetailV2Response: description: Response containing detailed information about a specific Datadog Agent. properties: data: $ref: "#/components/schemas/FleetAgentDetailV2" required: - data type: object FleetAgentInfoDetailsV2: description: Detailed information about a Datadog Agent. properties: active_ha_agent: description: The currently active agent in the high-availability group. type: string agent_version: description: The Datadog Agent version. example: "7.50.0" type: string api_key_name: description: The API key name (if available and not redacted). example: "Production API Key" type: string api_key_uuid: description: The API key UUID. example: "a1b2c3d4-e5f6-4321-a123-123456789abc" type: string cloud_provider: description: The cloud provider where the agent is running. example: "aws" type: string cluster_name: description: Kubernetes cluster name (if applicable). type: string config_id: description: The configuration identifier applied to the agent. type: string datadog_agent_key: description: The unique agent key identifier. example: "a1b2c3d4e5f67890a1b2c3d4e5f67890" type: string datadog_data_center: description: The Datadog data center the agent reports to. example: "us1" type: string ecs_fargate_cluster_name: description: The ECS Fargate cluster name, if the agent runs in an ECS Fargate environment. example: "my-ecs-cluster" type: string ecs_fargate_task_arn: description: The ECS Fargate task ARN, if the agent runs in an ECS Fargate environment. example: "arn:aws:ecs:us-east-1:123456789012:task/my-cluster/abc123" type: string enabled_products: description: Datadog products enabled on the agent. items: description: A Datadog product enabled on the agent. type: string type: array env: description: Environments the agent is reporting from. items: description: An environment name the agent is reporting from. type: string type: array first_seen_at: description: Timestamp when the agent was first seen. format: int64 type: integer ha_agent_hosts: description: Hosts participating in the agent's high-availability group. items: description: A hostname participating in the high-availability group. type: string type: array ha_agent_state: description: The high-availability state of the agent. type: string hostname: description: The hostname of the agent. example: "my-hostname" type: string hostname_aliases: description: Alternative hostname list for the agent. items: description: An alternative hostname alias for the agent. type: string type: array install_method_installer_version: description: The version of the installer used. example: "1.2.3" type: string install_method_tool: description: The tool used to install the agent. example: "chef" type: string ip_addresses: description: IP addresses of the agent. items: description: An IP address of the agent. type: string type: array is_single_step_instrumentation_enabled: description: Whether single-step instrumentation is enabled. type: boolean last_restart_at: description: Timestamp of the last agent restart. format: int64 type: integer os: description: The operating system. example: "linux" type: string os_version: description: The operating system version. example: "Ubuntu 20.04" type: string otel_collectors: description: OpenTelemetry collectors associated with the agent (if applicable). items: $ref: "#/components/schemas/FleetOtelCollector" type: array pod_name: description: Kubernetes pod name (if applicable). type: string preferred_ha_active_agent: description: The preferred active agent in the high-availability group. type: string python_version: description: The Python version used by the agent. example: "3.9.5" type: string region: description: Regions where the agent is running. items: description: A region where the agent is running. type: string type: array remote_agent_management: description: Remote agent management status. example: "enabled" type: string remote_config_status: description: Remote configuration status. example: "connected" type: string services: description: Services running on the agent. items: description: A service name running on the agent. type: string type: array support_agent_upgrade: description: Whether the agent supports remote agent upgrade. type: boolean tags: description: Tags associated with the agent. items: description: A tag string assigned to the agent. type: string type: array team: description: Team associated with the agent. type: string type: object FleetAgentV2: description: A Datadog Agent resource in the v2 list response. properties: attributes: $ref: "#/components/schemas/FleetAgentV2Attributes" id: description: The unique agent key identifier. example: "my-agent-hostname" type: string type: $ref: "#/components/schemas/FleetAgentV2ResourceType" required: - id - type - attributes type: object FleetAgentV2Attributes: description: Attributes of a Datadog Agent in the v2 list response. properties: agent_version: description: The Datadog Agent version. example: "7.50.0" type: string api_key_name: description: The name of the API key used by the agent, if available and not redacted. example: "Production API Key" type: string api_key_uuid: description: The UUID of the API key used by the agent. example: "a1b2c3d4-e5f6-4321-a123-123456789abc" type: string cloud_provider: description: The cloud provider where the agent is running. example: "aws" type: string cluster_name: description: The Kubernetes cluster name, if the agent runs in a cluster. example: "production-us-east-1" type: string datadog_data_center: description: The Datadog data center the agent reports to. example: "us1" type: string ecs_fargate_cluster_name: description: The ECS Fargate cluster name, if the agent runs in an ECS Fargate environment. example: "my-ecs-cluster" type: string ecs_fargate_task_arn: description: The ECS Fargate task ARN, if the agent runs in an ECS Fargate environment. example: "arn:aws:ecs:us-east-1:123456789012:task/my-cluster/abc123" type: string enabled_products: description: Datadog products enabled on the agent. items: description: A Datadog product enabled on the agent. type: string type: array env: description: Environments the agent is reporting from. items: description: An environment name the agent is reporting from. type: string type: array first_seen_at: description: Unix timestamp when the agent was first seen. example: 1699900000 format: int64 type: integer fleet_policies: description: Identifiers of fleet policies applied to the agent. items: description: A fleet policy identifier applied to the agent. type: string type: array hostname: description: The hostname of the agent. example: "my-hostname" type: string instrumentation_error_counts: description: >- Number of instrumentation errors on the agent. Absent from the response when the count is zero. example: 3 format: int64 type: integer instrumentation_status: $ref: "#/components/schemas/FleetAgentV2AttributesInstrumentationStatus" integrations: description: Names of integrations configured on the agent. items: description: An integration name configured on the agent. type: string type: array ip_addresses: description: IP addresses of the agent host. items: description: An IP address of the agent host. type: string type: array is_single_step_instrumentation_enabled: description: Whether single-step instrumentation is enabled on the agent. example: true type: boolean last_restart_at: description: Unix timestamp of the last agent restart. example: 1699999999 format: int64 type: integer os: description: The operating system of the host. example: "linux" type: string otel_collector_deployment_types: description: OpenTelemetry collector deployment types associated with the agent. items: description: An OpenTelemetry collector deployment type. type: string type: array otel_collector_distributions: description: OpenTelemetry collector distributions associated with the agent. items: description: An OpenTelemetry collector distribution. type: string type: array otel_collector_versions: description: All OpenTelemetry collector versions associated with the agent. items: description: An OpenTelemetry collector version string. type: string type: array otel_resource_attributes: description: OpenTelemetry resource attributes reported by the agent. items: description: An OpenTelemetry resource attribute. type: string type: array pod_name: description: The Kubernetes pod name, if the agent runs as a pod. example: "datadog-agent-abc123" type: string remote_agent_management: description: The remote agent management status. example: "enabled" type: string remote_config_status: description: The remote configuration connection status of the agent. example: "connected" type: string services: description: Services running on the agent. items: description: A service name running on the agent. type: string type: array tags: description: >- Tags associated with the agent. Returned as an empty array when the agent has no tags. items: $ref: "#/components/schemas/FleetAgentAttributesTagsItems" type: array team: description: The team associated with the agent. example: "platform" type: string type: object FleetAgentV2AttributesInstrumentationStatus: description: The single-step instrumentation status of the Agent. enum: - success - failure example: "success" type: string x-enum-varnames: - SUCCESS - FAILURE FleetAgentV2ResourceType: default: agent description: The type of the agent resource. enum: - agent example: agent type: string x-enum-varnames: - AGENT FleetAgentVersionV2: description: An available Datadog Agent version resource. properties: attributes: $ref: "#/components/schemas/FleetAgentVersionV2Attributes" id: description: The agent version string used as the unique identifier. example: "7.81.1" type: string type: $ref: "#/components/schemas/FleetAgentVersionV2ResourceType" required: - id - type - attributes type: object FleetAgentVersionV2Attributes: description: Attributes of an available Datadog Agent version. properties: version: description: The agent version string. example: "7.81.1" type: string type: object FleetAgentVersionV2ResourceType: default: agent_version description: The type of the agent version resource. enum: - agent_version example: agent_version type: string x-enum-varnames: - AGENT_VERSION FleetAgentVersionsV2Page: description: Pagination details for the v2 list of agent versions. properties: total_count: description: Total number of available agent versions. example: 10 format: int64 type: integer type: object FleetAgentVersionsV2Response: description: Response containing a list of available Datadog Agent versions. properties: data: description: Array of available agent versions. items: $ref: "#/components/schemas/FleetAgentVersionV2" type: array meta: $ref: "#/components/schemas/FleetAgentVersionsV2ResponseMeta" required: - data type: object FleetAgentVersionsV2ResponseMeta: description: Metadata for the v2 list of agent versions. properties: page: $ref: "#/components/schemas/FleetAgentVersionsV2Page" type: object FleetAgentsV2Page: description: Pagination details for the v2 list of agents. properties: total_count: description: Total number of agents in the fleet, regardless of any filter. example: 500 format: int64 type: integer total_filtered_count: description: Total number of agents matching the current filter criteria. example: 42 format: int64 type: integer type: object FleetAgentsV2Response: description: Response containing a paginated list of Datadog Agents. properties: data: description: Array of agents matching the query criteria. items: $ref: "#/components/schemas/FleetAgentV2" type: array meta: $ref: "#/components/schemas/FleetAgentsV2ResponseMeta" required: - data type: object FleetAgentsV2ResponseMeta: description: Metadata for the v2 list of agents, including pagination information. properties: page: $ref: "#/components/schemas/FleetAgentsV2Page" type: object FleetConfigurationFileV2: description: A configuration file for an integration. properties: agent_hash: description: Hash of the configuration file as seen by the agent. type: string file_content: description: The raw content of the configuration file. type: string file_path: description: Path to the configuration file. example: "/conf.d/postgres.d/postgres.yaml" type: string filename: description: Name of the configuration file. example: "postgres.yaml" type: string type: object FleetConfigurationLayer: description: Configuration information organized by layers. properties: compiled_configuration: description: The final compiled configuration. type: string env_configuration: description: Configuration from environment variables. type: string file_configuration: description: Configuration from files. type: string remote_configuration: description: Remote configuration settings. type: string runtime_configuration: description: Runtime configuration. type: string type: object FleetDeployment: description: A deployment that defines automated configuration changes for a fleet of hosts. properties: attributes: $ref: "#/components/schemas/FleetDeploymentAttributes" id: description: Unique identifier for the deployment. example: "aeadc05e-98a8-11ec-ac2c-da7ad0900001" type: string type: $ref: "#/components/schemas/FleetDeploymentResourceType" required: - id - type - attributes type: object FleetDeploymentAttributes: description: Attributes of a deployment in the response. properties: config_operations: description: Ordered list of configuration file operations to perform on the target hosts. items: $ref: "#/components/schemas/FleetDeploymentOperation" type: array estimated_end_time_unix: description: Estimated completion time of the deployment as a Unix timestamp (seconds since epoch). example: 1699999999 format: int64 type: integer filter_query: description: Query used to filter and select target hosts for the deployment. Uses the Datadog query syntax. example: "env:prod AND service:web" type: string high_level_status: description: |- Current high-level status of the deployment (for example, "pending", "running", "completed", "failed"). example: "pending" type: string hosts: description: |- Paginated list of hosts in this deployment with their individual statuses. Only included when fetching a single deployment by ID. Use the `limit` and `page` query parameters to navigate through pages. Pagination metadata is included in the response `meta.hosts` field. items: $ref: "#/components/schemas/FleetDeploymentHost" type: array packages: description: List of packages to deploy to target hosts. Present only for package upgrade deployments. items: $ref: "#/components/schemas/FleetDeploymentPackage" type: array total_hosts: description: Total number of hosts targeted by this deployment. example: 42 format: int64 type: integer type: object FleetDeploymentConfigureV2Attributes: description: Attributes for creating a new v2 configuration deployment. properties: config_operations: description: Ordered list of configuration file operations to perform on the target hosts. items: $ref: "#/components/schemas/FleetDeploymentOperation" type: array dry_run: description: |- Set to `true` to validate the configuration and resolve target hosts and packages without deploying anything. Returns a 200 with the validation result instead of creating and starting a real deployment. example: false type: boolean filter_query: description: Query used to filter and select target hosts for the deployment. Uses the Datadog query syntax. example: "env:prod AND service:web" type: string target_packages: description: |- List of packages and their target versions to additionally deploy alongside the configuration change. items: $ref: "#/components/schemas/FleetDeploymentConfigureV2Package" type: array required: - filter_query - config_operations type: object FleetDeploymentConfigureV2Create: description: Data for creating a new v2 configuration deployment. properties: attributes: $ref: "#/components/schemas/FleetDeploymentConfigureV2Attributes" type: $ref: "#/components/schemas/FleetDeploymentResourceType" required: - type - attributes type: object FleetDeploymentConfigureV2CreateRequest: description: Request payload for creating a new v2 configuration deployment. properties: data: $ref: "#/components/schemas/FleetDeploymentConfigureV2Create" required: - data type: object FleetDeploymentConfigureV2DryRun: description: The result of a configuration deployment dry run. properties: attributes: $ref: "#/components/schemas/FleetDeploymentConfigureV2DryRunAttributes" id: description: |- Always `"dry-run"` for a dry-run response. Does not identify a real deployment and cannot be used to fetch a deployment by ID. example: "dry-run" type: string type: $ref: "#/components/schemas/FleetDeploymentResourceType" required: - id - type - attributes type: object FleetDeploymentConfigureV2DryRunAttributes: description: Attributes of a configuration deployment dry-run response. properties: dry_run: $ref: "#/components/schemas/FleetDeploymentConfigureV2DryRunResult" query: description: Query used to filter and select target hosts for the deployment. example: "env:prod AND service:web" type: string total_hosts: description: Total number of hosts targeted by this deployment. example: 42 format: int64 type: integer type: object FleetDeploymentConfigureV2DryRunResponse: description: Response containing the result of a configuration deployment dry run. properties: data: $ref: "#/components/schemas/FleetDeploymentConfigureV2DryRun" required: - data type: object FleetDeploymentConfigureV2DryRunResult: description: Validation result of a configuration deployment dry run. properties: config_validated: description: Whether the configuration passed schema validation. example: true type: boolean non_upgradable_by_reason: additionalProperties: format: int64 type: integer description: |- Breakdown of ineligible host counts by reason. Only includes reasons with a non-zero count. Absent from the response when no targeted host is ineligible. example: {} type: object non_upgradable_hosts: description: Number of targeted hosts that are not eligible to receive this configuration. example: 0 format: int64 type: integer type: object FleetDeploymentConfigureV2Package: description: A package and its target version to additionally deploy alongside a configuration change. properties: apm_instrumentation: description: APM auto-instrumentation mode to enable for this package, if applicable. example: "host" type: string name: description: The name of the package to deploy. example: "datadog-agent" type: string version: description: The target version of the package to deploy. example: "7.52.0" type: string required: - name - version type: object FleetDeploymentFileOp: description: |- Type of file operation to perform on the target configuration file. - `merge-patch`: Merges the provided patch data with the existing configuration file. Creates the file if it doesn't exist. - `delete`: Removes the specified configuration file from the target hosts. enum: - "merge-patch" - "delete" example: "merge-patch" type: string x-enum-varnames: - MERGE_PATCH - DELETE FleetDeploymentHost: description: A host that is part of a deployment with its current status. properties: error: description: Error message if the deployment failed on this host. example: "" type: string hostname: description: The hostname of the agent. example: "web-server-01.example.com" type: string status: description: Current deployment status for this specific host. example: "succeeded" type: string versions: description: List of packages and their versions currently installed on this host. items: $ref: "#/components/schemas/FleetDeploymentHostPackage" type: array type: object FleetDeploymentHostPackage: description: |- Package version information for a host, showing the initial version before deployment, the target version to deploy, and the current version on the host. properties: current_version: description: The current version of the package on the host. example: "7.51.0" type: string initial_version: description: The initial version of the package on the host before the deployment started. example: "7.51.0" type: string package_name: description: The name of the package. example: "datadog-agent" type: string target_version: description: The target version that the deployment is attempting to install. example: "7.52.0" type: string type: object FleetDeploymentHostsPage: description: Pagination details for the list of hosts in a deployment. properties: current_page: description: Current page index (zero-based). example: 0 format: int64 type: integer page_size: description: Number of hosts returned per page. example: 50 format: int64 type: integer total_hosts: description: Total number of hosts in this deployment. example: 150 format: int64 type: integer total_pages: description: Total number of pages available. example: 3 format: int64 type: integer type: object FleetDeploymentOperation: description: A single configuration file operation to perform on the target hosts. properties: file_op: $ref: "#/components/schemas/FleetDeploymentFileOp" file_path: description: Absolute path to the target configuration file on the host. example: "/datadog.yaml" type: string patch: additionalProperties: {} description: |- Patch data in JSON format to apply to the configuration file. When using `merge-patch`, this object is merged with the existing configuration, allowing you to add, update, or override specific fields without replacing the entire file. The structure must match the target configuration file format (for example, YAML structure for Datadog Agent config). Not applicable when using the `delete` operation. example: apm_config: enabled: true log_level: "debug" logs_enabled: true type: object required: - file_op - file_path type: object FleetDeploymentPackage: description: A package and its target version for deployment. properties: name: description: The name of the package to deploy. example: "datadog-agent" type: string version: description: The target version of the package to deploy. example: "7.52.0" type: string required: - name - version type: object FleetDeploymentPackageUpgradeV2Attributes: description: Attributes for creating a new v2 package upgrade deployment. properties: filter_query: description: Query used to filter and select target hosts for the deployment. Uses the Datadog query syntax. example: "env:prod AND service:web" type: string target_packages: description: List of packages and their target versions to deploy to the selected hosts. items: $ref: "#/components/schemas/FleetDeploymentPackage" type: array required: - filter_query - target_packages type: object FleetDeploymentPackageUpgradeV2Create: description: Data for creating a new v2 package upgrade deployment. properties: attributes: $ref: "#/components/schemas/FleetDeploymentPackageUpgradeV2Attributes" type: $ref: "#/components/schemas/FleetDeploymentResourceType" required: - type - attributes type: object FleetDeploymentPackageUpgradeV2CreateRequest: description: Request payload for creating a new v2 package upgrade deployment. properties: data: $ref: "#/components/schemas/FleetDeploymentPackageUpgradeV2Create" required: - data type: object FleetDeploymentResourceType: default: deployment description: The type of deployment resource. enum: - deployment example: deployment type: string x-enum-varnames: - DEPLOYMENT FleetDeploymentResponse: description: Response containing a single deployment. properties: data: $ref: "#/components/schemas/FleetDeployment" meta: $ref: "#/components/schemas/FleetDeploymentResponseMeta" type: object FleetDeploymentResponseMeta: description: Metadata for a single deployment response, including pagination information for hosts. properties: hosts: $ref: "#/components/schemas/FleetDeploymentHostsPage" type: object FleetDeploymentV2: description: A deployment in the v2 API response. properties: attributes: $ref: "#/components/schemas/FleetDeploymentV2Attributes" id: description: Unique identifier for the deployment. example: "k7Q-3mX-p9Z" type: string type: $ref: "#/components/schemas/FleetDeploymentResourceType" required: - id - type - attributes type: object FleetDeploymentV2Attributes: description: Attributes of a deployment in the v2 API response. properties: author: description: Handle of the user who triggered the deployment. example: "alice@datadoghq.com" type: string config_operations: description: |- Ordered list of configuration file operations applied by this deployment. Absent for package deployments, which have no configuration file operations. items: $ref: "#/components/schemas/FleetDeploymentOperation" type: array duration_seconds: description: |- Duration of the deployment in seconds, computed as `finished_at - started_at`. Zero if the deployment has not finished. example: 1000 format: int64 type: integer error_summary: description: Top-level error message for the deployment. Populated only when the deployment has failed. example: "A host failed to update" type: string estimated_finished_at: description: Estimated completion time of the deployment as a Unix timestamp. Zero if not available. example: 1699999999 format: int64 type: integer finished_at: description: Time the deployment finished as a Unix timestamp. Zero if not yet finished. example: 0 format: int64 type: integer is_scheduled: description: Whether this deployment was triggered by a schedule (`schedule_id` is non-empty). example: true type: boolean query: description: Query used to filter and select target hosts for the deployment. example: "env:prod AND service:web" type: string schedule_id: description: Identifier of the schedule that triggered this deployment. Empty if triggered manually. example: "sched-123" type: string started_at: description: Time the deployment started as a Unix timestamp. Zero if not yet started. example: 1699990000 format: int64 type: integer status: description: |- Current high-level status of the deployment (for example, "pending", "running", "completed", "failed"). example: "pending" type: string target_versions: description: Package versions targeted by this deployment. example: ["7.52.0"] items: type: string type: array total_hosts: description: Total number of hosts targeted by this deployment. example: 42 format: int64 type: integer update_type: description: |- Type of update operation performed by this deployment (for example, "update_config_operations", "update_package"). example: "update_config_operations" type: string type: object FleetDeploymentV2Cancel: description: A deployment cancellation response. properties: attributes: $ref: "#/components/schemas/FleetDeploymentV2CancelAttributes" id: description: Unique identifier for the deployment. example: "k7Q-3mX-p9Z" type: string type: $ref: "#/components/schemas/FleetDeploymentResourceType" required: - id - type - attributes type: object FleetDeploymentV2CancelAttributes: description: Attributes of a deployment cancellation response. properties: message: description: Human-readable message describing the outcome of the cancellation request. example: "Cancellation has been requested; the deployment is stopping." type: string status: description: Status of the deployment after the cancellation request. example: "stopping" type: string type: object FleetDeploymentV2CancelResponse: description: Response containing the result of a deployment cancellation request. properties: data: $ref: "#/components/schemas/FleetDeploymentV2Cancel" required: - data type: object FleetDeploymentV2CreateResponse: description: Response containing the newly created deployment. properties: data: $ref: "#/components/schemas/FleetDeploymentV2" required: - data type: object FleetDeploymentV2Detail: description: Detailed information about a deployment. properties: attributes: $ref: "#/components/schemas/FleetDeploymentV2DetailAttributes" id: description: Unique identifier for the deployment. example: "k7Q-3mX-p9Z" type: string type: $ref: "#/components/schemas/FleetDeploymentResourceType" required: - id - type - attributes type: object FleetDeploymentV2DetailAgent: description: Per-host status entry for a deployment. properties: error: description: Error message if the deployment failed on this host. example: "" type: string hostname: description: Hostname of the agent. example: "web-01.example.com" type: string running_step: description: Name of the step currently executing on this host. example: "applying_config" type: string status: description: Deployment status for this host (for example, "pending", "running", "succeeded", "failed"). example: "running" type: string status_details: description: Additional details about the current deployment status on this host. example: "step 2/3" type: string versions: description: Package version details for this host. items: $ref: "#/components/schemas/FleetDeploymentHostPackage" type: array type: object FleetDeploymentV2DetailAttributes: description: Attributes of a deployment detail response. properties: author: description: Handle of the user who triggered the deployment. example: "carol@datadoghq.com" type: string canceled_hosts: description: Number of hosts on which the deployment was canceled. example: 1 format: int64 minimum: 0 type: integer config_operations: description: |- Ordered list of configuration file operations applied by this deployment. Absent for package deployments, which have no configuration file operations. items: $ref: "#/components/schemas/FleetDeploymentOperation" type: array duration_seconds: description: |- Duration of the deployment in seconds, computed as `finished_at - started_at`. Zero if the deployment has not finished. example: 3600 format: int64 type: integer error_summary: description: Top-level error message for the deployment. Populated only when the deployment has failed. example: "A host failed to update" type: string estimated_finished_at: description: Estimated completion time of the deployment as a Unix timestamp. Zero if not available. example: 1699999999 format: int64 type: integer failed_hosts: description: Number of hosts on which the deployment failed. example: 1 format: int64 minimum: 0 type: integer high_level_status: description: |- Current high-level status of the deployment (for example, "pending", "running", "completed", "failed"). example: "running" type: string hosts: description: Per-host status list for this deployment. items: $ref: "#/components/schemas/FleetDeploymentV2DetailAgent" type: array is_scheduled: description: Whether this deployment was triggered by a schedule (`schedule_id` is non-empty). example: true type: boolean query: description: Query used to filter and select target hosts for the deployment. example: "env:prod AND service:web" type: string running_hosts: description: Number of hosts on which the deployment is currently running. example: 1 format: int64 minimum: 0 type: integer schedule_id: description: Identifier of the schedule that triggered this deployment. Empty if triggered manually. example: "sched-789" type: string skipped_hosts: description: Number of hosts that were skipped during the deployment. example: 1 format: int64 minimum: 0 type: integer succeeded_hosts: description: Number of hosts on which the deployment succeeded. example: 1 format: int64 minimum: 0 type: integer target_versions: description: Distinct package versions targeted by this deployment, in first-seen order. example: ["7.52.0"] items: type: string type: array total_hosts: description: Total number of hosts targeted by this deployment. example: 42 format: int64 type: integer update_type: description: |- Type of update operation performed by this deployment (for example, "update_config_operations", "update_package"). example: "update_config_operations" type: string type: object FleetDeploymentV2DetailResponse: description: Response containing detailed information about a single deployment. properties: data: $ref: "#/components/schemas/FleetDeploymentV2Detail" required: - data type: object FleetDeploymentsV2Page: description: Pagination details for the v2 list of deployments. properties: total_count: description: Total number of deployments available across all pages. example: 25 format: int64 type: integer total_filtered_count: description: Total number of deployments matching the current filter query. example: 10 format: int64 type: integer type: object FleetDeploymentsV2Response: description: Response containing a paginated list of deployments. properties: data: description: Array of deployments matching the query criteria. items: $ref: "#/components/schemas/FleetDeploymentV2" type: array meta: $ref: "#/components/schemas/FleetDeploymentsV2ResponseMeta" required: - data type: object FleetDeploymentsV2ResponseMeta: description: Metadata for the v2 list of deployments, including pagination information. properties: page: $ref: "#/components/schemas/FleetDeploymentsV2Page" type: object FleetDetectedIntegration: description: An integration detected on the agent but not necessarily configured. properties: escaped_name: description: Escaped integration name. example: "postgresql" type: string prefix: description: Integration prefix identifier. example: "postgres" type: string type: object FleetIntegrationDetailsV2: description: Detailed information about a single integration. properties: data_type: description: Type of data collected, such as metrics or logs. example: "metrics" type: string error_messages: description: Error messages if the integration has issues. items: description: An error message describing an issue with the integration. type: string type: array init_config: description: Initialization configuration (YAML format). type: string instance_config: description: Instance-specific configuration (YAML format). type: string is_custom_check: description: Whether this is a custom integration. type: boolean is_default: description: Whether this is a default integration instance. type: boolean is_init: description: Whether this integration configuration is an init config. type: boolean log_config: description: Log collection configuration (YAML format). type: string name: description: Name of the integration instance. type: string pod_count: description: >- Number of pods running this integration. Absent from the response when the count is zero. format: int64 type: integer source_index: description: Index in the configuration file. format: int64 type: integer source_path: description: Path to the configuration file. type: string type: description: Integration type. example: "postgres" type: string type: object FleetIntegrationsByStatusV2: description: Integrations organized by their status. properties: configuration_files: description: Configuration files for integrations. items: $ref: "#/components/schemas/FleetConfigurationFileV2" type: array error_integrations: description: Integrations with errors. items: $ref: "#/components/schemas/FleetIntegrationDetailsV2" type: array missing_integrations: description: Detected but not configured integrations. items: $ref: "#/components/schemas/FleetDetectedIntegration" type: array warning_integrations: description: Integrations with warnings. items: $ref: "#/components/schemas/FleetIntegrationDetailsV2" type: array working_integrations: description: Integrations that are working correctly. items: $ref: "#/components/schemas/FleetIntegrationDetailsV2" type: array type: object FleetOtelCollector: additionalProperties: {} description: OpenTelemetry collector information. type: object FleetOtelCollectorConfigurationV2: description: Configuration for a single OpenTelemetry collector associated with the agent. properties: collector_id: description: The unique identifier of the OpenTelemetry collector. type: string compiled_configuration: description: The final compiled configuration of the OpenTelemetry collector. type: string distribution: description: The distribution of the OpenTelemetry collector. type: string type: object FleetSchedule: description: A schedule that automatically creates deployments based on a recurrence rule. properties: attributes: $ref: "#/components/schemas/FleetScheduleAttributes" id: description: Unique identifier for the schedule. example: "abc-def-ghi-123" type: string type: $ref: "#/components/schemas/FleetScheduleResourceType" required: - id - type - attributes type: object FleetScheduleAttributes: description: Attributes of a schedule in the response. properties: created_at_unix: description: Unix timestamp (seconds since epoch) when the schedule was created. example: 1699999999 format: int64 type: integer created_by: description: User handle of the person who created the schedule. example: "user@example.com" type: string name: description: Human-readable name for the schedule. example: "Weekly Production Agent Updates" type: string query: description: Query used to filter and select target hosts for scheduled deployments. Uses the Datadog query syntax. example: "env:prod AND service:web" type: string rule: $ref: "#/components/schemas/FleetScheduleRecurrenceRule" status: $ref: "#/components/schemas/FleetScheduleStatus" updated_at_unix: description: Unix timestamp (seconds since epoch) when the schedule was last updated. example: 1699999999 format: int64 type: integer updated_by: description: User handle of the person who last updated the schedule. example: "user@example.com" type: string version_to_latest: description: |- Number of major versions behind the latest to target for upgrades. - 0: Always upgrade to the latest version - 1: Upgrade to latest minus 1 major version - 2: Upgrade to latest minus 2 major versions Maximum value is 2. example: 0 format: int64 maximum: 2 minimum: 0 type: integer type: object FleetScheduleCreate: description: Data for creating a new schedule. properties: attributes: $ref: "#/components/schemas/FleetScheduleCreateAttributes" type: $ref: "#/components/schemas/FleetScheduleResourceType" required: - type - attributes type: object FleetScheduleCreateAttributes: description: Attributes for creating a new schedule. properties: name: description: Human-readable name for the schedule. example: "Weekly Production Agent Updates" type: string query: description: Query used to filter and select target hosts for scheduled deployments. Uses the Datadog query syntax. example: "env:prod AND service:web" type: string rule: $ref: "#/components/schemas/FleetScheduleRecurrenceRule" status: $ref: "#/components/schemas/FleetScheduleStatus" version_to_latest: description: |- Number of major versions behind the latest to target for upgrades. - 0: Always upgrade to the latest version (default) - 1: Upgrade to latest minus 1 major version - 2: Upgrade to latest minus 2 major versions Maximum value is 2. example: 0 format: int64 maximum: 2 minimum: 0 type: integer required: - name - query - rule type: object FleetScheduleCreateRequest: description: Request payload for creating a new schedule. properties: data: $ref: "#/components/schemas/FleetScheduleCreate" required: - data type: object FleetSchedulePatch: description: Data for partially updating a schedule. properties: attributes: $ref: "#/components/schemas/FleetSchedulePatchAttributes" type: $ref: "#/components/schemas/FleetScheduleResourceType" required: - type type: object FleetSchedulePatchAttributes: description: Attributes for partially updating a schedule. All fields are optional. properties: name: description: Human-readable name for the schedule. example: "Weekly Production Agent Updates" type: string query: description: Query used to filter and select target hosts for scheduled deployments. Uses the Datadog query syntax. example: "env:prod AND service:web" type: string rule: $ref: "#/components/schemas/FleetScheduleRecurrenceRule" status: $ref: "#/components/schemas/FleetScheduleStatus" version_to_latest: description: |- Number of major versions behind the latest to target for upgrades. - 0: Always upgrade to the latest version - 1: Upgrade to latest minus 1 major version - 2: Upgrade to latest minus 2 major versions Maximum value is 2. example: 0 format: int64 maximum: 2 minimum: 0 type: integer type: object FleetSchedulePatchRequest: description: Request payload for partially updating a schedule. properties: data: $ref: "#/components/schemas/FleetSchedulePatch" required: - data type: object FleetScheduleRecurrenceRule: description: |- Defines the recurrence pattern for the schedule. Specifies when deployments should be automatically triggered based on maintenance windows. properties: days_of_week: description: |- List of days of the week when the schedule should trigger. Valid values are: "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun". example: ["Mon", "Wed", "Fri"] items: description: A day of the week (for example, "Mon", "Tue"). type: string type: array maintenance_window_duration: description: Duration of the maintenance window in minutes. example: 1200 format: int64 type: integer start_maintenance_window: description: |- Start time of the maintenance window in 24-hour clock format (HH:MM). Deployments will be triggered at this time on the specified days. example: "02:00" type: string timezone: description: Timezone for the schedule in IANA Time Zone Database format (e.g., "America/New_York", "UTC"). example: "America/New_York" type: string required: - days_of_week - start_maintenance_window - maintenance_window_duration - timezone type: object FleetScheduleResourceType: default: schedule description: The type of schedule resource. enum: - schedule example: schedule type: string x-enum-varnames: - SCHEDULE FleetScheduleResponse: description: Response containing a single schedule. properties: data: $ref: "#/components/schemas/FleetSchedule" type: object FleetScheduleStatus: description: |- The status of the schedule. - `active`: The schedule is active and will create deployments according to its recurrence rule. - `inactive`: The schedule is inactive and will not create any deployments. enum: - active - inactive example: active type: string x-enum-varnames: - ACTIVE - INACTIVE FleetScheduleV2: description: A fleet upgrade schedule resource in the v2 API response. properties: attributes: $ref: "#/components/schemas/FleetScheduleV2Attributes" id: description: Unique identifier for the schedule. example: "abc-def-ghi-123" type: string type: $ref: "#/components/schemas/FleetScheduleResourceType" required: - id - type - attributes type: object FleetScheduleV2Attributes: description: Attributes of a fleet schedule in the v2 API response. properties: created_at: description: RFC3339 timestamp when the schedule was created. example: "2023-11-14T22:13:19Z" type: string created_by: description: User handle of the person who created the schedule. example: "user@example.com" type: string is_default: description: Whether this is the default schedule for the organization. example: false type: boolean name: description: Human-readable name for the schedule. example: "Weekly Production Agent Updates" type: string next_run: description: |- RFC3339 timestamp of the next scheduled maintenance window start time. Absent when the next run time cannot be computed. example: "2025-01-06T02:00:00Z" type: string notification_rule: $ref: "#/components/schemas/FleetScheduleV2NotificationRule" query: description: Query used to filter and select target hosts for scheduled deployments. example: "env:prod AND service:web" type: string rule: $ref: "#/components/schemas/FleetScheduleV2RecurrenceRule" status: $ref: "#/components/schemas/FleetScheduleStatus" updated_at: description: RFC3339 timestamp when the schedule was last updated. example: "2023-11-14T22:13:19Z" type: string updated_by: description: User handle of the person who last updated the schedule. example: "user@example.com" type: string version_to_latest: description: |- Number of major versions behind the latest to target for upgrades. - 0: Always upgrade to the latest version. - 1: Upgrade to latest minus 1 major version. - 2: Upgrade to latest minus 2 major versions. example: 0 format: int64 maximum: 2 minimum: 0 type: integer type: object FleetScheduleV2NotificationRule: description: |- Notification configuration attached to a schedule. Included when available. If the notification rule cannot be retrieved, this field is omitted and the schedule is still returned. If the notification rule is retrieved but its handles cannot be resolved, it is still included with an empty `handles` array. properties: handles: description: Notification handles (for example, Slack channels or PagerDuty integrations). items: description: A notification handle. type: string type: array tags: description: Tags associated with the notification rule. items: description: A tag string. type: string type: array type: object FleetScheduleV2RecurrenceRule: description: Defines the recurrence pattern for the schedule. properties: days_of_week: description: |- Days of the week when the schedule triggers. Valid values are "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun". example: ["Mon", "Wed", "Fri"] items: description: A day of the week (for example, "Mon"). type: string type: array interval: description: |- Interval between schedule runs in weeks. 1 means the schedule runs every week on the specified days. Higher values repeat every N weeks. example: 1 format: int64 type: integer maintenance_window_duration: description: Duration of the maintenance window in minutes. example: 120 format: int64 type: integer start_maintenance_window: description: |- Start time of the maintenance window in 24-hour clock format (HHMM). Deployments are triggered at this time on the specified days. example: "0200" type: string timezone: description: Timezone in IANA Time Zone Database format. example: "America/New_York" type: string type: object FleetScheduleV2Response: description: Response containing a single fleet schedule. properties: data: $ref: "#/components/schemas/FleetScheduleV2" required: - data type: object FleetSchedulesV2Page: description: Pagination details for the v2 list of schedules. properties: total_count: description: Total number of schedules returned. example: 5 format: int64 type: integer type: object FleetSchedulesV2Response: description: Response containing a list of fleet schedules. properties: data: description: Array of schedules for the organization. items: $ref: "#/components/schemas/FleetScheduleV2" type: array meta: $ref: "#/components/schemas/FleetSchedulesV2ResponseMeta" required: - data type: object FleetSchedulesV2ResponseMeta: description: Metadata for the v2 list of schedules response. properties: page: $ref: "#/components/schemas/FleetSchedulesV2Page" type: object FleetTracerAttributes: description: Attributes of a fleet tracer representing a service instance reporting telemetry. properties: env: description: The environment the tracer is reporting from. example: "production" type: string hostname: description: The hostname where the tracer is running. example: "my-hostname" type: string language: description: The programming language of the traced application. example: "java" type: string language_version: description: The version of the programming language runtime. example: "17.0.1" type: string remote_config_status: description: The remote configuration status of the tracer. example: "connected" type: string runtime_ids: description: Runtime identifiers for the tracer instances. items: description: A runtime identifier for a tracer instance. type: string type: array service: description: The telemetry-derived service name reported by the tracer. example: "inventory-service" type: string service_hostname: description: The service hostname reported by the tracer. example: "my-service-host" type: string service_version: description: The version of the traced service. example: "2.1.0" type: string tracer_version: description: The version of the Datadog tracer library. example: "1.32.0" type: string type: object FleetTracersResponse: description: Response containing a paginated list of fleet tracers. properties: data: $ref: "#/components/schemas/FleetTracersResponseData" meta: $ref: "#/components/schemas/FleetTracersResponseMeta" required: - data type: object FleetTracersResponseData: description: The response data containing status and tracers array. properties: attributes: $ref: "#/components/schemas/FleetTracersResponseDataAttributes" id: description: Status identifier. example: "done" type: string type: description: Resource type. example: "status" type: string required: - id - type - attributes type: object FleetTracersResponseDataAttributes: description: Attributes of the fleet tracers response containing the list of tracers. properties: tracers: description: Array of tracers matching the query criteria. items: $ref: "#/components/schemas/FleetTracerAttributes" type: array type: object FleetTracersResponseMeta: description: Metadata for the list of tracers response. properties: total_filtered_count: description: Total number of tracers matching the filter criteria across all pages. example: 42 format: int64 type: integer type: object FlutterSourcemapAttributes: description: Attributes of a Flutter symbol file. properties: arch: description: The target CPU architecture. example: arm64 type: string created_at: description: The timestamp when the symbol file was created. example: "2024-01-01T00:00:00Z" format: date-time type: string mapkind: $ref: "#/components/schemas/FlutterSourcemapMapKind" service: description: The service name associated with the symbol file. example: my-flutter-app type: string size: description: The size of the symbol file in bytes. example: 8192 format: int64 type: integer variant: description: The build variant. example: release type: string version: description: The version of the service associated with the symbol file. example: 1.0.0 type: string required: - mapkind - size - created_at type: object FlutterSourcemapData: description: Flutter symbol file data object. properties: attributes: $ref: "#/components/schemas/FlutterSourcemapAttributes" id: description: The unique identifier of the source map. example: "12" type: string type: $ref: "#/components/schemas/SourcemapDataType" required: - id - type - attributes type: object FlutterSourcemapMapKind: description: The type of source map. Always `flutter` for Flutter source maps. enum: - flutter example: flutter type: string x-enum-varnames: - FLUTTER FormData: description: A form resource object. properties: attributes: $ref: "#/components/schemas/FormDataAttributes" id: description: The ID of the form. example: 22f6006a-2302-4926-9396-d2dfcf7b0b34 format: uuid type: string type: $ref: "#/components/schemas/FormType" required: - id - type - attributes type: object FormDataAttributes: description: The attributes of a form. properties: active: description: Whether the form is currently active. example: true type: boolean anonymous: description: Whether the form accepts anonymous submissions. example: false type: boolean created_at: description: The time at which the form was created. example: "2026-05-29T20:06:13.677353Z" format: date-time type: string datastore_config: $ref: "#/components/schemas/FormDatastoreConfigAttributes" description: description: The description of the form. example: A form to collect user feedback. type: string end_date: description: The date and time at which the form stops accepting responses. example: format: date-time nullable: true type: string has_submitted: description: Whether the current user has already submitted this form. Only present for forms with `single_response` set to `true`. nullable: true type: boolean idp_survey: description: Whether the form is an IDP survey. example: false type: boolean modified_at: description: The time at which the form was last modified. example: "2026-05-29T20:06:13.677353Z" format: date-time type: string name: description: The name of the form. example: User Feedback Form type: string org_id: description: The ID of the organization that owns this form. example: 2 format: int64 type: integer publication: $ref: "#/components/schemas/FormPublicationAttributes" self_service: description: Whether the form is available in the self-service catalog. example: false type: boolean single_response: description: Whether each user can only submit one response. example: false type: boolean user_id: description: The ID of the user who created this form. example: 10001 format: int64 type: integer user_uuid: description: The UUID of the user who created this form. example: 1fc709aa-be19-4539-a47d-52a30d78a978 format: uuid type: string version: $ref: "#/components/schemas/FormVersionAttributes" required: - active - anonymous - created_at - datastore_config - description - idp_survey - modified_at - name - org_id - self_service - single_response - user_id - user_uuid type: object FormDataDefinition: additionalProperties: {} description: A JSON Schema definition that describes the form's data fields. properties: description: description: A description shown to form respondents. example: Welcome to the Engineering Experience Survey. type: string properties: additionalProperties: {} description: A map of field names to their JSON Schema definitions. type: object required: description: List of field names that must be answered. items: type: string type: array title: description: The title of the form schema. example: Developer Experience Survey type: string type: $ref: "#/components/schemas/FormDataDefinitionType" type: object FormDataDefinitionType: default: object description: The root schema type. enum: - object type: string x-enum-varnames: - OBJECT FormDataList: description: A list of form resource objects. items: $ref: "#/components/schemas/FormData" type: array FormDatastoreConfigAttributes: description: The datastore configuration for a form. properties: datastore_id: description: The ID of the datastore. example: 5108ea24-dd83-4696-9caa-f069f73d0fad format: uuid type: string primary_column_name: description: The name of the primary column in the datastore. example: id type: string primary_key_generation_strategy: description: The strategy used to generate primary keys in the datastore. example: none type: string required: - datastore_id - primary_column_name - primary_key_generation_strategy type: object FormPublicationAttributes: description: The attributes of a form publication. properties: created_at: description: The time at which the publication was created. example: "2026-05-29T20:06:13.677353Z" format: date-time type: string form_id: description: The ID of the form. example: afc67600-0511-43b1-9b18-578fb4979bd3 format: uuid type: string form_version: description: The version number that was published. example: 1 format: int64 type: integer id: description: The ID of the form publication. example: "42" type: string modified_at: description: The time at which the publication was last modified. example: "2026-05-29T20:06:13.677353Z" format: date-time type: string org_id: description: The ID of the organization that owns this publication. example: 2 format: int64 type: integer publish_seq: description: The sequential publication number for this form. example: 1 format: int64 type: integer user_id: description: The ID of the user who created this publication. example: 10001 format: int64 type: integer user_uuid: description: The UUID of the user who created this publication. example: 1fc709aa-be19-4539-a47d-52a30d78a978 format: uuid type: string required: - created_at - form_id - form_version - modified_at - org_id - publish_seq - user_id - user_uuid type: object FormPublicationData: description: A form publication resource object. properties: attributes: $ref: "#/components/schemas/FormPublicationAttributes" id: description: The ID of the form publication. example: "42" type: string type: $ref: "#/components/schemas/FormPublicationType" required: - id - type - attributes type: object FormPublicationResponse: description: A response containing a single form publication. properties: data: $ref: "#/components/schemas/FormPublicationData" required: - data type: object FormPublicationType: default: form_publications description: The resource type for a form publication. enum: - form_publications example: form_publications type: string x-enum-varnames: - FORM_PUBLICATIONS FormResponse: description: A response containing a single form. properties: data: $ref: "#/components/schemas/FormData" required: - data type: object FormTrigger: description: "Trigger a workflow from a Form." properties: formId: description: The form UUID. example: "" type: string type: object FormTriggerWrapper: description: "Schema for a Form-based trigger." properties: formTrigger: $ref: "#/components/schemas/FormTrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - formTrigger type: object FormType: default: forms description: The resource type for a form. enum: - forms example: forms type: string x-enum-varnames: - FORMS FormUiDefinition: additionalProperties: {} description: UI configuration for rendering form fields, including widget overrides, field ordering, and themes. properties: "ui:order": description: The order in which form fields are displayed. items: type: string type: array "ui:theme": $ref: "#/components/schemas/FormUiDefinitionUiTheme" type: object FormUiDefinitionUiTheme: description: The visual theme applied to the form. properties: primaryColor: $ref: "#/components/schemas/FormUiDefinitionUiThemePrimaryColor" type: object FormUiDefinitionUiThemePrimaryColor: description: The primary color of the form theme. enum: - gray - red - orange - yellow - green - light-blue - dark-blue - magenta - indigo type: string x-enum-varnames: - GRAY - RED - ORANGE - YELLOW - GREEN - LIGHT_BLUE - DARK_BLUE - MAGENTA - INDIGO FormUpdateAttributes: description: The fields to update on a form. At least one field must be provided. properties: datastore_config: $ref: "#/components/schemas/FormDatastoreConfigAttributes" description: description: The updated description of the form. example: An updated description. type: string name: description: The updated name of the form. example: Updated Form Name type: string type: object FormVersionAttributes: description: The attributes of a form version. properties: created_at: description: The time at which the version was created. example: "2026-05-29T20:06:14.895921Z" format: date-time type: string data_definition: $ref: "#/components/schemas/FormDataDefinition" definition_signature: description: The signature of the version definition. example: '{"signature":"b7f312957a80cea2c8c9950532b205a90a3f8a7ebb7e52fc25437a25d903d545","version":1}' type: string etag: description: The ETag for optimistic concurrency control. example: b51f08b698d88d8027a935d9db649774949f5fb41a0c559bfee6a9a13225c72d nullable: true type: string id: description: The ID of the form version. example: "126" type: string modified_at: description: The time at which the version was last modified. example: "2026-05-29T20:06:14.949163Z" format: date-time type: string state: $ref: "#/components/schemas/FormVersionState" ui_definition: $ref: "#/components/schemas/FormUiDefinition" user_id: description: The ID of the user who created this version. example: 10001 format: int64 type: integer user_uuid: description: The UUID of the user who created this version. example: 1fc709aa-be19-4539-a47d-52a30d78a978 format: uuid type: string version: description: The sequential version number. example: 1 format: int64 type: integer required: - created_at - data_definition - definition_signature - etag - modified_at - state - ui_definition - user_id - user_uuid - version type: object FormVersionData: description: A form version resource object. properties: attributes: $ref: "#/components/schemas/FormVersionAttributes" id: description: The ID of the form version. example: "126" type: string type: $ref: "#/components/schemas/FormVersionType" required: - id - type - attributes type: object FormVersionResponse: description: A response containing a single form version. properties: data: $ref: "#/components/schemas/FormVersionData" required: - data type: object FormVersionState: description: The state of a form version. enum: - draft - frozen example: frozen type: string x-enum-varnames: - DRAFT - FROZEN FormVersionType: default: form_versions description: The resource type for a form version. enum: - form_versions example: form_versions type: string x-enum-varnames: - FORM_VERSIONS FormsResponse: description: A response containing a list of forms. properties: data: $ref: "#/components/schemas/FormDataList" required: - data type: object FormulaLimit: description: |- Message for specifying limits to the number of values returned by a query. This limit is only for scalar queries and has no effect on timeseries queries. properties: count: description: The number of results to which to limit. example: 10 format: int32 maximum: 2147483647 type: integer order: $ref: "#/components/schemas/QuerySortOrder" type: object FrameworkHandleAndVersionResponseData: description: Contains type and attributes for custom frameworks. properties: attributes: $ref: "#/components/schemas/CustomFrameworkDataHandleAndVersion" id: description: The ID of the custom framework. example: handle-version type: string type: $ref: "#/components/schemas/CustomFrameworkType" required: - id - type - attributes type: object FreshserviceAPIKey: description: The definition of the `FreshserviceAPIKey` object. properties: api_key: $ref: "#/components/schemas/FreshserviceAPIKeyApiKey" domain: $ref: "#/components/schemas/FreshserviceAPIKeyDomain" type: $ref: "#/components/schemas/FreshserviceAPIKeyType" required: - type - domain - api_key type: object FreshserviceAPIKeyApiKey: description: The `FreshserviceAPIKey` `api_key`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" FreshserviceAPIKeyDomain: description: The `FreshserviceAPIKey` `domain`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" FreshserviceAPIKeyType: description: The definition of the `FreshserviceAPIKey` object. enum: - FreshserviceAPIKey example: FreshserviceAPIKey type: string x-enum-varnames: - FRESHSERVICEAPIKEY FreshserviceAPIKeyUpdate: description: The definition of the `FreshserviceAPIKey` object. properties: api_key: $ref: "#/components/schemas/FreshserviceAPIKeyUpdateApiKey" domain: $ref: "#/components/schemas/FreshserviceAPIKeyUpdateDomain" type: $ref: "#/components/schemas/FreshserviceAPIKeyType" required: - type type: object FreshserviceAPIKeyUpdateApiKey: description: The `FreshserviceAPIKeyUpdate` `api_key`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" FreshserviceAPIKeyUpdateDomain: description: The `FreshserviceAPIKeyUpdate` `domain`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" FreshserviceCredentials: description: The definition of the `FreshserviceCredentials` object. oneOf: - $ref: "#/components/schemas/FreshserviceAPIKey" FreshserviceCredentialsUpdate: description: The definition of the `FreshserviceCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/FreshserviceAPIKeyUpdate" FreshserviceIntegration: description: The definition of the `FreshserviceIntegration` object. properties: credentials: $ref: "#/components/schemas/FreshserviceCredentials" type: $ref: "#/components/schemas/FreshserviceIntegrationType" required: - type - credentials type: object FreshserviceIntegrationType: description: The definition of the `FreshserviceIntegrationType` object. enum: - Freshservice example: Freshservice type: string x-enum-varnames: - FRESHSERVICE FreshserviceIntegrationUpdate: description: The definition of the `FreshserviceIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/FreshserviceCredentialsUpdate" type: $ref: "#/components/schemas/FreshserviceIntegrationType" required: - type type: object FullAPIKey: description: Datadog API key. properties: attributes: $ref: "#/components/schemas/FullAPIKeyAttributes" id: description: ID of the API key. type: string relationships: $ref: "#/components/schemas/APIKeyRelationships" type: $ref: "#/components/schemas/APIKeysType" type: object FullAPIKeyAttributes: description: Attributes of a full API key. properties: category: description: The category of the API key. type: string created_at: description: Creation date of the API key. example: "2020-11-23T10:00:00.000Z" format: date-time readOnly: true type: string date_last_used: description: "Date the API Key was last used" example: "2020-11-27T10:00:00.000Z" format: date-time nullable: true readOnly: true type: string key: description: The API key. readOnly: true type: string last4: description: The last four characters of the API key. example: "abcd" maxLength: 4 minLength: 4 readOnly: true type: string modified_at: description: Date the API key was last modified. example: "2020-11-23T10:00:00.000Z" format: date-time readOnly: true type: string name: description: Name of the API key. example: "API Key for submitting metrics" type: string private_action_runner_enroll_enabled: description: Whether the API key can enroll a Private Action Runner. type: boolean remote_config_read_enabled: description: The remote config read enabled status. type: boolean type: object FullApplicationKey: description: Datadog application key. properties: attributes: $ref: "#/components/schemas/FullApplicationKeyAttributes" id: description: ID of the application key. type: string relationships: $ref: "#/components/schemas/ApplicationKeyRelationships" type: $ref: "#/components/schemas/ApplicationKeysType" type: object FullApplicationKeyAttributes: description: Attributes of a full application key. properties: created_at: description: Creation date of the application key. example: "2020-11-23T10:00:00.000Z" format: date-time readOnly: true type: string key: description: The application key. readOnly: true type: string last4: description: The last four characters of the application key. example: "abcd" maxLength: 4 minLength: 4 readOnly: true type: string last_used_at: description: Last usage timestamp of the application key. example: "2020-12-20T10:00:00.000Z" format: date-time nullable: true readOnly: true type: string name: description: Name of the application key. example: "Application Key for managing dashboards" type: string scopes: description: Array of scopes to grant the application key. example: ["dashboards_read", "dashboards_write", "dashboards_public_share"] items: description: Name of scope. type: string nullable: true type: array type: object FullCustomFrameworkData: description: Contains type and attributes for custom frameworks. properties: attributes: $ref: "#/components/schemas/FullCustomFrameworkDataAttributes" id: description: The ID of the custom framework. example: handle-version type: string type: $ref: "#/components/schemas/CustomFrameworkType" required: - id - type - attributes type: object FullCustomFrameworkDataAttributes: description: Full Framework Data Attributes. properties: handle: description: Framework Handle example: sec2 type: string icon_url: description: Framework Icon URL example: https://example.com/icon.png type: string name: description: Framework Name example: security-framework type: string requirements: description: Framework Requirements items: $ref: "#/components/schemas/CustomFrameworkRequirement" type: array version: description: Framework Version example: "2" type: string required: - handle - version - name - requirements type: object FullPersonalAccessToken: description: Datadog access token, including the token key. properties: attributes: $ref: "#/components/schemas/FullPersonalAccessTokenAttributes" id: description: ID of the access token. type: string relationships: $ref: "#/components/schemas/FullPersonalAccessTokenRelationships" type: $ref: "#/components/schemas/PersonalAccessTokensType" type: object FullPersonalAccessTokenAttributes: description: Attributes of a full access token, including the token key. properties: created_at: description: Creation date of the access token. example: "2024-01-01T00:00:00+00:00" format: date-time readOnly: true type: string expires_at: description: Expiration date of the access token. example: "2025-12-31T23:59:59+00:00" format: date-time nullable: true readOnly: true type: string key: description: The access token key. Only returned upon creation. readOnly: true type: string name: description: Name of the access token. example: "My Access Token" type: string public_portion: description: The public portion of the access token. example: "ddpat_abc123" readOnly: true type: string scopes: description: Array of scopes granted to the access token. example: - "dashboards_read" - "dashboards_write" items: description: Name of scope. type: string type: array type: object FullPersonalAccessTokenRelationships: description: Resources related to the access token. properties: owned_by: $ref: "#/components/schemas/RelationshipToUser" type: object FullServiceAccessToken: description: Datadog access token, including the token key. properties: attributes: $ref: "#/components/schemas/FullServiceAccessTokenAttributes" id: description: ID of the access token. type: string relationships: $ref: "#/components/schemas/FullServiceAccessTokenRelationships" type: $ref: "#/components/schemas/ServiceAccessTokensType" type: object FullServiceAccessTokenAttributes: description: Attributes of a full access token, including the token key. properties: created_at: description: Creation date of the access token. example: "2024-01-01T00:00:00+00:00" format: date-time readOnly: true type: string expires_at: description: Expiration date of the access token. example: "2025-12-31T23:59:59+00:00" format: date-time nullable: true readOnly: true type: string key: description: The access token key. Only returned upon creation. readOnly: true type: string name: description: Name of the access token. example: "My Access Token" type: string public_portion: description: The public portion of the access token. example: "ddsat_abc123" readOnly: true type: string scopes: description: Array of scopes granted to the access token. example: - "dashboards_read" - "dashboards_write" items: description: Name of scope. type: string type: array type: object FullServiceAccessTokenRelationships: description: Resources related to the access token. properties: owned_by: $ref: "#/components/schemas/RelationshipToServiceAccount" type: object GCPCredentials: description: The definition of the `GCPCredentials` object. oneOf: - $ref: "#/components/schemas/GCPServiceAccount" GCPCredentialsUpdate: description: The definition of the `GCPCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/GCPServiceAccountUpdate" GCPIntegration: description: The definition of the `GCPIntegration` object. properties: credentials: $ref: "#/components/schemas/GCPCredentials" type: $ref: "#/components/schemas/GCPIntegrationType" required: - type - credentials type: object GCPIntegrationType: description: The definition of the `GCPIntegrationType` object. enum: - GCP example: GCP type: string x-enum-varnames: - GCP GCPIntegrationUpdate: description: The definition of the `GCPIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/GCPCredentialsUpdate" type: $ref: "#/components/schemas/GCPIntegrationType" required: - type type: object GCPMetricNamespaceConfig: description: Configuration for a GCP metric namespace. properties: disabled: default: false description: When disabled, Datadog does not collect metrics that are related to this GCP metric namespace. example: true type: boolean filters: description: |- When enabled, Datadog applies these additional filters to limit metric collection. A metric is collected only if it does not match all exclusion filters and matches at least one allow filter. example: ["snapshot.*", "!*_by_region"] items: description: A metric namespace filter type: string type: array id: description: The id of the GCP metric namespace. example: "pubsub" type: string type: object GCPMonitoredResourceConfig: description: Configuration for a GCP monitored resource. properties: filters: description: |- List of filters to limit the monitored resources that are pulled into Datadog by using tags. Only monitored resources that apply to specified filters are imported into Datadog. example: ["$KEY:$VALUE"] items: description: A monitored resource filter type: string type: array type: $ref: "#/components/schemas/GCPMonitoredResourceConfigType" type: object GCPMonitoredResourceConfigType: description: The GCP monitored resource type. Only a subset of resource types are supported. enum: ["cloud_function", "cloud_run_revision", "gce_instance"] example: "gce_instance" type: string x-enum-varnames: - CLOUD_FUNCTION - CLOUD_RUN_REVISION - GCE_INSTANCE GCPSTSDelegateAccount: description: Datadog principal service account info. properties: attributes: $ref: "#/components/schemas/GCPSTSDelegateAccountAttributes" id: description: The ID of the delegate service account. example: "ddgci-1a19n28hb1a812221893@datadog-gci-sts-us5-prod.iam.gserviceaccount.com" type: string type: $ref: "#/components/schemas/GCPSTSDelegateAccountType" type: object GCPSTSDelegateAccountAttributes: description: Your delegate account attributes. properties: delegate_account_email: description: Your organization's Datadog principal email address. example: "ddgci-1a19n28hb1a812221893@datadog-gci-sts-us5-prod.iam.gserviceaccount.com" type: string type: object GCPSTSDelegateAccountResponse: description: Your delegate service account response data. properties: data: $ref: "#/components/schemas/GCPSTSDelegateAccount" type: object GCPSTSDelegateAccountType: default: gcp_sts_delegate description: The type of account. enum: - gcp_sts_delegate example: gcp_sts_delegate type: string x-enum-varnames: - GCP_STS_DELEGATE GCPSTSServiceAccount: description: Info on your service account. properties: attributes: $ref: "#/components/schemas/GCPSTSServiceAccountAttributes" id: description: Your service account's unique ID. example: "d291291f-12c2-22g4-j290-123456678897" type: string meta: $ref: "#/components/schemas/GCPServiceAccountMeta" type: $ref: "#/components/schemas/GCPServiceAccountType" type: object GCPSTSServiceAccountAttributes: description: Attributes associated with your service account. properties: account_tags: description: Tags to be associated with GCP metrics and service checks from your account. items: description: Account Level Tag type: string type: array automute: description: |- Silence monitors for expected GCE instance shutdowns. type: boolean client_email: description: Your service account email address. example: "datadog-service-account@test-project.iam.gserviceaccount.com" type: string cloud_run_revision_filters: deprecated: true description: |- List of filters to limit the Cloud Run revisions that are pulled into Datadog by using tags. Only Cloud Run revision resources that apply to specified filters are imported into Datadog. **Note:** This field is deprecated. Instead, use `monitored_resource_configs` with `type=cloud_run_revision` example: ["$KEY:$VALUE"] items: description: Cloud Run revision filters type: string type: array host_filters: deprecated: true description: |- List of filters to limit the VM instances that are pulled into Datadog by using tags. Only VM instance resources that apply to specified filters are imported into Datadog. **Note:** This field is deprecated. Instead, use `monitored_resource_configs` with `type=gce_instance` example: ["$KEY:$VALUE"] items: description: VM instance filters type: string type: array is_cspm_enabled: description: |- When enabled, Datadog will activate the Cloud Security Monitoring product for this service account. Note: This requires resource_collection_enabled or is_org_folder_resource_collection_enabled to be set to true. type: boolean is_global_location_enabled: default: true description: When enabled, Datadog collects metrics where location is explicitly stated as "global" or where location information cannot be deduced from GCP labels. example: true type: boolean is_org_folder_resource_collection_enabled: default: false description: |- When enabled, Datadog scans for organization and folder-level resources under the organization the service account belongs to. example: false type: boolean is_per_project_quota_enabled: default: false description: |- When enabled, Datadog applies the `X-Goog-User-Project` header, attributing Google Cloud billing and quota usage to the project being monitored rather than the default service account project. example: true type: boolean is_resource_change_collection_enabled: default: false description: |- When enabled, Datadog scans for all resource change data in your Google Cloud environment. example: true type: boolean is_security_command_center_enabled: default: false description: |- When enabled, Datadog will attempt to collect Security Command Center Findings. Note: This requires additional permissions on the service account. example: true type: boolean metric_namespace_configs: description: Configurations for GCP metric namespaces. example: [{"disabled": true, "id": "aiplatform"}, {"filters": ["snapshot.*", "!*_by_region"], "id": "pubsub"}] items: $ref: "#/components/schemas/GCPMetricNamespaceConfig" type: array monitored_resource_configs: description: Configurations for GCP monitored resources. example: [{"filters": ["$KEY:$VALUE"], "type": "gce_instance"}] items: $ref: "#/components/schemas/GCPMonitoredResourceConfig" type: array region_filter_configs: description: Configurations for GCP location filtering, such as region, multi-region, or zone. Only monitored resources that match the specified regions are imported into Datadog. By default, Datadog collects from all locations. example: ["nam4", "europe-north1"] items: description: Region Filter Configs type: string type: array resource_collection_enabled: description: |- When enabled, Datadog scans for all project-level resources in your GCP environment. type: boolean type: object GCPSTSServiceAccountCreateRequest: description: Data on your newly generated service account. properties: data: $ref: "#/components/schemas/GCPSTSServiceAccountData" type: object GCPSTSServiceAccountData: description: Additional metadata on your generated service account. properties: attributes: $ref: "#/components/schemas/GCPSTSServiceAccountAttributes" type: $ref: "#/components/schemas/GCPServiceAccountType" type: object GCPSTSServiceAccountResponse: description: The account creation response. properties: data: $ref: "#/components/schemas/GCPSTSServiceAccount" type: object GCPSTSServiceAccountUpdateRequest: description: Service account info. properties: data: $ref: "#/components/schemas/GCPSTSServiceAccountUpdateRequestData" type: object GCPSTSServiceAccountUpdateRequestData: description: Data on your service account. properties: attributes: $ref: "#/components/schemas/GCPSTSServiceAccountAttributes" id: description: Your service account's unique ID. example: "d291291f-12c2-22g4-j290-123456678897" type: string type: $ref: "#/components/schemas/GCPServiceAccountType" type: object GCPSTSServiceAccountsResponse: description: Object containing all your STS enabled accounts. properties: data: description: Array of GCP STS enabled service accounts. items: $ref: "#/components/schemas/GCPSTSServiceAccount" type: array type: object GCPServiceAccount: description: The definition of the `GCPServiceAccount` object. properties: private_key: $ref: "#/components/schemas/GCPServiceAccountPrivateKey" service_account_email: $ref: "#/components/schemas/GCPServiceAccountServiceAccountEmail" type: $ref: "#/components/schemas/GCPServiceAccountCredentialType" required: - type - service_account_email - private_key type: object GCPServiceAccountCredentialType: description: The definition of the `GCPServiceAccount` object. enum: - GCPServiceAccount example: GCPServiceAccount type: string x-enum-varnames: - GCPSERVICEACCOUNT GCPServiceAccountMeta: description: Additional information related to your service account. properties: accessible_projects: description: The current list of projects accessible from your service account. items: description: List of GCP projects. type: string type: array type: object GCPServiceAccountPrivateKey: description: The `GCPServiceAccount` `private_key`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" GCPServiceAccountServiceAccountEmail: description: The `GCPServiceAccount` `service_account_email`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" GCPServiceAccountType: default: gcp_service_account description: The type of account. enum: - gcp_service_account example: gcp_service_account type: string x-enum-varnames: - GCP_SERVICE_ACCOUNT GCPServiceAccountUpdate: description: The definition of the `GCPServiceAccount` object. properties: private_key: $ref: "#/components/schemas/GCPServiceAccountUpdatePrivateKey" service_account_email: $ref: "#/components/schemas/GCPServiceAccountUpdateServiceAccountEmail" type: $ref: "#/components/schemas/GCPServiceAccountCredentialType" required: - type type: object GCPServiceAccountUpdatePrivateKey: description: The `GCPServiceAccountUpdate` `private_key`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" GCPServiceAccountUpdateServiceAccountEmail: description: The `GCPServiceAccountUpdate` `service_account_email`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" GCPUsageCostConfig: description: Google Cloud Usage Cost config. properties: attributes: $ref: "#/components/schemas/GCPUsageCostConfigAttributes" id: description: The ID of the Google Cloud Usage Cost config. type: string type: $ref: "#/components/schemas/GCPUsageCostConfigType" required: - attributes - type type: object GCPUsageCostConfigAttributes: description: Attributes for a Google Cloud Usage Cost config. properties: account_id: description: The Google Cloud account ID. example: "123456_A123BC_12AB34" type: string bucket_name: description: The Google Cloud bucket name used to store the Usage Cost export. example: "dd-cost-bucket" type: string created_at: description: The timestamp when the Google Cloud Usage Cost config was created. pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$ type: string dataset: description: The export dataset name used for the Google Cloud Usage Cost Report. example: "billing" type: string error_messages: description: The error messages for the Google Cloud Usage Cost config. items: description: An error message string. type: string nullable: true type: array export_prefix: description: The export prefix used for the Google Cloud Usage Cost Report. example: "datadog_cloud_cost_usage_export" type: string export_project_name: description: The name of the Google Cloud Usage Cost Report. example: "dd-cloud-cost-report" type: string months: deprecated: true description: The number of months the report has been backfilled. format: int32 maximum: 36 type: integer project_id: description: The `project_id` of the Google Cloud Usage Cost report. example: "my-project-123" type: string service_account: description: The unique Google Cloud service account email. example: "dd-ccm-gcp-integration@my-environment.iam.gserviceaccount.com" type: string status: description: The status of the Google Cloud Usage Cost config. example: "active" type: string status_updated_at: description: The timestamp when the Google Cloud Usage Cost config status was updated. pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$ type: string updated_at: description: The timestamp when the Google Cloud Usage Cost config status was updated. pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$ type: string required: - account_id - bucket_name - dataset - export_prefix - export_project_name - service_account - status type: object GCPUsageCostConfigPatchData: description: Google Cloud Usage Cost config patch data. properties: attributes: $ref: "#/components/schemas/GCPUsageCostConfigPatchRequestAttributes" type: $ref: "#/components/schemas/GCPUsageCostConfigPatchRequestType" required: - attributes - type type: object GCPUsageCostConfigPatchRequest: description: Google Cloud Usage Cost config patch request. properties: data: $ref: "#/components/schemas/GCPUsageCostConfigPatchData" required: - data type: object GCPUsageCostConfigPatchRequestAttributes: description: Attributes for Google Cloud Usage Cost config patch request. properties: is_enabled: description: Whether or not the Cloud Cost Management account is enabled. example: true type: boolean required: - is_enabled type: object GCPUsageCostConfigPatchRequestType: default: gcp_uc_config_patch_request description: Type of Google Cloud Usage Cost config patch request. enum: - gcp_uc_config_patch_request example: gcp_uc_config_patch_request type: string x-enum-varnames: - GCP_USAGE_COST_CONFIG_PATCH_REQUEST GCPUsageCostConfigPostData: description: Google Cloud Usage Cost config post data. properties: attributes: $ref: "#/components/schemas/GCPUsageCostConfigPostRequestAttributes" type: $ref: "#/components/schemas/GCPUsageCostConfigPostRequestType" required: - type type: object GCPUsageCostConfigPostRequest: description: Google Cloud Usage Cost config post request. properties: data: $ref: "#/components/schemas/GCPUsageCostConfigPostData" required: - data type: object GCPUsageCostConfigPostRequestAttributes: description: Attributes for Google Cloud Usage Cost config post request. properties: billing_account_id: description: The Google Cloud account ID. example: "123456_A123BC_12AB34" type: string bucket_name: description: The Google Cloud bucket name used to store the Usage Cost export. example: "dd-cost-bucket" type: string export_dataset_name: description: The export dataset name used for the Google Cloud Usage Cost report. example: "billing" type: string export_prefix: description: The export prefix used for the Google Cloud Usage Cost report. example: "datadog_cloud_cost_usage_export" type: string export_project_name: description: The name of the Google Cloud Usage Cost report. example: "dd-cloud-cost-report" type: string service_account: description: The unique Google Cloud service account email. example: "dd-ccm-gcp-integration@my-environment.iam.gserviceaccount.com" type: string required: - billing_account_id - bucket_name - export_project_name - export_dataset_name - service_account type: object GCPUsageCostConfigPostRequestType: default: gcp_uc_config_post_request description: Type of Google Cloud Usage Cost config post request. enum: - gcp_uc_config_post_request example: gcp_uc_config_post_request type: string x-enum-varnames: - GCP_USAGE_COST_CONFIG_POST_REQUEST GCPUsageCostConfigResponse: description: Response of Google Cloud Usage Cost config. properties: data: $ref: "#/components/schemas/GCPUsageCostConfig" type: object GCPUsageCostConfigType: default: gcp_uc_config description: Type of Google Cloud Usage Cost config. enum: - gcp_uc_config example: gcp_uc_config type: string x-enum-varnames: - GCP_UC_CONFIG GCPUsageCostConfigsResponse: description: List of Google Cloud Usage Cost configs. properties: data: description: A Google Cloud Usage Cost config. items: $ref: "#/components/schemas/GCPUsageCostConfig" type: array required: - data type: object GcpScanOptions: description: Response object containing GCP scan options for a single project. example: data: attributes: cloud_function: true compliance_host: false vuln_containers_os: true vuln_host_os: true id: company-project-id type: gcp_scan_options properties: data: $ref: "#/components/schemas/GcpScanOptionsData" type: object GcpScanOptionsArray: description: Response object containing a list of GCP scan options. example: data: - attributes: cloud_function: true compliance_host: false vuln_containers_os: true vuln_host_os: true id: company-project-id type: gcp_scan_options properties: data: description: A list of GCP scan options. items: $ref: "#/components/schemas/GcpScanOptionsData" type: array required: - data type: object GcpScanOptionsData: description: Single GCP scan options entry. properties: attributes: $ref: "#/components/schemas/GcpScanOptionsDataAttributes" id: description: The GCP project ID. example: "" type: string type: $ref: "#/components/schemas/GcpScanOptionsDataType" required: - type - id type: object GcpScanOptionsDataAttributes: description: Attributes for GCP scan options configuration. properties: cloud_function: description: Indicates if scanning of Cloud Functions is enabled. type: boolean compliance_host: description: Indicates whether host compliance scanning is enabled. type: boolean vuln_containers_os: description: Indicates if scanning for vulnerabilities in containers is enabled. type: boolean vuln_host_os: description: Indicates if scanning for vulnerabilities in hosts is enabled. type: boolean type: object GcpScanOptionsDataType: default: gcp_scan_options description: GCP scan options resource type. enum: - gcp_scan_options example: gcp_scan_options type: string x-enum-varnames: - GCP_SCAN_OPTIONS GcpScanOptionsInputUpdate: description: Request object for updating GCP scan options. example: data: id: company-project-id type: gcp_scan_options properties: data: $ref: "#/components/schemas/GcpScanOptionsInputUpdateData" type: object GcpScanOptionsInputUpdateData: description: Data object for updating the scan options of a single GCP project. properties: attributes: $ref: "#/components/schemas/GcpScanOptionsInputUpdateDataAttributes" id: description: The GCP project ID. example: "" type: string type: $ref: "#/components/schemas/GcpScanOptionsInputUpdateDataType" required: - type - id type: object GcpScanOptionsInputUpdateDataAttributes: description: Attributes for updating GCP scan options configuration. properties: cloud_function: description: Indicates if scanning of Cloud Functions is enabled. type: boolean compliance_host: description: Indicates whether host compliance scanning is enabled. type: boolean vuln_containers_os: description: Indicates if scanning for vulnerabilities in containers is enabled. type: boolean vuln_host_os: description: Indicates if scanning for vulnerabilities in hosts is enabled. type: boolean type: object GcpScanOptionsInputUpdateDataType: default: gcp_scan_options description: GCP scan options resource type. enum: - gcp_scan_options example: gcp_scan_options type: string x-enum-varnames: - GCP_SCAN_OPTIONS GcpUcConfigResponse: description: The definition of `GcpUcConfigResponse` object. example: data: attributes: account_id: 123456_A123BC_12AB34 bucket_name: dd-cost-bucket created_at: "2023-01-01T12:00:00.000000" dataset: billing error_messages: [] export_prefix: datadog_cloud_cost_usage_export export_project_name: dd-cloud-cost-report months: 36 project_id: my-project-123 service_account: dd-ccm-gcp-integration@my-environment.iam.gserviceaccount.com status: active status_updated_at: "2023-01-01T12:00:00.000000" updated_at: "2023-01-01T12:00:00.000000" id: "123456789123" type: gcp_uc_config properties: data: $ref: "#/components/schemas/GcpUcConfigResponseData" type: object GcpUcConfigResponseData: description: The definition of `GcpUcConfigResponseData` object. properties: attributes: $ref: "#/components/schemas/GcpUcConfigResponseDataAttributes" id: description: The `GcpUcConfigResponseData` `id`. type: string type: $ref: "#/components/schemas/GcpUcConfigResponseDataType" required: - type type: object GcpUcConfigResponseDataAttributes: description: The definition of `GcpUcConfigResponseDataAttributes` object. properties: account_id: description: The `attributes` `account_id`. type: string bucket_name: description: The `attributes` `bucket_name`. type: string created_at: description: The `attributes` `created_at`. type: string dataset: description: The `attributes` `dataset`. type: string error_messages: description: The `attributes` `error_messages`. items: description: An error message string. type: string nullable: true type: array export_prefix: description: The `attributes` `export_prefix`. type: string export_project_name: description: The `attributes` `export_project_name`. type: string months: description: The `attributes` `months`. format: int64 type: integer project_id: description: The `attributes` `project_id`. type: string service_account: description: The `attributes` `service_account`. type: string status: description: The `attributes` `status`. type: string status_updated_at: description: The `attributes` `status_updated_at`. type: string updated_at: description: The `attributes` `updated_at`. type: string type: object GcpUcConfigResponseDataType: default: gcp_uc_config description: Google Cloud Usage Cost config resource type. enum: - gcp_uc_config example: gcp_uc_config type: string x-enum-varnames: - GCP_UC_CONFIG GeminiAPIKey: description: The definition of the `GeminiAPIKey` object. properties: api_key: $ref: "#/components/schemas/GeminiAPIKeyApiKey" type: $ref: "#/components/schemas/GeminiAPIKeyType" required: - type - api_key type: object GeminiAPIKeyApiKey: description: The `GeminiAPIKey` `api_key`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" GeminiAPIKeyType: description: The definition of the `GeminiAPIKey` object. enum: - GeminiAPIKey example: GeminiAPIKey type: string x-enum-varnames: - GEMINIAPIKEY GeminiAPIKeyUpdate: description: The definition of the `GeminiAPIKey` object. properties: api_key: $ref: "#/components/schemas/GeminiAPIKeyUpdateApiKey" type: $ref: "#/components/schemas/GeminiAPIKeyType" required: - type type: object GeminiAPIKeyUpdateApiKey: description: The `GeminiAPIKeyUpdate` `api_key`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" GeminiCredentials: description: The definition of the `GeminiCredentials` object. oneOf: - $ref: "#/components/schemas/GeminiAPIKey" GeminiCredentialsUpdate: description: The definition of the `GeminiCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/GeminiAPIKeyUpdate" GeminiIntegration: description: The definition of the `GeminiIntegration` object. properties: credentials: $ref: "#/components/schemas/GeminiCredentials" type: $ref: "#/components/schemas/GeminiIntegrationType" required: - type - credentials type: object GeminiIntegrationType: description: The definition of the `GeminiIntegrationType` object. enum: - Gemini example: Gemini type: string x-enum-varnames: - GEMINI GeminiIntegrationUpdate: description: The definition of the `GeminiIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/GeminiCredentialsUpdate" type: $ref: "#/components/schemas/GeminiIntegrationType" required: - type type: object GeneralInvestigationAttributes: description: Attributes for a general investigation, not tied to a specific monitor alert. oneOf: - $ref: "#/components/schemas/GeneralInvestigationAttributesWithoutTimeBounds" - $ref: "#/components/schemas/GeneralInvestigationAttributesWithTimeBounds" GeneralInvestigationAttributesWithTimeBounds: additionalProperties: false description: Attributes for a general investigation with an explicit time window. properties: description: description: A free-form description of what to investigate, up to 4,096 characters. example: "Checkout latency has been elevated for the past hour." maxLength: 4096 type: string end_time: description: The end of the investigation window, in Unix milliseconds. example: 1700003600000 format: int64 type: integer start_time: description: The start of the investigation window, in Unix milliseconds. example: 1700000000000 format: int64 type: integer tags: description: Tags that scope the investigation. example: - "service:checkout" items: type: string type: array required: - description - start_time - end_time type: object GeneralInvestigationAttributesWithoutTimeBounds: additionalProperties: false description: Attributes for a general investigation without an explicit time window. properties: description: description: A free-form description of what to investigate, up to 4,096 characters. example: "Checkout latency has been elevated for the past hour." maxLength: 4096 type: string tags: description: Tags that scope the investigation. example: - "service:checkout" items: type: string type: array required: - description type: object GeneralInvestigationTrigger: additionalProperties: false description: A trigger created from a general investigation request. properties: general_investigation: $ref: "#/components/schemas/GeneralInvestigationAttributes" type: $ref: "#/components/schemas/GeneralInvestigationTriggerType" required: - type - general_investigation type: object GeneralInvestigationTriggerType: description: The type of general investigation trigger. enum: - general_investigation example: general_investigation type: string x-enum-varnames: - GENERAL_INVESTIGATION GenerateCostTagDescriptionResponse: description: Response wrapping an AI-generated Cloud Cost Management tag key description. example: data: attributes: description: AWS account that owns this cost. id: account_id type: cost_generated_tag_description properties: data: $ref: "#/components/schemas/GeneratedCostTagDescription" required: - data type: object GeneratedCostTagDescription: description: AI-generated Cloud Cost Management tag key description returned by the generate endpoint. The result is returned to the client but is not persisted by this endpoint. properties: attributes: $ref: "#/components/schemas/GeneratedCostTagDescriptionAttributes" id: description: The tag key the AI description was generated for. example: account_id type: string type: $ref: "#/components/schemas/GeneratedCostTagDescriptionType" required: - attributes - id - type type: object GeneratedCostTagDescriptionAttributes: description: Attributes of an AI-generated Cloud Cost Management tag key description. properties: description: description: The AI-generated description for the tag key. example: AWS account that owns this cost. type: string required: - description type: object GeneratedCostTagDescriptionType: default: cost_generated_tag_description description: Type of the AI-generated Cloud Cost Management tag description resource. enum: - cost_generated_tag_description example: cost_generated_tag_description type: string x-enum-varnames: - COST_GENERATED_TAG_DESCRIPTION GetActionConnectionResponse: description: The response for found connection properties: data: $ref: "#/components/schemas/ActionConnectionData" type: object GetAppKeyRegistrationResponse: description: The response object after getting an app key registration. properties: data: $ref: "#/components/schemas/AppKeyRegistrationData" type: object GetAppResponse: description: The full app definition response object. properties: data: $ref: "#/components/schemas/GetAppResponseData" included: description: Data on the version of the app that was published. items: $ref: "#/components/schemas/Deployment" type: array meta: $ref: "#/components/schemas/AppMeta" relationship: $ref: "#/components/schemas/AppRelationship" type: object GetAppResponseData: description: The data object containing the app definition. properties: attributes: $ref: "#/components/schemas/GetAppResponseDataAttributes" id: description: The ID of the app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string type: $ref: "#/components/schemas/AppDefinitionType" required: - id - type - attributes type: object GetAppResponseDataAttributes: description: The app definition attributes, such as name, description, and components. properties: components: description: The UI components that make up the app. items: $ref: "#/components/schemas/ComponentGrid" type: array description: description: A human-readable description for the app. type: string favorite: description: Whether the app is marked as a favorite by the current user. type: boolean name: description: The name of the app. type: string queries: description: An array of queries, such as external actions and state variables, that the app uses. items: $ref: "#/components/schemas/Query" type: array rootInstanceName: description: The name of the root component of the app. This must be a `grid` component that contains all other components. type: string tags: description: A list of tags for the app, which can be used to filter apps. example: - "service:webshop-backend" - "team:webshop" items: description: An individual tag for the app. type: string type: array type: object GetAstRequest: description: The request payload for parsing source code into an abstract syntax tree. properties: _authentication_token: description: CSRF token for security, sent by browser-based clients. Ignored by the API when absent. type: string data: $ref: "#/components/schemas/GetAstRequestData" required: - data type: object GetAstRequestData: description: The primary data object in the get-AST request. properties: attributes: $ref: "#/components/schemas/GetAstRequestDataAttributes" id: description: An optional identifier for the get-AST request resource. type: string type: $ref: "#/components/schemas/GetAstRequestDataType" required: - type - attributes type: object GetAstRequestDataAttributes: description: The attributes of the get-AST request, containing the source code to parse. properties: code: description: The base64-encoded source code to parse into an abstract syntax tree. example: aW1wb3J0IHN5cw== type: string file_encoding: description: The encoding of the source code file (must be utf-8). example: utf-8 type: string language: description: The programming language of the source code to parse. example: python type: string required: - code - file_encoding - language type: object GetAstRequestDataType: default: get_ast_request description: Get AST request resource type. enum: - get_ast_request example: get_ast_request type: string x-enum-varnames: - GET_AST_REQUEST GetAstResponse: description: The response payload containing the parsed abstract syntax tree. properties: data: $ref: "#/components/schemas/GetAstResponseData" required: - data type: object GetAstResponseData: description: The primary data object in the get-AST response. properties: attributes: $ref: "#/components/schemas/GetAstResponseDataAttributes" id: description: The identifier of the get-AST response resource, echoed from the request. example: "" type: string type: $ref: "#/components/schemas/GetAstResponseDataType" required: - id - type - attributes type: object GetAstResponseDataAttributes: description: The attributes of the get-AST response, containing the parsed abstract syntax tree. properties: result: $ref: "#/components/schemas/AstNode" description: The root node of the parsed abstract syntax tree, or null when the source code could not be parsed. nullable: true required: - result type: object GetAstResponseDataType: default: get_ast_response description: Get AST response resource type. enum: - get_ast_response example: get_ast_response type: string x-enum-varnames: - GET_AST_RESPONSE GetBlueprintResponse: description: The response for retrieving a single blueprint. properties: data: $ref: "#/components/schemas/BlueprintData" type: object GetBlueprintsResponse: description: The response for retrieving multiple blueprints. properties: data: description: An array of blueprints. items: $ref: "#/components/schemas/BlueprintData" type: array type: object GetCustomFrameworkResponse: description: Response object to get a custom framework. properties: data: $ref: "#/components/schemas/FullCustomFrameworkData" required: - data type: object GetDataDeletionsResponseBody: description: The response from the get data deletion requests endpoint. properties: data: description: The list of data deletion requests that matches the query. items: $ref: "#/components/schemas/DataDeletionResponseItem" type: array meta: $ref: "#/components/schemas/DataDeletionResponseMeta" type: object GetDataObservabilityMonitorRunStatusResponse: description: The response for getting the status of a data observability monitor run. properties: data: $ref: "#/components/schemas/GetDataObservabilityMonitorRunStatusResponseData" required: - data type: object GetDataObservabilityMonitorRunStatusResponseAttributes: description: The attributes of a data observability monitor run status response. properties: error_message: description: Error message describing why the monitor run failed. Only present when status is error. example: "run completed but produced no metric data" type: string status: $ref: "#/components/schemas/DataObservabilityMonitorRunStatus" required: - status type: object GetDataObservabilityMonitorRunStatusResponseData: description: The data object for a data observability monitor run status response. properties: attributes: $ref: "#/components/schemas/GetDataObservabilityMonitorRunStatusResponseAttributes" id: description: The unique identifier of the monitor run. example: "abc123def456" type: string type: $ref: "#/components/schemas/DataObservabilityMonitorRunType" required: - id - type - attributes type: object GetDeviceAttributes: description: The device attributes properties: description: description: A description of the device. example: a device monitored with NDM type: string device_type: description: The type of the device. example: other type: string integration: description: The integration of the device. example: snmp type: string ip_address: description: The IP address of the device. example: 1.2.3.4 type: string location: description: The location of the device. example: paris type: string model: description: The model of the device. example: xx-123 type: string name: description: The name of the device. example: example device type: string os_hostname: description: The operating system hostname of the device. example: 1.0.2 type: string os_name: description: The operating system name of the device. example: example OS type: string os_version: description: The operating system version of the device. example: 1.0.2 type: string ping_status: description: The ping status of the device. example: unmonitored type: string product_name: description: The product name of the device. example: example device type: string serial_number: description: The serial number of the device. example: X12345 type: string status: description: The status of the device. example: ok type: string subnet: description: The subnet of the device. example: 1.2.3.4/24 type: string sys_object_id: description: The device `sys_object_id`. example: 1.3.6.1.4.1.99999 type: string tags: description: A list of tags associated with the device. example: ["device_ip:1.2.3.4", "device_id:example:1.2.3.4"] items: description: A tag string in `key:value` format. type: string type: array vendor: description: The vendor of the device. example: example vendor type: string version: description: The version of the device. example: 1.2.3 type: string type: object GetDeviceData: description: Get device response data. properties: attributes: $ref: "#/components/schemas/GetDeviceAttributes" id: description: The device ID example: example:1.2.3.4 type: string type: description: The type of the resource. The value should always be device. type: string type: object GetDeviceResponse: description: The `GetDevice` operation's response. properties: data: $ref: "#/components/schemas/GetDeviceData" type: object GetFindingResponse: description: The expected response schema when getting a finding. properties: data: $ref: "#/components/schemas/DetailedFinding" required: - data type: object GetInterfacesData: description: The interfaces list data properties: attributes: $ref: "#/components/schemas/InterfaceAttributes" id: description: The interface ID example: example:1.2.3.4:99 type: string type: description: The type of the resource. The value should always be interface. type: string type: object GetInterfacesResponse: description: The `GetInterfaces` operation's response. properties: data: description: Get Interfaces response items: $ref: "#/components/schemas/GetInterfacesData" type: array type: object GetInvestigationResponse: description: Response for a single Bits AI investigation. properties: data: $ref: "#/components/schemas/GetInvestigationResponseData" links: $ref: "#/components/schemas/GetInvestigationResponseLinks" required: - data - links type: object GetInvestigationResponseData: description: Data for the get investigation response. properties: attributes: $ref: "#/components/schemas/GetInvestigationResponseDataAttributes" id: description: The unique identifier of the investigation. example: "a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d" type: string type: $ref: "#/components/schemas/InvestigationType" required: - id - type - attributes type: object GetInvestigationResponseDataAttributes: description: Attributes of the investigation. properties: conclusions: description: The conclusions drawn from the investigation. items: $ref: "#/components/schemas/InvestigationConclusion" type: array status: description: The current status of the investigation. example: "conclusive" type: string title: description: The title of the investigation. example: "Monitor alert investigation for web-server-01" type: string required: - title - status - conclusions type: object GetInvestigationResponseLinks: description: Links related to the investigation. properties: self: description: The URL to the investigation in the Datadog app. example: "https://app.datadoghq.com/bits-ai/investigations/a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d" type: string required: - self type: object GetIoCIndicatorResponse: description: Response for the get indicator of compromise endpoint. properties: data: $ref: "#/components/schemas/GetIoCIndicatorResponseData" type: object GetIoCIndicatorResponseAttributes: description: Attributes of the get indicator response. properties: data: $ref: "#/components/schemas/IoCIndicatorDetailed" type: object GetIoCIndicatorResponseData: description: IoC indicator response data object. properties: attributes: $ref: "#/components/schemas/GetIoCIndicatorResponseAttributes" id: description: Unique identifier for the response. type: string type: description: Response type identifier. type: string type: object GetIssueIncludeQueryParameterItem: description: Relationship object that should be included in the response. enum: - assignee - case - team_owners - samples example: "case" type: string x-enum-varnames: - ASSIGNEE - CASE - TEAM_OWNERS - SAMPLES GetMappingResponse: description: Response containing the entity attribute mapping configuration including all available attributes and their properties. example: data: attributes: attributes: - attribute: user_id description: Unique user identifier display_name: User ID groups: - Identity is_custom: false type: string - attribute: user_email description: User email address display_name: Email Address groups: - Identity - Contact is_custom: false type: string - attribute: first_country_code description: The ISO code of the country for the user's first session display_name: First Country Code groups: - Geography is_custom: false type: string - attribute: "@customer_tier" description: Customer subscription tier display_name: Customer Tier groups: - Business is_custom: true type: string id: get_mappings_response type: get_mappings_response properties: data: $ref: "#/components/schemas/GetMappingResponseData" type: object GetMappingResponseData: description: The data object containing the resource type and attributes for the get mapping response. properties: attributes: $ref: "#/components/schemas/GetMappingResponseDataAttributes" id: description: Unique identifier for the get mapping response resource. type: string type: $ref: "#/components/schemas/GetMappingResponseDataType" required: - type type: object GetMappingResponseDataAttributes: description: Attributes of the get mapping response, containing the list of configured entity attributes. properties: attributes: description: The list of entity attributes and their mapping configurations. items: $ref: "#/components/schemas/GetMappingResponseDataAttributesAttributesItems" type: array type: object GetMappingResponseDataAttributesAttributesItems: description: Details of a single entity attribute including its mapping configuration and metadata. properties: attribute: description: The attribute identifier as used in the entity data model. type: string description: description: Human-readable explanation of what the attribute represents. type: string display_name: description: The human-readable label for the attribute shown in the UI. type: string groups: description: List of group labels used to categorize the attribute. items: description: A group label name for categorizing the attribute. type: string type: array is_custom: description: Whether this attribute is a custom user-defined attribute rather than a built-in one. type: boolean type: description: The data type of the attribute (for example, string or number). type: string type: object GetMappingResponseDataType: default: get_mappings_response description: Get mappings response resource type. enum: - get_mappings_response example: get_mappings_response type: string x-enum-varnames: - GET_MAPPINGS_RESPONSE GetMultipleRulesetsRequest: description: The request payload for retrieving rules for multiple rulesets in a single batch call. properties: _authentication_token: description: CSRF token for security, sent by browser-based clients. Ignored by the API when absent. type: string data: $ref: "#/components/schemas/GetMultipleRulesetsRequestData" type: object GetMultipleRulesetsRequestData: description: The primary data object in the get-multiple-rulesets request, containing request attributes and resource type. properties: attributes: $ref: "#/components/schemas/GetMultipleRulesetsRequestDataAttributes" id: description: An optional identifier for the get-multiple-rulesets request resource. type: string type: $ref: "#/components/schemas/GetMultipleRulesetsRequestDataType" required: - type type: object GetMultipleRulesetsRequestDataAttributes: description: The request attributes for fetching multiple rulesets, specifying which rulesets to retrieve and what data to include. properties: include_testing_rules: description: When true, rules that are available in testing mode are included in the response. type: boolean include_tests: description: When true, test cases associated with each rule are included in the response. type: boolean rulesets: description: The list of ruleset names to retrieve. items: description: The name of a ruleset to include in the batch request. type: string type: array type: object GetMultipleRulesetsRequestDataType: default: get_multiple_rulesets_request description: Get multiple rulesets request resource type. enum: - get_multiple_rulesets_request example: get_multiple_rulesets_request type: string x-enum-varnames: - GET_MULTIPLE_RULESETS_REQUEST GetMultipleRulesetsResponse: description: The response payload for the get-multiple-rulesets endpoint, containing the requested rulesets and their rules. properties: data: $ref: "#/components/schemas/GetMultipleRulesetsResponseData" required: - data type: object GetMultipleRulesetsResponseData: description: The primary data object in the get-multiple-rulesets response, containing the response attributes and resource type. properties: attributes: $ref: "#/components/schemas/GetMultipleRulesetsResponseDataAttributes" id: description: The unique identifier of the get-multiple-rulesets response resource, echoed from the request. example: "" type: string type: $ref: "#/components/schemas/GetMultipleRulesetsResponseDataType" required: - id - type - attributes type: object GetMultipleRulesetsResponseDataAttributes: description: The attributes of the get-multiple-rulesets response, containing the list of requested rulesets. properties: rulesets: description: The list of rulesets returned in response to the batch request. items: $ref: "#/components/schemas/GetMultipleRulesetsResponseDataAttributesRulesetsItems" type: array required: - rulesets type: object GetMultipleRulesetsResponseDataAttributesRulesetsItems: description: A ruleset returned in the response, containing its metadata and associated rules. properties: description: description: A detailed description of the ruleset's purpose and the types of issues it targets. example: "" type: string id: description: The unique identifier of the ruleset, which is the same as its name. example: "" type: string name: description: The unique name of the ruleset. example: "" type: string rules: description: The list of static analysis rules included in this ruleset. items: $ref: "#/components/schemas/GetMultipleRulesetsResponseDataAttributesRulesetsItemsRulesItems" type: array short_description: description: A brief summary of the ruleset, suitable for display in listings. example: "" type: string required: - id - name - short_description - description - rules type: object GetMultipleRulesetsResponseDataAttributesRulesetsItemsDataType: default: rulesets description: Rulesets resource type. enum: - rulesets example: rulesets type: string x-enum-varnames: - RULESETS GetMultipleRulesetsResponseDataAttributesRulesetsItemsRulesItems: description: A static analysis rule within a ruleset, including its definition, metadata, and associated test cases. properties: arguments: description: The list of configurable arguments accepted by this rule. items: $ref: "#/components/schemas/GetMultipleRulesetsResponseDataAttributesRulesetsItemsRulesItemsArgumentsItems" type: array category: description: The category classifying the type of issue this rule detects (e.g., security, style, performance). example: "" type: string checksum: description: A checksum of the rule definition used to detect changes. example: "" type: string code: description: The rule implementation code used by the static analysis engine. example: "" type: string created_at: description: The date and time when the rule was created. example: "" format: date-time type: string created_by: description: The identifier of the user or system that created the rule. example: "" type: string cve: description: The CVE identifier associated with the vulnerability this rule detects, if applicable. type: string cwe: description: The CWE identifier associated with the weakness category this rule detects, if applicable. type: string description: description: A detailed explanation of what the rule detects and why it matters. example: "" type: string documentation_url: description: A URL pointing to additional documentation for this rule. type: string entity_checked: description: The code entity type (e.g., function, class, variable) that this rule inspects. type: string id: description: The unique identifier of the rule, which is the same as its name. example: "" type: string is_published: description: Indicates whether the rule is publicly published and available to all users. example: false type: boolean is_testing: description: Indicates whether the rule is in testing mode and not yet promoted to production. example: false type: boolean language: description: The programming language this rule applies to. example: "" type: string last_updated_at: description: The date and time when the rule was last modified. example: "" format: date-time type: string last_updated_by: description: The identifier of the user or system that last updated the rule. example: "" type: string name: description: The unique name identifying this rule within its ruleset. example: "" type: string regex: description: A regular expression pattern used by the rule for pattern-based detection. type: string severity: description: The severity level of findings produced by this rule (e.g., ERROR, WARNING, NOTICE). example: "" type: string short_description: description: A brief summary of what the rule detects, suitable for display in listings. example: "" type: string should_use_ai_fix: description: Indicates whether an AI-generated fix suggestion should be offered for findings from this rule. example: false type: boolean tests: description: The list of test cases used to validate the rule's behavior. items: $ref: "#/components/schemas/GetMultipleRulesetsResponseDataAttributesRulesetsItemsRulesItemsTestsItems" type: array tree_sitter_query: description: The Tree-sitter query expression used by the rule to match code patterns in the AST. type: string type: description: The rule type indicating the detection mechanism used (e.g., tree_sitter, regex). example: "" type: string required: - id - name - short_description - description - code - language - type - checksum - created_at - created_by - last_updated_at - last_updated_by - severity - category - arguments - tests - is_published - should_use_ai_fix - is_testing type: object GetMultipleRulesetsResponseDataAttributesRulesetsItemsRulesItemsArgumentsItems: description: An argument parameter for a static analysis rule, with a name and description. properties: description: description: A human-readable explanation of the argument's purpose and accepted values. type: string name: description: The name of the rule argument. type: string type: object GetMultipleRulesetsResponseDataAttributesRulesetsItemsRulesItemsTestsItems: description: A test case associated with a static analysis rule, containing the source code and expected annotation count. properties: annotation_count: description: The expected number of annotations (findings) the rule should produce when run against the test code. format: int64 maximum: 65535 minimum: 0 type: integer code: description: The source code snippet used as input for the rule test. type: string filename: description: The filename associated with the test code snippet. type: string type: object GetMultipleRulesetsResponseDataType: default: get_multiple_rulesets_response description: Get multiple rulesets response resource type. enum: - get_multiple_rulesets_response example: get_multiple_rulesets_response type: string x-enum-varnames: - GET_MULTIPLE_RULESETS_RESPONSE GetResourceEvaluationFiltersResponse: description: The definition of `GetResourceEvaluationFiltersResponse` object. properties: data: $ref: "#/components/schemas/GetResourceEvaluationFiltersResponseData" required: - data type: object GetResourceEvaluationFiltersResponseData: description: The definition of `GetResourceFilterResponseData` object. properties: attributes: $ref: "#/components/schemas/ResourceFilterAttributes" id: description: The `data` `id`. example: csm_resource_filter type: string type: $ref: "#/components/schemas/ResourceFilterRequestType" type: object GetRuleVersionHistoryData: description: Data for the rule version history. properties: attributes: $ref: "#/components/schemas/RuleVersionHistory" id: description: ID of the rule. type: string type: $ref: "#/components/schemas/GetRuleVersionHistoryDataType" type: object GetRuleVersionHistoryDataType: description: Type of data. enum: - GetRuleVersionHistoryResponse type: string x-enum-varnames: - GETRULEVERSIONHISTORYRESPONSE GetRuleVersionHistoryResponse: description: Response for getting the rule version history. properties: data: $ref: "#/components/schemas/GetRuleVersionHistoryData" type: object GetSBOMResponse: description: The expected response schema when getting an SBOM. properties: data: $ref: "#/components/schemas/SBOM" required: - data type: object GetSuppressionVersionHistoryData: description: Data for the suppression version history. properties: attributes: $ref: "#/components/schemas/SuppressionVersionHistory" id: description: ID of the suppression. type: string type: $ref: "#/components/schemas/GetSuppressionVersionHistoryDataType" type: object GetSuppressionVersionHistoryDataType: description: Type of data. enum: - suppression_version_history type: string x-enum-varnames: - SUPPRESSIONVERSIONHISTORY GetSuppressionVersionHistoryResponse: description: Response for getting the suppression version history. properties: data: $ref: "#/components/schemas/GetSuppressionVersionHistoryData" type: object GetTeamMembershipsSort: description: Specifies the order of returned team memberships enum: - manager_name - -manager_name - name - -name - handle - -handle - email - -email type: string x-enum-varnames: - MANAGER_NAME - _MANAGER_NAME - NAME - _NAME - HANDLE - _HANDLE - EMAIL - _EMAIL GetWorkflowResponse: description: The response object after getting a workflow. properties: data: $ref: "#/components/schemas/WorkflowData" type: object GitCommitSHA: description: "Git Commit SHA." example: 66adc9350f2cc9b250b69abddab733dd55e1a588 pattern: "^[a-fA-F0-9]{40,}$" type: string GitHubCloudAuthIntakeMappingAttributesResponse: additionalProperties: false description: Attributes for GitHub cloud authentication intake mapping response. properties: claim_matchers: $ref: "#/components/schemas/GitHubOIDCClaimPatterns" required: - claim_matchers type: object GitHubCloudAuthIntakeMappingCreateAttributes: additionalProperties: false description: Attributes for creating a GitHub cloud authentication intake mapping properties: claim_matchers: $ref: "#/components/schemas/GitHubOIDCClaimPatterns" required: - claim_matchers type: object GitHubCloudAuthIntakeMappingCreateData: additionalProperties: false description: Data for creating a GitHub cloud authentication intake mapping. properties: attributes: $ref: "#/components/schemas/GitHubCloudAuthIntakeMappingCreateAttributes" type: $ref: "#/components/schemas/GitHubCloudAuthIntakeMappingType" required: - type - attributes type: object GitHubCloudAuthIntakeMappingCreateRequest: additionalProperties: false description: Request used to create a GitHub cloud authentication intake mapping. properties: data: $ref: "#/components/schemas/GitHubCloudAuthIntakeMappingCreateData" required: - data type: object GitHubCloudAuthIntakeMappingDataResponse: description: Data for GitHub cloud authentication intake mapping response. properties: attributes: $ref: "#/components/schemas/GitHubCloudAuthIntakeMappingAttributesResponse" id: description: Unique identifier for the intake mapping. example: "d6d869d7-29d3-5595-bf40-57c95235cf5b" type: string type: $ref: "#/components/schemas/GitHubCloudAuthIntakeMappingType" required: - id - type - attributes type: object GitHubCloudAuthIntakeMappingResponse: description: Response containing a single GitHub cloud authentication intake mapping. properties: data: $ref: "#/components/schemas/GitHubCloudAuthIntakeMappingDataResponse" required: - data type: object GitHubCloudAuthIntakeMappingType: description: Type identifier for GitHub cloud authentication intake mapping. enum: - github_oidc_auth_intake_mapping example: github_oidc_auth_intake_mapping type: string x-enum-varnames: - GITHUB_OIDC_AUTH_INTAKE_MAPPING GitHubCloudAuthIntakeMappingsData: description: List of GitHub cloud authentication intake mappings. items: $ref: "#/components/schemas/GitHubCloudAuthIntakeMappingDataResponse" type: array GitHubCloudAuthIntakeMappingsResponse: description: Response containing a list of GitHub cloud authentication intake mappings. properties: data: $ref: "#/components/schemas/GitHubCloudAuthIntakeMappingsData" example: - attributes: claim_matchers: ref: "refs/heads/main" repository: "test_owner/test_repo" repository_owner: "test_owner" sub: "repo:test_owner/test_repo:(ref:refs/heads/main|pull_request)" id: "d6d869d7-29d3-5595-bf40-57c95235cf5b" type: github_oidc_auth_intake_mapping required: - data type: object GitHubCloudAuthPersonaMappingAttributesResponse: additionalProperties: false description: Attributes for GitHub cloud authentication persona mapping response. properties: account_identifier: description: Datadog account identifier (email or handle) mapped to the GitHub principal. example: "test@example.com" type: string account_uuid: description: Datadog account UUID. example: "12bbdc5c-5966-47e0-8733-285f9e44bcf4" type: string claim_matchers: $ref: "#/components/schemas/GitHubOIDCClaimPatterns" required: - claim_matchers - account_identifier - account_uuid type: object GitHubCloudAuthPersonaMappingCreateAttributes: additionalProperties: false description: Attributes for creating a GitHub cloud authentication persona mapping. properties: account_identifier: description: Datadog account identifier (email or handle) mapped to the GitHub principal. example: "test@example.com" type: string claim_matchers: $ref: "#/components/schemas/GitHubOIDCClaimPatterns" required: - claim_matchers - account_identifier type: object GitHubCloudAuthPersonaMappingCreateData: additionalProperties: false description: Data for creating a GitHub cloud authentication persona mapping. properties: attributes: $ref: "#/components/schemas/GitHubCloudAuthPersonaMappingCreateAttributes" type: $ref: "#/components/schemas/GitHubCloudAuthPersonaMappingType" required: - type - attributes type: object GitHubCloudAuthPersonaMappingCreateRequest: additionalProperties: false description: Request used to create a GitHub cloud authentication persona mapping. properties: data: $ref: "#/components/schemas/GitHubCloudAuthPersonaMappingCreateData" required: - data type: object GitHubCloudAuthPersonaMappingDataResponse: description: Data for GitHub cloud authentication persona mapping response. properties: attributes: $ref: "#/components/schemas/GitHubCloudAuthPersonaMappingAttributesResponse" id: description: Unique identifier for the persona mapping. example: "c5c758c6-18c2-4484-ae3f-46b84128404a" type: string type: $ref: "#/components/schemas/GitHubCloudAuthPersonaMappingType" required: - id - type - attributes type: object GitHubCloudAuthPersonaMappingResponse: description: Response containing a single GitHub cloud authentication persona mapping. properties: data: $ref: "#/components/schemas/GitHubCloudAuthPersonaMappingDataResponse" required: - data type: object GitHubCloudAuthPersonaMappingType: description: Type identifier for GitHub cloud authentication persona mapping. enum: - github_oidc_auth_config example: github_oidc_auth_config type: string x-enum-varnames: - GITHUB_OIDC_AUTH_CONFIG GitHubCloudAuthPersonaMappingsData: description: List of GitHub cloud authentication persona mappings. items: $ref: "#/components/schemas/GitHubCloudAuthPersonaMappingDataResponse" type: array GitHubCloudAuthPersonaMappingsResponse: description: Response containing a list of GitHub cloud authentication persona mappings. properties: data: $ref: "#/components/schemas/GitHubCloudAuthPersonaMappingsData" example: - attributes: account_identifier: "test@example.com" account_uuid: "12bbdc5c-5966-47e0-8733-285f9e44bcf4" claim_matchers: ref: "refs/heads/main" repository: "test_owner/test_repo" repository_owner: "test_owner" sub: "repo:test_owner/test_repo:(ref:refs/heads/main|pull_request)" id: "c5c758c6-18c2-4484-ae3f-46b84128404a" type: github_oidc_auth_config required: - data type: object GitHubOIDCClaimPatterns: additionalProperties: false description: |- GitHub Actions OIDC claims to match against. Each field is a regular expression. The `sub` claim is required; all other claims are optional. A token matches only when all provided patterns match simultaneously (AND semantics). properties: actor: description: Regular expression matched against the `actor` claim. example: "octocat" type: string actor_id: description: Regular expression matched against the `actor_id` claim. example: "1234567" type: string enterprise: description: Regular expression matched against the `enterprise` claim. example: "test_enterprise" type: string enterprise_id: description: Regular expression matched against the `enterprise_id` claim. example: "42" type: string environment: description: Regular expression matched against the `environment` claim. example: "production" type: string event_name: description: Regular expression matched against the `event_name` claim. example: "push" type: string job_workflow_ref: description: Regular expression matched against the `job_workflow_ref` claim. example: "test_owner/test_repo/.github/workflows/jobs.yml@refs/heads/main" type: string ref: description: Regular expression matched against the `ref` claim. example: "refs/heads/main" type: string ref_type: description: Regular expression matched against the `ref_type` claim. example: "branch" type: string repository: description: Regular expression matched against the `repository` claim. example: "test_owner/test_repo" type: string repository_id: description: Regular expression matched against the `repository_id` claim. example: "123456789" type: string repository_owner: description: Regular expression matched against the `repository_owner` claim. example: "test_owner" type: string repository_owner_id: description: Regular expression matched against the `repository_owner_id` claim. example: "987654321" type: string repository_visibility: description: Regular expression matched against the `repository_visibility` claim. example: "public" type: string runner_environment: description: Regular expression matched against the `runner_environment` claim. example: "github-hosted" type: string sub: description: |- Regular expression matched against the entire `sub` (subject) claim, the primary GitHub Actions OIDC identifier (for example, `repo:/:ref:refs/heads/main`). The pattern must begin with `repo:/`, where `` is a literal repository-owner name rather than a regular expression. example: "repo:test_owner/test_repo:(ref:refs/heads/main|pull_request)" type: string workflow: description: Regular expression matched against the `workflow` claim. example: "CI" type: string workflow_ref: description: Regular expression matched against the `workflow_ref` claim. example: "test_owner/test_repo/.github/workflows/ci.yml@refs/heads/main" type: string required: - sub type: object GitRepositoryID: description: "Git Repository ID" example: "github.com/organization/example-repository" type: string GitRepositoryURL: description: "Git Repository URL" example: "https://github.com/organization/example-repository" type: string GithubWebhookTrigger: description: 'Trigger a workflow from a GitHub webhook. To trigger a workflow from GitHub, you must set a `webhookSecret`. In your GitHub Webhook Settings, set the Payload URL to "base_url"/api/v2/workflows/"workflow_id"/webhook?orgId="org_id", select application/json for the content type, and be highly recommend enabling SSL verification for security. The workflow must be published.' properties: rateLimit: $ref: "#/components/schemas/TriggerRateLimit" type: object GithubWebhookTriggerWrapper: description: "Schema for a GitHub webhook-based trigger." properties: githubWebhookTrigger: $ref: "#/components/schemas/GithubWebhookTrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - githubWebhookTrigger type: object GitlabAPIKey: description: The definition of the `GitlabAPIKey` object. properties: api_token: $ref: "#/components/schemas/GitlabAPIKeyApiToken" type: $ref: "#/components/schemas/GitlabAPIKeyType" required: - type - api_token type: object GitlabAPIKeyApiToken: description: The `GitlabAPIKey` `api_token`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" GitlabAPIKeyType: description: The definition of the `GitlabAPIKey` object. enum: - GitlabAPIKey example: GitlabAPIKey type: string x-enum-varnames: - GITLABAPIKEY GitlabAPIKeyUpdate: description: The definition of the `GitlabAPIKey` object. properties: api_token: $ref: "#/components/schemas/GitlabAPIKeyUpdateApiToken" type: $ref: "#/components/schemas/GitlabAPIKeyType" required: - type type: object GitlabAPIKeyUpdateApiToken: description: The `GitlabAPIKeyUpdate` `api_token`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" GitlabCredentials: description: The definition of the `GitlabCredentials` object. oneOf: - $ref: "#/components/schemas/GitlabAPIKey" GitlabCredentialsUpdate: description: The definition of the `GitlabCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/GitlabAPIKeyUpdate" GitlabIntegration: description: The definition of the `GitlabIntegration` object. properties: credentials: $ref: "#/components/schemas/GitlabCredentials" type: $ref: "#/components/schemas/GitlabIntegrationType" required: - type - credentials type: object GitlabIntegrationType: description: The definition of the `GitlabIntegrationType` object. enum: - Gitlab example: Gitlab type: string x-enum-varnames: - GITLAB GitlabIntegrationUpdate: description: The definition of the `GitlabIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/GitlabCredentialsUpdate" type: $ref: "#/components/schemas/GitlabIntegrationType" required: - type type: object GlobalAnnotationIds: description: List of annotation IDs that apply to the entire page rather than a specific widget. example: - "00000000-0000-0000-0000-000000000001" items: description: Annotation ID. format: uuid type: string type: array GlobalIncidentSettingsAttributesRequest: description: Global incident settings attributes properties: analytics_dashboard_id: description: The analytics dashboard ID example: abc-123-def type: string type: object GlobalIncidentSettingsAttributesResponse: description: Global incident settings attributes properties: analytics_dashboard_id: description: The analytics dashboard ID example: abc-123-def type: string created: description: Timestamp when the settings were created example: "2026-01-13T17:15:56.557278191Z" format: date-time type: string modified: description: Timestamp when the settings were last modified example: "2026-01-13T17:15:56.557278191Z" format: date-time type: string required: - created - modified - analytics_dashboard_id type: object GlobalIncidentSettingsDataRequest: description: Data object in the global incident settings request. properties: attributes: $ref: "#/components/schemas/GlobalIncidentSettingsAttributesRequest" type: $ref: "#/components/schemas/GlobalIncidentSettingsType" required: - type type: object GlobalIncidentSettingsDataResponse: description: Data object in the global incident settings response. properties: attributes: $ref: "#/components/schemas/GlobalIncidentSettingsAttributesResponse" id: description: The unique identifier for the global incident settings example: f8b9a915-ed85-48b4-9071-ceba567a3db5 type: string type: $ref: "#/components/schemas/GlobalIncidentSettingsType" required: - id - type - attributes type: object GlobalIncidentSettingsRequest: description: Request payload for updating global incident settings. properties: data: $ref: "#/components/schemas/GlobalIncidentSettingsDataRequest" required: - data type: object GlobalIncidentSettingsResponse: description: Response payload containing global incident settings. properties: data: $ref: "#/components/schemas/GlobalIncidentSettingsDataResponse" required: - data type: object GlobalIncidentSettingsType: description: Global incident settings resource type enum: - incidents_global_settings example: incidents_global_settings type: string x-enum-varnames: - INCIDENTS_GLOBAL_SETTINGS GlobalOrg: description: Organization information for a global organization association. properties: name: description: The name of the organization. example: Example Org type: string public_id: description: The public identifier of the organization. example: abcdef12345 nullable: true type: string subdomain: description: The subdomain used to access the organization, if configured. example: example nullable: true type: string uuid: description: The UUID of the organization. example: "13d10a96-6ff2-49be-be7b-4f56ebb13335" format: uuid type: string required: - uuid - name type: object GlobalOrgAttributes: description: Attributes of an organization associated with the authenticated user. properties: org: $ref: "#/components/schemas/GlobalOrg" redirect_url: description: The login URL used to switch into the organization, if available. example: "https://app.datadoghq.com/account/login/password?dd_oid=13d10a96-6ff2-49be-be7b-4f56ebb13335&login_hint=user%40example.com" nullable: true type: string source_region: description: The source region of the organization. example: us1.prod.dog type: string user: $ref: "#/components/schemas/GlobalOrgUser" required: - user - org - source_region type: object GlobalOrgData: description: An organization associated with the authenticated user. properties: attributes: $ref: "#/components/schemas/GlobalOrgAttributes" type: $ref: "#/components/schemas/GlobalOrgType" required: - type - attributes type: object GlobalOrgIdentifier: description: A unique identifier for an organization including its site. properties: org_site: description: The site of the organization. example: "us1" type: string org_uuid: description: The UUID of the organization. example: "c3d4e5f6-a7b8-9012-cdef-012345678901" format: uuid type: string required: - org_uuid - org_site type: object GlobalOrgType: description: The resource type for global user organizations. enum: [global_user_orgs] example: global_user_orgs type: string x-enum-varnames: - GLOBAL_USER_ORGS GlobalOrgUser: description: User information for a global organization association. properties: handle: description: The handle of the user. example: user@example.com type: string uuid: description: The UUID of the user. example: "cfab5cf9-5472-48ea-a79c-a64045f4f745" format: uuid type: string required: - uuid - handle type: object GlobalOrgsLinks: description: Pagination links. properties: next: description: Link to the next page. example: "https://app.datadoghq.com/api/v2/global_orgs?user_handle=user@example.com&page[limit]=100&page[cursor]=next-page" nullable: true type: string prev: description: Link to the previous page. nullable: true type: string self: description: Link to the current page. example: "https://app.datadoghq.com/api/v2/global_orgs?user_handle=user@example.com&page[limit]=100" type: string type: object GlobalOrgsMeta: description: Response metadata object. properties: page: $ref: "#/components/schemas/GlobalOrgsMetaPage" type: object GlobalOrgsMetaPage: description: Paging attributes. properties: cursor: description: The cursor used to get the current results, if any. example: "" type: string limit: description: Number of results returned. example: 100 format: int32 maximum: 1000 type: integer next_cursor: description: The cursor used to get the next results, if any. example: next-page nullable: true type: string prev_cursor: description: The cursor used to get the previous results, if any. nullable: true type: string type: $ref: "#/components/schemas/GlobalOrgsMetaPageType" type: object GlobalOrgsMetaPageType: description: Type of global orgs pagination. enum: [cursor] example: cursor type: string x-enum-varnames: - CURSOR GlobalOrgsResponse: description: Response containing organizations across regions for the authenticated user. properties: data: description: Organizations across regions for the authenticated user. items: $ref: "#/components/schemas/GlobalOrgData" type: array links: $ref: "#/components/schemas/GlobalOrgsLinks" meta: $ref: "#/components/schemas/GlobalOrgsMeta" required: - data type: object GlobalVariableData: description: Synthetics global variable data. Wrapper around the global variable object. properties: attributes: $ref: "#/components/schemas/SyntheticsGlobalVariable" id: description: Global variable identifier. type: string type: $ref: "#/components/schemas/GlobalVariableType" type: object GlobalVariableJsonPatchRequest: description: JSON Patch request for global variable. properties: data: $ref: "#/components/schemas/GlobalVariableJsonPatchRequestData" required: - data type: object GlobalVariableJsonPatchRequestData: description: Data object for a JSON Patch request on a Synthetic global variable. properties: attributes: $ref: "#/components/schemas/GlobalVariableJsonPatchRequestDataAttributes" type: $ref: "#/components/schemas/GlobalVariableJsonPatchType" type: object GlobalVariableJsonPatchRequestDataAttributes: description: Attributes for a JSON Patch request on a Synthetic global variable. properties: json_patch: description: JSON Patch operations following RFC 6902. items: $ref: "#/components/schemas/JsonPatchOperation" type: array type: object GlobalVariableJsonPatchType: description: Global variable JSON Patch type. enum: - global_variables_json_patch type: string x-enum-varnames: - GLOBAL_VARIABLES_JSON_PATCH GlobalVariableResponse: description: Global variable response. properties: data: $ref: "#/components/schemas/GlobalVariableData" type: object GlobalVariableType: description: Global variable type. enum: - global_variables type: string x-enum-varnames: - GLOBAL_VARIABLES GoogleChatAppNamedSpaceResponse: description: Response with Google Chat space information. properties: data: $ref: "#/components/schemas/GoogleChatAppNamedSpaceResponseData" required: - data type: object GoogleChatAppNamedSpaceResponseAttributes: description: Google Chat space attributes. properties: display_name: description: Google space display name. example: "Fake Space Name" maxLength: 255 type: string organization_binding_id: description: Organization binding ID. example: "2f18a894-adb5-4c53-8248-39fd3f5386a5" maxLength: 255 type: string resource_name: description: Google space resource name. example: "spaces/AAAAAAAAA" maxLength: 255 type: string space_uri: description: Google space URI. example: "https://chat.google.com/room/AAAAAAAAA" maxLength: 255 type: string type: object GoogleChatAppNamedSpaceResponseData: description: Google Chat space data from a response. properties: attributes: $ref: "#/components/schemas/GoogleChatAppNamedSpaceResponseAttributes" id: description: The ID of the Google Chat space. example: "596da4af-0563-4097-90ff-07230c3f9db3" maxLength: 100 minLength: 1 type: string type: $ref: "#/components/schemas/GoogleChatAppNamedSpaceType" type: object GoogleChatAppNamedSpaceType: default: google-chat-app-named-space description: Google Chat space resource type. enum: - google-chat-app-named-space example: google-chat-app-named-space type: string x-enum-varnames: - GOOGLE_CHAT_APP_NAMED_SPACE_TYPE GoogleChatCreateOrganizationHandleRequest: description: Create organization handle request. properties: data: $ref: "#/components/schemas/GoogleChatCreateOrganizationHandleRequestData" type: $ref: "#/components/schemas/GoogleChatOrganizationHandleType" required: - type - data type: object GoogleChatCreateOrganizationHandleRequestAttributes: description: Organization handle attributes for a create request. properties: name: description: Organization handle name. example: "fake-handle-name" maxLength: 255 type: string space_resource_name: description: Google space resource name. example: "spaces/AAAAAAAAA" maxLength: 255 type: string required: - name - space_resource_name type: object GoogleChatCreateOrganizationHandleRequestData: description: Organization handle data for a create request. properties: attributes: $ref: "#/components/schemas/GoogleChatCreateOrganizationHandleRequestAttributes" required: - attributes type: object GoogleChatDelegatedUserAttributes: description: Google Chat delegated user attributes. properties: display_name: description: The delegated user's display name. example: "fake-display-name" type: string email: description: The delegated user's email address. example: "user@example.com" type: string features: description: The list of features enabled for the delegated user. items: type: string type: array type: object GoogleChatDelegatedUserData: description: Google Chat delegated user data from a response. properties: attributes: $ref: "#/components/schemas/GoogleChatDelegatedUserAttributes" id: description: The ID of the delegated user. example: "2b3c4d5e-6f78-9012-bcde-f23456789012" maxLength: 100 minLength: 1 type: string type: $ref: "#/components/schemas/GoogleChatDelegatedUserType" type: object GoogleChatDelegatedUserResponse: description: Response containing a Google Chat delegated user. properties: data: $ref: "#/components/schemas/GoogleChatDelegatedUserData" required: - data type: object GoogleChatDelegatedUserType: default: google-chat-delegated-user description: Google Chat delegated user resource type. enum: - google-chat-delegated-user example: google-chat-delegated-user type: string x-enum-varnames: - GOOGLE_CHAT_DELEGATED_USER_TYPE GoogleChatOrganizationAttributes: description: Google Chat organization attributes. properties: domain_id: description: The Google Chat organization domain ID. example: "fake-domain-id" maxLength: 255 type: string domain_name: description: The Google Chat organization domain name. example: "example.com" maxLength: 255 type: string type: object GoogleChatOrganizationData: description: Google Chat organization data from a response. properties: attributes: $ref: "#/components/schemas/GoogleChatOrganizationAttributes" id: description: The ID of the Google Chat organization binding. example: "5ce87709-a12f-4086-fcc8-147045b73a19" maxLength: 100 minLength: 1 type: string relationships: $ref: "#/components/schemas/GoogleChatOrganizationRelationships" type: $ref: "#/components/schemas/GoogleChatOrganizationType" type: object GoogleChatOrganizationHandleResponse: description: Organization handle for monitor notifications to a Google Chat space within a Google organization. properties: data: $ref: "#/components/schemas/GoogleChatOrganizationHandleResponseData" required: - data type: object GoogleChatOrganizationHandleResponseAttributes: description: Organization handle attributes. properties: name: description: Organization handle name. example: "fake-handle-name" maxLength: 255 type: string space_display_name: description: Google space display name. example: "Fake Space Name" maxLength: 255 type: string space_resource_name: description: Google space resource name. example: "spaces/AAAAAAAAA" maxLength: 255 type: string type: object GoogleChatOrganizationHandleResponseData: description: Organization handle data from a response. properties: attributes: $ref: "#/components/schemas/GoogleChatOrganizationHandleResponseAttributes" id: description: The ID of the organization handle. example: "596da4af-0563-4097-90ff-07230c3f9db3" maxLength: 100 minLength: 1 type: string type: $ref: "#/components/schemas/GoogleChatOrganizationHandleType" type: object GoogleChatOrganizationHandleType: default: google-chat-organization-handle description: Organization handle resource type. enum: - google-chat-organization-handle example: google-chat-organization-handle type: string x-enum-varnames: - GOOGLE_CHAT_ORGANIZATION_HANDLE_TYPE GoogleChatOrganizationHandlesResponse: description: List of organization handles for monitor notifications to Google Chat spaces within a Google organization. properties: data: description: An array of organization handles. example: [{"attributes": {"name": "general-handle", "space_display_name": "General", "space_resource_name": "spaces/AAAAAAAAA"}, "id": "596da4af-0563-4097-90ff-07230c3f9db3", "type": "google-chat-organization-handle"}, {"attributes": {"name": "general-handle-2", "space_display_name": "General2", "space_resource_name": "spaces/BBBBBBBBB"}, "id": "596da4af-0563-4097-90ff-07230c3f9db4", "type": "google-chat-organization-handle"}] items: $ref: "#/components/schemas/GoogleChatOrganizationHandleResponseData" type: array required: - data type: object GoogleChatOrganizationRelationships: description: Google Chat organization relationships. properties: delegated_user: $ref: "#/components/schemas/GoogleChatOrganizationRelationshipsDelegatedUser" type: object GoogleChatOrganizationRelationshipsDelegatedUser: description: The delegated user relationship. properties: data: $ref: "#/components/schemas/GoogleChatOrganizationRelationshipsDelegatedUserData" type: object GoogleChatOrganizationRelationshipsDelegatedUserData: description: Delegated user relationship data. properties: id: description: The ID of the delegated user. example: "2b3c4d5e-6f78-9012-bcde-f23456789012" type: string type: $ref: "#/components/schemas/GoogleChatDelegatedUserType" type: object GoogleChatOrganizationResponse: description: Response containing a Google Chat organization binding. properties: data: $ref: "#/components/schemas/GoogleChatOrganizationData" required: - data type: object GoogleChatOrganizationType: default: google-chat-organization description: Google Chat organization resource type. enum: - google-chat-organization example: google-chat-organization type: string x-enum-varnames: - GOOGLE_CHAT_ORGANIZATION_TYPE GoogleChatOrganizationsResponse: description: Response containing a list of Google Chat organization bindings. properties: data: description: An array of Google Chat organization bindings. items: $ref: "#/components/schemas/GoogleChatOrganizationData" type: array required: - data type: object GoogleChatTargetAudienceAttributes: description: Google Chat target audience attributes. properties: audience_id: description: The audience ID. example: "fake-audience-id-1" maxLength: 255 type: string audience_name: description: The audience name. example: "fake audience name 1" maxLength: 255 type: string required: - audience_name - audience_id type: object GoogleChatTargetAudienceCreateRequest: description: Create target audience request. properties: data: $ref: "#/components/schemas/GoogleChatTargetAudienceCreateRequestData" required: - data type: object GoogleChatTargetAudienceCreateRequestAttributes: description: Attributes for creating a Google Chat target audience. properties: audience_id: description: The audience ID. example: "fake-audience-id-1" maxLength: 255 type: string audience_name: description: The audience name. example: "fake audience name 1" maxLength: 255 type: string required: - audience_name - audience_id type: object GoogleChatTargetAudienceCreateRequestData: description: Data for a create target audience request. properties: attributes: $ref: "#/components/schemas/GoogleChatTargetAudienceCreateRequestAttributes" type: $ref: "#/components/schemas/GoogleChatTargetAudienceType" required: - type - attributes type: object GoogleChatTargetAudienceData: description: Google Chat target audience data from a response. properties: attributes: $ref: "#/components/schemas/GoogleChatTargetAudienceAttributes" id: description: The ID of the target audience. example: "1f3e5ce6-944a-4075-97ae-105b5920b5cb" maxLength: 100 minLength: 1 type: string type: $ref: "#/components/schemas/GoogleChatTargetAudienceType" type: object GoogleChatTargetAudienceResponse: description: Response containing a Google Chat target audience. properties: data: $ref: "#/components/schemas/GoogleChatTargetAudienceData" required: - data type: object GoogleChatTargetAudienceType: default: google-chat-target-audience description: Google Chat target audience resource type. enum: - google-chat-target-audience example: google-chat-target-audience type: string x-enum-varnames: - GOOGLE_CHAT_TARGET_AUDIENCE_TYPE GoogleChatTargetAudienceUpdateRequest: description: Update target audience request. properties: data: $ref: "#/components/schemas/GoogleChatTargetAudienceUpdateRequestData" required: - data type: object GoogleChatTargetAudienceUpdateRequestAttributes: description: Attributes for updating a Google Chat target audience. properties: audience_id: description: The audience ID. example: "fake-audience-id-1" maxLength: 255 type: string audience_name: description: The audience name. example: "fake audience name 1" maxLength: 255 type: string type: object GoogleChatTargetAudienceUpdateRequestData: description: Data for an update target audience request. properties: attributes: $ref: "#/components/schemas/GoogleChatTargetAudienceUpdateRequestAttributes" type: $ref: "#/components/schemas/GoogleChatTargetAudienceType" required: - type - attributes type: object GoogleChatTargetAudiencesResponse: description: Response containing a list of Google Chat target audiences. properties: data: description: An array of Google Chat target audiences. items: $ref: "#/components/schemas/GoogleChatTargetAudienceData" type: array required: - data type: object GoogleChatUpdateOrganizationHandleRequest: description: Update organization handle request. properties: data: $ref: "#/components/schemas/GoogleChatUpdateOrganizationHandleRequestData" type: $ref: "#/components/schemas/GoogleChatOrganizationHandleType" required: - type - data type: object GoogleChatUpdateOrganizationHandleRequestAttributes: description: Organization handle attributes for an update request. properties: name: description: Organization handle name. example: "fake-handle-name" maxLength: 255 type: string space_resource_name: description: Google space resource name. example: "spaces/AAAAAAAAA" maxLength: 255 type: string type: object GoogleChatUpdateOrganizationHandleRequestData: description: Organization handle data for an update request. properties: attributes: $ref: "#/components/schemas/GoogleChatUpdateOrganizationHandleRequestAttributes" required: - attributes type: object GoogleDocsPostmortemSettings: description: Settings for a postmortem template stored in Google Docs. Required when `location` is `google_docs`. properties: account_id: description: The ID of the Google Drive integration account. example: "123456" type: string parent_folder_id: description: The ID of the Google Drive folder where postmortems are created. example: "789012" type: string required: - account_id - parent_folder_id type: object GoogleMeetConfigurationReference: description: A reference to a Google Meet Configuration resource. nullable: true properties: data: $ref: "#/components/schemas/GoogleMeetConfigurationReferenceData" required: - data type: object GoogleMeetConfigurationReferenceData: description: The Google Meet configuration relationship data object. nullable: true properties: id: description: The unique identifier of the Google Meet configuration. example: "00000000-0000-0000-0000-000000000000" type: string type: description: The type of the Google Meet configuration. example: "google_meet_configurations" type: string required: - id - type type: object GovernanceConfigAttributes: description: The attributes of a Governance Console configuration. properties: assignment_notifications_enabled: description: Whether notifications are sent to users when detections are assigned to them. example: true type: boolean enabled: description: Whether the Governance Console is enabled for the organization. example: true type: boolean usage_attribution_configured: description: Whether usage attribution is configured for the organization. example: true type: boolean xorg_insights_enabled: description: |- Whether the organization has opted in to sharing governance data with a managing org for cross-org insights. example: true type: boolean required: - enabled - assignment_notifications_enabled - usage_attribution_configured - xorg_insights_enabled type: object GovernanceConfigData: description: A Governance Console configuration resource. properties: attributes: $ref: "#/components/schemas/GovernanceConfigAttributes" id: description: |- The unique identifier of the organization the Governance Console configuration applies to. May be the nil UUID (`00000000-0000-0000-0000-000000000000`) when the configuration is not tied to a specific organization record. example: "00000000-0000-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/GovernanceConsoleConfigResourceType" required: - id - type - attributes type: object GovernanceConfigResponse: description: The Governance Console configuration for an organization. properties: data: $ref: "#/components/schemas/GovernanceConfigData" required: - data type: object GovernanceConsoleConfigResourceType: description: Governance console config resource type. enum: - governance_console_config example: "governance_console_config" type: string x-enum-varnames: - GOVERNANCE_CONSOLE_CONFIG GovernanceControlAttributes: description: The attributes of a governance control. properties: active_detections_count: description: The number of active detections for the control. example: 12 format: int64 type: integer category: description: The value driver the control is grouped under, such as `security` or `cost`. example: "security" type: string created_at: description: The time the control configuration was created. example: "2024-01-15T09:30:00Z" format: date-time type: string created_by: description: The UUID of the user who created the control configuration. example: "11111111-2222-3333-4444-555555555555" type: string description: description: A human-readable description of what the control detects. example: "Identifies API keys that have not been used within your specified time threshold, helping reduce security risks from dormant credentials." type: string detection_parameters: $ref: "#/components/schemas/GovernanceControlParametersMap" nullable: true insights: description: The insight slugs associated with the control. example: [] items: description: An insight slug associated with the control. type: string type: array last_detection_at: description: The time of the most recent detection for the control. `null` when there are no detections. example: "2024-03-01T12:00:00Z" format: date-time nullable: true type: string mitigated_detections_count: description: The number of mitigated detections for the control. example: 3 format: int64 type: integer mitigation_parameters: $ref: "#/components/schemas/GovernanceControlParametersMap" nullable: true mitigation_type: description: The configured mitigation type for the control. Empty when not configured. example: "revoke_api_key" type: string mitigations: $ref: "#/components/schemas/GovernanceControlMitigationDefinitionArray" name: description: Human-readable name of the control. example: "Unused API Keys" type: string priority: description: The priority of the control, such as `High`. example: "High" type: string product: description: The product the control belongs to. example: "api_keys" type: string resource_type: description: The type of resource the control evaluates. example: "api_key" type: string resource_type_display_name: description: The human-readable name of the resource type. example: "API Key" type: string supported_detection_parameters: $ref: "#/components/schemas/GovernanceControlParameterDefinitionArray" type: description: The control type, such as `Proactive` or `Detection`. example: "Proactive" type: string required: - name - description - supported_detection_parameters - resource_type - resource_type_display_name - product - category - insights - mitigations - type - priority - detection_parameters - mitigation_type - mitigation_parameters - created_at - created_by - active_detections_count - mitigated_detections_count - last_detection_at type: object GovernanceControlData: description: A governance control resource. properties: attributes: $ref: "#/components/schemas/GovernanceControlAttributes" id: description: The detection type that uniquely identifies the control. example: "unused_api_keys" type: string type: $ref: "#/components/schemas/GovernanceControlResourceType" required: - id - type - attributes type: object GovernanceControlDetectionAssignmentSource: description: How the detection's current assignment was determined. Possible values are `auto_resolved`, `manual`, `reassigned`, and `cleared`. enum: - auto_resolved - manual - reassigned - cleared example: "manual" type: string x-enum-varnames: - AUTO_RESOLVED - MANUAL - REASSIGNED - CLEARED GovernanceControlDetectionAttributes: description: The attributes of a governance control detection. properties: assigned_team: description: The identifier of the team the detection is assigned to, if any. example: "platform-security" type: string assigned_to: description: The identifier of the user the detection is assigned to, if any. example: "11111111-2222-3333-4444-555555555555" type: string assignment_source: $ref: "#/components/schemas/GovernanceControlDetectionAssignmentSource" control_id: deprecated: true description: |- DEPRECATED: mirrors `detection_type` for backward compatibility; use `detection_type` instead. example: "unused_api_keys" type: string created_at: description: The date and time when the detection was created. example: "2024-03-01T12:00:00Z" format: date-time type: string detection_type: description: The type of detection, which determines what condition was detected. example: "unused_api_keys" type: string display_name: description: The human-readable name of the detected resource. example: "CI Deploy Key" type: string exception_at: description: The date and time when the detection was marked as an exception, if applicable. example: "2024-03-05T09:00:00Z" format: date-time type: string exception_by: description: The identifier of the user who marked the detection as an exception, if applicable. example: "11111111-2222-3333-4444-555555555555" type: string metadata: description: Free-form metadata associated with the detection. example: region: "us-east-1" mitigate_after: description: The date and time after which the detection is scheduled to be mitigated, if applicable. example: "2024-03-15T00:00:00Z" format: date-time type: string mitigated_at: description: The date and time when the detection was mitigated, if applicable. example: "2024-03-10T15:30:00Z" format: date-time type: string priority: description: The priority of the detection, if set. example: 1 format: int64 type: integer resource_id: description: The identifier of the resource the detection applies to. example: "api-key-12345" type: string resource_type: description: The type of resource the detection applies to, for example `api_key` or `dashboard`. example: "api_key" type: string state: $ref: "#/components/schemas/GovernanceControlDetectionState" required: - state - control_id - resource_id - detection_type - resource_type - display_name - created_at - assignment_source - priority type: object GovernanceControlDetectionData: description: A governance control detection resource. properties: attributes: $ref: "#/components/schemas/GovernanceControlDetectionAttributes" id: description: The unique identifier of the detection. example: "3f9b2c1a-8d4e-4a6b-9c2f-1e7d5a0b3c4d" type: string type: $ref: "#/components/schemas/GovernanceControlDetectionResourceType" required: - id - type - attributes type: object GovernanceControlDetectionResourceType: description: Governance control detection resource type. enum: - governance_control_detection example: "governance_control_detection" type: string x-enum-varnames: - GOVERNANCE_CONTROL_DETECTION GovernanceControlDetectionResponse: description: A single governance control detection. properties: data: $ref: "#/components/schemas/GovernanceControlDetectionData" required: - data type: object GovernanceControlDetectionState: description: The current state of the detection. Possible values are `active`, `exception`, `mitigated`, `inactive`, `obsolete`, `resolved_externally`, and `mitigation_in_progress`. enum: - active - exception - mitigated - inactive - obsolete - resolved_externally - mitigation_in_progress example: "active" type: string x-enum-varnames: - ACTIVE - EXCEPTION - MITIGATED - INACTIVE - OBSOLETE - RESOLVED_EXTERNALLY - MITIGATION_IN_PROGRESS GovernanceControlDetectionUpdateAttributes: description: The attributes of a governance control detection that can be updated. Only the attributes present in the request are modified. properties: assigned_team: description: The handle of the team the detection is assigned to. Set to an empty string to clear the assignment. example: "platform-security" type: string assigned_to: description: The UUID of the user the detection is assigned to. Set to an empty string to clear the assignment. example: "11111111-2222-3333-4444-555555555555" type: string mitigate_after: description: The timestamp after which the detection becomes eligible for mitigation. Used to defer mitigation to a later time. example: "2024-03-15T00:00:00Z" format: date-time type: string state: $ref: "#/components/schemas/GovernanceControlDetectionUpdateState" type: object GovernanceControlDetectionUpdateData: description: The data of a governance control detection update request. properties: attributes: $ref: "#/components/schemas/GovernanceControlDetectionUpdateAttributes" type: $ref: "#/components/schemas/GovernanceControlDetectionResourceType" required: - type type: object GovernanceControlDetectionUpdateRequest: description: A request to update a governance control detection. properties: data: $ref: "#/components/schemas/GovernanceControlDetectionUpdateData" required: - data type: object GovernanceControlDetectionUpdateState: description: The new state to set for the detection. Set to `exception` to acknowledge the detection and exclude it from active counts, or `active` to reopen it. enum: - exception - active example: "exception" type: string x-enum-varnames: - EXCEPTION - ACTIVE GovernanceControlDetectionsDataArray: description: An array of governance control detection resources. items: $ref: "#/components/schemas/GovernanceControlDetectionData" type: array GovernanceControlDetectionsResponse: description: A list of governance control detections. properties: data: $ref: "#/components/schemas/GovernanceControlDetectionsDataArray" required: - data type: object GovernanceControlMitigationDefinition: description: The definition of a mitigation available for a control. properties: description: description: A human-readable description of the mitigation. example: "Automatically identifies and revokes inactive API keys to improve security and reduce potential attack surface." type: string execution_modes: description: The execution modes the mitigation supports, such as `manual` or `automatic`. example: - "manual" - "automatic" items: description: An execution mode the mitigation supports. type: string type: array id: description: The unique identifier of the mitigation. example: "revoke_api_key" type: string permissions: description: The permissions required to apply the mitigation. example: - "api_keys_write" - "api_keys_delete" items: description: A permission required to apply the mitigation. type: string type: array supported_parameters: $ref: "#/components/schemas/GovernanceControlParameterDefinitionArray" title: description: A short, human-readable name for the mitigation. example: "Revoke Unused API Keys" type: string required: - id - title - description - supported_parameters - permissions - execution_modes type: object GovernanceControlMitigationDefinitionArray: description: The mitigations available for a control. items: $ref: "#/components/schemas/GovernanceControlMitigationDefinition" type: array GovernanceControlParameterDefinition: description: The definition of a configurable parameter on a control or mitigation. properties: default_value: description: The default value of the parameter. The JSON type depends on the parameter's `type`. `null` when the parameter has no default. example: 30 nullable: true description: description: A human-readable description of the parameter. example: "Number of days of inactivity before an API key is considered unused." type: string display_name: description: The human-readable name of the parameter. example: "Unused API Key Threshold" type: string name: description: The machine-readable name of the parameter. example: "api_key_threshold" type: string required: description: Whether the parameter must be provided. example: false type: boolean supported_values: $ref: "#/components/schemas/GovernanceControlSupportedValueArray" type: description: The type of the parameter, such as `integer`, `string`, `boolean`, `enum`, or `pattern_list`. example: "integer" type: string required: - name - display_name - description - type - required - supported_values - default_value type: object GovernanceControlParameterDefinitionArray: description: An array of parameter definitions. items: $ref: "#/components/schemas/GovernanceControlParameterDefinition" type: array GovernanceControlParametersMap: additionalProperties: {} description: A free-form map of parameter names to their configured values. type: object GovernanceControlResourceType: description: JSON:API resource type for a governance control. enum: - governance_control example: "governance_control" type: string x-enum-varnames: - GOVERNANCE_CONTROL GovernanceControlResponse: description: A single governance control. properties: data: $ref: "#/components/schemas/GovernanceControlData" required: - data type: object GovernanceControlSupportedValue: description: A supported value for an enumerated parameter. properties: label: description: The human-readable label for the value. example: "30 days" type: string value: description: The machine-readable value. example: "thirty" type: string required: - value - label type: object GovernanceControlSupportedValueArray: description: The supported values for an enumerated parameter. `null` when the parameter is not an enumerated type. items: $ref: "#/components/schemas/GovernanceControlSupportedValue" nullable: true type: array GovernanceControlUpdateAttributes: description: The attributes of a governance control that can be updated. Only the attributes present in the request are modified. properties: detection_parameters: $ref: "#/components/schemas/GovernanceControlParametersMap" nullable: true mitigation_parameters: $ref: "#/components/schemas/GovernanceControlParametersMap" nullable: true mitigation_type: description: The mitigation type to configure for the control. example: "revoke_api_key" type: string type: object GovernanceControlUpdateData: description: The data of a governance control update request. properties: attributes: $ref: "#/components/schemas/GovernanceControlUpdateAttributes" type: $ref: "#/components/schemas/GovernanceControlResourceType" required: - type type: object GovernanceControlUpdateRequest: description: A request to update a governance control. properties: data: $ref: "#/components/schemas/GovernanceControlUpdateData" required: - data type: object GovernanceControlsDataArray: description: An array of governance control resources. items: $ref: "#/components/schemas/GovernanceControlData" type: array GovernanceControlsResponse: description: A list of governance controls. properties: data: $ref: "#/components/schemas/GovernanceControlsDataArray" required: - data type: object GovernanceInsightAttributes: description: |- The attributes of a governance insight. Exactly one of `metric_query`, `event_query`, `usage_query`, `audit_query`, or `percentage_query` is populated, depending on the data source the insight is computed from; the rest are `null`. properties: audit_query: $ref: "#/components/schemas/GovernanceInsightAuditQuery" nullable: true description: description: A human-readable description of what the insight measures. example: "Number of users who have used the Dashboard in the last 30 days" type: string display_name: description: Human-readable name of the insight. example: "Active Dashboards" type: string event_query: $ref: "#/components/schemas/GovernanceInsightEventQuery" nullable: true metric_query: $ref: "#/components/schemas/GovernanceInsightMetricQuery" nullable: true percentage_query: $ref: "#/components/schemas/GovernanceInsightPercentageQuery" nullable: true product: description: The product the insight belongs to. example: "Usage" type: string query_config: $ref: "#/components/schemas/GovernanceInsightQueryConfig" nullable: true sub_product: description: The sub-product the insight belongs to, if any. example: "Indexes" type: string time_range: description: The time range the insight value is computed over, if applicable. example: "month" type: string unit_name: description: The unit that the insight's value is measured in. example: "active dashboards" type: string usage_query: $ref: "#/components/schemas/GovernanceInsightUsageQuery" nullable: true required: - display_name - product - sub_product - unit_name - description - time_range type: object GovernanceInsightAuditCompute: description: The aggregation applied to an audit log query. properties: aggregation: description: The aggregation function to apply. example: "cardinality" type: string interval: description: The aggregation time window, in milliseconds. example: 86400000 format: int64 type: integer metric: description: The metric or attribute to aggregate. example: "@usr.id" type: string rollup: description: An optional secondary aggregation applied to the audit query result. example: "" type: string required: - aggregation - metric - interval type: object GovernanceInsightAuditQuery: description: An audit log query used to compute an insight value. properties: compute: $ref: "#/components/schemas/GovernanceInsightAuditCompute" indexes: description: The audit log indexes the query runs against. example: - "main" items: description: An audit log index name. type: string type: array query: description: The audit log search query string. example: "@evt.name:Dashboard" type: string source: description: The data source the query runs against. example: "audit" type: string required: - source - query - indexes - compute type: object GovernanceInsightData: description: A governance insight resource. properties: attributes: $ref: "#/components/schemas/GovernanceInsightAttributes" id: description: The unique identifier of the insight. example: "498ee21f-8037-48b8-a961-a488692902f4" type: string type: $ref: "#/components/schemas/GovernanceInsightResourceType" required: - id - type - attributes type: object GovernanceInsightDirectionality: description: Whether an increase in the insight's value is good, bad, or neutral. enum: - neutral - increase_better - decrease_better example: "neutral" type: string x-enum-varnames: - NEUTRAL - INCREASE_BETTER - DECREASE_BETTER GovernanceInsightEventCompute: description: The aggregation applied to an event query. properties: aggregation: description: The aggregation function to apply. example: "count" type: string interval: description: The aggregation time window, in milliseconds. example: 86400000 format: int64 type: integer required: - aggregation - interval type: object GovernanceInsightEventQuery: description: An event query used to compute an insight value. properties: compute: $ref: "#/components/schemas/GovernanceInsightEventCompute" nullable: true indexes: description: The event indexes the query runs against. example: - "main" items: description: An event index name. type: string type: array query: description: The event search query string. example: "source:cloudtrail" type: string required: - query - indexes type: object GovernanceInsightMetricQuery: description: A metric query used to compute an insight value. properties: query: description: The query string. example: "avg:system.cpu.user{*}" type: string reducer: description: How the query result series is reduced to a single value. example: "avg" type: string source: description: The data source the query runs against. example: "metrics" type: string required: - source - query - reducer type: object GovernanceInsightPercentageQuery: description: A percentage query that computes an insight value as a ratio of two metric queries. properties: denominator_query: $ref: "#/components/schemas/GovernanceInsightMetricQuery" numerator_query: $ref: "#/components/schemas/GovernanceInsightMetricQuery" required: - numerator_query - denominator_query type: object GovernanceInsightQueryConfig: description: Query execution context for running insight queries directly. properties: chart_type: description: The chart type used to render the insight. example: "line" type: string comparison_shift: description: The window used for the previous value comparison; for example, `week` or `month`. example: "month" type: string default_value: description: The default value to display when no data is available. example: 0 format: int64 type: integer directionality: $ref: "#/components/schemas/GovernanceInsightDirectionality" effective_time_window_days: description: The number of days the insight value is computed over. example: 30 format: int64 type: integer required: - effective_time_window_days - comparison_shift type: object GovernanceInsightResourceType: description: JSON:API resource type for a governance insight. enum: - insight example: "insight" type: string x-enum-varnames: - INSIGHT GovernanceInsightUsageQuery: description: A usage query used to compute an insight value. properties: query: description: The usage query string. example: "logs_indexed_events" type: string reducer: description: How the query result series is reduced to a single value. example: "sum" type: string required: - query - reducer type: object GovernanceInsightsDataArray: description: An array of governance insight resources. items: $ref: "#/components/schemas/GovernanceInsightData" type: array GovernanceInsightsResponse: description: A list of governance insights. properties: data: $ref: "#/components/schemas/GovernanceInsightsDataArray" required: - data type: object GovernanceMitigationRequest: description: A request to mitigate a set of governance detections. properties: data: $ref: "#/components/schemas/GovernanceMitigationRequestData" required: - data type: object GovernanceMitigationRequestAttributes: description: The attributes of a governance mitigation request. properties: detection_ids: description: The identifiers of the detections to mitigate in this request. example: - "3f9b2c1a-8d4e-4a6b-9c2f-1e7d5a0b3c4d" items: description: The identifier of a detection to mitigate in this request. type: string type: array detection_type: description: The detection type whose detections should be mitigated. example: "unused_api_keys" type: string mitigation_parameters: $ref: "#/components/schemas/GovernanceControlParametersMap" nullable: true mitigation_type: description: The mitigation to apply to the selected detections. Defaults to the control's configured mitigation when omitted. example: "revoke_api_key" type: string required: - detection_type - detection_ids type: object GovernanceMitigationRequestData: description: The data of a governance mitigation request. properties: attributes: $ref: "#/components/schemas/GovernanceMitigationRequestAttributes" type: $ref: "#/components/schemas/GovernanceControlDetectionResourceType" required: - type type: object GovernanceNotificationSettingsAttributes: description: The attributes of the organization-wide governance notification settings. properties: assignment_notifications_enabled: description: Whether notifications are sent to users when detections are assigned to them. example: true type: boolean required: - assignment_notifications_enabled type: object GovernanceNotificationSettingsData: description: A governance notification settings resource. properties: attributes: $ref: "#/components/schemas/GovernanceNotificationSettingsAttributes" id: description: The unique identifier of the organization the notification settings apply to. example: "11111111-2222-3333-4444-555555555555" type: string type: $ref: "#/components/schemas/GovernanceNotificationSettingsResourceType" required: - id - type - attributes type: object GovernanceNotificationSettingsResourceType: description: Governance notification settings resource type. enum: - governance_notification_settings example: "governance_notification_settings" type: string x-enum-varnames: - GOVERNANCE_NOTIFICATION_SETTINGS GovernanceNotificationSettingsResponse: description: The organization-wide governance notification settings. properties: data: $ref: "#/components/schemas/GovernanceNotificationSettingsData" required: - data type: object GovernanceNotificationSettingsUpdateAttributes: description: The attributes of the governance notification settings that can be updated. Only the attributes present in the request are modified. properties: assignment_notifications_enabled: description: Whether notifications are sent to users when detections are assigned to them. example: true type: boolean type: object GovernanceNotificationSettingsUpdateData: description: The data of a governance notification settings update request. properties: attributes: $ref: "#/components/schemas/GovernanceNotificationSettingsUpdateAttributes" type: $ref: "#/components/schemas/GovernanceNotificationSettingsResourceType" required: - type type: object GovernanceNotificationSettingsUpdateRequest: description: A request to update the organization-wide governance notification settings. properties: data: $ref: "#/components/schemas/GovernanceNotificationSettingsUpdateData" required: - data type: object GreyNoiseAPIKey: description: The definition of the `GreyNoiseAPIKey` object. properties: api_key: $ref: "#/components/schemas/GreyNoiseAPIKeyApiKey" type: $ref: "#/components/schemas/GreyNoiseAPIKeyType" required: - type - api_key type: object GreyNoiseAPIKeyApiKey: description: The `GreyNoiseAPIKey` `api_key`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" GreyNoiseAPIKeyType: description: The definition of the `GreyNoiseAPIKey` object. enum: - GreyNoiseAPIKey example: GreyNoiseAPIKey type: string x-enum-varnames: - GREYNOISEAPIKEY GreyNoiseAPIKeyUpdate: description: The definition of the `GreyNoiseAPIKey` object. properties: api_key: $ref: "#/components/schemas/GreyNoiseAPIKeyUpdateApiKey" type: $ref: "#/components/schemas/GreyNoiseAPIKeyType" required: - type type: object GreyNoiseAPIKeyUpdateApiKey: description: The `GreyNoiseAPIKeyUpdate` `api_key`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" GreyNoiseCredentials: description: The definition of the `GreyNoiseCredentials` object. oneOf: - $ref: "#/components/schemas/GreyNoiseAPIKey" GreyNoiseCredentialsUpdate: description: The definition of the `GreyNoiseCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/GreyNoiseAPIKeyUpdate" GreyNoiseIntegration: description: The definition of the `GreyNoiseIntegration` object. properties: credentials: $ref: "#/components/schemas/GreyNoiseCredentials" type: $ref: "#/components/schemas/GreyNoiseIntegrationType" required: - type - credentials type: object GreyNoiseIntegrationType: description: The definition of the `GreyNoiseIntegrationType` object. enum: - GreyNoise example: GreyNoise type: string x-enum-varnames: - GREYNOISE GreyNoiseIntegrationUpdate: description: The definition of the `GreyNoiseIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/GreyNoiseCredentialsUpdate" type: $ref: "#/components/schemas/GreyNoiseIntegrationType" required: - type type: object GroupScalarColumn: description: A column containing the tag keys and values in a group. properties: name: description: The name of the tag key or group. example: env type: string type: $ref: "#/components/schemas/ScalarColumnTypeGroup" values: description: The array of tag values for each group found for the results of the formulas or queries. example: [["production"], ["staging"]] items: description: An individual tag value for a given group column. items: description: One tag value within a values array. example: production type: string type: array type: array type: object GroupTags: description: List of tags that apply to a single response value. items: description: A single tag that applies to a single response value. example: "env:production" type: string type: array GuardrailMetric: description: Guardrail metric details. properties: metric_id: description: The metric ID to monitor. example: "metric-error-rate" type: string trigger_action: $ref: "#/components/schemas/GuardrailTriggerAction" triggered_by: description: The signal or system that triggered the action. example: "guardrail_monitor" nullable: true type: string required: - metric_id - trigger_action type: object GuardrailMetricRequest: description: Guardrail metric request payload. properties: metric_id: description: The metric ID to monitor. example: "metric-error-rate" type: string trigger_action: $ref: "#/components/schemas/GuardrailTriggerAction" required: - metric_id - trigger_action type: object GuardrailTriggerAction: description: Action to perform when a guardrail threshold is triggered. enum: - PAUSE - ABORT example: "PAUSE" type: string x-enum-varnames: - PAUSE - ABORT HTTPBody: description: The definition of `HTTPBody` object. properties: content: description: Serialized body content example: '{"some-json": "with-value"}' type: string content_type: description: Content type of the body example: application/json type: string type: object HTTPCDGatesBadRequestResponse: description: Bad request. properties: errors: description: Structured errors. items: $ref: "#/components/schemas/HTTPCIAppError" type: array type: object HTTPCDGatesNotFoundResponse: description: Deployment gate not found. properties: errors: description: Structured errors. items: $ref: "#/components/schemas/HTTPCIAppError" type: array type: object HTTPCDRulesNotFoundResponse: description: Deployment rule not found. properties: errors: description: Structured errors. items: $ref: "#/components/schemas/HTTPCIAppError" type: array type: object HTTPCIAppError: description: List of errors. properties: detail: description: Error message. example: "Malformed payload" type: string status: description: Error code. example: "400" type: string title: description: Error title. example: "Bad Request" type: string type: object HTTPCIAppErrors: description: Errors occurred. properties: errors: description: Structured errors. items: $ref: "#/components/schemas/HTTPCIAppError" type: array type: object HTTPCredentials: description: The definition of `HTTPCredentials` object. oneOf: - $ref: "#/components/schemas/HTTPTokenAuth" HTTPCredentialsUpdate: description: The definition of `HTTPCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/HTTPTokenAuthUpdate" HTTPHeader: description: The definition of `HTTPHeader` object. properties: name: description: The `HTTPHeader` `name`. example: MyHttpHeader pattern: ^[A-Za-z][A-Za-z\\d\\-\\_]*$ type: string value: description: The `HTTPHeader` `value`. example: Some header value type: string required: - name - value type: object HTTPHeaderUpdate: description: The definition of `HTTPHeaderUpdate` object. properties: deleted: description: Should the header be deleted. type: boolean name: description: The `HTTPHeaderUpdate` `name`. example: MyHttpHeader pattern: ^[A-Za-z][A-Za-z\\d\\-\\_]*$ type: string value: description: The `HTTPHeaderUpdate` `value`. example: Updated Header Value type: string required: - name type: object HTTPIntegration: description: The definition of `HTTPIntegration` object. properties: base_url: description: Base HTTP url for the integration example: http://datadoghq.com type: string credentials: $ref: "#/components/schemas/HTTPCredentials" type: $ref: "#/components/schemas/HTTPIntegrationType" required: - type - base_url - credentials type: object HTTPIntegrationType: description: The definition of `HTTPIntegrationType` object. enum: - HTTP example: HTTP type: string x-enum-varnames: - HTTP HTTPIntegrationUpdate: description: The definition of `HTTPIntegrationUpdate` object. properties: base_url: description: Base HTTP url for the integration example: http://datadoghq.com type: string credentials: $ref: "#/components/schemas/HTTPCredentialsUpdate" type: $ref: "#/components/schemas/HTTPIntegrationType" required: - type type: object HTTPLog: description: Structured log message. items: $ref: "#/components/schemas/HTTPLogItem" type: array HTTPLogError: description: List of errors. properties: detail: description: Error message. example: "Malformed payload" type: string status: description: Error code. example: "400" type: string title: description: Error title. example: "Bad Request" type: string type: object HTTPLogErrors: description: Invalid query performed. properties: errors: description: Structured errors. items: $ref: "#/components/schemas/HTTPLogError" type: array type: object HTTPLogItem: additionalProperties: description: Additional log attributes. description: Logs that are sent over HTTP. properties: ddsource: description: |- The integration name associated with your log: the technology from which the log originated. When it matches an integration name, Datadog automatically installs the corresponding parsers and facets. See [reserved attributes](https://docs.datadoghq.com/logs/log_configuration/attributes_naming_convention/#reserved-attributes). example: nginx type: string ddtags: description: Tags associated with your logs. example: env:staging,version:5.1 type: string hostname: description: The name of the originating host of the log. example: i-012345678 type: string message: description: |- The message [reserved attribute](https://docs.datadoghq.com/logs/log_configuration/attributes_naming_convention/#reserved-attributes) of your log. By default, Datadog ingests the value of the message attribute as the body of the log entry. That value is then highlighted and displayed in the Logstream, where it is indexed for full text search. example: 2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World type: string service: description: |- The name of the application or service generating the log events. It is used to switch from Logs to APM, so make sure you define the same value when you use both products. See [reserved attributes](https://docs.datadoghq.com/logs/log_configuration/attributes_naming_convention/#reserved-attributes). example: payment type: string required: - message type: object HTTPToken: description: The definition of `HTTPToken` object. properties: name: description: The `HTTPToken` `name`. example: MyToken pattern: ^[A-Za-z][A-Za-z\\d]*$ type: string type: $ref: "#/components/schemas/TokenType" value: $ref: "#/components/schemas/HTTPTokenValue" required: - name - value - type type: object HTTPTokenAuth: description: The definition of `HTTPTokenAuth` object. properties: body: $ref: "#/components/schemas/HTTPBody" headers: description: The `HTTPTokenAuth` `headers`. items: $ref: "#/components/schemas/HTTPHeader" type: array http_tokens: description: >- HTTP authentication tokens returned by the API. Use `tokens` when creating or updating tokens. items: $ref: "#/components/schemas/HTTPTokenResponse" readOnly: true type: array tokens: description: The `HTTPTokenAuth` `tokens`. items: $ref: "#/components/schemas/HTTPToken" type: array type: $ref: "#/components/schemas/HTTPTokenAuthType" url_parameters: description: The `HTTPTokenAuth` `url_parameters`. items: $ref: "#/components/schemas/UrlParam" type: array required: - type type: object HTTPTokenAuthType: description: The definition of `HTTPTokenAuthType` object. enum: - HTTPTokenAuth example: HTTPTokenAuth type: string x-enum-varnames: - HTTPTOKENAUTH HTTPTokenAuthUpdate: description: The definition of `HTTPTokenAuthUpdate` object. properties: body: $ref: "#/components/schemas/HTTPBody" headers: description: The `HTTPTokenAuthUpdate` `headers`. items: $ref: "#/components/schemas/HTTPHeaderUpdate" type: array tokens: description: The `HTTPTokenAuthUpdate` `tokens`. items: $ref: "#/components/schemas/HTTPTokenUpdate" type: array type: $ref: "#/components/schemas/HTTPTokenAuthType" url_parameters: description: The `HTTPTokenAuthUpdate` `url_parameters`. items: $ref: "#/components/schemas/UrlParamUpdate" type: array required: - type type: object HTTPTokenResponse: description: An HTTP authentication token returned by the API. Its type is implicitly `SECRET`. properties: name: description: Name of the HTTP authentication token. example: MyToken type: string value: $ref: "#/components/schemas/HTTPTokenResponseValue" required: - name - value type: object HTTPTokenResponseValue: description: The `HTTPTokenResponse` `value`. example: Some Token Value oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" HTTPTokenUpdate: description: The definition of `HTTPTokenUpdate` object. properties: deleted: description: Should the header be deleted. type: boolean name: description: The `HTTPToken` `name`. example: MyToken pattern: ^[A-Za-z][A-Za-z\\d]*$ type: string type: $ref: "#/components/schemas/TokenType" value: $ref: "#/components/schemas/HTTPTokenValue" required: - name - type - value type: object HTTPTokenValue: description: The `HTTPToken` `value`. example: Some Token Value oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" HamrOrgConnectionAttributesRequest: description: Attributes for a HAMR organization connection request. properties: hamr_status: $ref: "#/components/schemas/HamrOrgConnectionStatus" is_primary: description: |- Indicates whether this organization is the primary organization in the HAMR relationship. If true, this is the primary organization. If false, this is the secondary/backup organization. example: true type: boolean modified_by: description: Username or identifier of the user who last modified this HAMR connection. example: "admin@example.com" type: string target_org_datacenter: description: Datacenter location of the target organization (e.g., us1, eu1, us5). example: "us1" type: string target_org_name: description: Name of the target organization in the HAMR relationship. example: "Production Backup Org" type: string target_org_uuid: description: UUID of the target organization in the HAMR relationship. example: "660f9511-f3ac-52e5-b827-557766551111" type: string required: - target_org_uuid - target_org_name - target_org_datacenter - hamr_status - is_primary - modified_by type: object HamrOrgConnectionAttributesResponse: description: Attributes of a HAMR organization connection response. properties: hamr_status: $ref: "#/components/schemas/HamrOrgConnectionStatus" is_primary: description: |- Indicates whether this organization is the primary organization in the HAMR relationship. If true, this is the primary organization. If false, this is the secondary/backup organization. example: true type: boolean modified_at: description: Timestamp of when this HAMR connection was last modified (RFC3339 format). example: "2026-01-13T17:26:48.830968Z" type: string modified_by: description: Username or identifier of the user who last modified this HAMR connection. example: "admin@example.com" type: string target_org_datacenter: description: Datacenter location of the target organization (e.g., us1, eu1, us5). example: "us1" type: string target_org_name: description: Name of the target organization in the HAMR relationship. example: "Production Backup Org" type: string target_org_uuid: description: UUID of the target organization in the HAMR relationship. example: "660f9511-f3ac-52e5-b827-557766551111" type: string required: - target_org_uuid - target_org_name - target_org_datacenter - hamr_status - is_primary - modified_at - modified_by type: object HamrOrgConnectionDataRequest: description: Data object for a HAMR organization connection request. properties: attributes: $ref: "#/components/schemas/HamrOrgConnectionAttributesRequest" id: description: The organization UUID for this HAMR connection. Must match the authenticated organization's UUID. example: "550e8400-e29b-41d4-a716-446655440000" type: string type: $ref: "#/components/schemas/HamrOrgConnectionType" required: - id - type - attributes type: object HamrOrgConnectionDataResponse: description: Data object for a HAMR organization connection response. properties: attributes: $ref: "#/components/schemas/HamrOrgConnectionAttributesResponse" id: description: The organization UUID for this HAMR connection. example: "550e8400-e29b-41d4-a716-446655440000" type: string type: $ref: "#/components/schemas/HamrOrgConnectionType" required: - id - type - attributes type: object HamrOrgConnectionRequest: description: Request payload for creating or updating a HAMR organization connection. properties: data: $ref: "#/components/schemas/HamrOrgConnectionDataRequest" required: - data type: object HamrOrgConnectionResponse: description: Response payload for a HAMR organization connection. properties: data: $ref: "#/components/schemas/HamrOrgConnectionDataResponse" required: - data type: object HamrOrgConnectionStatus: description: |- Status of the HAMR connection: - 0: UNSPECIFIED - Connection status not specified - 1: ONBOARDING - Initial setup of HAMR connection - 2: PASSIVE - Secondary organization in passive standby mode - 3: FAILOVER - Liminal status between PASSIVE and ACTIVE - 4: ACTIVE - Organization is an active failover - 5: RECOVERY - Recovery operation in progress enum: - 0 - 1 - 2 - 3 - 4 - 5 example: 4 format: int64 type: integer x-enum-varnames: - UNSPECIFIED - ONBOARDING - PASSIVE - FAILOVER - ACTIVE - RECOVERY HamrOrgConnectionType: description: Type of the HAMR organization connection resource. enum: - hamr_org_connections example: hamr_org_connections type: string x-enum-varnames: - HAMR_ORG_CONNECTIONS HistoricalJobDataType: description: Type of payload. enum: - historicalDetectionsJob type: string x-enum-varnames: - HISTORICALDETECTIONSJOB HistoricalJobFailure: description: |- Details about why the job failed. Only present when the job has failed and won't be retried. properties: hint: description: A suggestion to fix the failure. example: Narrow the time range or reduce the data scanned. type: string reason: $ref: "#/components/schemas/HistoricalJobFailureReason" type: object HistoricalJobFailureReason: description: The reason why the job failed. enum: - rule_configuration - query_too_expensive - internal_error example: query_too_expensive type: string x-enum-descriptions: - The rule, or the dataset it references, can't run as written. - The query scans too much data. - An internal error occurred. These are usually temporary. x-enum-varnames: - RULE_CONFIGURATION - QUERY_TOO_EXPENSIVE - INTERNAL_ERROR HistoricalJobListMeta: description: Metadata about the list of jobs. properties: totalCount: description: Number of jobs in the list. format: int32 maximum: 2147483647 type: integer type: object HistoricalJobOptions: description: Job options. properties: anomalyDetectionOptions: $ref: "#/components/schemas/SecurityMonitoringRuleAnomalyDetectionOptions" detectionMethod: $ref: "#/components/schemas/SecurityMonitoringRuleDetectionMethod" evaluationWindow: $ref: "#/components/schemas/SecurityMonitoringRuleEvaluationWindow" impossibleTravelOptions: $ref: "#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptions" keepAlive: $ref: "#/components/schemas/SecurityMonitoringRuleKeepAlive" maxSignalDuration: $ref: "#/components/schemas/SecurityMonitoringRuleMaxSignalDuration" newValueOptions: $ref: "#/components/schemas/SecurityMonitoringRuleNewValueOptions" sequenceDetectionOptions: $ref: "#/components/schemas/SecurityMonitoringRuleSequenceDetectionOptions" thirdPartyRuleOptions: $ref: "#/components/schemas/SecurityMonitoringRuleThirdPartyOptions" type: object HistoricalJobQuery: description: Query for selecting logs analyzed by the historical job. properties: additionalFilters: description: Additional filters appended to the query at evaluation time. type: string aggregation: $ref: "#/components/schemas/SecurityMonitoringRuleQueryAggregation" correlatedByFields: description: Fields used to correlate results across queries in sequence detection rules. items: description: Field. type: string type: array correlatedQueryIndex: description: Zero-based index of the query to correlate with in sequence detection rules. Up to 10 queries are supported, so valid values are 0 to 9. format: int64 maximum: 9 minimum: 0 type: integer customQueryExtension: description: Custom query extension used to refine the base query. type: string dataSource: $ref: "#/components/schemas/SecurityMonitoringStandardDataSource" datasetIds: description: IDs of reference datasets used by this query. items: description: Dataset ID. type: string type: array distinctFields: description: Field for which the cardinality is measured. Sent as an array. items: description: Field. type: string type: array groupByFields: description: Fields to group by. items: description: Field. type: string type: array hasOptionalGroupByFields: default: false description: When false, events without a group-by value are ignored by the query. When true, events with missing group-by fields are processed with `N/A`, replacing the missing values. example: false type: boolean index: description: Index used to load the data for this query. type: string indexes: description: Indexes used to load the data for this query. Mutually exclusive with `index`. items: description: Index name. type: string type: array metrics: description: Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values. items: description: Field. type: string type: array name: description: Name of the query. type: string query: description: Query to run on logs. example: a > 3 type: string queryLanguage: description: Language used to parse the query string. type: string type: object HistoricalJobResponse: description: Historical job response. properties: data: $ref: "#/components/schemas/HistoricalJobResponseData" type: object HistoricalJobResponseAttributes: description: Historical job attributes. properties: createdAt: description: Time when the job was created. type: string createdByHandle: description: The handle of the user who created the job. type: string createdByName: description: The name of the user who created the job. type: string createdFromRuleId: description: ID of the rule used to create the job (if it is created from a rule). type: string failure: $ref: "#/components/schemas/HistoricalJobFailure" jobDefinition: $ref: "#/components/schemas/JobDefinition" jobName: description: Job name. type: string jobStatus: description: Job status. type: string modifiedAt: description: Last modification time of the job. type: string progressRate: description: Job execution progress as a value between 0 and 1. Available for ongoing jobs. format: double type: number signalOutput: description: Whether the job outputs signals. type: boolean type: object HistoricalJobResponseData: description: Historical job response data. properties: attributes: $ref: "#/components/schemas/HistoricalJobResponseAttributes" id: description: ID of the job. type: string type: $ref: "#/components/schemas/HistoricalJobDataType" type: object HistoricalMetricsConfigurationAttributes: description: Attributes of a historical metrics configuration. properties: created_at: description: Timestamp when historical metrics ingestion was enabled for the metric. example: "2024-01-15T12:00:00.000Z" format: date-time readOnly: true type: string type: object HistoricalMetricsConfigurationCreateData: description: Data object for enabling historical metrics ingestion for a metric. properties: id: description: The metric name, used as the resource ID. example: dd.test.metric type: string type: $ref: "#/components/schemas/HistoricalMetricsConfigurationType" required: - id - type type: object HistoricalMetricsConfigurationCreateRequest: description: Request body for enabling historical metrics ingestion for a metric. properties: data: $ref: "#/components/schemas/HistoricalMetricsConfigurationCreateData" required: - data type: object HistoricalMetricsConfigurationData: description: >- A historical metrics configuration resource object. Existence of this resource means historical metrics ingestion is enabled for the metric; there is no separate enabled attribute. properties: attributes: $ref: "#/components/schemas/HistoricalMetricsConfigurationAttributes" id: description: The metric name, used as the resource ID. example: dd.test.metric type: string type: $ref: "#/components/schemas/HistoricalMetricsConfigurationType" type: object HistoricalMetricsConfigurationResponse: description: Response containing a historical metrics configuration. properties: data: $ref: "#/components/schemas/HistoricalMetricsConfigurationData" readOnly: true type: object HistoricalMetricsConfigurationType: default: historical_metrics_configurations description: The historical metrics configuration resource type. enum: - historical_metrics_configurations example: historical_metrics_configurations type: string x-enum-varnames: - HISTORICAL_METRICS_CONFIGURATIONS HourlyUsage: description: Hourly usage for a product family for an org. properties: attributes: $ref: "#/components/schemas/HourlyUsageAttributes" id: description: Unique ID of the response. type: string type: $ref: "#/components/schemas/UsageTimeSeriesType" type: object HourlyUsageAttributes: description: Attributes of hourly usage for a product family for an org for a time period. properties: account_name: description: The account name. type: string account_public_id: description: The account public ID. type: string measurements: description: List of the measured usage values for the product family for the org for the time period. items: $ref: "#/components/schemas/HourlyUsageMeasurement" type: array org_name: description: The organization name. type: string product_family: description: The product for which usage is being reported. type: string public_id: description: The organization public ID. type: string region: description: The region of the Datadog instance that the organization belongs to. type: string timestamp: description: Datetime in ISO-8601 format, UTC. The hour for the usage. format: date-time type: string type: object HourlyUsageMeasurement: description: Usage amount for a given usage type. properties: usage_type: description: Type of usage. type: string value: description: Contains the number measured for the given usage_type during the hour. format: int64 nullable: true type: integer type: object HourlyUsageMetadata: description: The object containing document metadata. properties: pagination: $ref: "#/components/schemas/HourlyUsagePagination" type: object HourlyUsagePagination: description: The metadata for the current pagination. properties: next_record_id: description: The cursor to get the next results (if any). To make the next request, use the same parameters and add `next_record_id`. nullable: true type: string type: object HourlyUsageResponse: description: Hourly usage response. properties: data: description: Response containing hourly usage. items: $ref: "#/components/schemas/HourlyUsage" type: array meta: $ref: "#/components/schemas/HourlyUsageMetadata" type: object HourlyUsageType: description: Usage type that is being measured. enum: - app_sec_host_count - observability_pipelines_bytes_processed - lambda_traced_invocations_count example: observability_pipelines_bytes_processed type: string x-enum-varnames: - APP_SEC_HOST_COUNT - OBSERVABILITY_PIPELINES_BYTES_PROCESSSED - LAMBDA_TRACED_INVOCATIONS_COUNT ID: description: The ID of a notification rule. example: aaa-bbb-ccc type: string IL2CPPSourcemapAttributes: description: Attributes of an IL2CPP mapping file. properties: build_id: description: The build identifier (UUID format). example: 550e8400-e29b-41d4-a716-446655440000 type: string created_at: description: The timestamp when the mapping file was created. example: "2024-01-01T00:00:00Z" format: date-time type: string mapkind: $ref: "#/components/schemas/IL2CPPSourcemapMapKind" size: description: The size of the mapping file in bytes. example: 4096 format: int64 type: integer required: - mapkind - size - created_at type: object IL2CPPSourcemapData: description: IL2CPP mapping file data object. properties: attributes: $ref: "#/components/schemas/IL2CPPSourcemapAttributes" id: description: The unique identifier of the source map. example: "8" type: string type: $ref: "#/components/schemas/SourcemapDataType" required: - id - type - attributes type: object IL2CPPSourcemapMapKind: description: The type of source map. Always `il2cpp` for IL2CPP source maps. enum: - il2cpp example: il2cpp type: string x-enum-varnames: - IL2CPP IOSSourcemapAttributes: description: Attributes of an iOS dSYM source map. properties: created_at: description: The timestamp when the source map was created. example: "2024-01-01T00:00:00Z" format: date-time type: string mapkind: $ref: "#/components/schemas/IOSSourcemapMapKind" size: description: The size of the dSYM file in bytes. example: 4096 format: int64 type: integer uuids: description: The UUID(s) associated with the dSYM file. example: 550e8400-e29b-41d4-a716-446655440000 type: string required: - mapkind - size - created_at type: object IOSSourcemapData: description: iOS dSYM source map data object. properties: attributes: $ref: "#/components/schemas/IOSSourcemapAttributes" id: description: The unique identifier of the source map. example: "11" type: string type: $ref: "#/components/schemas/SourcemapDataType" required: - id - type - attributes type: object IOSSourcemapMapKind: description: The type of source map. Always `ios` for iOS dSYM source maps. enum: - ios example: ios type: string x-enum-varnames: - IOS IPAllowlistAttributes: description: Attributes of the IP allowlist. properties: enabled: description: Whether the IP allowlist logic is enabled or not. type: boolean entries: description: Array of entries in the IP allowlist. items: $ref: "#/components/schemas/IPAllowlistEntry" type: array type: object IPAllowlistData: description: IP allowlist data. properties: attributes: $ref: "#/components/schemas/IPAllowlistAttributes" id: description: The unique identifier of the org. type: string type: $ref: "#/components/schemas/IPAllowlistType" required: - type type: object IPAllowlistEntry: description: IP allowlist entry object. properties: data: $ref: "#/components/schemas/IPAllowlistEntryData" required: - data type: object IPAllowlistEntryAttributes: description: Attributes of the IP allowlist entry. properties: cidr_block: description: The CIDR block describing the IP range of the entry. type: string created_at: description: Creation time of the entry. format: date-time readOnly: true type: string modified_at: description: Time of last entry modification. format: date-time readOnly: true type: string note: description: A note describing the IP allowlist entry. type: string type: object IPAllowlistEntryData: description: Data of the IP allowlist entry object. properties: attributes: $ref: "#/components/schemas/IPAllowlistEntryAttributes" id: description: The unique identifier of the IP allowlist entry. type: string type: $ref: "#/components/schemas/IPAllowlistEntryType" required: - type type: object IPAllowlistEntryType: default: ip_allowlist_entry description: IP allowlist Entry type. enum: - ip_allowlist_entry example: ip_allowlist_entry type: string x-enum-varnames: - IP_ALLOWLIST_ENTRY IPAllowlistResponse: description: Response containing information about the IP allowlist. properties: data: $ref: "#/components/schemas/IPAllowlistData" type: object IPAllowlistType: default: ip_allowlist description: IP allowlist type. enum: - ip_allowlist example: ip_allowlist type: string x-enum-varnames: - IP_ALLOWLIST IPAllowlistUpdateRequest: description: Update the IP allowlist. properties: data: $ref: "#/components/schemas/IPAllowlistData" required: - data type: object IdPMetadataFormData: description: The form data submitted to upload IdP metadata properties: idp_file: description: The IdP metadata XML file format: binary type: string x-mimetype: application/xml type: object IdentityProviderAttributes: description: Attributes of an organization identity provider. properties: authentication_method: description: The authentication method used by this identity provider. example: "SAML" type: string enabled: description: Whether this identity provider is enabled for the organization. example: true type: boolean required: - authentication_method - enabled type: object IdentityProviderData: description: Data object representing an organization identity provider. properties: attributes: $ref: "#/components/schemas/IdentityProviderAttributes" id: description: The unique identifier of the identity provider. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/IdentityProviderType" required: - id - type - attributes type: object IdentityProviderDataList: description: List of organization identity provider data objects. items: $ref: "#/components/schemas/IdentityProviderData" type: array IdentityProviderResponse: description: Response containing a single organization identity provider. properties: data: $ref: "#/components/schemas/IdentityProviderData" required: - data type: object IdentityProviderType: description: The resource type for identity providers. enum: - identity_providers example: identity_providers type: string x-enum-varnames: - IDENTITY_PROVIDERS IdentityProviderUpdateAttributes: description: Attributes for updating an organization identity provider. properties: enabled: description: Whether to enable or disable this identity provider for the organization. example: true type: boolean required: - enabled type: object IdentityProviderUpdateData: description: Data object for updating an organization identity provider. properties: attributes: $ref: "#/components/schemas/IdentityProviderUpdateAttributes" id: description: The unique identifier of the identity provider to update. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/IdentityProviderType" required: - id - type - attributes type: object IdentityProviderUpdateRequest: description: Request body for updating an organization identity provider. properties: data: $ref: "#/components/schemas/IdentityProviderUpdateData" required: - data type: object IdentityProvidersResponse: description: Response containing a list of identity providers for an organization. properties: data: $ref: "#/components/schemas/IdentityProviderDataList" required: - data type: object InboxRuleAction: description: The action to take when the inbox rule matches a finding. properties: description: description: An optional description providing more context for the rule. example: "Needs triage" maxLength: 20000 type: string type: object InboxRuleAttributesCreate: description: Attributes for creating or updating an inbox rule. properties: action: $ref: "#/components/schemas/InboxRuleAction" enabled: description: Whether the inbox rule is enabled. example: true type: boolean name: description: The name of the inbox rule. example: "Triage production misconfigurations" maxLength: 255 minLength: 1 type: string rule: $ref: "#/components/schemas/AutomationRuleScope" required: - name - rule - action type: object InboxRuleAttributesResponse: description: Attributes of an inbox rule returned by the API. properties: action: $ref: "#/components/schemas/InboxRuleAction" created_at: description: The Unix timestamp in milliseconds when the rule was created. example: 1722439510282 format: int64 type: integer created_by: $ref: "#/components/schemas/AutomationRuleCreatedBy" enabled: description: Whether the inbox rule is enabled. example: true type: boolean modified_at: description: The Unix timestamp in milliseconds when the rule was last modified. example: 1722439510282 format: int64 type: integer modified_by: $ref: "#/components/schemas/AutomationRuleModifiedBy" name: description: The name of the inbox rule. example: "Triage production misconfigurations" maxLength: 255 minLength: 1 type: string rule: $ref: "#/components/schemas/AutomationRuleScope" required: - name - enabled - rule - action - created_at - created_by - modified_at - modified_by type: object InboxRuleCreateRequest: description: The body of an inbox rule create request. properties: data: $ref: "#/components/schemas/InboxRuleDataCreate" required: - data type: object InboxRuleDataCreate: description: The data object for an inbox rule create request. properties: attributes: $ref: "#/components/schemas/InboxRuleAttributesCreate" type: $ref: "#/components/schemas/InboxRuleType" required: - type - attributes type: object InboxRuleDataResponse: description: The data object for an inbox rule returned by the API. properties: attributes: $ref: "#/components/schemas/InboxRuleAttributesResponse" id: description: The ID of the inbox rule. example: "00000000-0000-0000-0000-000000000000" format: uuid type: string type: $ref: "#/components/schemas/InboxRuleType" required: - id - type - attributes type: object InboxRuleDataUpdate: description: The data object for an inbox rule update request. The `id` must match the `rule_id` path parameter. properties: attributes: $ref: "#/components/schemas/InboxRuleAttributesCreate" id: description: The ID of the inbox rule to update. example: "00000000-0000-0000-0000-000000000000" format: uuid type: string type: $ref: "#/components/schemas/InboxRuleType" required: - id - type - attributes type: object InboxRuleReorderData: description: The ordered list of all inbox rules. Every rule must be included. items: $ref: "#/components/schemas/InboxRuleReorderItem" type: array InboxRuleReorderItem: description: A reference to an inbox rule used for reordering. properties: id: description: The ID of the inbox rule. example: "00000000-0000-0000-0000-000000000000" format: uuid type: string type: $ref: "#/components/schemas/InboxRuleType" required: - type - id type: object InboxRuleReorderRequest: description: The body of an inbox rule reorder request. properties: data: $ref: "#/components/schemas/InboxRuleReorderData" required: - data type: object InboxRuleReorderResponse: description: The response of an inbox rule reorder request. properties: data: $ref: "#/components/schemas/InboxRuleReorderData" required: - data type: object InboxRuleResponse: description: A single inbox rule response. properties: data: $ref: "#/components/schemas/InboxRuleDataResponse" required: - data type: object InboxRuleType: description: The JSON:API type for inbox rules. enum: - inbox_rules example: inbox_rules type: string x-enum-varnames: - INBOX_RULES InboxRuleUpdateRequest: description: The body of an inbox rule update request. properties: data: $ref: "#/components/schemas/InboxRuleDataUpdate" required: - data type: object InboxRulesDataList: description: A list of inbox rule data objects. items: $ref: "#/components/schemas/InboxRuleDataResponse" type: array InboxRulesResponse: description: A list of inbox rules with pagination metadata. properties: data: $ref: "#/components/schemas/InboxRulesDataList" links: $ref: "#/components/schemas/SecurityAutomationRulesLinks" meta: $ref: "#/components/schemas/SecurityAutomationRulesMeta" required: - data - meta - links type: object IncidentAIPostmortemDataAttributesResponse: description: Attributes of an AI-generated incident postmortem. properties: action_items: description: Action items to prevent recurrence. example: "1. Improve failover testing. 2. Add more monitoring alerts." type: string customer_impact: description: The impact of the incident on customers. example: "5% of users experienced timeouts for 30 minutes." type: string executive_summary: description: An executive summary of the incident. example: "A database failover caused a 30-minute service outage affecting 5% of users." type: string key_timeline: description: Key timeline events during the incident. example: "10:00 - Alert fired. 10:05 - On-call engineer paged. 10:30 - Issue resolved." type: string lessons_learned: description: Lessons learned from the incident. example: "We need to test the failover process under realistic load conditions." type: string system_overview: description: An overview of the affected systems. example: "The primary database cluster experienced a failover event." type: string type: object IncidentAIPostmortemDataResponse: description: AI postmortem data in a response. properties: attributes: $ref: "#/components/schemas/IncidentAIPostmortemDataAttributesResponse" id: description: The incident identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string type: $ref: "#/components/schemas/IncidentAIPostmortemResponseType" required: - id - type - attributes type: object IncidentAIPostmortemResponse: description: Response with an AI-generated incident postmortem. properties: data: $ref: "#/components/schemas/IncidentAIPostmortemDataResponse" required: - data type: object IncidentAIPostmortemResponseType: description: AI postmortem response resource type. enum: - get_incident_ai_postmortem_response example: get_incident_ai_postmortem_response type: string x-enum-varnames: - GET_INCIDENT_AI_POSTMORTEM_RESPONSE IncidentAttachmentType: default: incident_attachments description: The incident attachment resource type. enum: - incident_attachments example: incident_attachments type: string x-enum-varnames: - INCIDENT_ATTACHMENTS IncidentCondition: description: "Conditions that determine which incidents trigger the workflow." properties: tagValues: description: "Incident tags and values used to filter matching incidents." items: $ref: "#/components/schemas/IncidentTagValue" type: array type: object IncidentConfigurationDataAttributesRequest: description: Attributes for creating an incident configuration. properties: execute_integrations: description: Whether to execute integrations for this incident. example: true type: boolean execute_notification_rules: description: Whether to execute notification rules for this incident. example: true type: boolean include_in_analytics: description: Whether to include this incident in analytics. example: true type: boolean include_in_search: description: Whether to include this incident in search results. example: true type: boolean type: object IncidentConfigurationDataAttributesResponse: description: Attributes of an incident configuration in a response. properties: created_at: description: Timestamp when the configuration was created. example: "2024-01-01T00:00:00.000Z" format: date-time type: string execute_integrations: description: Whether integrations are executed for this incident. example: true type: boolean execute_notification_rules: description: Whether notification rules are executed for this incident. example: true type: boolean incident_id: description: The incident identifier. example: 00000000-0000-0000-0000-000000000000 type: string include_in_analytics: description: Whether this incident is included in analytics. example: true type: boolean include_in_search: description: Whether this incident is included in search results. example: true type: boolean modified_at: description: Timestamp when the configuration was last modified. example: "2024-01-01T00:00:00.000Z" format: date-time type: string required: - incident_id - created_at - modified_at type: object IncidentConfigurationDataRequest: description: Incident configuration data in a create request. properties: attributes: $ref: "#/components/schemas/IncidentConfigurationDataAttributesRequest" type: $ref: "#/components/schemas/IncidentConfigurationType" required: - type type: object IncidentConfigurationDataResponse: description: Incident configuration data in a response. properties: attributes: $ref: "#/components/schemas/IncidentConfigurationDataAttributesResponse" id: description: The incident configuration identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string relationships: $ref: "#/components/schemas/IncidentConfigurationRelationships" type: $ref: "#/components/schemas/IncidentConfigurationType" required: - id - type - attributes type: object IncidentConfigurationPatchDataAttributesRequest: description: Attributes for patching an incident configuration. All fields are optional. properties: execute_integrations: description: Whether to execute integrations for this incident. example: true type: boolean execute_notification_rules: description: Whether to execute notification rules for this incident. example: true type: boolean include_in_analytics: description: Whether to include this incident in analytics. example: true type: boolean include_in_search: description: Whether to include this incident in search results. example: true type: boolean type: object IncidentConfigurationPatchDataRequest: description: Incident configuration data in a patch request. properties: attributes: $ref: "#/components/schemas/IncidentConfigurationPatchDataAttributesRequest" id: description: The incident configuration identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string type: $ref: "#/components/schemas/IncidentConfigurationType" required: - id - type type: object IncidentConfigurationPatchRequest: description: Request payload for patching an incident configuration. properties: data: $ref: "#/components/schemas/IncidentConfigurationPatchDataRequest" required: - data type: object IncidentConfigurationRelationships: description: Relationships for an incident configuration. properties: created_by_user: $ref: "#/components/schemas/RelationshipToUser" last_modified_by_user: $ref: "#/components/schemas/RelationshipToUser" type: object IncidentConfigurationRequest: description: Request payload for creating an incident configuration. properties: data: $ref: "#/components/schemas/IncidentConfigurationDataRequest" required: - data type: object IncidentConfigurationResponse: description: Response with an incident configuration. properties: data: $ref: "#/components/schemas/IncidentConfigurationDataResponse" included: description: Included related resources. items: $ref: "#/components/schemas/IncidentUserData" readOnly: true type: array required: - data type: object IncidentConfigurationType: description: Incident configuration resource type. enum: - incidents_configurations example: incidents_configurations type: string x-enum-varnames: - INCIDENTS_CONFIGURATIONS IncidentCreateAttributes: description: The incident's attributes for a create request. properties: customer_impact_scope: description: Required if `customer_impacted:"true"`. A summary of the impact customers experienced during the incident. example: "Example customer impact scope" type: string customer_impacted: description: A flag indicating whether the incident caused customer impact. example: false type: boolean fields: additionalProperties: $ref: "#/components/schemas/IncidentFieldAttributes" description: A condensed view of the user-defined fields for which to create initial selections. example: {"severity": {"type": "dropdown", "value": "SEV-5"}} type: object incident_type_uuid: description: A unique identifier that represents an incident type. The default incident type will be used if this property is not provided. example: "00000000-0000-0000-0000-000000000000" type: string initial_cells: description: An array of initial timeline cells to be placed at the beginning of the incident timeline. items: $ref: "#/components/schemas/IncidentTimelineCellCreateAttributes" type: array is_test: description: A flag indicating whether the incident is a test incident. example: false type: boolean notification_handles: description: Notification handles that will be notified of the incident at creation. example: [{"display_name": "Jane Doe", "handle": "@user@email.com"}, {"display_name": "Slack Channel", "handle": "@slack-channel"}, {"display_name": "Incident Workflow", "handle": "@workflow-from-incident"}] items: $ref: "#/components/schemas/IncidentNotificationHandle" type: array title: description: The title of the incident, which summarizes what happened. example: "A test incident title" type: string required: - title - customer_impacted type: object IncidentCreateData: description: Incident data for a create request. properties: attributes: $ref: "#/components/schemas/IncidentCreateAttributes" relationships: $ref: "#/components/schemas/IncidentCreateRelationships" type: $ref: "#/components/schemas/IncidentType" required: - type - attributes type: object IncidentCreateOnCallPageDataAttributesRequest: description: Attributes for creating an on-call page from an incident. properties: description: description: The description of the page. example: A critical incident affecting production systems. type: string role: $ref: "#/components/schemas/IncidentPageRoleReference" services: description: List of affected services. example: - web-store items: type: string type: array tags: description: List of tags for the page. example: - env:prod items: type: string type: array target: $ref: "#/components/schemas/IncidentPageTarget" title: description: The title of the page. example: Production outage - SEV-1 type: string type: object IncidentCreateOnCallPageDataRequest: description: On-call page data in a create request. properties: attributes: $ref: "#/components/schemas/IncidentCreateOnCallPageDataAttributesRequest" type: $ref: "#/components/schemas/IncidentCreatePageFromIncidentType" required: - type - attributes type: object IncidentCreateOnCallPageRequest: description: Request payload for creating an on-call page from an incident. properties: data: $ref: "#/components/schemas/IncidentCreateOnCallPageDataRequest" required: - data type: object IncidentCreatePageFromIncidentDataAttributesRequest: description: Attributes for creating a page from an incident. properties: description: description: The description of the page. example: A critical incident affecting production systems. type: string incident_public_id: description: The public ID of the incident. example: "12345" type: string role: $ref: "#/components/schemas/IncidentPageRoleReference" services: description: List of affected services. example: - web-store - checkout items: type: string type: array tags: description: List of tags for the page. example: - env:prod items: type: string type: array target: $ref: "#/components/schemas/IncidentPageTarget" title: description: The title of the page. example: Production outage - SEV-1 type: string type: object IncidentCreatePageFromIncidentDataRequest: description: Page data in a create request. properties: attributes: $ref: "#/components/schemas/IncidentCreatePageFromIncidentDataAttributesRequest" type: $ref: "#/components/schemas/IncidentCreatePageFromIncidentType" required: - type - attributes type: object IncidentCreatePageFromIncidentRequest: description: Request payload for creating a page from an incident. properties: data: $ref: "#/components/schemas/IncidentCreatePageFromIncidentDataRequest" required: - data type: object IncidentCreatePageFromIncidentType: description: Resource type for a page creation request. enum: - page example: page type: string x-enum-varnames: - PAGE IncidentCreateRelationships: description: The relationships the incident will have with other resources once created. properties: commander_user: $ref: "#/components/schemas/NullableRelationshipToUser" required: - commander_user type: object IncidentCreateRequest: description: Create request for an incident. properties: data: $ref: "#/components/schemas/IncidentCreateData" required: - data type: object IncidentCreatedTrigger: description: "Trigger a workflow when an incident is declared." properties: incidentType: description: "The type of incident that triggers the workflow." type: string tagCondition: $ref: "#/components/schemas/IncidentCondition" type: object IncidentCreatedTriggerWrapper: description: "Schema for an incident declared trigger." properties: incidentCreatedTrigger: $ref: "#/components/schemas/IncidentCreatedTrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - incidentCreatedTrigger type: object IncidentFieldAttributes: description: Dynamic fields for which selections can be made, with field names as keys. oneOf: - $ref: "#/components/schemas/IncidentFieldAttributesSingleValue" - $ref: "#/components/schemas/IncidentFieldAttributesMultipleValue" IncidentFieldAttributesMultipleValue: description: A field with potentially multiple values selected. properties: type: $ref: "#/components/schemas/IncidentFieldAttributesValueType" value: description: The multiple values selected for this field. example: ["1.0", "1.1"] items: description: A value which has been selected for the parent field. example: "1.1" type: string nullable: true type: array type: object IncidentFieldAttributesSingleValue: description: A field with a single value selected. properties: type: $ref: "#/components/schemas/IncidentFieldAttributesSingleValueType" value: description: The single value selected for this field. example: "SEV-1" nullable: true type: string type: object IncidentFieldAttributesSingleValueType: default: dropdown description: Type of the single value field definitions. enum: - dropdown - textbox example: dropdown type: string x-enum-varnames: - DROPDOWN - TEXTBOX IncidentFieldAttributesValueType: default: multiselect description: Type of the multiple value field definitions. enum: - multiselect - textarray - metrictag - autocomplete example: multiselect type: string x-enum-varnames: - MULTISELECT - TEXTARRAY - METRICTAG - AUTOCOMPLETE IncidentGoogleChatConfigurationDataAttributesRequest: description: Attributes for creating a Google Chat configuration. properties: domain_id: description: The Google Chat domain ID. example: my-domain type: string space_name_template: description: The template for the Google Chat space name. example: "{{incident.title}}" type: string space_target_audience_id: description: The target audience ID for the Google Chat space. example: "123456789" type: string space_time_zone: description: The time zone for the Google Chat space. example: America/New_York type: string required: - domain_id - space_name_template - space_time_zone - space_target_audience_id type: object IncidentGoogleChatConfigurationDataAttributesResponse: description: Attributes of a Google Chat configuration. properties: created_at: description: Timestamp when the configuration was created. example: "2024-01-01T00:00:00.000Z" format: date-time type: string domain_id: description: The Google Chat domain ID. example: my-domain type: string modified_at: description: Timestamp when the configuration was last modified. example: "2024-01-01T00:00:00.000Z" format: date-time type: string space_name_template: description: The template for the Google Chat space name. example: "{{incident.title}}" type: string space_target_audience_id: description: The target audience ID for the Google Chat space. example: "123456789" type: string space_time_zone: description: The time zone for the Google Chat space. example: America/New_York type: string required: - domain_id - space_name_template - space_time_zone - space_target_audience_id - created_at - modified_at type: object IncidentGoogleChatConfigurationDataRequest: description: Google Chat configuration data in a create request. properties: attributes: $ref: "#/components/schemas/IncidentGoogleChatConfigurationDataAttributesRequest" relationships: $ref: "#/components/schemas/IncidentGoogleChatConfigurationRelationshipsRequest" type: $ref: "#/components/schemas/IncidentGoogleChatConfigurationType" required: - type - attributes - relationships type: object IncidentGoogleChatConfigurationDataResponse: description: Google Chat configuration data in a response. properties: attributes: $ref: "#/components/schemas/IncidentGoogleChatConfigurationDataAttributesResponse" id: description: The configuration identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string relationships: $ref: "#/components/schemas/IncidentGoogleChatConfigurationRelationships" type: $ref: "#/components/schemas/IncidentGoogleChatConfigurationType" required: - id - type - attributes type: object IncidentGoogleChatConfigurationPatchDataAttributesRequest: description: Attributes for patching a Google Chat configuration. All fields are optional. properties: domain_id: description: The Google Chat domain ID. example: my-domain type: string space_name_template: description: The template for the Google Chat space name. example: "{{incident.title}}" type: string space_target_audience_id: description: The target audience ID for the Google Chat space. example: "123456789" type: string space_time_zone: description: The time zone for the Google Chat space. example: America/New_York type: string type: object IncidentGoogleChatConfigurationPatchDataRequest: description: Google Chat configuration data in a patch request. properties: attributes: $ref: "#/components/schemas/IncidentGoogleChatConfigurationPatchDataAttributesRequest" id: description: The configuration identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string type: $ref: "#/components/schemas/IncidentGoogleChatConfigurationType" required: - id - type type: object IncidentGoogleChatConfigurationPatchRequest: description: Request payload for patching a Google Chat configuration. properties: data: $ref: "#/components/schemas/IncidentGoogleChatConfigurationPatchDataRequest" required: - data type: object IncidentGoogleChatConfigurationRelationships: description: Relationships for a Google Chat configuration. properties: created_by_user: $ref: "#/components/schemas/RelationshipToUser" incident_type: $ref: "#/components/schemas/RelationshipToIncidentType" last_modified_by_user: $ref: "#/components/schemas/RelationshipToUser" type: object IncidentGoogleChatConfigurationRelationshipsRequest: description: Relationships for a Google Chat configuration create request. properties: incident_type: $ref: "#/components/schemas/RelationshipToIncidentType" required: - incident_type type: object IncidentGoogleChatConfigurationRequest: description: Request payload for creating a Google Chat configuration. properties: data: $ref: "#/components/schemas/IncidentGoogleChatConfigurationDataRequest" required: - data type: object IncidentGoogleChatConfigurationResponse: description: Response with a Google Chat configuration. properties: data: $ref: "#/components/schemas/IncidentGoogleChatConfigurationDataResponse" included: description: Included related resources. items: $ref: "#/components/schemas/IncidentUserData" readOnly: true type: array required: - data type: object IncidentGoogleChatConfigurationType: description: Google Chat configuration resource type. enum: - google_chat_configurations example: google_chat_configurations type: string x-enum-varnames: - GOOGLE_CHAT_CONFIGURATIONS IncidentGoogleMeetConfigurationDataAttributesRequest: description: Attributes for creating a Google Meet configuration. properties: allow_manual_meeting_creation: description: Whether to allow manual meeting creation. example: true type: boolean auto_summarize: description: Whether to auto-summarize meetings. example: false type: boolean required: - allow_manual_meeting_creation - auto_summarize type: object IncidentGoogleMeetConfigurationDataAttributesResponse: description: Attributes of a Google Meet configuration. properties: allow_manual_meeting_creation: description: Whether manual meeting creation is allowed. example: true type: boolean auto_summarize: description: Whether meetings are auto-summarized. example: false type: boolean created_at: description: Timestamp when the configuration was created. example: "2024-01-01T00:00:00.000Z" format: date-time type: string modified_at: description: Timestamp when the configuration was last modified. example: "2024-01-01T00:00:00.000Z" format: date-time type: string required: - allow_manual_meeting_creation - auto_summarize - modified_at type: object IncidentGoogleMeetConfigurationDataRequest: description: Google Meet configuration data in a create request. properties: attributes: $ref: "#/components/schemas/IncidentGoogleMeetConfigurationDataAttributesRequest" relationships: $ref: "#/components/schemas/IncidentGoogleMeetConfigurationRelationshipsRequest" type: $ref: "#/components/schemas/IncidentGoogleMeetConfigurationType" required: - type - attributes - relationships type: object IncidentGoogleMeetConfigurationDataResponse: description: Google Meet configuration data in a response. properties: attributes: $ref: "#/components/schemas/IncidentGoogleMeetConfigurationDataAttributesResponse" id: description: The configuration identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string relationships: $ref: "#/components/schemas/IncidentGoogleMeetConfigurationRelationships" type: $ref: "#/components/schemas/IncidentGoogleMeetConfigurationType" required: - id - type - attributes type: object IncidentGoogleMeetConfigurationPatchDataAttributesRequest: description: Attributes for patching a Google Meet configuration. All fields are optional. properties: allow_manual_meeting_creation: description: Whether to allow manual meeting creation. example: true type: boolean auto_summarize: description: Whether to auto-summarize meetings. example: false type: boolean type: object IncidentGoogleMeetConfigurationPatchDataRequest: description: Google Meet configuration data in a patch request. properties: attributes: $ref: "#/components/schemas/IncidentGoogleMeetConfigurationPatchDataAttributesRequest" id: description: The configuration identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string type: $ref: "#/components/schemas/IncidentGoogleMeetConfigurationType" required: - id - type type: object IncidentGoogleMeetConfigurationPatchRequest: description: Request payload for patching a Google Meet configuration. properties: data: $ref: "#/components/schemas/IncidentGoogleMeetConfigurationPatchDataRequest" required: - data type: object IncidentGoogleMeetConfigurationRelationships: description: Relationships for a Google Meet configuration. properties: created_by_user: $ref: "#/components/schemas/RelationshipToUser" incident_type: $ref: "#/components/schemas/RelationshipToIncidentType" last_modified_by_user: $ref: "#/components/schemas/RelationshipToUser" type: object IncidentGoogleMeetConfigurationRelationshipsRequest: description: Relationships for a Google Meet configuration create request. properties: incident_type: $ref: "#/components/schemas/RelationshipToIncidentType" required: - incident_type type: object IncidentGoogleMeetConfigurationRequest: description: Request payload for creating a Google Meet configuration. properties: data: $ref: "#/components/schemas/IncidentGoogleMeetConfigurationDataRequest" required: - data type: object IncidentGoogleMeetConfigurationResponse: description: Response with a Google Meet configuration. properties: data: $ref: "#/components/schemas/IncidentGoogleMeetConfigurationDataResponse" included: description: Included related resources. items: $ref: "#/components/schemas/IncidentUserData" readOnly: true type: array required: - data type: object IncidentGoogleMeetConfigurationType: description: Google Meet configuration resource type. enum: - google_meet_configurations example: google_meet_configurations type: string x-enum-varnames: - GOOGLE_MEET_CONFIGURATIONS IncidentHandleAttributesFields: description: Dynamic fields associated with the handle example: severity: ["SEV-1"] properties: severity: description: Severity levels associated with the handle items: $ref: "#/components/schemas/IncidentHandleAttributesFieldsSeverity" type: array type: object IncidentHandleAttributesFieldsSeverity: description: Severity level associated with an incident handle. example: SEV-1 type: string IncidentHandleAttributesRequest: description: Incident handle attributes for requests properties: fields: $ref: "#/components/schemas/IncidentHandleAttributesFields" name: description: The handle name example: "@incident-sev-1" type: string required: - name type: object IncidentHandleAttributesResponse: description: Incident handle attributes for responses properties: created_at: description: Timestamp when the handle was created example: "2026-01-13T17:15:52.726905Z" format: date-time type: string fields: $ref: "#/components/schemas/IncidentHandleAttributesFields" modified_at: description: Timestamp when the handle was last modified example: "2026-01-13T17:15:52.726905Z" format: date-time type: string name: description: The handle name example: "@incident-sev-1" type: string required: - name - fields - created_at - modified_at type: object IncidentHandleDataRequest: description: Data object representing an incident handle in a create or update request. properties: attributes: $ref: "#/components/schemas/IncidentHandleAttributesRequest" id: description: The ID of the incident handle (required for PUT requests) example: "b2494081-cdf0-4205-b366-4e1dd4fdf0bf" type: string relationships: $ref: "#/components/schemas/IncidentHandleRelationshipsRequest" type: $ref: "#/components/schemas/IncidentHandleType" required: - type - attributes type: object IncidentHandleDataResponse: description: Data object representing an incident handle in a response. properties: attributes: $ref: "#/components/schemas/IncidentHandleAttributesResponse" id: description: The ID of the incident handle example: "12ceee6d-a7c0-4407-bc54-30e54140d7f0" type: string relationships: $ref: "#/components/schemas/IncidentHandleRelationships" type: $ref: "#/components/schemas/IncidentHandleType" required: - id - type - attributes type: object IncidentHandleIncludedItemResponse: description: A single included resource item in an incident handle response, which can be a user or an incident type. oneOf: - $ref: "#/components/schemas/IncidentUserData" - $ref: "#/components/schemas/IncidentTypeObject" IncidentHandleIncludedResponse: description: Included related resources items: $ref: "#/components/schemas/IncidentHandleIncludedItemResponse" type: array IncidentHandleRelationship: description: A single relationship object for an incident handle, wrapping the related resource data. properties: data: $ref: "#/components/schemas/IncidentHandleRelationshipData" required: - data type: object IncidentHandleRelationshipData: description: Relationship data for an incident handle, containing the ID and type of the related resource. properties: id: description: The ID of the related resource example: "f7b538b1-ed7c-4e84-82de-fdf84a539d40" type: string type: description: The type of the related resource example: "incident_types" type: string required: - id - type type: object IncidentHandleRelationships: description: Relationships associated with an incident handle response, including linked users and incident type. nullable: true properties: commander_user: $ref: "#/components/schemas/IncidentHandleRelationship" created_by_user: $ref: "#/components/schemas/IncidentHandleRelationship" incident_type: $ref: "#/components/schemas/IncidentHandleRelationship" last_modified_by_user: $ref: "#/components/schemas/IncidentHandleRelationship" required: - incident_type - created_by_user - last_modified_by_user type: object IncidentHandleRelationshipsRequest: description: Relationships to associate with an incident handle in a create or update request. nullable: true properties: commander_user: $ref: "#/components/schemas/IncidentHandleRelationship" incident_type: $ref: "#/components/schemas/IncidentHandleRelationship" required: - incident_type type: object IncidentHandleRequest: description: Request payload for creating or updating a global incident handle. properties: data: $ref: "#/components/schemas/IncidentHandleDataRequest" required: - data type: object IncidentHandleResponse: description: Response payload for a single incident handle, including the handle data and related resources. properties: data: $ref: "#/components/schemas/IncidentHandleDataResponse" included: $ref: "#/components/schemas/IncidentHandleIncludedResponse" required: - data type: object IncidentHandleType: description: Incident handle resource type enum: - incidents_handles example: incidents_handles type: string x-enum-varnames: - INCIDENTS_HANDLES IncidentHandlesResponse: description: Response payload for a list of global incident handles, including handle data and related resources. properties: data: $ref: "#/components/schemas/IncidentHandlesResponseData" example: - attributes: name: "@incident-sev-1" id: "12ceee6d-a7c0-4407-bc54-30e54140d7f0" type: incident_handles included: $ref: "#/components/schemas/IncidentHandleIncludedResponse" required: - data type: object IncidentHandlesResponseData: description: Array of incident handle data objects returned in a list response. items: $ref: "#/components/schemas/IncidentHandleDataResponse" type: array IncidentImpactAttributes: description: The incident impact's attributes. properties: created: description: Timestamp when the impact was created. example: "2025-08-29T13:17:00Z" format: date-time readOnly: true type: string description: description: Description of the impact. example: "Service was unavailable for external users" type: string end_at: description: Timestamp when the impact ended. example: "2025-08-29T13:17:00Z" format: date-time nullable: true type: string fields: $ref: "#/components/schemas/IncidentImpactFieldsObject" impact_type: description: The type of impact. example: "customer" type: string modified: description: Timestamp when the impact was last modified. example: "2025-08-29T13:17:00Z" format: date-time readOnly: true type: string start_at: description: Timestamp representing when the impact started. example: "2025-08-28T13:17:00Z" format: date-time type: string required: - description - start_at type: object IncidentImpactCreateAttributes: description: The incident impact's attributes for a create request. properties: description: description: Description of the impact. example: "Service was unavailable for external users" type: string end_at: description: Timestamp when the impact ended. example: "2025-08-29T13:17:00Z" format: date-time nullable: true type: string fields: $ref: "#/components/schemas/IncidentImpactFieldsObject" start_at: description: Timestamp when the impact started. example: "2025-08-28T13:17:00Z" format: date-time type: string required: - description - start_at type: object IncidentImpactCreateData: description: Incident impact data for a create request. properties: attributes: $ref: "#/components/schemas/IncidentImpactCreateAttributes" type: $ref: "#/components/schemas/IncidentImpactType" required: - type - attributes type: object IncidentImpactCreateRequest: description: Create request for an incident impact. properties: data: $ref: "#/components/schemas/IncidentImpactCreateData" required: - data type: object IncidentImpactCreatedTrigger: description: "Trigger a workflow when an impact is created for an incident." properties: executionLimit: $ref: "#/components/schemas/ExecutionLimit" incidentType: description: "The type of incident that triggers the workflow." type: string tagCondition: $ref: "#/components/schemas/IncidentCondition" type: object IncidentImpactCreatedTriggerWrapper: description: "Schema for an incident impact created trigger." properties: incidentImpactCreatedTrigger: $ref: "#/components/schemas/IncidentImpactCreatedTrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - incidentImpactCreatedTrigger type: object IncidentImpactFieldChoice: description: A choice option for a dropdown or multiselect impact field. properties: description: description: The description of the choice. example: Affects all customers type: string display_name: description: The display name of the choice. example: Critical type: string value: description: The value of the choice. example: critical type: string required: - value - display_name type: object IncidentImpactFieldDataAttributesRequest: description: Attributes for creating an impact field. properties: display_name: description: The display name of the impact field. example: Customer Impact Scope type: string field_choices: description: The choices for dropdown or multiselect fields. items: $ref: "#/components/schemas/IncidentImpactFieldChoice" type: array field_type: $ref: "#/components/schemas/IncidentImpactFieldValueType" name: description: The normalized name of the impact field (used as identifier). example: customer_impact_scope type: string tag_key: description: The tag key associated with the field (for metrictag type). example: env nullable: true type: string required: - name - display_name - field_type type: object IncidentImpactFieldDataAttributesResponse: description: Attributes of an impact field in a response. properties: display_name: description: The display name of the impact field. example: Customer Impact Scope type: string field_choices: description: The choices for dropdown or multiselect fields. items: $ref: "#/components/schemas/IncidentImpactFieldChoice" type: array field_type: $ref: "#/components/schemas/IncidentImpactFieldValueType" name: description: The normalized name of the impact field. example: customer_impact_scope type: string tag_key: description: The tag key associated with the field. example: env nullable: true type: string required: - name - display_name - field_type type: object IncidentImpactFieldDataRequest: description: Impact field data in a create request. properties: attributes: $ref: "#/components/schemas/IncidentImpactFieldDataAttributesRequest" relationships: $ref: "#/components/schemas/IncidentImpactFieldRelationshipsRequest" type: $ref: "#/components/schemas/IncidentImpactFieldType" required: - type - attributes - relationships type: object IncidentImpactFieldDataResponse: description: Impact field data in a response. properties: attributes: $ref: "#/components/schemas/IncidentImpactFieldDataAttributesResponse" id: description: The impact field identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string relationships: $ref: "#/components/schemas/IncidentImpactFieldRelationships" type: $ref: "#/components/schemas/IncidentImpactFieldType" required: - id - type - attributes type: object IncidentImpactFieldRelationships: description: Relationships for an impact field. properties: created_by_user: $ref: "#/components/schemas/RelationshipToUser" incident_type: $ref: "#/components/schemas/RelationshipToIncidentType" last_modified_by_user: $ref: "#/components/schemas/RelationshipToUser" type: object IncidentImpactFieldRelationshipsRequest: description: Relationships for an impact field create request. properties: incident_type: $ref: "#/components/schemas/RelationshipToIncidentType" required: - incident_type type: object IncidentImpactFieldRequest: description: Request payload for creating an impact field. properties: data: $ref: "#/components/schemas/IncidentImpactFieldDataRequest" required: - data type: object IncidentImpactFieldResponse: description: Response with a single impact field. properties: data: $ref: "#/components/schemas/IncidentImpactFieldDataResponse" included: description: Included related resources. items: $ref: "#/components/schemas/IncidentUserData" readOnly: true type: array required: - data type: object IncidentImpactFieldType: description: Impact field resource type. enum: - impact_fields example: impact_fields type: string x-enum-varnames: - IMPACT_FIELDS IncidentImpactFieldValueType: description: The type of an impact field. enum: - dropdown - text - textarray - metrictag - number - datetime - multiselect example: dropdown type: string x-enum-varnames: - DROPDOWN - TEXT - TEXTARRAY - METRICTAG - NUMBER - DATETIME - MULTISELECT IncidentImpactFieldsObject: additionalProperties: {} description: An object mapping impact field names to field values. example: {"customers_impacted": "all", "products_impacted": ["shopping", "marketing"]} type: object IncidentImpactFieldsResponse: description: Response with a list of impact fields. properties: data: description: List of impact fields. items: $ref: "#/components/schemas/IncidentImpactFieldDataResponse" type: array included: description: Included related resources. items: $ref: "#/components/schemas/IncidentUserData" readOnly: true type: array required: - data type: object IncidentImpactPatchAttributes: description: The incident impact's attributes for a patch request. All fields are optional. properties: description: description: Description of the impact. example: "Service was unavailable for external users" type: string end_at: description: Timestamp when the impact ended. example: "2025-08-29T13:17:00Z" format: date-time nullable: true type: string fields: $ref: "#/components/schemas/IncidentImpactFieldsObject" start_at: description: Timestamp when the impact started. example: "2025-08-28T13:17:00Z" format: date-time type: string type: object IncidentImpactPatchData: description: Incident impact data for a patch request. properties: attributes: $ref: "#/components/schemas/IncidentImpactPatchAttributes" type: $ref: "#/components/schemas/IncidentImpactType" required: - type type: object IncidentImpactPatchRequest: description: Patch request for an incident impact. properties: data: $ref: "#/components/schemas/IncidentImpactPatchData" required: - data type: object IncidentImpactRelatedObject: description: A reference to a resource related to an incident impact. enum: - incident - created_by_user - last_modified_by_user type: string x-enum-varnames: - INCIDENT - CREATED_BY_USER - LAST_MODIFIED_BY_USER IncidentImpactRelationships: description: The incident impact's resource relationships. properties: created_by_user: $ref: "#/components/schemas/RelationshipToUser" incident: $ref: "#/components/schemas/RelationshipToIncident" last_modified_by_user: $ref: "#/components/schemas/RelationshipToUser" type: object IncidentImpactResponse: description: Response with an incident impact. properties: data: $ref: "#/components/schemas/IncidentImpactResponseData" included: description: Included related resources that the user requested. items: $ref: "#/components/schemas/IncidentUserData" readOnly: true type: array required: - data type: object IncidentImpactResponseData: description: Incident impact data from a response. properties: attributes: $ref: "#/components/schemas/IncidentImpactAttributes" id: description: The incident impact's ID. example: "00000000-0000-0000-1234-000000000000" type: string relationships: $ref: "#/components/schemas/IncidentImpactRelationships" type: $ref: "#/components/schemas/IncidentImpactType" required: - id - type type: object IncidentImpactType: default: incident_impacts description: Incident impact resource type. enum: - incident_impacts example: incident_impacts type: string x-enum-varnames: - INCIDENT_IMPACTS IncidentImpactUpdatedTrigger: description: "Trigger a workflow when an impact is updated for an incident." properties: executionLimit: $ref: "#/components/schemas/ExecutionLimit" incidentType: description: "The type of incident that triggers the workflow." type: string tagCondition: $ref: "#/components/schemas/IncidentCondition" type: object IncidentImpactUpdatedTriggerWrapper: description: "Schema for an incident impact updated trigger." properties: incidentImpactUpdatedTrigger: $ref: "#/components/schemas/IncidentImpactUpdatedTrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - incidentImpactUpdatedTrigger type: object IncidentImpactsResponse: description: Response with a list of incident impacts. properties: data: description: An array of incident impacts. items: $ref: "#/components/schemas/IncidentImpactResponseData" type: array included: description: Included related resources that the user requested. items: $ref: "#/components/schemas/IncidentUserData" readOnly: true type: array required: - data type: object IncidentImpactsType: description: The incident impacts type. enum: - incident_impacts example: incident_impacts type: string x-enum-varnames: - INCIDENT_IMPACTS IncidentImportFieldAttributes: description: Dynamic fields for which selections can be made, with field names as keys. oneOf: - $ref: "#/components/schemas/IncidentImportFieldAttributesSingleValue" - $ref: "#/components/schemas/IncidentImportFieldAttributesMultipleValue" IncidentImportFieldAttributesMultipleValue: additionalProperties: false description: A field with potentially multiple values selected. properties: value: description: The multiple values selected for this field. example: ["1.0", "1.1"] items: description: A value which has been selected for the parent field. example: "1.1" type: string nullable: true type: array type: object IncidentImportFieldAttributesSingleValue: additionalProperties: false description: A field with a single value selected. properties: value: description: The single value selected for this field. example: "SEV-1" nullable: true type: string type: object IncidentImportRelatedObject: description: Object related to an incident that can be included in the response. enum: - last_modified_by_user - created_by_user - commander_user - declared_by_user - incident_type type: string x-enum-varnames: - LAST_MODIFIED_BY_USER - CREATED_BY_USER - COMMANDER_USER - DECLARED_BY_USER - INCIDENT_TYPE IncidentImportRelationships: description: The relationships for an incident import request. properties: commander_user: $ref: "#/components/schemas/NullableRelationshipToUser" declared_by_user: $ref: "#/components/schemas/NullableRelationshipToUser" type: object IncidentImportRequest: description: Import request for an incident. Used to import historical incidents from external systems. properties: data: $ref: "#/components/schemas/IncidentImportRequestData" required: - data type: object IncidentImportRequestAttributes: description: The incident's attributes for an import request. properties: declared: description: Timestamp when the incident was declared. example: "2025-01-01T00:00:00Z" format: date-time type: string detected: description: Timestamp when the incident was detected. example: "2025-01-01T00:00:00Z" format: date-time type: string fields: additionalProperties: $ref: "#/components/schemas/IncidentImportFieldAttributes" description: A condensed view of the user-defined fields for which to create initial selections. example: {"severity": {"value": "SEV-5"}, "state": {"value": "active"}} type: object incident_type_uuid: description: A unique identifier that represents the incident type. If not provided, the default incident type is used. example: "00000000-0000-0000-0000-000000000000" type: string resolved: description: Timestamp when the incident was resolved. Can only be set when the state field is set to 'resolved'. example: "2025-01-01T01:00:00Z" format: date-time type: string title: description: The title of the incident that summarizes what happened. example: "Imported incident from external system" maxLength: 1024 type: string visibility: $ref: "#/components/schemas/IncidentImportVisibility" required: - title type: object IncidentImportRequestData: description: Incident data for an import request. properties: attributes: $ref: "#/components/schemas/IncidentImportRequestAttributes" relationships: $ref: "#/components/schemas/IncidentImportRelationships" type: $ref: "#/components/schemas/IncidentType" required: - type - attributes type: object IncidentImportResponse: description: Response with an incident. properties: data: $ref: "#/components/schemas/IncidentImportResponseData" included: description: Included related resources that the user requested. items: $ref: "#/components/schemas/IncidentImportResponseIncludedItem" readOnly: true type: array required: - data type: object IncidentImportResponseAttributes: description: The incident's attributes from an import response. properties: archived: description: Timestamp when the incident was archived. format: date-time nullable: true readOnly: true type: string case_id: description: The incident case ID. format: int64 nullable: true type: integer created: description: Timestamp when the incident was created. example: "2025-01-01T00:00:00Z" format: date-time readOnly: true type: string created_by_uuid: description: UUID of the user who created the incident. nullable: true type: string creation_idempotency_key: description: A unique key used to ensure idempotent incident creation. nullable: true type: string customer_impact_end: description: Timestamp when customers were no longer impacted by the incident. format: date-time nullable: true type: string customer_impact_scope: description: A summary of the impact customers experienced during the incident. example: "An example customer impact scope" nullable: true type: string customer_impact_start: description: Timestamp when customers began to be impacted by the incident. format: date-time nullable: true type: string declared: description: Timestamp when the incident was declared. example: "2025-01-01T00:00:00Z" format: date-time nullable: true type: string declared_by_uuid: description: UUID of the user who declared the incident. nullable: true type: string detected: description: Timestamp when the incident was detected. example: "2025-01-01T00:00:00Z" format: date-time nullable: true type: string fields: additionalProperties: $ref: "#/components/schemas/IncidentFieldAttributes" description: A condensed view of the user-defined fields attached to incidents. example: {"severity": {"type": "dropdown", "value": "SEV-5"}} type: object incident_type_uuid: description: A unique identifier that represents an incident type. example: "00000000-0000-0000-0000-000000000000" type: string is_test: description: A flag indicating whether the incident is a test incident. example: false type: boolean last_modified_by_uuid: description: UUID of the user who last modified the incident. nullable: true type: string modified: description: Timestamp when the incident was last modified. format: date-time readOnly: true type: string non_datadog_creator: $ref: "#/components/schemas/IncidentNonDatadogCreator" notification_handles: description: Notification handles that are notified of the incident during update. items: $ref: "#/components/schemas/IncidentNotificationHandle" nullable: true type: array public_id: description: The monotonically increasing integer ID for the incident. example: 1 format: int64 type: integer resolved: description: Timestamp when the incident's state was last changed from active or stable to resolved or completed. format: date-time nullable: true type: string severity: $ref: "#/components/schemas/IncidentSeverity" state: description: The state of the incident. nullable: true type: string title: description: The title of the incident that summarizes what happened. example: "A test incident title" type: string visibility: description: The incident visibility status. nullable: true type: string required: - title type: object IncidentImportResponseData: description: Incident data from an import response. properties: attributes: $ref: "#/components/schemas/IncidentImportResponseAttributes" id: description: The incident's ID. example: "00000000-0000-0000-1234-000000000000" type: string relationships: $ref: "#/components/schemas/IncidentImportResponseRelationships" type: $ref: "#/components/schemas/IncidentType" required: - id - type type: object IncidentImportResponseIncludedItem: description: An object related to an incident that is included in the response. oneOf: - $ref: "#/components/schemas/IncidentUserData" - $ref: "#/components/schemas/IncidentTypeObject" IncidentImportResponseRelationships: description: The incident's relationships from an import response. properties: attachments: $ref: "#/components/schemas/RelationshipToIncidentAttachment" commander_user: $ref: "#/components/schemas/NullableRelationshipToUser" created_by_user: $ref: "#/components/schemas/RelationshipToUser" declared_by_user: $ref: "#/components/schemas/RelationshipToUser" impacts: $ref: "#/components/schemas/RelationshipToIncidentImpacts" incident_type: $ref: "#/components/schemas/RelationshipToIncidentType" integrations: $ref: "#/components/schemas/RelationshipToIncidentIntegrationMetadatas" last_modified_by_user: $ref: "#/components/schemas/RelationshipToUser" responders: $ref: "#/components/schemas/RelationshipToIncidentResponders" user_defined_fields: $ref: "#/components/schemas/RelationshipToIncidentUserDefinedFields" type: object IncidentImportVisibility: default: organization description: The visibility of the incident. enum: - organization - private example: organization type: string x-enum-varnames: - ORGANIZATION - PRIVATE IncidentIntegrationMetadataAttributes: description: Incident integration metadata's attributes for a create request. properties: created: description: Timestamp when the incident todo was created. format: date-time readOnly: true type: string incident_id: description: UUID of the incident this integration metadata is connected to. example: "00000000-aaaa-0000-0000-000000000000" type: string integration_type: description: |- A number indicating the type of integration this metadata is for. 1 indicates Slack; 7 indicates Microsoft Teams; 8 indicates Jira. example: 1 format: int32 maximum: 100 type: integer metadata: $ref: "#/components/schemas/IncidentIntegrationMetadataMetadata" modified: description: Timestamp when the incident todo was last modified. format: date-time readOnly: true type: string status: description: |- A number indicating the status of this integration metadata. 0 indicates unknown; 1 indicates pending; 2 indicates complete; 3 indicates manually created; 4 indicates manually updated; 5 indicates failed. format: int32 maximum: 5 type: integer required: - integration_type - metadata type: object IncidentIntegrationMetadataCreateData: description: Incident integration metadata data for a create request. properties: attributes: $ref: "#/components/schemas/IncidentIntegrationMetadataAttributes" type: $ref: "#/components/schemas/IncidentIntegrationMetadataType" required: - type - attributes type: object IncidentIntegrationMetadataCreateRequest: description: Create request for an incident integration metadata. properties: data: $ref: "#/components/schemas/IncidentIntegrationMetadataCreateData" required: - data type: object IncidentIntegrationMetadataListResponse: description: Response with a list of incident integration metadata. properties: data: description: An array of incident integration metadata. items: $ref: "#/components/schemas/IncidentIntegrationMetadataResponseData" type: array included: description: Included related resources that the user requested. items: $ref: "#/components/schemas/IncidentIntegrationMetadataResponseIncludedItem" readOnly: true type: array meta: $ref: "#/components/schemas/IncidentResponseMeta" required: - data type: object IncidentIntegrationMetadataMetadata: description: Incident integration metadata's metadata attribute. oneOf: - $ref: "#/components/schemas/SlackIntegrationMetadata" - $ref: "#/components/schemas/JiraIntegrationMetadata" - $ref: "#/components/schemas/MSTeamsIntegrationMetadata" IncidentIntegrationMetadataPatchData: description: Incident integration metadata data for a patch request. properties: attributes: $ref: "#/components/schemas/IncidentIntegrationMetadataAttributes" type: $ref: "#/components/schemas/IncidentIntegrationMetadataType" required: - type - attributes type: object IncidentIntegrationMetadataPatchRequest: description: Patch request for an incident integration metadata. properties: data: $ref: "#/components/schemas/IncidentIntegrationMetadataPatchData" required: - data type: object IncidentIntegrationMetadataResponse: description: Response with an incident integration metadata. properties: data: $ref: "#/components/schemas/IncidentIntegrationMetadataResponseData" included: description: Included related resources that the user requested. items: $ref: "#/components/schemas/IncidentIntegrationMetadataResponseIncludedItem" readOnly: true type: array required: - data type: object IncidentIntegrationMetadataResponseData: description: Incident integration metadata from a response. properties: attributes: $ref: "#/components/schemas/IncidentIntegrationMetadataAttributes" id: description: The incident integration metadata's ID. example: "00000000-0000-0000-1234-000000000000" type: string relationships: $ref: "#/components/schemas/IncidentIntegrationRelationships" type: $ref: "#/components/schemas/IncidentIntegrationMetadataType" required: - id - type type: object IncidentIntegrationMetadataResponseIncludedItem: description: An object related to an incident integration metadata that is included in the response. oneOf: - $ref: "#/components/schemas/User" IncidentIntegrationMetadataType: default: incident_integrations description: Integration metadata resource type. enum: - incident_integrations example: incident_integrations type: string x-enum-varnames: - INCIDENT_INTEGRATIONS IncidentIntegrationRelationships: description: The incident's integration relationships from a response. properties: created_by_user: $ref: "#/components/schemas/RelationshipToUser" last_modified_by_user: $ref: "#/components/schemas/RelationshipToUser" type: object IncidentNonDatadogCreator: description: Incident's non Datadog creator. nullable: true properties: image_48_px: description: Non Datadog creator `48px` image. type: string name: description: Non Datadog creator name. type: string type: object IncidentNotificationHandle: description: A notification handle that will be notified at incident creation. properties: display_name: description: The name of the notified handle. example: Jane Doe type: string handle: description: The handle used for the notification. This includes an email address, Slack channel, or workflow. example: "@test.user@test.com" type: string type: object IncidentNotificationRule: description: Response with a notification rule. properties: data: $ref: "#/components/schemas/IncidentNotificationRuleResponseData" included: description: Related objects that are included in the response. items: $ref: "#/components/schemas/IncidentNotificationRuleIncludedItems" type: array required: - data type: object IncidentNotificationRuleArray: description: Response with notification rules. properties: data: description: The `NotificationRuleArray` `data`. items: $ref: "#/components/schemas/IncidentNotificationRuleResponseData" type: array included: description: Related objects that are included in the response. items: $ref: "#/components/schemas/IncidentNotificationRuleIncludedItems" type: array meta: $ref: "#/components/schemas/IncidentNotificationRuleArrayMeta" required: - data type: object IncidentNotificationRuleArrayMeta: description: Response metadata. properties: pagination: $ref: "#/components/schemas/IncidentNotificationRuleArrayMetaPage" type: object IncidentNotificationRuleArrayMetaPage: description: Pagination metadata. properties: next_offset: description: The offset for the next page of results. example: 15 format: int64 type: integer offset: description: The current offset in the results. example: 0 format: int64 type: integer size: description: The number of results returned per page. example: 15 format: int64 type: integer type: object IncidentNotificationRuleAttributes: description: The notification rule's attributes. properties: conditions: $ref: "#/components/schemas/IncidentNotificationRuleConditions" created: description: Timestamp when the notification rule was created. example: "2025-01-15T10:30:00Z" format: date-time readOnly: true type: string enabled: description: Whether the notification rule is enabled. example: true type: boolean handles: $ref: "#/components/schemas/IncidentNotificationRuleHandles" modified: description: Timestamp when the notification rule was last modified. example: "2025-01-15T14:45:00Z" format: date-time readOnly: true type: string renotify_on: $ref: "#/components/schemas/IncidentNotificationRuleRenotifyOn" trigger: description: The trigger event for this notification rule. example: "incident_created_trigger" type: string visibility: $ref: "#/components/schemas/IncidentNotificationRuleAttributesVisibility" required: - conditions - handles - visibility - trigger - enabled - created - modified type: object IncidentNotificationRuleAttributesVisibility: description: The visibility of the notification rule. enum: ["all", "organization", "private"] example: "organization" type: string x-enum-varnames: - ALL - ORGANIZATION - PRIVATE IncidentNotificationRuleConditions: description: The conditions that trigger this notification rule. example: [{"field": "severity", "values": ["SEV-1", "SEV-2"]}] items: $ref: "#/components/schemas/IncidentNotificationRuleConditionsItems" type: array IncidentNotificationRuleConditionsItems: description: A condition that must be met to trigger the notification rule. properties: field: description: The incident field to evaluate example: "severity" type: string values: description: The value(s) to compare against. Multiple values are `ORed` together. example: ["SEV-1", "SEV-2"] items: description: A value to compare against the incident field. type: string type: array required: - field - values type: object IncidentNotificationRuleCreateAttributes: description: The attributes for creating a notification rule. properties: conditions: $ref: "#/components/schemas/IncidentNotificationRuleConditions" enabled: default: false description: Whether the notification rule is enabled. example: true type: boolean handles: $ref: "#/components/schemas/IncidentNotificationRuleHandles" renotify_on: $ref: "#/components/schemas/IncidentNotificationRuleRenotifyOn" trigger: description: The trigger event for this notification rule. example: "incident_created_trigger" type: string visibility: $ref: "#/components/schemas/IncidentNotificationRuleCreateAttributesVisibility" required: - conditions - handles - trigger type: object IncidentNotificationRuleCreateAttributesVisibility: description: The visibility of the notification rule. enum: ["all", "organization", "private"] example: "organization" type: string x-enum-varnames: - ALL - ORGANIZATION - PRIVATE IncidentNotificationRuleCreateData: description: Notification rule data for a create request. properties: attributes: $ref: "#/components/schemas/IncidentNotificationRuleCreateAttributes" relationships: $ref: "#/components/schemas/IncidentNotificationRuleCreateDataRelationships" type: $ref: "#/components/schemas/IncidentNotificationRuleType" required: - type - attributes type: object IncidentNotificationRuleCreateDataRelationships: description: The definition of `NotificationRuleCreateDataRelationships` object. properties: incident_type: $ref: "#/components/schemas/RelationshipToIncidentType" notification_template: $ref: "#/components/schemas/RelationshipToIncidentNotificationTemplate" type: object IncidentNotificationRuleHandles: description: The notification handles (targets) for this rule. example: ["@team-email@company.com", "@slack-channel"] items: description: A notification handle (email, Slack channel, etc.). type: string type: array IncidentNotificationRuleIncludedItems: description: Objects related to a notification rule. oneOf: - $ref: "#/components/schemas/User" - $ref: "#/components/schemas/IncidentTypeObject" - $ref: "#/components/schemas/IncidentNotificationTemplateObject" IncidentNotificationRuleRelationships: description: The notification rule's resource relationships. properties: created_by_user: $ref: "#/components/schemas/RelationshipToUser" incident_type: $ref: "#/components/schemas/RelationshipToIncidentType" last_modified_by_user: $ref: "#/components/schemas/RelationshipToUser" notification_template: $ref: "#/components/schemas/RelationshipToIncidentNotificationTemplate" type: object IncidentNotificationRuleRenotifyOn: description: List of incident fields that trigger re-notification when changed. example: ["status", "severity"] items: description: An incident field name. type: string type: array IncidentNotificationRuleResponseData: description: Notification rule data from a response. properties: attributes: $ref: "#/components/schemas/IncidentNotificationRuleAttributes" id: description: The unique identifier of the notification rule. example: "00000000-0000-0000-0000-000000000001" format: uuid type: string relationships: $ref: "#/components/schemas/IncidentNotificationRuleRelationships" type: $ref: "#/components/schemas/IncidentNotificationRuleType" required: - id - type type: object IncidentNotificationRuleType: description: Notification rules resource type. enum: - incident_notification_rules example: incident_notification_rules type: string x-enum-varnames: - INCIDENT_NOTIFICATION_RULES IncidentNotificationRuleUpdateData: description: Notification rule data for an update request. properties: attributes: $ref: "#/components/schemas/IncidentNotificationRuleCreateAttributes" id: description: The unique identifier of the notification rule. example: "00000000-0000-0000-0000-000000000001" format: uuid type: string relationships: $ref: "#/components/schemas/IncidentNotificationRuleCreateDataRelationships" type: $ref: "#/components/schemas/IncidentNotificationRuleType" required: - id - type - attributes type: object IncidentNotificationTemplate: description: Response with a notification template. properties: data: $ref: "#/components/schemas/IncidentNotificationTemplateResponseData" included: description: Related objects that are included in the response. items: $ref: "#/components/schemas/IncidentNotificationTemplateIncludedItems" type: array required: - data type: object IncidentNotificationTemplateArray: description: Response with notification templates. properties: data: description: The `NotificationTemplateArray` `data`. items: $ref: "#/components/schemas/IncidentNotificationTemplateResponseData" type: array included: description: Related objects that are included in the response. items: $ref: "#/components/schemas/IncidentNotificationTemplateIncludedItems" type: array meta: $ref: "#/components/schemas/IncidentNotificationTemplateArrayMeta" required: - data type: object IncidentNotificationTemplateArrayMeta: description: Response metadata. properties: page: $ref: "#/components/schemas/IncidentNotificationTemplateArrayMetaPage" type: object IncidentNotificationTemplateArrayMetaPage: description: Pagination metadata. properties: total_count: description: Total number of notification templates. example: 42 format: int64 type: integer total_filtered_count: description: Total number of notification templates matching the filter. example: 15 format: int64 type: integer type: object IncidentNotificationTemplateAttributes: description: The notification template's attributes. properties: category: description: The category of the notification template. example: "alert" type: string content: description: The content body of the notification template. example: "An incident has been declared.\n\nTitle: {{incident.title}}\nSeverity: {{incident.severity}}\nAffected Services: {{incident.services}}\nStatus: {{incident.state}}\n\nPlease join the incident channel for updates." type: string created: description: Timestamp when the notification template was created. example: "2025-01-15T10:30:00Z" format: date-time readOnly: true type: string modified: description: Timestamp when the notification template was last modified. example: "2025-01-15T14:45:00Z" format: date-time readOnly: true type: string name: description: The name of the notification template. example: "Incident Alert Template" type: string subject: description: The subject line of the notification template. example: "{{incident.severity}} Incident: {{incident.title}}" type: string required: - name - subject - content - category - created - modified type: object IncidentNotificationTemplateCreateAttributes: description: The attributes for creating a notification template. properties: category: description: The category of the notification template. example: "alert" type: string content: description: The content body of the notification template. example: "An incident has been declared.\n\nTitle: {{incident.title}}\nSeverity: {{incident.severity}}\nAffected Services: {{incident.services}}\nStatus: {{incident.state}}\n\nPlease join the incident channel for updates." type: string name: description: The name of the notification template. example: "Incident Alert Template" type: string subject: description: The subject line of the notification template. example: "{{incident.severity}} Incident: {{incident.title}}" type: string required: - name - subject - content - category type: object IncidentNotificationTemplateCreateData: description: Notification template data for a create request. properties: attributes: $ref: "#/components/schemas/IncidentNotificationTemplateCreateAttributes" relationships: $ref: "#/components/schemas/IncidentNotificationTemplateCreateDataRelationships" type: $ref: "#/components/schemas/IncidentNotificationTemplateType" required: - type - attributes type: object IncidentNotificationTemplateCreateDataRelationships: description: The definition of `NotificationTemplateCreateDataRelationships` object. properties: incident_type: $ref: "#/components/schemas/RelationshipToIncidentType" type: object IncidentNotificationTemplateIncludedItems: description: Objects related to a notification template. oneOf: - $ref: "#/components/schemas/User" - $ref: "#/components/schemas/IncidentTypeObject" IncidentNotificationTemplateObject: description: A notification template object for inclusion in other resources. properties: attributes: $ref: "#/components/schemas/IncidentNotificationTemplateAttributes" id: description: The unique identifier of the notification template. example: "00000000-0000-0000-0000-000000000001" format: uuid type: string relationships: $ref: "#/components/schemas/IncidentNotificationTemplateRelationships" type: $ref: "#/components/schemas/IncidentNotificationTemplateType" required: - id - type type: object IncidentNotificationTemplateRelationships: description: The notification template's resource relationships. properties: created_by_user: $ref: "#/components/schemas/RelationshipToUser" incident_type: $ref: "#/components/schemas/RelationshipToIncidentType" last_modified_by_user: $ref: "#/components/schemas/RelationshipToUser" type: object IncidentNotificationTemplateResponseData: description: Notification template data from a response. properties: attributes: $ref: "#/components/schemas/IncidentNotificationTemplateAttributes" id: description: The unique identifier of the notification template. example: "00000000-0000-0000-0000-000000000001" format: uuid type: string relationships: $ref: "#/components/schemas/IncidentNotificationTemplateRelationships" type: $ref: "#/components/schemas/IncidentNotificationTemplateType" required: - id - type type: object IncidentNotificationTemplateType: description: Notification templates resource type. enum: - notification_templates example: notification_templates type: string x-enum-varnames: - NOTIFICATION_TEMPLATES IncidentNotificationTemplateUpdateAttributes: description: The attributes to update on a notification template. properties: category: description: The category of the notification template. example: "update" type: string content: description: The content body of the notification template. example: "Incident Status Update:\n\nTitle: {{incident.title}}\nNew Status: {{incident.state}}\nSeverity: {{incident.severity}}\nServices: {{incident.services}}\nCommander: {{incident.commander}}\n\nFor more details, visit the incident page." type: string name: description: The name of the notification template. example: "Incident Status Update Template" type: string subject: description: The subject line of the notification template. example: "Incident Update: {{incident.title}} - {{incident.state}}" type: string type: object IncidentNotificationTemplateUpdateData: description: Notification template data for an update request. properties: attributes: $ref: "#/components/schemas/IncidentNotificationTemplateUpdateAttributes" id: description: The unique identifier of the notification template. example: "00000000-0000-0000-0000-000000000001" format: uuid type: string type: $ref: "#/components/schemas/IncidentNotificationTemplateType" required: - id - type type: object IncidentOnCallPageDataAttributesRequest: description: Attributes for linking a page to an incident. properties: key: description: The key of the on-call page. example: PAGE-12345 type: string page_target: $ref: "#/components/schemas/IncidentOnCallPageTarget" team_id: description: The team ID associated with the page (deprecated, use page_target instead). example: team-abc-123 type: string type: object IncidentOnCallPageDataRequest: description: On-call page data in a link request. properties: attributes: $ref: "#/components/schemas/IncidentOnCallPageDataAttributesRequest" id: description: The ID of the on-call page to link. example: PAGE-12345 type: string type: $ref: "#/components/schemas/IncidentOnCallPageType" required: - id - type type: object IncidentOnCallPageLinkRequest: description: Request payload for linking an on-call page to an incident. properties: data: $ref: "#/components/schemas/IncidentOnCallPageDataRequest" required: - data type: object IncidentOnCallPageTarget: description: The target of an on-call page. properties: identifier: description: The identifier of the page target. example: my-oncall-team type: string type: description: The type of the page target. example: team_handle type: string required: - type - identifier type: object IncidentOnCallPageType: description: On-call page resource type. enum: - page example: page type: string x-enum-varnames: - PAGE IncidentOrgSettingsDataAttributesResponse: description: Attributes of an incident org settings resource in a response. properties: created: description: Timestamp when the settings were created. example: "2024-01-01T00:00:00.000Z" format: date-time type: string modified: description: Timestamp when the settings were last modified. example: "2024-01-01T00:00:00.000Z" format: date-time type: string settings: $ref: "#/components/schemas/IncidentOrgSettingsMeta" required: - created - modified - settings type: object IncidentOrgSettingsDataResponse: description: Incident org settings data in a response. properties: attributes: $ref: "#/components/schemas/IncidentOrgSettingsDataAttributesResponse" id: description: The org settings identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string relationships: $ref: "#/components/schemas/IncidentOrgSettingsRelationships" type: $ref: "#/components/schemas/IncidentOrgSettingsType" required: - id - type - attributes type: object IncidentOrgSettingsListResponse: description: Response with a list of incident org settings resources. properties: data: description: List of incident org settings resources. items: $ref: "#/components/schemas/IncidentOrgSettingsDataResponse" type: array required: - data type: object IncidentOrgSettingsMeta: additionalProperties: {} description: The settings configuration for an incident org settings resource. example: allow_anonymous_incident_declaration: false allow_guest_incident_declaration: false pagerduty_paging: true private_incidents_by_default: false type: object IncidentOrgSettingsRelationships: description: Relationships for an incident org settings resource. properties: incident_type: $ref: "#/components/schemas/RelationshipToIncidentType" type: object IncidentOrgSettingsResponse: description: Response with a single incident org settings resource. properties: data: $ref: "#/components/schemas/IncidentOrgSettingsDataResponse" required: - data type: object IncidentOrgSettingsType: description: Incident org settings resource type. enum: - incident_org_settings example: incident_org_settings type: string x-enum-varnames: - INCIDENT_ORG_SETTINGS IncidentPageRoleReference: description: A reference to an incident role for a page. properties: id: description: The role identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string type: $ref: "#/components/schemas/IncidentPageRoleType" required: - type - id type: object IncidentPageRoleType: description: The type of incident role for a page. enum: - incident_user_defined_roles - incident_reserved_roles example: incident_user_defined_roles type: string x-enum-varnames: - INCIDENT_USER_DEFINED_ROLES - INCIDENT_RESERVED_ROLES IncidentPageTarget: description: The target recipient for a page. properties: identifier: description: The identifier of the target (handle, UUID, or user UUID). example: my-team-handle type: string type: $ref: "#/components/schemas/IncidentPageTargetType" required: - type - identifier type: object IncidentPageTargetType: description: The type of target for a page request. enum: - team_handle - team_uuid - user_uuid example: team_uuid type: string x-enum-varnames: - TEAM_HANDLE - TEAM_UUID - USER_UUID IncidentPageUUIDDataResponse: description: Page UUID data in a response. properties: id: description: The UUID of the created page. example: 00000000-0000-0000-0000-000000000001 format: uuid type: string type: $ref: "#/components/schemas/IncidentPageUUIDType" required: - id - type type: object IncidentPageUUIDResponse: description: Response with a page UUID. properties: data: $ref: "#/components/schemas/IncidentPageUUIDDataResponse" required: - data type: object IncidentPageUUIDType: description: Resource type for a page UUID response. enum: - page_uuid example: page_uuid type: string x-enum-varnames: - PAGE_UUID IncidentPostmortemType: default: incident_postmortems description: Incident postmortem resource type. enum: - incident_postmortems example: incident_postmortems type: string x-enum-varnames: - INCIDENT_POSTMORTEMS IncidentPostmortemUpdatedTrigger: description: "Trigger a workflow when a postmortem is updated for an incident." properties: executionLimit: $ref: "#/components/schemas/ExecutionLimit" incidentType: description: "The type of incident that triggers the workflow." type: string tagCondition: $ref: "#/components/schemas/IncidentCondition" type: object IncidentPostmortemUpdatedTriggerWrapper: description: "Schema for an incident postmortem updated trigger." properties: incidentPostmortemUpdatedTrigger: $ref: "#/components/schemas/IncidentPostmortemUpdatedTrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - incidentPostmortemUpdatedTrigger type: object IncidentRelatedObject: description: Object related to an incident. enum: - users - attachments type: string x-enum-varnames: - USERS - ATTACHMENTS IncidentRelationshipData: description: Incident relationship data properties: id: description: Incident identifier example: "00000000-0000-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/IncidentResourceType" required: - type - id type: object IncidentResourceType: description: Incident resource type enum: - incidents example: incidents type: string x-enum-varnames: - INCIDENTS IncidentResponderCreatedTrigger: description: "Trigger a workflow when a responder is created for an incident." properties: executionLimit: $ref: "#/components/schemas/ExecutionLimit" incidentType: description: "The type of incident that triggers the workflow." type: string tagCondition: $ref: "#/components/schemas/IncidentCondition" type: object IncidentResponderCreatedTriggerWrapper: description: "Schema for an incident responder created trigger." properties: incidentResponderCreatedTrigger: $ref: "#/components/schemas/IncidentResponderCreatedTrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - incidentResponderCreatedTrigger type: object IncidentResponderDataAttributesResponse: description: Attributes of an incident responder in a response. properties: created: description: Timestamp when the responder was created. example: "2024-01-01T00:00:00.000Z" format: date-time type: string external_id: description: The external ID of the responder. example: nullable: true type: string external_source: description: The external source of the responder. example: nullable: true type: string is_billable: description: Whether this responder counts toward billing. example: true type: boolean last_active: description: Timestamp when the responder was last active. example: "2024-01-01T00:00:00.000Z" format: date-time nullable: true type: string meta: additionalProperties: {} description: Additional metadata for the responder. nullable: true type: object modified: description: Timestamp when the responder was last modified. example: "2024-01-01T00:00:00.000Z" format: date-time type: string required: - created - modified - is_billable type: object IncidentResponderDataRequest: description: Incident responder data in a create request. properties: relationships: $ref: "#/components/schemas/IncidentResponderRelationshipsRequest" type: $ref: "#/components/schemas/IncidentResponderType" required: - type - relationships type: object IncidentResponderDataResponse: description: Incident responder data in a response. properties: attributes: $ref: "#/components/schemas/IncidentResponderDataAttributesResponse" id: description: The responder identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string relationships: $ref: "#/components/schemas/IncidentResponderRelationships" type: $ref: "#/components/schemas/IncidentResponderType" required: - id - type - attributes type: object IncidentResponderIncludedItem: description: A user or role assignment related to an incident responder. oneOf: - $ref: "#/components/schemas/IncidentUserData" - $ref: "#/components/schemas/IncidentRoleAssignmentDataResponse" IncidentResponderRelatedObject: description: Object related to an incident responder. enum: - users - role_assignments type: string x-enum-varnames: - USERS - ROLE_ASSIGNMENTS IncidentResponderRelationships: description: Relationships for an incident responder. properties: created_by: $ref: "#/components/schemas/RelationshipToUser" last_modified_by: $ref: "#/components/schemas/RelationshipToUser" role_assignments: $ref: "#/components/schemas/IncidentResponderRoleAssignmentsRelationship" user: $ref: "#/components/schemas/NullableRelationshipToUser" type: object IncidentResponderRelationshipsRequest: description: Relationships for creating an incident responder. properties: user: $ref: "#/components/schemas/IncidentResponderUserRelationship" required: - user type: object IncidentResponderRequest: description: Request payload for creating an incident responder. properties: data: $ref: "#/components/schemas/IncidentResponderDataRequest" required: - data type: object IncidentResponderResponse: description: Response with a single incident responder. properties: data: $ref: "#/components/schemas/IncidentResponderDataResponse" included: description: Included related resources. items: $ref: "#/components/schemas/IncidentUserData" readOnly: true type: array required: - data type: object IncidentResponderRoleAssignmentRelationshipData: description: A single role assignment relationship data object. properties: id: description: The role assignment identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string type: description: The role assignment resource type. example: incident_role_assignments type: string required: - id - type type: object IncidentResponderRoleAssignmentsRelationship: description: Relationship to role assignments for a responder. properties: data: description: List of role assignment relationship data. items: $ref: "#/components/schemas/IncidentResponderRoleAssignmentRelationshipData" type: array type: object IncidentResponderType: description: Incident responder resource type. enum: - incident_responders example: incident_responders type: string x-enum-varnames: - INCIDENT_RESPONDERS IncidentResponderUserRelationship: description: Relationship to a user for a responder create request. properties: data: $ref: "#/components/schemas/IncidentResponderUserRelationshipData" required: - data type: object IncidentResponderUserRelationshipData: description: A user relationship data object for creating a responder. properties: id: description: The user identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string type: description: The user resource type. example: users type: string required: - id - type type: object IncidentRespondersPagination: description: Offset-based pagination for incident responders. properties: first_offset: description: The offset of the first page. example: 0 format: int64 type: integer last_offset: description: The offset of the last page, if available. example: 25 format: int64 nullable: true type: integer limit: description: The maximum number of elements returned per page. example: 25 format: int64 type: integer next_offset: description: The offset of the next page, if available. example: 25 format: int64 nullable: true type: integer offset: description: The index of the first element in the current page. example: 0 format: int64 type: integer prev_offset: description: The offset of the previous page, if available. example: 0 format: int64 nullable: true type: integer total: description: The total number of elements, when available. example: 1 format: int64 nullable: true type: integer type: description: The pagination type. example: offset_limit type: string type: object IncidentRespondersResponse: description: Response with a list of incident responders. properties: data: description: List of incident responders. items: $ref: "#/components/schemas/IncidentResponderDataResponse" type: array included: description: Included related resources. items: $ref: "#/components/schemas/IncidentResponderIncludedItem" readOnly: true type: array links: additionalProperties: type: string description: Links to pages of incident responders. type: object meta: $ref: "#/components/schemas/IncidentRespondersResponseMeta" required: - data type: object IncidentRespondersResponseMeta: description: Pagination metadata for the responder list. properties: page: $ref: "#/components/schemas/IncidentRespondersResponseMetaPage" pagination: $ref: "#/components/schemas/IncidentRespondersPagination" type: object IncidentRespondersResponseMetaPage: description: Total count for the responder list. properties: total_filtered_count: description: Total number of responders matching the query, before pagination. example: 1 format: int64 type: integer required: - total_filtered_count type: object IncidentRespondersType: description: The incident responders type. enum: - incident_responders example: incident_responders type: string x-enum-varnames: - INCIDENT_RESPONDERS IncidentResponse: description: Response with an incident. properties: data: $ref: "#/components/schemas/IncidentResponseData" included: description: Included related resources that the user requested. items: $ref: "#/components/schemas/IncidentResponseIncludedItem" readOnly: true type: array required: - data type: object IncidentResponseAttributes: additionalProperties: {} description: The incident's attributes from a response. properties: archived: description: Timestamp of when the incident was archived. format: date-time nullable: true readOnly: true type: string case_id: description: The incident case id. format: int64 nullable: true type: integer created: description: Timestamp when the incident was created. format: date-time readOnly: true type: string customer_impact_duration: description: |- Length of the incident's customer impact in seconds. Equals the difference between `customer_impact_start` and `customer_impact_end`. format: int64 readOnly: true type: integer customer_impact_end: description: Timestamp when customers were no longer impacted by the incident. format: date-time nullable: true type: string customer_impact_scope: description: A summary of the impact customers experienced during the incident. example: "An example customer impact scope" nullable: true type: string customer_impact_start: description: Timestamp when customers began being impacted by the incident. format: date-time nullable: true type: string customer_impacted: description: A flag indicating whether the incident caused customer impact. example: false type: boolean declared: description: Timestamp when the incident was declared. format: date-time readOnly: true type: string declared_by: $ref: "#/components/schemas/IncidentNonDatadogCreator" declared_by_uuid: description: UUID of the user who declared the incident. nullable: true type: string detected: description: Timestamp when the incident was detected. format: date-time nullable: true type: string fields: additionalProperties: $ref: "#/components/schemas/IncidentFieldAttributes" description: A condensed view of the user-defined fields attached to incidents. example: {"severity": {"type": "dropdown", "value": "SEV-5"}} type: object incident_type_uuid: description: A unique identifier that represents an incident type. example: "00000000-0000-0000-0000-000000000000" type: string is_test: description: A flag indicating whether the incident is a test incident. example: false type: boolean modified: description: Timestamp when the incident was last modified. format: date-time readOnly: true type: string non_datadog_creator: $ref: "#/components/schemas/IncidentNonDatadogCreator" notification_handles: description: Notification handles that will be notified of the incident during update. example: [{"display_name": "Jane Doe", "handle": "@user@email.com"}, {"display_name": "Slack Channel", "handle": "@slack-channel"}, {"display_name": "Incident Workflow", "handle": "@workflow-from-incident"}] items: $ref: "#/components/schemas/IncidentNotificationHandle" nullable: true type: array public_id: description: The monotonically increasing integer ID for the incident. example: 1 format: int64 type: integer resolved: description: |- Timestamp when the incident's state was last changed from active or stable to resolved or completed. format: date-time nullable: true type: string severity: $ref: "#/components/schemas/IncidentSeverity" state: description: The state incident. nullable: true type: string time_to_detect: description: |- The amount of time in seconds to detect the incident. Equals the difference between `customer_impact_start` and `detected`. format: int64 readOnly: true type: integer time_to_internal_response: description: >- The amount of time in seconds to call incident after detection. Equals the difference of `detected` and `created`. format: int64 readOnly: true type: integer time_to_repair: description: >- The amount of time in seconds to resolve customer impact after detecting the issue. Equals the difference between `customer_impact_end` and `detected`. format: int64 readOnly: true type: integer time_to_resolve: description: >- The amount of time in seconds to resolve the incident after it was created. Equals the difference between `created` and `resolved`. format: int64 readOnly: true type: integer title: description: The title of the incident, which summarizes what happened. example: "A test incident title" type: string visibility: description: The incident visibility status. nullable: true type: string required: - title type: object IncidentResponseData: description: Incident data from a response. properties: attributes: $ref: "#/components/schemas/IncidentResponseAttributes" id: description: The incident's ID. example: "00000000-0000-0000-1234-000000000000" type: string relationships: $ref: "#/components/schemas/IncidentResponseRelationships" type: $ref: "#/components/schemas/IncidentType" required: - id - type type: object IncidentResponseIncludedItem: description: An object related to an incident that is included in the response. oneOf: - $ref: "#/components/schemas/IncidentUserData" - $ref: "#/components/schemas/AttachmentData" IncidentResponseMeta: description: The metadata object containing pagination metadata. properties: pagination: $ref: "#/components/schemas/IncidentResponseMetaPagination" readOnly: true type: object IncidentResponseMetaPagination: description: Pagination properties. properties: next_offset: description: The index of the first element in the next page of results. Equal to page size added to the current offset. example: 1000 format: int64 type: integer offset: description: The index of the first element in the results. example: 10 format: int64 type: integer size: description: Maximum size of pages to return. example: 1000 format: int64 type: integer type: object IncidentResponseRelationships: description: The incident's relationships from a response. properties: attachments: $ref: "#/components/schemas/RelationshipToIncidentAttachment" commander_user: $ref: "#/components/schemas/NullableRelationshipToUser" created_by_user: $ref: "#/components/schemas/RelationshipToUser" declared_by_user: $ref: "#/components/schemas/RelationshipToUser" impacts: $ref: "#/components/schemas/RelationshipToIncidentImpacts" incident_type: $ref: "#/components/schemas/RelationshipToIncidentType" integrations: $ref: "#/components/schemas/RelationshipToIncidentIntegrationMetadatas" last_modified_by_user: $ref: "#/components/schemas/RelationshipToUser" responders: $ref: "#/components/schemas/RelationshipToIncidentResponders" user_defined_fields: $ref: "#/components/schemas/RelationshipToIncidentUserDefinedFields" type: object IncidentRoleAssignmentDataAttributesResponse: description: Attributes of an incident role assignment. properties: created: description: Timestamp when the role assignment was created. example: "2024-01-01T00:00:00.000Z" format: date-time type: string deleted: description: Timestamp when the role assignment was deleted, or the zero timestamp if it has not been deleted. example: "0001-01-01T00:00:00Z" format: date-time type: string modified: description: Timestamp when the role assignment was last modified. example: "2024-01-01T00:00:00.000Z" format: date-time type: string responder_type: description: The type of the responder. example: user type: string role: description: The name of the assigned role. example: commander type: string required: - role - responder_type - created - modified type: object IncidentRoleAssignmentDataResponse: description: Role assignment data in a response. properties: attributes: $ref: "#/components/schemas/IncidentRoleAssignmentDataAttributesResponse" id: description: The role assignment identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string relationships: $ref: "#/components/schemas/IncidentRoleAssignmentRelationshipsResponse" type: $ref: "#/components/schemas/IncidentRoleAssignmentType" required: - id - type - attributes type: object IncidentRoleAssignmentRelationshipsResponse: description: Relationships of a role assignment. properties: created_by_user: $ref: "#/components/schemas/IncidentRoleAssignmentResponderRelationship" last_modified_by_user: $ref: "#/components/schemas/IncidentRoleAssignmentResponderRelationship" reserved_role: $ref: "#/components/schemas/IncidentRoleAssignmentRoleRelationship" responder: $ref: "#/components/schemas/IncidentRoleAssignmentResponderRelationship" user_defined_role: $ref: "#/components/schemas/IncidentRoleAssignmentRoleRelationship" required: - responder type: object IncidentRoleAssignmentResponderRelationship: description: Relationship to a responder. properties: data: $ref: "#/components/schemas/IncidentRoleAssignmentResponderRelationshipData" required: - data type: object IncidentRoleAssignmentResponderRelationshipData: description: Responder relationship data. properties: id: description: The responder identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string type: description: The responder resource type. example: users type: string required: - id - type type: object IncidentRoleAssignmentRoleRelationship: description: Relationship to a role. properties: data: $ref: "#/components/schemas/IncidentRoleAssignmentRoleRelationshipData" type: object IncidentRoleAssignmentRoleRelationshipData: description: Role relationship data. nullable: true properties: id: description: The role identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string type: description: The role resource type. example: incident_reserved_roles type: string required: - id - type type: object IncidentRoleAssignmentType: description: Incident role assignment resource type. enum: - incident_role_assignments example: incident_role_assignments type: string x-enum-varnames: - INCIDENT_ROLE_ASSIGNMENTS IncidentRuleCondition: description: A condition for an incident rule. properties: field: description: The field to match on. example: severity type: string values: description: The values to match. example: - SEV-1 - SEV-2 items: type: string type: array required: - field - values type: object IncidentRuleDataAttributesRequest: description: Attributes for creating an incident rule. properties: condition: $ref: "#/components/schemas/IncidentRuleQueryCondition" condition_table_type: description: "The condition table type. 1 = raw query." example: 1 format: int64 type: integer conditions: description: List of field-based conditions. items: $ref: "#/components/schemas/IncidentRuleCondition" type: array enabled: description: Whether the rule is enabled. example: true type: boolean execution_type: $ref: "#/components/schemas/IncidentRuleExecutionType" incident_type_uuid: description: The UUID of the incident type this rule applies to. example: 00000000-0000-0000-0000-000000000000 format: uuid nullable: true type: string match_any_condition: description: Whether any condition (OR logic) should match instead of all (AND logic). example: false type: boolean task_id: $ref: "#/components/schemas/IncidentRuleTaskIDType" task_payload: description: The JSON-encoded payload for the task. example: "{}" type: string trigger: $ref: "#/components/schemas/IncidentRuleTriggerType" required: - execution_type - condition_table_type - condition - task_id - task_payload - enabled type: object IncidentRuleDataAttributesResponse: description: Attributes of an incident rule in a response. properties: condition: $ref: "#/components/schemas/IncidentRuleQueryCondition" condition_table_type: description: The condition table type. example: 1 format: int64 type: integer conditions: description: List of field-based conditions. items: $ref: "#/components/schemas/IncidentRuleCondition" type: array created: description: Timestamp when the rule was created. example: "2024-01-01T00:00:00.000Z" format: date-time type: string created_by_uuid: description: UUID of the user who created the rule. example: 00000000-0000-0000-0000-000000000001 format: uuid type: string deleted: description: Timestamp when the rule was deleted. example: format: date-time nullable: true type: string enabled: description: Whether the rule is enabled. example: true type: boolean execution_type: description: The execution type of the rule. example: 1 format: int64 type: integer incident_settings_association_uuid: description: The incident settings association UUID. example: format: uuid nullable: true type: string match_any_condition: description: Whether any condition should match. example: false type: boolean modified: description: Timestamp when the rule was last modified. example: "2024-01-01T00:00:00.000Z" format: date-time type: string modified_by_uuid: description: UUID of the user who last modified the rule. example: 00000000-0000-0000-0000-000000000001 format: uuid type: string org_id: description: The organization ID. example: 123456 format: int64 type: integer task_id: description: The task ID. example: notify-incident-handles-job nullable: true type: string task_payload: description: The JSON-encoded task payload. example: "{}" nullable: true type: string trigger: description: The trigger event for the rule. example: incident_created_trigger type: string type: object IncidentRuleDataRequest: description: Incident rule data in a create request. properties: attributes: $ref: "#/components/schemas/IncidentRuleDataAttributesRequest" type: $ref: "#/components/schemas/IncidentRuleType" required: - type - attributes type: object IncidentRuleDataResponse: description: Incident rule data in a response. properties: attributes: $ref: "#/components/schemas/IncidentRuleDataAttributesResponse" id: description: The rule identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string type: $ref: "#/components/schemas/IncidentRuleResponseType" required: - id - type - attributes type: object IncidentRuleExecutionType: description: The execution type of an incident rule. enum: - 1 - 2 example: 1 format: int64 type: integer x-enum-varnames: - SINGLE_EXECUTION - MULTI_EXECUTION IncidentRulePatchDataAttributesRequest: description: Attributes for patching an incident rule. All fields are optional. properties: condition: $ref: "#/components/schemas/IncidentRuleQueryCondition" conditions: description: List of field-based conditions. items: $ref: "#/components/schemas/IncidentRuleCondition" type: array enabled: description: Whether the rule is enabled. example: true type: boolean task_payload: description: The JSON-encoded payload for the task. example: "{}" type: string trigger: $ref: "#/components/schemas/IncidentRuleTriggerType" type: object IncidentRulePatchDataRequest: description: Incident rule data in a patch request. properties: attributes: $ref: "#/components/schemas/IncidentRulePatchDataAttributesRequest" id: description: The rule identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string type: $ref: "#/components/schemas/IncidentRuleType" required: - id - type type: object IncidentRulePatchRequest: description: Request payload for patching an incident rule. properties: data: $ref: "#/components/schemas/IncidentRulePatchDataRequest" required: - data type: object IncidentRuleQueryCondition: description: A query-based condition for an incident rule. properties: normalized_query: description: The normalized query string. example: "severity:SEV-1" nullable: true type: string raw_query: description: The raw query string. example: "severity:SEV-1" nullable: true type: string type: object IncidentRuleRequest: description: Request payload for creating an incident rule. properties: data: $ref: "#/components/schemas/IncidentRuleDataRequest" required: - data type: object IncidentRuleResponse: description: Response with a single incident rule. properties: data: $ref: "#/components/schemas/IncidentRuleDataResponse" required: - data type: object IncidentRuleResponseType: description: Incident rule response resource type. enum: - incidents_rules example: incidents_rules type: string x-enum-varnames: - INCIDENTS_RULES IncidentRuleTaskIDType: description: The task ID for an incident rule. enum: - jira-create-issue-job - notify-incident-handles-job - servicenow-create-incident-job - slack-create-channel-job - zoom-create-meeting-job - google-meet-create-meeting-job - workflow-automation-job - ms-teams-create-meeting-job - google-chat-create-space-job - zoom-suppress-summarization-job - ms-teams-suppress-summarization-job - google-meet-suppress-summarization-job example: notify-incident-handles-job type: string x-enum-varnames: - JIRA_CREATE_ISSUE_JOB - NOTIFY_INCIDENT_HANDLES_JOB - SERVICENOW_CREATE_INCIDENT_JOB - SLACK_CREATE_CHANNEL_JOB - ZOOM_CREATE_MEETING_JOB - GOOGLE_MEET_CREATE_MEETING_JOB - WORKFLOW_AUTOMATION_JOB - MS_TEAMS_CREATE_MEETING_JOB - GOOGLE_CHAT_CREATE_SPACE_JOB - ZOOM_SUPPRESS_SUMMARIZATION_JOB - MS_TEAMS_SUPPRESS_SUMMARIZATION_JOB - GOOGLE_MEET_SUPPRESS_SUMMARIZATION_JOB IncidentRuleTriggerType: description: The trigger event for an incident rule. enum: - incident_saved_trigger - incident_created_trigger - incident_modified_trigger example: incident_created_trigger type: string x-enum-varnames: - INCIDENT_SAVED_TRIGGER - INCIDENT_CREATED_TRIGGER - INCIDENT_MODIFIED_TRIGGER IncidentRuleType: description: Incident rule resource type. enum: - incident_rules example: incident_rules type: string x-enum-varnames: - INCIDENT_RULES IncidentRulesResponse: description: Response with a list of incident rules. properties: data: description: List of incident rules. items: $ref: "#/components/schemas/IncidentRuleDataResponse" type: array required: - data type: object IncidentSavedTrigger: description: "Trigger a workflow when an incident is declared or updated." properties: executionLimit: $ref: "#/components/schemas/ExecutionLimit" incidentType: description: "The type of incident that triggers the workflow." type: string serialExecution: $ref: "#/components/schemas/SerialExecution" tagCondition: $ref: "#/components/schemas/IncidentCondition" type: object IncidentSavedTriggerWrapper: description: "Schema for an incident declared or updated trigger." properties: incidentSavedTrigger: $ref: "#/components/schemas/IncidentSavedTrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - incidentSavedTrigger type: object IncidentScheduleTrigger: description: "Trigger a workflow on a schedule for an incident." properties: incidentType: description: "The type of incident that triggers the workflow." type: string rrule: description: "The recurrence rule for the schedule, expressed as an iCalendar `RRULE` string." example: "DTSTART:20241220T151700Z\nRRULE:FREQ=MONTHLY" minLength: 1 type: string tagCondition: $ref: "#/components/schemas/IncidentCondition" required: - rrule type: object IncidentScheduleTriggerWrapper: description: "Schema for an incident schedule trigger." properties: incidentScheduleTrigger: $ref: "#/components/schemas/IncidentScheduleTrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - incidentScheduleTrigger type: object IncidentSearchResponse: description: Response with incidents and facets. properties: data: $ref: "#/components/schemas/IncidentSearchResponseData" included: description: Included related resources that the user requested. items: $ref: "#/components/schemas/IncidentResponseIncludedItem" readOnly: true type: array meta: $ref: "#/components/schemas/IncidentSearchResponseMeta" required: - data type: object IncidentSearchResponseAttributes: description: Attributes returned by an incident search. properties: facets: $ref: "#/components/schemas/IncidentSearchResponseFacetsData" incidents: description: Incidents returned by the search. items: $ref: "#/components/schemas/IncidentSearchResponseIncidentsData" type: array total: description: Number of incidents returned by the search. example: 10 format: int32 maximum: 2147483647 type: integer required: - facets - incidents - total type: object IncidentSearchResponseData: description: Data returned by an incident search. properties: attributes: $ref: "#/components/schemas/IncidentSearchResponseAttributes" type: $ref: "#/components/schemas/IncidentSearchResultsType" type: object IncidentSearchResponseFacetCount: description: Count of the facet value appearing in search results. example: 5 format: int32 maximum: 2147483647 type: integer IncidentSearchResponseFacetsData: description: Facet data for incidents returned by a search query. properties: commander: description: Facet data for incident commander users. items: $ref: "#/components/schemas/IncidentSearchResponseUserFacetData" type: array created_by: description: Facet data for incident creator users. items: $ref: "#/components/schemas/IncidentSearchResponseUserFacetData" type: array fields: description: Facet data for incident property fields. items: $ref: "#/components/schemas/IncidentSearchResponsePropertyFieldFacetData" type: array impact: description: Facet data for incident impact attributes. items: $ref: "#/components/schemas/IncidentSearchResponseFieldFacetData" type: array last_modified_by: description: Facet data for incident last modified by users. items: $ref: "#/components/schemas/IncidentSearchResponseUserFacetData" type: array postmortem: description: Facet data for incident postmortem existence. items: $ref: "#/components/schemas/IncidentSearchResponseFieldFacetData" type: array responder: description: Facet data for incident responder users. items: $ref: "#/components/schemas/IncidentSearchResponseUserFacetData" type: array severity: description: Facet data for incident severity attributes. items: $ref: "#/components/schemas/IncidentSearchResponseFieldFacetData" type: array state: description: Facet data for incident state attributes. items: $ref: "#/components/schemas/IncidentSearchResponseFieldFacetData" type: array time_to_repair: description: Facet data for incident time to repair metrics. items: $ref: "#/components/schemas/IncidentSearchResponseNumericFacetData" type: array time_to_resolve: description: Facet data for incident time to resolve metrics. items: $ref: "#/components/schemas/IncidentSearchResponseNumericFacetData" type: array type: object IncidentSearchResponseFieldFacetData: description: Facet value and number of occurrences for a property field of an incident. properties: count: $ref: "#/components/schemas/IncidentSearchResponseFacetCount" name: description: The facet value appearing in search results. example: SEV-2 type: string type: object IncidentSearchResponseIncidentsData: description: Incident returned by the search. properties: data: $ref: "#/components/schemas/IncidentResponseData" required: - data type: object IncidentSearchResponseMeta: description: The metadata object containing pagination metadata. properties: pagination: $ref: "#/components/schemas/IncidentResponseMetaPagination" readOnly: true type: object IncidentSearchResponseNumericFacetData: description: Facet data numeric attributes of an incident. properties: aggregates: $ref: "#/components/schemas/IncidentSearchResponseNumericFacetDataAggregates" name: description: Name of the incident property field. example: time_to_repair type: string required: - name - aggregates type: object IncidentSearchResponseNumericFacetDataAggregates: description: Aggregate information for numeric incident data. properties: max: description: Maximum value of the numeric aggregates. example: 1234.0 format: double nullable: true type: number min: description: Minimum value of the numeric aggregates. example: 20.0 format: double nullable: true type: number type: object IncidentSearchResponsePropertyFieldFacetData: description: Facet data for the incident property fields. properties: aggregates: $ref: "#/components/schemas/IncidentSearchResponseNumericFacetDataAggregates" facets: description: Facet data for the property field of an incident. items: $ref: "#/components/schemas/IncidentSearchResponseFieldFacetData" type: array name: description: Name of the incident property field. example: Severity type: string required: - facets - name type: object IncidentSearchResponseUserFacetData: description: Facet data for user attributes of an incident. properties: count: $ref: "#/components/schemas/IncidentSearchResponseFacetCount" email: description: Email of the user. example: datadog.user@example.com type: string handle: description: Handle of the user. example: "@datadog.user@example.com" type: string name: description: Name of the user. example: Datadog User type: string uuid: description: ID of the user. example: 773b045d-ccf8-4808-bd3b-955ef6a8c940 type: string type: object IncidentSearchResultsType: default: incidents_search_results description: Incident search result type. enum: - incidents_search_results example: incidents_search_results type: string x-enum-varnames: - INCIDENTS_SEARCH_RESULTS IncidentSearchSortOrder: description: The ways searched incidents can be sorted. enum: - created - -created type: string x-enum-varnames: - CREATED_ASCENDING - CREATED_DESCENDING IncidentServiceNowRecordDataAttributesRequest: description: Attributes for creating a ServiceNow record for an incident. properties: assignment_group: description: The ServiceNow assignment group. example: IT Support type: string configuration_item_mapping: description: The ServiceNow configuration item mapping. example: my-service type: string instance_name: description: The ServiceNow instance name. example: my-instance type: string record_id: description: An existing ServiceNow record ID (Sys ID) to link instead of creating a new record. example: abc123def456 type: string required: - instance_name - assignment_group - configuration_item_mapping type: object IncidentServiceNowRecordDataRequest: description: ServiceNow record data in a create request. properties: attributes: $ref: "#/components/schemas/IncidentServiceNowRecordDataAttributesRequest" type: $ref: "#/components/schemas/IncidentServiceNowRecordPromptType" required: - type - attributes type: object IncidentServiceNowRecordPromptType: description: ServiceNow record prompt resource type. enum: - incident_servicenow_record_prompt example: incident_servicenow_record_prompt type: string x-enum-varnames: - INCIDENT_SERVICENOW_RECORD_PROMPT IncidentServiceNowRecordRequest: description: Request payload for creating a ServiceNow record for an incident. properties: data: $ref: "#/components/schemas/IncidentServiceNowRecordDataRequest" required: - data type: object IncidentSeverity: description: The incident severity. enum: - UNKNOWN - SEV-0 - SEV-1 - SEV-2 - SEV-3 - SEV-4 - SEV-5 example: UNKNOWN type: string x-enum-varnames: - UNKNOWN - SEV_0 - SEV_1 - SEV_2 - SEV_3 - SEV_4 - SEV_5 IncidentTagValue: description: "An incident tag and its accepted values." properties: tag: description: "The incident tag to match." example: "" type: string values: description: "The accepted values for the incident tag." example: - "" items: type: string type: array required: - tag - values type: object IncidentTimelineCellCreateAttributes: description: The timeline cell's attributes for a create request. oneOf: - $ref: "#/components/schemas/IncidentTimelineCellMarkdownCreateAttributes" IncidentTimelineCellMarkdownContentType: default: markdown description: Type of the Markdown timeline cell. enum: - markdown example: markdown type: string x-enum-varnames: - MARKDOWN IncidentTimelineCellMarkdownCreateAttributes: description: Timeline cell data for Markdown timeline cells for a create request. properties: cell_type: $ref: "#/components/schemas/IncidentTimelineCellMarkdownContentType" content: $ref: "#/components/schemas/IncidentTimelineCellMarkdownCreateAttributesContent" important: default: false description: A flag indicating whether the timeline cell is important and should be highlighted. example: false type: boolean required: - content - cell_type type: object IncidentTimelineCellMarkdownCreateAttributesContent: description: The Markdown timeline cell contents. properties: content: description: The Markdown content of the cell. example: "An example timeline cell message." nullable: false type: string type: object IncidentTimestampOverrideDataAttributesRequest: description: Attributes for creating a timestamp override. properties: timestamp_type: $ref: "#/components/schemas/IncidentTimestampType" timestamp_value: description: The overridden timestamp value. example: "2024-01-01T10:00:00.000Z" format: date-time type: string required: - timestamp_type - timestamp_value type: object IncidentTimestampOverrideDataAttributesResponse: description: Attributes of a timestamp override in a response. properties: created_at: description: Timestamp when the override was created. example: "2024-01-01T00:00:00.000Z" format: date-time type: string deleted_at: description: Timestamp when the override was deleted. example: format: date-time nullable: true type: string incident_id: description: The incident identifier. example: 00000000-0000-0000-0000-000000000000 type: string modified_at: description: Timestamp when the override was last modified. example: "2024-01-01T00:00:00.000Z" format: date-time type: string timestamp_type: $ref: "#/components/schemas/IncidentTimestampType" timestamp_value: description: The overridden timestamp value. example: "2024-01-01T10:00:00.000Z" format: date-time type: string required: - incident_id - timestamp_type - timestamp_value - created_at - modified_at type: object IncidentTimestampOverrideDataRequest: description: Timestamp override data in a create request. properties: attributes: $ref: "#/components/schemas/IncidentTimestampOverrideDataAttributesRequest" type: $ref: "#/components/schemas/IncidentTimestampOverrideType" required: - type - attributes type: object IncidentTimestampOverrideDataResponse: description: Timestamp override data in a response. properties: attributes: $ref: "#/components/schemas/IncidentTimestampOverrideDataAttributesResponse" id: description: The timestamp override identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string relationships: $ref: "#/components/schemas/IncidentTimestampOverrideRelationships" type: $ref: "#/components/schemas/IncidentTimestampOverrideType" required: - id - type - attributes type: object IncidentTimestampOverridePatchDataAttributesRequest: description: Attributes for patching a timestamp override. properties: timestamp_value: description: The overridden timestamp value. example: "2024-01-01T10:00:00.000Z" format: date-time type: string required: - timestamp_value type: object IncidentTimestampOverridePatchDataRequest: description: Timestamp override data in a patch request. properties: attributes: $ref: "#/components/schemas/IncidentTimestampOverridePatchDataAttributesRequest" id: description: The timestamp override identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string type: $ref: "#/components/schemas/IncidentTimestampOverrideType" required: - id - type type: object IncidentTimestampOverridePatchRequest: description: Request payload for patching a timestamp override. properties: data: $ref: "#/components/schemas/IncidentTimestampOverridePatchDataRequest" required: - data type: object IncidentTimestampOverrideRelationships: description: Relationships for a timestamp override. properties: created_by_user: $ref: "#/components/schemas/RelationshipToUser" last_modified_by_user: $ref: "#/components/schemas/RelationshipToUser" type: object IncidentTimestampOverrideRequest: description: Request payload for creating a timestamp override. properties: data: $ref: "#/components/schemas/IncidentTimestampOverrideDataRequest" required: - data type: object IncidentTimestampOverrideResponse: description: Response with a single timestamp override. properties: data: $ref: "#/components/schemas/IncidentTimestampOverrideDataResponse" included: description: Included related resources. items: $ref: "#/components/schemas/IncidentUserData" readOnly: true type: array required: - data type: object IncidentTimestampOverrideType: description: Incident timestamp override resource type. enum: - incidents_timestamp_overrides example: incidents_timestamp_overrides type: string x-enum-varnames: - INCIDENTS_TIMESTAMP_OVERRIDES IncidentTimestampOverridesResponse: description: Response with a list of timestamp overrides. properties: data: description: List of timestamp overrides. items: $ref: "#/components/schemas/IncidentTimestampOverrideDataResponse" type: array included: description: Included related resources. items: $ref: "#/components/schemas/IncidentUserData" readOnly: true type: array required: - data type: object IncidentTimestampType: description: The type of timestamp to override. enum: - detected - resolved - declared example: detected type: string x-enum-varnames: - DETECTED - RESOLVED - DECLARED IncidentTodoAnonymousAssignee: description: Anonymous assignee entity. properties: icon: description: URL for assignee's icon. example: https://a.slack-edge.com/80588/img/slackbot_48.png type: string id: description: Anonymous assignee's ID. example: USLACKBOT type: string name: description: Assignee's name. example: Slackbot type: string source: $ref: "#/components/schemas/IncidentTodoAnonymousAssigneeSource" required: - id - icon - name - source type: object IncidentTodoAnonymousAssigneeSource: default: slack description: The source of the anonymous assignee. enum: - slack - microsoft_teams example: slack type: string x-enum-varnames: - SLACK - MICROSOFT_TEAMS IncidentTodoAssignee: description: A todo assignee. example: "@test.user@test.com" oneOf: - $ref: "#/components/schemas/IncidentTodoAssigneeHandle" - $ref: "#/components/schemas/IncidentTodoAnonymousAssignee" IncidentTodoAssigneeArray: description: Array of todo assignees. example: - "@test.user@test.com" items: $ref: "#/components/schemas/IncidentTodoAssignee" type: array IncidentTodoAssigneeHandle: description: Assignee's @-handle. example: "@test.user@test.com" type: string IncidentTodoAttributes: description: Incident todo's attributes. properties: assignees: $ref: "#/components/schemas/IncidentTodoAssigneeArray" completed: description: Timestamp when the todo was completed. example: "2023-03-06T22:00:00.000000+00:00" nullable: true type: string content: description: The follow-up task's content. example: Restore lost data. type: string created: description: Timestamp when the incident todo was created. format: date-time readOnly: true type: string due_date: description: Timestamp when the todo should be completed by. example: "2023-07-10T05:00:00.000000+00:00" nullable: true type: string incident_id: description: UUID of the incident this todo is connected to. example: "00000000-aaaa-0000-0000-000000000000" type: string modified: description: Timestamp when the incident todo was last modified. format: date-time readOnly: true type: string required: - content - assignees type: object IncidentTodoCreateData: description: Incident todo data for a create request. properties: attributes: $ref: "#/components/schemas/IncidentTodoAttributes" type: $ref: "#/components/schemas/IncidentTodoType" required: - type - attributes type: object IncidentTodoCreateRequest: description: Create request for an incident todo. properties: data: $ref: "#/components/schemas/IncidentTodoCreateData" required: - data type: object IncidentTodoListResponse: description: Response with a list of incident todos. properties: data: description: An array of incident todos. items: $ref: "#/components/schemas/IncidentTodoResponseData" type: array included: description: Included related resources that the user requested. items: $ref: "#/components/schemas/IncidentTodoResponseIncludedItem" readOnly: true type: array meta: $ref: "#/components/schemas/IncidentResponseMeta" required: - data type: object IncidentTodoPatchData: description: Incident todo data for a patch request. properties: attributes: $ref: "#/components/schemas/IncidentTodoAttributes" type: $ref: "#/components/schemas/IncidentTodoType" required: - type - attributes type: object IncidentTodoPatchRequest: description: Patch request for an incident todo. properties: data: $ref: "#/components/schemas/IncidentTodoPatchData" required: - data type: object IncidentTodoRelationships: description: The incident's relationships from a response. properties: created_by_user: $ref: "#/components/schemas/RelationshipToUser" last_modified_by_user: $ref: "#/components/schemas/RelationshipToUser" type: object IncidentTodoResponse: description: Response with an incident todo. properties: data: $ref: "#/components/schemas/IncidentTodoResponseData" included: description: Included related resources that the user requested. items: $ref: "#/components/schemas/IncidentTodoResponseIncludedItem" readOnly: true type: array required: - data type: object IncidentTodoResponseData: description: Incident todo response data. properties: attributes: $ref: "#/components/schemas/IncidentTodoAttributes" id: description: The incident todo's ID. example: "00000000-0000-0000-1234-000000000000" type: string relationships: $ref: "#/components/schemas/IncidentTodoRelationships" type: $ref: "#/components/schemas/IncidentTodoType" required: - id - type type: object IncidentTodoResponseIncludedItem: description: An object related to an incident todo that is included in the response. oneOf: - $ref: "#/components/schemas/User" IncidentTodoType: default: incident_todos description: Todo resource type. enum: - incident_todos example: incident_todos type: string x-enum-varnames: - INCIDENT_TODOS IncidentTrigger: description: "Trigger a workflow from an incident. For automatic triggering a handle must be configured and the workflow must be published." properties: rateLimit: $ref: "#/components/schemas/TriggerRateLimit" version: description: "Version of the incident manual trigger." type: string type: object IncidentTriggerWrapper: description: "Schema for an incident-based trigger." properties: incidentTrigger: $ref: "#/components/schemas/IncidentTrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - incidentTrigger type: object IncidentType: default: incidents description: Incident resource type. enum: - incidents example: incidents type: string x-enum-varnames: - INCIDENTS IncidentTypeAttributes: description: Incident type's attributes. properties: configuration: $ref: "#/components/schemas/IncidentTypeConfiguration" readOnly: true createdAt: description: Timestamp when the incident type was created. format: date-time readOnly: true type: string createdBy: description: A unique identifier that represents the user that created the incident type. example: "00000000-0000-0000-0000-000000000000" readOnly: true type: string description: description: Text that describes the incident type. example: "Any incidents that harm (or have the potential to) the confidentiality, integrity, or availability of our data." type: string is_default: default: false description: If true, this incident type will be used as the default incident type if a type is not specified during the creation of incident resources. example: false type: boolean lastModifiedBy: description: A unique identifier that represents the user that last modified the incident type. example: "00000000-0000-0000-0000-000000000000" readOnly: true type: string modifiedAt: description: Timestamp when the incident type was last modified. format: date-time readOnly: true type: string name: description: The name of the incident type. example: "Security Incident" type: string prefix: description: The string that will be prepended to the incident title across the Datadog app. example: "IR" readOnly: true type: string required: - name type: object IncidentTypeConfiguration: description: >- The incident-type-scoped behavior settings. All fields are optional on update. Any field omitted from a PATCH request keeps its current value. This object is read-only on the incident type resource itself and is only mutated through the update (PATCH) endpoint. properties: allow_incident_deletion: default: false description: Whether incidents of this type can be deleted. example: false type: boolean allow_workflows: default: true description: Whether automation workflows can be triggered for incidents of this type. example: true type: boolean create_message: description: An optional message shown to users when they declare an incident of this type. example: "Create an incident here" type: string editable_timestamps: default: false description: Whether responders can edit incident timestamps for incidents of this type. example: false type: boolean private_incidents: default: false description: >- Whether responders can create private incidents of this type. This is an opt-in setting, distinct from `private_incidents_by_default`, which controls whether incidents are created private automatically. example: false type: boolean private_incidents_by_default: default: false description: Whether incidents of this type are created as private by default. example: false type: boolean slug_source: $ref: "#/components/schemas/IncidentTypeSlugSource" test_incidents: default: true description: Whether incidents of this type are treated as test incidents. example: true type: boolean type: object IncidentTypeCreateData: description: Incident type data for a create request. properties: attributes: $ref: "#/components/schemas/IncidentTypeAttributes" type: $ref: "#/components/schemas/IncidentTypeType" required: - type - attributes type: object IncidentTypeCreateRequest: description: Create request for an incident type. properties: data: $ref: "#/components/schemas/IncidentTypeCreateData" required: - data type: object IncidentTypeListResponse: description: Response with a list of incident types. properties: data: description: An array of incident type objects. items: $ref: "#/components/schemas/IncidentTypeObject" type: array required: - data type: object IncidentTypeObject: description: Incident type response data. properties: attributes: $ref: "#/components/schemas/IncidentTypeAttributes" id: description: The incident type's ID. example: "00000000-0000-0000-0000-000000000000" type: string relationships: $ref: "#/components/schemas/IncidentTypeRelationships" type: $ref: "#/components/schemas/IncidentTypeType" required: - id - type type: object IncidentTypePatchData: description: Incident type data for a patch request. properties: attributes: $ref: "#/components/schemas/IncidentTypeUpdateAttributes" id: description: The incident type's ID. example: "00000000-0000-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/IncidentTypeType" required: - id - type - attributes type: object IncidentTypePatchRequest: description: Patch request for an incident type. properties: data: $ref: "#/components/schemas/IncidentTypePatchData" required: - data type: object IncidentTypeRelationships: additionalProperties: {} description: The incident type's resource relationships. properties: created_by_user: $ref: "#/components/schemas/RelationshipToUser" google_meet_configuration: $ref: "#/components/schemas/GoogleMeetConfigurationReference" last_modified_by_user: $ref: "#/components/schemas/RelationshipToUser" microsoft_teams_configuration: $ref: "#/components/schemas/MicrosoftTeamsConfigurationReference" zoom_configuration: $ref: "#/components/schemas/ZoomConfigurationReference" type: object IncidentTypeResponse: description: Incident type response data. properties: data: $ref: "#/components/schemas/IncidentTypeObject" required: - data type: object IncidentTypeSlugSource: default: default description: >- When set to `servicenow`, incidents will display the ServiceNow record ID instead of the public ID. If no ServiceNow integration exists, the public ID will be displayed. enum: - default - servicenow example: default type: string x-enum-varnames: - DEFAULT - SERVICENOW IncidentTypeType: default: incident_types description: Incident type resource type. enum: - incident_types example: incident_types type: string x-enum-varnames: - INCIDENT_TYPES IncidentTypeUpdateAttributes: description: Incident type's attributes for updates. properties: configuration: $ref: "#/components/schemas/IncidentTypeConfiguration" createdAt: description: Timestamp when the incident type was created. format: date-time readOnly: true type: string createdBy: description: A unique identifier that represents the user that created the incident type. example: "00000000-0000-0000-0000-000000000000" readOnly: true type: string description: description: Text that describes the incident type. example: "Any incidents that harm (or have the potential to) the confidentiality, integrity, or availability of our data. Note: This will notify the security team." type: string is_default: description: When true, this incident type will be used as the default type when an incident type is not specified. example: false type: boolean lastModifiedBy: description: A unique identifier that represents the user that last modified the incident type. example: "00000000-0000-0000-0000-000000000000" readOnly: true type: string modifiedAt: description: Timestamp when the incident type was last modified. format: date-time readOnly: true type: string name: description: The name of the incident type. example: "Security Incident" type: string prefix: description: The string that will be prepended to the incident title across the Datadog app. example: "IR" readOnly: true type: string type: object IncidentUpdateAttributes: description: The incident's attributes for an update request. properties: customer_impact_end: description: Timestamp when customers were no longer impacted by the incident. format: date-time nullable: true type: string customer_impact_scope: description: A summary of the impact customers experienced during the incident. example: "Example customer impact scope" type: string customer_impact_start: description: Timestamp when customers began being impacted by the incident. format: date-time nullable: true type: string customer_impacted: description: A flag indicating whether the incident caused customer impact. example: false type: boolean detected: description: Timestamp when the incident was detected. format: date-time nullable: true type: string fields: additionalProperties: $ref: "#/components/schemas/IncidentFieldAttributes" description: A condensed view of the user-defined fields for which to update selections. example: {"severity": {"type": "dropdown", "value": "SEV-5"}} type: object notification_handles: description: Notification handles that will be notified of the incident during update. example: [{"display_name": "Jane Doe", "handle": "@user@email.com"}, {"display_name": "Slack Channel", "handle": "@slack-channel"}, {"display_name": "Incident Workflow", "handle": "@workflow-from-incident"}] items: $ref: "#/components/schemas/IncidentNotificationHandle" type: array title: description: The title of the incident, which summarizes what happened. example: "A test incident title" type: string type: object IncidentUpdateData: description: Incident data for an update request. properties: attributes: $ref: "#/components/schemas/IncidentUpdateAttributes" id: description: The incident's ID. example: "00000000-0000-0000-4567-000000000000" type: string relationships: $ref: "#/components/schemas/IncidentUpdateRelationships" type: $ref: "#/components/schemas/IncidentType" required: - id - type type: object IncidentUpdateRelationships: description: The incident's relationships for an update request. properties: commander_user: $ref: "#/components/schemas/NullableRelationshipToUser" integrations: $ref: "#/components/schemas/RelationshipToIncidentIntegrationMetadatas" postmortem: $ref: "#/components/schemas/RelationshipToIncidentPostmortem" type: object IncidentUpdateRequest: description: Update request for an incident. properties: data: $ref: "#/components/schemas/IncidentUpdateData" required: - data type: object IncidentUserAttributes: description: Attributes of user object returned by the API. properties: email: description: Email of the user. type: string handle: description: Handle of the user. type: string icon: description: URL of the user's icon. type: string name: description: Name of the user. nullable: true type: string uuid: description: UUID of the user. type: string type: object IncidentUserData: description: User object returned by the API. properties: attributes: $ref: "#/components/schemas/IncidentUserAttributes" id: description: ID of the user. type: string type: $ref: "#/components/schemas/UsersType" type: object IncidentUserDefinedFieldAttributesCreateRequest: description: Attributes for creating an incident user-defined field. properties: category: $ref: "#/components/schemas/IncidentUserDefinedFieldCategory" collected: $ref: "#/components/schemas/IncidentUserDefinedFieldCollected" default_value: description: The default value for the field. Must be one of the valid values when valid_values is set. example: "critical" nullable: true type: string display_name: description: The human-readable name shown in the UI. Defaults to a formatted version of the name if not provided. example: "Root Cause" type: string name: description: The unique identifier of the field. Must start with a letter or digit and contain only letters, digits, underscores, or periods. example: "root_cause" type: string ordinal: description: A decimal string representing the field's display order in the UI. example: "1.5" nullable: true type: string required: description: When true, users must fill out this field on incidents. example: false type: boolean tag_key: description: For metric tag-type fields only, the metric tag key that powers the autocomplete options. example: "datacenter" nullable: true type: string type: $ref: "#/components/schemas/IncidentUserDefinedFieldFieldType" valid_values: description: The list of allowed values for dropdown and multiselect fields. Limited to 1000 values. items: $ref: "#/components/schemas/IncidentUserDefinedFieldValidValue" type: array required: - name - type type: object IncidentUserDefinedFieldAttributesResponse: description: Attributes of an incident user-defined field. properties: category: $ref: "#/components/schemas/IncidentUserDefinedFieldCategory" collected: $ref: "#/components/schemas/IncidentUserDefinedFieldCollected" created: description: Timestamp when the field was created. example: "2026-03-18T08:40:05.185406Z" format: date-time readOnly: true type: string default_value: description: The default value for the field. example: "critical" nullable: true type: string deleted: description: Timestamp when the field was soft-deleted, or null if not deleted. example: format: date-time nullable: true readOnly: true type: string display_name: description: The human-readable name shown in the UI. example: "Root Cause" type: string metadata: $ref: "#/components/schemas/IncidentUserDefinedFieldMetadata" modified: description: Timestamp when the field was last modified. example: "2026-03-18T08:40:05.185406Z" format: date-time nullable: true readOnly: true type: string name: description: The unique identifier of the field. example: "root_cause" type: string ordinal: description: A decimal string representing the field's display order in the UI. example: "1.5" nullable: true type: string required: description: When true, users must fill out this field on incidents. example: false type: boolean reserved: description: When true, this field is reserved for system use and cannot be deleted. example: false readOnly: true type: boolean tag_key: description: For metric tag-type fields only, the metric tag key that powers the autocomplete options. example: nullable: true type: string type: description: The data type of the field. 1=dropdown, 2=multiselect, 3=textbox, 4=textarray, 5=metrictag, 6=autocomplete, 7=number, 8=datetime. example: 3 format: int32 maximum: 8 minimum: 1 nullable: true type: integer valid_values: description: The list of allowed values for dropdown, multiselect, and autocomplete fields. items: $ref: "#/components/schemas/IncidentUserDefinedFieldValidValue" nullable: true type: array required: - category - collected - created - default_value - deleted - display_name - metadata - modified - name - ordinal - required - reserved - tag_key - type - valid_values type: object IncidentUserDefinedFieldAttributesUpdateRequest: description: Attributes for updating an incident user-defined field. All fields are optional. properties: category: $ref: "#/components/schemas/IncidentUserDefinedFieldCategory" collected: $ref: "#/components/schemas/IncidentUserDefinedFieldCollected" default_value: description: The default value for the field. Must be one of the valid values when valid_values is set. example: "critical" nullable: true type: string display_name: description: The human-readable name shown in the UI. example: "Root Cause" type: string ordinal: description: A decimal string representing the field's display order in the UI. example: "1.5" nullable: true type: string required: description: When true, users must fill out this field on incidents. example: false nullable: true type: boolean valid_values: description: The list of allowed values for dropdown and multiselect fields. Limited to 1000 values. items: $ref: "#/components/schemas/IncidentUserDefinedFieldValidValue" nullable: true type: array type: object IncidentUserDefinedFieldCategory: description: 'The section in which the field appears: "what_happened" or "why_it_happened". When null, the field appears in the Attributes section.' enum: - what_happened - why_it_happened example: what_happened nullable: true type: string x-enum-varnames: - WHAT_HAPPENED - WHY_IT_HAPPENED IncidentUserDefinedFieldCollected: description: The lifecycle stage at which the app prompts users to fill out this field. Cannot be set on required fields. enum: - active - stable - resolved - completed example: active nullable: true type: string x-enum-varnames: - ACTIVE - STABLE - RESOLVED - COMPLETED IncidentUserDefinedFieldCreateData: description: Data for creating an incident user-defined field. properties: attributes: $ref: "#/components/schemas/IncidentUserDefinedFieldAttributesCreateRequest" relationships: $ref: "#/components/schemas/IncidentUserDefinedFieldCreateRelationships" type: $ref: "#/components/schemas/IncidentUserDefinedFieldType" required: - type - attributes - relationships type: object IncidentUserDefinedFieldCreateRelationships: description: Relationships for creating an incident user-defined field. properties: incident_type: $ref: "#/components/schemas/RelationshipToIncidentType" required: - incident_type type: object IncidentUserDefinedFieldCreateRequest: description: Request body for creating an incident user-defined field. properties: data: $ref: "#/components/schemas/IncidentUserDefinedFieldCreateData" required: - data type: object IncidentUserDefinedFieldFieldType: description: The data type of the field. 1=dropdown, 2=multiselect, 3=textbox, 4=textarray, 5=metrictag, 6=autocomplete, 7=number, 8=datetime. enum: - 1 - 2 - 3 - 4 - 5 - 6 - 7 - 8 example: 3 format: int32 type: integer x-enum-varnames: - DROPDOWN - MULTISELECT - TEXTBOX - TEXTARRAY - METRICTAG - AUTOCOMPLETE - NUMBER - DATETIME IncidentUserDefinedFieldListMeta: description: Pagination metadata for the user-defined field list response. properties: offset: description: The offset of the current page. example: 0 format: int64 type: integer size: description: The total number of items in the current page. example: 5 format: int64 type: integer type: object IncidentUserDefinedFieldListResponse: description: Response containing a list of incident user-defined fields. properties: data: description: An array of user-defined field objects. items: $ref: "#/components/schemas/IncidentUserDefinedFieldResponseData" type: array meta: $ref: "#/components/schemas/IncidentUserDefinedFieldListMeta" required: - data - meta type: object IncidentUserDefinedFieldMetadata: description: Metadata for autocomplete-type user-defined fields, describing how to populate autocomplete options. nullable: true properties: category: description: The category of the autocomplete source. example: "teams_and_services" type: string search_limit_param: description: The query parameter used to limit the number of autocomplete results. example: "page[size]" type: string search_params: additionalProperties: {} description: Additional query parameters to include in the search URL. type: object search_query_param: description: The query parameter used to pass typed input to the search URL. example: "filter" type: string search_result_path: description: The JSON path to the results in the response body. example: "$.data[*].attributes.name" type: string search_url: description: The URL used to populate autocomplete options. example: "/api/v2/incidents/config/services" type: string required: - category - search_url - search_query_param - search_limit_param - search_result_path - search_params type: object IncidentUserDefinedFieldRelationships: description: Relationships of an incident user-defined field. properties: created_by_user: $ref: "#/components/schemas/RelationshipToUser" incident_type: $ref: "#/components/schemas/RelationshipToIncidentType" last_modified_by_user: $ref: "#/components/schemas/RelationshipToUser" required: - created_by_user - last_modified_by_user - incident_type type: object IncidentUserDefinedFieldResponse: description: Response containing a single incident user-defined field. properties: data: $ref: "#/components/schemas/IncidentUserDefinedFieldResponseData" required: - data type: object IncidentUserDefinedFieldResponseData: description: Data object for an incident user-defined field response. properties: attributes: $ref: "#/components/schemas/IncidentUserDefinedFieldAttributesResponse" id: description: The unique identifier of the user-defined field. example: "00000000-0000-0000-0000-000000000000" type: string relationships: $ref: "#/components/schemas/IncidentUserDefinedFieldRelationships" type: $ref: "#/components/schemas/IncidentUserDefinedFieldType" required: - id - type - attributes - relationships type: object IncidentUserDefinedFieldType: description: The incident user defined fields type. enum: - user_defined_field example: user_defined_field type: string x-enum-varnames: - USER_DEFINED_FIELD IncidentUserDefinedFieldUpdateData: description: Data for updating an incident user-defined field. properties: attributes: $ref: "#/components/schemas/IncidentUserDefinedFieldAttributesUpdateRequest" id: description: The unique identifier of the user-defined field to update. example: "00000000-0000-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/IncidentUserDefinedFieldType" required: - id - type - attributes type: object IncidentUserDefinedFieldUpdateRequest: description: Request body for updating an incident user-defined field. properties: data: $ref: "#/components/schemas/IncidentUserDefinedFieldUpdateData" required: - data type: object IncidentUserDefinedFieldValidValue: description: A valid value for an incident user-defined field. properties: description: description: A detailed description of the valid value. example: "A critical severity incident." type: string display_name: description: The human-readable display name for this value. example: "Critical" type: string short_description: description: A short description of the valid value. example: "Critical" type: string value: description: The identifier that is stored when this option is selected. example: "critical" type: string required: - display_name - value type: object IncidentUserDefinedRoleDataAttributesRequest: description: Attributes for creating an incident user-defined role. properties: description: description: A description of the user-defined role. example: "The technical lead for the incident." nullable: true type: string name: description: The name of the user-defined role. example: "Tech Lead" type: string policy: $ref: "#/components/schemas/IncidentUserDefinedRolePolicy" required: - name type: object IncidentUserDefinedRoleDataAttributesResponse: description: Attributes of an incident user-defined role. properties: created: description: Timestamp when the role was created. example: "2024-01-01T00:00:00.000Z" format: date-time type: string description: description: A description of the user-defined role. example: "The technical lead for the incident." nullable: true type: string modified: description: Timestamp when the role was last modified. example: "2024-01-01T00:00:00.000Z" format: date-time type: string name: description: The name of the user-defined role. example: "Tech Lead" type: string policy: $ref: "#/components/schemas/IncidentUserDefinedRolePolicy" required: - name - policy - created - modified type: object IncidentUserDefinedRoleDataRequest: description: Data for creating an incident user-defined role. properties: attributes: $ref: "#/components/schemas/IncidentUserDefinedRoleDataAttributesRequest" relationships: $ref: "#/components/schemas/IncidentUserDefinedRoleRelationshipsRequest" type: $ref: "#/components/schemas/IncidentUserDefinedRoleType" required: - type - attributes - relationships type: object IncidentUserDefinedRoleDataResponse: description: Data for an incident user-defined role response. properties: attributes: $ref: "#/components/schemas/IncidentUserDefinedRoleDataAttributesResponse" id: description: The ID of the user-defined role. example: "00000000-0000-0000-0000-000000000002" format: uuid type: string relationships: $ref: "#/components/schemas/IncidentUserDefinedRoleRelationshipsResponse" type: $ref: "#/components/schemas/IncidentUserDefinedRoleType" required: - id - type - attributes type: object IncidentUserDefinedRoleIncidentTypeRelationship: description: Relationship to an incident type for a user-defined role. properties: data: $ref: "#/components/schemas/IncidentUserDefinedRoleIncidentTypeRelationshipData" required: - data type: object IncidentUserDefinedRoleIncidentTypeRelationshipData: description: Data for the incident type relationship of a user-defined role. properties: id: description: The ID of the incident type. example: "00000000-0000-0000-0000-000000000001" format: uuid type: string type: description: The type of the resource. example: "incident_types" type: string required: - id - type type: object IncidentUserDefinedRoleIncludedItem: description: A single included resource in a user-defined role response. oneOf: - $ref: "#/components/schemas/IncidentUserData" - $ref: "#/components/schemas/IncidentTypeObject" IncidentUserDefinedRoleIncludedResponse: description: Included resources for an incident user-defined role response. items: $ref: "#/components/schemas/IncidentUserDefinedRoleIncludedItem" type: array IncidentUserDefinedRolePatchDataAttributesRequest: description: Attributes for updating an incident user-defined role. properties: description: description: A description of the user-defined role. example: "The technical lead for the incident." nullable: true type: string name: description: The name of the user-defined role. example: "Tech Lead" type: string policy: $ref: "#/components/schemas/IncidentUserDefinedRolePolicy" type: object IncidentUserDefinedRolePatchDataRequest: description: Data for updating an incident user-defined role. properties: attributes: $ref: "#/components/schemas/IncidentUserDefinedRolePatchDataAttributesRequest" id: description: The ID of the user-defined role to update. example: "00000000-0000-0000-0000-000000000002" format: uuid type: string type: $ref: "#/components/schemas/IncidentUserDefinedRoleType" required: - id - type type: object IncidentUserDefinedRolePatchRequest: description: Request for updating an incident user-defined role. properties: data: $ref: "#/components/schemas/IncidentUserDefinedRolePatchDataRequest" required: - data type: object IncidentUserDefinedRolePolicy: description: Policy configuration for a user-defined role. properties: is_single: description: Whether this role can only be assigned to one responder at a time. example: true type: boolean required: - is_single type: object IncidentUserDefinedRoleRelationshipsRequest: description: Relationships for creating a user-defined role. properties: incident_type: $ref: "#/components/schemas/IncidentUserDefinedRoleIncidentTypeRelationship" required: - incident_type type: object IncidentUserDefinedRoleRelationshipsResponse: description: Relationships of a user-defined role response. properties: created_by_user: $ref: "#/components/schemas/RelationshipToUser" incident_type: $ref: "#/components/schemas/IncidentUserDefinedRoleIncidentTypeRelationship" last_modified_by_user: $ref: "#/components/schemas/RelationshipToUser" type: object IncidentUserDefinedRoleRequest: description: Request for creating an incident user-defined role. properties: data: $ref: "#/components/schemas/IncidentUserDefinedRoleDataRequest" required: - data type: object IncidentUserDefinedRoleResponse: description: Response with a single incident user-defined role. properties: data: $ref: "#/components/schemas/IncidentUserDefinedRoleDataResponse" included: $ref: "#/components/schemas/IncidentUserDefinedRoleIncludedResponse" required: - data type: object IncidentUserDefinedRoleType: description: Incident user-defined role resource type. enum: - incident_user_defined_roles example: incident_user_defined_roles type: string x-enum-varnames: - INCIDENT_USER_DEFINED_ROLES IncidentUserDefinedRolesDataResponse: description: List of incident user-defined role data objects. items: $ref: "#/components/schemas/IncidentUserDefinedRoleDataResponse" type: array IncidentUserDefinedRolesResponse: description: Response with a list of incident user-defined roles. properties: data: $ref: "#/components/schemas/IncidentUserDefinedRolesDataResponse" included: $ref: "#/components/schemas/IncidentUserDefinedRoleIncludedResponse" required: - data type: object IncidentsResponse: description: Response with a list of incidents. properties: data: description: An array of incidents. example: [{"attributes": {"created": "2020-04-21T15:34:08.627205+00:00", "creation_idempotency_key": null, "customer_impact_duration": 0, "customer_impact_end": null, "customer_impact_scope": null, "customer_impact_start": null, "customer_impacted": false, "detected": "2020-04-14T00:00:00+00:00", "incident_type_uuid": "00000000-0000-0000-0000-000000000001", "modified": "2020-09-17T14:16:58.696424+00:00", "public_id": 1, "resolved": null, "severity": "SEV-1", "time_to_detect": 0, "time_to_internal_response": 0, "time_to_repair": 0, "time_to_resolve": 0, "title": "Example Incident"}, "id": "00000000-aaaa-0000-0000-000000000000", "relationships": {"attachments": {"data": [{"id": "00000000-9999-0000-0000-000000000000", "type": "incident_attachments"}, {"id": "00000000-1234-0000-0000-000000000000", "type": "incident_attachments"}]}, "commander_user": {"data": {"id": "00000000-0000-0000-cccc-000000000000", "type": "users"}}, "created_by_user": {"data": {"id": "00000000-0000-0000-cccc-000000000000", "type": "users"}}, "integrations": {"data": [{"id": "00000000-0000-0000-4444-000000000000", "type": "incident_integrations"}, {"id": "00000000-0000-0000-5555-000000000000", "type": "incident_integrations"}]}, "last_modified_by_user": {"data": {"id": "00000000-0000-0000-cccc-000000000000", "type": "users"}}}, "type": "incidents"}, {"attributes": {"created": "2020-04-21T15:34:08.627205+00:00", "creation_idempotency_key": null, "customer_impact_duration": 0, "customer_impact_end": null, "customer_impact_scope": null, "customer_impact_start": null, "customer_impacted": false, "detected": "2020-04-14T00:00:00+00:00", "incident_type_uuid": "00000000-0000-0000-0000-000000000002", "modified": "2020-09-17T14:16:58.696424+00:00", "public_id": 2, "resolved": null, "severity": "SEV-5", "time_to_detect": 0, "time_to_internal_response": 0, "time_to_repair": 0, "time_to_resolve": 0, "title": "Example Incident 2"}, "id": "00000000-1111-0000-0000-000000000000", "relationships": {"attachments": { "data": [{"id": "00000000-9999-0000-0000-000000000000", "type": "incident_attachments"}]}, "commander_user": {"data": {"id": "00000000-aaaa-0000-0000-000000000000", "type": "users"}}, "created_by_user": {"data": {"id": "00000000-aaaa-0000-0000-000000000000", "type": "users"}}, "integrations": {"data": [{"id": "00000000-0000-0000-0001-000000000000", "type": "incident_integrations"}, {"id": "00000000-0000-0000-0002-000000000000", "type": "incident_integrations"}]}, "last_modified_by_user": {"data": {"id": "00000000-aaaa-0000-0000-000000000000", "type": "users"}}}, "type": "incidents"}] items: $ref: "#/components/schemas/IncidentResponseData" type: array included: description: Included related resources that the user requested. items: $ref: "#/components/schemas/IncidentResponseIncludedItem" readOnly: true type: array meta: $ref: "#/components/schemas/IncidentResponseMeta" required: - data type: object IncludeType: description: Supported include types. enum: - schema - raw_schema - oncall - incident - relation type: string x-enum-varnames: - SCHEMA - RAW_SCHEMA - ONCALL - INCIDENT - RELATION InputSchema: description: "A list of input parameters for the workflow. Input parameters are available under the `Trigger` object and can be referenced in workflow steps using `{{ Trigger. }}`." properties: parameters: description: The `InputSchema` `parameters`. items: $ref: "#/components/schemas/InputSchemaParameters" type: array type: object InputSchemaParameters: description: The definition of `InputSchemaParameters` object. properties: allowExtraValues: description: The `InputSchemaParameters` `allowExtraValues`. type: boolean allowedValues: description: The `InputSchemaParameters` `allowedValues`. defaultValue: description: The `InputSchemaParameters` `defaultValue`. description: description: The `InputSchemaParameters` `description`. type: string label: description: The `InputSchemaParameters` `label`. type: string name: description: The `InputSchemaParameters` `name`. example: "" minLength: 1 type: string type: $ref: "#/components/schemas/InputSchemaParametersType" required: - name - type type: object InputSchemaParametersType: description: The definition of `InputSchemaParametersType` object. enum: - STRING - NUMBER - BOOLEAN - OBJECT - ARRAY_STRING - ARRAY_NUMBER - ARRAY_BOOLEAN - ARRAY_OBJECT example: STRING type: string x-enum-varnames: - STRING - NUMBER - BOOLEAN - OBJECT - ARRAY_STRING - ARRAY_NUMBER - ARRAY_BOOLEAN - ARRAY_OBJECT IntakePayloadAccepted: description: The payload accepted for intake. properties: errors: description: A list of errors. items: description: An empty error list. type: string type: array type: object Integration: description: Integration resource object. properties: attributes: $ref: "#/components/schemas/IntegrationAttributes" id: description: The unique identifier of the integration. example: "calico" type: string links: $ref: "#/components/schemas/IntegrationLinks" type: $ref: "#/components/schemas/IntegrationType" required: - type - id - attributes type: object IntegrationAccountDataflowHealth: description: Collection health of a single dataflow. enum: - DATAFLOW_HEALTH_OK - DATAFLOW_HEALTH_BROKEN - DATAFLOW_HEALTH_UNKNOWN example: DATAFLOW_HEALTH_OK type: string x-enum-varnames: - OK - BROKEN - UNKNOWN IntegrationAccountDataflowStatus: description: Read-only collection status of a dataflow. properties: health: $ref: "#/components/schemas/IntegrationAccountDataflowHealth" message: description: Human-readable detail, populated when the dataflow is not healthy. example: "" type: string updated_at: description: Time the status was last computed. example: "2026-06-25T08:30:50Z" format: date-time type: string readOnly: true type: object IntegrationAccountType: default: integration-account description: The type of the integration account resource. Always `integration-account`. enum: - integration-account example: integration-account type: string x-enum-varnames: - INTEGRATION_ACCOUNT IntegrationAttributes: description: Attributes for an integration. properties: categories: description: List of categories associated with the integration. example: - "Category::Kubernetes" - "Category::Log Collection" items: description: A category associated with the integration. type: string type: array description: description: A description of the integration. example: "Calico is a networking and network security solution for containers." type: string installed: description: Whether the integration is installed. example: true type: boolean title: description: The name of the integration. example: "calico" type: string required: - title - description - categories - installed type: object IntegrationIncident: description: Incident integration settings. properties: auto_escalation_query: description: Query for auto-escalation. type: string default_incident_commander: description: Default incident commander. type: string enabled: description: Whether incident integration is enabled. type: boolean field_mappings: description: List of mappings between incident fields and work item fields. items: $ref: "#/components/schemas/IntegrationIncidentFieldMappingsItems" type: array incident_type: description: Incident type. type: string severity_config: $ref: "#/components/schemas/IntegrationIncidentSeverityConfig" type: object IntegrationIncidentFieldMappingsItems: description: Mapping between an incident user-defined field and a work item field. properties: case_field: description: The work item field to map the incident field value to. type: string incident_user_defined_field_id: description: The identifier of the incident user-defined field to map from. type: string type: object IntegrationIncidentSeverityConfig: description: Severity configuration for mapping incident priorities to work item priorities. properties: priority_mapping: additionalProperties: type: string description: Mapping of incident severity values to work item priority values. type: object type: object IntegrationJira: description: Jira integration settings. properties: auto_creation: $ref: "#/components/schemas/IntegrationJiraAutoCreation" enabled: description: Whether Jira integration is enabled. type: boolean metadata: $ref: "#/components/schemas/IntegrationJiraMetadata" sync: $ref: "#/components/schemas/IntegrationJiraSync" type: object IntegrationJiraAutoCreation: description: Auto-creation settings for Jira issues from work items. properties: enabled: description: Whether automatic Jira issue creation is enabled. type: boolean type: object IntegrationJiraMetadata: description: Metadata for connecting a Work Management project to a Jira project. properties: account_id: description: The Jira account identifier. type: string issue_type_id: description: The Jira issue type identifier to use when creating issues. type: string project_id: description: The Jira project identifier to associate with this Work Management project. type: string type: object IntegrationJiraSync: description: Synchronization configuration for Jira integration. properties: enabled: description: Whether Jira field synchronization is enabled. type: boolean properties: $ref: "#/components/schemas/IntegrationJiraSyncProperties" type: object IntegrationJiraSyncDueDate: description: Due date synchronization configuration for Jira integration. properties: jira_field_id: description: The Jira field identifier used to store the due date. type: string sync_type: description: The type of synchronization to apply for the due date field. type: string type: object IntegrationJiraSyncProperties: description: Field synchronization properties for Jira integration. properties: assignee: $ref: "#/components/schemas/SyncProperty" comments: $ref: "#/components/schemas/SyncProperty" custom_fields: additionalProperties: $ref: "#/components/schemas/IntegrationJiraSyncPropertiesCustomFieldsAdditionalProperties" description: Map of custom field identifiers to their sync configurations. type: object description: $ref: "#/components/schemas/SyncProperty" due_date: $ref: "#/components/schemas/IntegrationJiraSyncDueDate" priority: $ref: "#/components/schemas/SyncPropertyWithMapping" status: $ref: "#/components/schemas/SyncPropertyWithMapping" title: $ref: "#/components/schemas/SyncProperty" type: object IntegrationJiraSyncPropertiesCustomFieldsAdditionalProperties: description: Synchronization configuration for a Jira custom field. properties: sync_type: description: The type of synchronization to apply for this custom field. type: string value: $ref: "#/components/schemas/AnyValue" type: object IntegrationLinks: description: Links for the integration resource. properties: self: description: Link to the integration resource. example: "/integrations?integrationId=calico" type: string type: object IntegrationMonitor: description: Monitor integration settings. properties: auto_resolve_enabled: description: Whether auto-resolve is enabled. type: boolean case_type_id: description: Work item type ID for monitor integration. type: string enabled: description: Whether monitor integration is enabled. type: boolean handle: description: Monitor handle. type: string type: object IntegrationOnCall: description: On-Call integration settings. properties: auto_assign_on_call: description: Whether to auto-assign on-call. type: boolean enabled: description: Whether On-Call integration is enabled. type: boolean escalation_queries: description: List of escalation queries for routing work items to on-call responders. items: $ref: "#/components/schemas/IntegrationOnCallEscalationQueriesItems" type: array type: object IntegrationOnCallEscalationQueriesItems: description: An On-Call escalation query entry used to route work items to on-call responders. properties: enabled: description: Whether this escalation query is enabled. type: boolean id: description: Unique identifier of the escalation query. type: string query: description: The query used to match work items for escalation. type: string target: $ref: "#/components/schemas/IntegrationOnCallEscalationQueriesItemsTarget" type: object IntegrationOnCallEscalationQueriesItemsTarget: description: The target recipient for an On-Call escalation query. properties: dynamic_team_paging: description: Whether to use dynamic team paging for escalation. type: boolean team_id: description: The identifier of the team to escalate to. type: string user_id: description: The identifier of the user to escalate to. type: string type: object IntegrationServiceNow: description: ServiceNow integration settings. properties: assignment_group: description: Assignment group. type: string auto_creation: $ref: "#/components/schemas/IntegrationServiceNowAutoCreation" enabled: description: Whether ServiceNow integration is enabled. type: boolean instance_name: description: ServiceNow instance name. type: string sync_config: $ref: "#/components/schemas/IntegrationServiceNowSyncConfig" type: object IntegrationServiceNowAutoCreation: description: Auto-creation settings for ServiceNow incidents from work items. properties: enabled: description: Whether automatic ServiceNow incident creation is enabled. type: boolean type: object IntegrationServiceNowSyncConfig: description: Synchronization configuration for ServiceNow integration. properties: enabled: description: Whether ServiceNow synchronization is enabled. type: boolean properties: $ref: "#/components/schemas/IntegrationServiceNowSyncConfig139772721534496" type: object IntegrationServiceNowSyncConfig139772721534496: description: Field-level synchronization properties for ServiceNow integration. properties: comments: $ref: "#/components/schemas/SyncProperty" priority: $ref: "#/components/schemas/IntegrationServiceNowSyncConfigPriority" status: $ref: "#/components/schemas/SyncPropertyWithMapping" type: object IntegrationServiceNowSyncConfigPriority: description: Priority synchronization configuration for ServiceNow integration. properties: impact_mapping: additionalProperties: type: string description: Mapping of work item priority values to ServiceNow impact values. type: object sync_type: description: The type of synchronization to apply for priority. type: string urgency_mapping: additionalProperties: type: string description: Mapping of work item priority values to ServiceNow urgency values. type: object type: object IntegrationType: default: integration description: Integration resource type. enum: - integration example: integration type: string x-enum-varnames: - INTEGRATION InterfaceAttributes: description: The interface attributes properties: alias: description: The interface alias example: interface_0 type: string description: description: The interface description example: a network interface type: string index: description: The interface index example: 0 format: int64 type: integer ip_addresses: description: The interface IP addresses example: ["1.1.1.1", "1.1.1.2"] items: description: An IP address assigned to the interface. type: string type: array mac_address: description: The interface MAC address example: 00:00:00:00:00:00 type: string name: description: The interface name example: if0 type: string status: $ref: "#/components/schemas/InterfaceAttributesStatus" type: object InterfaceAttributesStatus: description: The interface status enum: - up - down - warning - "off" example: up type: string x-enum-varnames: - UP - DOWN - WARNING - "OFF" InvestigationConclusion: description: A full explanation of the finding, including root cause analysis and supporting evidence. properties: description: description: A full explanation of the finding, including root cause analysis and supporting evidence. example: "The investigation found that a memory leak in payments-service caused CPU usage to spike above 95% starting at 14:32 UTC." type: string summary: description: A summary of the finding, including affected components and timeframe. example: "CPU usage exceeded 95% for over 10 minutes on web-server-01." type: string title: description: The title of the conclusion. example: "High CPU usage detected on web-server-01" type: string required: - title - summary - description type: object InvestigationType: description: The resource type for investigations. enum: - investigation example: investigation type: string x-enum-varnames: - INVESTIGATION IoCExplorerListResponse: description: Response for the list indicators of compromise endpoint. properties: data: $ref: "#/components/schemas/IoCExplorerListResponseData" type: object IoCExplorerListResponseAttributes: description: Attributes of the IoC Explorer list response. properties: data: description: List of indicators of compromise. items: $ref: "#/components/schemas/IoCIndicator" type: array metadata: $ref: "#/components/schemas/IoCExplorerListResponseMetadata" paging: $ref: "#/components/schemas/IoCExplorerListResponsePaging" type: object IoCExplorerListResponseData: description: IoC Explorer list response data object. properties: attributes: $ref: "#/components/schemas/IoCExplorerListResponseAttributes" id: description: Unique identifier for the response. type: string type: description: Response type identifier. type: string type: object IoCExplorerListResponseMetadata: description: Response metadata. properties: count: description: Total number of indicators matching the query. format: int64 type: integer type: object IoCExplorerListResponsePaging: description: Pagination information. properties: offset: description: Current pagination offset. format: int64 type: integer type: object IoCGeoLocation: description: Geographic location information for an IP indicator. properties: city: description: City name. type: string country_code: description: ISO country code. type: string country_name: description: Full country name. type: string type: object IoCIndicator: description: An indicator of compromise with threat intelligence data. properties: as_geo: $ref: "#/components/schemas/IoCGeoLocation" as_type: description: Autonomous system type. type: string benign_sources: description: Threat intelligence sources that flagged this indicator as benign. items: $ref: "#/components/schemas/IoCSource" nullable: true type: array categories: description: Threat categories associated with the indicator. items: type: string type: array first_seen: description: Timestamp when the indicator was first seen. format: date-time type: string id: description: Unique identifier for the indicator. type: string indicator: description: The indicator value (for example, an IP address or domain). type: string indicator_type: description: Type of indicator (for example, IP address or domain). type: string last_seen: description: Timestamp when the indicator was last seen. format: date-time type: string log_matches: description: Number of logs that matched this indicator. format: int64 type: integer m_as_type: $ref: "#/components/schemas/IoCScoreEffect" m_persistence: $ref: "#/components/schemas/IoCScoreEffect" m_signal: $ref: "#/components/schemas/IoCScoreEffect" m_sources: $ref: "#/components/schemas/IoCScoreEffect" malicious_sources: description: Threat intelligence sources that flagged this indicator as malicious. items: $ref: "#/components/schemas/IoCSource" nullable: true type: array max_trust_score: $ref: "#/components/schemas/IoCScoreEffect" score: description: Threat score for the indicator (0-100). format: double type: number signal_matches: description: Number of security signals that matched this indicator. format: int64 type: integer signal_tier: description: Signal tier level. format: int64 type: integer suspicious_sources: description: Threat intelligence sources that flagged this indicator as suspicious. items: $ref: "#/components/schemas/IoCSource" nullable: true type: array tags: description: Tags associated with the indicator. items: type: string type: array triage_state: $ref: "#/components/schemas/IoCTriageState" triaged_at: description: Timestamp when the indicator was last triaged. format: date-time type: string triaged_by: description: UUID of the user who last triaged the indicator. type: string type: object IoCIndicatorDetailed: description: An indicator of compromise with extended context from your environment. properties: additional_data: additionalProperties: {} description: Additional domain-specific context from threat intelligence sources. type: object as_cidr_block: description: Autonomous system CIDR block. type: string as_geo: $ref: "#/components/schemas/IoCGeoLocation" as_number: description: Autonomous system number. type: string as_organization: description: Autonomous system organization name. type: string as_type: description: Autonomous system type. type: string benign_sources: description: Threat intelligence sources that flagged this indicator as benign. items: $ref: "#/components/schemas/IoCSource" nullable: true type: array categories: description: Threat categories associated with the indicator. items: type: string type: array critical_assets: description: Critical assets associated with this indicator. items: type: string type: array first_seen: description: Timestamp when the indicator was first seen. format: date-time type: string hosts: description: Hosts associated with this indicator. items: type: string type: array id: description: Unique identifier for the indicator. type: string indicator: description: The indicator value (for example, an IP address or domain). type: string indicator_type: description: Type of indicator (for example, IP address or domain). type: string last_seen: description: Timestamp when the indicator was last seen. format: date-time type: string log_matches: description: Number of logs that matched this indicator. format: int64 type: integer log_sources: description: Log sources where this indicator was observed. items: type: string type: array m_as_type: $ref: "#/components/schemas/IoCScoreEffect" m_persistence: $ref: "#/components/schemas/IoCScoreEffect" m_signal: $ref: "#/components/schemas/IoCScoreEffect" m_sources: $ref: "#/components/schemas/IoCScoreEffect" malicious_sources: description: Threat intelligence sources that flagged this indicator as malicious. items: $ref: "#/components/schemas/IoCSource" nullable: true type: array max_trust_score: $ref: "#/components/schemas/IoCScoreEffect" score: description: Threat score for the indicator (0-100). format: double type: number services: description: Services where this indicator was observed. items: type: string type: array signal_matches: description: Number of security signals that matched this indicator. format: int64 type: integer signal_severity: description: Breakdown of security signals by severity. items: $ref: "#/components/schemas/IoCSignalSeverityCount" type: array signal_tier: description: Signal tier level. format: int64 type: integer suspicious_sources: description: Threat intelligence sources that flagged this indicator as suspicious. items: $ref: "#/components/schemas/IoCSource" nullable: true type: array tags: description: Tags associated with the indicator. items: type: string type: array triage_history: description: Full triage history timeline. Returned only when `include_triage_history` is true. items: $ref: "#/components/schemas/IoCTriageEvent" type: array triage_state: $ref: "#/components/schemas/IoCTriageState" triaged_at: description: Timestamp when the indicator was last triaged. format: date-time type: string triaged_by: description: UUID of the user who last triaged the indicator. type: string users: additionalProperties: description: List of user identifiers in this category. items: type: string type: array description: Users associated with this indicator, grouped by category. type: object type: object IoCScoreEffect: description: Effect of a scoring factor on the indicator's threat score. enum: - RAISE_SCORE - LOWER_SCORE - NO_EFFECT type: string x-enum-varnames: - RAISE_SCORE - LOWER_SCORE - NO_EFFECT IoCSignalSeverityCount: description: Count of security signals by severity level. properties: count: description: Number of signals at this severity level. format: int64 type: integer severity: description: Severity level (for example, critical, high, medium, low, info). type: string type: object IoCSource: description: A threat intelligence source that has flagged an indicator. properties: name: description: Name of the threat intelligence source. type: string type: object IoCTriageEvent: description: A single entry in an indicator's triage history timeline. properties: triage_state: $ref: "#/components/schemas/IoCTriageState" triaged_at: description: Timestamp when this triage action occurred. format: date-time type: string triaged_by: description: UUID of the user who performed this triage action. type: string type: object IoCTriageState: description: Current triage state of the indicator. enum: - not_reviewed - reviewed example: not_reviewed type: string x-enum-varnames: - NOT_REVIEWED - REVIEWED IoCTriageWriteRequest: description: Request body for creating or updating an indicator triage state. properties: data: $ref: "#/components/schemas/IoCTriageWriteRequestData" required: - data type: object IoCTriageWriteRequestAttributes: description: Attributes for setting an indicator's triage state. properties: indicator: description: The indicator value to triage (for example, an IP address or domain). example: "192.0.2.1" type: string triage_state: $ref: "#/components/schemas/IoCTriageState" required: - indicator - triage_state type: object IoCTriageWriteRequestData: description: Data object for the triage write request. properties: attributes: $ref: "#/components/schemas/IoCTriageWriteRequestAttributes" type: default: ioc_triage_state description: Triage state resource type. example: ioc_triage_state type: string required: - type - attributes type: object IoCTriageWriteResponse: description: Response for the create indicator triage state endpoint. properties: data: $ref: "#/components/schemas/IoCTriageWriteResponseData" type: object IoCTriageWriteResponseAttributes: description: Attributes of a created or updated triage state. properties: created_at: description: Timestamp when the triage record was created. format: date-time type: string indicator: description: The indicator value that was triaged. type: string triage_state: $ref: "#/components/schemas/IoCTriageState" triaged_at: description: Timestamp when the triage state was set. format: date-time type: string triaged_by: description: UUID of the user who set the triage state. type: string type: object IoCTriageWriteResponseData: description: Data object of the triage write response. properties: attributes: $ref: "#/components/schemas/IoCTriageWriteResponseAttributes" id: description: Unique identifier for the triage state record. type: string type: default: ioc_triage_state description: Triage state resource type. type: string type: object Issue: description: The issue matching the request. properties: attributes: $ref: "#/components/schemas/IssueAttributes" id: description: Issue identifier. example: "c1726a66-1f64-11ee-b338-da7ad0900002" type: string relationships: $ref: "#/components/schemas/IssueRelationships" type: $ref: "#/components/schemas/IssueType" required: - id - type - attributes type: object IssueAssigneeRelationship: description: Relationship between the issue and assignee. properties: data: $ref: "#/components/schemas/IssueUserReference" required: - data type: object IssueAttributes: description: Object containing the information of an issue. properties: error_message: description: Error message associated with the issue. example: "object of type 'NoneType' has no len()" type: string error_type: description: Type of the error that matches the issue. example: "builtins.TypeError" type: string file_path: description: Path of the file where the issue occurred. example: "/django-email/conduit/apps/core/utils.py" type: string first_seen: description: Timestamp of the first seen error in milliseconds since the Unix epoch. example: 1671612804001 format: int64 type: integer first_seen_version: description: The application version (for example, git commit hash) where the issue was first observed. example: "aaf65cd0" type: string function_name: description: Name of the function where the issue occurred. example: "filter_forbidden_tags" type: string is_crash: description: Error is a crash. example: false type: boolean languages: description: Array of programming languages associated with the issue. example: ["PYTHON", "GO"] items: $ref: "#/components/schemas/IssueLanguage" type: array last_seen: description: Timestamp of the last seen error in milliseconds since the Unix epoch. example: 1671620003100 format: int64 type: integer last_seen_version: description: The application version (for example, git commit hash) where the issue was last observed. example: "b6199f80" type: string platform: $ref: "#/components/schemas/IssuePlatform" regression: $ref: "#/components/schemas/IssueRegression" service: description: Service name. example: "email-api-py" type: string state: $ref: "#/components/schemas/IssueState" type: object IssueCase: description: The case attached to the issue. properties: attributes: $ref: "#/components/schemas/IssueCaseAttributes" id: description: Case identifier. example: "2841440d-e780-4fe2-96cd-6a8c1d194da5" type: string relationships: $ref: "#/components/schemas/IssueCaseRelationships" type: $ref: "#/components/schemas/IssueCaseResourceType" required: - id - type - attributes type: object IssueCaseAttributes: description: Object containing the information of a case. properties: archived_at: description: Timestamp of when the case was archived. example: "2025-01-01T00:00:00Z" format: date-time type: string closed_at: description: Timestamp of when the case was closed. example: "2025-01-01T00:00:00Z" format: date-time type: string created_at: description: Timestamp of when the case was created. example: "2025-01-01T00:00:00Z" format: date-time type: string creation_source: description: Source of the case creation. example: "ERROR_TRACKING" type: string description: description: Description of the case. type: string due_date: description: Due date of the case. example: "2025-01-01" type: string insights: description: Insights of the case. items: $ref: "#/components/schemas/IssueCaseInsight" type: array jira_issue: $ref: "#/components/schemas/IssueCaseJiraIssue" key: description: Key of the case. example: "ET-123" type: string linear_issue: $ref: "#/components/schemas/IssueCaseLinearIssue" modified_at: description: Timestamp of when the case was last modified. example: "2025-01-01T00:00:00Z" format: date-time type: string priority: $ref: "#/components/schemas/CasePriority" status: $ref: "#/components/schemas/CaseStatus" title: description: Title of the case. example: "Error: HTTP error" type: string type: description: Type of the case. example: "ERROR_TRACKING_ISSUE" type: string type: object IssueCaseInsight: description: Insight of the case. properties: ref: description: Reference of the insight. example: "/error-tracking?issueId=2841440d-e780-4fe2-96cd-6a8c1d194da5" type: string resource_id: description: Insight identifier. example: "2841440d-e780-4fe2-96cd-6a8c1d194da5" type: string type: description: Type of the insight. example: "ERROR_TRACKING" type: string type: object IssueCaseJiraIssue: description: Jira issue of the case. properties: error_message: description: Error message set when the Jira issue creation fails. example: "" type: string result: $ref: "#/components/schemas/IssueCaseJiraIssueResult" status: description: Creation status of the Jira issue. example: "COMPLETED" type: string type: object IssueCaseJiraIssueResult: description: Contains the identifiers and URL for a successfully created Jira issue. properties: account_id: description: Jira account identifier. example: "abcd1234-5678-90ab-cdef-1234567890ab" type: string issue_id: description: Jira issue identifier. example: "1904866" type: string issue_key: description: Jira issue key. example: "ET-123" type: string issue_url: description: Jira issue URL. example: "https://your-jira-instance.atlassian.net/browse/ET-123" type: string project_id: description: Jira project identifier. example: "10001" type: string project_key: description: Jira project key. example: "ET" type: string type: object IssueCaseLinearIssue: description: Linear issue of the case. properties: error_message: description: Error message set when the Linear issue creation fails. example: "" type: string result: $ref: "#/components/schemas/IssueCaseLinearIssueResult" status: description: Creation status of the Linear issue. example: "COMPLETED" type: string type: object IssueCaseLinearIssueResult: description: Contains the identifiers and URL for a successfully created Linear issue. properties: account_id: description: Linear account identifier. example: "abcd1234-5678-90ab-cdef-1234567890ab" type: string issue_id: description: Linear issue identifier. example: "a1b2c3d4-5678-90ab-cdef-1234567890ab" type: string issue_key: description: Linear issue key. example: "ENG-123" type: string issue_url: description: Linear issue URL. example: "https://linear.app/your-workspace/issue/ENG-123" type: string team_id: description: Linear team identifier. example: "f1e2d3c4-5678-90ab-cdef-1234567890ab" type: string type: object IssueCaseReference: description: The case the issue is attached to. properties: id: description: Case identifier. example: "2841440d-e780-4fe2-96cd-6a8c1d194da5" type: string type: $ref: "#/components/schemas/IssueCaseResourceType" required: - id - type type: object IssueCaseRelationship: description: Relationship between the issue and case. properties: data: $ref: "#/components/schemas/IssueCaseReference" required: - data type: object IssueCaseRelationships: description: Resources related to a case. properties: assignee: $ref: "#/components/schemas/NullableUserRelationship" created_by: $ref: "#/components/schemas/NullableUserRelationship" modified_by: $ref: "#/components/schemas/NullableUserRelationship" project: $ref: "#/components/schemas/ProjectRelationship" type: object IssueCaseResourceType: description: Type of the object. enum: ["case"] example: "case" type: string x-enum-varnames: - CASE IssueIncluded: description: An array of related resources, returned when the `include` query parameter is used. oneOf: - $ref: "#/components/schemas/IssueCase" - $ref: "#/components/schemas/IssueUser" - $ref: "#/components/schemas/IssueTeam" - $ref: "#/components/schemas/IssueSample" IssueLanguage: description: Programming language associated with the issue. enum: - BRIGHTSCRIPT - C - C_PLUS_PLUS - C_SHARP - CLOJURE - DOT_NET - ELIXIR - ERLANG - GO - GROOVY - HASKELL - HCL - JAVA - JAVASCRIPT - JVM - KOTLIN - OBJECTIVE_C - PERL - PHP - PYTHON - RUBY - RUST - SCALA - SWIFT - TERRAFORM - TYPESCRIPT - UNKNOWN example: "PYTHON" type: string x-enum-varnames: - BRIGHTSCRIPT - C - C_PLUS_PLUS - C_SHARP - CLOJURE - DOT_NET - ELIXIR - ERLANG - GO - GROOVY - HASKELL - HCL - JAVA - JAVASCRIPT - JVM - KOTLIN - OBJECTIVE_C - PERL - PHP - PYTHON - RUBY - RUST - SCALA - SWIFT - TERRAFORM - TYPESCRIPT - UNKNOWN IssuePlatform: description: Platform associated with the issue. enum: - ANDROID - BACKEND - BROWSER - FLUTTER - IOS - REACT_NATIVE - ROKU - UNKNOWN example: "BACKEND" type: string x-enum-varnames: - ANDROID - BACKEND - BROWSER - FLUTTER - IOS - REACT_NATIVE - ROKU - UNKNOWN IssueReference: description: The issue the search result corresponds to. properties: id: description: Issue identifier. example: "c1726a66-1f64-11ee-b338-da7ad0900002" type: string type: $ref: "#/components/schemas/IssueType" required: - id - type type: object IssueRegression: description: Regression information for an issue that was previously resolved and then reopened. properties: regressed_at: description: Timestamp when the issue was reopened (regressed). example: "2024-01-03T08:00:00Z" format: date-time type: string regressed_at_version: description: Application version where the regression was observed. example: "v2.5.2" type: string resolved_at: description: Timestamp when the issue was resolved before the regression. example: "2024-01-01T10:00:00Z" format: date-time type: string required: - resolved_at - regressed_at type: object IssueRelationships: description: Relationship between the issue and an assignee, case and/or teams. properties: assignee: $ref: "#/components/schemas/IssueAssigneeRelationship" case: $ref: "#/components/schemas/IssueCaseRelationship" samples: $ref: "#/components/schemas/IssueSamplesRelationship" team_owners: $ref: "#/components/schemas/IssueTeamOwnersRelationship" type: object IssueResponse: description: Response containing error tracking issue data. properties: data: $ref: "#/components/schemas/Issue" included: description: Array of resources related to the issue. items: $ref: "#/components/schemas/IssueIncluded" type: array type: object IssueSample: description: An error event of the issue, picked because it satisfies one or more sample biases. properties: attributes: $ref: "#/components/schemas/IssueSampleAttributes" id: description: Sample identifier. example: "AwAAAZPHnBVMDCSmFgAAABhBWlBIbkJWTUFBRDVnUkhKTmY0WmhRQUEAAAAkMDE5M2M3OWMtMTg1OC00ZTE1LWFhMmItOTQ1N2ZkOGVlMzQyAAAAAA" type: string type: $ref: "#/components/schemas/IssueSampleType" required: - id - type - attributes type: object IssueSampleAttributes: description: Object containing the information of a sample. properties: application_id: description: RUM application identifier of the error. example: "40d8ca4b-2ac0-481f-b16e-f110699ecff6" type: string biases: description: Biases the sample satisfies. A single error can satisfy several biases. example: ["latest", "git_metadata"] items: $ref: "#/components/schemas/IssueSampleBias" type: array build_id: description: Build identifier of the mobile application. example: "a1b2c3" type: string bundle_version: description: Bundle version of the mobile application. example: "42" type: string data_source: $ref: "#/components/schemas/IssueSampleDataSource" debug_id: description: Debug identifier used to resolve the stack trace of the error to source code. example: "9d8c7b6a-5f4e-3d2c-1b0a-9f8e7d6c5b4a" type: string debug_info_captured: description: Whether an Exception Replay snapshot was captured for the error. example: false type: boolean error_source_type: description: |- Source type set by the SDK or tracer that reported the error, such as `browser` for RUM browser errors or `Crashtracking` for backend crash reports. Usually not set for APM and logs errors. example: "browser" type: string error_stack: $ref: "#/components/schemas/IssueSampleErrorStack" event: $ref: "#/components/schemas/IssueSampleEvent" git_commit_sha: description: Git commit SHA of the service version. example: "b6199f80b6199f80b6199f80b6199f80b6199f80" type: string git_repository_id: description: Git repository identifier of the service. example: "github.com/company/email-api-py" type: string git_repository_url: description: Git repository URL of the service. example: "https://github.com/company/email-api-py" type: string has_session_replay: description: Whether a RUM session replay is available for the error. example: true type: boolean language: description: Programming language of the service. example: "python" type: string links: description: Source code locations of the stack frames that resolve to a repository file. items: $ref: "#/components/schemas/IssueSampleFrameLink" type: array os_name: description: Operating system of the device that reported the error. example: "iOS" type: string service: description: Service name. example: "email-api-py" type: string session_id: description: RUM session identifier of the error. example: "72d11fa0-7f59-408a-95ff-9af7d4f8d7db" type: string session_replay_url: description: URL of the RUM session replay of the error. example: "https://app.datadoghq.com/rum/replay/sessions/72d11fa0-7f59-408a-95ff-9af7d4f8d7db" type: string snapshot_id: description: Identifier of the Exception Replay snapshot of the error. example: "0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d" type: string span_id: description: APM span identifier of the error. example: "3906394766563720946" type: string timestamp: description: Timestamp of the error. example: "2024-01-01T10:00:00Z" format: date-time type: string trace_id: description: APM trace identifier of the error. example: "6730183925457637287" type: string variant: description: Build variant of the mobile application. example: "release" type: string version: description: Version of the service. example: "1.2.3" type: string view_id: description: RUM view identifier of the error. example: "c5c02423-c03a-400a-993f-731bebf1732b" type: string required: - timestamp - error_stack type: object IssueSampleBias: description: |- Criterion used to pick a sample. `latest` picks the most recent error. `git_metadata` picks the most recent error with source code metadata, whose stack trace is parsed. `trace` picks the most recent error with an APM trace. `session_replay` picks the most recent error with a RUM session replay. `exception_replay` picks the most recent error with an Exception Replay snapshot. enum: - latest - git_metadata - trace - session_replay - exception_replay example: "latest" type: string x-enum-varnames: - LATEST - GIT_METADATA - TRACE - SESSION_REPLAY - EXCEPTION_REPLAY IssueSampleCodeSnippet: description: Source code around a stack frame. Empty when the source code is unavailable. properties: lines: description: Lines of source code. example: ["def filter_forbidden_tags(tags):", " return len(tags)"] items: type: string type: array offset: description: Line number of the first line of the snippet, starting at 1. example: 37 format: int64 type: integer type: object IssueSampleDataSource: description: Product that reported the error. The value is `NONE` when the error has no known origin. enum: - APM - LOGS - RUM - LLMOBS - SYNTHETICS - NONE example: "APM" type: string x-enum-varnames: - APM - LOGS - RUM - LLMOBS - SYNTHETICS - NONE IssueSampleErrorStack: description: Parsed stack trace of the error. Only the sample picked by the `git_metadata` bias has frames. properties: frames: description: Stack frames, from the top of the stack. items: $ref: "#/components/schemas/IssueSampleStackFrame" type: array language: description: Programming language used to parse the stack trace. example: "go" type: string type: object IssueSampleEvent: additionalProperties: {} description: Raw error event, as stored by its data source. Its fields differ between APM, logs, and RUM. type: object IssueSampleFrameLink: description: Source code location of a stack frame. properties: code_location: $ref: "#/components/schemas/IssueSampleGitFileLocation" frame_id: description: Index of the frame in the stack trace, starting at 0. example: 1 format: int64 type: integer required: - frame_id - code_location type: object IssueSampleGitFileLocation: description: Location of a stack frame in a repository file. Empty when the source code is unavailable. properties: column: description: Column of the location, starting at 1. example: 13 format: int64 type: integer filepath: description: Path of the file in the repository. example: "conduit/apps/core/utils.py" type: string first_line: description: First line of the location, starting at 1. example: 42 format: int64 type: integer last_line: description: Last line of the location, starting at 1. example: 42 format: int64 type: integer ref: description: Git reference of the file, usually a commit SHA. example: "b6199f80b6199f80b6199f80b6199f80b6199f80" type: string repo_id: description: Repository identifier. example: "github.com/company/email-api-py" type: string type: object IssueSampleReference: description: A curated error sample of the issue. properties: id: description: Sample identifier. example: "AwAAAZPHnBVMDCSmFgAAABhBWlBIbkJWTUFBRDVnUkhKTmY0WmhRQUEAAAAkMDE5M2M3OWMtMTg1OC00ZTE1LWFhMmItOTQ1N2ZkOGVlMzQyAAAAAA" type: string type: $ref: "#/components/schemas/IssueSampleType" required: - id - type type: object IssueSampleStackFrame: description: A stack frame. properties: code_snippet: $ref: "#/components/schemas/IssueSampleCodeSnippet" git_file_location: $ref: "#/components/schemas/IssueSampleGitFileLocation" text: description: Text of the frame, as it appears in the stack trace. example: "main.handler(0xc000123456)\n\t/go/src/app/main.go:42 +0x1d" type: string type: object IssueSampleType: description: Type of the object. enum: ["error_tracking_issue_sample"] example: "error_tracking_issue_sample" type: string x-enum-varnames: - ERROR_TRACKING_ISSUE_SAMPLE IssueSamplesRelationship: description: Relationship between the issue and its curated error samples. properties: data: description: Array of curated error samples of the issue. items: $ref: "#/components/schemas/IssueSampleReference" type: array required: - data type: object IssueState: description: State of the issue enum: - OPEN - ACKNOWLEDGED - RESOLVED - IGNORED - EXCLUDED example: "RESOLVED" type: string x-enum-varnames: - OPEN - ACKNOWLEDGED - RESOLVED - IGNORED - EXCLUDED IssueTeam: description: A team that owns an issue. properties: attributes: $ref: "#/components/schemas/IssueTeamAttributes" id: description: Team identifier. example: "221b0179-6447-4d03-91c3-3ca98bf60e8a" type: string type: $ref: "#/components/schemas/IssueTeamType" required: - id - type - attributes type: object IssueTeamAttributes: description: Object containing the information of a team. properties: handle: description: The team's identifier. example: "team-handle" type: string name: description: The name of the team. example: "Team Name" type: string summary: description: A brief summary of the team, derived from its description. example: "This is a team." type: string type: object IssueTeamOwnersRelationship: description: Relationship between the issue and teams. properties: data: description: Array of teams that are owners of the issue. items: $ref: "#/components/schemas/IssueTeamReference" type: array required: - data type: object IssueTeamReference: description: A team that owns the issue. properties: id: description: Team identifier. example: "221b0179-6447-4d03-91c3-3ca98bf60e8a" type: string type: $ref: "#/components/schemas/IssueTeamType" required: - id - type type: object IssueTeamType: description: Type of the object. enum: ["team"] example: "team" type: string x-enum-varnames: - TEAM IssueType: description: Type of the object. enum: ["issue"] example: "issue" type: string x-enum-varnames: - ISSUE IssueUpdateAssigneeRequest: description: Update issue assignee request payload. properties: data: $ref: "#/components/schemas/IssueUpdateAssigneeRequestData" required: - data type: object IssueUpdateAssigneeRequestData: description: Update issue assignee request. properties: id: description: User identifier. example: "87cb11a0-278c-440a-99fe-701223c80296" type: string type: $ref: "#/components/schemas/IssueUpdateAssigneeRequestDataType" required: - id - type type: object IssueUpdateAssigneeRequestDataType: description: Type of the object. enum: ["assignee"] example: "assignee" type: string x-enum-varnames: - ASSIGNEE IssueUpdateStateRequest: description: Update issue state request payload. properties: data: $ref: "#/components/schemas/IssueUpdateStateRequestData" required: - data type: object IssueUpdateStateRequestData: description: Update issue state request. properties: attributes: $ref: "#/components/schemas/IssueUpdateStateRequestDataAttributes" id: description: Issue identifier. example: "c1726a66-1f64-11ee-b338-da7ad0900002" type: string type: $ref: "#/components/schemas/IssueUpdateStateRequestDataType" required: - id - type - attributes type: object IssueUpdateStateRequestDataAttributes: description: Object describing an issue state update request. properties: state: $ref: "#/components/schemas/IssueState" required: - state type: object IssueUpdateStateRequestDataType: description: Type of the object. enum: ["error_tracking_issue"] example: "error_tracking_issue" type: string x-enum-varnames: - ERROR_TRACKING_ISSUE IssueUser: description: The user to whom the issue is assigned. properties: attributes: $ref: "#/components/schemas/IssueUserAttributes" id: description: User identifier. example: "87cb11a0-278c-440a-99fe-701223c80296" type: string type: $ref: "#/components/schemas/IssueUserType" required: - id - type - attributes type: object IssueUserAttributes: description: Object containing the information of a user. properties: email: description: Email of the user. example: "user@company.com" type: string handle: description: Handle of the user. example: "User Handle" type: string name: description: Name of the user. example: "User Name" type: string type: object IssueUserReference: description: The user the issue is assigned to. properties: id: description: User identifier. example: "87cb11a0-278c-440a-99fe-701223c80296" type: string type: $ref: "#/components/schemas/IssueUserType" required: - id - type type: object IssueUserType: description: Type of the object enum: ["user"] example: "user" type: string x-enum-varnames: - USER IssuesSearchRequest: description: Search issues request payload. properties: data: $ref: "#/components/schemas/IssuesSearchRequestData" required: - data type: object IssuesSearchRequestData: description: Search issues request. properties: attributes: $ref: "#/components/schemas/IssuesSearchRequestDataAttributes" type: $ref: "#/components/schemas/IssuesSearchRequestDataType" required: - type - attributes type: object IssuesSearchRequestDataAttributes: description: Object describing a search issue request. properties: assignee_ids: description: Filter issues by assignee IDs. Multiple values are combined with OR logic. example: - "00000000-0000-0000-0000-000000000001" items: format: uuid type: string maxItems: 50 type: array from: description: Start date (inclusive) of the query in milliseconds since the Unix epoch. example: 1671612804000 format: int64 type: integer order_by: $ref: "#/components/schemas/IssuesSearchRequestDataAttributesOrderBy" persona: $ref: "#/components/schemas/IssuesSearchRequestDataAttributesPersona" query: description: Search query following the event search syntax. example: "service:orders-* AND @language:go" type: string states: description: Filter issues by state. Multiple values are combined with OR logic. example: - "OPEN" - "ACKNOWLEDGED" items: $ref: "#/components/schemas/IssueState" maxItems: 20 type: array team_ids: description: Filter issues by team IDs. Multiple values are combined with OR logic. example: - "00000000-0000-0000-0000-000000000002" items: format: uuid type: string maxItems: 50 type: array to: description: End date (exclusive) of the query in milliseconds since the Unix epoch. example: 1671620004000 format: int64 type: integer track: $ref: "#/components/schemas/IssuesSearchRequestDataAttributesTrack" required: - query - from - to type: object IssuesSearchRequestDataAttributesOrderBy: description: The attribute to sort the search results by. enum: - TOTAL_COUNT - FIRST_SEEN - IMPACTED_SESSIONS - PRIORITY example: "IMPACTED_SESSIONS" type: string x-enum-varnames: - TOTAL_COUNT - FIRST_SEEN - IMPACTED_SESSIONS - PRIORITY IssuesSearchRequestDataAttributesPersona: description: Persona for the search. Either track(s) or persona(s) must be specified. enum: ["ALL", "BROWSER", "MOBILE", "BACKEND"] example: "BACKEND" type: string x-enum-varnames: - ALL - BROWSER - MOBILE - BACKEND IssuesSearchRequestDataAttributesTrack: description: Track of the events to query. Either track(s) or persona(s) must be specified. enum: ["trace", "logs", "rum"] example: "trace" type: string x-enum-varnames: - TRACE - LOGS - RUM IssuesSearchRequestDataType: description: Type of the object. enum: ["search_request"] example: "search_request" type: string x-enum-varnames: - SEARCH_REQUEST IssuesSearchResponse: description: Search issues response payload. properties: data: description: Array of results matching the search query. items: $ref: "#/components/schemas/IssuesSearchResult" type: array included: description: Array of resources related to the search results. items: $ref: "#/components/schemas/IssuesSearchResultIncluded" type: array type: object IssuesSearchResult: description: Result matching the search query. properties: attributes: $ref: "#/components/schemas/IssuesSearchResultAttributes" id: description: Search result identifier (matches the nested issue's identifier). example: "c1726a66-1f64-11ee-b338-da7ad0900002" type: string relationships: $ref: "#/components/schemas/IssuesSearchResultRelationships" type: $ref: "#/components/schemas/IssuesSearchResultType" required: - id - type - attributes type: object IssuesSearchResultAttributes: description: Object containing the information of a search result. properties: impacted_sessions: description: Count of sessions impacted by the issue over the queried time window. example: 12 format: int64 type: integer impacted_users: description: Count of users impacted by the issue over the queried time window. example: 4 format: int64 type: integer total_count: description: Total count of errors that match the issue over the queried time window. example: 82 format: int64 type: integer type: object IssuesSearchResultIncluded: description: An array of related resources, returned when the `include` query parameter is used. oneOf: - $ref: "#/components/schemas/Issue" - $ref: "#/components/schemas/IssueCase" - $ref: "#/components/schemas/IssueUser" - $ref: "#/components/schemas/IssueTeam" IssuesSearchResultIssueRelationship: description: Relationship between the search result and the corresponding issue. properties: data: $ref: "#/components/schemas/IssueReference" required: - data type: object IssuesSearchResultRelationships: description: Relationships between the search result and other resources. properties: issue: $ref: "#/components/schemas/IssuesSearchResultIssueRelationship" type: object IssuesSearchResultType: description: Type of the object. enum: ["error_tracking_search_result"] example: "error_tracking_search_result" type: string x-enum-varnames: - ERROR_TRACKING_SEARCH_RESULT ItemApiPayload: description: A single datastore item with its content and metadata. properties: data: $ref: "#/components/schemas/ItemApiPayloadData" type: object ItemApiPayloadArray: description: A collection of datastore items with pagination and schema metadata. properties: data: description: An array of datastore items with their content and metadata. items: $ref: "#/components/schemas/ItemApiPayloadData" maxItems: 100 type: array meta: $ref: "#/components/schemas/ItemApiPayloadMeta" description: Metadata about the included items, including pagination info and datastore schema. required: - data type: object ItemApiPayloadData: description: Core data and metadata for a single datastore item. properties: attributes: $ref: "#/components/schemas/ItemApiPayloadDataAttributes" id: description: The unique identifier of the datastore. type: string type: $ref: "#/components/schemas/DatastoreItemsDataType" required: - type type: object ItemApiPayloadDataAttributes: description: Metadata and content of a datastore item. properties: created_at: description: Timestamp when the item was first created. format: date-time type: string modified_at: description: Timestamp when the item was last modified. format: date-time type: string org_id: description: The ID of the organization that owns this item. format: int64 type: integer primary_column_name: $ref: "#/components/schemas/DatastoreAttributesPrimaryColumnName" signature: description: A unique signature identifying this item version. type: string store_id: description: The unique identifier of the datastore containing this item. type: string value: $ref: "#/components/schemas/ItemApiPayloadDataAttributesValue" type: object ItemApiPayloadDataAttributesValue: additionalProperties: {} description: The data content (as key-value pairs) of a datastore item. type: object ItemApiPayloadMeta: description: Additional metadata about a collection of datastore items, including pagination and schema information. properties: page: $ref: "#/components/schemas/ItemApiPayloadMetaPage" schema: $ref: "#/components/schemas/ItemApiPayloadMetaSchema" type: object ItemApiPayloadMetaPage: description: Pagination information for a collection of datastore items. properties: hasMore: description: Whether there are additional pages of items beyond the current page. type: boolean totalCount: description: The total number of items in the datastore, ignoring any filters. format: int64 type: integer totalFilteredCount: description: The total number of items that match the current filter criteria. format: int64 type: integer type: object ItemApiPayloadMetaSchema: description: Schema information about the datastore, including its primary key and field definitions. properties: fields: description: An array describing the columns available in this datastore. items: $ref: "#/components/schemas/ItemApiPayloadMetaSchemaField" type: array primary_key: description: The name of the primary key column for this datastore. type: string type: object ItemApiPayloadMetaSchemaField: description: Information about a specific column in the datastore schema. properties: name: description: The name of this column in the datastore. example: "" type: string type: description: The data type of this column. For example, 'string', 'number', or 'boolean'. example: "" type: string required: - name - type type: object JSONAPIErrorItem: description: API error response body properties: detail: description: A human-readable explanation specific to this occurrence of the error. example: Missing required attribute in body type: string meta: additionalProperties: {} description: Non-standard meta-information about the error type: object source: $ref: "#/components/schemas/JSONAPIErrorItemSource" status: description: Status code of the response. example: "400" type: string title: description: Short human-readable summary of the error. example: Bad Request type: string type: object JSONAPIErrorItemSource: description: References to the source of the error. properties: header: description: A string indicating the name of a single request header which caused the error. example: "Authorization" type: string parameter: description: A string indicating which URI query parameter caused the error. example: "limit" type: string pointer: description: A JSON pointer to the value in the request document that caused the error. example: "/data/attributes/title" type: string type: object JSONAPIErrorResponse: description: API error response. properties: errors: description: A list of errors. items: $ref: "#/components/schemas/JSONAPIErrorItem" type: array required: - errors type: object JSSourcemapAttributes: description: Attributes of a JavaScript source map. properties: absolute_path: description: The absolute path to the minified JavaScript file. example: /js/bundle.min.js type: string blob_storage_sourcemap_path: description: The path to the source map in blob storage. example: org123/1.0.0/bundle.min.js.map type: string build_id: description: The build identifier. example: abc123 type: string created_at: description: The timestamp when the source map was created. example: "2024-01-01T00:00:00Z" format: date-time type: string debug_id: description: |- The debug identifier (UUID format) that uniquely identifies this JavaScript source map. Returned for source maps indexed by debug ID. example: 00000000-0000-4000-8000-000000000001 type: string domain: description: The domain associated with the source map. example: example.com type: string file_name: description: The file name of the minified JavaScript file. example: bundle.min.js type: string mapkind: $ref: "#/components/schemas/JSSourcemapMapKind" service: description: The service name associated with the source map. example: my-web-service type: string size: description: The size of the source map file in bytes. example: 1024 format: int64 type: integer variant: description: The source map variant. example: release type: string version: description: The version of the service associated with the source map. example: 1.0.0 type: string version_code: description: The version code. example: "100" type: string required: - mapkind - size - created_at type: object JSSourcemapData: description: JavaScript source map data object. properties: attributes: $ref: "#/components/schemas/JSSourcemapAttributes" id: description: The unique identifier of the source map. example: "5" type: string type: $ref: "#/components/schemas/SourcemapDataType" required: - id - type - attributes type: object JSSourcemapMapKind: description: The type of source map. Always `js` for JavaScript source maps. enum: - js example: js type: string x-enum-varnames: - JS JVMSourcemapAttributes: description: Attributes of a JVM mapping file. properties: build_id: description: The build identifier (UUID format). example: 550e8400-e29b-41d4-a716-446655440000 type: string created_at: description: The timestamp when the mapping file was created. example: "2024-01-01T00:00:00Z" format: date-time type: string mapkind: $ref: "#/components/schemas/JVMSourcemapMapKind" service: description: The service name associated with the mapping file. example: my-android-app type: string size: description: The size of the mapping file in bytes. example: 512 format: int64 type: integer variant: description: The build variant (e.g., `release`, `debug`). example: release type: string version: description: The version of the service associated with the mapping file. example: 1.0.0 type: string version_code: description: The version code. example: "100" type: string required: - mapkind - size - created_at type: object JVMSourcemapData: description: JVM (ProGuard/R8) mapping file data object. properties: attributes: $ref: "#/components/schemas/JVMSourcemapAttributes" id: description: The unique identifier of the source map. example: "9" type: string type: $ref: "#/components/schemas/SourcemapDataType" required: - id - type - attributes type: object JVMSourcemapMapKind: description: The type of source map. Always `jvm` for JVM source maps. enum: - jvm example: jvm type: string x-enum-varnames: - JVM JiraAccountAttributes: description: Attributes of a Jira account properties: consumer_key: description: The consumer key for the Jira account example: "consumer-key-1" type: string instance_url: description: The URL of the Jira instance example: "https://example.atlassian.net" type: string last_webhook_timestamp: description: Timestamp of the last webhook received example: "2024-01-15T10:30:00Z" format: date-time type: string required: - consumer_key - instance_url type: object JiraAccountData: description: Data object for a Jira account properties: attributes: $ref: "#/components/schemas/JiraAccountAttributes" id: description: Unique identifier for the Jira account example: "account-1" type: string type: $ref: "#/components/schemas/JiraAccountType" required: - id - type - attributes type: object JiraAccountRelationship: description: Relationship to a Jira account properties: data: $ref: "#/components/schemas/JiraAccountData" required: - data type: object JiraAccountType: description: Type identifier for Jira account resources enum: - jira-account example: jira-account type: string x-enum-varnames: - JIRA_ACCOUNT JiraAccountsData: description: Array of Jira account data objects items: $ref: "#/components/schemas/JiraAccountData" type: array JiraAccountsMeta: description: Metadata for Jira accounts response properties: public_key: description: Public key for the Jira integration example: "c29tZSBkYXRhIHdpdGggACBhbmQg77u/" type: string type: object JiraAccountsResponse: description: Response containing Jira accounts properties: data: $ref: "#/components/schemas/JiraAccountsData" example: - attributes: consumer_key: "consumer-key-1" instance_url: "https://example.atlassian.net" id: "account-1" type: jira-account meta: $ref: "#/components/schemas/JiraAccountsMeta" required: - data type: object JiraIntegrationMetadata: description: Incident integration metadata for the Jira integration. properties: issues: description: Array of Jira issues in this integration metadata. example: [] items: $ref: "#/components/schemas/JiraIntegrationMetadataIssuesItem" type: array required: - issues type: object JiraIntegrationMetadataIssuesItem: description: Item in the Jira integration metadata issue array. properties: account: description: URL of issue's Jira account. example: https://example.atlassian.net type: string issue_key: description: Jira issue's issue key. example: PROJ-123 type: string issuetype_id: description: Jira issue's issue type. example: "1000" type: string project_key: description: Jira issue's project keys. example: PROJ type: string redirect_url: description: URL redirecting to the Jira issue. example: https://example.atlassian.net/browse/PROJ-123 type: string required: - project_key - account type: object JiraIssue: description: Jira issue attached to work item nullable: true properties: result: $ref: "#/components/schemas/JiraIssueResult" status: $ref: "#/components/schemas/Case3rdPartyTicketStatus" readOnly: true type: object JiraIssueCreateAttributes: description: Jira issue creation attributes properties: fields: additionalProperties: {} description: Additional Jira fields example: {} type: object issue_type_id: description: Jira issue type ID example: "10001" type: string jira_account_id: description: Jira account ID example: "1234" type: string project_id: description: Jira project ID example: "5678" type: string required: - jira_account_id - project_id - issue_type_id type: object JiraIssueCreateData: description: Jira issue creation data properties: attributes: $ref: "#/components/schemas/JiraIssueCreateAttributes" type: $ref: "#/components/schemas/JiraIssueResourceType" required: - type - attributes type: object JiraIssueCreateRequest: description: Jira issue creation request properties: data: $ref: "#/components/schemas/JiraIssueCreateData" required: - data type: object JiraIssueLinkAttributes: description: Jira issue link attributes properties: jira_issue_url: description: URL of the Jira issue example: "https://jira.example.com/browse/PROJ-123" type: string required: - jira_issue_url type: object JiraIssueLinkData: description: Jira issue link data properties: attributes: $ref: "#/components/schemas/JiraIssueLinkAttributes" type: $ref: "#/components/schemas/JiraIssueResourceType" required: - type - attributes type: object JiraIssueLinkRequest: description: Jira issue link request properties: data: $ref: "#/components/schemas/JiraIssueLinkData" required: - data type: object JiraIssueResourceType: description: Jira issue resource type enum: - issues example: issues type: string x-enum-varnames: - ISSUES JiraIssueResult: description: Jira issue information properties: issue_id: description: Jira issue ID type: string issue_key: description: Jira issue key type: string issue_url: description: Jira issue URL type: string project_key: description: Jira project key type: string type: object JiraIssueTemplateCreateRequest: description: Request to create a Jira issue template properties: data: $ref: "#/components/schemas/JiraIssueTemplateCreateRequestData" type: object JiraIssueTemplateCreateRequestAttributes: description: Attributes for creating a Jira issue template properties: fields: additionalProperties: {} description: Custom fields for the Jira issue template example: description: payload: "Test" type: "json" type: object issue_type_id: description: The ID of the Jira issue type example: "12730" type: string jira-account: $ref: "#/components/schemas/JiraIssueTemplateCreateRequestAttributesJiraAccount" name: description: The name of the issue template example: "test-template" type: string project_id: description: The ID of the Jira project example: "10772" type: string type: object JiraIssueTemplateCreateRequestAttributesJiraAccount: description: Reference to the Jira account properties: id: description: The ID of the Jira account example: "80f16d40-1fba-486e-b1fc-983e6ca19bec" format: uuid type: string required: - id type: object JiraIssueTemplateCreateRequestData: description: Data object for creating a Jira issue template properties: attributes: $ref: "#/components/schemas/JiraIssueTemplateCreateRequestAttributes" type: $ref: "#/components/schemas/JiraIssueTemplateType" type: object JiraIssueTemplateData: description: Data object for a Jira issue template properties: attributes: $ref: "#/components/schemas/JiraIssueTemplateDataAttributes" id: description: Unique identifier for the Jira issue template example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string relationships: $ref: "#/components/schemas/JiraIssueTemplateDataRelationships" type: $ref: "#/components/schemas/JiraIssueTemplateType" required: - id - type - attributes type: object JiraIssueTemplateDataAttributes: description: Attributes of a Jira issue template properties: fields: additionalProperties: {} description: Custom fields for the Jira issue template example: description: payload: "Test Description" type: "json" type: object issue_type_id: description: The ID of the Jira issue type example: "456" type: string name: description: The name of the issue template example: "Test Template" type: string project_id: description: The ID of the Jira project example: "123" type: string required: - name - project_id - issue_type_id - fields type: object JiraIssueTemplateDataRelationships: description: Relationships of a Jira issue template properties: jira-account: $ref: "#/components/schemas/JiraAccountRelationship" required: - jira-account type: object JiraIssueTemplateResponse: description: Response containing a single Jira issue template properties: data: $ref: "#/components/schemas/JiraIssueTemplateData" included: $ref: "#/components/schemas/JiraAccountsData" required: - data type: object JiraIssueTemplateType: description: Type identifier for Jira issue template resources enum: - jira-issue-template example: jira-issue-template type: string x-enum-varnames: - JIRA_ISSUE_TEMPLATE JiraIssueTemplateUpdateRequest: description: Request to update a Jira issue template properties: data: $ref: "#/components/schemas/JiraIssueTemplateUpdateRequestData" required: - data type: object JiraIssueTemplateUpdateRequestAttributes: description: Attributes for updating a Jira issue template properties: fields: additionalProperties: {} description: Custom fields for the Jira issue template example: description: payload: "Updated Description" type: "json" type: object name: description: The name of the issue template example: "test_template_updated" type: string type: object JiraIssueTemplateUpdateRequestData: description: Data object for updating a Jira issue template properties: attributes: $ref: "#/components/schemas/JiraIssueTemplateUpdateRequestAttributes" type: $ref: "#/components/schemas/JiraIssueTemplateType" required: - type - attributes type: object JiraIssueTemplatesData: description: Array of Jira issue template data objects items: $ref: "#/components/schemas/JiraIssueTemplateData" type: array JiraIssueTemplatesResponse: description: Response containing Jira issue templates properties: data: $ref: "#/components/schemas/JiraIssueTemplatesData" example: - attributes: fields: description: payload: "Test Description" type: "json" issue_type_id: "10001" name: "Bug Report Template" project_id: "PROJECT-1" id: "65b3341b-0680-47f9-a6d4-134db45c603e" type: jira-issue-template included: $ref: "#/components/schemas/JiraAccountsData" required: - data type: object JiraIssuesDataType: default: jira_issues description: Jira issues resource type. enum: - jira_issues example: jira_issues type: string x-enum-varnames: - JIRA_ISSUES JobCreateResponse: description: Run a historical job response. properties: data: $ref: "#/components/schemas/JobCreateResponseData" type: object JobCreateResponseData: description: The definition of `JobCreateResponseData` object. properties: id: description: ID of the created job. type: string type: $ref: "#/components/schemas/HistoricalJobDataType" type: object JobDefinition: description: Definition of a historical job. properties: calculatedFields: description: Calculated fields. items: $ref: "#/components/schemas/CalculatedField" type: array cases: description: Cases used for generating job results. Up to 10 cases are allowed. items: $ref: "#/components/schemas/SecurityMonitoringRuleCaseCreate" maxItems: 10 type: array from: description: Starting time of data analyzed by the job. example: 1729843470000 format: int64 type: integer groupSignalsBy: description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. example: - service items: description: Field to group by. type: string type: array index: description: Index used to load the data. example: cloud_siem type: string message: description: Message for generated results. example: A large number of failed login attempts. type: string name: description: Job name. example: Excessive number of failed attempts. type: string options: $ref: "#/components/schemas/HistoricalJobOptions" queries: description: Queries for selecting logs analyzed by the job. Up to 10 queries are allowed. items: $ref: "#/components/schemas/HistoricalJobQuery" maxItems: 10 type: array referenceTables: description: Reference tables used in the queries. items: $ref: "#/components/schemas/SecurityMonitoringReferenceTable" type: array tags: description: Tags for generated signals. items: description: A tag string in `key:value` format. type: string type: array thirdPartyCases: description: Cases for generating results from third-party detection method. Only available for third-party detection method. Up to 10 cases are allowed. example: [] items: $ref: "#/components/schemas/SecurityMonitoringThirdPartyRuleCaseCreate" maxItems: 10 type: array to: description: Ending time of data analyzed by the job. example: 1729847070000 format: int64 type: integer type: description: Job type. type: string required: - from - to - index - name - cases - queries - message type: object JobDefinitionFromRule: description: Definition of a historical job based on a security monitoring rule. properties: caseIndex: description: Zero-based index of the rule case to use as the job's signal condition. When omitted, all cases are evaluated. Up to 10 cases are supported, so valid values are 0 to 9. format: int32 maximum: 9 minimum: 0 type: integer from: description: Starting time of data analyzed by the job. example: 1729843470000 format: int64 type: integer id: description: ID of the detection rule used to create the job. example: abc-def-ghi type: string index: description: Index used to load the data. example: cloud_siem type: string notifications: description: Notifications sent when the job is completed. example: - "@sns-cloudtrail-results" items: description: A notification recipient handle (for example, `@user` or `@channel`). type: string type: array to: description: Ending time of data analyzed by the job. example: 1729847070000 format: int64 type: integer required: - id - from - to - index type: object JsonPatchOperation: description: A JSON Patch operation as per RFC 6902. properties: op: $ref: "#/components/schemas/JsonPatchOperationOp" path: description: A JSON Pointer path (e.g., "/name", "/value/secure"). example: "/name" type: string value: description: The value to use for the operation (not applicable for "remove" and "test" operations). required: - op - path type: object JsonPatchOperationOp: description: The operation to perform. enum: - add - remove - replace - move - copy - test example: add type: string x-enum-varnames: - ADD - REMOVE - REPLACE - MOVE - COPY - TEST KindAttributes: description: Kind attributes. properties: description: description: Short description of the kind. type: string displayName: description: User friendly name of the kind. type: string name: description: The kind name. example: my-job minLength: 1 type: string type: object KindData: description: Schema that defines the structure of a Kind object in the Software Catalog. properties: attributes: $ref: "#/components/schemas/KindAttributes" id: description: A read-only globally unique identifier for the entity generated by Datadog. User supplied values are ignored. example: 4b163705-23c0-4573-b2fb-f6cea2163fcb minLength: 1 type: string meta: $ref: "#/components/schemas/KindMetadata" type: description: Kind. type: string type: object KindMetadata: description: Kind metadata. properties: createdAt: description: The creation time. type: string modifiedAt: description: The modification time. type: string type: object KindObj: description: Schema for kind. properties: description: description: Short description of the kind. type: string displayName: description: The display name of the kind. Automatically generated if not provided. type: string kind: description: The name of the kind to create or update. This must be in kebab-case format. example: "my-job" type: string required: - kind type: object KindRaw: description: Kind definition in raw JSON or YAML representation. example: |- kind: service displayName: Service description: A service entity in the catalog. type: string KindResponseData: description: List of kind responses. items: $ref: "#/components/schemas/KindData" type: array KindResponseMeta: description: Kind response metadata. properties: count: description: Total kinds count. format: int64 type: integer type: object LLMObsAnnotatedInteractionByTraceItem: description: An annotated interaction returned by the cross-queue lookup, including the source queue metadata. properties: annotations: description: List of annotations for this interaction. items: $ref: "#/components/schemas/LLMObsAnnotationItem" type: array can_annotate: description: Whether the current caller can annotate this interaction. example: true type: boolean content_id: description: Upstream entity identifier (trace ID, session ID, or deterministic display_block ID). example: "trace-abc-123" type: string created_at: description: Timestamp when the interaction was added to the queue. example: "2025-06-01T12:00:00Z" format: date-time type: string display_block: $ref: "#/components/schemas/LLMObsContentBlocks" id: description: Unique identifier of the interaction. example: "interaction-456" type: string modified_at: description: Timestamp when the interaction was last updated. example: "2025-06-01T12:00:00Z" format: date-time type: string queue_id: description: Identifier of the annotation queue this interaction belongs to. example: "queue-uuid-001" type: string queue_name: description: Name of the annotation queue this interaction belongs to. example: "My Annotation Queue" type: string type: $ref: "#/components/schemas/LLMObsAnyInteractionType" required: - id - type - content_id - created_at - modified_at - queue_id - queue_name - can_annotate - annotations type: object LLMObsAnnotatedInteractionDataAttributesResponse: description: Attributes containing an annotated interaction and its related events. properties: annotated_interaction: $ref: "#/components/schemas/LLMObsAnnotatedInteractionItem" events: $ref: "#/components/schemas/LLMObsAnnotatedInteractionEvents" interaction_type: $ref: "#/components/schemas/LLMObsAnyInteractionType" next_cursor: description: Cursor to retrieve the next page of events. Absent when there are no more events. example: "eyJzdGFydCI6MTAwfQ==" type: string required: - annotated_interaction - interaction_type - events type: object LLMObsAnnotatedInteractionDataResponse: description: Data object for a single annotated interaction. properties: attributes: $ref: "#/components/schemas/LLMObsAnnotatedInteractionDataAttributesResponse" id: description: Unique identifier of the interaction. example: "interaction-456" type: string type: $ref: "#/components/schemas/LLMObsAnnotatedInteractionsType" required: - id - type - attributes type: object LLMObsAnnotatedInteractionEvent: description: An event associated with an annotated interaction. properties: attributes: $ref: "#/components/schemas/LLMObsAnnotatedInteractionEventAttributes" id: description: Unique identifier of the event. example: "span-7a1b2c3d" type: string type: description: Type of the event. example: span type: string required: - id - type - attributes type: object LLMObsAnnotatedInteractionEventAttributes: additionalProperties: {} description: Attributes of an event associated with an annotated interaction. example: duration: 1500000000 ml_app: my-llm-app name: agent_workflow span_id: span-7a1b2c3d span_kind: agent start_ns: 1705314600000000000 status: ok trace_id: trace-abc-123 type: object LLMObsAnnotatedInteractionEvents: description: Page of events associated with the annotated interaction. items: $ref: "#/components/schemas/LLMObsAnnotatedInteractionEvent" type: array LLMObsAnnotatedInteractionItem: description: An interaction with its associated annotations. oneOf: - $ref: "#/components/schemas/LLMObsTraceAnnotatedInteractionItem" - $ref: "#/components/schemas/LLMObsDisplayBlockAnnotatedInteractionItem" LLMObsAnnotatedInteractionResponse: description: Response containing a single annotated interaction and its related events. properties: data: $ref: "#/components/schemas/LLMObsAnnotatedInteractionDataResponse" required: - data type: object LLMObsAnnotatedInteractionsByTraceDataAttributesResponse: description: Attributes of the cross-queue annotated interactions response. properties: annotated_interactions: description: List of annotated interactions across all queues for the requested content IDs. items: $ref: "#/components/schemas/LLMObsAnnotatedInteractionByTraceItem" type: array total_count: description: Total number of annotated interactions matching the query. example: 1 format: int32 maximum: 2147483647 type: integer required: - annotated_interactions - total_count type: object LLMObsAnnotatedInteractionsByTraceDataResponse: description: Data object for the cross-queue annotated interactions response. properties: attributes: $ref: "#/components/schemas/LLMObsAnnotatedInteractionsByTraceDataAttributesResponse" id: description: Opaque identifier for the response object. example: "trace-query" type: string type: $ref: "#/components/schemas/LLMObsAnnotatedInteractionsByTraceType" required: - id - type - attributes type: object LLMObsAnnotatedInteractionsByTraceResponse: description: Response containing annotated interactions across all queues for the requested content IDs. properties: data: $ref: "#/components/schemas/LLMObsAnnotatedInteractionsByTraceDataResponse" required: - data type: object LLMObsAnnotatedInteractionsByTraceType: description: Resource type for cross-queue annotated interactions lookup. enum: - annotated_interactions_by_trace example: annotated_interactions_by_trace type: string x-enum-varnames: - ANNOTATED_INTERACTIONS_BY_TRACE LLMObsAnnotatedInteractionsDataAttributesResponse: description: Attributes containing the list of annotated interactions. properties: annotated_interactions: description: List of interactions with their annotations. example: - annotations: [] can_annotate: true content_id: trace-abc-123 id: "interaction-456" type: trace items: $ref: "#/components/schemas/LLMObsAnnotatedInteractionItem" type: array required: - annotated_interactions type: object LLMObsAnnotatedInteractionsDataResponse: description: Data object for annotated interactions. properties: attributes: $ref: "#/components/schemas/LLMObsAnnotatedInteractionsDataAttributesResponse" id: description: The annotation queue ID. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/LLMObsAnnotatedInteractionsType" required: - id - type - attributes type: object LLMObsAnnotatedInteractionsResponse: description: Response containing the annotated interactions for an annotation queue. properties: data: $ref: "#/components/schemas/LLMObsAnnotatedInteractionsDataResponse" required: - data type: object LLMObsAnnotatedInteractionsType: description: Resource type for annotated interactions. enum: - annotated_interactions example: annotated_interactions type: string x-enum-varnames: - ANNOTATED_INTERACTIONS LLMObsAnnotationAssessment: description: Assessment result for a label value. enum: - pass - fail example: "pass" type: string x-enum-varnames: - PASS - FAIL LLMObsAnnotationError: description: A partial error for a single annotation that could not be processed. properties: annotation_id: description: ID of the annotation that failed, if applicable. example: "00000000-0000-0000-0000-000000000000" type: string code: $ref: "#/components/schemas/LLMObsAnnotationErrorCode" error: description: Error message. example: "interaction not found" type: string interaction_id: description: ID of the interaction that failed. example: "00000000-0000-0000-0000-000000000001" type: string required: - interaction_id - error type: object LLMObsAnnotationErrorCode: description: Stable error code. `permission_denied` indicates the item was rejected by queue access rules. enum: - permission_denied example: permission_denied type: string x-enum-varnames: - PERMISSION_DENIED LLMObsAnnotationItem: description: A single annotation on an interaction. properties: created_at: description: Timestamp when the annotation was created. example: "2024-01-15T10:30:00Z" format: date-time type: string created_by: description: Identifier of the user who created the annotation. example: "00000000-0000-0000-0000-000000000002" type: string id: description: Unique identifier of the annotation. example: "annotation-789" type: string interaction_id: description: Identifier of the interaction this annotation belongs to. example: "interaction-456" type: string label_values: additionalProperties: {} description: Label values for this annotation. example: - label_schema_id: "abc-123" value: "good" type: object modified_at: description: Timestamp when the annotation was last modified. example: "2024-01-15T10:30:00Z" format: date-time type: string modified_by: description: Identifier of the user who last modified the annotation. example: "00000000-0000-0000-0000-000000000002" type: string required: - id - interaction_id - label_values - created_by - created_at - modified_by - modified_at type: object LLMObsAnnotationItemResponse: description: A single annotation on an interaction, as returned by the API. properties: created_at: description: Timestamp when the annotation was created. example: "2024-01-15T10:30:00Z" format: date-time type: string created_by: description: Identifier of the user who created the annotation. example: "00000000-0000-0000-0000-000000000002" type: string id: description: Unique identifier of the annotation. example: "annotation-789" type: string interaction_id: description: Identifier of the interaction this annotation belongs to. example: "interaction-456" type: string label_values: description: |- Label values for this annotation. Each entry references a label schema by ID and provides the corresponding value. example: - label_schema_id: "abc-123" value: "good" items: $ref: "#/components/schemas/LLMObsAnnotationLabelValueResponse" type: array modified_at: description: Timestamp when the annotation was last modified. example: "2024-01-15T10:30:00Z" format: date-time type: string modified_by: description: Identifier of the user who last modified the annotation. example: "00000000-0000-0000-0000-000000000002" type: string required: - id - interaction_id - label_values - created_by - created_at - modified_by - modified_at type: object LLMObsAnnotationLabelValue: description: |- A single label value entry in an annotation. The `value` type must match the label schema type: - `score`: a number within the schema `min`/`max` range (integer if `is_integer` is `true`). - `categorical`: a string that is one of the schema `values`. - `boolean`: `true` or `false`. - `text`: any non-empty string. properties: assessment: $ref: "#/components/schemas/LLMObsAnnotationAssessment" label_schema_id: description: ID of the label schema this value corresponds to. example: "abc-123" type: string reasoning: description: Free text reasoning for this label value. example: "The response was accurate and well-structured." type: string value: $ref: "#/components/schemas/LLMObsAnnotationLabelValueValue" required: - label_schema_id - value type: object LLMObsAnnotationLabelValueResponse: description: |- A single label value entry in an annotation response. In addition to the submitted fields, the server populates `type` and `name_when_saved` to mirror the schema state at the time the annotation was created — these help clients display values correctly when the schema has since changed. properties: assessment: $ref: "#/components/schemas/LLMObsAnnotationAssessment" label_schema_id: description: ID of the label schema this value corresponds to. example: "abc-123" type: string name_when_saved: description: Name of the label schema at the time the annotation was created. example: "quality" type: string reasoning: description: Free text reasoning for this label value. example: "The response was accurate and well-structured." type: string type: $ref: "#/components/schemas/LLMObsLabelSchemaType" value: $ref: "#/components/schemas/LLMObsAnnotationLabelValueValue" required: - label_schema_id - value type: object LLMObsAnnotationLabelValueStringArray: description: For categorical-type labels allowing multiple selections. items: type: string type: array LLMObsAnnotationLabelValueValue: description: The value for this label. Must comply with the label schema type constraints. example: 0.0 oneOf: - $ref: "#/components/schemas/AnyValueNumber" - $ref: "#/components/schemas/AnyValueString" - $ref: "#/components/schemas/LLMObsAnnotationLabelValueStringArray" - $ref: "#/components/schemas/AnyValueBoolean" LLMObsAnnotationQueueDataAttributesRequest: description: Attributes for creating an Agent Observability annotation queue. properties: annotation_schema: $ref: "#/components/schemas/LLMObsAnnotationSchema" description: description: Description of the annotation queue. example: "Queue for annotating customer support traces" type: string name: description: Name of the annotation queue. example: "My annotation queue" type: string project_id: description: Identifier of the project this queue belongs to. example: "00000000-0000-0000-0000-000000000002" type: string restrict_to_assignees: description: Whether annotation access is restricted to assigned users. example: false type: boolean restrict_to_reviewers: description: Whether annotation access is restricted to queue reviewers. example: true type: boolean reviewer_emails: description: Email addresses of reviewers who can access the annotation queue. example: - "reviewer@example.com" items: type: string type: array required: - name - project_id type: object LLMObsAnnotationQueueDataAttributesResponse: description: Attributes of an Agent Observability annotation queue. properties: annotation_schema: $ref: "#/components/schemas/LLMObsAnnotationSchema" can_manage_access: description: Whether the current caller can manage access for the annotation queue. example: true readOnly: true type: boolean created_at: description: Timestamp when the queue was created. example: "2024-01-15T10:30:00Z" format: date-time type: string created_by: description: Identifier of the user who created the queue. example: "00000000-0000-0000-0000-000000000002" type: string description: description: Description of the annotation queue. example: "Queue for annotating customer support traces" type: string modified_at: description: Timestamp when the queue was last modified. example: "2024-01-15T10:30:00Z" format: date-time type: string modified_by: description: Identifier of the user who last modified the queue. example: "00000000-0000-0000-0000-000000000002" type: string name: description: Name of the annotation queue. example: "My annotation queue" type: string owned_by: description: Identifier of the user who owns the queue. example: "00000000-0000-0000-0000-000000000002" type: string project_id: description: Identifier of the project this queue belongs to. example: "00000000-0000-0000-0000-000000000002" type: string restrict_to_assignees: description: Whether annotation access is restricted to assigned users. example: false type: boolean restrict_to_reviewers: description: Whether annotation access is restricted to queue reviewers. example: true type: boolean reviewer_emails: description: |- Email addresses of reviewers for the annotation queue. Returned only when the caller can manage queue access. example: - "reviewer@example.com" items: type: string type: array required: - name - project_id - description - created_by - created_at - modified_by - modified_at - owned_by - restrict_to_reviewers - restrict_to_assignees - can_manage_access type: object LLMObsAnnotationQueueDataRequest: description: Data object for creating an Agent Observability annotation queue. properties: attributes: $ref: "#/components/schemas/LLMObsAnnotationQueueDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsAnnotationQueueType" required: - type - attributes type: object LLMObsAnnotationQueueDataResponse: description: Data object for an Agent Observability annotation queue. properties: attributes: $ref: "#/components/schemas/LLMObsAnnotationQueueDataAttributesResponse" id: description: Unique identifier of the annotation queue. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/LLMObsAnnotationQueueType" required: - id - type - attributes type: object LLMObsAnnotationQueueInteractionItem: description: A single interaction to add to an annotation queue. oneOf: - $ref: "#/components/schemas/LLMObsTraceInteractionItem" - $ref: "#/components/schemas/LLMObsDisplayBlockInteractionItem" LLMObsAnnotationQueueInteractionResponseItem: description: A single interaction result. oneOf: - $ref: "#/components/schemas/LLMObsTraceInteractionResponseItem" - $ref: "#/components/schemas/LLMObsDisplayBlockInteractionResponseItem" LLMObsAnnotationQueueInteractionsDataAttributesRequest: description: Attributes for adding interactions to an annotation queue. properties: interactions: description: List of interactions to add to the queue. Must contain at least one item. example: - content_id: trace-abc-123 type: trace items: $ref: "#/components/schemas/LLMObsAnnotationQueueInteractionItem" minItems: 1 type: array required: - interactions type: object LLMObsAnnotationQueueInteractionsDataAttributesResponse: description: Attributes of the interaction addition response. properties: interactions: description: List of interactions that were processed. example: - already_existed: false content_id: trace-abc-123 id: "00000000-0000-0000-0000-000000000000" type: trace items: $ref: "#/components/schemas/LLMObsAnnotationQueueInteractionResponseItem" type: array required: - interactions type: object LLMObsAnnotationQueueInteractionsDataRequest: description: Data object for adding interactions to an annotation queue. properties: attributes: $ref: "#/components/schemas/LLMObsAnnotationQueueInteractionsDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsAnnotationQueueInteractionsType" required: - type - attributes type: object LLMObsAnnotationQueueInteractionsDataResponse: description: Data object for the interaction addition response. properties: attributes: $ref: "#/components/schemas/LLMObsAnnotationQueueInteractionsDataAttributesResponse" id: description: The queue ID the interactions were added to. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/LLMObsAnnotationQueueInteractionsType" required: - id - type - attributes type: object LLMObsAnnotationQueueInteractionsRequest: description: Request to add interactions to an Agent Observability annotation queue. properties: data: $ref: "#/components/schemas/LLMObsAnnotationQueueInteractionsDataRequest" required: - data type: object LLMObsAnnotationQueueInteractionsResponse: description: Response containing the result of adding interactions to an annotation queue. properties: data: $ref: "#/components/schemas/LLMObsAnnotationQueueInteractionsDataResponse" required: - data type: object LLMObsAnnotationQueueInteractionsType: description: Resource type for annotation queue interactions. enum: - interactions example: interactions type: string x-enum-varnames: - INTERACTIONS LLMObsAnnotationQueueLabelSchemaAttributes: description: Attributes of an annotation queue label schema. properties: annotation_schema: $ref: "#/components/schemas/LLMObsAnnotationSchema" required: - annotation_schema type: object LLMObsAnnotationQueueLabelSchemaData: description: Data object for an annotation queue label schema. properties: attributes: $ref: "#/components/schemas/LLMObsAnnotationQueueLabelSchemaAttributes" id: description: Unique identifier of the annotation queue. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/LLMObsAnnotationQueueType" required: - id - type - attributes type: object LLMObsAnnotationQueueLabelSchemaResponse: description: Response containing the label schema of an annotation queue. properties: data: $ref: "#/components/schemas/LLMObsAnnotationQueueLabelSchemaData" required: - data type: object LLMObsAnnotationQueueLabelSchemaUpdateAttributes: description: Attributes for updating an annotation queue label schema. properties: annotation_schema: $ref: "#/components/schemas/LLMObsAnnotationSchema" required: - annotation_schema type: object LLMObsAnnotationQueueLabelSchemaUpdateData: description: Data object for updating an annotation queue label schema. properties: attributes: $ref: "#/components/schemas/LLMObsAnnotationQueueLabelSchemaUpdateAttributes" type: $ref: "#/components/schemas/LLMObsAnnotationQueueType" required: - type - attributes type: object LLMObsAnnotationQueueLabelSchemaUpdateRequest: description: Request to update the label schema of an annotation queue. properties: data: $ref: "#/components/schemas/LLMObsAnnotationQueueLabelSchemaUpdateData" required: - data type: object LLMObsAnnotationQueueRequest: description: Request to create an Agent Observability annotation queue. properties: data: $ref: "#/components/schemas/LLMObsAnnotationQueueDataRequest" required: - data type: object LLMObsAnnotationQueueResponse: description: Response containing a single Agent Observability annotation queue. properties: data: $ref: "#/components/schemas/LLMObsAnnotationQueueDataResponse" required: - data type: object LLMObsAnnotationQueueType: description: Resource type of an Agent Observability annotation queue. enum: - queues example: queues type: string x-enum-varnames: - QUEUES LLMObsAnnotationQueueUpdateDataAttributesRequest: description: Attributes for updating an Agent Observability annotation queue. All fields are optional. properties: annotation_schema: $ref: "#/components/schemas/LLMObsAnnotationSchema" description: description: Updated description of the annotation queue. example: "Updated description" type: string name: description: Updated name of the annotation queue. example: "Updated queue name" type: string restrict_to_assignees: description: Whether annotation access is restricted to assigned users. example: false type: boolean restrict_to_reviewers: description: Whether annotation access is restricted to queue reviewers. example: true type: boolean reviewer_emails: description: Updated email addresses of reviewers who can access the annotation queue. example: - "reviewer@example.com" items: type: string type: array type: object LLMObsAnnotationQueueUpdateDataRequest: description: Data object for updating an Agent Observability annotation queue. properties: attributes: $ref: "#/components/schemas/LLMObsAnnotationQueueUpdateDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsAnnotationQueueType" required: - type - attributes type: object LLMObsAnnotationQueueUpdateRequest: description: Request to update an Agent Observability annotation queue. properties: data: $ref: "#/components/schemas/LLMObsAnnotationQueueUpdateDataRequest" required: - data type: object LLMObsAnnotationQueuesResponse: description: Response containing a list of Agent Observability annotation queues. properties: data: description: List of annotation queues. items: $ref: "#/components/schemas/LLMObsAnnotationQueueDataResponse" type: array required: - data type: object LLMObsAnnotationSchema: description: Schema defining the labels for an annotation queue. properties: label_schemas: description: List of label schema definitions. items: $ref: "#/components/schemas/LLMObsLabelSchema" type: array required: - label_schemas type: object LLMObsAnnotationsDataAttributesRequest: description: Attributes for creating or updating annotations. properties: annotations: description: List of annotations to create or update. Must contain at least one item. items: $ref: "#/components/schemas/LLMObsUpsertAnnotationItem" minItems: 1 type: array required: - annotations type: object LLMObsAnnotationsDataAttributesResponse: description: Attributes of the annotations response. properties: annotations: description: Successfully created or updated annotations. items: $ref: "#/components/schemas/LLMObsAnnotationItemResponse" type: array errors: description: Partial errors for annotations that could not be processed. items: $ref: "#/components/schemas/LLMObsAnnotationError" type: array required: - annotations type: object LLMObsAnnotationsDataRequest: description: Data object for creating or updating annotations. properties: attributes: $ref: "#/components/schemas/LLMObsAnnotationsDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsAnnotationsType" required: - type - attributes type: object LLMObsAnnotationsDataResponse: description: Data object for the annotations response. properties: attributes: $ref: "#/components/schemas/LLMObsAnnotationsDataAttributesResponse" id: description: The annotation queue ID. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/LLMObsAnnotationsType" required: - id - type - attributes type: object LLMObsAnnotationsRequest: description: Request to create or update annotations on interactions in an annotation queue. properties: data: $ref: "#/components/schemas/LLMObsAnnotationsDataRequest" required: - data type: object LLMObsAnnotationsResponse: description: Response containing the created or updated annotations. properties: data: $ref: "#/components/schemas/LLMObsAnnotationsDataResponse" required: - data type: object LLMObsAnnotationsType: description: Resource type for Agent Observability annotations. enum: - annotations example: annotations type: string x-enum-varnames: - ANNOTATIONS LLMObsAnthropicEffort: description: The effort level for Anthropic inference. enum: - low - medium - high - max example: medium nullable: true type: string x-enum-varnames: - LOW - MEDIUM - HIGH - MAX LLMObsAnthropicMetadata: description: Anthropic-specific metadata for an inference request. properties: effort: $ref: "#/components/schemas/LLMObsAnthropicEffort" thinking: $ref: "#/components/schemas/LLMObsAnthropicThinkingConfig" nullable: true type: object LLMObsAnthropicThinkingConfig: description: Configuration for Anthropic extended thinking feature. properties: budget_tokens: description: Maximum token budget for extended thinking. Required when type is `enabled`. example: 1024 format: int64 nullable: true type: integer type: $ref: "#/components/schemas/LLMObsAnthropicThinkingType" required: - type type: object LLMObsAnthropicThinkingType: description: The thinking mode for Anthropic extended thinking. enum: - enabled - disabled - adaptive example: enabled type: string x-enum-varnames: - ENABLED - DISABLED - ADAPTIVE LLMObsAnyInteractionType: description: Type of an annotated interaction. enum: - trace - experiment_trace - session - display_block example: trace type: string x-enum-varnames: - TRACE - EXPERIMENT_TRACE - SESSION - DISPLAY_BLOCK LLMObsAzureOpenAIMetadata: description: Azure OpenAI-specific metadata for an integration account or inference request. properties: deployment_id: description: The Azure OpenAI deployment ID. example: "my-gpt4-deployment" type: string model_version: description: The model version deployed in Azure. example: "0613" type: string resource_name: description: The Azure OpenAI resource name. example: "my-azure-resource" type: string type: object LLMObsBedrockMetadata: description: Amazon Bedrock-specific metadata for an inference request. properties: region: description: The AWS region for the Bedrock request. example: "us-east-1" type: string type: object LLMObsContentBlock: description: |- A single content block rendered inside a `display_block` interaction. `type` discriminates which other fields are meaningful: - `markdown` / `text`: `content` must be a string. - `header`: `content` must be a string; `level`, when set, must be one of `sm`, `md`, `lg`, `xl`. - `json`: `content` must be a well-formed JSON value (object, array, or scalar). - `image`: `url` is required. - `univiz`: `tileDef` is required (any well-formed JSON; the frontend owns the renderable schema). - `llmobs_trace`: `traceId` is required; `interactionType`, when set, must be `trace` or `experiment_trace`. - `frontend`: `code` is required and must be a non-empty string; `label` is optional. `height`, when set, must be positive. properties: alt: description: Alternative text for an `image` block. example: "Example image" type: string code: $ref: "#/components/schemas/LLMObsFrontendContentBlockCode" content: description: |- Block payload. A string for `markdown`, `header`, and `text`; an arbitrary JSON value (object, array, or scalar) for `json`. Omitted for `image`, `univiz`, `llmobs_trace`, and `frontend`. example: "## Triage Instructions" height: description: Optional rendered height. Must be positive when set. example: 240 format: int64 type: integer interactionType: $ref: "#/components/schemas/LLMObsContentBlockLLMObsTraceInteractionType" label: description: Optional label rendered alongside a `frontend` block. example: "Triage Instructions" type: string level: $ref: "#/components/schemas/LLMObsContentBlockHeaderLevel" tileDef: description: |- Tile definition for a `univiz` block. Required for `univiz`. The schema is owned by the frontend renderer. example: requests: - queries: - data_source: metrics name: q query: "avg:system.cpu.user{*}" response_format: timeseries type: line viz: timeseries timeFrame: $ref: "#/components/schemas/LLMObsContentBlockTimeFrame" traceId: description: Trace identifier. Required for `llmobs_trace` blocks. example: "69fcc2bb0000000003113989d83069ba" type: string type: $ref: "#/components/schemas/LLMObsContentBlockType" url: description: URL of the image. Required for `image` blocks. example: "https://example.com/image.png" type: string type: object LLMObsContentBlockHeaderLevel: description: Visual size for a `header` block. enum: - sm - md - lg - xl example: md type: string x-enum-varnames: - SM - MD - LG - XL LLMObsContentBlockLLMObsTraceInteractionType: description: |- Upstream interaction type referenced by an `llmobs_trace` block. Restricted to `trace` or `experiment_trace`. enum: - trace - experiment_trace example: trace type: string x-enum-varnames: - TRACE - EXPERIMENT_TRACE LLMObsContentBlockTimeFrame: description: Unix-millis time range used by chart blocks. properties: end: description: End of the range, in Unix milliseconds. example: 1705315800000 format: int64 type: integer start: description: Start of the range, in Unix milliseconds. example: 1705312200000 format: int64 type: integer required: - start - end type: object LLMObsContentBlockType: description: |- Discriminator for a single `display_block` content block. Adding a variant requires coordinated changes in the frontend renderer. enum: - markdown - header - text - json - image - univiz - llmobs_trace - frontend example: markdown type: string x-enum-varnames: - MARKDOWN - HEADER - TEXT - JSON - IMAGE - UNIVIZ - LLMOBS_TRACE - FRONTEND LLMObsContentBlocks: description: |- List of content blocks that make up a `display_block` interaction. Must contain at least one block. items: $ref: "#/components/schemas/LLMObsContentBlock" minItems: 1 type: array LLMObsCreatePromptData: description: Data object for creating an Agent Observability prompt. properties: attributes: $ref: "#/components/schemas/LLMObsCreatePromptDataAttributes" type: $ref: "#/components/schemas/LLMObsPromptType" required: - type - attributes type: object LLMObsCreatePromptDataAttributes: description: >- Attributes for creating an Agent Observability prompt and its first version. `prompt_id` and `template` are required; all other attributes are optional. If `config` is omitted, the first version stores an empty object. Configuration authoring must be enabled for your organization to supply `config`. Otherwise, supplying it, including an empty object, returns HTTP 403. properties: config: $ref: "#/components/schemas/LLMObsPromptConfig" description: description: Optional description of the prompt. type: string env_ids: description: >- Optional feature-flag environment UUIDs the service attempts to enable and configure to use the first version as their default after creation. items: type: string type: array labels: deprecated: true description: >- Optional labels to attach to the first version. Do not use this attribute for new integrations. items: $ref: "#/components/schemas/LLMObsPromptVersionLabel" type: array prompt_id: description: Customer-provided identifier for the new prompt. example: "customer-support-assistant" minLength: 1 type: string template: $ref: "#/components/schemas/LLMObsPromptTemplate" title: description: Optional title of the prompt. type: string user_version: description: Optional user-supplied version identifier for the first version. type: string required: - prompt_id - template type: object LLMObsCreatePromptRequest: description: Request to create an Agent Observability prompt. properties: data: $ref: "#/components/schemas/LLMObsCreatePromptData" required: - data type: object LLMObsCreatePromptResponse: description: Response returned after creating an Agent Observability prompt. properties: data: $ref: "#/components/schemas/LLMObsCreatePromptResponseData" required: - data type: object LLMObsCreatePromptResponseData: description: Data object returned after creating an Agent Observability prompt. properties: attributes: $ref: "#/components/schemas/LLMObsCreatePromptResponseDataAttributes" id: description: Unique identifier of the prompt. example: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" type: string type: $ref: "#/components/schemas/LLMObsPromptType" required: - id - type - attributes type: object LLMObsCreatePromptResponseDataAttributes: description: >- Attributes returned after creating an Agent Observability prompt and its first version. Empty `config` is omitted when configuration authoring is disabled for the organization. Non-empty saved configuration is always returned. properties: author: description: UUID of the user who authored the prompt. type: string config: $ref: "#/components/schemas/LLMObsPromptConfig" created_at: description: Timestamp when the prompt was created. format: date-time type: string created_from: description: >- Source that created the prompt, such as `ui-registry`, `sdk-registry`, or `sdk-instrumentation`. example: "sdk-registry" type: string datasets: description: Datasets observed in runs associated with this prompt. items: $ref: "#/components/schemas/LLMObsPromptDataset" type: array description: description: Description of the prompt. type: string extracted_from: description: Source prompt from which this prompt was extracted, when applicable. type: string in_registry: description: Whether the prompt is a registry entry (as opposed to a code-discovered prompt). example: true type: boolean last_seen_at: description: Timestamp of the most recent observed run of this prompt. format: date-time type: string last_version_created_at: description: Timestamp when the most recent version of the prompt was created. format: date-time type: string ml_app: description: The ML application this prompt is associated with. type: string ml_apps: description: ML applications observed running this prompt. items: type: string type: array num_versions: description: Number of versions of the prompt. example: 1 format: int64 type: integer prompt_id: description: Customer-provided identifier of the prompt. example: "customer-support-assistant" type: string source: $ref: "#/components/schemas/LLMObsPromptResponseSource" tags: description: Tags observed on runs of this prompt. items: type: string type: array title: description: Title of the prompt. type: string required: - prompt_id - source - num_versions - in_registry - created_from type: object LLMObsCreatePromptVersionData: description: Data object for creating an Agent Observability prompt version. properties: attributes: $ref: "#/components/schemas/LLMObsCreatePromptVersionDataAttributes" type: $ref: "#/components/schemas/LLMObsPromptVersionType" required: - type - attributes type: object LLMObsCreatePromptVersionDataAttributes: description: >- Attributes for creating a new version of an Agent Observability prompt. `template` is required; all other attributes are optional. If `config` is omitted, the latest version's configuration is carried forward. An explicit empty object clears it. Configuration authoring must be enabled for your organization to supply `config`. Otherwise, supplying it, including an empty object, returns HTTP 403. Omitting `config` still carries forward the latest configuration. properties: config: $ref: "#/components/schemas/LLMObsPromptConfig" description: description: Optional description of this version. type: string env_ids: description: >- Optional feature-flag environment UUIDs the service attempts to enable and configure to use this version as their default after creation. items: type: string type: array labels: deprecated: true description: Optional labels to attach to this version. Do not use this attribute for new integrations. items: $ref: "#/components/schemas/LLMObsPromptVersionLabel" type: array template: $ref: "#/components/schemas/LLMObsPromptTemplate" user_version: description: Optional user-supplied version identifier for this version. type: string required: - template type: object LLMObsCreatePromptVersionRequest: description: Request to create a new version of an Agent Observability prompt. properties: data: $ref: "#/components/schemas/LLMObsCreatePromptVersionData" required: - data type: object LLMObsCursorMeta: description: Pagination cursor metadata. properties: after: description: Cursor for the next page of results. nullable: true type: string type: object LLMObsCustomEvalConfigAssessmentCriteria: description: Criteria used to assess the pass/fail result of a custom evaluator. properties: max_threshold: description: Maximum numeric threshold for a passing result. example: 1.0 format: double nullable: true type: number min_threshold: description: Minimum numeric threshold for a passing result. example: 0.7 format: double nullable: true type: number pass_values: description: Specific output values considered as a passing result. example: - "pass" - "yes" items: description: A value considered as a passing result. type: string nullable: true type: array pass_when: description: When true, a boolean output of true is treated as passing. example: true nullable: true type: boolean type: object LLMObsCustomEvalConfigAttributes: description: Attributes of a custom Agent Observability evaluator configuration. properties: category: description: Category of the evaluator. example: "Custom" type: string created_at: description: Timestamp when the evaluator configuration was created. example: "2024-01-15T10:30:00Z" format: date-time type: string created_by: $ref: "#/components/schemas/LLMObsCustomEvalConfigUser" eval_name: description: Name of the custom evaluator. example: "my-custom-evaluator" type: string last_updated_by: $ref: "#/components/schemas/LLMObsCustomEvalConfigUser" llm_judge_config: $ref: "#/components/schemas/LLMObsCustomEvalConfigLLMJudgeConfig" llm_provider: $ref: "#/components/schemas/LLMObsCustomEvalConfigLLMProvider" target: $ref: "#/components/schemas/LLMObsCustomEvalConfigTarget" updated_at: description: Timestamp when the evaluator configuration was last updated. example: "2024-01-15T10:30:00Z" format: date-time type: string required: - eval_name - created_at - updated_at type: object LLMObsCustomEvalConfigBedrockOptions: description: AWS Bedrock-specific options for LLM provider configuration. properties: inference_profile: description: Bedrock inference profile identifier, such as an application inference profile ARN. example: "arn:aws:bedrock:us-east-1:123456789012:application-inference-profile/abc123" type: string region: description: AWS region for Bedrock. example: "us-east-1" type: string type: object LLMObsCustomEvalConfigData: description: Data object for a custom Agent Observability evaluator configuration. properties: attributes: $ref: "#/components/schemas/LLMObsCustomEvalConfigAttributes" id: description: Unique name identifier of the evaluator configuration. example: "my-custom-evaluator" type: string type: $ref: "#/components/schemas/LLMObsCustomEvalConfigType" required: - id - type - attributes type: object LLMObsCustomEvalConfigEvalScope: description: Scope at which to evaluate spans. `trace_fan_out` requires `llm_judge_config.target_query`. enum: - span - trace - trace_fan_out - session example: "span" type: string x-enum-varnames: - SPAN - TRACE - TRACE_FAN_OUT - SESSION LLMObsCustomEvalConfigInferenceParams: description: LLM inference parameters for a custom evaluator. properties: frequency_penalty: description: Frequency penalty to reduce repetition. example: 0.0 format: double type: number max_tokens: description: Maximum number of tokens to generate. example: 1024 format: int64 type: integer presence_penalty: description: Presence penalty to reduce repetition. example: 0.0 format: double type: number temperature: description: Sampling temperature for the LLM. example: 0.7 format: double type: number top_k: description: Top-k sampling parameter. example: 50 format: int64 type: integer top_p: description: Top-p (nucleus) sampling parameter. example: 1.0 format: double type: number type: object LLMObsCustomEvalConfigIntegrationProvider: description: >- Name of the LLM integration provider. Use `deterministic` for a code evaluator, which runs `llm_judge_config.user_specified_json_post_processing_function` instead of calling an LLM. `insights_sponsored` is returned for evaluators that Datadog manages and cannot be set. enum: - openai - amazon_bedrock - anthropic - azure_openai - vertex_ai - llmproxy - deterministic - typesafe - datadog - datadog_ai_gateway - insights_sponsored example: "openai" type: string x-enum-varnames: - OPENAI - AMAZON_BEDROCK - ANTHROPIC - AZURE_OPENAI - VERTEX_AI - LLM_PROXY - DETERMINISTIC - TYPESAFE - DATADOG - DATADOG_AI_GATEWAY - INSIGHTS_SPONSORED LLMObsCustomEvalConfigLLMJudgeConfig: description: LLM judge configuration for a custom evaluator. properties: assessment_criteria: $ref: "#/components/schemas/LLMObsCustomEvalConfigAssessmentCriteria" context_query: description: Query used to extract additional context for the evaluation. example: "@input.context" nullable: true type: string inference_params: $ref: "#/components/schemas/LLMObsCustomEvalConfigInferenceParams" last_used_library_prompt_template_name: description: Name of the last library prompt template used. example: "sentiment-analysis-v1" nullable: true type: string modified_library_prompt_template: description: Whether the library prompt template was modified. example: false nullable: true type: boolean output_schema: additionalProperties: {} description: JSON schema describing the expected output format of the LLM judge. Omit for a `deterministic` evaluator. nullable: true type: object parsing_type: $ref: "#/components/schemas/LLMObsCustomEvalConfigParsingType" prompt_template: description: List of messages forming the LLM judge prompt template. Omit for a `deterministic` evaluator. items: $ref: "#/components/schemas/LLMObsCustomEvalConfigPromptMessage" type: array target_query: description: Query used to extract the target value to evaluate. example: "@output.value" nullable: true type: string user_specified_json_post_processing_function: description: >- User-provided JavaScript function applied to post-process the JSON output of the LLM judge. For a `deterministic` evaluator it is the evaluator itself: it receives the evaluated span (span scope), `{spans}` (trace scope), or `{session_id, traces}` (session scope), and its return value sets the result. A boolean, number, string or object becomes a boolean, score, categorical or JSON metric; `null` skips the evaluation; and `{value, assessment, reasoning, metadata}` also sets pass or fail, reasoning, and metadata. nullable: true type: string required: - inference_params type: object LLMObsCustomEvalConfigLLMProvider: description: LLM provider configuration for a custom evaluator. properties: bedrock: $ref: "#/components/schemas/LLMObsCustomEvalConfigBedrockOptions" integration_account_id: description: Integration account identifier. example: "my-account-id" type: string integration_provider: $ref: "#/components/schemas/LLMObsCustomEvalConfigIntegrationProvider" model_name: description: Name of the LLM model. Use `javascript` for a `deterministic` evaluator. example: "gpt-4o" type: string vertex_ai: $ref: "#/components/schemas/LLMObsCustomEvalConfigVertexAIOptions" type: object LLMObsCustomEvalConfigListResponse: description: Response containing a list of custom Agent Observability evaluator configurations. properties: data: description: List of custom evaluator configuration data objects. items: $ref: "#/components/schemas/LLMObsCustomEvalConfigData" type: array required: - data type: object LLMObsCustomEvalConfigParsingType: description: Output parsing type for a custom LLM judge evaluator. enum: - structured_output - json - keyword_search - typed_questions example: "structured_output" type: string x-enum-varnames: - STRUCTURED_OUTPUT - JSON - KEYWORD_SEARCH - TYPED_QUESTIONS LLMObsCustomEvalConfigPromptContent: description: A content block within a prompt message. properties: type: description: Content block type. example: "text" type: string value: $ref: "#/components/schemas/LLMObsCustomEvalConfigPromptContentValue" required: - type - value type: object LLMObsCustomEvalConfigPromptContentValue: description: Value of a prompt message content block. properties: text: description: Text content of the message block. example: "What is the sentiment of this review?" type: string tool_call: $ref: "#/components/schemas/LLMObsCustomEvalConfigPromptToolCall" tool_call_result: $ref: "#/components/schemas/LLMObsCustomEvalConfigPromptToolResult" type: object LLMObsCustomEvalConfigPromptMessage: description: A message in the prompt template for a custom LLM judge evaluator. properties: content: description: Text content of the message. example: "Rate the quality of the following response:" type: string contents: description: Multi-part content blocks for the message. items: $ref: "#/components/schemas/LLMObsCustomEvalConfigPromptContent" type: array role: description: Role of the message author. example: "user" type: string required: - role type: object LLMObsCustomEvalConfigPromptToolCall: description: A tool call within a prompt message. properties: arguments: description: JSON-encoded arguments for the tool call. example: '{"location": "San Francisco"}' type: string id: description: Unique identifier of the tool call. example: "call_abc123" type: string name: description: Name of the tool being called. example: "get_weather" type: string type: description: Type of the tool call. example: "function" type: string type: object LLMObsCustomEvalConfigPromptToolResult: description: A tool call result within a prompt message. properties: name: description: Name of the tool that produced this result. example: "get_weather" type: string result: description: The result returned by the tool. example: "sunny, 72F" type: string tool_id: description: Identifier of the tool call this result corresponds to. example: "call_abc123" type: string type: description: Type of the tool result. example: "function" type: string type: object LLMObsCustomEvalConfigResponse: description: Response containing a custom Agent Observability evaluator configuration. properties: data: $ref: "#/components/schemas/LLMObsCustomEvalConfigData" required: - data type: object LLMObsCustomEvalConfigTarget: description: Target application configuration for a custom evaluator. properties: application_name: description: Name of the ML application this evaluator targets. example: "my-llm-app" type: string enabled: description: Whether the evaluator is active for the target application. example: true type: boolean eval_scope: $ref: "#/components/schemas/LLMObsCustomEvalConfigEvalScope" nullable: true experiment_project_ids: description: Experiment project IDs this evaluator is scoped to. items: description: An experiment project ID. format: uuid type: string type: array filter: description: Filter expression to select which spans to evaluate. example: "@service:my-service" nullable: true type: string root_spans_only: description: When true, only root spans are evaluated. example: true nullable: true type: boolean sampling_percentage: description: Percentage of traces to evaluate. Must be greater than 0 and at most 100. example: 50.0 format: double nullable: true type: number required: - application_name - enabled type: object LLMObsCustomEvalConfigType: description: Type of the custom Agent Observability evaluator configuration resource. enum: - evaluator_config example: "evaluator_config" type: string x-enum-varnames: - EVALUATOR_CONFIG LLMObsCustomEvalConfigUpdateAttributes: description: Attributes for creating or updating a custom Agent Observability evaluator configuration. properties: category: description: Category of the evaluator. example: "Custom" type: string eval_name: description: Name of the custom evaluator. If provided, must match the eval_name path parameter. example: "my-custom-evaluator" type: string llm_judge_config: $ref: "#/components/schemas/LLMObsCustomEvalConfigLLMJudgeConfig" llm_provider: $ref: "#/components/schemas/LLMObsCustomEvalConfigLLMProvider" target: $ref: "#/components/schemas/LLMObsCustomEvalConfigTarget" required: - target type: object LLMObsCustomEvalConfigUpdateData: description: Data object for creating or updating a custom Agent Observability evaluator configuration. properties: attributes: $ref: "#/components/schemas/LLMObsCustomEvalConfigUpdateAttributes" id: description: Name of the evaluator. If provided, must match the eval_name path parameter. example: "my-custom-evaluator" type: string type: $ref: "#/components/schemas/LLMObsCustomEvalConfigType" required: - type - attributes type: object LLMObsCustomEvalConfigUpdateRequest: description: Request to create or update a custom Agent Observability evaluator configuration. properties: data: $ref: "#/components/schemas/LLMObsCustomEvalConfigUpdateData" required: - data type: object LLMObsCustomEvalConfigUser: description: A Datadog user associated with a custom evaluator configuration. properties: email: description: Email address of the user. example: "user@example.com" type: string type: object LLMObsCustomEvalConfigVertexAIOptions: description: Google Vertex AI-specific options for LLM provider configuration. properties: location: description: Google Cloud region. example: "us-central1" type: string project: description: Google Cloud project ID. example: "my-gcp-project" type: string type: object LLMObsDatasetBatchUpdateDataAttributesRequest: description: Attributes for batch-updating records in an Agent Observability dataset. properties: create_new_version: description: Whether to create a new dataset version when applying the batch update. Defaults to `true`. example: true type: boolean delete_records: $ref: "#/components/schemas/LLMObsDatasetBatchUpdateDeleteRecords" insert_records: $ref: "#/components/schemas/LLMObsDatasetBatchUpdateInsertRecords" tags: $ref: "#/components/schemas/LLMObsDatasetRecordTagsList" update_records: $ref: "#/components/schemas/LLMObsDatasetBatchUpdateUpdateRecords" type: object LLMObsDatasetBatchUpdateDataRequest: description: Data object for batch-updating records in an Agent Observability dataset. properties: attributes: $ref: "#/components/schemas/LLMObsDatasetBatchUpdateDataAttributesRequest" id: description: Unique identifier of the dataset. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" type: string type: $ref: "#/components/schemas/LLMObsDatasetType" required: - id - type - attributes type: object LLMObsDatasetBatchUpdateDeleteRecords: description: Record IDs to delete. items: description: A record ID to delete. type: string type: array LLMObsDatasetBatchUpdateInsertRecord: description: A record to insert as part of a batch update on an Agent Observability dataset. properties: expected_output: $ref: "#/components/schemas/AnyValue" id: description: Optional user-provided identifier for the record. If omitted, the server generates an identifier. example: "rec-7c3f5a1b-9e2d-4f8a-b1c6-3d7e9f0a2b4c" type: string input: $ref: "#/components/schemas/AnyValue" metadata: additionalProperties: {} description: Arbitrary metadata associated with the record. type: object tag_operations: $ref: "#/components/schemas/LLMObsDatasetRecordTagOperations" tags: $ref: "#/components/schemas/LLMObsDatasetRecordTagsList" required: - input type: object LLMObsDatasetBatchUpdateInsertRecords: description: Records to insert. items: $ref: "#/components/schemas/LLMObsDatasetBatchUpdateInsertRecord" type: array LLMObsDatasetBatchUpdateRequest: description: Request to batch-insert, update, and delete records in an Agent Observability dataset. properties: data: $ref: "#/components/schemas/LLMObsDatasetBatchUpdateDataRequest" required: - data type: object LLMObsDatasetBatchUpdateUpdateRecord: description: A record update payload as part of a batch update on an Agent Observability dataset. properties: expected_output: $ref: "#/components/schemas/AnyValue" id: description: Unique identifier of the record to update. example: "rec-7c3f5a1b-9e2d-4f8a-b1c6-3d7e9f0a2b4c" type: string input: $ref: "#/components/schemas/AnyValue" metadata: additionalProperties: {} description: Updated metadata associated with the record. type: object tag_operations: $ref: "#/components/schemas/LLMObsDatasetRecordTagOperations" required: - id type: object LLMObsDatasetBatchUpdateUpdateRecords: description: Records to update by ID. items: $ref: "#/components/schemas/LLMObsDatasetBatchUpdateUpdateRecord" type: array LLMObsDatasetCloneDataAttributesRequest: description: Attributes for cloning an Agent Observability dataset. properties: description: description: Description of the cloned dataset. example: "Clone of the original dataset for experimentation." type: string name: description: Name of the cloned dataset. example: "My cloned dataset" type: string required: - name type: object LLMObsDatasetCloneDataRequest: description: Data object for cloning an Agent Observability dataset. properties: attributes: $ref: "#/components/schemas/LLMObsDatasetCloneDataAttributesRequest" id: description: Identifier of the source dataset to clone. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" type: string type: $ref: "#/components/schemas/LLMObsDatasetType" required: - id - type - attributes type: object LLMObsDatasetCloneRequest: description: Request to clone an Agent Observability dataset. properties: data: $ref: "#/components/schemas/LLMObsDatasetCloneDataRequest" required: - data type: object LLMObsDatasetDataAttributesRequest: description: Attributes for creating an Agent Observability dataset. properties: description: description: Description of the dataset. type: string metadata: additionalProperties: {} description: Arbitrary metadata associated with the dataset. type: object name: description: Name of the dataset. example: "My LLM Dataset" type: string required: - name type: object LLMObsDatasetDataAttributesResponse: description: Attributes of an Agent Observability dataset. properties: created_at: description: Timestamp when the dataset was created. example: "2024-01-15T10:30:00Z" format: date-time type: string current_version: description: Current version number of the dataset. example: 1 format: int64 type: integer description: description: Description of the dataset. example: "" nullable: true type: string metadata: additionalProperties: {} description: Arbitrary metadata associated with the dataset. nullable: true type: object name: description: Name of the dataset. example: "My LLM Dataset" type: string updated_at: description: Timestamp when the dataset was last updated. example: "2024-01-15T10:30:00Z" format: date-time type: string required: - name - description - metadata - current_version - created_at - updated_at type: object LLMObsDatasetDataRequest: description: Data object for creating an Agent Observability dataset. properties: attributes: $ref: "#/components/schemas/LLMObsDatasetDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsDatasetType" required: - type - attributes type: object LLMObsDatasetDataResponse: description: Data object for an Agent Observability dataset. properties: attributes: $ref: "#/components/schemas/LLMObsDatasetDataAttributesResponse" id: description: Unique identifier of the dataset. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" type: string type: $ref: "#/components/schemas/LLMObsDatasetType" required: - id - type - attributes type: object LLMObsDatasetDraftStateData: description: Data object for an Agent Observability dataset draft state. properties: attributes: $ref: "#/components/schemas/LLMObsDatasetDraftStateDataAttributes" id: description: Unique identifier of the dataset draft state. Matches the dataset ID. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" type: string type: $ref: "#/components/schemas/LLMObsDatasetDraftStateType" required: - id - type - attributes type: object LLMObsDatasetDraftStateDataAttributes: description: Attributes of an Agent Observability dataset draft state. properties: drafting_since: description: Timestamp when the dataset draft session started. example: "2024-01-15T10:30:00Z" format: date-time type: string user: $ref: "#/components/schemas/LLMObsDatasetDraftStateUser" required: - user - drafting_since type: object LLMObsDatasetDraftStateResponse: description: Response containing the draft state of an Agent Observability dataset. properties: data: $ref: "#/components/schemas/LLMObsDatasetDraftStateData" required: - data type: object LLMObsDatasetDraftStateType: description: Resource type of an Agent Observability dataset draft state. enum: - draft_state_data example: draft_state_data type: string x-enum-varnames: - DRAFT_STATE_DATA LLMObsDatasetDraftStateUser: description: User information associated with a dataset draft state. properties: email: description: Email address of the user. example: "jane.doe@example.com" type: string handle: description: Handle of the user. example: "jane.doe@example.com" type: string icon: description: Icon for the user. example: "" type: string id: description: Unique identifier of the user holding the draft lock. example: "00000000-0000-0000-0000-000000000010" type: string name: description: Display name of the user. example: "Jane Doe" type: string required: - id type: object LLMObsDatasetExportFormat: default: csv description: Supported export format for an Agent Observability dataset. enum: - csv example: csv type: string x-enum-varnames: - CSV LLMObsDatasetRecordDataResponse: description: A single Agent Observability dataset record. properties: created_at: description: Timestamp when the record was created. example: "2024-01-15T10:30:00Z" format: date-time type: string dataset_id: description: Identifier of the dataset this record belongs to. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" type: string expected_output: $ref: "#/components/schemas/AnyValue" id: description: Unique identifier of the record. example: "rec-7c3f5a1b-9e2d-4f8a-b1c6-3d7e9f0a2b4c" type: string input: $ref: "#/components/schemas/AnyValue" metadata: additionalProperties: {} description: Arbitrary metadata associated with the record. nullable: true type: object updated_at: description: Timestamp when the record was last updated. example: "2024-01-15T10:30:00Z" format: date-time type: string required: - id - dataset_id - input - expected_output - metadata - created_at - updated_at type: object LLMObsDatasetRecordItem: description: A single record to append to an Agent Observability dataset. properties: expected_output: $ref: "#/components/schemas/AnyValue" input: $ref: "#/components/schemas/AnyValue" metadata: additionalProperties: {} description: Arbitrary metadata associated with the record. type: object required: - input type: object LLMObsDatasetRecordTagOperations: description: Explicit tag operations for updating records. Operations are applied in order, Remove then Add then Set. `set` is the final override; if specified, the result of `remove` and `add` is discarded. properties: add: $ref: "#/components/schemas/LLMObsDatasetRecordTagsList" remove: $ref: "#/components/schemas/LLMObsDatasetRecordTagsList" set: $ref: "#/components/schemas/LLMObsDatasetRecordTagsList" type: object LLMObsDatasetRecordTagsList: description: List of tag strings. items: description: A tag. type: string type: array LLMObsDatasetRecordUpdateItem: description: A record update payload for an Agent Observability dataset. properties: expected_output: $ref: "#/components/schemas/AnyValue" id: description: Unique identifier of the record to update. example: "rec-7c3f5a1b-9e2d-4f8a-b1c6-3d7e9f0a2b4c" type: string input: $ref: "#/components/schemas/AnyValue" metadata: additionalProperties: {} description: Updated metadata associated with the record. type: object required: - id type: object LLMObsDatasetRecordsDataAttributesRequest: description: Attributes for appending records to an Agent Observability dataset. properties: deduplicate: description: Whether to deduplicate records before appending. Defaults to `true`. type: boolean records: description: List of records to append to the dataset. items: $ref: "#/components/schemas/LLMObsDatasetRecordItem" type: array required: - records type: object LLMObsDatasetRecordsDataRequest: description: Data object for appending records to an Agent Observability dataset. properties: attributes: $ref: "#/components/schemas/LLMObsDatasetRecordsDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsDatasetType" required: - type - attributes type: object LLMObsDatasetRecordsListResponse: description: Response containing a paginated list of Agent Observability dataset records. properties: data: description: List of dataset records. items: $ref: "#/components/schemas/LLMObsDatasetRecordDataResponse" type: array meta: $ref: "#/components/schemas/LLMObsCursorMeta" required: - data type: object LLMObsDatasetRecordsMutationData: description: Response containing records after a create or update operation. properties: records: description: List of affected dataset records. items: $ref: "#/components/schemas/LLMObsDatasetRecordDataResponse" type: array required: - records type: object LLMObsDatasetRecordsMutationResponse: description: Response containing records after a create or update operation. properties: data: description: List of affected dataset records. items: $ref: "#/components/schemas/LLMObsDatasetRecordsMutationData" type: array required: - data type: object LLMObsDatasetRecordsRequest: description: Request to append records to an Agent Observability dataset. properties: data: $ref: "#/components/schemas/LLMObsDatasetRecordsDataRequest" required: - data type: object LLMObsDatasetRecordsUpdateDataAttributesRequest: description: Attributes for updating records in an Agent Observability dataset. properties: records: description: List of records to update. items: $ref: "#/components/schemas/LLMObsDatasetRecordUpdateItem" type: array required: - records type: object LLMObsDatasetRecordsUpdateDataRequest: description: Data object for updating records in an Agent Observability dataset. properties: attributes: $ref: "#/components/schemas/LLMObsDatasetRecordsUpdateDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsDatasetType" required: - type - attributes type: object LLMObsDatasetRecordsUpdateRequest: description: Request to update records in an Agent Observability dataset. properties: data: $ref: "#/components/schemas/LLMObsDatasetRecordsUpdateDataRequest" required: - data type: object LLMObsDatasetRecordsUploadFile: description: Multipart payload for uploading dataset records from a file. properties: file: description: The records file to upload. Currently only CSV is supported. The file must include an `input` column. Optional columns include `id`, `expected_output`, `metadata`, and `tags`. format: binary type: string type: object LLMObsDatasetRequest: description: Request to create an Agent Observability dataset. properties: data: $ref: "#/components/schemas/LLMObsDatasetDataRequest" required: - data type: object LLMObsDatasetResponse: description: Response containing a single Agent Observability dataset. properties: data: $ref: "#/components/schemas/LLMObsDatasetDataResponse" required: - data type: object LLMObsDatasetRestoreVersionDataAttributesRequest: description: Attributes for restoring an Agent Observability dataset to a previous version. properties: dataset_version: description: Version number of the dataset to restore. Must be between 0 and the current version of the dataset, inclusive. example: 1 format: int32 maximum: 2147483647 type: integer required: - dataset_version type: object LLMObsDatasetRestoreVersionDataRequest: description: Data object for restoring an Agent Observability dataset to a previous version. properties: attributes: $ref: "#/components/schemas/LLMObsDatasetRestoreVersionDataAttributesRequest" id: description: Unique identifier of the dataset to restore. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" type: string type: $ref: "#/components/schemas/LLMObsDatasetType" required: - id - type - attributes type: object LLMObsDatasetRestoreVersionRequest: description: Request to restore an Agent Observability dataset to a previous version. properties: data: $ref: "#/components/schemas/LLMObsDatasetRestoreVersionDataRequest" required: - data type: object LLMObsDatasetType: description: Resource type of an Agent Observability dataset. enum: - datasets example: datasets type: string x-enum-varnames: - DATASETS LLMObsDatasetUpdateDataAttributesRequest: description: Attributes for updating an Agent Observability dataset. properties: description: description: Updated description of the dataset. type: string metadata: additionalProperties: {} description: Updated metadata associated with the dataset. type: object name: description: Updated name of the dataset. type: string type: object LLMObsDatasetUpdateDataRequest: description: Data object for updating an Agent Observability dataset. properties: attributes: $ref: "#/components/schemas/LLMObsDatasetUpdateDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsDatasetType" required: - type - attributes type: object LLMObsDatasetUpdateRequest: description: Request to partially update an Agent Observability dataset. properties: data: $ref: "#/components/schemas/LLMObsDatasetUpdateDataRequest" required: - data type: object LLMObsDatasetVersionData: description: Data object for an Agent Observability dataset version. properties: attributes: $ref: "#/components/schemas/LLMObsDatasetVersionDataAttributes" id: description: Unique identifier of the dataset version. example: "3fd6b5e0-8910-4b1c-a7d0-5b84de329012" type: string type: $ref: "#/components/schemas/LLMObsDatasetVersionType" required: - id - type - attributes type: object LLMObsDatasetVersionDataAttributes: description: Attributes of an Agent Observability dataset version. properties: dataset_id: description: Unique identifier of the dataset this version belongs to. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" type: string last_used: description: Timestamp when this dataset version was last referenced. Null if the version has never been used. example: "2024-01-15T10:30:00Z" format: date-time nullable: true type: string version_number: description: Sequential version number for this dataset version. example: 1 format: int32 maximum: 2147483647 type: integer required: - dataset_id - version_number - last_used type: object LLMObsDatasetVersionType: description: Resource type of an Agent Observability dataset version. enum: - dataset_version example: dataset_version type: string x-enum-varnames: - DATASET_VERSION LLMObsDatasetVersionsResponse: description: Response containing the active versions of an Agent Observability dataset. properties: data: $ref: "#/components/schemas/LLMObsDatasetVersionsResponseData" required: - data type: object LLMObsDatasetVersionsResponseData: description: List of dataset versions. items: $ref: "#/components/schemas/LLMObsDatasetVersionData" type: array LLMObsDatasetsResponse: description: Response containing a list of Agent Observability datasets. properties: data: description: List of datasets. items: $ref: "#/components/schemas/LLMObsDatasetDataResponse" type: array meta: $ref: "#/components/schemas/LLMObsCursorMeta" required: - data type: object LLMObsDeleteAnnotationError: description: A partial error for a single annotation that could not be deleted. properties: annotation_id: description: ID of the annotation that could not be deleted. example: "00000000-0000-0000-0000-000000000000" type: string error: description: Error message. example: "annotation not found" type: string required: - annotation_id - error type: object LLMObsDeleteAnnotationQueueInteractionsDataAttributesRequest: description: Attributes for deleting interactions from an annotation queue. properties: interaction_ids: description: List of interaction IDs to delete. Must contain at least one item. example: - "00000000-0000-0000-0000-000000000000" - "00000000-0000-0000-0000-000000000001" items: description: An interaction ID to delete. type: string minItems: 1 type: array required: - interaction_ids type: object LLMObsDeleteAnnotationQueueInteractionsDataRequest: description: Data object for deleting interactions from an annotation queue. properties: attributes: $ref: "#/components/schemas/LLMObsDeleteAnnotationQueueInteractionsDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsAnnotationQueueInteractionsType" required: - type - attributes type: object LLMObsDeleteAnnotationQueueInteractionsRequest: description: Request to delete interactions from an Agent Observability annotation queue. properties: data: $ref: "#/components/schemas/LLMObsDeleteAnnotationQueueInteractionsDataRequest" required: - data type: object LLMObsDeleteAnnotationsDataAttributesRequest: description: Attributes for deleting annotations. properties: annotation_ids: description: IDs of the annotations to delete. Must contain at least one item. example: - "00000000-0000-0000-0000-000000000000" - "00000000-0000-0000-0000-000000000001" items: type: string minItems: 1 type: array required: - annotation_ids type: object LLMObsDeleteAnnotationsDataAttributesResponse: description: Attributes of the annotation deletion response. properties: annotation_ids: description: IDs of the successfully deleted annotations. example: - "00000000-0000-0000-0000-000000000000" items: type: string type: array errors: description: Errors for annotations that could not be deleted. items: $ref: "#/components/schemas/LLMObsDeleteAnnotationError" type: array required: - annotation_ids - errors type: object LLMObsDeleteAnnotationsDataRequest: description: Data object for deleting annotations. properties: attributes: $ref: "#/components/schemas/LLMObsDeleteAnnotationsDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsAnnotationsType" required: - type - attributes type: object LLMObsDeleteAnnotationsDataResponse: description: Data object for the annotation deletion response. properties: attributes: $ref: "#/components/schemas/LLMObsDeleteAnnotationsDataAttributesResponse" id: description: The annotation queue ID. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/LLMObsAnnotationsType" required: - id - type - attributes type: object LLMObsDeleteAnnotationsRequest: description: Request to delete annotations from an annotation queue. properties: data: $ref: "#/components/schemas/LLMObsDeleteAnnotationsDataRequest" required: - data type: object LLMObsDeleteAnnotationsResponse: description: |- Response for a batch annotation deletion. Partial errors are listed in the response if any annotations could not be deleted. properties: data: $ref: "#/components/schemas/LLMObsDeleteAnnotationsDataResponse" required: - data type: object LLMObsDeleteDatasetRecordsDataAttributesRequest: description: Attributes for deleting records from an Agent Observability dataset. properties: record_ids: description: List of record IDs to delete. example: - "rec-7c3f5a1b-9e2d-4f8a-b1c6-3d7e9f0a2b4c" items: description: A record ID to delete. type: string type: array required: - record_ids type: object LLMObsDeleteDatasetRecordsDataRequest: description: Data object for deleting records from an Agent Observability dataset. properties: attributes: $ref: "#/components/schemas/LLMObsDeleteDatasetRecordsDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsDatasetType" required: - type - attributes type: object LLMObsDeleteDatasetRecordsRequest: description: Request to delete records from an Agent Observability dataset. properties: data: $ref: "#/components/schemas/LLMObsDeleteDatasetRecordsDataRequest" required: - data type: object LLMObsDeleteDatasetsDataAttributesRequest: description: Attributes for deleting Agent Observability datasets. properties: dataset_ids: description: List of dataset IDs to delete. example: - "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" items: description: A dataset ID to delete. type: string type: array required: - dataset_ids type: object LLMObsDeleteDatasetsDataRequest: description: Data object for deleting Agent Observability datasets. properties: attributes: $ref: "#/components/schemas/LLMObsDeleteDatasetsDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsDatasetType" required: - type - attributes type: object LLMObsDeleteDatasetsRequest: description: Request to delete one or more Agent Observability datasets. properties: data: $ref: "#/components/schemas/LLMObsDeleteDatasetsDataRequest" required: - data type: object LLMObsDeleteExperimentsDataAttributesRequest: description: Attributes for deleting Agent Observability experiments. properties: experiment_ids: description: List of experiment IDs to delete. example: - "3fd6b5e0-8910-4b1c-a7d0-5b84de329012" items: description: An experiment ID to delete. type: string type: array required: - experiment_ids type: object LLMObsDeleteExperimentsDataRequest: description: Data object for deleting Agent Observability experiments. properties: attributes: $ref: "#/components/schemas/LLMObsDeleteExperimentsDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsExperimentType" required: - type - attributes type: object LLMObsDeleteExperimentsRequest: description: Request to delete one or more Agent Observability experiments. properties: data: $ref: "#/components/schemas/LLMObsDeleteExperimentsDataRequest" required: - data type: object LLMObsDeleteProjectsDataAttributesRequest: description: Attributes for deleting Agent Observability projects. properties: project_ids: description: List of project IDs to delete. example: - "a33671aa-24fd-4dcd-9b33-a8ec7dde7751" items: description: A project ID to delete. type: string type: array required: - project_ids type: object LLMObsDeleteProjectsDataRequest: description: Data object for deleting Agent Observability projects. properties: attributes: $ref: "#/components/schemas/LLMObsDeleteProjectsDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsProjectType" required: - type - attributes type: object LLMObsDeleteProjectsRequest: description: Request to delete one or more Agent Observability projects. properties: data: $ref: "#/components/schemas/LLMObsDeleteProjectsDataRequest" required: - data type: object LLMObsDeletedPromptData: description: Data object confirming that an Agent Observability prompt was deleted. properties: attributes: $ref: "#/components/schemas/LLMObsDeletedPromptDataAttributes" id: description: Unique identifier of the deleted prompt. example: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" type: string type: $ref: "#/components/schemas/LLMObsPromptType" required: - id - type - attributes type: object LLMObsDeletedPromptDataAttributes: description: Attributes confirming that an Agent Observability prompt was deleted. properties: deleted_at: description: Timestamp when the prompt was deleted. example: "2025-02-10T09:15:00Z" format: date-time type: string prompt_id: description: Customer-provided identifier of the deleted prompt. example: "customer-support-assistant" type: string required: - prompt_id - deleted_at type: object LLMObsDeletedPromptResponse: description: Response confirming that an Agent Observability prompt was deleted. example: data: attributes: deleted_at: "2025-02-10T09:15:00Z" prompt_id: "customer-support-assistant" id: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" type: prompt-templates properties: data: $ref: "#/components/schemas/LLMObsDeletedPromptData" required: - data type: object LLMObsDisplayBlockAnnotatedInteractionItem: description: A display_block interaction with its associated annotations. properties: annotations: description: List of annotations for this interaction. items: $ref: "#/components/schemas/LLMObsAnnotationItem" type: array can_annotate: description: Whether the current caller can annotate this interaction. example: true type: boolean content_id: description: Server-generated deterministic identifier derived from the block list. example: "9a87f3e2b1d4c5a6f8b3e2d1c4a7b5f6e3d2a1c4b7e5f8a3d6c2e1b4a7d5f8c2" type: string display_block: $ref: "#/components/schemas/LLMObsContentBlocks" id: description: Unique identifier of the interaction. example: "interaction-456" type: string type: $ref: "#/components/schemas/LLMObsDisplayBlockInteractionType" required: - id - type - content_id - can_annotate - annotations - display_block type: object LLMObsDisplayBlockInteractionItem: description: |- An interaction whose rendered content is supplied directly as a list of display blocks. The server generates `content_id` deterministically from the block list. properties: display_block: $ref: "#/components/schemas/LLMObsContentBlocks" type: $ref: "#/components/schemas/LLMObsDisplayBlockInteractionType" required: - type - display_block type: object LLMObsDisplayBlockInteractionResponseItem: description: A display_block interaction result. properties: already_existed: description: Whether this interaction already existed in the queue. example: false type: boolean content_id: description: Server-generated deterministic identifier derived from the block list. example: "9a87f3e2b1d4c5a6f8b3e2d1c4a7b5f6e3d2a1c4b7e5f8a3d6c2e1b4a7d5f8c2" type: string display_block: $ref: "#/components/schemas/LLMObsContentBlocks" id: description: Unique identifier of the interaction. example: "00000000-0000-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/LLMObsDisplayBlockInteractionType" required: - id - type - content_id - already_existed - display_block type: object LLMObsDisplayBlockInteractionType: description: Type discriminator for a `display_block` interaction. enum: - display_block example: display_block type: string x-enum-varnames: - DISPLAY_BLOCK LLMObsExperimentDataAttributesRequest: description: Attributes for creating an Agent Observability experiment. properties: config: additionalProperties: {} description: Configuration parameters for the experiment. type: object dataset_id: description: Identifier of the dataset used in this experiment. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" type: string dataset_version: description: Version of the dataset to use. Defaults to the current version if not specified. format: int64 type: integer description: description: Description of the experiment. type: string ensure_unique: description: Whether to ensure the experiment name is unique. Defaults to `true`. type: boolean metadata: additionalProperties: {} description: Arbitrary metadata associated with the experiment. type: object name: description: Name of the experiment. example: "My Experiment v1" type: string parent_experiment_id: description: Identifier of the parent (baseline) experiment this experiment is run against. example: "3fd6b5e0-8910-4b1c-a7d0-5b84de329012" type: string project_id: description: Identifier of the project this experiment belongs to. example: "a33671aa-24fd-4dcd-9b33-a8ec7dde7751" type: string run_count: description: Number of runs configured for this experiment. format: int32 maximum: 2147483647 type: integer required: - project_id - name type: object LLMObsExperimentDataAttributesResponse: description: Attributes of an Agent Observability experiment. properties: aggregate_data: additionalProperties: {} description: >- Pre-computed aggregate metrics for this experiment run, including eval score distributions, token costs, and error rates. nullable: true type: object author: $ref: "#/components/schemas/LLMObsExperimentUser" config: additionalProperties: {} description: Configuration parameters for the experiment. nullable: true type: object created_at: description: Timestamp when the experiment was created. example: "2024-01-15T10:30:00Z" format: date-time type: string dataset_id: description: Identifier of the dataset used in this experiment. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" type: string dataset_name: description: |- Name of the dataset used in this experiment. Only present when `include[dataset_names]` is `true`. nullable: true type: string dataset_version: description: Version of the dataset used in this experiment. format: int64 type: integer deleted_at: description: Timestamp when the experiment was soft-deleted, if applicable. format: date-time nullable: true type: string description: description: Description of the experiment. example: "" nullable: true type: string error: description: Error message describing why the experiment failed, if applicable. nullable: true type: string experiment: description: Logical name of the experiment, shared across all runs of the same pipeline. example: "my-pipeline" type: string metadata: additionalProperties: {} description: Arbitrary metadata associated with the experiment. nullable: true type: object name: description: Name of the experiment. example: "My Experiment v1" type: string parent_experiment_id: description: Identifier of the parent (baseline) experiment this experiment was run against, if any. example: "3fd6b5e0-8910-4b1c-a7d0-5b84de329012" nullable: true type: string project_id: description: Identifier of the project this experiment belongs to. example: "a33671aa-24fd-4dcd-9b33-a8ec7dde7751" type: string run_count: description: Expected number of runs for this experiment. format: int32 maximum: 2147483647 type: integer status: $ref: "#/components/schemas/LLMObsExperimentStatus" updated_at: description: Timestamp when the experiment was last updated. example: "2024-01-15T10:30:00Z" format: date-time type: string required: - project_id - dataset_id - name - description - metadata - config - created_at - updated_at type: object LLMObsExperimentDataRequest: description: Data object for creating an Agent Observability experiment. properties: attributes: $ref: "#/components/schemas/LLMObsExperimentDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsExperimentType" required: - type - attributes type: object LLMObsExperimentDataResponse: description: Data object for an Agent Observability experiment. properties: attributes: $ref: "#/components/schemas/LLMObsExperimentDataAttributesResponse" id: description: Unique identifier of the experiment. example: "3fd6b5e0-8910-4b1c-a7d0-5b84de329012" type: string type: $ref: "#/components/schemas/LLMObsExperimentType" required: - id - type - attributes type: object LLMObsExperimentEvalMetricEvent: description: An evaluation metric event associated with an experiment span. properties: assessment: $ref: "#/components/schemas/LLMObsMetricAssessment" boolean_value: description: Boolean value. Present when `metric_type` is `boolean`. nullable: true type: boolean categorical_value: description: Categorical value. Present when `metric_type` is `categorical`. nullable: true type: string eval_source_type: description: Source type of the evaluation. example: "managed" type: string id: description: Unique identifier of the evaluation metric event. example: "00000000-0000-0000-0000-000000000001" type: string json_value: additionalProperties: {} description: JSON value. Present when `metric_type` is `json`. nullable: true type: object label: description: Label or name for the metric. example: "faithfulness" type: string metadata: additionalProperties: {} description: Arbitrary metadata associated with the metric. nullable: true type: object metric_source: description: Source of the metric. Either `custom` (user-submitted) or `summary` (experiment-level aggregate). example: "custom" type: string metric_type: $ref: "#/components/schemas/LLMObsMetricScoreType" reasoning: description: Human-readable reasoning for the metric value. nullable: true type: string score_value: description: Numeric score. Present when `metric_type` is `score`. format: double nullable: true type: number span_id: description: Span ID this metric is associated with. example: "span-7a1b2c3d" type: string tags: description: Tags associated with the metric. items: type: string type: array timestamp_ms: description: Timestamp when the metric was recorded, in milliseconds since Unix epoch. example: 1705314600000 format: int64 type: integer trace_id: description: Trace ID linking this metric to a span. example: "abc123def456" type: string type: object LLMObsExperimentEventsDataAttributesRequest: description: Attributes for pushing experiment events including spans and metrics. properties: metrics: description: List of metrics to push for the experiment. items: $ref: "#/components/schemas/LLMObsExperimentMetric" type: array spans: description: List of spans to push for the experiment. items: $ref: "#/components/schemas/LLMObsExperimentSpan" type: array type: object LLMObsExperimentEventsDataRequest: description: Data object for pushing experiment events. properties: attributes: $ref: "#/components/schemas/LLMObsExperimentEventsDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsExperimentType" required: - type - attributes type: object LLMObsExperimentEventsRequest: description: Request to push spans and metrics for an Agent Observability experiment. properties: data: $ref: "#/components/schemas/LLMObsExperimentEventsDataRequest" required: - data type: object LLMObsExperimentEventsType: description: Resource type for an experiment events collection. enum: - experiment_events example: experiment_events type: string x-enum-varnames: - EXPERIMENT_EVENTS LLMObsExperimentEventsV2DataAttributesResponse: description: Attributes of an experiment events response. properties: spans: description: Experiment spans, each enriched with their associated evaluation metrics. items: $ref: "#/components/schemas/LLMObsExperimentSpanWithEvals" type: array summary_metrics: description: Experiment-level summary evaluation metrics (not tied to individual spans). items: $ref: "#/components/schemas/LLMObsExperimentEvalMetricEvent" type: array required: - spans - summary_metrics type: object LLMObsExperimentEventsV2DataResponse: description: JSON:API data object for an experiment events response. properties: attributes: $ref: "#/components/schemas/LLMObsExperimentEventsV2DataAttributesResponse" id: description: Identifier for this events resource. example: "3fd6b5e0-8910-4b1c-a7d0-5b84de329012" type: string type: $ref: "#/components/schemas/LLMObsExperimentEventsType" required: - id - type - attributes type: object LLMObsExperimentEventsV2Response: description: Response for listing experiment events (v2/v3). Returns spans and summary metrics in a single resource. properties: data: $ref: "#/components/schemas/LLMObsExperimentEventsV2DataResponse" meta: $ref: "#/components/schemas/LLMObsCursorMeta" required: - data type: object LLMObsExperimentMetric: description: A metric associated with an Agent Observability experiment span. properties: assessment: $ref: "#/components/schemas/LLMObsMetricAssessment" boolean_value: description: Boolean value. Used when `metric_type` is `boolean`. type: boolean categorical_value: description: Categorical value. Used when `metric_type` is `categorical`. type: string error: $ref: "#/components/schemas/LLMObsExperimentMetricError" json_value: additionalProperties: {} description: JSON value. Used when `metric_type` is `json`. type: object label: description: Label or name for the metric. example: "faithfulness" type: string metadata: additionalProperties: {} description: Arbitrary metadata associated with the metric. type: object metric_type: $ref: "#/components/schemas/LLMObsMetricScoreType" reasoning: description: Human-readable reasoning for the metric value. type: string score_value: description: Numeric score value. Used when `metric_type` is `score`. format: double type: number span_id: description: The ID of the span this metric measures. example: "span-7a1b2c3d" type: string tags: description: List of tags associated with the metric. items: description: A tag string in `key:value` format. type: string type: array timestamp_ms: description: Timestamp when the metric was recorded, in milliseconds since Unix epoch. example: 1705314600000 format: int64 type: integer required: - span_id - metric_type - timestamp_ms - label type: object LLMObsExperimentMetricError: description: Error details for an experiment metric evaluation. properties: message: description: Error message associated with the metric evaluation. type: string type: object LLMObsExperimentRequest: description: Request to create an Agent Observability experiment. properties: data: $ref: "#/components/schemas/LLMObsExperimentDataRequest" required: - data type: object LLMObsExperimentResponse: description: Response containing a single Agent Observability experiment. properties: data: $ref: "#/components/schemas/LLMObsExperimentDataResponse" required: - data type: object LLMObsExperimentRunDataResponse: description: Data object for an Agent Observability experiment run. properties: aggregate_data: additionalProperties: {} description: Aggregated metric data for this run. nullable: true type: object created_at: description: Timestamp when the run was created. example: "2024-01-15T10:30:00Z" format: date-time type: string experiment_id: description: Identifier of the experiment this run belongs to. example: "3fd6b5e0-8910-4b1c-a7d0-5b84de329012" type: string id: description: Unique identifier of the experiment run. example: "7a1b2c3d-4e5f-6789-abcd-ef0123456789" type: string run_number: description: Sequential number of this run within the experiment. example: 1 format: int32 maximum: 2147483647 type: integer type: object LLMObsExperimentSpan: description: A span associated with an Agent Observability experiment. properties: dataset_id: description: Dataset ID associated with this span. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" type: string duration: description: Duration of the span in nanoseconds. example: 1500000000 format: int64 type: integer meta: $ref: "#/components/schemas/LLMObsExperimentSpanMeta" name: description: Name of the span. example: "llm_call" type: string project_id: description: Project ID associated with this span. example: "a33671aa-24fd-4dcd-9b33-a8ec7dde7751" type: string span_id: description: Unique identifier of the span. example: "span-7a1b2c3d" type: string start_ns: description: Start time of the span in nanoseconds since Unix epoch. example: 1705314600000000000 format: int64 type: integer status: $ref: "#/components/schemas/LLMObsExperimentSpanStatus" tags: description: List of tags associated with the span. items: description: A tag string in `key:value` format. type: string type: array trace_id: description: Trace ID for the span. example: "abc123def456" type: string required: - trace_id - span_id - project_id - dataset_id - name - start_ns - duration - status type: object LLMObsExperimentSpanDataResponse: description: JSON:API data item wrapping a single experiment span with evaluations. properties: attributes: $ref: "#/components/schemas/LLMObsExperimentSpanWithEvals" id: description: Unique identifier of the span. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/LLMObsExperimentSpanType" required: - id - type - attributes type: object LLMObsExperimentSpanError: description: Error details for an experiment span. properties: message: description: Error message. example: "Model response timed out" type: string stack: description: Stack trace of the error. example: "Traceback (most recent call last):\n File \"main.py\", line 10, in \n response = model.generate(input)\n File \"model.py\", line 45, in generate\n raise TimeoutError(\"Model response timed out\")\nTimeoutError: Model response timed out" type: string type: description: The error type or exception class name. example: "TimeoutError" type: string type: object LLMObsExperimentSpanMeta: description: Metadata associated with an experiment span. properties: error: $ref: "#/components/schemas/LLMObsExperimentSpanError" expected_output: additionalProperties: {} description: Expected output for the span, used for evaluation. type: object input: $ref: "#/components/schemas/AnyValue" output: $ref: "#/components/schemas/AnyValue" type: object LLMObsExperimentSpanStatus: description: Status of the span. enum: - ok - error example: "ok" type: string x-enum-varnames: - OK - ERROR LLMObsExperimentSpanType: description: Resource type for a span item in an experiment spans response. enum: - experiments example: experiments type: string x-enum-varnames: - EXPERIMENTS_SPAN LLMObsExperimentSpanWithEvals: description: An experiment span enriched with its associated evaluation metrics. properties: dataset_record_id: description: ID of the dataset record this span evaluated. nullable: true type: string duration: description: Duration of the span in nanoseconds. example: 1500000000.0 format: double type: number eval_metrics: description: Evaluation metrics associated with this span. items: $ref: "#/components/schemas/LLMObsExperimentEvalMetricEvent" type: array id: description: Unique identifier of the span. example: "00000000-0000-0000-0000-000000000001" type: string meta: $ref: "#/components/schemas/LLMObsExperimentSpanMeta" metrics: additionalProperties: format: double type: number description: Numeric metrics attached to the span. type: object name: description: Name of the span. example: "llm_call" type: string parent_id: description: Parent span ID, if any. type: string span_id: description: Span ID. example: "span-7a1b2c3d" type: string start_ns: description: Start time in nanoseconds since Unix epoch. example: 1705314600000000000 format: int64 type: integer status: $ref: "#/components/schemas/LLMObsExperimentSpanStatus" tags: description: Tags associated with the span. items: type: string type: array trace_id: description: Trace ID. example: "abc123def456" type: string type: object LLMObsExperimentSpansResponse: description: >- Response for listing experiment spans (v1). Returns only spans with their evaluation metrics. No summary metrics or pagination are included. Deprecated in favor of `ListLLMObsExperimentEventsV3`. properties: data: description: List of experiment spans with their evaluation metrics. items: $ref: "#/components/schemas/LLMObsExperimentSpanDataResponse" type: array required: - data type: object LLMObsExperimentStatus: description: Execution status of an Agent Observability experiment. enum: - running - completed - failed - interrupted example: completed type: string x-enum-varnames: - RUNNING - COMPLETED - FAILED - INTERRUPTED LLMObsExperimentType: description: Resource type of an Agent Observability experiment. enum: - experiments example: experiments type: string x-enum-varnames: - EXPERIMENTS LLMObsExperimentUpdateDataAttributesRequest: description: Attributes for updating an Agent Observability experiment. properties: dataset_id: description: Updated identifier of the dataset used in this experiment. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" type: string description: description: Updated description of the experiment. type: string error: description: Error message describing why the experiment failed, if applicable. type: string metadata: additionalProperties: {} description: Updated arbitrary metadata associated with the experiment. type: object name: description: Updated name of the experiment. type: string status: $ref: "#/components/schemas/LLMObsExperimentStatus" type: object LLMObsExperimentUpdateDataRequest: description: Data object for updating an Agent Observability experiment. properties: attributes: $ref: "#/components/schemas/LLMObsExperimentUpdateDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsExperimentType" required: - type - attributes type: object LLMObsExperimentUpdateRequest: description: Request to partially update an Agent Observability experiment. properties: data: $ref: "#/components/schemas/LLMObsExperimentUpdateDataRequest" required: - data type: object LLMObsExperimentUser: description: User data for the author of an experiment. Only present when `include[user_data]` is `true`. properties: email: description: Email address of the user. example: "jane.doe@example.com" type: string handle: description: Username or handle associated with the user's Datadog account. example: "jane.doe@example.com" type: string icon: description: URL of the user's icon. example: "https://example.com/icon.png" type: string id: description: Unique identifier of the user. example: "00000000-0000-0000-0000-000000000010" type: string name: description: Display name of the user. example: "Jane Doe" type: string type: object LLMObsExperimentationAnalyticsAggregate: description: Analytics aggregation parameters. properties: compute: description: List of metric computations to perform. items: $ref: "#/components/schemas/LLMObsExperimentationAnalyticsCompute" minItems: 1 type: array dataset_version: description: Filter to a specific dataset version. format: int64 nullable: true type: integer group_by: description: Fields to group results by. items: $ref: "#/components/schemas/LLMObsExperimentationAnalyticsGroupBy" type: array indexes: description: Data indexes to query. At least one is required. example: - "experiment-evals" items: type: string minItems: 1 type: array limit: description: Maximum number of results to return. example: 1000 format: int32 maximum: 2147483647 nullable: true type: integer search: $ref: "#/components/schemas/LLMObsExperimentationAnalyticsSearch" time: $ref: "#/components/schemas/LLMObsExperimentationAnalyticsTimeRange" required: - compute - indexes - search type: object LLMObsExperimentationAnalyticsCompute: description: A single metric computation definition. properties: metric: description: Name of the metric to compute. example: "score_value" type: string name: description: Optional alias for this computation in the response. example: "avg_faithfulness" type: string required: - metric type: object LLMObsExperimentationAnalyticsDataAttributesRequest: description: Attributes for an analytics request. properties: aggregate: $ref: "#/components/schemas/LLMObsExperimentationAnalyticsAggregate" required: - aggregate type: object LLMObsExperimentationAnalyticsDataAttributesResponse: description: Attributes of an analytics response. properties: hit_count: description: Total number of events matched by the query before grouping. example: 1500 format: int64 type: integer result: $ref: "#/components/schemas/LLMObsExperimentationAnalyticsResult" required: - hit_count - result type: object LLMObsExperimentationAnalyticsDataRequest: description: Data object for an analytics request. properties: attributes: $ref: "#/components/schemas/LLMObsExperimentationAnalyticsDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsExperimentationType" required: - type - attributes type: object LLMObsExperimentationAnalyticsDataResponse: description: JSON:API data object for an analytics response. properties: attributes: $ref: "#/components/schemas/LLMObsExperimentationAnalyticsDataAttributesResponse" id: description: Server-generated identifier for this analytics result. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/LLMObsExperimentationType" required: - id - type - attributes type: object LLMObsExperimentationAnalyticsGroupBy: description: A field to group analytics results by. properties: field: description: Field name to group by. example: "span_id" type: string required: - field type: object LLMObsExperimentationAnalyticsRequest: description: Request to run an analytics aggregation over Agent Observability experimentation data. properties: data: $ref: "#/components/schemas/LLMObsExperimentationAnalyticsDataRequest" required: - data type: object LLMObsExperimentationAnalyticsResponse: description: Response to an analytics query. properties: data: $ref: "#/components/schemas/LLMObsExperimentationAnalyticsDataResponse" required: - data type: object LLMObsExperimentationAnalyticsResult: description: Analytics query result containing all buckets. properties: values: description: List of result buckets. items: $ref: "#/components/schemas/LLMObsExperimentationAnalyticsValue" type: array required: - values type: object LLMObsExperimentationAnalyticsSearch: description: Search query for filtering analytics data. properties: query: description: Filter expression. example: "@experiment_id:3fd6b5e0-8910-4b1c-a7d0-5b84de329012" type: string required: - query type: object LLMObsExperimentationAnalyticsTimeRange: description: Unix-millisecond time range for filtering analytics data. properties: from: description: Start of the time range in milliseconds since Unix epoch. example: 1705312200000 format: int64 type: integer to: description: End of the time range in milliseconds since Unix epoch. example: 1705315800000 format: int64 type: integer required: - from - to type: object LLMObsExperimentationAnalyticsValue: description: A single analytics result bucket. properties: by: additionalProperties: {} description: The group-by field values for this bucket. example: span_id: "span-7a1b2c3d" type: object metrics: additionalProperties: {} description: Computed metric values for this bucket. example: score_value: 0.85 type: object required: - metrics type: object LLMObsExperimentationContentPreview: description: Options to control content preview truncation. properties: limit: description: Maximum number of characters to include in content previews. example: 500 format: int64 type: integer type: object LLMObsExperimentationCursorPage: description: Cursor-based pagination parameters. properties: cursor: description: Opaque cursor returned from a previous response to fetch the next page. type: string limit: description: Maximum number of results per page. example: 100 format: int64 type: integer type: object LLMObsExperimentationFilter: description: Filter criteria for an experimentation search request. properties: include_deleted: default: false description: When `true`, include soft-deleted entities alongside active ones. type: boolean is_deleted: default: false description: When `true`, return only soft-deleted entities. type: boolean query: description: Free-text search query. example: "my experiment" type: string scope: description: >- Entity types to search. Valid values are `projects`, `datasets`, `dataset_records`, `experiments`, and `experiment_runs`. example: - "experiments" items: example: "experiments" type: string type: array version: description: Filter dataset records by a specific dataset version. format: int64 nullable: true type: integer required: - scope type: object LLMObsExperimentationInclude: description: Additional data to include in the response. properties: user_data: default: false description: When `true`, enrich results with author user data (name and email). type: boolean type: object LLMObsExperimentationNumberPage: description: Offset-based pagination parameters for simple search. properties: limit: description: Maximum number of results per page. example: 50 format: int32 maximum: 2147483647 type: integer number: description: Page number to retrieve (1-indexed). example: 1 format: int32 maximum: 2147483647 minimum: 1 type: integer type: object LLMObsExperimentationSearchDataAttributesRequest: description: Attributes for an experimentation search request. properties: content_preview: $ref: "#/components/schemas/LLMObsExperimentationContentPreview" filter: $ref: "#/components/schemas/LLMObsExperimentationFilter" include: $ref: "#/components/schemas/LLMObsExperimentationInclude" page: $ref: "#/components/schemas/LLMObsExperimentationCursorPage" required: - filter type: object LLMObsExperimentationSearchDataRequest: description: Data object for an experimentation search request. properties: attributes: $ref: "#/components/schemas/LLMObsExperimentationSearchDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsExperimentationType" required: - type - attributes type: object LLMObsExperimentationSearchDataResponse: description: JSON:API data object for an experimentation search response. properties: attributes: $ref: "#/components/schemas/LLMObsExperimentationSearchResults" id: description: Server-generated identifier for this search result. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/LLMObsExperimentationType" required: - id - type - attributes type: object LLMObsExperimentationSearchRequest: description: Request to search across Agent Observability experimentation entities using cursor-based pagination. properties: data: $ref: "#/components/schemas/LLMObsExperimentationSearchDataRequest" required: - data type: object LLMObsExperimentationSearchResponse: description: Response to a cursor-based experimentation search. Returns `200 OK` when all results fit in one page; `206 Partial Content` when a next-page cursor is available. properties: data: $ref: "#/components/schemas/LLMObsExperimentationSearchDataResponse" meta: $ref: "#/components/schemas/LLMObsCursorMeta" required: - data type: object LLMObsExperimentationSearchResults: description: The matching experimentation entities grouped by type. properties: dataset_records: description: Matching dataset records. Present when `dataset_records` is included in `filter.scope`. items: $ref: "#/components/schemas/LLMObsDatasetRecordDataResponse" nullable: true type: array datasets: description: Matching datasets. Present when `datasets` is included in `filter.scope`. items: $ref: "#/components/schemas/LLMObsDatasetDataResponse" nullable: true type: array experiment_runs: description: Matching experiment runs. Present when `experiment_runs` is included in `filter.scope`. items: $ref: "#/components/schemas/LLMObsExperimentRunDataResponse" nullable: true type: array experiments: description: Matching experiments. Present when `experiments` is included in `filter.scope`. items: $ref: "#/components/schemas/LLMObsExperimentDataAttributesResponse" nullable: true type: array projects: description: Matching projects. Present when `projects` is included in `filter.scope`. items: $ref: "#/components/schemas/LLMObsProjectDataResponse" nullable: true type: array type: object LLMObsExperimentationSimpleSearchDataAttributesRequest: description: Attributes for an experimentation simple search request. properties: content_preview: $ref: "#/components/schemas/LLMObsExperimentationContentPreview" filter: $ref: "#/components/schemas/LLMObsExperimentationFilter" include: $ref: "#/components/schemas/LLMObsExperimentationInclude" page: $ref: "#/components/schemas/LLMObsExperimentationNumberPage" sort: description: Sort order for results. items: $ref: "#/components/schemas/LLMObsExperimentationSortField" type: array required: - filter type: object LLMObsExperimentationSimpleSearchDataRequest: description: Data object for an experimentation simple search request. properties: attributes: $ref: "#/components/schemas/LLMObsExperimentationSimpleSearchDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsExperimentationType" required: - type - attributes type: object LLMObsExperimentationSimpleSearchDataResponse: description: JSON:API data object for a simple search response. properties: attributes: $ref: "#/components/schemas/LLMObsExperimentationSearchResults" id: description: Server-generated identifier for this search result. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/LLMObsExperimentationType" required: - id - type - attributes type: object LLMObsExperimentationSimpleSearchMeta: description: Pagination metadata for a simple search response. properties: page: $ref: "#/components/schemas/LLMObsExperimentationSimpleSearchMetaPage" type: object LLMObsExperimentationSimpleSearchMetaPage: description: Page metadata. properties: current: description: Current page number. example: 1 format: int32 maximum: 2147483647 type: integer limit: description: Page size used for this response. example: 50 format: int32 maximum: 2147483647 type: integer total_count: description: Total number of matching results (capped at the maximum search limit). example: 193 format: int32 maximum: 2147483647 type: integer total_pages: description: Total number of pages available. example: 4 format: int32 maximum: 2147483647 type: integer type: object LLMObsExperimentationSimpleSearchRequest: description: Request to search across Agent Observability experimentation entities using offset-based pagination. properties: data: $ref: "#/components/schemas/LLMObsExperimentationSimpleSearchDataRequest" required: - data type: object LLMObsExperimentationSimpleSearchResponse: description: Response to an offset-based experimentation simple search. properties: data: $ref: "#/components/schemas/LLMObsExperimentationSimpleSearchDataResponse" meta: $ref: "#/components/schemas/LLMObsExperimentationSimpleSearchMeta" required: - data type: object LLMObsExperimentationSortField: description: A field and direction to sort results by. properties: direction: $ref: "#/components/schemas/LLMObsExperimentationSortFieldDirection" field: description: The field name to sort on. example: "created_at" type: string required: - field type: object LLMObsExperimentationSortFieldDirection: description: Sort direction. enum: - asc - desc example: "desc" type: string x-enum-varnames: - ASC - DESC LLMObsExperimentationType: description: Resource type for experimentation search and analytics operations. enum: - experimentation example: experimentation type: string x-enum-varnames: - EXPERIMENTATION LLMObsExperimentsResponse: description: Response containing a list of Agent Observability experiments. properties: data: description: List of experiments. items: $ref: "#/components/schemas/LLMObsExperimentDataResponse" type: array meta: $ref: "#/components/schemas/LLMObsCursorMeta" required: - data type: object LLMObsFrontendContentBlockCode: description: HTML code rendered by a `frontend` block. Required for `frontend` blocks. example: '
Ready for review
' minLength: 1 type: string LLMObsInferenceCode: description: A generated code snippet for running an inference request programmatically. properties: code: description: The generated code content. example: "import openai\nclient = openai.OpenAI()\n..." type: string id: description: Unique identifier for the code snippet. example: "code-python-001" type: string type: description: The programming language or SDK type of the code snippet. example: "python" type: string required: - id - type - code type: object LLMObsInferenceContent: description: A structured content block within a message. properties: type: description: The content block type. example: "text" type: string value: $ref: "#/components/schemas/LLMObsInferenceContentValue" required: - type - value type: object LLMObsInferenceContentList: description: List of structured content blocks in a message. items: $ref: "#/components/schemas/LLMObsInferenceContent" type: array LLMObsInferenceContentValue: description: The typed value of a message content block. properties: text: description: Plain text content. example: "Hello, how can I help you?" type: string tool_call: $ref: "#/components/schemas/LLMObsInferenceToolCall" tool_call_result: $ref: "#/components/schemas/LLMObsInferenceToolResult" type: object LLMObsInferenceErrorResponse: description: Error details returned when an inference provider returns an error. properties: message: description: A human-readable description of the error. example: "The model does not exist." type: string type: description: The provider-specific error type. example: "invalid_request_error" type: string required: - type - message type: object LLMObsInferenceFunction: description: A function definition for a tool available to the model. properties: description: description: A description of what the function does. example: "Get the current weather for a location." type: string name: description: The name of the function. example: "get_weather" type: string parameters: additionalProperties: {} description: JSON schema describing the function parameters. example: properties: location: type: string type: object type: object required: - name - parameters type: object LLMObsInferenceMessage: description: A single message in an LLM inference conversation. properties: content: description: Plain text content of the message. example: "What is the capital of France?" type: string contents: $ref: "#/components/schemas/LLMObsInferenceContentList" id: description: Unique identifier for the message. example: "msg_001" type: string role: description: The role of the message author. example: "user" type: string tool_calls: $ref: "#/components/schemas/LLMObsInferenceToolCallsList" tool_results: $ref: "#/components/schemas/LLMObsInferenceToolResultsList" type: object LLMObsInferenceMessagesList: description: List of messages in an inference conversation. items: $ref: "#/components/schemas/LLMObsInferenceMessage" type: array LLMObsInferenceRunResult: description: The output of a completed LLM inference call. properties: assessment: description: An optional assessment of the inference output quality. example: "pass" nullable: true type: string content: description: The text content of the model response. example: "The capital of France is Paris." type: string finish_reason: description: The reason the model stopped generating tokens. example: "stop" type: string inference_codes: $ref: "#/components/schemas/LLMObsIntegrationInferenceCodesResponse" input_tokens: description: Number of input tokens consumed. example: 15 format: int64 type: integer internal_reasoning: $ref: "#/components/schemas/LLMObsInternalReasoning" nullable: true latency: description: Request latency in milliseconds. example: 843 format: int64 type: integer output_tokens: description: Number of output tokens generated. example: 10 format: int64 type: integer tools: $ref: "#/components/schemas/LLMObsInferenceToolsList" total_tokens: description: Total tokens used (input plus output). example: 25 format: int64 type: integer required: - content - input_tokens - output_tokens - total_tokens - latency - finish_reason - inference_codes - tools - assessment type: object LLMObsInferenceTool: description: A tool definition available to the model during inference. properties: function: $ref: "#/components/schemas/LLMObsInferenceFunction" type: description: The type of tool. example: "function" type: string required: - type - function type: object LLMObsInferenceToolCall: description: A tool call made during LLM inference. properties: arguments: additionalProperties: {} description: The arguments passed to the tool. example: location: "San Francisco" type: object name: description: The name of the tool being called. example: "get_weather" type: string tool_id: description: Unique identifier for the tool call. example: "call_abc123" type: string type: description: The type of tool call. example: "function" type: string type: object LLMObsInferenceToolCallsList: description: List of tool calls in a message. items: $ref: "#/components/schemas/LLMObsInferenceToolCall" type: array LLMObsInferenceToolResult: description: The result returned by a tool call during LLM inference. properties: name: description: The name of the tool that produced this result. example: "get_weather" type: string result: description: The result content returned by the tool. example: "The weather in San Francisco is 68°F and sunny." type: string tool_id: description: Identifier matching the corresponding tool call. example: "call_abc123" type: string type: description: The type of tool result. example: "function" type: string type: object LLMObsInferenceToolResultsList: description: List of tool results in a message. items: $ref: "#/components/schemas/LLMObsInferenceToolResult" type: array LLMObsInferenceToolsList: description: List of tools available to the model. items: $ref: "#/components/schemas/LLMObsInferenceTool" type: array LLMObsIntegrationAccount: description: A configured account for an LLM provider integration. properties: account_id: description: Provider-specific account identifier. example: "org-XYZ123" type: string account_name: description: Human-readable name for the integration account. example: "Production OpenAI" type: string account_region: description: Provider region associated with the account, if applicable. example: "us-east-1" type: string azure_openai_metadata: $ref: "#/components/schemas/LLMObsAzureOpenAIMetadata" id: description: Unique identifier for the integration account. example: "account-abc123" type: string integration: description: The name of the LLM provider integration. example: openai type: string vertex_ai_metadata: $ref: "#/components/schemas/LLMObsVertexAIMetadata" required: - id - account_id - account_name - integration type: object LLMObsIntegrationInferenceCodesResponse: description: List of generated code snippets for the inference configuration. items: $ref: "#/components/schemas/LLMObsInferenceCode" type: array LLMObsIntegrationInferenceRequest: description: Parameters for an LLM inference request. properties: anthropic_metadata: $ref: "#/components/schemas/LLMObsAnthropicMetadata" nullable: true azure_openai_metadata: $ref: "#/components/schemas/LLMObsAzureOpenAIMetadata" nullable: true bedrock_metadata: $ref: "#/components/schemas/LLMObsBedrockMetadata" nullable: true frequency_penalty: description: Penalty for token frequency to reduce repetition. example: 0.0 format: double nullable: true type: number json_schema: description: JSON schema for structured output, if supported by the model. example: '{"type":"object","properties":{"answer":{"type":"string"}}}' nullable: true type: string max_completion_tokens: description: Maximum number of completion tokens to generate (alternative to max_tokens for some providers). example: 1024 format: int64 nullable: true type: integer max_tokens: description: Maximum number of tokens to generate. example: 1024 format: int64 nullable: true type: integer messages: $ref: "#/components/schemas/LLMObsInferenceMessagesList" model_id: description: The model identifier to use for inference. example: "gpt-4o" type: string openai_metadata: $ref: "#/components/schemas/LLMObsOpenAIMetadata" nullable: true presence_penalty: description: Penalty for token presence to encourage topic diversity. example: 0.0 format: double nullable: true type: number temperature: description: Sampling temperature between 0 and 2. Higher values produce more random output. example: 0.7 format: double nullable: true type: number tools: $ref: "#/components/schemas/LLMObsInferenceToolsList" top_k: description: Top-K sampling parameter. example: 50 format: int64 nullable: true type: integer top_p: description: Nucleus sampling probability mass. example: 1.0 format: double nullable: true type: number vertex_ai_metadata: $ref: "#/components/schemas/LLMObsVertexAIMetadata" nullable: true required: - model_id - messages type: object LLMObsIntegrationInferenceResponse: description: The result of an LLM inference request, including input parameters and the model response. properties: anthropic_metadata: $ref: "#/components/schemas/LLMObsAnthropicMetadata" nullable: true azure_openai_metadata: $ref: "#/components/schemas/LLMObsAzureOpenAIMetadata" nullable: true bedrock_metadata: $ref: "#/components/schemas/LLMObsBedrockMetadata" nullable: true error_response: $ref: "#/components/schemas/LLMObsInferenceErrorResponse" frequency_penalty: description: Frequency penalty that was applied. example: 0.0 format: double nullable: true type: number json_schema: description: JSON schema that was applied for structured output. example: '{"type":"object","properties":{"answer":{"type":"string"}}}' nullable: true type: string max_completion_tokens: description: Maximum number of completion tokens that were configured. example: 1024 format: int64 nullable: true type: integer max_tokens: description: Maximum number of tokens that were configured. example: 1024 format: int64 nullable: true type: integer messages: $ref: "#/components/schemas/LLMObsInferenceMessagesList" model_id: description: The model identifier used for inference. example: "gpt-4o" type: string openai_metadata: $ref: "#/components/schemas/LLMObsOpenAIMetadata" nullable: true presence_penalty: description: Presence penalty that was applied. example: 0.0 format: double nullable: true type: number response: $ref: "#/components/schemas/LLMObsInferenceRunResult" temperature: description: Sampling temperature that was used. example: 0.7 format: double nullable: true type: number tools: $ref: "#/components/schemas/LLMObsInferenceToolsList" top_k: description: Top-K sampling parameter that was used. example: 50 format: int64 nullable: true type: integer top_p: description: Nucleus sampling parameter that was used. example: 1.0 format: double nullable: true type: number vertex_ai_metadata: $ref: "#/components/schemas/LLMObsVertexAIMetadata" nullable: true required: - model_id - messages - response type: object LLMObsIntegrationModel: description: A model available for a given LLM provider integration and account. properties: has_access: description: Whether the account has access to this model. example: true type: boolean id: description: Unique identifier for the model entry. example: "gpt-4o" type: string integration: description: The name of the LLM provider integration. example: "openai" type: string integration_display_name: description: Human-readable name of the LLM provider integration. example: "OpenAI" type: string json_schema: description: Whether the model supports structured output via JSON schema. example: true type: boolean model_display_name: description: Human-readable model name. example: "GPT-4o" type: string model_id: description: Provider-specific model identifier used in inference calls. example: "gpt-4o" type: string provider: description: The underlying model provider. example: "openai" type: string provider_display_name: description: Human-readable name of the underlying model provider. example: "OpenAI" type: string region_prefix_overrides: $ref: "#/components/schemas/LLMObsIntegrationModelRegionPrefixOverrides" required: - id - model_id - model_display_name - integration - integration_display_name - provider - provider_display_name - json_schema - has_access type: object LLMObsIntegrationModelRegionPrefixOverrides: additionalProperties: type: string description: Map of region-specific model ID prefix overrides. example: us-east-1: "us." type: object LLMObsIntegrationName: description: The name of a supported LLM provider integration. enum: - openai - amazon_bedrock - anthropic - azure_openai - vertex_ai - llmproxy example: openai type: string x-enum-varnames: - OPENAI - AMAZON_BEDROCK - ANTHROPIC - AZURE_OPENAI - VERTEX_AI - LLMPROXY LLMObsInternalReasoning: description: The model's internal reasoning or thinking output, if available. properties: reasoning_tokens: description: Number of tokens used for internal reasoning. example: 256 format: int64 nullable: true type: integer text: description: The reasoning text produced by the model. example: "Let me think about this step by step..." type: string required: - text type: object LLMObsLabelSchema: description: Schema definition for a single label in an annotation queue. properties: description: description: Description of the label. example: "Rating of the response quality." type: string has_assessment: description: Whether this label includes an assessment field. example: false type: boolean has_reasoning: description: Whether this label includes a reasoning field. example: false type: boolean id: description: Unique identifier of the label schema. Assigned by the server if not provided. example: "abc-123" type: string is_assessment: description: Whether the boolean label represents an assessment. Requires `has_assessment` to be true. example: false type: boolean is_integer: description: Whether score values must be integers. Applicable to score-type labels. example: false type: boolean is_required: description: Whether this label is required for an annotation. example: true type: boolean max: description: Maximum value for score-type labels. example: 5.0 format: double type: number min: description: Minimum value for score-type labels. example: 0.0 format: double type: number name: description: Name of the label. Must match the pattern `^[a-zA-Z0-9_-]+$` and be unique within the queue. example: "quality" type: string type: $ref: "#/components/schemas/LLMObsLabelSchemaType" values: description: Allowed values for categorical-type labels. Must contain at least one non-empty, unique value. example: - "good" - "bad" - "neutral" items: description: An allowed value for a categorical label. type: string type: array required: - name - type type: object LLMObsLabelSchemaType: description: Type of a label in an annotation queue label schema. enum: - score - categorical - boolean - text example: score type: string x-enum-varnames: - SCORE - CATEGORICAL - BOOLEAN - TEXT LLMObsMetricAssessment: description: Assessment result for an Agent Observability experiment metric. enum: - pass - fail example: pass type: string x-enum-varnames: - PASS - FAIL LLMObsMetricScoreType: description: Type of metric recorded for an Agent Observability experiment. enum: - score - categorical - boolean - json example: score type: string x-enum-varnames: - SCORE - CATEGORICAL - BOOLEAN - JSON LLMObsOpenAIMetadata: description: OpenAI-specific metadata for an inference request. properties: reasoning_effort: $ref: "#/components/schemas/LLMObsOpenAIReasoningEffort" reasoning_summary: $ref: "#/components/schemas/LLMObsOpenAIReasoningSummary" type: object LLMObsOpenAIReasoningEffort: description: The reasoning effort level for OpenAI models that support it. enum: - none - low - medium - high - xhigh example: medium nullable: true type: string x-enum-varnames: - NONE - LOW - MEDIUM - HIGH - XHIGH LLMObsOpenAIReasoningSummary: description: The verbosity of the reasoning summary. enum: - auto - concise - detailed example: auto nullable: true type: string x-enum-varnames: - AUTO - CONCISE - DETAILED LLMObsPatternsActivityProgress: description: Progress information for a single step of a patterns run. properties: name: description: Name of the step. example: generate_topics type: string started_at: description: Timestamp when the step started. Null if the step has not started. example: "2024-01-15T10:30:00Z" format: date-time nullable: true type: string status: description: Status of the step. example: completed type: string required: - name - status type: object LLMObsPatternsClusteredPoint: description: A single data point grouped into a topic. properties: event_id: description: Identifier of the source event. example: "AAAAAYabc123" type: string id: description: Unique identifier of the clustered point. example: "9b0c1d2e-3f40-5a61-b728-c9d0e1f2a3b4" type: string input: description: Input text of the source span. example: "How do I get a refund?" type: string is_included: description: Whether the point is included in the patterns dataset. example: false type: boolean is_suggested: description: Whether the point is suggested for inclusion in the patterns dataset. example: true type: boolean session_id: description: Identifier of the source session. example: "session-7c3f5a1b" type: string span_id: description: Identifier of the source span. example: "1234567890123456789" type: string topic_id: description: Identifier of the topic the point belongs to. example: "5c1fae90-2b6d-4e3a-9f12-7a0c4d8e6b21" type: string required: - id - event_id - topic_id - span_id - session_id - input - is_suggested - is_included type: object LLMObsPatternsClusteredPointRef: description: |- A clustered point attached inline to a topic. The metric fields are populated only when the request includes `include_metrics=true`. properties: duration: description: Duration of the source span in nanoseconds. Included only when metrics are requested. example: 1500000 format: double type: number estimated_total_cost: description: Estimated total cost of the source span. Included only when metrics are requested. example: 0.0021 format: double type: number evaluation: additionalProperties: {} description: |- Evaluation results for the source span keyed by evaluation name. Included only when metrics are requested. type: object input_tokens: description: Number of input tokens of the source span. Included only when metrics are requested. example: 128 format: double type: number output_tokens: description: Number of output tokens of the source span. Included only when metrics are requested. example: 64 format: double type: number span_id: description: Identifier of the source span. example: "1234567890123456789" type: string status: description: Status of the source span. Included only when metrics are requested. example: ok type: string total_tokens: description: Total number of tokens of the source span. Included only when metrics are requested. example: 192 format: double type: number required: - span_id type: object LLMObsPatternsClusteredPointRefsList: description: List of clustered points attached to a topic. items: $ref: "#/components/schemas/LLMObsPatternsClusteredPointRef" type: array LLMObsPatternsClusteredPointsList: description: List of clustered points. items: $ref: "#/components/schemas/LLMObsPatternsClusteredPoint" type: array LLMObsPatternsClusteredPointsResponse: description: Response containing the clustered points of an Agent Observability topic. properties: data: $ref: "#/components/schemas/LLMObsPatternsClusteredPointsResponseData" required: - data type: object LLMObsPatternsClusteredPointsResponseAttributes: description: Attributes of an Agent Observability patterns clustered points response. properties: next_page_token: description: Pagination token for the next page of points. Null if there are no more pages. example: "eyJvZmZzZXQiOjUwfQ==" nullable: true type: string points: $ref: "#/components/schemas/LLMObsPatternsClusteredPointsList" topic_id: description: Identifier of the topic the points belong to. example: "5c1fae90-2b6d-4e3a-9f12-7a0c4d8e6b21" type: string required: - topic_id - next_page_token - points type: object LLMObsPatternsClusteredPointsResponseData: description: Data object of an Agent Observability patterns clustered points response. properties: attributes: $ref: "#/components/schemas/LLMObsPatternsClusteredPointsResponseAttributes" id: description: Identifier of the topic the points belong to. example: "5c1fae90-2b6d-4e3a-9f12-7a0c4d8e6b21" type: string type: $ref: "#/components/schemas/LLMObsPatternsClusteredPointsType" required: - id - type - attributes type: object LLMObsPatternsClusteredPointsType: description: Resource type of an Agent Observability patterns clustered points response. enum: - clustered_points_response example: clustered_points_response type: string x-enum-varnames: - CLUSTERED_POINTS_RESPONSE LLMObsPatternsConfigAttributes: description: Attributes of an Agent Observability patterns configuration. properties: account_id: description: Integration account ID for a bring-your-own-model configuration. example: "1000000001" nullable: true type: string created_at: description: Timestamp when the configuration was created. example: "2024-01-15T10:30:00Z" format: date-time type: string evp_query: description: Query that selects the spans the patterns run analyzes. example: "@ml_app:support-bot" type: string hierarchy_depth: description: Depth of the topic hierarchy to generate. example: 2 format: int32 maximum: 2147483647 type: integer integration_provider: description: Integration provider for a bring-your-own-model configuration. example: openai nullable: true type: string model_name: description: Model name for a bring-your-own-model configuration. example: gpt-4o nullable: true type: string name: description: Name of the configuration. example: "Support chatbot topics" type: string num_records: description: Maximum number of records to process for the run. example: 1000 format: int32 maximum: 2147483647 type: integer sampling_ratio: description: Fraction of matching spans to sample for the run. example: 0.1 format: double type: number scope: description: Scope of the configuration. example: "" type: string template: description: Template used to guide topic generation. example: "" nullable: true type: string updated_at: description: Timestamp when the configuration was last updated. example: "2024-01-15T10:30:00Z" format: date-time type: string required: - name - evp_query - sampling_ratio - num_records - hierarchy_depth - scope - created_at - updated_at type: object LLMObsPatternsConfigItem: description: A single Agent Observability patterns configuration in a list response. properties: account_id: description: Integration account ID for a bring-your-own-model configuration. example: "1000000001" nullable: true type: string created_at: description: Timestamp when the configuration was created. example: "2024-01-15T10:30:00Z" format: date-time type: string evp_query: description: Query that selects the spans the patterns run analyzes. example: "@ml_app:support-bot" type: string hierarchy_depth: description: Depth of the topic hierarchy to generate. example: 2 format: int32 maximum: 2147483647 type: integer id: description: Unique identifier of the configuration. example: "a7c8d9e0-1234-5678-9abc-def012345678" type: string integration_provider: description: Integration provider for a bring-your-own-model configuration. example: openai nullable: true type: string model_name: description: Model name for a bring-your-own-model configuration. example: gpt-4o nullable: true type: string name: description: Name of the configuration. example: "Support chatbot topics" type: string num_records: description: Maximum number of records to process for the run. example: 1000 format: int32 maximum: 2147483647 type: integer sampling_ratio: description: Fraction of matching spans to sample for the run. example: 0.1 format: double type: number scope: description: Scope of the configuration. example: "" type: string template: description: Template used to guide topic generation. example: "" nullable: true type: string updated_at: description: Timestamp when the configuration was last updated. example: "2024-01-15T10:30:00Z" format: date-time type: string required: - id - name - evp_query - sampling_ratio - num_records - hierarchy_depth - scope - created_at - updated_at type: object LLMObsPatternsConfigItemsList: description: List of patterns configurations. items: $ref: "#/components/schemas/LLMObsPatternsConfigItem" type: array LLMObsPatternsConfigResponse: description: Response containing a single Agent Observability patterns configuration. properties: data: $ref: "#/components/schemas/LLMObsPatternsConfigResponseData" required: - data type: object LLMObsPatternsConfigResponseData: description: Data object of an Agent Observability patterns configuration. properties: attributes: $ref: "#/components/schemas/LLMObsPatternsConfigAttributes" id: description: Unique identifier of the configuration. example: "a7c8d9e0-1234-5678-9abc-def012345678" type: string type: $ref: "#/components/schemas/LLMObsPatternsConfigType" required: - id - type - attributes type: object LLMObsPatternsConfigSnapshot: description: Snapshot of the configuration used for a patterns run. properties: account_id: description: Integration account ID used for a bring-your-own-model run. example: "1000000001" type: string evp_query: description: Query that selected the spans for the run. example: "@ml_app:support-bot" type: string hierarchy_depth: description: Depth of the topic hierarchy generated. example: 2 format: int32 maximum: 2147483647 type: integer integration_provider: description: Integration provider used for a bring-your-own-model run. example: openai type: string model_name: description: Model name used for a bring-your-own-model run. example: gpt-4o type: string num_records: description: Maximum number of records processed for the run. example: 1000 format: int32 maximum: 2147483647 type: integer sampling_ratio: description: Fraction of matching spans sampled for the run. example: 0.1 format: double type: number type: object LLMObsPatternsConfigType: description: Resource type of an Agent Observability patterns configuration. enum: - topic_discovery_configs example: topic_discovery_configs type: string x-enum-varnames: - TOPIC_DISCOVERY_CONFIGS LLMObsPatternsConfigUpsertRequest: description: Request to create or update an Agent Observability patterns configuration. properties: data: $ref: "#/components/schemas/LLMObsPatternsConfigUpsertRequestData" required: - data type: object LLMObsPatternsConfigUpsertRequestAttributes: description: Attributes for creating or updating an Agent Observability patterns configuration. properties: account_id: description: Integration account ID for a bring-your-own-model configuration. example: "1000000001" type: string config_id: description: The ID of an existing configuration to update. If omitted, a new configuration is created. example: "a7c8d9e0-1234-5678-9abc-def012345678" type: string evp_query: description: Query that selects the spans the patterns run analyzes. example: "@ml_app:support-bot" type: string hierarchy_depth: description: Depth of the topic hierarchy to generate. example: 2 format: int32 maximum: 2147483647 type: integer integration_provider: description: Integration provider for a bring-your-own-model configuration. example: openai type: string model_name: description: Model name for a bring-your-own-model configuration. example: gpt-4o type: string name: description: Name of the configuration. example: "Support chatbot topics" type: string num_records: description: Maximum number of records to process for the run. example: 1000 format: int32 maximum: 2147483647 type: integer sampling_ratio: description: Fraction of matching spans to sample for the run. example: 0.1 format: double type: number scope: description: Scope of the configuration. example: "" type: string template: description: Template used to guide topic generation. example: "" type: string required: - name - evp_query - sampling_ratio - num_records - hierarchy_depth type: object LLMObsPatternsConfigUpsertRequestData: description: Data object for creating or updating an Agent Observability patterns configuration. properties: attributes: $ref: "#/components/schemas/LLMObsPatternsConfigUpsertRequestAttributes" type: $ref: "#/components/schemas/LLMObsPatternsConfigType" required: - type - attributes type: object LLMObsPatternsConfigsListType: description: Resource type of a list of Agent Observability patterns configurations. enum: - list_topic_discovery_configs_response example: list_topic_discovery_configs_response type: string x-enum-varnames: - LIST_TOPIC_DISCOVERY_CONFIGS_RESPONSE LLMObsPatternsConfigsResponse: description: Response containing a list of Agent Observability patterns configurations. properties: data: $ref: "#/components/schemas/LLMObsPatternsConfigsResponseData" required: - data type: object LLMObsPatternsConfigsResponseAttributes: description: Attributes of a list of Agent Observability patterns configurations. properties: configs: $ref: "#/components/schemas/LLMObsPatternsConfigItemsList" required: - configs type: object LLMObsPatternsConfigsResponseData: description: Data object of a list of Agent Observability patterns configurations. properties: attributes: $ref: "#/components/schemas/LLMObsPatternsConfigsResponseAttributes" id: description: Identifier of the list response. example: "1000000001" type: string type: $ref: "#/components/schemas/LLMObsPatternsConfigsListType" required: - id - type - attributes type: object LLMObsPatternsProgressList: description: List of step-by-step progress entries for a patterns run. items: $ref: "#/components/schemas/LLMObsPatternsActivityProgress" type: array LLMObsPatternsRequestType: description: Resource type for triggering an Agent Observability patterns run. enum: - topic_discovery example: topic_discovery type: string x-enum-varnames: - TOPIC_DISCOVERY LLMObsPatternsRunStatusResponse: description: Response containing the status of an Agent Observability patterns run. properties: data: $ref: "#/components/schemas/LLMObsPatternsRunStatusResponseData" required: - data type: object LLMObsPatternsRunStatusResponseAttributes: description: Attributes of an Agent Observability patterns run status. properties: created_at: description: Timestamp when the run was created. example: "2024-01-15T10:30:00Z" format: date-time type: string progress: $ref: "#/components/schemas/LLMObsPatternsProgressList" status: description: Overall status of the run. example: running type: string step: description: The current step of the run. example: generate_topics type: string required: - created_at - status - step - progress type: object LLMObsPatternsRunStatusResponseData: description: Data object of an Agent Observability patterns run status response. properties: attributes: $ref: "#/components/schemas/LLMObsPatternsRunStatusResponseAttributes" id: description: The ID of the patterns run. example: "3fd6b5e0-8910-4b1c-a7d0-5b84de329012" type: string type: $ref: "#/components/schemas/LLMObsPatternsRunStatusType" required: - id - type - attributes type: object LLMObsPatternsRunStatusType: description: Resource type of an Agent Observability patterns run status. enum: - topic_discovery_run_status example: topic_discovery_run_status type: string x-enum-varnames: - TOPIC_DISCOVERY_RUN_STATUS LLMObsPatternsRunSummary: description: Summary of an Agent Observability patterns run. properties: completed_at: description: Timestamp when the run completed. Null if the run has not completed. example: "2024-01-15T10:45:00Z" format: date-time nullable: true type: string config_snapshot: $ref: "#/components/schemas/LLMObsPatternsConfigSnapshot" created_at: description: Timestamp when the run was created. example: "2024-01-15T10:30:00Z" format: date-time type: string id: description: Unique identifier of the run. example: "3fd6b5e0-8910-4b1c-a7d0-5b84de329012" type: string status: description: Status of the run. example: completed type: string required: - id - status - created_at type: object LLMObsPatternsRunsList: description: List of patterns runs. items: $ref: "#/components/schemas/LLMObsPatternsRunSummary" type: array LLMObsPatternsRunsListType: description: Resource type of a list of Agent Observability patterns runs. enum: - list_topic_discovery_runs_response example: list_topic_discovery_runs_response type: string x-enum-varnames: - LIST_TOPIC_DISCOVERY_RUNS_RESPONSE LLMObsPatternsRunsResponse: description: Response containing the completed runs of an Agent Observability patterns configuration. properties: data: $ref: "#/components/schemas/LLMObsPatternsRunsResponseData" required: - data type: object LLMObsPatternsRunsResponseAttributes: description: Attributes of an Agent Observability patterns runs response. properties: runs: $ref: "#/components/schemas/LLMObsPatternsRunsList" required: - runs type: object LLMObsPatternsRunsResponseData: description: Data object of an Agent Observability patterns runs response. properties: attributes: $ref: "#/components/schemas/LLMObsPatternsRunsResponseAttributes" id: description: Identifier of the configuration the runs belong to. example: "a7c8d9e0-1234-5678-9abc-def012345678" type: string type: $ref: "#/components/schemas/LLMObsPatternsRunsListType" required: - id - type - attributes type: object LLMObsPatternsTemplateItem: description: A single Agent Observability patterns template in a list response. properties: clustering_instructions: description: Instructions guiding how topics are clustered for configurations linked to this template. example: "Group topics by user intent." type: string created_at: description: Timestamp when the template was created. example: "2024-01-15T10:30:00Z" format: date-time type: string description: description: Human-readable description of what the template is for. example: "A general-purpose starting point for topic discovery." type: string evp_query_prefix: description: Prefix merged into the query that selects spans for configurations linked to this template. example: "" type: string id: description: Unique identifier of the template. example: "a7c8d9e0-1234-5678-9abc-def012345678" type: string name: description: Name of the template. example: "General" type: string scope: description: Scope the template applies to. example: "span" type: string template: description: Template used to guide topic generation for configurations linked to this template. example: "{{span_input}}" type: string time_frame_duration_ms: description: Default lookback window, in milliseconds, for configurations linked to this template. example: 604800000 format: int64 type: integer required: - id - name - description - scope - clustering_instructions - template - evp_query_prefix - time_frame_duration_ms - created_at type: object LLMObsPatternsTemplateItemsList: description: List of patterns templates. items: $ref: "#/components/schemas/LLMObsPatternsTemplateItem" type: array LLMObsPatternsTemplatesListType: description: Resource type of a list of Agent Observability patterns templates. enum: - list_topic_discovery_templates_response example: list_topic_discovery_templates_response type: string x-enum-varnames: - LIST_TOPIC_DISCOVERY_TEMPLATES_RESPONSE LLMObsPatternsTemplatesResponse: description: Response containing a list of Agent Observability patterns templates. properties: data: $ref: "#/components/schemas/LLMObsPatternsTemplatesResponseData" required: - data type: object LLMObsPatternsTemplatesResponseAttributes: description: Attributes of a list of Agent Observability patterns templates. properties: templates: $ref: "#/components/schemas/LLMObsPatternsTemplateItemsList" required: - templates type: object LLMObsPatternsTemplatesResponseData: description: Data object of a list of Agent Observability patterns templates. properties: attributes: $ref: "#/components/schemas/LLMObsPatternsTemplatesResponseAttributes" id: description: Identifier of the list response. example: "topic_discovery_templates" type: string type: $ref: "#/components/schemas/LLMObsPatternsTemplatesListType" required: - id - type - attributes type: object LLMObsPatternsTopic: description: A topic discovered by an Agent Observability patterns run. properties: created_at: description: Timestamp when the topic was created. example: "2024-01-15T10:30:00Z" format: date-time type: string description: description: Description of the topic. example: "Questions about invoices, charges, and refunds." type: string first_seen_at: description: Timestamp when the topic was first seen. example: "2024-01-15T10:30:00Z" format: date-time type: string hierarchy_level: description: Level of the topic in the hierarchy. Level 0 is a leaf topic. example: 0 format: int64 type: integer id: description: Unique identifier of the topic. example: "5c1fae90-2b6d-4e3a-9f12-7a0c4d8e6b21" type: string is_validated: description: Whether the topic has been validated. example: true type: boolean name: description: Name of the topic. example: "Billing questions" type: string parent_topic_id: description: Identifier of the parent topic. Empty for top-level topics. example: "" type: string point_count: description: Number of data points assigned to the topic. example: 125 format: int64 type: integer run_id: description: Identifier of the run that produced the topic. example: "3fd6b5e0-8910-4b1c-a7d0-5b84de329012" type: string required: - id - run_id - parent_topic_id - hierarchy_level - name - description - is_validated - created_at - point_count - first_seen_at type: object LLMObsPatternsTopicWithClusteredPoints: description: |- A topic discovered by an Agent Observability patterns run, including the clustered points attached to leaf topics. properties: cluster_points: $ref: "#/components/schemas/LLMObsPatternsClusteredPointRefsList" created_at: description: Timestamp when the topic was created. example: "2024-01-15T10:30:00Z" format: date-time type: string description: description: Description of the topic. example: "Questions about invoices, charges, and refunds." type: string first_seen_at: description: Timestamp when the topic was first seen. example: "2024-01-15T10:30:00Z" format: date-time type: string hierarchy_level: description: Level of the topic in the hierarchy. Level 0 is a leaf topic. example: 0 format: int64 type: integer id: description: Unique identifier of the topic. example: "5c1fae90-2b6d-4e3a-9f12-7a0c4d8e6b21" type: string is_validated: description: Whether the topic has been validated. example: true type: boolean name: description: Name of the topic. example: "Billing questions" type: string parent_topic_id: description: Identifier of the parent topic. Empty for top-level topics. example: "" type: string point_count: description: Number of data points assigned to the topic. example: 125 format: int64 type: integer run_id: description: Identifier of the run that produced the topic. example: "3fd6b5e0-8910-4b1c-a7d0-5b84de329012" type: string required: - id - run_id - parent_topic_id - hierarchy_level - name - description - is_validated - created_at - point_count - first_seen_at type: object LLMObsPatternsTopicsList: description: List of discovered topics. items: $ref: "#/components/schemas/LLMObsPatternsTopic" type: array LLMObsPatternsTopicsResponse: description: Response containing the topics discovered by an Agent Observability patterns run. properties: data: $ref: "#/components/schemas/LLMObsPatternsTopicsResponseData" required: - data type: object LLMObsPatternsTopicsResponseAttributes: description: Attributes of an Agent Observability patterns topics response. properties: completed_at: description: Timestamp when the run completed. Null if the run has not completed. example: "2024-01-15T10:45:00Z" format: date-time nullable: true type: string config_id: description: Identifier of the configuration that produced the run. example: "a7c8d9e0-1234-5678-9abc-def012345678" type: string config_snapshot: $ref: "#/components/schemas/LLMObsPatternsConfigSnapshot" created_at: description: Timestamp when the run was created. example: "2024-01-15T10:30:00Z" format: date-time type: string previous_run_id: description: Identifier of the run that completed immediately before this one. Empty if none. example: "" type: string run_id: description: Identifier of the run that produced the topics. example: "3fd6b5e0-8910-4b1c-a7d0-5b84de329012" type: string topics: $ref: "#/components/schemas/LLMObsPatternsTopicsList" required: - run_id - config_id - previous_run_id - created_at - topics type: object LLMObsPatternsTopicsResponseData: description: Data object of an Agent Observability patterns topics response. properties: attributes: $ref: "#/components/schemas/LLMObsPatternsTopicsResponseAttributes" id: description: Identifier of the run the topics belong to. example: "3fd6b5e0-8910-4b1c-a7d0-5b84de329012" type: string type: $ref: "#/components/schemas/LLMObsPatternsTopicsType" required: - id - type - attributes type: object LLMObsPatternsTopicsType: description: Resource type of an Agent Observability patterns topics response. enum: - get_topics_response example: get_topics_response type: string x-enum-varnames: - GET_TOPICS_RESPONSE LLMObsPatternsTopicsWithClusteredPointsList: description: List of discovered topics with their clustered points. items: $ref: "#/components/schemas/LLMObsPatternsTopicWithClusteredPoints" type: array LLMObsPatternsTopicsWithClusteredPointsResponse: description: |- Response containing the topics, and the clustered points of their leaf topics, discovered by an Agent Observability patterns run. properties: data: $ref: "#/components/schemas/LLMObsPatternsTopicsWithClusteredPointsResponseData" required: - data type: object LLMObsPatternsTopicsWithClusteredPointsResponseAttributes: description: Attributes of an Agent Observability patterns topics-with-clustered-points response. properties: completed_at: description: Timestamp when the run completed. Null if the run has not completed. example: "2024-01-15T10:45:00Z" format: date-time nullable: true type: string config_id: description: Identifier of the configuration that produced the run. example: "a7c8d9e0-1234-5678-9abc-def012345678" type: string config_snapshot: $ref: "#/components/schemas/LLMObsPatternsConfigSnapshot" created_at: description: Timestamp when the run was created. example: "2024-01-15T10:30:00Z" format: date-time type: string previous_run_id: description: Identifier of the run that completed immediately before this one. Empty if none. example: "" type: string run_id: description: Identifier of the run that produced the topics. example: "3fd6b5e0-8910-4b1c-a7d0-5b84de329012" type: string topics: $ref: "#/components/schemas/LLMObsPatternsTopicsWithClusteredPointsList" required: - run_id - config_id - previous_run_id - created_at - topics type: object LLMObsPatternsTopicsWithClusteredPointsResponseData: description: Data object of an Agent Observability patterns topics-with-clustered-points response. properties: attributes: $ref: "#/components/schemas/LLMObsPatternsTopicsWithClusteredPointsResponseAttributes" id: description: Identifier of the run the topics belong to. example: "3fd6b5e0-8910-4b1c-a7d0-5b84de329012" type: string type: $ref: "#/components/schemas/LLMObsPatternsTopicsWithClusteredPointsType" required: - id - type - attributes type: object LLMObsPatternsTopicsWithClusteredPointsType: description: Resource type of an Agent Observability patterns topics-with-clustered-points response. enum: - get_topics_with_cluster_points_response example: get_topics_with_cluster_points_response type: string x-enum-varnames: - GET_TOPICS_WITH_CLUSTER_POINTS_RESPONSE LLMObsPatternsTriggerRequest: description: Request to trigger an Agent Observability patterns run. properties: data: $ref: "#/components/schemas/LLMObsPatternsTriggerRequestData" required: - data type: object LLMObsPatternsTriggerRequestAttributes: description: Attributes for triggering an Agent Observability patterns run. properties: config_id: description: The ID of the patterns configuration to run. example: "a7c8d9e0-1234-5678-9abc-def012345678" type: string required: - config_id type: object LLMObsPatternsTriggerRequestData: description: Data object for triggering an Agent Observability patterns run. properties: attributes: $ref: "#/components/schemas/LLMObsPatternsTriggerRequestAttributes" type: $ref: "#/components/schemas/LLMObsPatternsRequestType" required: - type - attributes type: object LLMObsPatternsTriggerResponse: description: Response after triggering an Agent Observability patterns run. properties: data: $ref: "#/components/schemas/LLMObsPatternsTriggerResponseData" required: - data type: object LLMObsPatternsTriggerResponseAttributes: description: Attributes of an Agent Observability patterns trigger response. properties: config_id: description: The ID of the patterns configuration that was run. example: "a7c8d9e0-1234-5678-9abc-def012345678" type: string run_id: description: The ID of the patterns run that was started. example: "3fd6b5e0-8910-4b1c-a7d0-5b84de329012" type: string status: description: Status of the patterns run. example: started type: string required: - run_id - config_id - status type: object LLMObsPatternsTriggerResponseData: description: Data object of an Agent Observability patterns trigger response. properties: attributes: $ref: "#/components/schemas/LLMObsPatternsTriggerResponseAttributes" id: description: The ID of the patterns configuration that was run. example: "a7c8d9e0-1234-5678-9abc-def012345678" type: string type: $ref: "#/components/schemas/LLMObsPatternsTriggerResponseType" required: - id - type - attributes type: object LLMObsPatternsTriggerResponseType: description: Resource type of an Agent Observability patterns trigger response. enum: - topic_discovery_run example: topic_discovery_run type: string x-enum-varnames: - TOPIC_DISCOVERY_RUN LLMObsProjectDataAttributesRequest: description: Attributes for creating an Agent Observability project. properties: description: description: Description of the project. type: string name: description: Name of the project. example: "My LLM Project" type: string required: - name type: object LLMObsProjectDataAttributesResponse: description: Attributes of an Agent Observability project. properties: created_at: description: Timestamp when the project was created. example: "2024-01-15T10:30:00Z" format: date-time type: string description: description: Description of the project. example: "" nullable: true type: string name: description: Name of the project. example: "My LLM Project" type: string updated_at: description: Timestamp when the project was last updated. example: "2024-01-15T10:30:00Z" format: date-time type: string required: - name - description - created_at - updated_at type: object LLMObsProjectDataRequest: description: Data object for creating an Agent Observability project. properties: attributes: $ref: "#/components/schemas/LLMObsProjectDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsProjectType" required: - type - attributes type: object LLMObsProjectDataResponse: description: Data object for an Agent Observability project. properties: attributes: $ref: "#/components/schemas/LLMObsProjectDataAttributesResponse" id: description: Unique identifier of the project. example: "a33671aa-24fd-4dcd-9b33-a8ec7dde7751" type: string type: $ref: "#/components/schemas/LLMObsProjectType" required: - id - type - attributes type: object LLMObsProjectRequest: description: Request to create an Agent Observability project. properties: data: $ref: "#/components/schemas/LLMObsProjectDataRequest" required: - data type: object LLMObsProjectResponse: description: Response containing a single Agent Observability project. properties: data: $ref: "#/components/schemas/LLMObsProjectDataResponse" required: - data type: object LLMObsProjectType: description: Resource type of an Agent Observability project. enum: - projects example: projects type: string x-enum-varnames: - PROJECTS LLMObsProjectUpdateDataAttributesRequest: description: Attributes for updating an Agent Observability project. properties: description: description: Updated description of the project. type: string name: description: Updated name of the project. type: string type: object LLMObsProjectUpdateDataRequest: description: Data object for updating an Agent Observability project. properties: attributes: $ref: "#/components/schemas/LLMObsProjectUpdateDataAttributesRequest" type: $ref: "#/components/schemas/LLMObsProjectType" required: - type - attributes type: object LLMObsProjectUpdateRequest: description: Request to partially update an Agent Observability project. properties: data: $ref: "#/components/schemas/LLMObsProjectUpdateDataRequest" required: - data type: object LLMObsProjectsResponse: description: Response containing a list of Agent Observability projects. properties: data: description: List of projects. items: $ref: "#/components/schemas/LLMObsProjectDataResponse" type: array meta: $ref: "#/components/schemas/LLMObsCursorMeta" required: - data type: object LLMObsPromptAuthoringChatTemplate: description: A chat prompt containing messages, references to specific versions of other prompts, or both. items: $ref: "#/components/schemas/LLMObsPromptAuthoringItem" minItems: 1 type: array LLMObsPromptAuthoringItem: description: >- A chat message or a reference to a specific version of another prompt. A chat message must not contain an `include` field; the API rejects items that combine both forms. oneOf: - $ref: "#/components/schemas/LLMObsPromptChatMessage" - $ref: "#/components/schemas/LLMObsPromptIncludeItem" LLMObsPromptAuthoringMessagesTemplate: description: A chat prompt whose authored items are stored under `messages`. properties: messages: $ref: "#/components/schemas/LLMObsPromptAuthoringChatTemplate" required: - messages type: object LLMObsPromptChatMessage: description: A single chat message in a prompt template. properties: content: description: Content of the message. example: "You are a helpful customer support assistant for {{company_name}}." type: string role: description: Role of the message (for example `system`, `user`, or `assistant`). example: "system" type: string required: - role - content type: object LLMObsPromptChatTemplate: description: >- A chat prompt template containing messages and optional named message placeholders. **Preview:** Message placeholders are available in Preview. To request access, contact [Datadog Support](https://www.datadoghq.com/support/) or your Customer Success Manager. items: $ref: "#/components/schemas/LLMObsPromptChatTemplateItem" minItems: 1 type: array x-generate-alias-as-model: true LLMObsPromptChatTemplateItem: description: A chat message or a named message placeholder in a prompt template. oneOf: - $ref: "#/components/schemas/LLMObsPromptChatMessage" - $ref: "#/components/schemas/LLMObsPromptMessagePlaceholder" LLMObsPromptConfig: additionalProperties: {} description: >- Versioned prompt configuration is in Preview. To request access, contact [Datadog Support](https://www.datadoghq.com/support/) or your Customer Success Manager. Customer-owned configuration delivered with a prompt version. Datadog stores and returns the object without interpolating it, validating provider-specific keys, or applying it to model calls. Do not include secrets. example: model: provider-model response_format: type: json_object temperature: 0.2 type: object LLMObsPromptData: description: Data object for an Agent Observability prompt. properties: attributes: $ref: "#/components/schemas/LLMObsPromptDataAttributes" id: description: Unique identifier of the prompt. example: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" type: string type: $ref: "#/components/schemas/LLMObsPromptType" required: - id - type - attributes type: object LLMObsPromptDataAttributes: description: >- Attributes of an Agent Observability prompt registry entry. Prompt list and metadata-update responses omit complete template and configuration data. properties: author: description: UUID of the user who authored the prompt. type: string created_at: description: Timestamp when the prompt was created. format: date-time type: string created_from: description: >- Source that created the prompt, such as `ui-registry`, `sdk-registry`, or `sdk-instrumentation`. example: "sdk-registry" type: string datasets: description: Datasets observed in runs associated with this prompt. items: $ref: "#/components/schemas/LLMObsPromptDataset" type: array description: description: Description of the prompt. type: string extracted_from: description: Source prompt from which this prompt was extracted, when applicable. type: string in_registry: description: Whether the prompt is a registry entry (as opposed to a code-discovered prompt). example: true type: boolean last_seen_at: description: Timestamp of the most recent observed run of this prompt. format: date-time type: string last_version_created_at: description: Timestamp when the most recent version of the prompt was created. format: date-time type: string ml_app: description: The ML application this prompt is associated with. type: string ml_apps: description: ML applications observed running this prompt. items: type: string type: array num_versions: description: Number of versions of the prompt. example: 2 format: int64 type: integer prompt_id: description: Customer-provided identifier of the prompt. example: "customer-support-assistant" type: string source: $ref: "#/components/schemas/LLMObsPromptResponseSource" tags: description: Tags observed on runs of this prompt. items: type: string type: array title: description: Title of the prompt. type: string required: - prompt_id - source - num_versions - in_registry - created_from type: object LLMObsPromptDataset: description: A dataset observed in runs associated with a prompt or prompt version. properties: id: description: Unique identifier of the dataset. example: "" type: string name: description: Name of the dataset. type: string required: - id type: object LLMObsPromptInclude: additionalProperties: false description: >- Includes messages from a specific version of another prompt. Omitting `items` includes every message from that version in its original order. When `items` is present, messages are included in the specified order, including repetitions. properties: items: description: >- Zero-based indexes of messages from the included prompt. For example, `[2, 0, 0]` includes the third message, followed by the first message twice. Omit this field to include all messages in their original order. items: format: int64 maximum: 2147483647 minimum: 0 type: integer minItems: 1 type: array prompt_id: description: Customer-provided identifier of the included prompt. example: "response-policy" minLength: 1 type: string version: description: Positive sequential version number of the included prompt. example: 3 format: int64 maximum: 2147483647 minimum: 1 type: integer required: - prompt_id - version type: object LLMObsPromptIncludeItem: additionalProperties: false description: Includes all or selected messages from a specific version of another prompt. properties: include: $ref: "#/components/schemas/LLMObsPromptInclude" required: - include type: object LLMObsPromptMessagePlaceholder: additionalProperties: false description: >- A named placeholder that inserts a list of messages when a compatible SDK formats the prompt. **Preview:** Message placeholders are available in Preview. To request access, contact [Datadog Support](https://www.datadoghq.com/support/) or your Customer Success Manager. properties: name: description: Name used to supply the message list when formatting the prompt. example: "history" minLength: 1 pattern: "^[A-Za-z0-9_]+$" type: string type: $ref: "#/components/schemas/LLMObsPromptMessagePlaceholderType" required: - type - name type: object LLMObsPromptMessagePlaceholderType: description: Type of chat-template item. enum: - placeholder example: "placeholder" type: string x-enum-varnames: - PLACEHOLDER LLMObsPromptResponse: description: Response containing a single Agent Observability prompt. example: data: attributes: author: "3b12f1df-14fd-4e12-bd6f-4a2f5c8b3d1e" created_at: "2025-01-15T10:00:00Z" created_from: "sdk-registry" description: "Answers customer questions using the company knowledge base." in_registry: true last_version_created_at: "2025-01-15T10:00:00Z" num_versions: 1 prompt_id: "customer-support-assistant" source: registry title: "Customer Support Assistant" id: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" type: prompt-templates properties: data: $ref: "#/components/schemas/LLMObsPromptData" required: - data type: object LLMObsPromptResponseSource: description: Whether the prompt was created from the registry or discovered from observed LLM calls. enum: - registry - code example: registry type: string x-enum-varnames: - REGISTRY - CODE LLMObsPromptSDKData: description: Data object for a flattened Agent Observability prompt version returned for SDK consumption. properties: attributes: $ref: "#/components/schemas/LLMObsPromptSDKDataAttributes" id: description: Unique identifier of the prompt. example: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" type: string type: $ref: "#/components/schemas/LLMObsPromptType" required: - id - type - attributes type: object LLMObsPromptSDKDataAttributes: description: >- Attributes of a flattened prompt version returned for SDK consumption. Exactly one of `template` and `chat_template` is returned. Empty `config` is omitted when configuration authoring is disabled for the organization. Non-empty saved configuration is always returned. properties: chat_template: description: >- Chat template for this prompt version, as a list of messages and named message placeholders. Omitted for text templates. **Preview:** Message placeholders are available in Preview. To request access, contact [Datadog Support](https://www.datadoghq.com/support/) or your Customer Success Manager. items: $ref: "#/components/schemas/LLMObsPromptChatTemplateItem" type: array config: $ref: "#/components/schemas/LLMObsPromptConfig" labels: deprecated: true description: Labels attached to the selected version. items: type: string type: array prompt_id: description: Customer-provided identifier of the prompt. example: "customer-support-assistant" type: string prompt_version_uuid: description: Unique identifier of this prompt version. example: "d83ab666-61cc-5545-a83b-2424bb85467b" type: string template: description: Text template for this prompt version. Omitted for chat templates. type: string version: description: >- Version identifier for this prompt version. This is the sequential version number unless a user-supplied version identifier was set, in which case that identifier is used instead. example: "2" type: string type: object LLMObsPromptSDKResponse: description: Response containing a flattened Agent Observability prompt version for SDK consumption. example: data: attributes: chat_template: - content: "You are a helpful customer support assistant for {{company_name}}." role: "system" - name: "history" type: "placeholder" - content: "Help {{customer_name}} with this question: {{question}}" role: "user" config: model: provider-model temperature: 0.2 prompt_id: "customer-support-assistant" prompt_version_uuid: "d83ab666-61cc-5545-a83b-2424bb85467b" version: "2" id: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" type: prompt-templates properties: data: $ref: "#/components/schemas/LLMObsPromptSDKData" required: - data type: object LLMObsPromptTemplate: description: >- A text template, a list of chat messages and named message placeholders, or an authored chat object. Text can include an exact prompt version with `{{>prompt-id version=N}}`; other text, including `{{>...}}` sequences without a version, remains literal. Use an authored chat object when including prompts as chat messages. **Preview**: Prompt composition is available in Preview. To request access, contact [Datadog Support](https://docs.datadoghq.com/help/) or your Customer Success Manager. Without access, inline references remain literal text and structured includes are unsupported. Previously compiled prompt versions remain available for execution. **Preview:** Message placeholders are available in Preview. To request access, contact [Datadog Support](https://www.datadoghq.com/support/) or your Customer Success Manager. example: "You are a helpful assistant for {{audience}}." oneOf: - $ref: "#/components/schemas/LLMObsPromptTextTemplate" - $ref: "#/components/schemas/LLMObsPromptChatTemplate" - $ref: "#/components/schemas/LLMObsPromptAuthoringMessagesTemplate" LLMObsPromptTextTemplate: description: A text prompt template. minLength: 1 pattern: ".*\\S.*" type: string LLMObsPromptType: description: Resource type of an Agent Observability prompt. enum: - prompt-templates example: prompt-templates type: string x-enum-varnames: - PROMPT_TEMPLATES LLMObsPromptVersionData: description: Data object for a specific version of an Agent Observability prompt. properties: attributes: $ref: "#/components/schemas/LLMObsPromptVersionDataAttributes" id: description: Unique identifier of the prompt version. example: "d83ab666-61cc-5545-a83b-2424bb85467b" type: string type: $ref: "#/components/schemas/LLMObsPromptVersionType" required: - id - type - attributes type: object LLMObsPromptVersionDataAttributes: description: >- Attributes of a specific version of an Agent Observability prompt. For a composed version, `authoring_template` contains its pinned include-bearing source; ordinary versions omit that attribute. Empty `config` is omitted when configuration authoring is disabled for the organization. Non-empty saved configuration is always returned. properties: author: description: UUID of the user who authored this version. type: string authoring_template: $ref: "#/components/schemas/LLMObsPromptTemplate" config: $ref: "#/components/schemas/LLMObsPromptConfig" created_at: description: Timestamp stored on this prompt version. format: date-time type: string datasets: description: Datasets observed in runs associated with this prompt version. items: $ref: "#/components/schemas/LLMObsPromptDataset" type: array description: description: Description of this version. type: string labels: deprecated: true description: Labels attached to this version (for example `development`, `staging`, `production`). items: type: string type: array last_seen_at: description: Timestamp of the most recent observed run of this prompt version. format: date-time type: string ml_app: description: The ML application this prompt is associated with. type: string ml_apps: description: ML applications observed running this prompt version. items: type: string type: array prompt_id: description: Customer-provided identifier of the parent prompt. example: "customer-support-assistant" type: string prompt_uuid: description: Unique identifier of the parent prompt. example: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" type: string tags: description: Tags observed on runs of this prompt version. items: type: string type: array template: $ref: "#/components/schemas/LLMObsPromptTemplate" user_version: description: User-supplied identifier for this version. type: string version: description: Sequential version number. example: 1 format: int64 minimum: 1 type: integer version_created_at: description: Timestamp when this version was created. format: date-time type: string required: - prompt_uuid - prompt_id - template - version type: object LLMObsPromptVersionLabel: description: A label attached to an Agent Observability prompt version. enum: - production - development type: string x-enum-varnames: - PRODUCTION - DEVELOPMENT LLMObsPromptVersionListData: description: Data object for a prompt version returned in a list. properties: attributes: $ref: "#/components/schemas/LLMObsPromptVersionListDataAttributes" id: description: Unique identifier of the prompt version. example: "d83ab666-61cc-5545-a83b-2424bb85467b" type: string type: $ref: "#/components/schemas/LLMObsPromptVersionType" required: - id - type - attributes type: object LLMObsPromptVersionListDataAttributes: description: Attributes of a prompt version returned in a list, excluding its template. properties: author: description: UUID of the user who authored this version. type: string created_at: description: Timestamp stored on this prompt version. format: date-time type: string datasets: description: Datasets observed in runs associated with this prompt version. items: $ref: "#/components/schemas/LLMObsPromptDataset" type: array description: description: Description of this version. type: string labels: deprecated: true description: Labels attached to this version (for example `development`, `staging`, `production`). items: type: string type: array last_seen_at: description: Timestamp of the most recent observed run of this prompt version. format: date-time type: string ml_app: description: The ML application this prompt is associated with. type: string ml_apps: description: ML applications observed running this prompt version. items: type: string type: array prompt_id: description: Customer-provided identifier of the parent prompt. example: "customer-support-assistant" type: string prompt_uuid: description: Unique identifier of the parent prompt. example: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" type: string tags: description: Tags observed on runs of this prompt version. items: type: string type: array user_version: description: User-supplied identifier for this version. type: string version: description: Sequential version number. example: 1 format: int64 minimum: 1 type: integer version_created_at: description: Timestamp when this version was created. format: date-time type: string required: - prompt_uuid - prompt_id - version type: object LLMObsPromptVersionResponse: description: Response containing a specific version of an Agent Observability prompt. example: data: attributes: author: "3b12f1df-14fd-4e12-bd6f-4a2f5c8b3d1e" config: {} created_at: "2025-02-01T14:30:00Z" description: "Give concise answers and cite relevant help-center articles." prompt_id: "customer-support-assistant" prompt_uuid: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" template: - content: "You are a helpful customer support assistant for {{company_name}}." role: "system" - content: "Help {{customer_name}} with this question: {{question}}" role: "user" version: 2 version_created_at: "2025-02-01T14:30:00Z" id: "d83ab666-61cc-5545-a83b-2424bb85467b" type: prompt-template-versions properties: data: $ref: "#/components/schemas/LLMObsPromptVersionData" required: - data type: object LLMObsPromptVersionType: description: Resource type of an Agent Observability prompt version. enum: - prompt-template-versions example: prompt-template-versions type: string x-enum-varnames: - PROMPT_TEMPLATE_VERSIONS LLMObsPromptVersionsResponse: description: Response containing the versions of an Agent Observability prompt. example: data: - attributes: author: "3b12f1df-14fd-4e12-bd6f-4a2f5c8b3d1e" created_at: "2025-02-01T14:30:00Z" description: "Give concise answers and cite relevant help-center articles." prompt_id: "customer-support-assistant" prompt_uuid: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" version: 2 version_created_at: "2025-02-01T14:30:00Z" id: "d83ab666-61cc-5545-a83b-2424bb85467b" type: prompt-template-versions - attributes: author: "3b12f1df-14fd-4e12-bd6f-4a2f5c8b3d1e" created_at: "2025-01-15T10:00:00Z" description: "Initial customer support prompt." prompt_id: "customer-support-assistant" prompt_uuid: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" version: 1 version_created_at: "2025-01-15T10:00:00Z" id: "20e5280b-c75d-5699-8a70-a2773a751428" type: prompt-template-versions properties: data: description: Prompt versions ordered from newest to oldest. items: $ref: "#/components/schemas/LLMObsPromptVersionListData" type: array required: - data type: object LLMObsPromptsResponse: description: Response containing a list of Agent Observability prompts. example: data: - attributes: author: "3b12f1df-14fd-4e12-bd6f-4a2f5c8b3d1e" created_at: "2025-01-15T10:00:00Z" created_from: "sdk-registry" description: "Answers customer questions using the company knowledge base." in_registry: true last_version_created_at: "2025-02-01T14:30:00Z" num_versions: 2 prompt_id: "customer-support-assistant" source: registry title: "Customer Support Assistant" id: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" type: prompt-templates properties: data: description: List of Agent Observability prompts. items: $ref: "#/components/schemas/LLMObsPromptData" type: array required: - data type: object LLMObsSearchSpansRequest: description: Request body for searching Agent Observability spans. properties: data: $ref: "#/components/schemas/LLMObsSearchSpansRequestData" required: - data type: object LLMObsSearchSpansRequestAttributes: description: Attributes of an Agent Observability spans search request. properties: filter: $ref: "#/components/schemas/LLMObsSpanFilter" options: $ref: "#/components/schemas/LLMObsSpanSearchOptions" page: $ref: "#/components/schemas/LLMObsSpanPageQuery" sort: description: Sort order for the results. Use `-` prefix for descending order. example: "-start_ns" type: string type: object LLMObsSearchSpansRequestData: description: Data object for an Agent Observability spans search request. properties: attributes: $ref: "#/components/schemas/LLMObsSearchSpansRequestAttributes" type: $ref: "#/components/schemas/LLMObsSearchSpansRequestType" required: - type - attributes type: object LLMObsSearchSpansRequestType: description: Resource type for an Agent Observability spans search request. enum: - spans example: spans type: string x-enum-varnames: - SPANS LLMObsSpanAttributes: description: Attributes of an Agent Observability span. properties: duration: description: Duration of the span in nanoseconds. example: 1500000000.0 format: double type: number evaluation: additionalProperties: $ref: "#/components/schemas/LLMObsSpanEvaluationMetric" description: Evaluation metrics keyed by evaluator name. type: object input: $ref: "#/components/schemas/LLMObsSpanIO" intent: description: Detected intent of the span. type: string metadata: additionalProperties: {} description: Arbitrary metadata associated with the span. type: object metrics: additionalProperties: format: double type: number description: Numeric metrics associated with the span (e.g., token counts). type: object ml_app: description: Name of the ML application this span belongs to. example: "my-llm-app" type: string model_name: description: Name of the model used in this span. example: "gpt-4o" type: string model_provider: description: Provider of the model used in this span. example: "openai" type: string name: description: Name of the span. example: "llm_call" type: string output: $ref: "#/components/schemas/LLMObsSpanIO" parent_id: description: Identifier of the parent span, if any. type: string span_id: description: Unique identifier of the span. example: "abc123def456" type: string span_kind: description: Kind of span (e.g., llm, agent, tool, task, workflow). example: "llm" type: string start_ns: description: Start time of the span in nanoseconds since Unix epoch. example: 1705314600000000000 format: int64 type: integer status: description: Status of the span (e.g., ok, error). example: "ok" type: string tags: description: Tags associated with the span. items: type: string type: array tool_definitions: description: Tool definitions available to the span. items: $ref: "#/components/schemas/LLMObsSpanToolDefinition" type: array trace_id: description: Trace identifier this span belongs to. example: "trace-9a8b7c6d5e4f" type: string required: - span_id - trace_id - name - status - start_ns - duration - ml_app - span_kind type: object LLMObsSpanData: description: A single Agent Observability span. properties: attributes: $ref: "#/components/schemas/LLMObsSpanAttributes" id: description: Unique identifier of the span. example: "abc123def456" type: string type: $ref: "#/components/schemas/LLMObsSpanType" required: - id - type - attributes type: object LLMObsSpanEvaluationMetric: description: An evaluation metric associated with an Agent Observability span. properties: assessment: description: Assessment result (e.g., pass or fail). example: pass type: string eval_metric_type: description: Type of the evaluation metric (e.g., score, categorical, boolean). example: score type: string reasoning: description: Human-readable reasoning for the evaluation result. type: string status: description: Status of the evaluation execution. type: string tags: description: Tags associated with the evaluation metric. items: type: string type: array value: description: Value of the evaluation result. type: object LLMObsSpanFilter: description: Filter criteria for an Agent Observability span search. properties: from: description: Start of the time range. Accepts ISO 8601 or relative format (e.g., `now-15m`). Defaults to `now-15m`. example: "now-900s" type: string ml_app: description: Filter by ML application name. example: "my-llm-app" type: string query: description: >- Search query using Agent Observability query syntax. Supports attribute filters using the field:value syntax (e.g. session_id, trace_id, ml_app, meta.span.kind). When provided, structured field filters (`span_id`, `trace_id`, etc.) are ignored. example: "@session_id:abc123def456" type: string span_id: description: Filter by exact span ID. example: "abc123def456" type: string span_kind: description: Filter by span kind (e.g., llm, agent, tool, task, workflow). example: "llm" type: string span_name: description: Filter by span name. example: "llm_call" type: string tags: additionalProperties: type: string description: Filter by tag key-value pairs. type: object to: description: End of the time range. Accepts ISO 8601 or relative format (e.g., `now`). Defaults to `now`. example: "now" type: string trace_id: description: Filter by exact trace ID. example: "trace-9a8b7c6d5e4f" type: string type: object LLMObsSpanIO: description: Input or output content of an Agent Observability span. properties: messages: description: List of messages in the input or output. items: $ref: "#/components/schemas/LLMObsSpanMessage" type: array value: description: Plain-text value of the input or output. type: string type: object LLMObsSpanMessage: description: A single message in a span input or output. properties: content: description: Text content of the message. type: string id: description: Unique identifier of the message. type: string role: description: Role of the message sender (e.g., user, assistant, system). type: string tool_calls: description: Tool calls made in this message. items: $ref: "#/components/schemas/LLMObsSpanToolCall" type: array tool_results: description: Tool results returned in this message. items: $ref: "#/components/schemas/LLMObsSpanToolResult" type: array type: object LLMObsSpanPageQuery: description: Pagination settings for a span search request. properties: cursor: description: Cursor from the previous response to retrieve the next page. example: "eyJzdGFydCI6MTAwfQ==" type: string limit: description: Maximum number of spans to return. Defaults to `10`. example: 10 format: int64 type: integer type: object LLMObsSpanSearchOptions: description: Additional options for a span search request. properties: include_attachments: description: Whether to include attachment data in the response. Defaults to `true`. example: true type: boolean time_offset: description: Offset in seconds applied to both `from` and `to` timestamps. example: 0 format: int64 type: integer type: object LLMObsSpanToolCall: description: A tool call made during a span. properties: arguments: additionalProperties: {} description: Arguments passed to the tool. type: object name: description: Name of the tool called. type: string tool_id: description: Identifier of the tool call. type: string type: description: Type of the tool call. type: string type: object LLMObsSpanToolDefinition: description: A tool definition available to an LLM span. properties: description: description: Description of what the tool does. type: string name: description: Name of the tool. type: string schema: additionalProperties: {} description: JSON schema describing the tool's input parameters. type: object version: description: Version of the tool definition. type: string type: object LLMObsSpanToolResult: description: A result returned from a tool call during a span. properties: name: description: Name of the tool that produced this result. type: string result: description: Result value returned by the tool. type: string tool_id: description: Identifier of the corresponding tool call. type: string type: description: Type of the tool result. type: string type: object LLMObsSpanType: description: Resource type for an Agent Observability span. enum: - span example: span type: string x-enum-varnames: - SPAN LLMObsSpansResponse: description: Response containing a list of Agent Observability spans. properties: data: description: List of spans matching the query. items: $ref: "#/components/schemas/LLMObsSpanData" type: array links: $ref: "#/components/schemas/LLMObsSpansResponseLinks" meta: $ref: "#/components/schemas/LLMObsSpansResponseMeta" required: - data - meta type: object LLMObsSpansResponseLinks: description: Pagination links accompanying the spans response. properties: next: description: URL to retrieve the next page of results. example: "https://api.datadoghq.com/api/v2/llm-obs/v1/spans/events?page[cursor]=eyJzdGFydCI6MTAwfQ==" type: string type: object LLMObsSpansResponseMeta: description: Metadata accompanying the spans response. properties: elapsed: description: Time elapsed for the query in milliseconds. example: 132 format: int64 type: integer page: $ref: "#/components/schemas/LLMObsSpansResponsePage" request_id: description: Unique identifier for the request. example: "req-abc123" type: string status: description: Status of the query execution. example: "done" type: string required: - elapsed - request_id - status - page type: object LLMObsSpansResponsePage: description: Pagination cursor for the spans response. properties: after: description: Cursor to retrieve the next page of results. Absent when there are no more results. example: "eyJzdGFydCI6MTAwfQ==" type: string type: object LLMObsTraceAnnotatedInteractionItem: description: A trace, experiment trace, or session interaction with its associated annotations. properties: annotations: description: List of annotations for this interaction. items: $ref: "#/components/schemas/LLMObsAnnotationItem" type: array can_annotate: description: Whether the current caller can annotate this interaction. example: true type: boolean content_id: description: Upstream entity identifier supplied by the caller. example: "trace-abc-123" type: string created_at: description: Timestamp when the interaction was added to the queue. example: "2024-01-15T10:30:00Z" format: date-time type: string id: description: Unique identifier of the interaction. example: "interaction-456" type: string modified_at: description: Timestamp when the interaction was last updated. example: "2024-01-15T10:30:00Z" format: date-time type: string type: $ref: "#/components/schemas/LLMObsTraceInteractionType" required: - id - type - content_id - created_at - modified_at - can_annotate - annotations type: object LLMObsTraceInteractionItem: description: An interaction that references an upstream trace, experiment trace, or session. properties: content_id: description: Upstream entity identifier (trace, experiment trace, or session ID). example: "trace-abc-123" type: string type: $ref: "#/components/schemas/LLMObsTraceInteractionType" required: - type - content_id type: object LLMObsTraceInteractionResponseItem: description: A trace, experiment trace, or session interaction result. properties: already_existed: description: Whether this interaction already existed in the queue. example: false type: boolean content_id: description: Upstream entity identifier supplied by the caller. example: "trace-abc-123" type: string created_at: description: Timestamp when the interaction was added to the queue. example: "2024-01-15T10:30:00Z" format: date-time type: string id: description: Unique identifier of the interaction. example: "00000000-0000-0000-0000-000000000000" type: string modified_at: description: Timestamp when the interaction was last updated. example: "2024-01-15T10:30:00Z" format: date-time type: string type: $ref: "#/components/schemas/LLMObsTraceInteractionType" required: - id - type - content_id - already_existed - created_at - modified_at type: object LLMObsTraceInteractionType: description: Type of an upstream-entity interaction. enum: - trace - experiment_trace - session example: trace type: string x-enum-varnames: - TRACE - EXPERIMENT_TRACE - SESSION LLMObsUpdatePromptData: description: Data object for updating an Agent Observability prompt. properties: attributes: $ref: "#/components/schemas/LLMObsUpdatePromptDataAttributes" type: $ref: "#/components/schemas/LLMObsPromptType" required: - type - attributes type: object LLMObsUpdatePromptDataAttributes: additionalProperties: false description: >- Attributes for updating an Agent Observability prompt. At least one of `title` or `description` must be provided; both attributes are optional individually. minProperties: 1 properties: description: description: Optional new description for the prompt. type: string title: description: Optional new title for the prompt. type: string type: object LLMObsUpdatePromptRequest: description: Request to update an Agent Observability prompt's metadata. properties: data: $ref: "#/components/schemas/LLMObsUpdatePromptData" required: - data type: object LLMObsUpdatePromptVersionData: description: Data object for updating an Agent Observability prompt version. properties: attributes: $ref: "#/components/schemas/LLMObsUpdatePromptVersionDataAttributes" type: $ref: "#/components/schemas/LLMObsPromptVersionType" required: - type - attributes type: object LLMObsUpdatePromptVersionDataAttributes: additionalProperties: false description: >- Attributes for updating an Agent Observability prompt version. At least one of `description`, `labels`, or `env_ids` must be provided; all three attributes are optional individually. minProperties: 1 properties: description: description: Optional new description for this version. type: string env_ids: description: >- Optional feature-flag environment UUIDs the service attempts to enable and configure to use this version as their default. items: type: string type: array labels: deprecated: true description: Optional new labels for this version. Do not use this attribute for new integrations. items: $ref: "#/components/schemas/LLMObsPromptVersionLabel" type: array type: object LLMObsUpdatePromptVersionRequest: description: Request to update an Agent Observability prompt version's metadata or feature-flag environments. properties: data: $ref: "#/components/schemas/LLMObsUpdatePromptVersionData" required: - data type: object LLMObsUpsertAnnotationItem: description: |- A single annotation to create or update. The annotation is matched by `interaction_id` and the requesting user's identity. properties: interaction_id: description: ID of the interaction to annotate. example: "00000000-0000-0000-0000-000000000001" type: string label_values: description: |- Label values for this annotation. Each entry references a label schema by ID and provides the corresponding value validated against the schema type constraints. example: - label_schema_id: "abc-123" value: "good" - label_schema_id: "ef56gh78" value: "positive" items: $ref: "#/components/schemas/LLMObsAnnotationLabelValue" minItems: 1 type: array required: - interaction_id - label_values type: object LLMObsVertexAIMetadata: description: Vertex AI-specific metadata for an integration account or inference request. properties: location: description: The Vertex AI region. example: "us-central1" type: string project: description: The Google Cloud project ID. example: "my-gcp-project" type: string project_ids: description: List of Google Cloud project IDs available to the service account. example: - "my-gcp-project" items: type: string type: array type: object Language: description: Programming language enum: - PYTHON - JAVASCRIPT - TYPESCRIPT - JAVA - GO - YAML - RUBY - CSHARP - PHP - KOTLIN - SWIFT - DART - DOCKERFILE - ELIXIR - JSON - RUST - TERRAFORM - STARLARK - BASH - MARKDOWN - APEX - R - SQL example: PYTHON type: string x-enum-varnames: - PYTHON - JAVASCRIPT - TYPESCRIPT - JAVA - GO - YAML - RUBY - CSHARP - PHP - KOTLIN - SWIFT - DART - DOCKERFILE - ELIXIR - JSON - RUST - TERRAFORM - STARLARK - BASH - MARKDOWN - APEX - R - SQL LatestVersionMatchPolicy: description: The policy for matching the latest form version during an upsert operation. enum: - none - if_etag_match example: none type: string x-enum-varnames: - NONE - IF_ETAG_MATCH LaunchDarklyAPIKey: description: The definition of the `LaunchDarklyAPIKey` object. properties: api_token: $ref: "#/components/schemas/LaunchDarklyAPIKeyApiToken" type: $ref: "#/components/schemas/LaunchDarklyAPIKeyType" required: - type - api_token type: object LaunchDarklyAPIKeyApiToken: description: The `LaunchDarklyAPIKey` `api_token`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" LaunchDarklyAPIKeyType: description: The definition of the `LaunchDarklyAPIKey` object. enum: - LaunchDarklyAPIKey example: LaunchDarklyAPIKey type: string x-enum-varnames: - LAUNCHDARKLYAPIKEY LaunchDarklyAPIKeyUpdate: description: The definition of the `LaunchDarklyAPIKey` object. properties: api_token: $ref: "#/components/schemas/LaunchDarklyAPIKeyUpdateApiToken" type: $ref: "#/components/schemas/LaunchDarklyAPIKeyType" required: - type type: object LaunchDarklyAPIKeyUpdateApiToken: description: The `LaunchDarklyAPIKeyUpdate` `api_token`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" LaunchDarklyCredentials: description: The definition of the `LaunchDarklyCredentials` object. oneOf: - $ref: "#/components/schemas/LaunchDarklyAPIKey" LaunchDarklyCredentialsUpdate: description: The definition of the `LaunchDarklyCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/LaunchDarklyAPIKeyUpdate" LaunchDarklyIntegration: description: The definition of the `LaunchDarklyIntegration` object. properties: credentials: $ref: "#/components/schemas/LaunchDarklyCredentials" type: $ref: "#/components/schemas/LaunchDarklyIntegrationType" required: - type - credentials type: object LaunchDarklyIntegrationType: description: The definition of the `LaunchDarklyIntegrationType` object. enum: - LaunchDarkly example: LaunchDarkly type: string x-enum-varnames: - LAUNCHDARKLY LaunchDarklyIntegrationUpdate: description: The definition of the `LaunchDarklyIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/LaunchDarklyCredentialsUpdate" type: $ref: "#/components/schemas/LaunchDarklyIntegrationType" required: - type type: object Layer: description: Encapsulates a layer resource, holding attributes like rotation details, plus relationships to the members covering that layer. properties: attributes: $ref: "#/components/schemas/LayerAttributes" id: description: A unique identifier for this layer. type: string relationships: $ref: "#/components/schemas/LayerRelationships" type: $ref: "#/components/schemas/LayerType" required: - type type: object LayerAttributes: description: Describes key properties of a Layer, including rotation details, name, start/end times, and any restrictions. properties: effective_date: description: When the layer becomes active (ISO 8601). format: date-time type: string end_date: description: When the layer ceases to be active (ISO 8601). format: date-time type: string interval: $ref: "#/components/schemas/LayerAttributesInterval" name: description: The name of this layer. example: Weekend Layer type: string restrictions: description: An optional list of time restrictions for when this layer is in effect. items: $ref: "#/components/schemas/TimeRestriction" type: array rotation_start: description: The date/time when the rotation starts (ISO 8601). format: date-time type: string time_zone: description: The time zone for this layer. example: "America/New_York" type: string type: object LayerAttributesInterval: description: Defines how often the rotation repeats, using a combination of days and optional seconds. Should be at least 1 hour. properties: days: description: The number of days in each rotation cycle. example: 1 format: int32 maximum: 400 type: integer seconds: description: Any additional seconds for the rotation cycle (up to 30 days). example: 300 format: int64 maximum: 2592000 type: integer type: object LayerRelationships: description: Holds references to objects related to the Layer entity, such as its members. properties: members: $ref: "#/components/schemas/LayerRelationshipsMembers" type: object LayerRelationshipsMembers: description: Holds an array of references to the members of a Layer, each containing member IDs. properties: data: description: The list of members who belong to this layer. items: $ref: "#/components/schemas/LayerRelationshipsMembersDataItems" type: array type: object LayerRelationshipsMembersDataItems: description: |- Represents a single member object in a layer's `members` array, referencing a unique Datadog user ID. properties: id: description: The unique user ID of the layer member. example: "00000000-0000-0000-0000-000000000002" type: string type: $ref: "#/components/schemas/LayerRelationshipsMembersDataItemsType" required: - type - id type: object LayerRelationshipsMembersDataItemsType: default: members description: |- Members resource type. enum: - members example: members type: string x-enum-varnames: - MEMBERS LayerType: default: layers description: |- Layers resource type. enum: - layers example: layers type: string x-enum-varnames: - LAYERS LeakedKey: description: The definition of LeakedKey object. properties: attributes: $ref: "#/components/schemas/LeakedKeyAttributes" id: description: The LeakedKey id. example: "id" type: string type: $ref: "#/components/schemas/LeakedKeyType" required: - attributes - id - type type: object LeakedKeyAttributes: description: The definition of LeakedKeyAttributes object. properties: date: description: The LeakedKeyAttributes date. example: "2017-07-21T17:32:28Z" format: date-time type: string leak_source: description: The LeakedKeyAttributes leak_source. type: string required: - date type: object LeakedKeyType: default: leaked_keys description: The definition of LeakedKeyType object. enum: - leaked_keys example: leaked_keys type: string x-enum-varnames: - LEAKED_KEYS Library: description: Vulnerability library. properties: additional_names: description: Related library or package names (such as child packages or affected binary paths). items: description: A related library or package name affected by the vulnerability. example: linux-tools-common type: string type: array name: description: Vulnerability library name. example: linux-aws-5.15 type: string version: description: Vulnerability library version. example: 5.15.0 type: string required: - name type: object LicensesListResponse: description: >- The top-level response object returned by the licenses list endpoint, containing the array of supported SPDX licenses. properties: data: $ref: "#/components/schemas/LicensesListResponseData" required: - data type: object LicensesListResponseData: description: The data object in a licenses list response, containing the list of SPDX licenses. properties: attributes: $ref: "#/components/schemas/LicensesListResponseDataAttributes" id: description: The unique identifier for this licenses list response. example: 0190a3d4-1234-7000-8000-000000000000 type: string type: $ref: "#/components/schemas/LicensesListResponseDataType" required: - id - type - attributes type: object LicensesListResponseDataAttributes: description: The attributes of the licenses list response, containing the array of SPDX licenses. properties: licenses: $ref: "#/components/schemas/LicensesListResponseDataAttributesLicenses" required: - licenses type: object LicensesListResponseDataAttributesLicenses: description: The list of SPDX licenses returned by the API. items: $ref: "#/components/schemas/LicensesListResponseDataAttributesLicensesItems" type: array LicensesListResponseDataAttributesLicensesItems: description: An SPDX license entry returned by the licenses list endpoint. properties: display_name: description: The human-readable name of the license. example: MIT License type: string identifier: description: The SPDX identifier of the license. example: MIT type: string short_name: description: The short name of the license, typically matching the SPDX identifier. example: MIT type: string required: - display_name - identifier - short_name type: object LicensesListResponseDataType: default: licenserequest description: The type identifier for license list responses. enum: - licenserequest example: licenserequest type: string x-enum-varnames: - LICENSEREQUEST LinearIssuesDataType: default: linear_issues description: Linear issues resource type. enum: - linear_issues example: linear_issues type: string x-enum-varnames: - LINEAR_ISSUES Links: description: The JSON:API links related to pagination. properties: first: description: First page link. example: "https://api.datadoghq.com/api/v2/security/vulnerabilities?page%5Bnumber%5D=1&page%5Btoken%5D=b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4" type: string last: description: Last page link. example: "https://api.datadoghq.com/api/v2/security/vulnerabilities?page%5Bnumber%5D=15&page%5Btoken%5D=b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4" type: string next: description: Next page link. example: "https://api.datadoghq.com/api/v2/security/vulnerabilities?page%5Bnumber%5D=16&page%5Btoken%5D=b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4" type: string previous: description: Previous page link. example: "https://api.datadoghq.com/api/v2/security/vulnerabilities?page%5Bnumber%5D=14&page%5Btoken%5D=b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4" type: string self: description: Request link. example: https://api.datadoghq.com/api/v2/security/vulnerabilities?filter%5Btool%5D=Infra type: string required: - self - first - last type: object ListAPIsResponse: description: Response for `ListAPIs`. properties: data: description: List of API items. items: $ref: "#/components/schemas/ListAPIsResponseData" type: array meta: $ref: "#/components/schemas/ListAPIsResponseMeta" type: object ListAPIsResponseData: description: Data envelope for `ListAPIsResponse`. properties: attributes: $ref: "#/components/schemas/ListAPIsResponseDataAttributes" id: $ref: "#/components/schemas/ApiID" type: object ListAPIsResponseDataAttributes: description: Attributes for `ListAPIsResponseData`. properties: name: description: API name. example: "Payments API" type: string type: object ListAPIsResponseMeta: description: Metadata for `ListAPIsResponse`. properties: pagination: $ref: "#/components/schemas/ListAPIsResponseMetaPagination" type: object ListAPIsResponseMetaPagination: description: Pagination metadata information for `ListAPIsResponse`. properties: limit: description: Number of items in the current page. example: 20 format: int64 type: integer offset: description: Offset for pagination. example: 0 format: int64 type: integer total_count: description: Total number of items. example: 35 format: int64 type: integer type: object ListAllocationsResponse: description: Response containing a list of targeting rules (allocations). properties: data: description: List of targeting rules (allocations). items: $ref: "#/components/schemas/AllocationDataResponse" description: Allocation item. type: array required: - data type: object ListAppKeyRegistrationsResponse: description: A paginated list of app key registrations. properties: data: description: An array of app key registrations. items: $ref: "#/components/schemas/AppKeyRegistrationData" type: array meta: $ref: "#/components/schemas/ListAppKeyRegistrationsResponseMeta" type: object ListAppKeyRegistrationsResponseMeta: description: The definition of `ListAppKeyRegistrationsResponseMeta` object. properties: total: description: The total number of app key registrations. example: 1 format: int64 type: integer total_filtered: description: The total number of app key registrations that match the specified filters. example: 1 format: int64 type: integer type: object ListAppVersionsResponse: description: A paginated list of versions for an app. properties: data: description: The list of app versions. items: $ref: "#/components/schemas/AppVersion" type: array meta: $ref: "#/components/schemas/ListAppsResponseMeta" type: object ListApplicationKeysResponse: description: Response for a list of application keys. properties: data: description: Array of application keys. items: $ref: "#/components/schemas/PartialApplicationKey" type: array included: description: Array of objects related to the application key. items: $ref: "#/components/schemas/ApplicationKeyResponseIncludedItem" type: array meta: $ref: "#/components/schemas/ApplicationKeyResponseMeta" type: object ListAppsResponse: description: A paginated list of apps matching the specified filters and sorting. properties: data: description: An array of app definitions. items: $ref: "#/components/schemas/ListAppsResponseDataItems" type: array included: description: Data on the version of the app that was published. items: $ref: "#/components/schemas/Deployment" type: array meta: $ref: "#/components/schemas/ListAppsResponseMeta" type: object ListAppsResponseDataItems: description: An app definition object. This contains only basic information about the app such as ID, name, and tags. properties: attributes: $ref: "#/components/schemas/ListAppsResponseDataItemsAttributes" id: description: The ID of the app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string meta: $ref: "#/components/schemas/AppMeta" relationships: $ref: "#/components/schemas/ListAppsResponseDataItemsRelationships" type: $ref: "#/components/schemas/AppDefinitionType" required: - id - type - attributes type: object ListAppsResponseDataItemsAttributes: description: Basic information about the app such as name, description, and tags. properties: description: description: A human-readable description for the app. type: string favorite: description: Whether the app is marked as a favorite by the current user. type: boolean name: description: The name of the app. type: string selfService: description: Whether the app is enabled for use in the Datadog self-service hub. type: boolean tags: description: A list of tags for the app, which can be used to filter apps. example: - "service:webshop-backend" - "team:webshop" items: description: An individual tag for the app. type: string type: array type: object ListAppsResponseDataItemsRelationships: description: The app's publication information. properties: deployment: $ref: "#/components/schemas/DeploymentRelationship" type: object ListAppsResponseMeta: description: Pagination metadata. properties: page: $ref: "#/components/schemas/ListAppsResponseMetaPage" type: object ListAppsResponseMetaPage: description: Information on the total number of apps, to be used for pagination. properties: totalCount: description: The total number of apps under the Datadog organization, disregarding any filters applied. format: int64 type: integer totalFilteredCount: description: The total number of apps that match the specified filters. format: int64 type: integer type: object ListAssetsSBOMsResponse: description: The expected response schema when listing assets SBOMs. properties: data: description: List of assets SBOMs. items: $ref: "#/components/schemas/SBOM" type: array links: $ref: "#/components/schemas/Links" meta: $ref: "#/components/schemas/Metadata" required: - data type: object ListBlueprintsResponse: description: The response for listing available blueprints. properties: data: description: An array of blueprint metadata. items: $ref: "#/components/schemas/BlueprintMetadataData" type: array type: object ListCampaignsResponse: description: Response containing a list of campaigns. properties: data: $ref: "#/components/schemas/ListCampaignsResponseData" meta: $ref: "#/components/schemas/PaginatedResponseMeta" required: - data - meta type: object ListCampaignsResponseData: description: Array of campaigns. items: $ref: "#/components/schemas/CampaignResponseData" type: array ListConnectionsResponse: description: Response containing the list of all data source connections configured for an entity. example: data: attributes: connections: - created_at: "0001-01-01T00:00:00Z" created_by: 00000000-0000-0000-0000-000000000000 fields: - description: Customer subscription tier display_name: Customer Tier groups: - Business - Subscription id: customer_tier source_name: subscription_tier type: string - description: Channel through which user signed up display_name: Signup Source groups: - Marketing - Attribution id: signup_source source_name: acquisition_channel type: string id: user-profiles-connection join: attribute: user_email type: email type: ref_table updated_at: "0001-01-01T00:00:00Z" updated_by: 00000000-0000-0000-0000-000000000000 id: list_connections_response type: list_connections_response properties: data: $ref: "#/components/schemas/ListConnectionsResponseData" type: object ListConnectionsResponseData: description: The data object containing the resource type and attributes for the list connections response. properties: attributes: $ref: "#/components/schemas/ListConnectionsResponseDataAttributes" id: description: Unique identifier for the list connections response resource. type: string type: $ref: "#/components/schemas/ListConnectionsResponseDataType" required: - type type: object ListConnectionsResponseDataAttributes: description: Attributes of the list connections response, containing the collection of data source connections. properties: connections: description: The list of data source connections configured for the entity. items: $ref: "#/components/schemas/ListConnectionsResponseDataAttributesConnectionsItems" type: array type: object ListConnectionsResponseDataAttributesConnectionsItems: description: Details of a single data source connection, including its fields, join configuration, and audit metadata. properties: created_at: description: Timestamp indicating when the connection was created. format: date-time type: string created_by: description: Identifier of the user who created the connection. type: string details: $ref: "#/components/schemas/ListConnectionsResponseDataAttributesConnectionsItemsDetails" fields: description: List of custom attribute fields imported from the data source. items: $ref: "#/components/schemas/CreateConnectionRequestDataAttributesFieldsItems" type: array id: description: Unique identifier of the connection. type: string join: $ref: "#/components/schemas/ListConnectionsResponseDataAttributesConnectionsItemsJoin" metadata: additionalProperties: type: string description: Additional key-value metadata associated with the connection. type: object name: description: Display name of the connection. type: string type: description: The type of data source connection (for example, ref_table). type: string updated_at: description: Timestamp indicating when the connection was last updated. format: date-time type: string updated_by: description: Identifier of the user who last updated the connection. type: string type: object ListConnectionsResponseDataAttributesConnectionsItemsDetails: description: Type-specific configuration of the connection. Only the field matching the connection type is set. properties: ref_table: $ref: "#/components/schemas/ListConnectionsResponseDataAttributesConnectionsItemsDetailsRefTable" snowflake: $ref: "#/components/schemas/ListConnectionsResponseDataAttributesConnectionsItemsDetailsSnowflake" type: object ListConnectionsResponseDataAttributesConnectionsItemsDetailsRefTable: description: Configuration of a reference table connection. properties: table_id: description: Identifier of the reference table. type: string table_name: description: Name of the reference table. type: string type: object ListConnectionsResponseDataAttributesConnectionsItemsDetailsSnowflake: description: Configuration of a Snowflake connection. properties: account_id: description: Identifier of the Snowflake account. type: string database_name: description: Name of the Snowflake database. type: string schema: description: Name of the Snowflake schema. type: string table_name: description: Name of the Snowflake table. type: string type: object ListConnectionsResponseDataAttributesConnectionsItemsJoin: description: The join configuration describing how the data source is linked to the entity. properties: attribute: description: The entity attribute used as the join key to link records from the data source. type: string type: description: The type of join key used (for example, email or user_id). type: string type: object ListConnectionsResponseDataType: default: list_connections_response description: List connections response resource type. enum: - list_connections_response example: list_connections_response type: string x-enum-varnames: - LIST_CONNECTIONS_RESPONSE ListDashboardsUsageResponse: description: Paginated list of dashboard usage records. properties: data: description: Dashboard usage records, one per dashboard in the caller's organization. items: $ref: "#/components/schemas/DashboardUsage" type: array links: $ref: "#/components/schemas/ListDashboardsUsageResponseLinks" meta: $ref: "#/components/schemas/ListDashboardsUsageResponseMeta" required: - data - meta type: object ListDashboardsUsageResponseLinks: description: Pagination links for a list of dashboard usage records. properties: first: description: Link to the first page. example: "https://api.datadoghq.com/api/v2/dashboards/usage?page[offset]=0&page[limit]=250" type: string last: description: Link to the last page, or `null` if the total is unknown. nullable: true type: string next: description: Link to the next page. Absent when there is no next page. nullable: true type: string prev: description: Link to the previous page. Absent when there is no previous page. nullable: true type: string self: description: Link to the current page. example: "https://api.datadoghq.com/api/v2/dashboards/usage" type: string type: object ListDashboardsUsageResponseMeta: description: Pagination metadata for a list of dashboard usage records. properties: page: $ref: "#/components/schemas/PaginationMetaPage" type: object ListDeploymentRuleResponseData: description: Data for a list of deployment rules. properties: attributes: $ref: "#/components/schemas/ListDeploymentRulesResponseDataAttributes" id: description: Unique identifier of the deployment rule. example: "1111-2222-3333-4444-555566667777" type: string type: $ref: "#/components/schemas/ListDeploymentRulesDataType" required: - type - attributes - id type: object ListDeploymentRulesDataType: description: List deployment rule resource type. enum: - list_deployment_rules example: list_deployment_rules type: string x-enum-varnames: - LIST_DEPLOYMENT_RULES ListDeploymentRulesResponseDataAttributes: description: Attributes of the response for listing deployment rules. properties: rules: description: The list of deployment rules. items: $ref: "#/components/schemas/DeploymentRuleResponseDataAttributes" type: array type: object ListDevicesResponse: description: List devices response. properties: data: description: The list devices response data. items: $ref: "#/components/schemas/DevicesListData" type: array meta: $ref: "#/components/schemas/ListDevicesResponseMetadata" type: object ListDevicesResponseMetadata: description: Object describing meta attributes of response. properties: page: $ref: "#/components/schemas/ListDevicesResponseMetadataPage" type: object ListDevicesResponseMetadataPage: description: Pagination object. properties: total_filtered_count: description: Total count of devices matched by the filter. example: 1 format: int64 type: integer type: object ListDowntimesResponse: description: Response for retrieving all downtimes. properties: data: description: An array of downtimes. items: $ref: "#/components/schemas/DowntimeResponseData" type: array included: description: Array of objects related to the downtimes. items: $ref: "#/components/schemas/DowntimeResponseIncludedItem" type: array meta: $ref: "#/components/schemas/DowntimeMeta" type: object ListEntityCatalogResponse: description: List entity response. properties: data: $ref: "#/components/schemas/EntityResponseData" included: $ref: "#/components/schemas/ListEntityCatalogResponseIncluded" links: $ref: "#/components/schemas/ListEntityCatalogResponseLinks" meta: $ref: "#/components/schemas/EntityResponseMeta" type: object ListEntityCatalogResponseIncluded: description: List entity response included. items: $ref: "#/components/schemas/ListEntityCatalogResponseIncludedItem" type: array ListEntityCatalogResponseIncludedItem: description: List entity response included item. oneOf: - $ref: "#/components/schemas/EntityResponseIncludedSchema" - $ref: "#/components/schemas/EntityResponseIncludedRawSchema" - $ref: "#/components/schemas/EntityResponseIncludedRelatedEntity" - $ref: "#/components/schemas/EntityResponseIncludedOncall" - $ref: "#/components/schemas/EntityResponseIncludedIncident" ListEntityCatalogResponseLinks: description: List entity response links. properties: next: description: Next link. type: string previous: description: Previous link. type: string self: description: Current link. type: string type: object ListEnvironmentsResponse: description: Response containing a list of environments. properties: data: description: List of environments. items: $ref: "#/components/schemas/Environment" type: array meta: $ref: "#/components/schemas/EnvironmentsPaginationMeta" required: - data type: object ListFeatureFlagsResponse: description: Response containing a list of feature flags. properties: data: description: List of feature flags. items: $ref: "#/components/schemas/FeatureFlagListItem" type: array links: $ref: "#/components/schemas/FeatureFlagsPaginationLinks" meta: $ref: "#/components/schemas/FeatureFlagsPaginationMeta" required: - data type: object ListFindingsData: description: Array of findings. items: $ref: "#/components/schemas/Finding" type: array ListFindingsMeta: additionalProperties: false description: Metadata for pagination. properties: page: $ref: "#/components/schemas/ListFindingsPage" snapshot_timestamp: description: The point in time corresponding to the listed findings. example: 1678721573794 format: int64 minimum: 1 type: integer type: object ListFindingsPage: additionalProperties: false description: Pagination and findings count information. properties: cursor: description: The cursor used to paginate requests. example: "eyJhZnRlciI6IkFRQUFBWWJiaEJXQS1OY1dqUUFBQUFCQldXSmlhRUpYUVVGQlJFSktkbTlDTUdaWFRVbDNRVUUiLCJ2YWx1ZXMiOlsiY3JpdGljYWwiXX0=" type: string total_filtered_count: description: The total count of findings after the filter has been applied. example: 213 format: int64 type: integer type: object ListFindingsResponse: description: The expected response schema when listing findings. properties: data: $ref: "#/components/schemas/ListFindingsData" example: - attributes: evaluation: fail resource: "arn:aws:s3:::my-bucket" resource_type: aws_s3_bucket status: high id: "abc-123-xyz" type: finding meta: $ref: "#/components/schemas/ListFindingsMeta" required: - data - meta type: object ListHistoricalJobsResponse: description: List of historical jobs. properties: data: description: Array containing the list of historical jobs. items: $ref: "#/components/schemas/HistoricalJobResponseData" type: array meta: $ref: "#/components/schemas/HistoricalJobListMeta" type: object ListIntegrationsResponse: description: Response containing information about multiple integrations. properties: data: description: Array of integration objects. items: $ref: "#/components/schemas/Integration" type: array required: - data type: object ListInterfaceTagsResponse: description: Response for listing interface tags. properties: data: $ref: "#/components/schemas/ListInterfaceTagsResponseData" type: object ListInterfaceTagsResponseData: description: Response data for listing interface tags. properties: attributes: $ref: "#/components/schemas/ListTagsResponseDataAttributes" id: description: The interface ID example: example:1.2.3.4:1 type: string type: description: The type of the resource. The value should always be tags. type: string type: object ListInvestigationsResponse: description: Response for listing investigations. properties: data: description: List of investigations. items: $ref: "#/components/schemas/ListInvestigationsResponseData" type: array links: $ref: "#/components/schemas/ListInvestigationsResponseLinks" meta: $ref: "#/components/schemas/ListInvestigationsResponseMeta" required: - data - meta - links type: object ListInvestigationsResponseData: description: Data for an investigation list item. properties: attributes: $ref: "#/components/schemas/ListInvestigationsResponseDataAttributes" id: description: The unique identifier of the investigation. example: "a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d" type: string type: $ref: "#/components/schemas/InvestigationType" required: - id - type - attributes type: object ListInvestigationsResponseDataAttributes: description: Attributes of an investigation list item. properties: status: description: The current status of the investigation. example: "conclusive" type: string title: description: The title of the investigation. example: "Monitor alert investigation for web-server-01" type: string required: - status - title type: object ListInvestigationsResponseLinks: description: Pagination links for the list investigations response. properties: first: description: Link to the first page. example: "https://api.datadoghq.com/api/v2/bits-ai/investigations?page[offset]=0&page[limit]=10" type: string last: description: Link to the last page. nullable: true type: string next: description: Link to the next page. example: "https://api.datadoghq.com/api/v2/bits-ai/investigations?page[offset]=10&page[limit]=10" type: string prev: description: Link to the previous page. nullable: true type: string self: description: Link to the current page. example: "https://api.datadoghq.com/api/v2/bits-ai/investigations?page[offset]=0&page[limit]=10" type: string required: - first - next - self type: object ListInvestigationsResponseMeta: description: Metadata for the list investigations response. properties: page: $ref: "#/components/schemas/ListInvestigationsResponseMetaPage" required: - page type: object ListInvestigationsResponseMetaPage: description: Pagination metadata. properties: limit: description: Maximum number of results per page. example: 10 format: int64 type: integer offset: description: Offset of the current page. example: 0 format: int64 type: integer total: description: Total number of investigations. example: 50 format: int64 type: integer required: - total - limit - offset type: object ListKindCatalogResponse: description: List kind response. properties: data: $ref: "#/components/schemas/KindResponseData" meta: $ref: "#/components/schemas/KindResponseMeta" type: object ListNotificationChannelsResponse: description: Response type for listing notification channels for a user properties: data: description: Array of notification channel data objects. items: $ref: "#/components/schemas/NotificationChannelData" type: array type: object ListOnCallNotificationRulesResponse: description: Response type for listing notification rules for a user properties: data: description: Array of notification rule data objects. items: $ref: "#/components/schemas/OnCallNotificationRuleData" type: array included: items: $ref: "#/components/schemas/OnCallNotificationRulesIncluded" type: array type: object ListPersonalAccessTokensResponse: description: Response for a list of access tokens. Includes both personal and service access tokens. properties: data: description: Array of access tokens. Includes both personal and service access tokens. items: $ref: "#/components/schemas/AccessTokenListItem" type: array included: $ref: "#/components/schemas/AccessTokenResponseIncludedArray" meta: $ref: "#/components/schemas/PersonalAccessTokenResponseMeta" type: object ListPipelinesResponse: description: Represents the response payload containing a list of pipelines and associated metadata. properties: data: description: The `schema` `data`. items: $ref: "#/components/schemas/ObservabilityPipelineData" type: array meta: $ref: "#/components/schemas/ListPipelinesResponseMeta" required: - data type: object ListPipelinesResponseMeta: description: Metadata about the response. properties: totalCount: description: The total number of pipelines. example: 42 format: int64 type: integer type: object ListPowerpacksResponse: description: Response object which includes all powerpack configurations. properties: data: description: List of powerpack definitions. items: $ref: "#/components/schemas/PowerpackData" type: array included: description: Array of objects related to the users. items: $ref: "#/components/schemas/User" type: array links: $ref: "#/components/schemas/PowerpackResponseLinks" meta: $ref: "#/components/schemas/PowerpacksResponseMeta" type: object ListRelationCatalogResponse: description: List entity relation response. properties: data: $ref: "#/components/schemas/RelationResponseData" included: $ref: "#/components/schemas/ListRelationCatalogResponseIncluded" links: $ref: "#/components/schemas/ListRelationCatalogResponseLinks" meta: $ref: "#/components/schemas/RelationResponseMeta" type: object ListRelationCatalogResponseIncluded: description: List relation response included entities. items: $ref: "#/components/schemas/EntityData" type: array ListRelationCatalogResponseLinks: description: List relation response links. properties: next: description: Next link. example: "/api/v2/catalog/relation?filter[from_ref]=service:service-catalog&include=entity&page[limit]=2&page[offset]=2" type: string previous: description: Previous link. type: string self: description: Current link. example: "/api/v2/catalog/relation?filter[from_ref]=service:service-catalog&include=entity&page[limit]=2&page[offset]=0" type: string type: object ListRowsResponse: description: Paginated list of reference table rows. example: data: - attributes: values: category: tor intention: suspicious ip_address: 102.130.113.9 id: 102.130.113.9 type: row links: first: "/api/v2/reference-tables/tables//rows/list?page[limit]=100" self: "/api/v2/reference-tables/tables//rows/list?page[continuation_token]=" meta: page: next_continuation_token: eyJzaWQiOjEyMzQ1LCJwayI6ImV4YW1wbGVfcGsifQ== properties: data: description: The rows. items: $ref: "#/components/schemas/TableRowResourceData" type: array links: $ref: "#/components/schemas/ListRowsResponseLinks" meta: $ref: "#/components/schemas/ListRowsResponseMeta" required: - data - links type: object ListRowsResponseLinks: description: Pagination links for the list rows response. properties: first: description: Link to the first page of results. example: "/api/v2/reference-tables/tables//rows/list?page[limit]=100" type: string next: description: Link to the next page of results. Only present when more rows are available. example: "/api/v2/reference-tables/tables//rows/list?page[continuation_token]=" type: string self: description: Link to the current page of results. example: "/api/v2/reference-tables/tables//rows/list?page[continuation_token]=" type: string required: - self - first type: object ListRowsResponseMeta: description: Contains pagination details, including the continuation token for fetching additional rows. properties: page: $ref: "#/components/schemas/ListRowsResponseMetaPage" type: object ListRowsResponseMetaPage: description: Contains the continuation token for navigating to the next page of rows. properties: next_continuation_token: description: >- Opaque token to pass as the `page[continuation_token]` query parameter to fetch the next page of results. Only present when more rows are available. example: eyJzaWQiOjEyMzQ1LCJwayI6ImV4YW1wbGVfcGsifQ== type: string type: object ListRulesResponse: description: Scorecard rules response. properties: data: $ref: "#/components/schemas/ListRulesResponseData" links: $ref: "#/components/schemas/ListRulesResponseLinks" type: object ListRulesResponseData: description: Array of rule details. items: $ref: "#/components/schemas/ListRulesResponseDataItem" type: array ListRulesResponseDataItem: description: Rule details. properties: attributes: $ref: "#/components/schemas/RuleAttributes" id: $ref: "#/components/schemas/RuleId" relationships: $ref: "#/components/schemas/RelationshipToRule" type: $ref: "#/components/schemas/RuleType" type: object ListRulesResponseLinks: description: Links attributes. properties: next: description: |- Link for the next set of rules. example: "/api/v2/scorecard/rules?page%5Blimit%5D=2&page%5Boffset%5D=2&page%5Bsize%5D=2" type: string type: object ListScorecardScoresMeta: description: Pagination metadata for scores. properties: count: description: The number of results returned in this page. format: int64 type: integer limit: description: The page limit. format: int64 type: integer offset: description: The page offset. format: int64 type: integer total: description: The total number of results. format: int64 type: integer type: object ListScorecardScoresResponse: description: A list of scorecard scores for a given aggregation type. properties: data: description: Array of score objects. items: $ref: "#/components/schemas/ScorecardScoreData" type: array links: $ref: "#/components/schemas/ListRulesResponseLinks" meta: $ref: "#/components/schemas/ListScorecardScoresMeta" type: object ListScorecardsResponse: description: Response containing a list of scorecards. properties: data: $ref: "#/components/schemas/ListScorecardsResponseData" required: - data type: object ListScorecardsResponseData: description: Array of scorecards. items: $ref: "#/components/schemas/ScorecardListResponseData" type: array ListSecurityFindingsResponse: description: The expected response schema when listing security findings. properties: data: description: Array of security findings matching the search query. items: $ref: "#/components/schemas/SecurityFindingsData" type: array links: $ref: "#/components/schemas/SecurityFindingsLinks" meta: $ref: "#/components/schemas/SecurityFindingsMeta" type: object ListServiceAccessTokensResponse: description: Response for a list of access tokens. properties: data: description: Array of access tokens. items: $ref: "#/components/schemas/ServiceAccessToken" type: array included: $ref: "#/components/schemas/AccessTokenResponseIncludedArray" meta: $ref: "#/components/schemas/ServiceAccessTokenResponseMeta" type: object ListSharedDashboardsResponse: description: Response containing shared dashboards for a dashboard. properties: data: description: Shared dashboards for the dashboard. items: $ref: "#/components/schemas/SharedDashboardResponse" type: array included: description: Users and dashboards related to the shared dashboards. items: $ref: "#/components/schemas/SharedDashboardIncluded" type: array required: - data - included type: object ListSourcemapsResponse: description: Response containing a paginated list of source maps. properties: data: $ref: "#/components/schemas/SourcemapsData" meta: $ref: "#/components/schemas/SourcemapsListMeta" required: - data type: object ListTagsResponse: description: List tags response. properties: data: $ref: "#/components/schemas/ListTagsResponseData" type: object ListTagsResponseData: description: The list tags response data. properties: attributes: $ref: "#/components/schemas/ListTagsResponseDataAttributes" id: description: The device ID example: example:1.2.3.4 type: string type: description: The type of the resource. The value should always be tags. type: string type: object ListTagsResponseDataAttributes: description: The definition of ListTagsResponseDataAttributes object. properties: by_source: description: The list of device tags grouped by source. items: $ref: "#/components/schemas/DeviceTagsBySource" readOnly: true type: array tags: description: The list of tags example: ["tag:test", "tag:testbis"] items: description: A tag string in `key:value` format. type: string type: array type: object ListTeamsInclude: description: Included related resources optionally requested. enum: - team_links - user_team_permissions type: string x-enum-varnames: - TEAM_LINKS - USER_TEAM_PERMISSIONS ListTeamsSort: description: Specifies the order of the returned teams enum: - name - -name - user_count - -user_count - link_count - -link_count type: string x-enum-varnames: - NAME - _NAME - USER_COUNT - _USER_COUNT - LINK_COUNT - _LINK_COUNT ListVulnerabilitiesResponse: description: The expected response schema when listing vulnerabilities. properties: data: description: List of vulnerabilities. items: $ref: "#/components/schemas/Vulnerability" type: array links: $ref: "#/components/schemas/Links" meta: $ref: "#/components/schemas/Metadata" required: - data type: object ListVulnerableAssetsResponse: description: The expected response schema when listing vulnerable assets. properties: data: description: List of vulnerable assets. items: $ref: "#/components/schemas/Asset" type: array links: $ref: "#/components/schemas/Links" meta: $ref: "#/components/schemas/Metadata" required: - data type: object ListWorkflowsResponse: description: The response object for a listing workflows request. properties: data: description: A list of workflows. items: $ref: "#/components/schemas/WorkflowListItem" type: array meta: $ref: "#/components/schemas/ListWorkflowsResponseMeta" type: object ListWorkflowsResponseMeta: description: Metadata for a List Workflows response. properties: page: $ref: "#/components/schemas/ListWorkflowsResponseMetaPage" type: object ListWorkflowsResponseMetaPage: description: Pagination metadata for a List Workflows response. properties: totalCount: description: The total number of workflows in the organization. format: int64 type: integer totalFilteredCount: description: The total number of workflows matching the applied filters. format: int64 type: integer type: object Log: description: Object description of a log after being processed and stored by Datadog. properties: attributes: $ref: "#/components/schemas/LogAttributes" id: description: Unique ID of the Log. example: "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA" type: string type: $ref: "#/components/schemas/LogType" type: object LogAttributes: description: JSON object containing all log attributes and their associated values. properties: attributes: additionalProperties: {} description: JSON object of attributes from your log. example: {"customAttribute": 123, "duration": 2345} type: object host: description: |- Name of the machine from where the logs are being sent. example: "i-0123" type: string message: description: |- The message [reserved attribute](https://docs.datadoghq.com/logs/log_collection/#reserved-attributes) of your log. By default, Datadog ingests the value of the message attribute as the body of the log entry. That value is then highlighted and displayed in the Logstream, where it is indexed for full text search. example: "Host connected to remote" type: string service: description: |- The name of the application or service generating the log events. It is used to switch from Logs to APM, so make sure you define the same value when you use both products. example: "agent" type: string status: description: |- Status of the message associated with your log. example: "INFO" type: string tags: description: Array of tags associated with your log. example: ["team:A"] items: description: Tag associated with your log. type: string type: array timestamp: description: Timestamp of your log. example: "2019-01-02T09:42:36.320Z" format: date-time type: string type: object LogType: default: log description: Type of the event. enum: - log example: "log" type: string x-enum-varnames: - LOG LogsAggregateBucket: description: A bucket values properties: by: additionalProperties: description: The values for each group by description: The key, value pairs for each group by example: {"@state": "success", "@version": "abc"} type: object computes: additionalProperties: $ref: "#/components/schemas/LogsAggregateBucketValue" description: A map of the metric name -> value for regular compute or list of values for a timeseries type: object type: object LogsAggregateBucketValue: description: A bucket value, can be either a timeseries or a single value oneOf: - $ref: "#/components/schemas/LogsAggregateBucketValueSingleString" - $ref: "#/components/schemas/LogsAggregateBucketValueSingleNumber" - $ref: "#/components/schemas/LogsAggregateBucketValueTimeseries" LogsAggregateBucketValueSingleNumber: description: A single number value format: double type: number LogsAggregateBucketValueSingleString: description: A single string value type: string LogsAggregateBucketValueTimeseries: description: A timeseries array items: $ref: "#/components/schemas/LogsAggregateBucketValueTimeseriesPoint" type: array x-generate-alias-as-model: true LogsAggregateBucketValueTimeseriesPoint: description: A timeseries point properties: time: description: The time value for this point example: "2020-06-08T11:55:00Z" type: string value: description: The value for this point example: 19 format: double type: number type: object LogsAggregateRequest: description: The object sent with the request to retrieve a list of logs from your organization. properties: compute: description: The list of metrics or timeseries to compute for the retrieved buckets. items: $ref: "#/components/schemas/LogsCompute" type: array filter: $ref: "#/components/schemas/LogsQueryFilter" group_by: description: The rules for the group by items: $ref: "#/components/schemas/LogsGroupBy" type: array options: $ref: "#/components/schemas/LogsQueryOptions" page: $ref: "#/components/schemas/LogsAggregateRequestPage" type: object LogsAggregateRequestPage: description: Paging settings properties: cursor: description: |- The returned paging point to use to get the next results. Note: at most 1000 results can be paged. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string type: object LogsAggregateResponse: description: The response object for the logs aggregate API endpoint properties: data: $ref: "#/components/schemas/LogsAggregateResponseData" meta: $ref: "#/components/schemas/LogsResponseMetadata" type: object LogsAggregateResponseData: description: The query results properties: buckets: description: The list of matching buckets, one item per bucket items: $ref: "#/components/schemas/LogsAggregateBucket" type: array type: object LogsAggregateResponseStatus: description: The status of the response enum: ["done", "timeout"] example: "done" type: string x-enum-varnames: ["DONE", "TIMEOUT"] LogsAggregateSort: description: A sort rule example: {"aggregation": "count", "order": "asc"} properties: aggregation: $ref: "#/components/schemas/LogsAggregationFunction" metric: description: The metric to sort by (only used for `type=measure`) example: "@duration" type: string order: $ref: "#/components/schemas/LogsSortOrder" type: $ref: "#/components/schemas/LogsAggregateSortType" type: object LogsAggregateSortType: default: "alphabetical" description: The type of sorting algorithm enum: ["alphabetical", "measure"] type: string x-enum-varnames: ["ALPHABETICAL", "MEASURE"] LogsAggregationFunction: description: An aggregation function enum: ["count", "cardinality", "pc75", "pc90", "pc95", "pc98", "pc99", "sum", "min", "max", "avg", "median"] example: "pc90" type: string x-enum-varnames: ["COUNT", "CARDINALITY", "PERCENTILE_75", "PERCENTILE_90", "PERCENTILE_95", "PERCENTILE_98", "PERCENTILE_99", "SUM", "MIN", "MAX", "AVG", "MEDIAN"] LogsArchive: description: The logs archive. properties: data: $ref: "#/components/schemas/LogsArchiveDefinition" type: object LogsArchiveAttributes: description: The attributes associated with the archive. properties: compression_method: $ref: "#/components/schemas/LogsArchiveAttributesCompressionMethod" destination: $ref: "#/components/schemas/LogsArchiveDestination" include_tags: default: false description: |- To store the tags in the archive, set the value "true". If it is set to "false", the tags will be deleted when the logs are sent to the archive. example: false type: boolean lookup_attributes: description: An array of attributes to use as lookup keys for the archive. example: ["trace_id", "user_id"] items: description: A lookup attribute name. type: string type: array name: description: The archive name. example: Nginx Archive type: string partitioning_attributes: description: An array of attributes to use as partition keys for the archive. The attribute used most frequently for querying should be first. example: ["service", "status"] items: description: A partition attribute name. type: string type: array query: description: The archive query/filter. Logs matching this query are included in the archive. example: source:nginx type: string rehydration_max_scan_size_in_gb: description: Maximum scan size for rehydration from this archive. example: 100 format: int64 nullable: true type: integer rehydration_tags: description: An array of tags to add to rehydrated logs from an archive. example: ["team:intake", "team:app"] items: description: A given tag in the `:` format. type: string type: array state: $ref: "#/components/schemas/LogsArchiveState" required: - name - query - destination type: object LogsArchiveAttributesCompressionMethod: default: ZSTD description: The type of compression for the archive. enum: - GZIP - ZSTD example: ZSTD type: string x-enum-varnames: - GZIP - ZSTD LogsArchiveCreateRequest: description: The logs archive. properties: data: $ref: "#/components/schemas/LogsArchiveCreateRequestDefinition" type: object LogsArchiveCreateRequestAttributes: description: The attributes associated with the archive. properties: compression_method: $ref: "#/components/schemas/LogsArchiveAttributesCompressionMethod" destination: $ref: "#/components/schemas/LogsArchiveCreateRequestDestination" include_tags: default: false description: |- To store the tags in the archive, set the value "true". If it is set to "false", the tags will be deleted when the logs are sent to the archive. example: false type: boolean lookup_attributes: description: An array of attributes to use as lookup keys for the archive. example: ["trace_id", "user_id"] items: description: A lookup attribute name. type: string type: array name: description: The archive name. example: Nginx Archive type: string partitioning_attributes: description: An array of attributes to use as partition keys for the archive. The attribute used most frequently for querying should be first. example: ["service", "status"] items: description: A partition attribute name. type: string type: array query: description: The archive query/filter. Logs matching this query are included in the archive. example: source:nginx type: string rehydration_max_scan_size_in_gb: description: Maximum scan size for rehydration from this archive. example: 100 format: int64 nullable: true type: integer rehydration_tags: description: An array of tags to add to rehydrated logs from an archive. example: ["team:intake", "team:app"] items: description: A given tag in the `:` format. type: string type: array required: - name - query - destination type: object LogsArchiveCreateRequestDefinition: description: The definition of an archive. properties: attributes: $ref: "#/components/schemas/LogsArchiveCreateRequestAttributes" type: default: archives description: The type of the resource. The value should always be archives. example: archives type: string required: - type type: object LogsArchiveCreateRequestDestination: description: An archive's destination. oneOf: - $ref: "#/components/schemas/LogsArchiveDestinationAzure" - $ref: "#/components/schemas/LogsArchiveDestinationGCS" - $ref: "#/components/schemas/LogsArchiveDestinationS3" LogsArchiveDefinition: description: The definition of an archive. properties: attributes: $ref: "#/components/schemas/LogsArchiveAttributes" id: description: The archive ID. example: a2zcMylnM4OCHpYusxIi3g readOnly: true type: string type: default: archives description: The type of the resource. The value should always be archives. example: archives readOnly: true type: string required: - type type: object LogsArchiveDestination: description: An archive's destination. nullable: true oneOf: - $ref: "#/components/schemas/LogsArchiveDestinationAzure" - $ref: "#/components/schemas/LogsArchiveDestinationGCS" - $ref: "#/components/schemas/LogsArchiveDestinationS3" type: object LogsArchiveDestinationAzure: description: The Azure archive destination. properties: container: description: The container where the archive will be stored. example: container-name type: string integration: $ref: "#/components/schemas/LogsArchiveIntegrationAzure" path: description: The archive path. type: string region: description: The region where the archive will be stored. type: string storage_account: description: The associated storage account. example: account-name type: string type: $ref: "#/components/schemas/LogsArchiveDestinationAzureType" required: - storage_account - container - integration - type type: object LogsArchiveDestinationAzureType: default: azure description: Type of the Azure archive destination. enum: - azure example: azure type: string x-enum-varnames: - AZURE LogsArchiveDestinationGCS: description: The GCS archive destination. properties: bucket: description: The bucket where the archive will be stored. example: bucket-name type: string integration: $ref: "#/components/schemas/LogsArchiveIntegrationGCS" path: description: The archive path. type: string type: $ref: "#/components/schemas/LogsArchiveDestinationGCSType" required: - bucket - integration - type type: object LogsArchiveDestinationGCSType: default: gcs description: Type of the GCS archive destination. enum: - gcs example: gcs type: string x-enum-varnames: - GCS LogsArchiveDestinationS3: description: The S3 archive destination. properties: bucket: description: The bucket where the archive will be stored. example: bucket-name type: string encryption: $ref: "#/components/schemas/LogsArchiveEncryptionS3" integration: $ref: "#/components/schemas/LogsArchiveIntegrationS3" path: description: The archive path. type: string storage_class: $ref: "#/components/schemas/LogsArchiveStorageClassS3Type" type: $ref: "#/components/schemas/LogsArchiveDestinationS3Type" required: - bucket - integration - type type: object LogsArchiveDestinationS3Type: default: s3 description: Type of the S3 archive destination. enum: - s3 example: s3 type: string x-enum-varnames: - S3 LogsArchiveEncryptionS3: description: The S3 encryption settings. properties: key: description: An Amazon Resource Name (ARN) used to identify an AWS KMS key. example: arn:aws:kms:us-east-1:012345678901:key/DatadogIntegrationRoleKms type: string type: $ref: "#/components/schemas/LogsArchiveEncryptionS3Type" required: - type type: object LogsArchiveEncryptionS3Type: description: Type of S3 encryption for a destination. enum: - NO_OVERRIDE - SSE_S3 - SSE_KMS example: SSE_S3 type: string x-enum-varnames: - NO_OVERRIDE - SSE_S3 - SSE_KMS LogsArchiveIntegrationAzure: description: The Azure archive's integration destination. properties: client_id: description: A client ID. example: aaaaaaaa-1a1a-1a1a-1a1a-aaaaaaaaaaaa type: string tenant_id: description: A tenant ID. example: aaaaaaaa-1a1a-1a1a-1a1a-aaaaaaaaaaaa type: string required: - tenant_id - client_id type: object LogsArchiveIntegrationGCS: description: The GCS archive's integration destination. properties: client_email: description: A client email. example: youremail@example.com type: string project_id: description: A project ID. example: project-id type: string required: - client_email type: object LogsArchiveIntegrationS3: description: >- The S3 Archive's integration destination. You must provide one of the following: `access_key_id` alone, or both `account_id` and `role_name` together. oneOf: - $ref: "#/components/schemas/LogsArchiveIntegrationS3AccessKey" - $ref: "#/components/schemas/LogsArchiveIntegrationS3Role" LogsArchiveIntegrationS3AccessKey: description: The S3 Archive's integration destination using an access key. properties: access_key_id: description: The access key ID for the integration. example: AKIAIOSFODNN7EXAMPLE type: string required: - access_key_id type: object LogsArchiveIntegrationS3Role: description: The S3 Archive's integration destination using an IAM role. properties: account_id: description: The account ID for the integration. example: "123456789012" type: string role_name: description: The name of the role to assume for the integration. example: role-name type: string required: - account_id - role_name type: object LogsArchiveOrder: description: A ordered list of archive IDs. properties: data: $ref: "#/components/schemas/LogsArchiveOrderDefinition" type: object LogsArchiveOrderAttributes: description: The attributes associated with the archive order. properties: archive_ids: description: |- An ordered array of `` strings, the order of archive IDs in the array define the overall archives order for Datadog. example: ["a2zcMylnM4OCHpYusxIi1g", "a2zcMylnM4OCHpYusxIi2g", "a2zcMylnM4OCHpYusxIi3g"] items: description: A given archive ID. type: string type: array required: - archive_ids type: object LogsArchiveOrderDefinition: description: The definition of an archive order. properties: attributes: $ref: "#/components/schemas/LogsArchiveOrderAttributes" type: $ref: "#/components/schemas/LogsArchiveOrderDefinitionType" required: - type - attributes type: object LogsArchiveOrderDefinitionType: default: archive_order description: Type of the archive order definition. enum: - archive_order example: archive_order type: string x-enum-varnames: - ARCHIVE_ORDER LogsArchiveState: description: The state of the archive. enum: - UNKNOWN - WORKING - FAILING - WORKING_AUTH_LEGACY example: WORKING type: string x-enum-varnames: - UNKNOWN - WORKING - FAILING - WORKING_AUTH_LEGACY LogsArchiveStorageClassS3Type: default: STANDARD description: The storage class where the archive will be stored. enum: - STANDARD - STANDARD_IA - ONEZONE_IA - INTELLIGENT_TIERING - GLACIER_IR example: STANDARD type: string x-enum-varnames: - STANDARD - STANDARD_IA - ONEZONE_IA - INTELLIGENT_TIERING - GLACIER_IR LogsArchives: description: The available archives. properties: data: description: A list of archives. items: $ref: "#/components/schemas/LogsArchiveDefinition" type: array type: object LogsCompute: description: A compute rule to compute metrics or timeseries properties: aggregation: $ref: "#/components/schemas/LogsAggregationFunction" interval: description: |- The time buckets' size (only used for type=timeseries) Defaults to a resolution of 150 points example: "5m" type: string metric: description: The metric to use example: "@duration" type: string type: $ref: "#/components/schemas/LogsComputeType" required: - aggregation type: object LogsComputeType: default: "total" description: The type of compute enum: ["timeseries", "total"] type: string x-enum-varnames: ["TIMESERIES", "TOTAL"] LogsGroupBy: description: A group by rule properties: facet: description: The name of the facet to use (required) example: "host" type: string histogram: $ref: "#/components/schemas/LogsGroupByHistogram" limit: default: 10 description: |- The maximum buckets to return for this group by. Note: at most 10000 buckets are allowed. If grouping by multiple facets, the product of limits must not exceed 10000. format: int64 type: integer missing: $ref: "#/components/schemas/LogsGroupByMissing" sort: $ref: "#/components/schemas/LogsAggregateSort" total: $ref: "#/components/schemas/LogsGroupByTotal" required: - facet type: object LogsGroupByHistogram: description: |- Used to perform a histogram computation (only for measure facets). Note: at most 100 buckets are allowed, the number of buckets is (max - min)/interval. properties: interval: description: The bin size of the histogram buckets example: 10 format: double type: number max: description: |- The maximum value for the measure used in the histogram (values greater than this one are filtered out) example: 100 format: double type: number min: description: |- The minimum value for the measure used in the histogram (values smaller than this one are filtered out) example: 50 format: double type: number required: - interval - min - max type: object LogsGroupByMissing: description: The value to use for logs that don't have the facet used to group by oneOf: - $ref: "#/components/schemas/LogsGroupByMissingString" - $ref: "#/components/schemas/LogsGroupByMissingNumber" LogsGroupByMissingNumber: description: The missing value to use if there is a number valued facet. format: double type: number LogsGroupByMissingString: description: The missing value to use if there is string valued facet. type: string LogsGroupByTotal: default: false description: |- A resulting object to put the given computes in over all the matching records. oneOf: - $ref: "#/components/schemas/LogsGroupByTotalBoolean" - $ref: "#/components/schemas/LogsGroupByTotalString" - $ref: "#/components/schemas/LogsGroupByTotalNumber" LogsGroupByTotalBoolean: description: If set to true, creates an additional bucket labeled "$facet_total" type: boolean LogsGroupByTotalNumber: description: A number to use as the key value for the total bucket format: double type: number LogsGroupByTotalString: description: A string to use as the key value for the total bucket type: string LogsListRequest: description: The request for a logs list. properties: filter: $ref: "#/components/schemas/LogsQueryFilter" options: $ref: "#/components/schemas/LogsQueryOptions" page: $ref: "#/components/schemas/LogsListRequestPage" sort: $ref: "#/components/schemas/LogsSort" type: object LogsListRequestPage: description: Paging attributes for listing logs. properties: cursor: description: |- List following results with a cursor provided in the previous query. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string limit: default: 10 description: Requested maximum number of logs in the response. example: 25 format: int32 maximum: 5000 type: integer type: object LogsListResponse: description: Response object with all logs matching the request and pagination information. properties: data: description: Array of logs matching the request. items: $ref: "#/components/schemas/Log" type: array links: $ref: "#/components/schemas/LogsListResponseLinks" meta: $ref: "#/components/schemas/LogsResponseMetadata" type: object LogsListResponseLinks: description: Links attributes. properties: next: description: |- Link for the next set of results. Note that the request can also be made using the POST endpoint. example: "https://app.datadoghq.com/api/v2/logs/event?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string type: object LogsMetricCompute: description: The compute rule to compute the log-based metric. properties: aggregation_type: $ref: "#/components/schemas/LogsMetricComputeAggregationType" include_percentiles: $ref: "#/components/schemas/LogsMetricComputeIncludePercentiles" path: description: The path to the value the log-based metric will aggregate on (only used if the aggregation type is a "distribution"). example: "@duration" type: string required: - aggregation_type type: object LogsMetricComputeAggregationType: description: The type of aggregation to use. enum: ["count", "distribution"] example: "distribution" type: string x-enum-varnames: ["COUNT", "DISTRIBUTION"] LogsMetricComputeIncludePercentiles: description: |- Toggle to include or exclude percentile aggregations for distribution metrics. Only present when the `aggregation_type` is `distribution`. example: true type: boolean LogsMetricCreateAttributes: description: The object describing the Datadog log-based metric to create. properties: compute: $ref: "#/components/schemas/LogsMetricCompute" filter: $ref: "#/components/schemas/LogsMetricFilter" group_by: description: The rules for the group by. items: $ref: "#/components/schemas/LogsMetricGroupBy" type: array required: - compute type: object LogsMetricCreateData: description: The new log-based metric properties. properties: attributes: $ref: "#/components/schemas/LogsMetricCreateAttributes" id: $ref: "#/components/schemas/LogsMetricID" type: $ref: "#/components/schemas/LogsMetricType" required: - id - type - attributes type: object LogsMetricCreateRequest: description: The new log-based metric body. properties: data: $ref: "#/components/schemas/LogsMetricCreateData" required: - data type: object LogsMetricFilter: description: The log-based metric filter. Logs matching this filter will be aggregated in this metric. properties: query: default: "*" description: The search query - following the log search syntax. example: "service:web-api AND @http.status_code:[200 TO 299]" type: string type: object LogsMetricGroupBy: description: A group by rule. properties: path: description: The path to the value the log-based metric will be aggregated over. example: "@http.status_code" type: string tag_name: description: Eventual name of the tag that gets created. By default, the path attribute is used as the tag name. example: "status_code" type: string required: - path type: object LogsMetricID: description: The name of the log-based metric. example: "logs.page.load.count" type: string LogsMetricResponse: description: The log-based metric object. properties: data: $ref: "#/components/schemas/LogsMetricResponseData" type: object LogsMetricResponseAttributes: description: The object describing a Datadog log-based metric. properties: compute: $ref: "#/components/schemas/LogsMetricResponseCompute" filter: $ref: "#/components/schemas/LogsMetricResponseFilter" group_by: description: The rules for the group by. items: $ref: "#/components/schemas/LogsMetricResponseGroupBy" type: array type: object LogsMetricResponseCompute: description: The compute rule to compute the log-based metric. properties: aggregation_type: $ref: "#/components/schemas/LogsMetricResponseComputeAggregationType" include_percentiles: $ref: "#/components/schemas/LogsMetricComputeIncludePercentiles" path: description: The path to the value the log-based metric will aggregate on (only used if the aggregation type is a "distribution"). example: "@duration" type: string type: object LogsMetricResponseComputeAggregationType: description: The type of aggregation to use. enum: ["count", "distribution"] example: "distribution" type: string x-enum-varnames: ["COUNT", "DISTRIBUTION"] LogsMetricResponseData: description: The log-based metric properties. properties: attributes: $ref: "#/components/schemas/LogsMetricResponseAttributes" id: $ref: "#/components/schemas/LogsMetricID" type: $ref: "#/components/schemas/LogsMetricType" type: object LogsMetricResponseFilter: description: The log-based metric filter. Logs matching this filter will be aggregated in this metric. properties: query: description: The search query - following the log search syntax. example: "service:web-api AND @http.status_code:[200 TO 299]" type: string type: object LogsMetricResponseGroupBy: description: A group by rule. properties: path: description: The path to the value the log-based metric will be aggregated over. example: "@http.status_code" type: string tag_name: description: Eventual name of the tag that gets created. By default, the path attribute is used as the tag name. example: "status_code" type: string type: object LogsMetricType: default: logs_metrics description: The type of the resource. The value should always be logs_metrics. enum: - logs_metrics example: logs_metrics type: string x-enum-varnames: ["LOGS_METRICS"] LogsMetricUpdateAttributes: description: The log-based metric properties that will be updated. properties: compute: $ref: "#/components/schemas/LogsMetricUpdateCompute" filter: $ref: "#/components/schemas/LogsMetricFilter" group_by: description: The rules for the group by. items: $ref: "#/components/schemas/LogsMetricGroupBy" type: array type: object LogsMetricUpdateCompute: description: The compute rule to compute the log-based metric. properties: include_percentiles: $ref: "#/components/schemas/LogsMetricComputeIncludePercentiles" type: object LogsMetricUpdateData: description: The new log-based metric properties. properties: attributes: $ref: "#/components/schemas/LogsMetricUpdateAttributes" type: $ref: "#/components/schemas/LogsMetricType" required: - type - attributes type: object LogsMetricUpdateRequest: description: The new log-based metric body. properties: data: $ref: "#/components/schemas/LogsMetricUpdateData" required: - data type: object LogsMetricsResponse: description: All the available log-based metric objects. properties: data: description: A list of log-based metric objects. items: $ref: "#/components/schemas/LogsMetricResponseData" type: array type: object LogsQueryFilter: description: The search and filter query settings properties: from: default: "now-15m" description: The minimum time for the requested logs, supports date math and regular timestamps (milliseconds). example: "now-15m" type: string indexes: default: ["*"] description: For customers with multiple indexes, the indexes to search. Defaults to ['*'] which means all indexes. example: ["main", "web"] items: description: The name of a log index. type: string type: array query: default: "*" description: The search query - following the log search syntax. example: "service:web-api AND @http.status_code:[200 TO 299]" type: string storage_tier: $ref: "#/components/schemas/LogsStorageTier" to: default: "now" description: The maximum time for the requested logs, supports date math and regular timestamps (milliseconds). example: "now" type: string type: object LogsQueryOptions: deprecated: true description: |- Global query options that are used during the query. Note: These fields are currently deprecated and do not affect the query results. properties: timeOffset: description: The time offset (in seconds) to apply to the query. format: int64 type: integer timezone: default: "UTC" description: |- The timezone can be specified as GMT, UTC, an offset from UTC (like UTC+1), or as a Timezone Database identifier (like America/New_York). example: "GMT" type: string type: object LogsResponseMetadata: description: The metadata associated with a request properties: elapsed: description: The time elapsed in milliseconds example: 132 format: int64 type: integer page: $ref: "#/components/schemas/LogsResponseMetadataPage" request_id: description: The identifier of the request example: "MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR" type: string status: $ref: "#/components/schemas/LogsAggregateResponseStatus" warnings: description: |- A list of warnings (non fatal errors) encountered, partial results might be returned if warnings are present in the response. items: $ref: "#/components/schemas/LogsWarning" type: array type: object LogsResponseMetadataPage: description: Paging attributes. properties: after: description: |- The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of the `page[cursor]`. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string type: object LogsRestrictionQueriesType: default: logs_restriction_queries description: Restriction query resource type. enum: - logs_restriction_queries example: logs_restriction_queries type: string x-enum-varnames: - LOGS_RESTRICTION_QUERIES LogsSort: description: Sort parameters when querying logs. enum: - timestamp - -timestamp type: string x-enum-varnames: - TIMESTAMP_ASCENDING - TIMESTAMP_DESCENDING LogsSortOrder: description: The order to use, ascending or descending enum: - "asc" - "desc" example: "asc" type: string x-enum-varnames: - "ASCENDING" - "DESCENDING" LogsStorageTier: default: "indexes" description: Specifies storage type as indexes, online-archives or flex enum: ["indexes", "online-archives", "flex"] example: "indexes" type: string x-enum-varnames: ["INDEXES", "ONLINE_ARCHIVES", "FLEX"] LogsWarning: description: A warning message indicating something that went wrong with the query properties: code: description: A unique code for this type of warning example: "unknown_index" type: string detail: description: A detailed explanation of this specific warning example: "indexes: foo, bar" type: string title: description: A short human-readable summary of the warning example: "One or several indexes are missing or invalid, results hold data from the other indexes" type: string type: object LongTaskMetricStats: description: Statistical distribution (average, min, max) of a long task metric across sampled views. properties: average: description: Average value across sampled views. example: 3504.1 format: double type: number max: description: Maximum value across sampled views. example: 3517.8 format: double type: number min: description: Minimum value across sampled views. example: 3500.1 format: double type: number required: - average - min - max type: object LongTaskStatsPerView: description: Statistical distributions of long task metrics computed per view across sampled views. properties: fcp_blocking_time_ms: $ref: "#/components/schemas/LongTaskMetricStats" fcp_count: $ref: "#/components/schemas/LongTaskMetricStats" inp_overlap_blocking_time_ms: $ref: "#/components/schemas/LongTaskMetricStats" inp_overlap_count: $ref: "#/components/schemas/LongTaskMetricStats" lcp_blocking_time_ms: $ref: "#/components/schemas/LongTaskMetricStats" lcp_count: $ref: "#/components/schemas/LongTaskMetricStats" loading_time_blocking_time_ms: $ref: "#/components/schemas/LongTaskMetricStats" loading_time_count: $ref: "#/components/schemas/LongTaskMetricStats" total_blocking_time_ms: $ref: "#/components/schemas/LongTaskMetricStats" total_count: $ref: "#/components/schemas/LongTaskMetricStats" type: object MSTeamsIntegrationMetadata: description: Incident integration metadata for the Microsoft Teams integration. properties: teams: description: Array of Microsoft Teams in this integration metadata. example: [] items: $ref: "#/components/schemas/MSTeamsIntegrationMetadataTeamsItem" type: array required: - teams type: object MSTeamsIntegrationMetadataTeamsItem: description: Item in the Microsoft Teams integration metadata teams array. properties: ms_channel_id: description: Microsoft Teams channel ID. example: 19:abc00abcdef00a0abcdef0abcdef0a@thread.tacv2 type: string ms_channel_name: description: Microsoft Teams channel name. example: incident-0001-example type: string ms_tenant_id: description: Microsoft Teams tenant ID. example: 00000000-abcd-0005-0000-000000000000 type: string redirect_url: description: URL redirecting to the Microsoft Teams channel. example: https://teams.microsoft.com/l/channel/19%3Aabc00abcdef00a0abcdef0abcdef0a%40thread.tacv2/conversations?groupId=12345678-abcd-dcba-abcd-1234567890ab&tenantId=00000000-abcd-0005-0000-000000000000 type: string required: - ms_tenant_id - ms_channel_id - ms_channel_name - redirect_url type: object Maintenance: description: Response object for a single maintenance. properties: data: $ref: "#/components/schemas/MaintenanceData" included: description: The included related resources of a maintenance. Client must explicitly request these resources by name in the `include` query parameter. items: $ref: "#/components/schemas/DegradationIncluded" type: array type: object MaintenanceArray: description: Response object for a list of maintenances. properties: data: description: A list of maintenance data objects. items: $ref: "#/components/schemas/MaintenanceData" type: array included: description: The included related resources of a maintenance. Client must explicitly request these resources by name in the `include` query parameter. items: $ref: "#/components/schemas/DegradationIncluded" type: array meta: $ref: "#/components/schemas/PaginationMeta" required: - data type: object MaintenanceData: description: The data object for a maintenance. properties: attributes: $ref: "#/components/schemas/MaintenanceDataAttributes" id: description: The ID of the maintenance. format: uuid type: string relationships: $ref: "#/components/schemas/MaintenanceDataRelationships" type: $ref: "#/components/schemas/PatchMaintenanceRequestDataType" required: - type type: object MaintenanceDataAttributes: description: The attributes of a maintenance. properties: canceled_description: description: The description shown when the maintenance is canceled. type: string completed_date: description: Timestamp of when the maintenance was completed. format: date-time type: string completed_description: description: The description shown when the maintenance is completed. type: string components_affected: description: Components affected by the maintenance. items: $ref: "#/components/schemas/MaintenanceDataAttributesComponentsAffectedItems" type: array in_progress_description: description: The description shown while the maintenance is in progress. type: string is_backfilled: description: Whether the maintenance was backfilled. type: boolean modified_at: description: Timestamp of when the maintenance was last modified. format: date-time type: string published_date: description: Timestamp of when the maintenance was published. format: date-time type: string scheduled_description: description: The description shown when the maintenance is scheduled. type: string start_date: description: Timestamp of when the maintenance is scheduled to start. format: date-time type: string status: $ref: "#/components/schemas/MaintenanceDataAttributesStatus" description: The status of the maintenance. title: description: Title of the maintenance. type: string updates: description: Past updates made to the maintenance. items: $ref: "#/components/schemas/MaintenanceDataAttributesUpdatesItems" type: array type: object MaintenanceDataAttributesComponentsAffectedItems: description: A component affected by a maintenance. properties: id: description: The ID of the component. Must be a component of type `component`. example: "1234abcd-12ab-34cd-56ef-123456abcdef" format: uuid type: string name: description: The name of the component. readOnly: true type: string status: $ref: "#/components/schemas/PatchMaintenanceRequestDataAttributesComponentsAffectedItemsStatus" required: - id - status type: object MaintenanceDataAttributesStatus: description: The status of the maintenance. enum: - scheduled - in_progress - completed type: string x-enum-varnames: - SCHEDULED - IN_PROGRESS - COMPLETED MaintenanceDataAttributesUpdatesItems: description: An update made to a maintenance. properties: components_affected: description: The components affected at the time of the update. items: $ref: "#/components/schemas/MaintenanceDataAttributesUpdatesItemsComponentsAffectedItems" type: array created_at: description: Timestamp of when the update was created. format: date-time readOnly: true type: string description: description: Description of the update. type: string id: description: Identifier of the update. format: uuid readOnly: true type: string manual_transition: description: Whether the update was applied manually by a user (true) or automatically by the system (false). readOnly: true type: boolean modified_at: description: Timestamp of when the update was last modified. format: date-time readOnly: true type: string started_at: description: Timestamp of when the update started. format: date-time type: string status: description: The status of the update. type: string type: object MaintenanceDataAttributesUpdatesItemsComponentsAffectedItems: description: A component affected at the time of a maintenance update. properties: id: description: Identifier of the component affected at the time of the update. example: "1234abcd-12ab-34cd-56ef-123456abcdef" format: uuid type: string name: description: The name of the component affected at the time of the update. readOnly: true type: string status: $ref: "#/components/schemas/PatchMaintenanceRequestDataAttributesComponentsAffectedItemsStatus" description: The status of the component affected at the time of the update. required: - id - status type: object MaintenanceDataRelationships: description: The relationships of a maintenance. properties: created_by_user: $ref: "#/components/schemas/MaintenanceDataRelationshipsCreatedByUser" description: The Datadog user who created the maintenance. last_modified_by_user: $ref: "#/components/schemas/MaintenanceDataRelationshipsLastModifiedByUser" description: The Datadog user who last modified the maintenance. status_page: $ref: "#/components/schemas/MaintenanceDataRelationshipsStatusPage" description: The status page the maintenance belongs to. template: $ref: "#/components/schemas/MaintenanceDataRelationshipsTemplate" description: The template the maintenance was created from. type: object MaintenanceDataRelationshipsCreatedByUser: description: The Datadog user who created the maintenance. properties: data: $ref: "#/components/schemas/MaintenanceDataRelationshipsCreatedByUserData" required: - data type: object MaintenanceDataRelationshipsCreatedByUserData: description: The data object identifying the Datadog user who created the maintenance. properties: id: description: The ID of the Datadog user who created the maintenance. example: "" format: uuid type: string type: $ref: "#/components/schemas/StatusPagesUserType" required: - type - id type: object MaintenanceDataRelationshipsLastModifiedByUser: description: The Datadog user who last modified the maintenance. properties: data: $ref: "#/components/schemas/MaintenanceDataRelationshipsLastModifiedByUserData" required: - data type: object MaintenanceDataRelationshipsLastModifiedByUserData: description: The data object identifying the Datadog user who last modified the maintenance. properties: id: description: The ID of the Datadog user who last modified the maintenance. example: "" format: uuid type: string type: $ref: "#/components/schemas/StatusPagesUserType" required: - type - id type: object MaintenanceDataRelationshipsStatusPage: description: The status page the maintenance belongs to. properties: data: $ref: "#/components/schemas/MaintenanceDataRelationshipsStatusPageData" required: - data type: object MaintenanceDataRelationshipsStatusPageData: description: The data object identifying the status page associated with a maintenance. properties: id: description: The ID of the status page. example: "" format: uuid type: string type: $ref: "#/components/schemas/StatusPageDataType" required: - type - id type: object MaintenanceDataRelationshipsTemplate: description: The template the maintenance was created from. properties: data: $ref: "#/components/schemas/MaintenanceDataRelationshipsTemplateData" required: - data type: object MaintenanceDataRelationshipsTemplateData: description: The data object identifying the template the maintenance was created from. properties: id: description: The ID of the maintenance template. example: "" type: string type: $ref: "#/components/schemas/PatchMaintenanceTemplateRequestDataType" required: - type - id type: object MaintenanceTemplate: description: Response object for a single maintenance template. properties: data: $ref: "#/components/schemas/MaintenanceTemplateData" included: description: The included related resources of a maintenance template. Client must explicitly request these resources by name in the `include` query parameter. items: $ref: "#/components/schemas/DegradationIncluded" type: array type: object MaintenanceTemplateArray: description: Response object for a list of maintenance templates. properties: data: description: A list of maintenance template data objects. items: $ref: "#/components/schemas/MaintenanceTemplateData" type: array included: description: The included related resources of a maintenance template. Client must explicitly request these resources by name in the `include` query parameter. items: $ref: "#/components/schemas/DegradationIncluded" type: array required: - data type: object MaintenanceTemplateData: description: The data object for a maintenance template. properties: attributes: $ref: "#/components/schemas/MaintenanceTemplateDataAttributes" id: description: The ID of the maintenance template. type: string relationships: $ref: "#/components/schemas/MaintenanceTemplateDataRelationships" type: $ref: "#/components/schemas/PatchMaintenanceTemplateRequestDataType" required: - type type: object MaintenanceTemplateDataAttributes: description: The attributes of a maintenance template. properties: completed_description: description: The description shown when a maintenance created from this template is completed. type: string component_ids: description: The IDs of the components affected by a maintenance created from this template. items: type: string type: array created_at: description: Timestamp of when the maintenance template was created. format: date-time type: string in_progress_description: description: The description shown while a maintenance created from this template is in progress. type: string maintenance_title: description: The title used for a maintenance created from this template. type: string modified_at: description: Timestamp of when the maintenance template was last modified. format: date-time type: string name: description: The name of the maintenance template. type: string scheduled_description: description: The description shown when a maintenance created from this template is scheduled. type: string type: object MaintenanceTemplateDataRelationships: description: The relationships of a maintenance template. properties: created_by_user: $ref: "#/components/schemas/MaintenanceTemplateDataRelationshipsCreatedByUser" description: The Datadog user who created the maintenance template. last_modified_by_user: $ref: "#/components/schemas/MaintenanceTemplateDataRelationshipsLastModifiedByUser" description: The Datadog user who last modified the maintenance template. status_page: $ref: "#/components/schemas/MaintenanceTemplateDataRelationshipsStatusPage" description: The status page the maintenance template belongs to. type: object MaintenanceTemplateDataRelationshipsCreatedByUser: description: The Datadog user who created the maintenance template. properties: data: $ref: "#/components/schemas/MaintenanceTemplateDataRelationshipsCreatedByUserData" required: - data type: object MaintenanceTemplateDataRelationshipsCreatedByUserData: description: The data object identifying the Datadog user who created the maintenance template. properties: id: description: The ID of the Datadog user who created the maintenance template. example: "" type: string type: $ref: "#/components/schemas/StatusPagesUserType" required: - type - id type: object MaintenanceTemplateDataRelationshipsLastModifiedByUser: description: The Datadog user who last modified the maintenance template. properties: data: $ref: "#/components/schemas/MaintenanceTemplateDataRelationshipsLastModifiedByUserData" required: - data type: object MaintenanceTemplateDataRelationshipsLastModifiedByUserData: description: The data object identifying the Datadog user who last modified the maintenance template. properties: id: description: The ID of the Datadog user who last modified the maintenance template. example: "" type: string type: $ref: "#/components/schemas/StatusPagesUserType" required: - type - id type: object MaintenanceTemplateDataRelationshipsStatusPage: description: The status page the maintenance template belongs to. properties: data: $ref: "#/components/schemas/MaintenanceTemplateDataRelationshipsStatusPageData" required: - data type: object MaintenanceTemplateDataRelationshipsStatusPageData: description: The data object identifying the status page associated with a maintenance template. properties: id: description: The ID of the status page. example: "" type: string type: $ref: "#/components/schemas/StatusPageDataType" required: - type - id type: object MaintenanceUpdate: description: Response object for a maintenance update. properties: data: $ref: "#/components/schemas/MaintenanceUpdateData" type: object MaintenanceUpdateData: description: The data object for a maintenance update. properties: attributes: $ref: "#/components/schemas/MaintenanceUpdateDataAttributes" id: description: The ID of the maintenance update. example: "1234abcd-12ab-34cd-56ef-123456abcdef" format: uuid type: string relationships: $ref: "#/components/schemas/MaintenanceUpdateDataRelationships" type: $ref: "#/components/schemas/PatchMaintenanceUpdateRequestDataType" required: - id - type type: object MaintenanceUpdateDataAttributes: description: Attributes of a maintenance update resource. properties: components_affected: description: Components affected at the time of the update. items: $ref: "#/components/schemas/CreateMaintenanceRequestDataAttributesComponentsAffectedItems" type: array created_at: description: The date and time the update was created. format: date-time type: string description: description: The message body of the update. type: string manual_transition: description: Whether the update was applied manually by a user (true) or automatically by the system (false). type: boolean modified_at: description: The date and time the update was last modified. format: date-time type: string started_at: description: The date and time the update started. format: date-time type: string status: $ref: "#/components/schemas/MaintenanceUpdateDataAttributesStatus" type: object MaintenanceUpdateDataAttributesStatus: description: The status of the maintenance update. enum: - scheduled - in_progress - completed - canceled type: string x-enum-varnames: - SCHEDULED - IN_PROGRESS - COMPLETED - CANCELED MaintenanceUpdateDataRelationships: description: Relationships of a maintenance update resource. properties: created_by_user: $ref: "#/components/schemas/MaintenanceUpdateDataRelationshipsUser" last_modified_by_user: $ref: "#/components/schemas/MaintenanceUpdateDataRelationshipsUser" maintenance: $ref: "#/components/schemas/MaintenanceUpdateDataRelationshipsMaintenance" type: object MaintenanceUpdateDataRelationshipsMaintenance: description: The parent maintenance of the update. properties: data: $ref: "#/components/schemas/MaintenanceUpdateDataRelationshipsMaintenanceData" required: - data type: object MaintenanceUpdateDataRelationshipsMaintenanceData: description: The maintenance linked to a maintenance update. properties: id: description: The ID of the maintenance. example: "" format: uuid type: string type: $ref: "#/components/schemas/PatchMaintenanceRequestDataType" required: - type - id type: object MaintenanceUpdateDataRelationshipsUser: description: A user relationship of a maintenance update. properties: data: $ref: "#/components/schemas/MaintenanceUpdateDataRelationshipsUserData" required: - data type: object MaintenanceUpdateDataRelationshipsUserData: description: The data object identifying a Datadog user linked to a maintenance update. properties: id: description: The ID of the Datadog user. example: "" format: uuid type: string type: $ref: "#/components/schemas/StatusPagesUserType" required: - type - id type: object MaintenanceWindow: description: A maintenance window that defines a scheduled time period during which notifications and automation rules related to work items are suppressed. Each maintenance window applies to work items matching a specified query. properties: attributes: $ref: "#/components/schemas/MaintenanceWindowAttributes" id: description: The maintenance window's identifier. example: "a1b2c3d4-e5f6-7890-abcd-ef1234567890" type: string type: $ref: "#/components/schemas/MaintenanceWindowResourceType" required: - id - type - attributes type: object MaintenanceWindowAttributes: description: Attributes of a maintenance window, including its schedule and the query that determines which work items are affected. properties: created_by: description: The UUID of the user who created this maintenance window. Read-only. readOnly: true type: string end_at: description: The ISO 8601 timestamp when the maintenance window ends and normal notification behavior resumes. example: "2026-06-01T06:00:00Z" format: date-time type: string name: description: "A human-readable name for the maintenance window (for example, `Database migration - Dec 15`)." example: "Weekly maintenance" type: string query: description: A work item search query that determines which work items are affected during the maintenance window. Uses the same syntax as the Work Management search bar. example: "project:SEC" type: string start_at: description: The ISO 8601 timestamp when the maintenance window begins and notifications start being suppressed. example: "2026-06-01T00:00:00Z" format: date-time type: string updated_by: description: The UUID of the user who last modified this maintenance window. Read-only. readOnly: true type: string required: - name - query - start_at - end_at type: object MaintenanceWindowCreate: description: Data object for creating a maintenance window. properties: attributes: $ref: "#/components/schemas/MaintenanceWindowCreateAttributes" type: $ref: "#/components/schemas/MaintenanceWindowResourceType" required: - type - attributes type: object MaintenanceWindowCreateAttributes: description: Attributes required to create a maintenance window. properties: end_at: description: The end time of the maintenance window. example: "2026-06-01T06:00:00Z" format: date-time type: string name: description: The name of the maintenance window. example: "Weekly maintenance" type: string query: description: The query to filter event management work items for this maintenance window. example: "project:SEC" type: string start_at: description: The start time of the maintenance window. example: "2026-06-01T00:00:00Z" format: date-time type: string required: - name - query - start_at - end_at type: object MaintenanceWindowCreateRequest: description: Request payload for creating a maintenance window. properties: data: $ref: "#/components/schemas/MaintenanceWindowCreate" required: - data type: object MaintenanceWindowResourceType: default: maintenance_window description: JSON:API resource type for maintenance windows. enum: - maintenance_window example: maintenance_window type: string x-enum-varnames: - MAINTENANCE_WINDOW MaintenanceWindowResponse: description: Response containing a single maintenance window. properties: data: $ref: "#/components/schemas/MaintenanceWindow" required: - data type: object MaintenanceWindowUpdate: description: Data object for updating a maintenance window. properties: attributes: $ref: "#/components/schemas/MaintenanceWindowUpdateAttributes" type: $ref: "#/components/schemas/MaintenanceWindowResourceType" required: - type type: object MaintenanceWindowUpdateAttributes: description: Attributes that can be updated on a maintenance window. All fields are optional; only provided fields are changed. properties: end_at: description: The end time of the maintenance window. format: date-time type: string name: description: The name of the maintenance window. type: string query: description: The query to filter event management work items for this maintenance window. type: string start_at: description: The start time of the maintenance window. format: date-time type: string type: object MaintenanceWindowUpdateRequest: description: Request payload for updating a maintenance window. properties: data: $ref: "#/components/schemas/MaintenanceWindowUpdate" required: - data type: object MaintenanceWindowsResponse: description: Response containing a list of maintenance windows. properties: data: description: List of maintenance windows. items: $ref: "#/components/schemas/MaintenanceWindow" type: array required: - data type: object ManagedOrgsData: description: The managed organizations resource. properties: id: description: The UUID of the current organization. example: "4dee724d-00cc-11ea-a77b-570c9d03c6c5" format: uuid type: string relationships: $ref: "#/components/schemas/ManagedOrgsRelationships" type: $ref: "#/components/schemas/ManagedOrgsType" required: - id - type - relationships type: object ManagedOrgsRelationshipToOrg: description: Relationship to the current organization. properties: data: $ref: "#/components/schemas/OrgRelationshipData" required: - data type: object ManagedOrgsRelationshipToOrgs: description: Relationship to the managed organizations. properties: data: description: List of managed organization references. items: $ref: "#/components/schemas/OrgRelationshipData" type: array required: - data type: object ManagedOrgsRelationships: description: Relationships of the managed organizations resource. properties: current_org: $ref: "#/components/schemas/ManagedOrgsRelationshipToOrg" managed_orgs: $ref: "#/components/schemas/ManagedOrgsRelationshipToOrgs" required: - current_org - managed_orgs type: object ManagedOrgsResponse: description: Response containing the current organization and its managed organizations. properties: data: $ref: "#/components/schemas/ManagedOrgsData" included: description: Included organization resources. items: $ref: "#/components/schemas/OrgData" type: array required: - data - included type: object ManagedOrgsType: description: The resource type for managed organizations. enum: [managed_orgs] example: "managed_orgs" type: string x-enum-varnames: - MANAGED_ORGS MatchingSignalAttributes: description: Attributes of a matching security signal. properties: event_tracker_id: description: The tracker ID linking the signal back to the originating event. Distinct from `id`, which identifies the matching signal itself. example: AAAAAWgOAX0mtsWfeQAAAABzX1RyYWNrZXJfMTIzNDU2Nzg5MA type: string severity: description: The severity of the signal. example: high type: string title: description: The title of the signal. example: Unusual login activity detected type: string trigger_time_ms: description: The Unix timestamp (in milliseconds) at which the signal was triggered. example: 1707393746000 format: int64 type: integer required: - event_tracker_id - severity - title - trigger_time_ms type: object MatchingSignalData: description: A security signal that matches the queried event. properties: attributes: $ref: "#/components/schemas/MatchingSignalAttributes" id: description: The ID of the matching signal. example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: string type: $ref: "#/components/schemas/MatchingSignalType" required: - id - type - attributes type: object MatchingSignalType: default: matching_signal description: The type of the resource. The value should always be `matching_signal`. enum: - matching_signal example: matching_signal type: string x-enum-varnames: - MATCHING_SIGNAL MatchingSignalsResponse: description: Response containing the list of security signals matching an event. properties: data: description: Array of matching signals. items: $ref: "#/components/schemas/MatchingSignalData" type: array required: - data type: object MaxSessionDurationType: description: Data type of a maximum session duration update. enum: [max_session_duration] example: max_session_duration type: string x-enum-varnames: - MAX_SESSION_DURATION MaxSessionDurationUpdateAttributes: description: Attributes for the maximum session duration update request. properties: max_session_duration: description: The maximum session duration, in seconds. example: 604800 format: int64 minimum: 1 type: integer required: [max_session_duration] type: object MaxSessionDurationUpdateData: description: The data object for a maximum session duration update request. properties: attributes: $ref: "#/components/schemas/MaxSessionDurationUpdateAttributes" type: $ref: "#/components/schemas/MaxSessionDurationType" required: [type, attributes] type: object MaxSessionDurationUpdateRequest: description: A request to update the maximum session duration for an organization. properties: data: $ref: "#/components/schemas/MaxSessionDurationUpdateData" required: [data] type: object McpScanRequest: description: The top-level request object for submitting an MCP SCA dependency scan. properties: data: $ref: "#/components/schemas/McpScanRequestData" required: - data type: object McpScanRequestData: description: The data object in an MCP SCA scan request, containing the scan attributes and request type. properties: attributes: $ref: "#/components/schemas/McpScanRequestDataAttributes" id: description: An optional identifier for this scan request. type: string type: $ref: "#/components/schemas/McpScanRequestDataType" required: - type - attributes type: object McpScanRequestDataAttributes: description: The attributes of an MCP SCA scan request, describing the libraries to scan and their context. properties: commit_hash: description: The commit hash of the source code being scanned. example: 0e9fc8de83eaabecd722e1cd0ed44fb489fe15fc type: string libraries: $ref: "#/components/schemas/McpScanRequestDataAttributesLibraries" resource_name: description: The name of the resource (typically the repository or project name) being scanned. example: my-org/my-repo type: string required: - resource_name - commit_hash - libraries type: object McpScanRequestDataAttributesLibraries: description: The list of libraries to scan for vulnerabilities. items: $ref: "#/components/schemas/McpScanRequestDataAttributesLibrariesItems" type: array McpScanRequestDataAttributesLibrariesItems: description: A library declaration to include in the dependency scan. properties: exclusions: $ref: "#/components/schemas/McpScanRequestDataAttributesLibrariesItemsExclusions" is_dev: description: Whether this library is a development-only dependency. example: false type: boolean is_direct: description: Whether this library is a direct (rather than transitive) dependency. example: true type: boolean package_manager: description: The package manager that produced this library entry (for example, `npm`, `pip`, `nuget`). example: nuget type: string purl: description: The Package URL (PURL) uniquely identifying the library and its version. example: pkg:nuget/Newtonsoft.Json@13.0.1 type: string target_frameworks: $ref: "#/components/schemas/McpScanRequestDataAttributesLibrariesItemsTargetFrameworks" required: - purl - is_dev - is_direct - package_manager type: object McpScanRequestDataAttributesLibrariesItemsExclusions: description: The list of dependency PURLs to exclude when resolving transitive dependencies for this library. items: description: A dependency PURL to exclude. type: string type: array McpScanRequestDataAttributesLibrariesItemsTargetFrameworks: description: The list of target framework identifiers associated with the library. items: description: A target framework identifier (for example, `net8.0`). type: string type: array McpScanRequestDataType: default: mcpscanrequest description: The type identifier for MCP SCA scan requests. enum: - mcpscanrequest example: mcpscanrequest type: string x-enum-varnames: - MCPSCANREQUEST McpScanRequestResponse: description: The top-level response object returned when an MCP SCA dependency scan request has been accepted. properties: data: $ref: "#/components/schemas/McpScanRequestResponseData" required: - data type: object McpScanRequestResponseData: description: The data object returned when a scan request has been accepted. properties: attributes: $ref: "#/components/schemas/McpScanRequestResponseDataAttributes" id: description: The job identifier assigned to the scan. example: 0190a3d4-1234-7000-8000-000000000000 type: string type: $ref: "#/components/schemas/McpScanRequestResponseDataType" required: - id - type - attributes type: object McpScanRequestResponseDataAttributes: description: >- The attributes returned when a scan request has been accepted, containing the job identifier used to poll for results. properties: job_id: description: The job identifier assigned to the scan, used to retrieve the scan result. example: 0190a3d4-1234-7000-8000-000000000000 type: string required: - job_id type: object McpScanRequestResponseDataType: default: mcpscanrequestresponse description: The type identifier for MCP SCA scan request responses. enum: - mcpscanrequestresponse example: mcpscanrequestresponse type: string x-enum-varnames: - MCPSCANREQUESTRESPONSE MemberTeam: description: A member team properties: id: description: The member team's identifier example: aeadc05e-98a8-11ec-ac2c-da7ad0900001 type: string type: $ref: "#/components/schemas/MemberTeamType" required: - id - type type: object MemberTeamType: default: member_teams description: Member team type enum: - member_teams example: member_teams type: string x-enum-varnames: - MEMBER_TEAMS Metadata: description: The metadata related to this request. properties: count: description: Number of entities included in the response. example: 150 format: int64 type: integer token: description: The token that identifies the request. example: "b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4" type: string total: description: Total number of entities across all pages. example: 152431 format: int64 type: integer required: - count - total - token type: object Metric: description: Object for a single metric. example: id: metric.foo.bar type: metrics properties: id: $ref: "#/components/schemas/MetricName" relationships: $ref: "#/components/schemas/MetricRelationships" type: $ref: "#/components/schemas/MetricType" type: object MetricActiveConfigurationType: default: actively_queried_configurations description: The metric actively queried configuration resource type. enum: - actively_queried_configurations example: actively_queried_configurations type: string x-enum-varnames: - ACTIVELY_QUERIED_CONFIGURATIONS MetricAllTags: description: Object for a single metric's indexed and ingested tags. properties: attributes: $ref: "#/components/schemas/MetricAllTagsAttributes" id: $ref: "#/components/schemas/MetricName" type: $ref: "#/components/schemas/MetricType" type: object MetricAllTagsAttributes: description: Object containing the definition of a metric's indexed and ingested tags. properties: ingested_tags: description: List of ingested tags that are not indexed. example: ["env:prod", "service:web", "version:1.0"] items: description: Ingested tags for the metric. type: string type: array tags: description: List of indexed tags. example: ["sport:golf", "sport:football", "animal:dog"] items: description: Indexed tags for the metric. type: string type: array type: object MetricAllTagsResponse: description: Response object that includes a single metric's indexed and ingested tags. properties: data: $ref: "#/components/schemas/MetricAllTags" readOnly: true type: object MetricAssetAttributes: description: Assets related to the object, including title, url, and tags. properties: tags: description: List of tag keys used in the asset. example: ["env", "service", "host", "datacenter"] items: description: Tag key used in assets. type: string type: array title: description: Title of the asset. type: string url: description: URL path of the asset. type: string type: object MetricAssetDashboardRelationship: description: An object of type `dashboard` that can be referenced in the `included` data. properties: id: $ref: "#/components/schemas/MetricDashboardID" type: $ref: "#/components/schemas/MetricDashboardType" type: object MetricAssetDashboardRelationships: description: An object containing the list of dashboards that can be referenced in the `included` data. properties: data: description: A list of dashboards that can be referenced in the `included` data. items: $ref: "#/components/schemas/MetricAssetDashboardRelationship" type: array type: object MetricAssetMonitorRelationship: description: An object of type `monitor` that can be referenced in the `included` data. properties: id: $ref: "#/components/schemas/MetricMonitorID" type: $ref: "#/components/schemas/MetricMonitorType" type: object MetricAssetMonitorRelationships: description: A object containing the list of monitors that can be referenced in the `included` data. properties: data: description: A list of monitors that can be referenced in the `included` data. items: $ref: "#/components/schemas/MetricAssetMonitorRelationship" type: array type: object MetricAssetNotebookRelationship: description: An object of type `notebook` that can be referenced in the `included` data. properties: id: $ref: "#/components/schemas/MetricNotebookID" type: $ref: "#/components/schemas/MetricNotebookType" type: object MetricAssetNotebookRelationships: description: An object containing the list of notebooks that can be referenced in the `included` data. properties: data: description: A list of notebooks that can be referenced in the `included` data. items: $ref: "#/components/schemas/MetricAssetNotebookRelationship" type: array type: object MetricAssetResponseData: description: Metric assets response data. properties: id: $ref: "#/components/schemas/MetricName" relationships: $ref: "#/components/schemas/MetricAssetResponseRelationships" type: $ref: "#/components/schemas/MetricType" required: - id - type type: object MetricAssetResponseIncluded: description: List of included assets with full set of attributes. oneOf: - $ref: "#/components/schemas/MetricDashboardAsset" - $ref: "#/components/schemas/MetricMonitorAsset" - $ref: "#/components/schemas/MetricNotebookAsset" - $ref: "#/components/schemas/MetricSLOAsset" MetricAssetResponseRelationships: description: Relationships to assets related to the metric. properties: dashboards: $ref: "#/components/schemas/MetricAssetDashboardRelationships" monitors: $ref: "#/components/schemas/MetricAssetMonitorRelationships" notebooks: $ref: "#/components/schemas/MetricAssetNotebookRelationships" slos: $ref: "#/components/schemas/MetricAssetSLORelationships" type: object MetricAssetSLORelationship: description: An object of type `slos` that can be referenced in the `included` data. properties: id: $ref: "#/components/schemas/MetricSLOID" type: $ref: "#/components/schemas/MetricSLOType" type: object MetricAssetSLORelationships: description: An object containing a list of SLOs that can be referenced in the `included` data. properties: data: description: A list of SLOs that can be referenced in the `included` data. items: $ref: "#/components/schemas/MetricAssetSLORelationship" type: array type: object MetricAssetsResponse: description: Response object that includes related dashboards, monitors, notebooks, and SLOs. properties: data: $ref: "#/components/schemas/MetricAssetResponseData" included: description: Array of objects related to the metric assets. items: $ref: "#/components/schemas/MetricAssetResponseIncluded" type: array type: object MetricContentEncoding: default: deflate description: HTTP header used to compress the media-type. enum: - deflate - zstd1 - gzip example: deflate type: string x-enum-varnames: - DEFLATE - ZSTD1 - GZIP MetricCustomAggregation: description: |- A time and space aggregation combination for use in query. example: space: sum time: sum properties: space: $ref: "#/components/schemas/MetricCustomSpaceAggregation" time: $ref: "#/components/schemas/MetricCustomTimeAggregation" required: - time - space type: object MetricCustomAggregations: description: |- Deprecated. You no longer need to configure specific time and space aggregations for Metrics Without Limits. example: - space: sum time: sum - space: sum time: count items: $ref: "#/components/schemas/MetricCustomAggregation" type: array MetricCustomSpaceAggregation: description: A space aggregation for use in query. enum: - avg - max - min - sum example: sum type: string x-enum-varnames: - AVG - MAX - MIN - SUM MetricCustomTimeAggregation: description: A time aggregation for use in query. enum: - avg - count - max - min - sum example: sum type: string x-enum-varnames: - AVG - COUNT - MAX - MIN - SUM MetricDashboardAsset: description: A dashboard object with title and popularity. properties: attributes: $ref: "#/components/schemas/MetricDashboardAttributes" id: $ref: "#/components/schemas/MetricDashboardID" type: $ref: "#/components/schemas/MetricDashboardType" required: - id - type type: object MetricDashboardAttributes: description: Attributes related to the dashboard, including title, popularity, and url. properties: popularity: description: Value from 0 to 5 that ranks popularity of the dashboard. format: double maximum: 5 minimum: 0 type: number tags: description: List of tag keys used in the asset. example: ["env", "service", "host", "datacenter"] items: description: Tag key used in assets. type: string type: array title: description: Title of the asset. type: string url: description: URL path of the asset. type: string type: object MetricDashboardID: description: The related dashboard's ID. example: "xxx-yyy-zzz" type: string MetricDashboardType: description: Dashboard resource type. enum: - dashboards example: "dashboards" type: string x-enum-varnames: - DASHBOARDS MetricDistinctVolume: description: Object for a single metric's distinct volume. properties: attributes: $ref: "#/components/schemas/MetricDistinctVolumeAttributes" id: $ref: "#/components/schemas/MetricName" type: $ref: "#/components/schemas/MetricDistinctVolumeType" type: object MetricDistinctVolumeAttributes: description: Object containing the definition of a metric's distinct volume. properties: distinct_volume: description: Distinct volume for the given metric. example: 10 format: int64 type: integer type: object MetricDistinctVolumeType: default: distinct_metric_volumes description: The metric distinct volume type. enum: - distinct_metric_volumes example: distinct_metric_volumes type: string x-enum-varnames: - DISTINCT_METRIC_VOLUMES MetricEstimate: description: Object for a metric cardinality estimate. properties: attributes: $ref: "#/components/schemas/MetricEstimateAttributes" id: $ref: "#/components/schemas/MetricName" type: $ref: "#/components/schemas/MetricEstimateResourceType" type: object MetricEstimateAttributes: description: Object containing the definition of a metric estimate attribute. properties: estimate_type: $ref: "#/components/schemas/MetricEstimateType" estimated_at: description: Timestamp when the cardinality estimate was requested. example: "2022-04-27T09:48:37.463835Z" format: date-time type: string estimated_output_series: description: Estimated cardinality of the metric based on the queried configuration. example: 50 format: int64 type: integer type: object MetricEstimateResourceType: default: metric_cardinality_estimate description: The metric estimate resource type. enum: - metric_cardinality_estimate example: metric_cardinality_estimate type: string x-enum-varnames: - METRIC_CARDINALITY_ESTIMATE MetricEstimateResponse: description: Response object that includes metric cardinality estimates. properties: data: $ref: "#/components/schemas/MetricEstimate" type: object MetricEstimateType: default: count_or_gauge description: |- Estimate type based on the queried configuration. `count_or_gauge` is returned by default, and `distribution` is returned for distribution metrics. The `filter[pct]` query parameter has no effect on this value. enum: - count_or_gauge - distribution - percentile example: distribution type: string x-enum-varnames: - COUNT_OR_GAUGE - DISTRIBUTION - PERCENTILE MetricIngestedIndexedVolume: description: Object for a single metric's ingested and indexed volume. properties: attributes: $ref: "#/components/schemas/MetricIngestedIndexedVolumeAttributes" id: $ref: "#/components/schemas/MetricName" type: $ref: "#/components/schemas/MetricIngestedIndexedVolumeType" type: object MetricIngestedIndexedVolumeAttributes: description: Object containing the definition of a metric's ingested and indexed volume. properties: indexed_volume: description: Estimated average hourly number of indexed time series for the given metric over the last hour. For organizations on Metric Name Pricing, this represents the estimated sum of indexed data points over the last hour. example: 10 format: int64 type: integer indexed_volume_delta: description: |- Change in `indexed_volume` compared with the previous hour: the last hour's value minus the value for the hour before. Negative when volume decreased. example: 2 format: int64 type: integer ingested_volume: description: Estimated average hourly number of ingested time series for the given metric over the last hour. This value is `0` for metrics not configured with Metrics Without Limits. For organizations on Metric Name Pricing, this represents the estimated sum of ingested data points over the last hour. example: 20 format: int64 type: integer ingested_volume_delta: description: |- Change in `ingested_volume` compared with the previous hour: the last hour's value minus the value for the hour before. Negative when volume decreased. example: 4 format: int64 type: integer type: object MetricIngestedIndexedVolumeType: default: metric_volumes description: The metric ingested and indexed volume type. enum: - metric_volumes example: metric_volumes type: string x-enum-varnames: - METRIC_VOLUMES MetricIntakeType: description: The type of metric. The available types are `0` (unspecified), `1` (count), `2` (rate), and `3` (gauge). enum: - 0 - 1 - 2 - 3 format: int32 type: integer x-enum-varnames: - UNSPECIFIED - COUNT - RATE - GAUGE MetricMetaPage: description: Paging attributes. Only present if pagination query parameters were provided. properties: cursor: description: The cursor used to get the current results, if any. nullable: true type: string limit: description: Number of results returned format: int32 maximum: 20000 minimum: 0 type: integer next_cursor: description: The cursor used to get the next results, if any. nullable: true type: string type: $ref: "#/components/schemas/MetricMetaPageType" type: object MetricMetaPageType: default: cursor_limit description: Type of metric pagination. enum: - cursor_limit example: cursor_limit type: string x-enum-varnames: - CURSOR_LIMIT MetricMetadata: description: Metadata for the metric. properties: origin: $ref: "#/components/schemas/MetricOrigin" type: object MetricMonitorAsset: description: A monitor object with title. properties: attributes: $ref: "#/components/schemas/MetricAssetAttributes" id: $ref: "#/components/schemas/MetricMonitorID" type: $ref: "#/components/schemas/MetricMonitorType" required: - id - type type: object MetricMonitorID: description: The related monitor's ID. example: "1775073" type: string MetricMonitorType: description: Monitor resource type. enum: - monitors example: "monitors" type: string x-enum-varnames: - MONITORS MetricName: description: The metric name for this resource. example: test.metric.latency type: string MetricNotebookAsset: description: A notebook object with title. properties: attributes: $ref: "#/components/schemas/MetricAssetAttributes" id: $ref: "#/components/schemas/MetricNotebookID" type: $ref: "#/components/schemas/MetricNotebookType" required: - id - type type: object MetricNotebookID: description: The related notebook's ID. example: "12345" type: string MetricNotebookType: description: Notebook resource type. enum: - notebooks example: "notebooks" type: string x-enum-varnames: - NOTEBOOKS MetricOrigin: description: Metric origin information. properties: metric_type: default: 0 description: The origin metric type code format: int32 maximum: 1000 type: integer product: default: 0 description: The origin product code format: int32 maximum: 1000 type: integer service: default: 0 description: The origin service code format: int32 maximum: 1000 type: integer type: object MetricPaginationMeta: description: Response metadata object. properties: pagination: $ref: "#/components/schemas/MetricMetaPage" type: object MetricPayload: description: The metrics' payload. properties: series: description: A list of timeseries to submit to Datadog. example: - metric: "system.load.1" points: - {timestamp: 1475317847, value: 0.7} resources: - {name: "dummyhost", type: "host"} items: $ref: "#/components/schemas/MetricSeries" type: array required: - series type: object MetricPoint: description: A point object is of the form `{POSIX_timestamp, numeric_value}`. example: {timestamp: 1575317847, value: 0.5} properties: timestamp: description: |- The timestamp should be in seconds and current. Current is defined as not more than 10 minutes in the future or more than 1 hour in the past. format: int64 type: integer value: description: The numeric value format should be a 64bit float gauge-type value. format: double type: number type: object MetricRelationships: description: Relationships for a metric. properties: metric_volumes: $ref: "#/components/schemas/MetricVolumesRelationship" type: object MetricResource: description: Metric resource. example: {name: "dummyhost", type: "host"} properties: name: description: The name of the resource. type: string type: description: The type of the resource. type: string type: object MetricSLOAsset: description: A SLO object with title. properties: attributes: $ref: "#/components/schemas/MetricAssetAttributes" id: $ref: "#/components/schemas/MetricSLOID" type: $ref: "#/components/schemas/MetricSLOType" required: - id - type type: object MetricSLOID: description: The SLO ID. example: "9ffef113b389520db54391d67d652dfb" type: string MetricSLOType: description: SLO resource type. enum: - slos example: "slos" type: string x-enum-varnames: - SLOS MetricSeries: description: |- A metric to submit to Datadog. See [Datadog metrics](https://docs.datadoghq.com/developers/metrics/#custom-metrics-properties). properties: interval: description: If the type of the metric is rate or count, define the corresponding interval in seconds. example: 20 format: int64 type: integer metadata: $ref: "#/components/schemas/MetricMetadata" metric: description: The name of the timeseries. example: system.load.1 type: string points: description: Points relating to a metric. All points must be objects with timestamp and a scalar value (cannot be a string). Timestamps should be in POSIX time in seconds, and cannot be more than ten minutes in the future or more than one hour in the past. example: - {timestamp: 1575317847, value: 0.5} items: $ref: "#/components/schemas/MetricPoint" type: array resources: description: A list of resources to associate with this metric. items: $ref: "#/components/schemas/MetricResource" type: array source_type_name: description: The source type name. example: "datadog" type: string tags: description: A list of tags associated with the metric. example: ["environment:test"] items: description: Individual tags. type: string type: array type: $ref: "#/components/schemas/MetricIntakeType" unit: description: The unit of point value. example: "second" type: string required: - metric - points type: object MetricSuggestedAggregations: description: |- List of aggregation combinations that have been actively queried. example: - space: sum time: sum - space: sum time: count items: $ref: "#/components/schemas/MetricCustomAggregation" type: array MetricSuggestedTagsAndAggregations: description: Object for a single metric's actively queried tags and aggregations. properties: attributes: $ref: "#/components/schemas/MetricSuggestedTagsAttributes" id: $ref: "#/components/schemas/MetricName" type: $ref: "#/components/schemas/MetricActiveConfigurationType" type: object MetricSuggestedTagsAndAggregationsResponse: description: Response object that includes a single metric's actively queried tags and aggregations. properties: data: $ref: "#/components/schemas/MetricSuggestedTagsAndAggregations" readOnly: true type: object MetricSuggestedTagsAttributes: description: Object containing the definition of a metric's actively queried tags and aggregations. properties: active_aggregations: $ref: "#/components/schemas/MetricSuggestedAggregations" active_tags: description: List of tag keys that have been actively queried. example: ["app", "datacenter"] items: description: Actively queried tag keys. type: string type: array type: object MetricTagCardinalitiesData: description: A list of tag cardinalities associated with the given metric. items: $ref: "#/components/schemas/MetricTagCardinality" type: array MetricTagCardinalitiesMeta: description: Response metadata object. properties: metric_name: description: |- The name of metric for which the tag cardinalities are returned. This matches the metric name provided in the request. type: string type: object MetricTagCardinalitiesResponse: description: |- Response object that includes an array of objects representing the cardinality details of a metric's tags. properties: data: $ref: "#/components/schemas/MetricTagCardinalitiesData" meta: $ref: "#/components/schemas/MetricTagCardinalitiesMeta" readOnly: true type: object MetricTagCardinality: description: Object containing metadata and attributes related to a specific tag key associated with the metric. example: attributes: cardinality_delta: 25 id: http.request.latency type: tag_cardinality properties: attributes: $ref: "#/components/schemas/MetricTagCardinalityAttributes" id: description: The name of the tag key. type: string type: default: tag_cardinality description: This describes the endpoint action. type: string type: object MetricTagCardinalityAttributes: description: An object containing properties related to the tag key properties: cardinality_delta: description: This describes the recent change in the tag keys cardinality format: int64 type: integer type: object MetricTagConfiguration: description: Object for a single metric tag configuration. example: attributes: aggregations: [{"space": "avg", "time": "avg"}] created_at: "2020-03-25T09:48:37.463835Z" metric_type: gauge modified_at: "2020-04-25T09:48:37.463835Z" tags: ["app", "datacenter"] id: http.request.latency type: manage_tags properties: attributes: $ref: "#/components/schemas/MetricTagConfigurationAttributes" id: $ref: "#/components/schemas/MetricName" relationships: $ref: "#/components/schemas/MetricRelationships" type: $ref: "#/components/schemas/MetricTagConfigurationType" type: object MetricTagConfigurationAttributes: description: Object containing the definition of a metric tag configuration attributes. properties: aggregations: $ref: "#/components/schemas/MetricCustomAggregations" created_at: description: Timestamp when the tag configuration was created. example: "2020-03-25T09:48:37.463835Z" format: date-time type: string exclude_tags_mode: description: |- When set to true, the configuration will exclude the configured tags and include any other submitted tags. When set to false, the configuration will include the configured tags and exclude any other submitted tags. Defaults to false. Requires `tags` property. type: boolean include_percentiles: description: |- Toggle to include or exclude percentile aggregations for distribution metrics. Only present when the `metric_type` is `distribution`. example: true type: boolean metric_type: $ref: "#/components/schemas/MetricTagConfigurationMetricTypes" modified_at: description: Timestamp when the tag configuration was last modified. example: "2020-03-25T09:48:37.463835Z" format: date-time type: string tags: description: List of tag keys on which to group. example: ["app", "datacenter"] items: description: Tag keys to group by. type: string type: array type: object MetricTagConfigurationCreateAttributes: description: Object containing the definition of a metric tag configuration to be created. properties: aggregations: $ref: "#/components/schemas/MetricCustomAggregations" exclude_tags_mode: description: |- When set to true, the configuration will exclude the configured tags and include any other submitted tags. When set to false, the configuration will include the configured tags and exclude any other submitted tags. Defaults to false. Requires `tags` property. type: boolean include_percentiles: description: |- Toggle to include/exclude percentiles for a distribution metric. Defaults to false. Can only be applied to metrics that have a `metric_type` of `distribution`. example: true type: boolean metric_type: $ref: "#/components/schemas/MetricTagConfigurationMetricTypes" tags: default: [] description: A list of tag keys that will be queryable for your metric. example: ["app", "datacenter"] items: description: Tag keys to group by. type: string type: array required: - tags - metric_type type: object MetricTagConfigurationCreateData: description: Object for a single metric to be configure tags on. example: attributes: include_percentiles: false metric_type: distribution tags: - app - datacenter id: http.endpoint.request type: manage_tags properties: attributes: $ref: "#/components/schemas/MetricTagConfigurationCreateAttributes" id: $ref: "#/components/schemas/MetricName" type: $ref: "#/components/schemas/MetricTagConfigurationType" required: - id - type type: object MetricTagConfigurationCreateRequest: description: Request object that includes the metric that you would like to configure tags for. properties: data: $ref: "#/components/schemas/MetricTagConfigurationCreateData" required: - data type: object MetricTagConfigurationMetricTypeCategory: description: The metric's type category. enum: - non_distribution - distribution - exponential_histogram - explicit_histogram type: string x-enum-varnames: - NON_DISTRIBUTION - DISTRIBUTION - EXPONENTIAL_HISTOGRAM - EXPLICIT_HISTOGRAM MetricTagConfigurationMetricTypes: default: gauge description: The metric's type. enum: - gauge - count - rate - distribution example: count type: string x-enum-varnames: - GAUGE - COUNT - RATE - DISTRIBUTION MetricTagConfigurationResponse: description: Response object which includes a single metric's tag configuration. properties: data: $ref: "#/components/schemas/MetricTagConfiguration" readOnly: true type: object MetricTagConfigurationType: default: manage_tags description: The metric tag configuration resource type. enum: - manage_tags example: manage_tags type: string x-enum-varnames: - MANAGE_TAGS MetricTagConfigurationUpdateAttributes: description: Object containing the definition of a metric tag configuration to be updated. properties: aggregations: $ref: "#/components/schemas/MetricCustomAggregations" exclude_tags_mode: description: |- When set to true, the configuration will exclude the configured tags and include any other submitted tags. When set to false, the configuration will include the configured tags and exclude any other submitted tags. Defaults to false. Requires `tags` property. type: boolean include_percentiles: description: |- Toggle to include/exclude percentiles for a distribution metric. Defaults to false. Can only be applied to metrics that have a `metric_type` of `distribution`. example: true type: boolean tags: default: [] description: A list of tag keys that will be queryable for your metric. example: ["app", "datacenter"] items: description: Tag keys to group by. type: string type: array type: object MetricTagConfigurationUpdateData: description: Object for a single tag configuration to be edited. example: attributes: group_by: - app - datacenter include_percentiles: false id: http.endpoint.request type: manage_tags properties: attributes: $ref: "#/components/schemas/MetricTagConfigurationUpdateAttributes" id: $ref: "#/components/schemas/MetricName" type: $ref: "#/components/schemas/MetricTagConfigurationType" required: - id - type type: object MetricTagConfigurationUpdateRequest: description: Request object that includes the metric that you would like to edit the tag configuration on. properties: data: $ref: "#/components/schemas/MetricTagConfigurationUpdateData" required: - data type: object MetricType: default: metrics description: The metric resource type. enum: - metrics example: metrics type: string x-enum-varnames: - METRICS MetricVolumes: description: Possible response objects for a metric's volume. oneOf: - $ref: "#/components/schemas/MetricDistinctVolume" - $ref: "#/components/schemas/MetricIngestedIndexedVolume" MetricVolumesRelationship: description: Relationship to a metric volume included in the response. properties: data: $ref: "#/components/schemas/MetricVolumesRelationshipData" type: object MetricVolumesRelationshipData: description: Relationship data for a metric volume. properties: id: $ref: "#/components/schemas/MetricName" type: $ref: "#/components/schemas/MetricIngestedIndexedVolumeType" type: object MetricVolumesResponse: description: Response object which includes a single metric's volume. properties: data: $ref: "#/components/schemas/MetricVolumes" readOnly: true type: object MetricsAggregator: default: "avg" description: The type of aggregation that can be performed on metrics-based queries. enum: - avg - min - max - sum - last - percentile - mean - l2norm - area example: "avg" type: string x-enum-varnames: - AVG - MIN - MAX - SUM - LAST - PERCENTILE - MEAN - L2NORM - AREA MetricsAndMetricTagConfigurations: description: Object for a metrics and metric tag configurations. oneOf: - $ref: "#/components/schemas/Metric" - $ref: "#/components/schemas/MetricTagConfiguration" MetricsAndMetricTagConfigurationsResponse: description: Response object that includes metrics and metric tag configurations. properties: data: description: Array of metrics and metric tag configurations. items: $ref: "#/components/schemas/MetricsAndMetricTagConfigurations" type: array included: description: Array of metric volume resources included when requested with `include=metric_volumes`. items: $ref: "#/components/schemas/MetricIngestedIndexedVolume" type: array links: $ref: "#/components/schemas/MetricsListResponseLinks" meta: $ref: "#/components/schemas/MetricPaginationMeta" readOnly: true type: object MetricsDataSource: default: metrics description: A data source that is powered by the Metrics platform. enum: - metrics - cloud_cost example: metrics type: string x-enum-varnames: - METRICS - CLOUD_COST MetricsListResponseLinks: description: Pagination links. Only present if pagination query parameters were provided. properties: first: description: Link to the first page. type: string last: description: Link to the last page. nullable: true type: string next: description: Link to the next page. nullable: true type: string prev: description: Link to previous page. nullable: true type: string self: description: Link to current page. type: string type: object MetricsScalarQuery: description: A query against Datadog custom metrics or Cloud Cost data sources. properties: aggregator: $ref: "#/components/schemas/MetricsAggregator" cross_org_uuids: $ref: "#/components/schemas/CrossOrgUuids" data_source: $ref: "#/components/schemas/MetricsDataSource" name: description: The variable name for use in formulas. type: string query: description: A classic metrics query string. example: avg:system.cpu.user{*} by {env} type: string required: - data_source - query - aggregator type: object MetricsTimeseriesQuery: description: A query against Datadog custom metrics or Cloud Cost data sources. properties: cross_org_uuids: $ref: "#/components/schemas/CrossOrgUuids" data_source: $ref: "#/components/schemas/MetricsDataSource" name: description: The variable name for use in formulas. type: string query: description: A classic metrics query string. example: avg:system.cpu.user{*} by {env} type: string required: - data_source - query type: object MicrosoftSentinelDestination: description: |- The `microsoft_sentinel` destination forwards logs to Microsoft Sentinel. **Supported pipeline types:** logs properties: buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" client_id: description: Azure AD client ID used for authentication. example: "a1b2c3d4-5678-90ab-cdef-1234567890ab" type: string client_secret_key: description: Name of the environment variable or secret that holds the Azure AD client secret. example: AZURE_CLIENT_SECRET type: string dce_uri_key: description: Name of the environment variable or secret that holds the Data Collection Endpoint (DCE) URI. example: DCE_URI type: string dcr_immutable_id: description: The immutable ID of the Data Collection Rule (DCR). example: "dcr-uuid-1234" type: string id: description: The unique identifier for this component. example: "sentinel-destination" type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array table: description: The name of the Log Analytics table where logs are sent. example: "CustomLogsTable" type: string tenant_id: description: Azure AD tenant ID. example: "abcdef12-3456-7890-abcd-ef1234567890" type: string type: $ref: "#/components/schemas/MicrosoftSentinelDestinationType" required: - id - type - inputs - client_id - tenant_id - dcr_immutable_id - table type: object x-pipeline-types: [logs] MicrosoftSentinelDestinationType: default: microsoft_sentinel description: The destination type. The value should always be `microsoft_sentinel`. enum: - microsoft_sentinel example: microsoft_sentinel type: string x-enum-varnames: - MICROSOFT_SENTINEL MicrosoftTeamsChannelInfoResponseAttributes: description: Channel attributes. properties: is_primary: description: Indicates if this is the primary channel. example: true maxLength: 255 type: boolean team_id: description: Team id. example: "00000000-0000-0000-0000-000000000000" maxLength: 255 type: string tenant_id: description: Tenant id. example: "00000000-0000-0000-0000-000000000001" maxLength: 255 type: string type: object MicrosoftTeamsChannelInfoResponseData: description: Channel data from a response. properties: attributes: $ref: "#/components/schemas/MicrosoftTeamsChannelInfoResponseAttributes" id: description: The ID of the channel. example: "19:b41k24b14bn1nwffkernfkwrnfneubgkr@thread.tacv2" maxLength: 255 minLength: 1 type: string type: $ref: "#/components/schemas/MicrosoftTeamsChannelInfoType" type: object MicrosoftTeamsChannelInfoType: default: ms-teams-channel-info description: Channel info resource type. enum: - ms-teams-channel-info example: ms-teams-channel-info type: string x-enum-varnames: - MS_TEAMS_CHANNEL_INFO MicrosoftTeamsConfigurationReference: description: A reference to a Microsoft Teams Configuration resource. nullable: true properties: data: $ref: "#/components/schemas/MicrosoftTeamsConfigurationReferenceData" required: - data type: object MicrosoftTeamsConfigurationReferenceData: description: The Microsoft Teams configuration relationship data object. nullable: true properties: id: description: The unique identifier of the Microsoft Teams configuration. example: "00000000-0000-0000-0000-000000000000" type: string type: description: The type of the Microsoft Teams configuration. example: "microsoft_teams_configurations" type: string required: - id - type type: object MicrosoftTeamsCreateTenantBasedHandleRequest: description: Create tenant-based handle request. properties: data: $ref: "#/components/schemas/MicrosoftTeamsTenantBasedHandleRequestData" required: - data type: object MicrosoftTeamsCreateWorkflowsWebhookHandleRequest: description: Create Workflows webhook handle request. properties: data: $ref: "#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleRequestData" required: - data type: object MicrosoftTeamsGetChannelByNameResponse: description: Response with channel, team, and tenant ID information. properties: data: $ref: "#/components/schemas/MicrosoftTeamsChannelInfoResponseData" type: object MicrosoftTeamsTenantBasedHandleAttributes: description: Tenant-based handle attributes. properties: channel_id: description: Channel id. example: "fake-channel-id" maxLength: 255 type: string name: description: Tenant-based handle name. example: "fake-handle-name" maxLength: 255 type: string team_id: description: Team id. example: "00000000-0000-0000-0000-000000000000" maxLength: 255 type: string tenant_id: description: Tenant id. example: "00000000-0000-0000-0000-000000000001" maxLength: 255 type: string type: object MicrosoftTeamsTenantBasedHandleInfoResponseAttributes: description: Tenant-based handle attributes. properties: channel_id: description: Channel id. example: "fake-channel-id" maxLength: 255 type: string channel_name: description: Channel name. example: "fake-channel-name" maxLength: 255 type: string name: description: Tenant-based handle name. example: "fake-handle-name" maxLength: 255 type: string team_id: description: Team id. example: "00000000-0000-0000-0000-000000000000" maxLength: 255 type: string team_name: description: Team name. example: "fake-team-name" maxLength: 255 type: string tenant_id: description: Tenant id. example: "00000000-0000-0000-0000-000000000001" maxLength: 255 type: string tenant_name: description: Tenant name. example: "fake-tenant-name" maxLength: 255 type: string type: object MicrosoftTeamsTenantBasedHandleInfoResponseData: description: Tenant-based handle data from a response. properties: attributes: $ref: "#/components/schemas/MicrosoftTeamsTenantBasedHandleInfoResponseAttributes" id: description: The ID of the tenant-based handle. example: "596da4af-0563-4097-90ff-07230c3f9db3" maxLength: 100 minLength: 1 type: string type: $ref: "#/components/schemas/MicrosoftTeamsTenantBasedHandleInfoType" type: object MicrosoftTeamsTenantBasedHandleInfoType: default: ms-teams-tenant-based-handle-info description: Tenant-based handle resource type. enum: - ms-teams-tenant-based-handle-info example: ms-teams-tenant-based-handle-info type: string x-enum-varnames: - MS_TEAMS_TENANT_BASED_HANDLE_INFO MicrosoftTeamsTenantBasedHandleRequestAttributes: description: Tenant-based handle attributes. properties: channel_id: description: Channel id. example: "fake-channel-id" maxLength: 255 type: string name: description: Tenant-based handle name. example: "fake-handle-name" maxLength: 255 type: string team_id: description: Team id. example: "00000000-0000-0000-0000-000000000000" maxLength: 255 type: string tenant_id: description: Tenant id. example: "00000000-0000-0000-0000-000000000001" maxLength: 255 type: string required: - name - channel_id - team_id - tenant_id type: object MicrosoftTeamsTenantBasedHandleRequestData: description: Tenant-based handle data from a response. properties: attributes: $ref: "#/components/schemas/MicrosoftTeamsTenantBasedHandleRequestAttributes" type: $ref: "#/components/schemas/MicrosoftTeamsTenantBasedHandleType" required: - type - attributes type: object MicrosoftTeamsTenantBasedHandleResponse: description: Response of a tenant-based handle. properties: data: $ref: "#/components/schemas/MicrosoftTeamsTenantBasedHandleResponseData" required: - data type: object MicrosoftTeamsTenantBasedHandleResponseData: description: Tenant-based handle data from a response. properties: attributes: $ref: "#/components/schemas/MicrosoftTeamsTenantBasedHandleAttributes" id: description: The ID of the tenant-based handle. example: "596da4af-0563-4097-90ff-07230c3f9db3" maxLength: 100 minLength: 1 type: string type: $ref: "#/components/schemas/MicrosoftTeamsTenantBasedHandleType" type: object MicrosoftTeamsTenantBasedHandleType: default: tenant-based-handle description: Specifies the tenant-based handle resource type. enum: - tenant-based-handle example: tenant-based-handle type: string x-enum-varnames: - TENANT_BASED_HANDLE MicrosoftTeamsTenantBasedHandlesResponse: description: Response with a list of tenant-based handles. properties: data: description: An array of tenant-based handles. example: [{"attributes": {"channelId": "19:b41k24b14bn1nwffkernfkwrnfneubgkr@thread.tacv2", "channelName": "General", "name": "general-handle", "teamId": "00000000-0000-0000-0000-000000000000", "teamName": "Example Team", "tenantId": "00000000-0000-0000-0000-000000000001", "tenantName": "Company, Inc."}, "id": "596da4af-0563-4097-90ff-07230c3f9db3", "type": "ms-teams-tenant-based-handle-info"}, {"attributes": {"channelId": "19:b41k24b14bn1nwffkernfkwrnfneubgk1@thread.tacv2", "channelName": "General2", "name": "general-handle-2", "teamId": "00000000-0000-0000-0000-000000000002", "teamName": "Example Team 2", "tenantId": "00000000-0000-0000-0000-000000000003", "tenantName": "Company, Inc."}, "id": "596da4af-0563-4097-90ff-07230c3f9db4", "type": "ms-teams-tenant-based-handle-info"}] items: $ref: "#/components/schemas/MicrosoftTeamsTenantBasedHandleInfoResponseData" type: array required: - data type: object MicrosoftTeamsUpdateTenantBasedHandleRequest: description: Update tenant-based handle request. properties: data: $ref: "#/components/schemas/MicrosoftTeamsUpdateTenantBasedHandleRequestData" required: - data type: object MicrosoftTeamsUpdateTenantBasedHandleRequestData: description: Tenant-based handle data from a response. properties: attributes: $ref: "#/components/schemas/MicrosoftTeamsTenantBasedHandleAttributes" type: $ref: "#/components/schemas/MicrosoftTeamsTenantBasedHandleType" required: - type - attributes type: object MicrosoftTeamsUpdateWorkflowsWebhookHandleRequest: description: Update Workflows webhook handle request. properties: data: $ref: "#/components/schemas/MicrosoftTeamsUpdateWorkflowsWebhookHandleRequestData" required: - data type: object MicrosoftTeamsUpdateWorkflowsWebhookHandleRequestData: description: Workflows Webhook handle data from a response. properties: attributes: $ref: "#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleAttributes" type: $ref: "#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleType" required: - type - attributes type: object MicrosoftTeamsWorkflowsWebhookHandleAttributes: description: Workflows Webhook handle attributes. properties: name: description: Workflows Webhook handle name. example: "fake-handle-name" maxLength: 255 type: string url: description: Workflows Webhook URL. example: "https://fake.url.com" maxLength: 255 type: string type: object MicrosoftTeamsWorkflowsWebhookHandleRequestAttributes: description: Workflows Webhook handle attributes. properties: name: description: Workflows Webhook handle name. example: "fake-handle-name" maxLength: 255 type: string url: description: Workflows Webhook URL. example: "https://fake.url.com" maxLength: 255 type: string required: - name - url type: object MicrosoftTeamsWorkflowsWebhookHandleRequestData: description: Workflows Webhook handle data from a response. properties: attributes: $ref: "#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleRequestAttributes" type: $ref: "#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleType" required: - type - attributes type: object MicrosoftTeamsWorkflowsWebhookHandleResponse: description: Response of a Workflows webhook handle. properties: data: $ref: "#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleResponseData" required: - data type: object MicrosoftTeamsWorkflowsWebhookHandleResponseData: description: Workflows Webhook handle data from a response. properties: attributes: $ref: "#/components/schemas/MicrosoftTeamsWorkflowsWebhookResponseAttributes" id: description: The ID of the Workflows webhook handle. example: "596da4af-0563-4097-90ff-07230c3f9db3" maxLength: 100 minLength: 1 type: string type: $ref: "#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleType" type: object MicrosoftTeamsWorkflowsWebhookHandleType: default: workflows-webhook-handle description: Specifies the Workflows webhook handle resource type. enum: - workflows-webhook-handle example: workflows-webhook-handle type: string x-enum-varnames: - WORKFLOWS_WEBHOOK_HANDLE MicrosoftTeamsWorkflowsWebhookHandlesResponse: description: Response with a list of Workflows webhook handles. properties: data: description: An array of Workflows webhook handles. example: [{"attributes": {"name": "general-handle"}, "id": "596da4af-0563-4097-90ff-07230c3f9db3", "type": "workflows-webhook-handle"}, {"attributes": {"name": "general-handle-2"}, "id": "596da4af-0563-4097-90ff-07230c3f9db4", "type": "workflows-webhook-handle"}] items: $ref: "#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleResponseData" type: array required: - data type: object MicrosoftTeamsWorkflowsWebhookResponseAttributes: description: Workflows Webhook handle attributes. properties: name: description: Workflows Webhook handle name. example: "fake-handle-name" maxLength: 255 type: string type: object ModelLabArtifactInfo: description: Information about a project-level artifact file. properties: artifact_path: description: The full artifact path relative to the project's artifact root. example: projects/1/artifacts/model.pkl type: string created_at: description: The date and time the artifact was created. example: "2024-01-20T10:00:00Z" format: date-time type: string file_size: description: The size of the file in bytes. format: int64 nullable: true type: integer filename: description: The filename of the artifact. example: model.pkl type: string required: - filename - artifact_path - created_at type: object ModelLabArtifactObjectInfo: description: Information about an artifact file or directory within a run. properties: file_size: description: The size of the file in bytes. format: int64 nullable: true type: integer is_dir: description: Whether this artifact entry is a directory. example: false type: boolean path: description: The path of the artifact relative to the run's artifact root. example: model/weights.pt type: string required: - path - is_dir type: object ModelLabFacetKeysAttributes: description: Available facet key names for filtering resources. properties: metrics: description: The list of available metric facet keys. example: - accuracy items: type: string nullable: true type: array parameters: description: The list of available parameter facet keys. example: - learning_rate items: type: string type: array tags: description: The list of available tag facet keys. example: - model items: type: string type: array required: - parameters - tags - metrics type: object ModelLabFacetKeysData: description: A facet keys JSON:API resource object. properties: attributes: $ref: "#/components/schemas/ModelLabFacetKeysAttributes" id: description: The unique identifier of the facet keys resource. example: "1" type: string type: $ref: "#/components/schemas/ModelLabFacetKeysType" required: - id - type - attributes type: object ModelLabFacetKeysResponse: description: Response containing available facet keys. properties: data: $ref: "#/components/schemas/ModelLabFacetKeysData" required: - data type: object ModelLabFacetKeysType: description: The JSON:API type for a facet keys resource. enum: - facet_keys example: facet_keys type: string x-enum-varnames: - FACET_KEYS ModelLabFacetType: description: The type of facet for filtering Model Lab runs. enum: - parameter - attribute - tag - metric example: tag type: string x-enum-varnames: - PARAMETER - ATTRIBUTE - TAG - METRIC ModelLabFacetValuesAttributes: description: Available values for a specific facet key. properties: facet_name: description: The name of the facet. example: model type: string facet_type: description: The type of the facet. example: tag type: string metric_stat_ranges: description: The ranges for each metric statistic. items: $ref: "#/components/schemas/ModelLabMetricStatRange" type: array numeric_range: $ref: "#/components/schemas/ModelLabNumericRange" values: description: The list of available string values for this facet. example: - gpt4 items: type: string type: array required: - facet_type - facet_name - values type: object ModelLabFacetValuesData: description: A facet values JSON:API resource object. properties: attributes: $ref: "#/components/schemas/ModelLabFacetValuesAttributes" id: description: The unique identifier of the facet values resource. example: "1" type: string type: $ref: "#/components/schemas/ModelLabFacetValuesType" required: - id - type - attributes type: object ModelLabFacetValuesResponse: description: Response containing available values for a facet key. properties: data: $ref: "#/components/schemas/ModelLabFacetValuesData" required: - data type: object ModelLabFacetValuesType: description: The JSON:API type for a facet values resource. enum: - facet_values example: facet_values type: string x-enum-varnames: - FACET_VALUES ModelLabMetricStatRange: description: The range of values for a specific metric statistic. properties: max: description: The maximum value of the statistic. example: 1.0 format: double type: number min: description: The minimum value of the statistic. example: 0.0 format: double type: number stat: description: The metric statistic name. example: mean type: string required: - stat - min - max type: object ModelLabMetricSummary: description: Summary statistics for a metric recorded during a Model Lab run. properties: count: description: The total number of recorded values. example: 100 format: int64 type: integer first_step: description: The first step at which the metric was recorded. format: int64 nullable: true type: integer key: description: The metric name. example: accuracy type: string last_step: description: The last step at which the metric was recorded. format: int64 nullable: true type: integer latest: description: The most recently recorded value. format: double nullable: true type: number max: description: The maximum recorded value. format: double nullable: true type: number mean: description: The mean of recorded values. format: double nullable: true type: number min: description: The minimum recorded value. format: double nullable: true type: number stddev: description: The standard deviation of recorded values. format: double nullable: true type: number required: - key - count type: object ModelLabNumericRange: description: The numeric range of values for a facet. properties: max: description: The maximum value. example: 1.0 format: double type: number min: description: The minimum value. example: 0.0 format: double type: number required: - min - max type: object ModelLabPageMeta: description: Pagination metadata for a list response. properties: page: $ref: "#/components/schemas/ModelLabPageMetaPage" required: - page type: object ModelLabPageMetaPage: description: Pagination details for a list response. properties: first_number: description: The first page number. format: int64 type: integer last_number: description: The last page number. format: int64 type: integer next_number: description: The next page number. format: int64 nullable: true type: integer number: description: The current page number. example: 1 format: int64 type: integer prev_number: description: The previous page number. format: int64 nullable: true type: integer size: description: The number of items per page. example: 25 format: int64 type: integer total: description: The total number of items. example: 100 format: int64 type: integer type: description: The pagination type. type: string required: - number - size - total type: object ModelLabPaginationLinks: description: Pagination links for navigating list responses. properties: first: description: Link to the first page. type: string last: description: Link to the last page. type: string next: description: Link to the next page. nullable: true type: string prev: description: Link to the previous page. nullable: true type: string self: description: Link to the current page. type: string type: object ModelLabProjectArtifactsAttributes: description: Artifact listing for a Model Lab project. properties: files: description: The list of artifact files associated with the project. items: $ref: "#/components/schemas/ModelLabArtifactInfo" type: array required: - files type: object ModelLabProjectArtifactsData: description: A project artifacts JSON:API resource object. properties: attributes: $ref: "#/components/schemas/ModelLabProjectArtifactsAttributes" id: description: The unique identifier of the project artifacts resource. example: "1" type: string type: $ref: "#/components/schemas/ModelLabProjectArtifactsType" required: - id - type - attributes type: object ModelLabProjectArtifactsResponse: description: Response containing the artifact listing for a Model Lab project. properties: data: $ref: "#/components/schemas/ModelLabProjectArtifactsData" required: - data type: object ModelLabProjectArtifactsType: description: The JSON:API type for a project artifacts resource. enum: - project_files example: project_files type: string x-enum-varnames: - PROJECT_FILES ModelLabProjectAttributes: description: Attributes of a Model Lab project. properties: artifact_storage_location: description: The storage location for project artifacts. example: s3://bucket/active-project type: string created_at: description: The date and time the project was created. example: "2024-01-20T10:00:00Z" format: date-time type: string deleted_at: description: The date and time the project was soft-deleted. format: date-time nullable: true type: string description: description: A description of the project. example: A machine learning training project. type: string external_url: description: An optional external URL associated with the project. nullable: true type: string is_starred: description: Whether the project is starred by the current user. example: false type: boolean name: description: The name of the project. example: active-project type: string owner_id: description: The UUID of the project owner. nullable: true type: string tags: description: The list of tags associated with the project. items: $ref: "#/components/schemas/ModelLabTag" type: array updated_at: description: The date and time the project was last updated. example: "2024-01-20T11:00:00Z" format: date-time type: string required: - name - description - artifact_storage_location - created_at - updated_at - tags - is_starred type: object ModelLabProjectData: description: A Model Lab project JSON:API resource object. properties: attributes: $ref: "#/components/schemas/ModelLabProjectAttributes" id: description: The unique identifier of the project. example: "2" type: string type: $ref: "#/components/schemas/ModelLabProjectType" required: - id - type - attributes type: object ModelLabProjectFacetType: description: The type of facet for filtering Model Lab projects. enum: - tag example: tag type: string x-enum-varnames: - TAG ModelLabProjectResponse: description: Response containing a single Model Lab project. properties: data: $ref: "#/components/schemas/ModelLabProjectData" required: - data type: object ModelLabProjectType: description: The JSON:API type for a Model Lab project resource. enum: - projects example: projects type: string x-enum-varnames: - PROJECTS ModelLabProjectsResponse: description: Response containing a list of Model Lab projects with pagination metadata. properties: data: description: The list of projects. items: $ref: "#/components/schemas/ModelLabProjectData" type: array links: $ref: "#/components/schemas/ModelLabPaginationLinks" meta: $ref: "#/components/schemas/ModelLabPageMeta" required: - data - meta type: object ModelLabRunArtifactsAttributes: description: Artifact listing for a Model Lab run. properties: files: description: The list of artifact files and directories. items: $ref: "#/components/schemas/ModelLabArtifactObjectInfo" type: array path_in_project: description: The path of the run's artifacts relative to the project's artifact root. example: runs/42 type: string required: - path_in_project - files type: object ModelLabRunArtifactsData: description: A run artifacts JSON:API resource object. properties: attributes: $ref: "#/components/schemas/ModelLabRunArtifactsAttributes" id: description: The unique identifier of the artifacts resource. example: "42" type: string type: $ref: "#/components/schemas/ModelLabRunArtifactsType" required: - id - type - attributes type: object ModelLabRunArtifactsResponse: description: Response containing the artifact listing for a Model Lab run. properties: data: $ref: "#/components/schemas/ModelLabRunArtifactsData" required: - data type: object ModelLabRunArtifactsType: description: The JSON:API type for a run artifacts resource. enum: - artifacts example: artifacts type: string x-enum-varnames: - ARTIFACTS ModelLabRunAttributes: description: Attributes of a Model Lab run. properties: completed_at: description: The date and time the run completed. format: date-time nullable: true type: string created_at: description: The date and time the run was created. example: "2024-01-20T10:00:00Z" format: date-time type: string deleted_at: description: The date and time the run was soft-deleted. format: date-time nullable: true type: string descendant_match: description: Whether a descendant run matched the applied filters. example: false type: boolean description: description: A description of the run. example: Fine-tuning run with custom hyperparameters. type: string duration: description: The duration of the run in seconds. format: double nullable: true type: number external_url: description: An optional external URL associated with the run. nullable: true type: string has_children: description: Whether the run has child runs. example: false type: boolean is_pinned: description: Whether the run is pinned by the current user. example: false type: boolean metric_summaries: description: Summary statistics for metrics recorded during the run. items: $ref: "#/components/schemas/ModelLabMetricSummary" type: array mlflow_artifact_location: description: The MLflow artifact storage location for this run. example: s3://bucket/active-run type: string name: description: The name of the run. example: training-run-1 type: string owner_id: description: The UUID of the run owner. nullable: true type: string params: description: The list of parameters used for the run. items: $ref: "#/components/schemas/ModelLabRunParam" nullable: true type: array project_id: description: The ID of the project this run belongs to. example: 101 format: int64 type: integer started_at: description: The date and time the run started. example: "2024-01-20T10:00:00Z" format: date-time type: string status: $ref: "#/components/schemas/ModelLabRunStatus" tags: description: The list of tags associated with the run. items: $ref: "#/components/schemas/ModelLabTag" type: array updated_at: description: The date and time the run was last updated. example: "2024-01-20T11:00:00Z" format: date-time type: string required: - project_id - name - description - status - mlflow_artifact_location - started_at - created_at - updated_at - tags - params - metric_summaries - is_pinned - has_children - descendant_match type: object ModelLabRunData: description: A Model Lab run JSON:API resource object. properties: attributes: $ref: "#/components/schemas/ModelLabRunAttributes" id: description: The unique identifier of the run. example: "42" type: string type: $ref: "#/components/schemas/ModelLabRunType" required: - id - type - attributes type: object ModelLabRunParam: description: A key-value parameter for a Model Lab run. properties: key: description: The parameter key. example: algorithm type: string value: description: The parameter value. example: gpt4 type: string required: - key - value type: object ModelLabRunResponse: description: Response containing a single Model Lab run. properties: data: $ref: "#/components/schemas/ModelLabRunData" required: - data type: object ModelLabRunStatus: description: The status of a Model Lab run. enum: - pending - running - completed - failed - killed - unresponsive - paused example: running type: string x-enum-varnames: - PENDING - RUNNING - COMPLETED - FAILED - KILLED - UNRESPONSIVE - PAUSED ModelLabRunType: description: The JSON:API type for a Model Lab run resource. enum: - runs example: runs type: string x-enum-varnames: - RUNS ModelLabRunsResponse: description: Response containing a list of Model Lab runs with pagination metadata. properties: data: description: The list of runs. items: $ref: "#/components/schemas/ModelLabRunData" type: array links: $ref: "#/components/schemas/ModelLabPaginationLinks" meta: $ref: "#/components/schemas/ModelLabPageMeta" required: - data - meta type: object ModelLabTag: description: A key-value tag attached to a resource. properties: key: description: The tag key. example: model type: string value: description: The tag value. example: opus type: string required: - key - value type: object MonitorAlertTrigger: additionalProperties: false description: A trigger created from a monitor alert. properties: monitor_alert_trigger: $ref: "#/components/schemas/MonitorAlertTriggerAttributes" type: $ref: "#/components/schemas/MonitorAlertTriggerType" required: - type - monitor_alert_trigger type: object MonitorAlertTriggerAttributes: description: Attributes for a monitor alert trigger. properties: event_id: description: The event ID associated with the monitor alert. example: "1234567890123456789" type: string event_ts: description: The timestamp of the event in Unix milliseconds. example: 1700000000000 format: int64 type: integer monitor_id: description: The monitor ID that triggered the alert. example: 12345678 format: int64 type: integer required: - monitor_id - event_id - event_ts type: object MonitorAlertTriggerType: description: The type of monitor alert trigger. enum: - monitor_alert_trigger example: monitor_alert_trigger type: string x-enum-varnames: - MONITOR_ALERT_TRIGGER MonitorConfigPolicyAttributeCreateRequest: description: Policy and policy type for a monitor configuration policy. properties: policy: $ref: "#/components/schemas/MonitorConfigPolicyPolicyCreateRequest" policy_type: $ref: "#/components/schemas/MonitorConfigPolicyType" required: - policy_type - policy type: object MonitorConfigPolicyAttributeEditRequest: description: Policy and policy type for a monitor configuration policy. properties: policy: $ref: "#/components/schemas/MonitorConfigPolicyPolicy" policy_type: $ref: "#/components/schemas/MonitorConfigPolicyType" required: - policy_type - policy type: object MonitorConfigPolicyAttributeResponse: description: Policy and policy type for a monitor configuration policy. properties: policy: $ref: "#/components/schemas/MonitorConfigPolicyPolicy" policy_type: $ref: "#/components/schemas/MonitorConfigPolicyType" type: object MonitorConfigPolicyCreateData: description: A monitor configuration policy data. properties: attributes: $ref: "#/components/schemas/MonitorConfigPolicyAttributeCreateRequest" type: $ref: "#/components/schemas/MonitorConfigPolicyResourceType" required: - type - attributes type: object MonitorConfigPolicyCreateRequest: description: Request for creating a monitor configuration policy. properties: data: $ref: "#/components/schemas/MonitorConfigPolicyCreateData" required: - data type: object MonitorConfigPolicyDowntimePolicy: additionalProperties: false description: Downtime duration attributes of a monitor configuration policy. properties: max_duration_ms: description: The maximum allowed downtime duration, in milliseconds. example: 3600000 format: int64 minimum: 1 type: integer required: - max_duration_ms type: object MonitorConfigPolicyDowntimePolicyCreateRequest: additionalProperties: false description: Downtime duration attributes of a monitor configuration policy. properties: max_duration_ms: description: The maximum allowed downtime duration, in milliseconds. example: 3600000 format: int64 minimum: 1 type: integer required: - max_duration_ms type: object MonitorConfigPolicyEditData: description: A monitor configuration policy data. properties: attributes: $ref: "#/components/schemas/MonitorConfigPolicyAttributeEditRequest" id: description: ID of this monitor configuration policy. example: "00000000-0000-1234-0000-000000000000" type: string type: $ref: "#/components/schemas/MonitorConfigPolicyResourceType" required: - id - type - attributes type: object MonitorConfigPolicyEditRequest: description: Request for editing a monitor configuration policy. properties: data: $ref: "#/components/schemas/MonitorConfigPolicyEditData" required: - data type: object MonitorConfigPolicyListResponse: description: Response for retrieving all monitor configuration policies. properties: data: description: An array of monitor configuration policies. items: $ref: "#/components/schemas/MonitorConfigPolicyResponseData" type: array type: object MonitorConfigPolicyPolicy: description: Configuration for the policy. oneOf: - $ref: "#/components/schemas/MonitorConfigPolicyTagPolicy" - $ref: "#/components/schemas/MonitorConfigPolicyDowntimePolicy" MonitorConfigPolicyPolicyCreateRequest: description: Configuration for the policy. oneOf: - $ref: "#/components/schemas/MonitorConfigPolicyTagPolicyCreateRequest" - $ref: "#/components/schemas/MonitorConfigPolicyDowntimePolicyCreateRequest" MonitorConfigPolicyResourceType: default: monitor-config-policy description: Monitor configuration policy resource type. enum: - monitor-config-policy example: "monitor-config-policy" type: string x-enum-varnames: - MONITOR_CONFIG_POLICY MonitorConfigPolicyResponse: description: Response for retrieving a monitor configuration policy. properties: data: $ref: "#/components/schemas/MonitorConfigPolicyResponseData" type: object MonitorConfigPolicyResponseData: description: A monitor configuration policy data. properties: attributes: $ref: "#/components/schemas/MonitorConfigPolicyAttributeResponse" id: description: ID of this monitor configuration policy. example: "00000000-0000-1234-0000-000000000000" type: string type: $ref: "#/components/schemas/MonitorConfigPolicyResourceType" type: object MonitorConfigPolicyTagPolicy: additionalProperties: false description: Tag attributes of a monitor configuration policy. properties: tag_key: description: The key of the tag. example: datacenter maxLength: 255 type: string tag_key_required: description: If a tag key is required for monitor creation. example: true type: boolean valid_tag_values: description: Valid values for the tag. example: ["prod", "staging"] items: description: A valid tag value for the monitor configuration policy. maxLength: 255 type: string type: array type: object MonitorConfigPolicyTagPolicyCreateRequest: additionalProperties: false description: Tag attributes of a monitor configuration policy. properties: tag_key: description: The key of the tag. example: datacenter maxLength: 255 type: string tag_key_required: description: If a tag key is required for monitor creation. example: true type: boolean valid_tag_values: description: Valid values for the tag. example: ["prod", "staging"] items: description: A valid tag value for the monitor configuration policy. maxLength: 255 type: string type: array required: - tag_key - tag_key_required - valid_tag_values type: object MonitorConfigPolicyType: default: tag description: |- The monitor configuration policy type. `tag` enforces required tags on monitors. `downtime` sets a maximum downtime duration for the organization. enum: - tag - downtime example: "tag" type: string x-enum-varnames: - TAG - DOWNTIME MonitorDowntimeMatchResourceType: default: downtime_match description: Monitor Downtime Match resource type. enum: - downtime_match example: "downtime_match" type: string x-enum-varnames: - DOWNTIME_MATCH MonitorDowntimeMatchResponse: description: Response for retrieving all downtime matches for a monitor. properties: data: description: An array of downtime matches. items: $ref: "#/components/schemas/MonitorDowntimeMatchResponseData" type: array meta: $ref: "#/components/schemas/DowntimeMeta" type: object MonitorDowntimeMatchResponseAttributes: description: Downtime match details. properties: end: description: The end of the downtime. example: 2020-01-02 03:04:00+00:00 format: date-time nullable: true type: string groups: description: An array of groups associated with the downtime. example: ["service:postgres", "team:frontend"] items: description: An array of groups. example: "service:postgres" type: string type: array scope: $ref: "#/components/schemas/DowntimeScope" start: description: The start of the downtime. example: 2020-01-02 03:04:00+00:00 format: date-time type: string type: object MonitorDowntimeMatchResponseData: description: A downtime match. properties: attributes: $ref: "#/components/schemas/MonitorDowntimeMatchResponseAttributes" id: description: The downtime ID. example: "00000000-0000-1234-0000-000000000000" nullable: true type: string type: $ref: "#/components/schemas/MonitorDowntimeMatchResourceType" type: object MonitorNotificationRuleAttributes: additionalProperties: false description: Attributes of the monitor notification rule. properties: bundle_config: $ref: "#/components/schemas/MonitorNotificationRuleBundleConfig" conditional_recipients: $ref: "#/components/schemas/MonitorNotificationRuleConditionalRecipients" filter: $ref: "#/components/schemas/MonitorNotificationRuleFilter" name: $ref: "#/components/schemas/MonitorNotificationRuleName" recipients: $ref: "#/components/schemas/MonitorNotificationRuleRecipients" rule_options: $ref: "#/components/schemas/MonitorNotificationRuleOptions" required: [name] type: object MonitorNotificationRuleBundleConfig: description: |- Use bundle config to enable alert bundling to reduce monitor signal noises. **Note**: This feature is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). properties: duration: description: Duration of the bundling period. example: 3600 format: int32 maximum: 2147483647 type: integer required: [duration] type: object MonitorNotificationRuleCondition: description: |- A conditional recipient rule composed of a `scope` (the matching condition) and `recipients` (who to notify when it matches). properties: recipients: $ref: "#/components/schemas/MonitorNotificationRuleRecipients" description: A list of recipients to notify. Uses the same format as the monitor `message` field. Must not start with an '@'. scope: $ref: "#/components/schemas/MonitorNotificationRuleConditionScope" required: [scope, recipients] type: object MonitorNotificationRuleConditionScope: description: |- Defines the condition under which the recipients are notified. Supported formats: - Monitor status condition using `transition_type:`, for example `transition_type:is_alert`. - A single tag key:value pair, for example `env:prod`. example: transition_type:is_alert maxLength: 3000 minLength: 1 type: string MonitorNotificationRuleConditionalRecipients: description: |- Use conditional recipients to define different recipients for different situations. Cannot be used with `recipients`. properties: conditions: description: Conditions of the notification rule. items: $ref: "#/components/schemas/MonitorNotificationRuleCondition" maxItems: 10 minItems: 1 type: array fallback_recipients: $ref: "#/components/schemas/MonitorNotificationRuleRecipients" description: If none of the `conditions` applied, `fallback_recipients` will get notified. required: [conditions] type: object MonitorNotificationRuleCreateRequest: description: Request for creating a monitor notification rule. properties: data: $ref: "#/components/schemas/MonitorNotificationRuleCreateRequestData" required: [data] type: object MonitorNotificationRuleCreateRequestData: description: Object to create a monitor notification rule. properties: attributes: $ref: "#/components/schemas/MonitorNotificationRuleAttributes" type: $ref: "#/components/schemas/MonitorNotificationRuleResourceType" required: [attributes] type: object MonitorNotificationRuleData: description: Monitor notification rule data. properties: attributes: $ref: "#/components/schemas/MonitorNotificationRuleResponseAttributes" id: $ref: "#/components/schemas/MonitorNotificationRuleId" relationships: $ref: "#/components/schemas/MonitorNotificationRuleRelationships" type: $ref: "#/components/schemas/MonitorNotificationRuleResourceType" type: object MonitorNotificationRuleFilter: description: Specifies the matching criteria for monitor notifications. oneOf: - $ref: "#/components/schemas/MonitorNotificationRuleFilterTags" - $ref: "#/components/schemas/MonitorNotificationRuleFilterScope" MonitorNotificationRuleFilterScope: additionalProperties: false description: Filters monitor notifications using a scope expression over key:value pairs with boolean logic (AND, OR, NOT). properties: scope: description: |- A scope expression composed by key:value pairs (e.g. `service:foo`) with boolean operators (AND, OR, NOT) and parentheses for grouping. example: service:(foo OR bar) AND team:test NOT environment:staging maxLength: 3000 minLength: 1 type: string required: [scope] type: object MonitorNotificationRuleFilterTags: additionalProperties: false description: Filters monitor notifications by a list of tag key:value pairs. properties: tags: description: |- A list of tag key:value pairs (e.g. `team:product`). All tags must match (AND semantics). example: [team:product, host:abc] items: description: A tag key:value pair to match against monitor notifications. maxLength: 255 type: string maxItems: 20 minItems: 1 type: array uniqueItems: true required: [tags] type: object MonitorNotificationRuleId: description: The ID of the monitor notification rule. example: 00000000-0000-1234-0000-000000000000 type: string MonitorNotificationRuleListResponse: description: Response for retrieving all monitor notification rules. properties: data: description: A list of monitor notification rules. items: $ref: "#/components/schemas/MonitorNotificationRuleData" type: array included: description: Array of objects related to the monitor notification rules. items: $ref: "#/components/schemas/MonitorNotificationRuleResponseIncludedItem" type: array type: object MonitorNotificationRuleName: description: The name of the monitor notification rule. example: A notification rule name maxLength: 1000 minLength: 1 type: string MonitorNotificationRuleOptions: description: Additional options for the monitor notification rule. properties: is_threaded: description: |- Whether notifications from this rule are threaded. When `true`, follow-up notifications for the same monitor alert are posted in Slack as replies to the first notification. Cannot be `true` when `bundle_config` is set. example: true type: boolean required: [is_threaded] type: object MonitorNotificationRuleRecipients: description: |- A list of recipients to notify. Uses the same format as the monitor `message` field. Must not start with an '@'. Cannot be used with `conditional_recipients`. example: [slack-test-channel, jira-test] items: description: individual recipient. maxLength: 255 type: string maxItems: 20 minItems: 1 type: array uniqueItems: true MonitorNotificationRuleRelationships: description: All relationships associated with monitor notification rule. properties: created_by: $ref: "#/components/schemas/MonitorNotificationRuleRelationshipsCreatedBy" type: object MonitorNotificationRuleRelationshipsCreatedBy: description: The user who created the monitor notification rule. properties: data: $ref: "#/components/schemas/MonitorNotificationRuleRelationshipsCreatedByData" type: object MonitorNotificationRuleRelationshipsCreatedByData: description: Data for the user who created the monitor notification rule. nullable: true properties: id: description: User ID of the monitor notification rule creator. example: "00000000-0000-1234-0000-000000000000" type: string type: $ref: "#/components/schemas/UsersType" type: object MonitorNotificationRuleResourceType: default: monitor-notification-rule description: Monitor notification rule resource type. enum: [monitor-notification-rule] example: monitor-notification-rule type: string x-enum-varnames: [MONITOR_NOTIFICATION_RULE] MonitorNotificationRuleResponse: description: A monitor notification rule. properties: data: $ref: "#/components/schemas/MonitorNotificationRuleData" included: description: Array of objects related to the monitor notification rule that the user requested. items: $ref: "#/components/schemas/MonitorNotificationRuleResponseIncludedItem" type: array type: object MonitorNotificationRuleResponseAttributes: additionalProperties: {} description: Attributes of the monitor notification rule. properties: bundle_config: $ref: "#/components/schemas/MonitorNotificationRuleBundleConfig" conditional_recipients: $ref: "#/components/schemas/MonitorNotificationRuleConditionalRecipients" created: description: Creation time of the monitor notification rule. example: 2020-01-02 03:04:00+00:00 format: date-time type: string filter: $ref: "#/components/schemas/MonitorNotificationRuleFilter" modified: description: Time the monitor notification rule was last modified. example: 2020-01-02 03:04:00+00:00 format: date-time type: string name: $ref: "#/components/schemas/MonitorNotificationRuleName" recipients: $ref: "#/components/schemas/MonitorNotificationRuleRecipients" rule_options: $ref: "#/components/schemas/MonitorNotificationRuleOptions" type: object MonitorNotificationRuleResponseIncludedItem: description: An object related to a monitor notification rule. oneOf: - $ref: "#/components/schemas/User" MonitorNotificationRuleUpdateRequest: description: Request for updating a monitor notification rule. properties: data: $ref: "#/components/schemas/MonitorNotificationRuleUpdateRequestData" required: [data] type: object MonitorNotificationRuleUpdateRequestData: description: Object to update a monitor notification rule. properties: attributes: $ref: "#/components/schemas/MonitorNotificationRuleAttributes" id: $ref: "#/components/schemas/MonitorNotificationRuleId" type: $ref: "#/components/schemas/MonitorNotificationRuleResourceType" required: [id, attributes] type: object MonitorTrigger: description: "Trigger a workflow from a Monitor. For automatic triggering a handle must be configured and the workflow must be published." properties: rateLimit: $ref: "#/components/schemas/TriggerRateLimit" type: object MonitorTriggerWrapper: description: "Schema for a Monitor-based trigger." properties: monitorTrigger: $ref: "#/components/schemas/MonitorTrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - monitorTrigger type: object MonitorType: description: |- Attributes from the monitor that triggered the event. nullable: true properties: created_at: description: The POSIX timestamp of the monitor's creation in nanoseconds. example: 1646318692000 format: int64 type: integer group_status: description: Monitor group status used when there is no `result_groups`. format: int32 maximum: 2147483647 type: integer groups: description: Groups to which the monitor belongs. items: description: A group. type: string type: array id: description: The monitor ID. format: int64 type: integer message: description: The monitor message. type: string modified: description: The monitor's last-modified timestamp. format: int64 type: integer name: description: The monitor name. type: string query: description: The query that triggers the alert. type: string tags: description: A list of tags attached to the monitor. example: ["environment:test"] items: description: A tag. type: string type: array templated_name: description: The templated name of the monitor before resolving any template variables. type: string type: description: The monitor type. type: string type: object MonitorUserTemplate: additionalProperties: {} description: A monitor user template object. properties: created: $ref: "#/components/schemas/MonitorUserTemplateCreated" description: $ref: "#/components/schemas/MonitorUserTemplateDescription" modified: $ref: "#/components/schemas/MonitorUserTemplateModified" monitor_definition: additionalProperties: {} description: A valid monitor definition in the same format as the [V1 Monitor API](https://docs.datadoghq.com/api/latest/monitors/#create-a-monitor). example: {"message": "You may need to add web hosts if this is consistently high.", "name": "Bytes received on host0", "query": "avg(last_5m):sum:system.net.bytes_rcvd{host:host0} > 100", "type": "query alert"} type: object tags: $ref: "#/components/schemas/MonitorUserTemplateTags" template_variables: $ref: "#/components/schemas/MonitorUserTemplateTemplateVariables" title: $ref: "#/components/schemas/MonitorUserTemplateTitle" version: $ref: "#/components/schemas/MonitorUserTemplateVersion" versions: description: All versions of the monitor user template. items: $ref: "#/components/schemas/SimpleMonitorUserTemplate" type: array type: object MonitorUserTemplateCreateData: description: Monitor user template data. properties: attributes: $ref: "#/components/schemas/MonitorUserTemplateRequestAttributes" type: $ref: "#/components/schemas/MonitorUserTemplateResourceType" required: - type - attributes type: object MonitorUserTemplateCreateRequest: description: Request for creating a monitor user template. properties: data: $ref: "#/components/schemas/MonitorUserTemplateCreateData" required: - data type: object MonitorUserTemplateCreateResponse: description: Response for creating a monitor user template. properties: data: $ref: "#/components/schemas/MonitorUserTemplateResponseData" type: object MonitorUserTemplateCreated: description: The created timestamp of the template. example: "2024-01-02T03:04:23.274966+00:00" format: date-time readOnly: true type: string MonitorUserTemplateDescription: description: A brief description of the monitor user template. example: "This is a template for monitoring user activity." nullable: true type: string MonitorUserTemplateId: description: The unique identifier. example: "00000000-0000-1234-0000-000000000000" type: string MonitorUserTemplateListResponse: description: Response for retrieving all monitor user templates. properties: data: description: An array of monitor user templates. items: $ref: "#/components/schemas/MonitorUserTemplateResponseData" type: array type: object MonitorUserTemplateModified: description: The last modified timestamp. When the template version was created. example: "2024-02-02T03:04:23.274966+00:00" format: date-time readOnly: true type: string MonitorUserTemplateRequestAttributes: additionalProperties: false description: Attributes for a monitor user template. properties: description: $ref: "#/components/schemas/MonitorUserTemplateDescription" monitor_definition: additionalProperties: {} description: A valid monitor definition in the same format as the [V1 Monitor API](https://docs.datadoghq.com/api/latest/monitors/#create-a-monitor). example: {"message": "You may need to add web hosts if this is consistently high.", "name": "Bytes received on host0", "query": "avg(last_5m):sum:system.net.bytes_rcvd{host:host0} > 100", "type": "query alert"} type: object tags: $ref: "#/components/schemas/MonitorUserTemplateTags" template_variables: $ref: "#/components/schemas/MonitorUserTemplateTemplateVariables" title: $ref: "#/components/schemas/MonitorUserTemplateTitle" required: - title - monitor_definition - tags type: object MonitorUserTemplateResourceType: default: monitor-user-template description: Monitor user template resource type. enum: - monitor-user-template example: "monitor-user-template" type: string x-enum-varnames: - MONITOR_USER_TEMPLATE MonitorUserTemplateResponse: description: Response for retrieving a monitor user template. properties: data: $ref: "#/components/schemas/MonitorUserTemplateResponseDataWithVersions" type: object MonitorUserTemplateResponseAttributes: additionalProperties: {} description: Attributes for a monitor user template. properties: created: $ref: "#/components/schemas/MonitorUserTemplateCreated" description: $ref: "#/components/schemas/MonitorUserTemplateDescription" modified: $ref: "#/components/schemas/MonitorUserTemplateModified" monitor_definition: additionalProperties: {} description: A valid monitor definition in the same format as the [V1 Monitor API](https://docs.datadoghq.com/api/latest/monitors/#create-a-monitor). example: {"message": "You may need to add web hosts if this is consistently high.", "name": "Bytes received on host0", "query": "avg(last_5m):sum:system.net.bytes_rcvd{host:host0} > 100", "type": "query alert"} type: object tags: $ref: "#/components/schemas/MonitorUserTemplateTags" template_variables: $ref: "#/components/schemas/MonitorUserTemplateTemplateVariables" title: $ref: "#/components/schemas/MonitorUserTemplateTitle" version: $ref: "#/components/schemas/MonitorUserTemplateVersion" type: object MonitorUserTemplateResponseData: description: Monitor user template list response data. properties: attributes: $ref: "#/components/schemas/MonitorUserTemplateResponseAttributes" id: $ref: "#/components/schemas/MonitorUserTemplateId" type: $ref: "#/components/schemas/MonitorUserTemplateResourceType" type: object MonitorUserTemplateResponseDataWithVersions: description: Monitor user template data. properties: attributes: $ref: "#/components/schemas/MonitorUserTemplate" id: $ref: "#/components/schemas/MonitorUserTemplateId" type: $ref: "#/components/schemas/MonitorUserTemplateResourceType" type: object MonitorUserTemplateTags: description: The definition of `MonitorUserTemplateTags` object. example: ["product:Our Custom App", "integration:Azure"] items: description: |- Tags associated with the monitor user template. Must be key value. Only 'product' and 'integration' keys are allowed. The value is the name of the category to display the template under. Integrations can be filtered out in the UI. (Review note: This modeling of 'categories' is subject to change.) example: "us-east1" minLength: 1 type: string uniqueItems: true type: array MonitorUserTemplateTemplateVariables: description: The definition of `MonitorUserTemplateTemplateVariables` object. items: $ref: "#/components/schemas/MonitorUserTemplateTemplateVariablesItems" type: array MonitorUserTemplateTemplateVariablesItems: additionalProperties: false description: List of objects representing template variables on the monitor which can have selectable values. properties: available_values: description: Available values for the variable. example: ["value1", "value2"] items: description: An available value for the template variable. minLength: 1 type: string uniqueItems: true type: array defaults: description: Default values of the template variable. example: ["defaultValue"] items: description: A default value for the template variable. minLength: 0 type: string uniqueItems: true type: array name: description: The name of the template variable. example: "regionName" type: string tag_key: description: |- The tag key associated with the variable. This works the same as dashboard template variables. example: "datacenter" type: string required: - name type: object MonitorUserTemplateTitle: description: The title of the monitor user template. example: "Postgres CPU Monitor" type: string MonitorUserTemplateUpdateData: description: Monitor user template data. properties: attributes: $ref: "#/components/schemas/MonitorUserTemplateRequestAttributes" id: $ref: "#/components/schemas/MonitorUserTemplateId" type: $ref: "#/components/schemas/MonitorUserTemplateResourceType" required: - id - type - attributes type: object MonitorUserTemplateUpdateRequest: description: Request for creating a new monitor user template version. properties: data: $ref: "#/components/schemas/MonitorUserTemplateUpdateData" required: - data type: object MonitorUserTemplateVersion: description: The version of the monitor user template. example: 0 format: int64 nullable: true readOnly: true type: integer MonthlyCostAttributionAttributes: description: Cost Attribution by Tag for a given organization. properties: month: description: "Datetime in ISO-8601 format, UTC, precise to hour: `[YYYY-MM-DDThh]`." format: date-time type: string org_name: description: The name of the organization. type: string public_id: description: The organization public ID. type: string tag_config_source: description: The source of the cost attribution tag configuration and the selected tags in the format `::://////`. type: string tags: $ref: "#/components/schemas/CostAttributionTagNames" updated_at: description: Shows the most recent hour in the current months for all organizations for which all costs were calculated. type: string values: description: |- Fields in Cost Attribution by tag(s). Example: `infra_host_on_demand_cost`, `infra_host_committed_cost`, `infra_host_total_cost`, `infra_host_percentage_in_org`, `infra_host_percentage_in_account`. type: object type: object MonthlyCostAttributionBody: description: Cost data. properties: attributes: $ref: "#/components/schemas/MonthlyCostAttributionAttributes" id: description: Unique ID of the response. type: string type: $ref: "#/components/schemas/CostAttributionType" type: object MonthlyCostAttributionMeta: description: The object containing document metadata. properties: aggregates: $ref: "#/components/schemas/CostAttributionAggregates" pagination: $ref: "#/components/schemas/MonthlyCostAttributionPagination" type: object MonthlyCostAttributionPagination: description: The metadata for the current pagination. properties: next_record_id: description: The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of the `next_record_id`. nullable: true type: string type: object MonthlyCostAttributionResponse: description: Response containing the monthly cost attribution by tag(s). properties: data: description: Response containing cost attribution. items: $ref: "#/components/schemas/MonthlyCostAttributionBody" type: array meta: $ref: "#/components/schemas/MonthlyCostAttributionMeta" type: object MuteDataType: default: mute description: Mute resource type. enum: - mute example: mute type: string x-enum-varnames: - MUTE MuteFindingsMuteAttributes: description: Mute properties to apply to the findings. properties: description: description: Additional information about the reason why the findings are muted or unmuted. This field has a limit of 280 characters. example: "To be resolved later." type: string expire_at: description: >- The expiration date of the mute action (Unix ms). It must be set to a value greater than the current timestamp. If this field is not provided, the findings remain muted indefinitely. example: 1778721573794 format: int64 type: integer is_muted: description: Whether the findings should be muted or unmuted. example: true type: boolean reason: $ref: "#/components/schemas/MuteFindingsReason" description: The reason why the findings are muted or unmuted. required: - is_muted - reason type: object MuteFindingsReason: description: The reason why the findings are muted or unmuted. enum: - PENDING_FIX - FALSE_POSITIVE - OTHER - NO_FIX - DUPLICATE - RISK_ACCEPTED - NO_PENDING_FIX - HUMAN_ERROR - NO_LONGER_ACCEPTED_RISK example: PENDING_FIX type: string x-enum-varnames: - PENDING_FIX - FALSE_POSITIVE - OTHER - NO_FIX - DUPLICATE - RISK_ACCEPTED - NO_PENDING_FIX - HUMAN_ERROR - NO_LONGER_ACCEPTED_RISK MuteFindingsRequest: description: Request to mute or unmute security findings. properties: data: $ref: "#/components/schemas/MuteFindingsRequestData" required: - data type: object MuteFindingsRequestData: description: Data of the mute request. properties: attributes: $ref: "#/components/schemas/MuteFindingsRequestDataAttributes" id: description: Unique identifier of the mute request. example: "00000000-0000-0000-0000-000000000001" type: string relationships: $ref: "#/components/schemas/MuteFindingsRequestDataRelationships" type: $ref: "#/components/schemas/MuteDataType" required: - attributes - relationships - type type: object MuteFindingsRequestDataAttributes: description: Attributes of the mute request. properties: mute: $ref: "#/components/schemas/MuteFindingsMuteAttributes" required: - mute type: object MuteFindingsRequestDataRelationships: description: Relationships of the mute request. properties: findings: $ref: "#/components/schemas/Findings" description: Security findings to mute or unmute. required: - findings type: object MuteFindingsResponse: description: Response for the mute or unmute request. properties: data: $ref: "#/components/schemas/MuteFindingsResponseData" type: object MuteFindingsResponseData: description: Data of the mute response. properties: id: description: Unique identifier of the mute request. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/MuteDataType" required: - type - id type: object MuteReason: description: The reason for muting a security finding. enum: - duplicate - false_positive - no_fix - other - pending_fix - risk_accepted example: risk_accepted type: string x-enum-varnames: - DUPLICATE - FALSE_POSITIVE - NO_FIX - OTHER - PENDING_FIX - RISK_ACCEPTED MuteRuleAction: description: The action to take when the mute rule matches a finding. properties: expire_at: description: The Unix timestamp in milliseconds at which the mute expires. If omitted, the mute does not expire. example: 4070908800000 format: int64 type: integer reason: $ref: "#/components/schemas/MuteReason" reason_description: description: An optional description providing more context for the mute reason. example: "Accepted for dev environments only" maxLength: 20000 type: string required: - reason type: object MuteRuleAttributesCreate: description: Attributes for creating or updating a mute rule. properties: action: $ref: "#/components/schemas/MuteRuleAction" enabled: description: Whether the mute rule is enabled. example: true type: boolean name: description: The name of the mute rule. example: "Mute accepted risks in dev" maxLength: 255 minLength: 1 type: string rule: $ref: "#/components/schemas/AutomationRuleScope" required: - name - rule - action type: object MuteRuleAttributesResponse: description: Attributes of a mute rule returned by the API. properties: action: $ref: "#/components/schemas/MuteRuleAction" created_at: description: The Unix timestamp in milliseconds when the rule was created. example: 1722439510282 format: int64 type: integer created_by: $ref: "#/components/schemas/AutomationRuleCreatedBy" enabled: description: Whether the mute rule is enabled. example: true type: boolean modified_at: description: The Unix timestamp in milliseconds when the rule was last modified. example: 1722439510282 format: int64 type: integer modified_by: $ref: "#/components/schemas/AutomationRuleModifiedBy" name: description: The name of the mute rule. example: "Mute accepted risks in dev" maxLength: 255 minLength: 1 type: string rule: $ref: "#/components/schemas/AutomationRuleScope" required: - name - enabled - rule - action - created_at - created_by - modified_at - modified_by type: object MuteRuleCreateRequest: description: The body of a mute rule create request. properties: data: $ref: "#/components/schemas/MuteRuleDataCreate" required: - data type: object MuteRuleDataCreate: description: The data object for a mute rule create request. properties: attributes: $ref: "#/components/schemas/MuteRuleAttributesCreate" type: $ref: "#/components/schemas/MuteRuleType" required: - type - attributes type: object MuteRuleDataResponse: description: The data object for a mute rule returned by the API. properties: attributes: $ref: "#/components/schemas/MuteRuleAttributesResponse" id: description: The ID of the mute rule. example: "00000000-0000-0000-0000-000000000000" format: uuid type: string type: $ref: "#/components/schemas/MuteRuleType" required: - id - type - attributes type: object MuteRuleDataUpdate: description: The data object for a mute rule update request. The `id` must match the `rule_id` path parameter. properties: attributes: $ref: "#/components/schemas/MuteRuleAttributesCreate" id: description: The ID of the mute rule to update. example: "00000000-0000-0000-0000-000000000000" format: uuid type: string type: $ref: "#/components/schemas/MuteRuleType" required: - id - type - attributes type: object MuteRuleReorderData: description: The ordered list of all mute rules. Every rule must be included. items: $ref: "#/components/schemas/MuteRuleReorderItem" type: array MuteRuleReorderItem: description: A reference to a mute rule used for reordering. properties: id: description: The ID of the mute rule. example: "00000000-0000-0000-0000-000000000000" format: uuid type: string type: $ref: "#/components/schemas/MuteRuleType" required: - type - id type: object MuteRuleReorderRequest: description: The body of a mute rule reorder request. properties: data: $ref: "#/components/schemas/MuteRuleReorderData" required: - data type: object MuteRuleReorderResponse: description: The response of a mute rule reorder request. properties: data: $ref: "#/components/schemas/MuteRuleReorderData" required: - data type: object MuteRuleResponse: description: A single mute rule response. properties: data: $ref: "#/components/schemas/MuteRuleDataResponse" required: - data type: object MuteRuleType: description: The JSON:API type for mute rules. enum: - mute_rules example: mute_rules type: string x-enum-varnames: - MUTE_RULES MuteRuleUpdateRequest: description: The body of a mute rule update request. properties: data: $ref: "#/components/schemas/MuteRuleDataUpdate" required: - data type: object MuteRulesDataList: description: A list of mute rule data objects. items: $ref: "#/components/schemas/MuteRuleDataResponse" type: array MuteRulesResponse: description: A list of mute rules with pagination metadata. properties: data: $ref: "#/components/schemas/MuteRulesDataList" links: $ref: "#/components/schemas/SecurityAutomationRulesLinks" meta: $ref: "#/components/schemas/SecurityAutomationRulesMeta" required: - data - meta - links type: object NDKSourcemapAttributes: description: Attributes of an Android NDK symbol file. properties: arch: description: The target CPU architecture. example: arm64-v8a type: string build_id: description: The build identifier (UUID format). example: 550e8400-e29b-41d4-a716-446655440000 type: string created_at: description: The timestamp when the symbol file was created. example: "2024-01-01T00:00:00Z" format: date-time type: string file_name: description: The NDK library file name. example: libmyapp.so type: string mapkind: $ref: "#/components/schemas/NDKSourcemapMapKind" size: description: The size of the symbol file in bytes. example: 32768 format: int64 type: integer required: - mapkind - size - created_at type: object NDKSourcemapData: description: Android NDK symbol file data object. properties: attributes: $ref: "#/components/schemas/NDKSourcemapAttributes" id: description: The unique identifier of the source map. example: "7" type: string type: $ref: "#/components/schemas/SourcemapDataType" required: - id - type - attributes type: object NDKSourcemapMapKind: description: The type of source map. Always `ndk` for Android NDK source maps. enum: - ndk example: ndk type: string x-enum-varnames: - NDK NodeType: additionalProperties: {} description: A tree-sitter node type definition for a given language, describing the node's structure, subtypes, and fields. type: object NodeTypesResponse: description: The response payload containing tree-sitter node type definitions for a programming language. properties: data: $ref: "#/components/schemas/NodeTypesResponseData" required: - data type: object NodeTypesResponseData: description: The primary data object in the node types response. properties: attributes: $ref: "#/components/schemas/NodeTypesResponseDataAttributes" id: description: The unique identifier of the node types response resource. example: python type: string type: $ref: "#/components/schemas/NodeTypesResponseDataType" required: - id - type - attributes type: object NodeTypesResponseDataAttributes: description: The attributes of the node types response, containing the list of node type definitions for the requested language. properties: node_types: description: The list of tree-sitter node type definitions for the language. items: $ref: "#/components/schemas/NodeType" type: array required: - node_types type: object NodeTypesResponseDataType: default: get_node_types_response description: Get node types response resource type. enum: - get_node_types_response example: get_node_types_response type: string x-enum-varnames: - GET_NODE_TYPES_RESPONSE NotebookTriggerWrapper: description: "Schema for a Notebook-based trigger." properties: notebookTrigger: description: "Trigger a workflow from a Notebook." type: object startStepNames: $ref: "#/components/schemas/StartStepNames" required: - notebookTrigger type: object NotificationChannel: description: A top-level wrapper for a user notification channel example: data: attributes: config: address: "foo@bar.com" formats: ["html"] type: "email" id: 27590dae-47be-4a7d-9abf-8f4e45124020 type: notification_channels properties: data: $ref: "#/components/schemas/NotificationChannelData" type: object NotificationChannelAttributes: description: Attributes for an on-call notification channel. properties: active: description: Whether the notification channel is currently active. type: boolean config: $ref: "#/components/schemas/NotificationChannelConfig" description: Notification channel configuration type: object NotificationChannelConfig: description: "Defines the configuration for an On-Call notification channel" oneOf: - $ref: "#/components/schemas/NotificationChannelPhoneConfig" - $ref: "#/components/schemas/NotificationChannelEmailConfig" - $ref: "#/components/schemas/NotificationChannelPushConfig" NotificationChannelData: description: Data for an on-call notification channel properties: attributes: $ref: "#/components/schemas/NotificationChannelAttributes" id: description: Unique identifier for the channel type: string type: $ref: "#/components/schemas/NotificationChannelType" required: - type type: object NotificationChannelEmailConfig: description: "Email notification channel configuration" properties: address: description: "The e-mail address to be notified" example: "" type: string formats: description: Preferred content formats for notifications. example: - html items: $ref: "#/components/schemas/NotificationChannelEmailFormatType" type: array type: $ref: "#/components/schemas/NotificationChannelEmailConfigType" verified: description: Whether this email address has been verified. type: boolean required: - type - address - formats type: object NotificationChannelEmailConfigType: default: email description: "Indicates that the notification channel is an e-mail address" enum: - email example: email type: string x-enum-varnames: - EMAIL NotificationChannelEmailFormatType: default: html description: Specifies the format of the e-mail that is sent for On-Call notifications enum: - html - text example: html type: string x-enum-varnames: - HTML - TEXT NotificationChannelPhoneConfig: description: "Phone notification channel configuration" properties: available_notification_types: description: Notification methods currently available for this phone number. Omitted when no methods are available. items: $ref: "#/components/schemas/OnCallPhoneNotificationRuleMethod" type: array formatted_number: description: "The formatted international version of Number (e.g. +33 7 1 23 45 67)." example: "" type: string number: description: "The E-164 formatted phone number (e.g. +3371234567)" example: "" type: string region: description: "The ISO 3166-1 alpha-2 two-letter country code." example: "" type: string sms_subscribed_at: description: "If present, the date the user subscribed this number to SMS messages" format: date-time nullable: true type: string type: $ref: "#/components/schemas/NotificationChannelPhoneConfigType" verified: description: "Indicates whether this phone has been verified by the user in Datadog On-Call" example: false type: boolean required: - type - number - formatted_number - region - verified type: object NotificationChannelPhoneConfigType: default: phone description: "Indicates that the notification channel is a phone" enum: - phone example: phone type: string x-enum-varnames: - PHONE NotificationChannelPushConfig: description: "Push notification channel configuration" properties: application_name: description: "The name of the application used to receive push notifications" example: "" type: string device_name: description: "The name of the mobile device being used" example: "" type: string type: $ref: "#/components/schemas/NotificationChannelPushConfigType" required: - type - device_name - application_name type: object NotificationChannelPushConfigType: default: push description: "Indicates that the notification channel is a mobile device for push notifications" enum: - push example: push type: string x-enum-varnames: - PUSH NotificationChannelType: default: notification_channels description: "Indicates that the resource is of type `notification_channels`." enum: - notification_channels example: notification_channels type: string x-enum-varnames: - NOTIFICATION_CHANNELS NotificationRule: description: |- Notification rules allow full control over notifications generated by the various Datadog security products. They allow users to define the conditions under which a notification should be generated (based on rule severities, rule types, rule tags, and so on), and the targets to notify. A notification rule is composed of a rule ID, a rule type, and the rule attributes. All fields are required. properties: attributes: $ref: "#/components/schemas/NotificationRuleAttributes" id: $ref: "#/components/schemas/ID" type: $ref: "#/components/schemas/NotificationRulesType" required: - attributes - id - type type: object NotificationRuleAttributes: description: Attributes of the notification rule. properties: created_at: $ref: "#/components/schemas/Date" created_by: $ref: "#/components/schemas/RuleUser" enabled: $ref: "#/components/schemas/Enabled" modified_at: $ref: "#/components/schemas/Date" modified_by: $ref: "#/components/schemas/RuleUser" name: $ref: "#/components/schemas/RuleName" selectors: $ref: "#/components/schemas/Selectors" targets: $ref: "#/components/schemas/Targets" time_aggregation: $ref: "#/components/schemas/TimeAggregation" version: $ref: "#/components/schemas/Version" required: - created_at - created_by - enabled - modified_at - modified_by - name - selectors - targets - version type: object NotificationRulePreviewNotificationStatus: description: The notification status for the given rule type. `SUCCESS` means a matching event was found and the notification was sent successfully. `DEFAULT` means no matching event was found and a default placeholder notification was sent instead. `ERROR` means an error occurred while sending the notification. enum: - SUCCESS - DEFAULT - ERROR example: SUCCESS type: string x-enum-varnames: - SUCCESS - DEFAULT - ERROR NotificationRulePreviewResponse: description: Response from the notification preview request. properties: data: $ref: "#/components/schemas/NotificationRulePreviewResponseData" required: - data type: object NotificationRulePreviewResponseAttributes: description: Attributes of the notification preview response. properties: preview_results: $ref: "#/components/schemas/NotificationRulePreviewResults" required: - preview_results type: object NotificationRulePreviewResponseData: description: The notification preview response data. properties: attributes: $ref: "#/components/schemas/NotificationRulePreviewResponseAttributes" id: description: The ID of the notification preview response. example: rka-loa-zwu type: string type: $ref: "#/components/schemas/NotificationRulePreviewResponseType" required: - type - attributes type: object NotificationRulePreviewResponseType: description: The type of the notification preview response. enum: - notification_preview_response example: notification_preview_response type: string x-enum-varnames: - NOTIFICATION_PREVIEW_RESPONSE NotificationRulePreviewResult: description: The preview result for a single rule type. properties: notification_status: $ref: "#/components/schemas/NotificationRulePreviewNotificationStatus" rule_type: $ref: "#/components/schemas/RuleTypesItems" required: - rule_type - notification_status type: object NotificationRulePreviewResults: description: List of preview results for each rule type matched by the notification rule. example: - notification_status: DEFAULT rule_type: log_detection items: $ref: "#/components/schemas/NotificationRulePreviewResult" type: array NotificationRuleQuery: description: The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes. example: (source:production_service OR env:prod) type: string NotificationRuleResponse: description: Response object which includes a notification rule. properties: data: $ref: "#/components/schemas/NotificationRule" type: object NotificationRuleRouting: description: Routing configuration for the notification rule. properties: mode: $ref: "#/components/schemas/NotificationRuleRoutingMode" required: - mode type: object NotificationRuleRoutingMode: description: The routing mode for the notification rule. `manual` sends notifications to the configured targets. enum: - manual example: manual type: string x-enum-varnames: - MANUAL NotificationRulesListResponse: description: The list of notification rules. properties: data: items: $ref: "#/components/schemas/NotificationRule" type: array type: object NotificationRulesType: description: The rule type associated to notification rules. enum: - notification_rules example: notification_rules type: string x-enum-varnames: - NOTIFICATION_RULES NotionAPIKey: description: The definition of the `NotionAPIKey` object. properties: api_token: $ref: "#/components/schemas/NotionAPIKeyApiToken" type: $ref: "#/components/schemas/NotionAPIKeyType" required: - type - api_token type: object NotionAPIKeyApiToken: description: The `NotionAPIKey` `api_token`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" NotionAPIKeyType: description: The definition of the `NotionAPIKey` object. enum: - NotionAPIKey example: NotionAPIKey type: string x-enum-varnames: - NOTIONAPIKEY NotionAPIKeyUpdate: description: The definition of the `NotionAPIKey` object. properties: api_token: $ref: "#/components/schemas/NotionAPIKeyUpdateApiToken" type: $ref: "#/components/schemas/NotionAPIKeyType" required: - type type: object NotionAPIKeyUpdateApiToken: description: The `NotionAPIKeyUpdate` `api_token`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" NotionCredentials: description: The definition of the `NotionCredentials` object. oneOf: - $ref: "#/components/schemas/NotionAPIKey" NotionCredentialsUpdate: description: The definition of the `NotionCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/NotionAPIKeyUpdate" NotionIntegration: description: The definition of the `NotionIntegration` object. properties: credentials: $ref: "#/components/schemas/NotionCredentials" type: $ref: "#/components/schemas/NotionIntegrationType" required: - type - credentials type: object NotionIntegrationType: description: The definition of the `NotionIntegrationType` object. enum: - Notion example: Notion type: string x-enum-varnames: - NOTION NotionIntegrationUpdate: description: The definition of the `NotionIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/NotionCredentialsUpdate" type: $ref: "#/components/schemas/NotionIntegrationType" required: - type type: object NullableRelationshipToUser: description: Relationship to user. nullable: true properties: data: $ref: "#/components/schemas/NullableRelationshipToUserData" required: - data type: object NullableRelationshipToUserData: description: Relationship to user object. nullable: true properties: id: description: A unique identifier that represents the user. example: "00000000-0000-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/UsersType" required: - id - type type: object NullableUserRelationship: description: Relationship to user. nullable: true properties: data: $ref: "#/components/schemas/NullableUserRelationshipData" required: - data type: object NullableUserRelationshipData: description: Relationship to user object. nullable: true properties: id: description: A unique identifier that represents the user. example: "00000000-0000-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/UserResourceType" required: - id - type type: object OAuth2WellKnownSitesAttributes: description: Attributes containing the list of public OAuth2 sites. properties: sites: description: Array of public OAuth2 site URLs for the environment. example: - datadoghq.com - datadoghq.eu - us5.datadoghq.com - us3.datadoghq.com - ap1.datadoghq.com - ap2.datadoghq.com items: description: Public OAuth2 site URL. example: app.datadoghq.com type: string type: array required: - sites type: object OAuth2WellKnownSitesData: description: Data object containing OAuth2 well-known sites information. properties: attributes: $ref: "#/components/schemas/OAuth2WellKnownSitesAttributes" id: description: Environment identifier. example: prod type: string type: $ref: "#/components/schemas/OAuth2WellKnownSitesEnvType" required: - id - type - attributes type: object OAuth2WellKnownSitesEnvType: default: env description: JSON:API resource type for OAuth2 well-known sites environment. enum: - env example: env type: string x-enum-varnames: - ENV OAuth2WellKnownSitesResponse: description: Response payload containing the list of public OAuth2 sites for discovery. properties: data: $ref: "#/components/schemas/OAuth2WellKnownSitesData" required: - data type: object OAuthClientRegistrationError: description: Error payload returned by OAuth2 dynamic client registration as defined by RFC 7591. properties: error: description: Single ASCII error code per RFC 7591, such as `invalid_request` or `invalid_client_metadata`. example: invalid_client_metadata type: string error_description: description: Human-readable description of the error. example: redirect URI is not well-formed type: string required: - error - error_description type: object OAuthClientRegistrationGrantType: description: OAuth 2.0 grant type that a registered client may use. enum: - authorization_code - refresh_token example: authorization_code type: string x-enum-varnames: - AUTHORIZATION_CODE - REFRESH_TOKEN OAuthClientRegistrationRequest: description: Request payload for OAuth2 dynamic client registration as defined by RFC 7591. properties: client_name: description: Human-readable name of the client. Control characters are rejected. example: Example MCP Client maxLength: 1000 type: string client_uri: description: URL of the home page of the client. example: https://example.com maxLength: 1000 type: string grant_types: description: |- OAuth 2.0 grant types the client may use. Defaults to `authorization_code` and `refresh_token` when omitted. example: - authorization_code - refresh_token items: $ref: "#/components/schemas/OAuthClientRegistrationGrantType" type: array jwks_uri: description: URL referencing the client's JSON Web Key Set. example: https://example.com/.well-known/jwks.json maxLength: 1000 type: string logo_uri: description: URL referencing a logo for the client. example: https://example.com/logo.png maxLength: 1000 type: string policy_uri: description: URL pointing to the client's privacy policy. example: https://example.com/privacy maxLength: 1000 type: string redirect_uris: description: Array of redirection URI strings used by the client in redirect-based flows. example: - https://example.com/oauth/callback items: description: Redirection URI registered for the client. example: https://example.com/oauth/callback maxLength: 1000 type: string type: array response_types: description: OAuth 2.0 response types the client may use. Only `code` is supported. example: - code items: $ref: "#/components/schemas/OAuthClientRegistrationResponseType" type: array scope: description: Space-separated list of scope values the client may request. example: openid profile maxLength: 1000 type: string token_endpoint_auth_method: description: Requested authentication method for the token endpoint. Only `none` is supported. example: none maxLength: 20 type: string tos_uri: description: URL pointing to the client's terms of service. example: https://example.com/tos maxLength: 1000 type: string required: - client_name - redirect_uris type: object OAuthClientRegistrationResponse: description: Response payload for a successful OAuth2 dynamic client registration as defined by RFC 7591. properties: client_id: description: Unique identifier assigned to the registered client. example: 72b68208-36a6-11f0-b21b-da7ad0900002 format: uuid type: string client_name: description: Human-readable name of the client. example: Example MCP Client type: string grant_types: description: OAuth 2.0 grant types registered for the client. example: - authorization_code - refresh_token items: $ref: "#/components/schemas/OAuthClientRegistrationGrantType" type: array redirect_uris: description: Redirection URIs registered for the client. example: - https://example.com/oauth/callback items: description: Redirection URI registered for the client. example: https://example.com/oauth/callback type: string type: array response_types: description: OAuth 2.0 response types registered for the client. example: - code items: $ref: "#/components/schemas/OAuthClientRegistrationResponseType" type: array token_endpoint_auth_method: description: Authentication method registered for the token endpoint. Always `none`. example: none type: string required: - client_id - client_name - redirect_uris - token_endpoint_auth_method - grant_types - response_types type: object OAuthClientRegistrationResponseType: description: OAuth 2.0 response type that a registered client may use. enum: - code example: code type: string x-enum-varnames: - CODE OAuthOidcScope: description: OIDC scope a client may be restricted to. enum: - openid - profile - email - offline_access example: openid type: string x-enum-varnames: - OPENID - PROFILE - EMAIL - OFFLINE_ACCESS OAuthScopesRestriction: description: Allowlist of OIDC and permission scopes enforced for the OAuth2 client. nullable: true properties: oidc_scopes: description: OIDC scopes the client is restricted to. example: - openid - email items: $ref: "#/components/schemas/OAuthOidcScope" type: array permission_scopes: description: Datadog permission scopes the client is restricted to. example: - dashboards_read - metrics_read items: description: Datadog permission scope name. example: dashboards_read type: string type: array required: - oidc_scopes - permission_scopes type: object OAuthScopesRestrictionResponse: description: Response payload describing the scopes restriction of an OAuth2 client. properties: data: $ref: "#/components/schemas/OAuthScopesRestrictionResponseData" required: - data type: object OAuthScopesRestrictionResponseAttributes: description: Attributes of an OAuth2 client scopes restriction. properties: required_permission_scopes: description: |- Permission scopes automatically required for this client (for example, mobile-app permission scopes). Returns `null` when no scopes are required. example: - mobile_app_access items: description: Datadog permission scope name. example: mobile_app_access type: string nullable: true type: array scopes_restriction: $ref: "#/components/schemas/OAuthScopesRestriction" required: - scopes_restriction - required_permission_scopes type: object OAuthScopesRestrictionResponseData: description: Data object of an OAuth2 client scopes restriction response. properties: attributes: $ref: "#/components/schemas/OAuthScopesRestrictionResponseAttributes" id: description: UUID of the OAuth2 client this restriction applies to. example: fafa8e1c-36a5-11f0-a83d-da7ad0900001 format: uuid type: string type: $ref: "#/components/schemas/OAuthScopesRestrictionType" required: - id - type - attributes type: object OAuthScopesRestrictionType: default: scopes_restriction description: JSON:API resource type for an OAuth2 client scopes restriction. enum: - scopes_restriction example: scopes_restriction type: string x-enum-varnames: - SCOPES_RESTRICTION OCIConfig: description: OCI config. properties: attributes: $ref: "#/components/schemas/OCIConfigAttributes" id: description: The ID of the OCI config. example: "1" type: string type: $ref: "#/components/schemas/OCIConfigType" required: - attributes - id - type type: object OCIConfigAttributes: description: Attributes for an OCI config. properties: account_id: description: The OCID of the OCI tenancy. example: "ocid1.tenancy.oc1..example" type: string created_at: description: The timestamp when the OCI config was created. example: "2026-01-01T12:00:00Z" type: string error_messages: description: The error messages for the OCI config. items: description: An error message string. type: string nullable: true type: array status: description: The status of the OCI config. example: "active" type: string status_updated_at: description: The timestamp when the OCI config status was last updated. example: "2026-01-01T12:00:00Z" type: string updated_at: description: The timestamp when the OCI config was last updated. example: "2026-01-01T12:00:00Z" type: string required: - account_id - created_at - status - status_updated_at - updated_at type: object OCIConfigType: default: oci_config description: Type of OCI config. enum: - oci_config example: oci_config type: string x-enum-varnames: - OCI_CONFIG OCIConfigsResponse: description: List of OCI configs. example: data: - attributes: account_id: "ocid1.tenancy.oc1..example" created_at: "2026-01-01T12:00:00Z" error_messages: [] status: active status_updated_at: "2026-01-01T12:00:00Z" updated_at: "2026-01-01T12:00:00Z" id: "1" type: oci_config properties: data: description: An OCI config. items: $ref: "#/components/schemas/OCIConfig" type: array required: - data type: object OIDCCloudAuthClaimMatchMode: default: exact description: "Case-sensitive matching mode. Exact compares strings. Glob matches the entire value: * matches any number of characters, including /, and ? matches one character. Other characters are literal; escaping is not supported." enum: - exact - glob example: exact type: string x-enum-varnames: - EXACT - GLOB OIDCCloudAuthClaimMatcher: description: A token claim must match at least one of the configured values. properties: claim: description: Name of the token claim. example: sub type: string mode: $ref: "#/components/schemas/OIDCCloudAuthClaimMatchMode" values: description: Accepted values for this claim. example: - system:serviceaccount:controllers:example-controller items: type: string minItems: 1 type: array required: - claim - values type: object OIDCCloudAuthClaimMatcherCreate: description: Claim condition for creating a provider or persona mapping. A token claim must match at least one configured value. properties: claim: description: Name of the token claim. example: sub type: string mode: $ref: "#/components/schemas/OIDCCloudAuthClaimMatchMode" values: description: Accepted values for this claim. Each value is limited to 500 UTF-8 bytes when creating the resource. example: - system:serviceaccount:controllers:example-controller items: maxLength: 500 type: string minItems: 1 type: array required: - claim - values type: object OIDCCloudAuthDiscoveryType: description: How the signing keys are discovered. enum: - oidc_discovery - direct_jwks example: oidc_discovery type: string x-enum-varnames: - OIDC_DISCOVERY - DIRECT_JWKS OIDCCloudAuthOrgUUIDSource: default: dd_org_uuid description: Source of the organization UUID in the signed token. The `aud` source accepts a datadog/{org_uuid} audience. enum: - dd_org_uuid - aud example: dd_org_uuid type: string x-enum-varnames: - DD_ORG_UUID - AUD OIDCCloudAuthPersonaMappingAttributesResponse: description: Stored Custom OIDC persona mapping attributes. properties: account_identifier: description: Handle resolved when the mapping was created; not updated if the account handle changes. readOnly: true type: string account_uuid: description: UUID of the Datadog user or service account to authenticate as. example: 00000000-0000-0000-0000-000000000003 type: string claim_matchers: description: Every claim condition must match. Supply claim_matchers or identity_pattern, but not both. items: $ref: "#/components/schemas/OIDCCloudAuthClaimMatcher" type: array created_at: description: Time the configuration was created. format: date-time readOnly: true type: string created_by: description: UUID of the user who created the configuration. format: uuid readOnly: true type: string identity_pattern: description: Legacy glob pattern matched against the provider identity claim. Supply this or claim_matchers, but not both. Prefer claim_matchers with exact mode for a single Kubernetes service account. example: system:serviceaccount:controllers:example-controller type: string provider_id: description: UUID of the registered Custom OIDC provider. example: 00000000-0000-0000-0000-000000000002 format: uuid type: string type: object OIDCCloudAuthPersonaMappingCreateAttributes: description: Attributes for creating a Custom OIDC persona mapping. properties: account_uuid: description: UUID of the Datadog user or service account to authenticate as. example: 00000000-0000-0000-0000-000000000003 type: string claim_matchers: description: Every claim condition must match. Supply claim_matchers or identity_pattern, but not both. items: $ref: "#/components/schemas/OIDCCloudAuthClaimMatcherCreate" type: array identity_pattern: description: Legacy glob pattern, limited to 500 UTF-8 bytes when creating a mapping, matched against the provider identity claim. Supply this or claim_matchers, but not both. Prefer claim_matchers with exact mode for a single Kubernetes service account. example: system:serviceaccount:controllers:example-controller maxLength: 500 type: string provider_id: description: UUID of the registered Custom OIDC provider. example: 00000000-0000-0000-0000-000000000002 format: uuid type: string required: - provider_id - account_uuid type: object OIDCCloudAuthPersonaMappingCreateData: description: Custom OIDC persona mapping creation data. properties: attributes: $ref: "#/components/schemas/OIDCCloudAuthPersonaMappingCreateAttributes" type: $ref: "#/components/schemas/OIDCCloudAuthPersonaMappingType" required: - type - attributes type: object OIDCCloudAuthPersonaMappingCreateRequest: description: Request to create a Custom OIDC persona mapping. properties: data: $ref: "#/components/schemas/OIDCCloudAuthPersonaMappingCreateData" required: - data type: object OIDCCloudAuthPersonaMappingDataResponse: description: Custom OIDC persona mapping resource. properties: attributes: $ref: "#/components/schemas/OIDCCloudAuthPersonaMappingAttributesResponse" id: description: Unique resource identifier. example: 00000000-0000-0000-0000-000000000004 format: uuid type: string type: $ref: "#/components/schemas/OIDCCloudAuthPersonaMappingType" required: - id - type - attributes type: object OIDCCloudAuthPersonaMappingResponse: description: Custom OIDC persona mapping response. properties: data: $ref: "#/components/schemas/OIDCCloudAuthPersonaMappingDataResponse" required: - data type: object OIDCCloudAuthPersonaMappingType: default: custom_oidc_identity_mapping description: Resource type returned by the existing Custom OIDC persona mapping API. enum: - custom_oidc_identity_mapping example: custom_oidc_identity_mapping type: string x-enum-varnames: - CUSTOM_OIDC_IDENTITY_MAPPING OIDCCloudAuthPersonaMappingsResponse: description: List of Custom OIDC persona mapping resources. properties: data: description: Configured resources. items: $ref: "#/components/schemas/OIDCCloudAuthPersonaMappingDataResponse" type: array required: - data type: object OIDCCloudAuthProviderAttributesResponse: description: Stored Custom OIDC provider attributes. properties: audiences: description: Expected token audiences. At least one audience is required. When `org_uuid_source` is `aud`, include datadog/{org_uuid} for the organization creating the provider. example: - datadog/00000000-0000-0000-0000-000000000001 items: type: string minItems: 1 type: array created_at: description: Time the configuration was created. format: date-time readOnly: true type: string created_by: description: UUID of the user who created the configuration. format: uuid readOnly: true type: string discovery_type: $ref: "#/components/schemas/OIDCCloudAuthDiscoveryType" identity_claim_name: default: sub description: Claim used by legacy identity_pattern mappings and in identity logs. example: sub type: string issuer_url: description: HTTPS issuer URL that must match the token issuer. For oidc_discovery, signing keys are located through the issuer discovery document. example: https://issuer.example.com type: string jwks_url: description: HTTPS JSON Web Key Set URL. Required when `discovery_type` is `direct_jwks`. example: https://issuer.example.com/keys type: string org_uuid_claim_name: description: Optional name of the token claim containing the Datadog organization UUID. example: dd_org_uuid type: string org_uuid_source: $ref: "#/components/schemas/OIDCCloudAuthOrgUUIDSource" provider_name: description: Name identifying the provider within the organization. example: example-cluster type: string required_claims: description: Claim matchers required for every token from this provider, in addition to the persona mapping matchers. Shared issuers can require an exact tenant claim. items: $ref: "#/components/schemas/OIDCCloudAuthClaimMatcher" type: array type: object OIDCCloudAuthProviderCreateAttributes: description: Attributes for creating a Custom OIDC provider. properties: audiences: description: Expected token audiences. At least one audience is required. When `org_uuid_source` is `aud`, include datadog/{org_uuid} for the organization creating the provider. example: - datadog/00000000-0000-0000-0000-000000000001 items: type: string minItems: 1 type: array discovery_type: $ref: "#/components/schemas/OIDCCloudAuthDiscoveryType" identity_claim_name: default: sub description: Claim used by legacy identity_pattern mappings and in identity logs. example: sub type: string issuer_url: description: HTTPS issuer URL that must match the token issuer. For oidc_discovery, signing keys are located through the issuer discovery document. example: https://issuer.example.com type: string jwks_url: description: HTTPS JSON Web Key Set URL. Required when `discovery_type` is `direct_jwks`. example: https://issuer.example.com/keys type: string org_uuid_claim_name: description: Optional name of the token claim containing the Datadog organization UUID. example: dd_org_uuid type: string org_uuid_source: $ref: "#/components/schemas/OIDCCloudAuthOrgUUIDSource" provider_name: description: Name identifying the provider within the organization. example: example-cluster type: string required_claims: description: Claim matchers required for every token from this provider, in addition to the persona mapping matchers. Shared issuers can require an exact tenant claim. items: $ref: "#/components/schemas/OIDCCloudAuthClaimMatcherCreate" type: array required: - provider_name - discovery_type - issuer_url - audiences type: object OIDCCloudAuthProviderCreateData: description: Custom OIDC provider creation data. properties: attributes: $ref: "#/components/schemas/OIDCCloudAuthProviderCreateAttributes" type: $ref: "#/components/schemas/OIDCCloudAuthProviderType" required: - type - attributes type: object OIDCCloudAuthProviderCreateRequest: description: Request to create a Custom OIDC provider. properties: data: $ref: "#/components/schemas/OIDCCloudAuthProviderCreateData" required: - data type: object OIDCCloudAuthProviderDataResponse: description: Custom OIDC provider resource. properties: attributes: $ref: "#/components/schemas/OIDCCloudAuthProviderAttributesResponse" id: description: Unique resource identifier. example: 00000000-0000-0000-0000-000000000004 format: uuid type: string type: $ref: "#/components/schemas/OIDCCloudAuthProviderType" required: - id - type - attributes type: object OIDCCloudAuthProviderResponse: description: Custom OIDC provider response. properties: data: $ref: "#/components/schemas/OIDCCloudAuthProviderDataResponse" required: - data type: object OIDCCloudAuthProviderType: default: custom_oidc_provider_config description: Resource type. enum: - custom_oidc_provider_config example: custom_oidc_provider_config type: string x-enum-varnames: - CUSTOM_OIDC_PROVIDER_CONFIG OIDCCloudAuthProvidersResponse: description: List of Custom OIDC provider resources. properties: data: description: Configured resources. items: $ref: "#/components/schemas/OIDCCloudAuthProviderDataResponse" type: array required: - data type: object OIDCDiscoveryDocument: description: OpenID Connect provider metadata. properties: authorization_endpoint: description: URL of the OAuth2 authorization endpoint. example: https://app.datadoghq.com/oauth2/v1/authorize type: string id_token_signing_alg_values_supported: description: Signing algorithms supported for ID tokens. example: - RS256 items: type: string type: array issuer: description: URL identifying the OpenID Connect issuer. example: https://app.datadoghq.com/api/v2/oauth2 type: string jwks_uri: description: URL of the JSON Web Key Set used to verify ID token signatures. example: https://app.datadoghq.com/oauth2/v1/keys type: string response_types_supported: description: OAuth2 response types supported by the provider. example: - code items: type: string type: array subject_types_supported: description: Subject identifier types supported by the provider. example: - public items: type: string type: array token_endpoint: description: URL of the OAuth2 token endpoint. example: https://app.datadoghq.com/api/v2/oauth2/token type: string required: - issuer - authorization_endpoint - token_endpoint - jwks_uri - response_types_supported - subject_types_supported - id_token_signing_alg_values_supported type: object ObservabilityPipeline: description: Top-level schema representing a pipeline. properties: data: $ref: "#/components/schemas/ObservabilityPipelineData" required: - data type: object ObservabilityPipelineAddEnvVarsProcessor: description: |- The `add_env_vars` processor adds environment variable values to log events. **Supported pipeline types:** logs properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean id: description: The unique identifier for this component. Used to reference this processor in the pipeline. example: add-env-vars-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string type: $ref: "#/components/schemas/ObservabilityPipelineAddEnvVarsProcessorType" variables: description: A list of environment variable mappings to apply to log fields. items: $ref: "#/components/schemas/ObservabilityPipelineAddEnvVarsProcessorVariable" type: array required: - id - type - include - variables - enabled type: object x-pipeline-types: [logs] ObservabilityPipelineAddEnvVarsProcessorType: default: add_env_vars description: The processor type. The value should always be `add_env_vars`. enum: - add_env_vars example: add_env_vars type: string x-enum-varnames: - ADD_ENV_VARS ObservabilityPipelineAddEnvVarsProcessorVariable: description: Defines a mapping between an environment variable and a log field. properties: field: description: The target field in the log event. example: log.environment.region type: string name: description: The name of the environment variable to read. example: AWS_REGION type: string required: - field - name type: object ObservabilityPipelineAddFieldsProcessor: description: |- The `add_fields` processor adds static key-value fields to logs. **Supported pipeline types:** logs properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean fields: description: A list of static fields (key-value pairs) that is added to each log event processed by this component. items: $ref: "#/components/schemas/ObservabilityPipelineFieldValue" type: array id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: "add-fields-processor" type: string include: description: A Datadog search query used to determine which logs this processor targets. example: "service:my-service" type: string type: $ref: "#/components/schemas/ObservabilityPipelineAddFieldsProcessorType" required: - id - type - include - fields - enabled type: object x-pipeline-types: [logs] ObservabilityPipelineAddFieldsProcessorType: default: add_fields description: The processor type. The value should always be `add_fields`. enum: - add_fields example: add_fields type: string x-enum-varnames: - ADD_FIELDS ObservabilityPipelineAddHostnameProcessor: description: |- The `add_hostname` processor adds the hostname to log events. **Supported pipeline types:** logs properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: add-hostname-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: "service:my-service" type: string type: $ref: "#/components/schemas/ObservabilityPipelineAddHostnameProcessorType" required: - id - type - include - enabled type: object x-pipeline-types: [logs] ObservabilityPipelineAddHostnameProcessorType: default: add_hostname description: The processor type. The value should always be `add_hostname`. enum: - add_hostname example: add_hostname type: string x-enum-varnames: - ADD_HOSTNAME ObservabilityPipelineAddMetricTagsProcessor: description: |- The `add_metric_tags` processor adds static tags to metrics. **Supported pipeline types:** metrics properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: "add-metric-tags-processor" type: string include: description: A Datadog search query used to determine which metrics this processor targets. example: "*" type: string tags: description: A list of static tags (key-value pairs) added to each metric processed by this component. items: $ref: "#/components/schemas/ObservabilityPipelineFieldValue" maxItems: 15 type: array type: $ref: "#/components/schemas/ObservabilityPipelineAddMetricTagsProcessorType" required: - id - type - include - tags - enabled type: object x-pipeline-types: [metrics] ObservabilityPipelineAddMetricTagsProcessorType: default: add_metric_tags description: The processor type. The value must be `add_metric_tags`. enum: [add_metric_tags] example: add_metric_tags type: string x-enum-varnames: - ADD_METRIC_TAGS ObservabilityPipelineAggregateProcessor: description: |- The `aggregate` processor combines metrics that share the same name and tags into a single metric over a configurable interval. **Supported pipeline types:** metrics properties: aggregation_timing: $ref: "#/components/schemas/ObservabilityPipelineAggregateProcessorAggregationTiming" display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: "aggregate-processor" type: string include: description: A Datadog search query used to determine which metrics this processor targets. example: "*" type: string interval_secs: description: The interval, in seconds, over which metrics are aggregated. example: 10 format: int64 maximum: 60 minimum: 1 type: integer mode: $ref: "#/components/schemas/ObservabilityPipelineAggregateProcessorMode" type: $ref: "#/components/schemas/ObservabilityPipelineAggregateProcessorType" required: - id - type - include - interval_secs - mode - enabled type: object x-pipeline-types: [metrics] ObservabilityPipelineAggregateProcessorAggregationTiming: description: Configures how metrics are assigned to aggregation windows. When omitted, metrics are grouped using system time. properties: allowed_lateness_secs: description: Grace period, in seconds, for late-arriving metrics when using event time. Defaults to 10 seconds when omitted. example: 10 format: int64 maximum: 3600 minimum: 0 type: integer type: $ref: "#/components/schemas/ObservabilityPipelineAggregateProcessorAggregationTimingType" required: - type type: object ObservabilityPipelineAggregateProcessorAggregationTimingType: description: Determines whether metrics are assigned to aggregation windows based on when they are processed or their timestamps. enum: - system_time - event_time example: event_time type: string x-enum-varnames: - SYSTEM_TIME - EVENT_TIME ObservabilityPipelineAggregateProcessorMode: description: The aggregation mode applied to metrics that share the same name and tags within the interval. enum: - auto - sum - latest - count - max - min - mean example: auto type: string x-enum-varnames: - AUTO - SUM - LATEST - COUNT - MAX - MIN - MEAN ObservabilityPipelineAggregateProcessorType: default: aggregate description: The processor type. The value must be `aggregate`. enum: [aggregate] example: aggregate type: string x-enum-varnames: - AGGREGATE ObservabilityPipelineAmazonDataFirehoseSource: description: |- The `amazon_data_firehose` source ingests logs from AWS Data Firehose. **Supported pipeline types:** logs properties: address_key: description: Name of the environment variable or secret that holds the Firehose delivery stream address. example: FIREHOSE_ADDRESS type: string auth: $ref: "#/components/schemas/ObservabilityPipelineAwsAuth" id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: amazon-firehose-source type: string tls: $ref: "#/components/schemas/ObservabilityPipelineTls" type: $ref: "#/components/schemas/ObservabilityPipelineAmazonDataFirehoseSourceType" required: - id - type type: object x-pipeline-types: [logs] ObservabilityPipelineAmazonDataFirehoseSourceType: default: amazon_data_firehose description: The source type. The value should always be `amazon_data_firehose`. enum: [amazon_data_firehose] example: amazon_data_firehose type: string x-enum-varnames: [AMAZON_DATA_FIREHOSE] ObservabilityPipelineAmazonOpenSearchDestination: description: |- The `amazon_opensearch` destination writes logs to Amazon OpenSearch. **Supported pipeline types:** logs properties: auth: $ref: "#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestinationAuth" buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" bulk_index: description: The index to write logs to. example: logs-index type: string data_stream: $ref: "#/components/schemas/ObservabilityPipelineOpenSearchDestinationDataStream" endpoint_url_key: description: Name of the environment variable or secret that holds the Amazon OpenSearch endpoint URL. example: AMAZON_OPENSEARCH_ENDPOINT_URL type: string id: description: The unique identifier for this component. example: elasticsearch-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array type: $ref: "#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestinationType" required: - id - type - inputs type: object x-pipeline-types: [logs] ObservabilityPipelineAmazonOpenSearchDestinationAuth: description: |- Authentication settings for the Amazon OpenSearch destination. The `strategy` field determines whether basic or AWS-based authentication is used. When `strategy` is `basic`, use `username_key` and `password_key` to reference credentials stored in environment variables or secrets. properties: assume_role: description: The ARN of the role to assume (used with `aws` strategy). type: string aws_region: description: AWS region type: string external_id: description: External ID for the assumed role (used with `aws` strategy). type: string password_key: description: Name of the environment variable or secret that holds the Amazon OpenSearch password (used when `strategy` is `basic`). example: AMAZON_OPENSEARCH_PASSWORD type: string session_name: description: Session name for the assumed role (used with `aws` strategy). type: string strategy: $ref: "#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestinationAuthStrategy" username_key: description: Name of the environment variable or secret that holds the Amazon OpenSearch username (used when `strategy` is `basic`). example: AMAZON_OPENSEARCH_USERNAME type: string required: - strategy type: object ObservabilityPipelineAmazonOpenSearchDestinationAuthStrategy: description: The authentication strategy to use. enum: [basic, aws] example: aws type: string x-enum-varnames: - BASIC - AWS ObservabilityPipelineAmazonOpenSearchDestinationType: default: amazon_opensearch description: The destination type. The value should always be `amazon_opensearch`. enum: - amazon_opensearch example: amazon_opensearch type: string x-enum-varnames: - AMAZON_OPENSEARCH ObservabilityPipelineAmazonS3Destination: description: |- The `amazon_s3` destination sends your logs in Datadog-rehydratable format to an Amazon S3 bucket for archiving. **Supported pipeline types:** logs properties: auth: $ref: "#/components/schemas/ObservabilityPipelineAwsAuth" bucket: description: S3 bucket name. example: "error-logs" type: string buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" compression: $ref: "#/components/schemas/ObservabilityPipelineAmazonS3DestinationCompression" id: description: Unique identifier for the destination component. example: amazon-s3-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["datadog-agent-source"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array key_prefix: description: Optional prefix for object keys. type: string region: description: AWS region of the S3 bucket. example: "us-east-1" type: string server_side_encryption: $ref: "#/components/schemas/ObservabilityPipelineAmazonS3DestinationServerSideEncryption" ssekms_key_id: description: |- The AWS KMS key ID used for SSE-KMS encryption. Only applies when `server_side_encryption` is set to `aws:kms`. example: "arn:aws:kms:us-east-1:123456789012:key/mrk-abc123" type: string storage_class: $ref: "#/components/schemas/ObservabilityPipelineAmazonS3DestinationStorageClass" tls: $ref: "#/components/schemas/ObservabilityPipelineTls" type: $ref: "#/components/schemas/ObservabilityPipelineAmazonS3DestinationType" required: - id - type - inputs - bucket - region - storage_class type: object x-pipeline-types: [logs] ObservabilityPipelineAmazonS3DestinationCompression: description: |- Compression configuration for archived logs. When omitted, logs are compressed with gzip for backward compatibility. oneOf: - $ref: "#/components/schemas/ObservabilityPipelineAmazonS3DestinationCompressionZstd" - $ref: "#/components/schemas/ObservabilityPipelineAmazonS3DestinationCompressionGzip" ObservabilityPipelineAmazonS3DestinationCompressionGzip: description: Gzip compression. properties: algorithm: $ref: "#/components/schemas/ObservabilityPipelineAmazonS3DestinationCompressionGzipType" level: description: Gzip compression level. Valid values range from `1` to `9`. example: 6 format: int64 maximum: 9 minimum: 1 type: integer required: - algorithm - level type: object ObservabilityPipelineAmazonS3DestinationCompressionGzipType: default: gzip description: The compression type. Always `gzip`. enum: - gzip example: gzip type: string x-enum-varnames: - GZIP ObservabilityPipelineAmazonS3DestinationCompressionZstd: description: Zstd compression. properties: algorithm: $ref: "#/components/schemas/ObservabilityPipelineAmazonS3DestinationCompressionZstdType" level: description: Zstd compression level. Valid values range from `1` to` 21`. example: 3 format: int64 maximum: 21 minimum: 1 type: integer required: - algorithm - level type: object ObservabilityPipelineAmazonS3DestinationCompressionZstdType: default: zstd description: The compression type. Always `zstd`. enum: - zstd example: zstd type: string x-enum-varnames: - ZSTD ObservabilityPipelineAmazonS3DestinationServerSideEncryption: description: Server-side encryption type for Amazon S3. enum: - "aws:kms" - AES256 example: "aws:kms" type: string x-enum-varnames: - AWS_KMS - AES256 ObservabilityPipelineAmazonS3DestinationStorageClass: description: S3 storage class. enum: - STANDARD - REDUCED_REDUNDANCY - INTELLIGENT_TIERING - STANDARD_IA - EXPRESS_ONEZONE - ONEZONE_IA - GLACIER - GLACIER_IR - DEEP_ARCHIVE example: STANDARD type: string x-enum-varnames: - STANDARD - REDUCED_REDUNDANCY - INTELLIGENT_TIERING - STANDARD_IA - EXPRESS_ONEZONE - ONEZONE_IA - GLACIER - GLACIER_IR - DEEP_ARCHIVE ObservabilityPipelineAmazonS3DestinationType: default: amazon_s3 description: The destination type. Always `amazon_s3`. enum: - amazon_s3 example: amazon_s3 type: string x-enum-varnames: - AMAZON_S3 ObservabilityPipelineAmazonS3GenericBatchSettings: description: Event batching settings properties: batch_size: description: Maximum batch size in bytes. example: 100000000 format: int64 type: integer timeout_secs: description: Maximum number of seconds to wait before flushing the batch. example: 900 format: int64 type: integer type: object ObservabilityPipelineAmazonS3GenericCompression: description: Compression algorithm applied to encoded logs. oneOf: - $ref: "#/components/schemas/ObservabilityPipelineAmazonS3GenericCompressionZstd" - $ref: "#/components/schemas/ObservabilityPipelineAmazonS3GenericCompressionGzip" - $ref: "#/components/schemas/ObservabilityPipelineAmazonS3GenericCompressionSnappy" ObservabilityPipelineAmazonS3GenericCompressionGzip: description: Gzip compression. properties: algorithm: $ref: "#/components/schemas/ObservabilityPipelineAmazonS3GenericCompressionGzipType" level: description: Gzip compression level. example: 6 format: int64 type: integer required: - algorithm - level type: object ObservabilityPipelineAmazonS3GenericCompressionGzipType: default: gzip description: The compression type. Always `gzip`. enum: - gzip example: gzip type: string x-enum-varnames: - GZIP ObservabilityPipelineAmazonS3GenericCompressionSnappy: description: Snappy compression. properties: algorithm: $ref: "#/components/schemas/ObservabilityPipelineAmazonS3GenericCompressionSnappyType" required: - algorithm type: object ObservabilityPipelineAmazonS3GenericCompressionSnappyType: default: snappy description: The compression type. Always `snappy`. enum: - snappy example: snappy type: string x-enum-varnames: - SNAPPY ObservabilityPipelineAmazonS3GenericCompressionZstd: description: Zstd compression. properties: algorithm: $ref: "#/components/schemas/ObservabilityPipelineAmazonS3GenericCompressionZstdType" level: description: Zstd compression level. example: 3 format: int64 type: integer required: - algorithm - level type: object ObservabilityPipelineAmazonS3GenericCompressionZstdType: default: zstd description: The compression type. Always `zstd`. enum: - zstd example: zstd type: string x-enum-varnames: - ZSTD ObservabilityPipelineAmazonS3GenericDestination: description: |- The `amazon_s3_generic` destination sends your logs to an Amazon S3 bucket. **Supported pipeline types:** logs properties: auth: $ref: "#/components/schemas/ObservabilityPipelineAwsAuth" batch_settings: $ref: "#/components/schemas/ObservabilityPipelineAmazonS3GenericBatchSettings" bucket: description: S3 bucket name. example: "my-bucket" type: string buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" compression: $ref: "#/components/schemas/ObservabilityPipelineAmazonS3GenericCompression" encoding: $ref: "#/components/schemas/ObservabilityPipelineAmazonS3GenericEncoding" id: description: Unique identifier for the destination component. example: generic-s3-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: A component ID referenced as an input source. type: string type: array key_prefix: description: Optional prefix for object keys. type: string region: description: AWS region of the S3 bucket. example: "us-east-1" type: string server_side_encryption: $ref: "#/components/schemas/ObservabilityPipelineAmazonS3DestinationServerSideEncryption" ssekms_key_id: description: |- The AWS KMS key ID used for SSE-KMS encryption. Only applies when `server_side_encryption` is set to `aws:kms`. example: "arn:aws:kms:us-east-1:123456789012:key/mrk-abc123" type: string storage_class: $ref: "#/components/schemas/ObservabilityPipelineAmazonS3DestinationStorageClass" type: $ref: "#/components/schemas/ObservabilityPipelineAmazonS3GenericDestinationType" required: - id - type - inputs - bucket - region - storage_class - encoding - compression type: object x-pipeline-types: [logs] ObservabilityPipelineAmazonS3GenericDestinationType: default: amazon_s3_generic description: The destination type. Always `amazon_s3_generic`. enum: - amazon_s3_generic example: amazon_s3_generic type: string x-enum-varnames: - GENERIC_ARCHIVES_S3 ObservabilityPipelineAmazonS3GenericEncoding: description: Encoding format for the destination. oneOf: - $ref: "#/components/schemas/ObservabilityPipelineAmazonS3GenericEncodingJson" - $ref: "#/components/schemas/ObservabilityPipelineAmazonS3GenericEncodingParquet" ObservabilityPipelineAmazonS3GenericEncodingJson: description: JSON encoding. properties: type: $ref: "#/components/schemas/ObservabilityPipelineAmazonS3GenericEncodingJsonType" required: - type type: object ObservabilityPipelineAmazonS3GenericEncodingJsonType: default: json description: The encoding type. Always `json`. enum: - json example: json type: string x-enum-varnames: - JSON ObservabilityPipelineAmazonS3GenericEncodingParquet: description: Parquet encoding. properties: type: $ref: "#/components/schemas/ObservabilityPipelineAmazonS3GenericEncodingParquetType" required: - type type: object ObservabilityPipelineAmazonS3GenericEncodingParquetType: default: parquet description: The encoding type. Always `parquet`. enum: - parquet example: parquet type: string x-enum-varnames: - PARQUET ObservabilityPipelineAmazonS3Source: description: |- The `amazon_s3` source ingests logs from an Amazon S3 bucket. It supports AWS authentication, TLS encryption, and configurable compression. **Supported pipeline types:** logs properties: auth: $ref: "#/components/schemas/ObservabilityPipelineAwsAuth" compression: $ref: "#/components/schemas/ObservabilityPipelineAmazonS3SourceCompression" id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: aws-s3-source type: string region: description: AWS region where the S3 bucket resides. example: us-east-1 type: string tls: $ref: "#/components/schemas/ObservabilityPipelineTls" type: $ref: "#/components/schemas/ObservabilityPipelineAmazonS3SourceType" url_key: description: Name of the environment variable or secret that holds the S3 bucket URL. example: S3_BUCKET_URL type: string required: - id - type - region type: object x-pipeline-types: [logs] ObservabilityPipelineAmazonS3SourceCompression: description: Compression format for objects retrieved from the S3 bucket. Use `auto` to detect compression from the object's Content-Encoding header or file extension. enum: - auto - none - gzip - zstd example: gzip type: string x-enum-varnames: - AUTO - NONE - GZIP - ZSTD ObservabilityPipelineAmazonS3SourceType: default: amazon_s3 description: The source type. Always `amazon_s3`. enum: - amazon_s3 example: amazon_s3 type: string x-enum-varnames: - AMAZON_S3 ObservabilityPipelineAmazonSecurityLakeDestination: description: |- The `amazon_security_lake` destination sends your logs to Amazon Security Lake. **Supported pipeline types:** logs properties: auth: $ref: "#/components/schemas/ObservabilityPipelineAwsAuth" bucket: description: Name of the Amazon S3 bucket in Security Lake (3-63 characters). example: "security-lake-bucket" type: string buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" custom_source_name: description: Custom source name for the logs in Security Lake. example: "my-custom-source" type: string id: description: Unique identifier for the destination component. example: amazon-security-lake-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array region: description: AWS region of the S3 bucket. example: "us-east-1" type: string tls: $ref: "#/components/schemas/ObservabilityPipelineTls" type: $ref: "#/components/schemas/ObservabilityPipelineAmazonSecurityLakeDestinationType" required: - id - type - inputs - bucket - region - custom_source_name type: object x-pipeline-types: [logs] ObservabilityPipelineAmazonSecurityLakeDestinationType: default: amazon_security_lake description: The destination type. Always `amazon_security_lake`. enum: - amazon_security_lake example: amazon_security_lake type: string x-enum-varnames: - AMAZON_SECURITY_LAKE ObservabilityPipelineAwsAuth: description: |- AWS authentication credentials used for accessing AWS services such as S3. If omitted, the system’s default credentials are used (for example, the IAM role and environment variables). properties: assume_role: description: The Amazon Resource Name (ARN) of the role to assume. type: string external_id: description: A unique identifier for cross-account role assumption. type: string session_name: description: A session identifier used for logging and tracing the assumed role session. type: string type: object ObservabilityPipelineAzureDataExplorerDestination: description: |- The `azure_data_explorer` destination sends log events to an Azure Data Explorer table. **Supported pipeline types:** logs properties: auth: $ref: "#/components/schemas/ObservabilityPipelineAzureDataExplorerDestinationAuth" batch: $ref: "#/components/schemas/ObservabilityPipelineAzureDataExplorerDestinationBatch" buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" compression: $ref: "#/components/schemas/ObservabilityPipelineAzureStorageDestinationCompressionGzip" database: description: The name of the Azure Data Explorer database to ingest into. Supports template syntax. example: logs_db type: string id: description: The unique identifier for this component. example: azure-data-explorer-destination type: string ingestion_endpoint_key: description: |- Name of the environment variable or secret that holds the Azure Data Explorer ingestion endpoint URL. Defaults to `DESTINATION_AZURE_DATA_EXPLORER_INGESTION_ENDPOINT` (prefixed with `DD_OP_` at runtime). example: AZURE_DATA_EXPLORER_INGESTION_ENDPOINT type: string ingestion_mode: $ref: "#/components/schemas/ObservabilityPipelineAzureDataExplorerDestinationIngestionMode" inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array mapping_reference: description: The name of a pre-created ingestion mapping on the table used to map incoming events to columns. Supports template syntax. example: application_logs_mapping nullable: true type: string table: description: The name of the Azure Data Explorer table to ingest into. Supports template syntax. example: application_logs type: string token_scope: description: |- The OAuth scope requested when acquiring an access token for Azure Data Explorer. Defaults to `https://kusto.kusto.windows.net/.default`. example: https://kusto.kusto.windows.net/.default type: string type: $ref: "#/components/schemas/ObservabilityPipelineAzureDataExplorerDestinationType" required: - id - type - inputs - database - table - auth type: object x-pipeline-types: [logs] ObservabilityPipelineAzureDataExplorerDestinationAuth: description: Authentication configuration for Azure Data Explorer. The `azure_credential_kind` field selects the credential type. oneOf: - $ref: "#/components/schemas/ObservabilityPipelineAzureDataExplorerDestinationAuthAzureCli" - $ref: "#/components/schemas/ObservabilityPipelineAzureDataExplorerDestinationAuthClientSecret" - $ref: "#/components/schemas/ObservabilityPipelineAzureDataExplorerDestinationAuthClientCertificate" - $ref: "#/components/schemas/ObservabilityPipelineAzureDataExplorerDestinationAuthManagedIdentity" - $ref: "#/components/schemas/ObservabilityPipelineAzureDataExplorerManagedIdentityClientAssertion" - $ref: "#/components/schemas/ObservabilityPipelineAzureDataExplorerDestinationAuthWorkloadIdentity" ObservabilityPipelineAzureDataExplorerDestinationAuthAzureCli: description: Authenticate using the Azure CLI credentials available in the environment. properties: azure_credential_kind: $ref: "#/components/schemas/ObservabilityPipelineAzureDataExplorerDestinationAuthAzureCliKind" required: - azure_credential_kind type: object ObservabilityPipelineAzureDataExplorerDestinationAuthAzureCliKind: default: azure_cli description: The Azure credential kind. The value should always be `azure_cli`. enum: - azure_cli example: azure_cli type: string x-enum-varnames: - AZURE_CLI ObservabilityPipelineAzureDataExplorerDestinationAuthClientCertificate: description: Authenticate using a Microsoft Entra application client certificate. properties: azure_client_id: description: The Microsoft Entra application (client) ID. example: 22222222-2222-2222-2222-222222222222 type: string azure_credential_kind: $ref: "#/components/schemas/ObservabilityPipelineAzureDataExplorerDestinationAuthClientCertificateKind" azure_tenant_id: description: The Microsoft Entra tenant ID. example: 11111111-1111-1111-1111-111111111111 type: string certificate_password_key: description: Name of the environment variable or secret that holds the password for the client certificate. example: AZURE_CERTIFICATE_PASSWORD nullable: true type: string certificate_path: description: Path to the `.pfx` client certificate file on the Worker. example: /etc/certs/client.pfx type: string required: - azure_credential_kind - azure_tenant_id - azure_client_id - certificate_path type: object ObservabilityPipelineAzureDataExplorerDestinationAuthClientCertificateKind: default: client_certificate_credential description: The Azure credential kind. The value should always be `client_certificate_credential`. enum: - client_certificate_credential example: client_certificate_credential type: string x-enum-varnames: - CLIENT_CERTIFICATE_CREDENTIAL ObservabilityPipelineAzureDataExplorerDestinationAuthClientSecret: description: Authenticate using a Microsoft Entra application client secret. properties: azure_client_id: description: The Microsoft Entra application (client) ID. example: 22222222-2222-2222-2222-222222222222 type: string azure_client_secret_key: description: Name of the environment variable or secret that holds the Microsoft Entra application client secret. example: AZURE_CLIENT_SECRET type: string azure_credential_kind: $ref: "#/components/schemas/ObservabilityPipelineAzureDataExplorerDestinationAuthClientSecretKind" azure_tenant_id: description: The Microsoft Entra tenant ID. example: 11111111-1111-1111-1111-111111111111 type: string required: - azure_credential_kind - azure_tenant_id - azure_client_id - azure_client_secret_key type: object ObservabilityPipelineAzureDataExplorerDestinationAuthClientSecretKind: default: client_secret_credential description: The Azure credential kind. The value should always be `client_secret_credential`. enum: - client_secret_credential example: client_secret_credential type: string x-enum-varnames: - CLIENT_SECRET_CREDENTIAL ObservabilityPipelineAzureDataExplorerDestinationAuthManagedIdentity: description: Authenticate using an Azure managed identity. properties: azure_credential_kind: $ref: "#/components/schemas/ObservabilityPipelineAzureDataExplorerDestinationAuthManagedIdentityKind" user_assigned_managed_identity_id: description: The ID of the user-assigned managed identity. If omitted, the system-assigned managed identity is used. example: 00000000-0000-0000-0000-000000000000 nullable: true type: string user_assigned_managed_identity_id_type: $ref: "#/components/schemas/ObservabilityPipelineAzureDataExplorerDestinationManagedIdentityIdType" required: - azure_credential_kind type: object ObservabilityPipelineAzureDataExplorerDestinationAuthManagedIdentityKind: default: managed_identity description: The Azure credential kind. The value should always be `managed_identity`. enum: - managed_identity example: managed_identity type: string x-enum-varnames: - MANAGED_IDENTITY ObservabilityPipelineAzureDataExplorerDestinationAuthWorkloadIdentity: description: Authenticate using Azure Workload Identity (for example, on Kubernetes). properties: azure_credential_kind: $ref: "#/components/schemas/ObservabilityPipelineAzureDataExplorerDestinationAuthWorkloadIdentityKind" client_id: description: The client ID of the Microsoft Entra application. If omitted, it is read from the environment. example: 22222222-2222-2222-2222-222222222222 nullable: true type: string tenant_id: description: The Microsoft Entra tenant ID. If omitted, it is read from the environment. example: 11111111-1111-1111-1111-111111111111 nullable: true type: string token_file_path: description: Path to the federated token file. If omitted, it is read from the environment. example: /var/run/secrets/azure/tokens/azure-identity-token nullable: true type: string required: - azure_credential_kind type: object ObservabilityPipelineAzureDataExplorerDestinationAuthWorkloadIdentityKind: default: workload_identity description: The Azure credential kind. The value should always be `workload_identity`. enum: - workload_identity example: workload_identity type: string x-enum-varnames: - WORKLOAD_IDENTITY ObservabilityPipelineAzureDataExplorerDestinationBatch: description: Event batching settings for Azure Data Explorer ingestion. properties: max_bytes: description: Maximum batch size in bytes. example: 2000000 format: int64 type: integer max_events: description: Maximum number of events per batch before it is flushed. example: 1000 format: int64 type: integer timeout_secs: description: Maximum number of seconds to wait before flushing a partial batch. example: 1 format: int64 type: integer type: object ObservabilityPipelineAzureDataExplorerDestinationIngestionMode: default: streaming description: |- The ingestion method used to send data to Azure Data Explorer. - `streaming`: Sends events directly to the table using streaming ingestion. - `queue`: Sends events through queued (batched) ingestion. Defaults to `streaming`. enum: - streaming - queue example: queue type: string x-enum-varnames: - STREAMING - QUEUE ObservabilityPipelineAzureDataExplorerDestinationManagedIdentityIdType: description: The type of the user-assigned managed identity ID. enum: - client_id - object_id - resource_id example: client_id type: string x-enum-varnames: - CLIENT_ID - OBJECT_ID - RESOURCE_ID ObservabilityPipelineAzureDataExplorerDestinationType: default: azure_data_explorer description: The destination type. The value should always be `azure_data_explorer`. enum: - azure_data_explorer example: azure_data_explorer type: string x-enum-varnames: - AZURE_DATA_EXPLORER ObservabilityPipelineAzureDataExplorerManagedIdentityClientAssertion: description: Authenticate using a managed identity as a client assertion for a Microsoft Entra application. properties: azure_credential_kind: $ref: "#/components/schemas/ObservabilityPipelineAzureDataExplorerManagedIdentityClientAssertionKind" client_assertion_client_id: description: The client ID of the Microsoft Entra application that trusts the managed identity. example: 22222222-2222-2222-2222-222222222222 type: string client_assertion_tenant_id: description: The tenant ID of the Microsoft Entra application that trusts the managed identity. example: 11111111-1111-1111-1111-111111111111 type: string user_assigned_managed_identity_id: description: The ID of the user-assigned managed identity. If omitted, the system-assigned managed identity is used. example: 00000000-0000-0000-0000-000000000000 nullable: true type: string user_assigned_managed_identity_id_type: $ref: "#/components/schemas/ObservabilityPipelineAzureDataExplorerDestinationManagedIdentityIdType" required: - azure_credential_kind - client_assertion_client_id - client_assertion_tenant_id type: object ObservabilityPipelineAzureDataExplorerManagedIdentityClientAssertionKind: default: managed_identity_client_assertion description: The Azure credential kind. The value should always be `managed_identity_client_assertion`. enum: - managed_identity_client_assertion example: managed_identity_client_assertion type: string x-enum-varnames: - MANAGED_IDENTITY_CLIENT_ASSERTION ObservabilityPipelineAzureStorageDestinationCompression: description: |- Compression configuration for archived logs. When omitted, logs are compressed with gzip for backward compatibility. oneOf: - $ref: "#/components/schemas/ObservabilityPipelineAzureStorageDestinationCompressionZstd" - $ref: "#/components/schemas/ObservabilityPipelineAzureStorageDestinationCompressionGzip" ObservabilityPipelineAzureStorageDestinationCompressionGzip: description: Gzip compression. properties: algorithm: $ref: "#/components/schemas/ObservabilityPipelineAzureStorageDestinationCompressionGzipType" level: description: Gzip compression level. Valid values range from `1` to `9`. example: 6 format: int64 maximum: 9 minimum: 1 type: integer required: - algorithm - level type: object ObservabilityPipelineAzureStorageDestinationCompressionGzipType: default: gzip description: The compression type. Always `gzip`. enum: - gzip example: gzip type: string x-enum-varnames: - GZIP ObservabilityPipelineAzureStorageDestinationCompressionZstd: description: Zstd compression. properties: algorithm: $ref: "#/components/schemas/ObservabilityPipelineAzureStorageDestinationCompressionZstdType" level: description: Zstd compression level. Valid values range from `1` to `21`. example: 3 format: int64 maximum: 21 minimum: 1 type: integer required: - algorithm - level type: object ObservabilityPipelineAzureStorageDestinationCompressionZstdType: default: zstd description: The compression type. Always `zstd`. enum: - zstd example: zstd type: string x-enum-varnames: - ZSTD ObservabilityPipelineBufferOptions: description: Configuration for buffer settings on destination components. oneOf: - $ref: "#/components/schemas/ObservabilityPipelineDiskBufferOptions" - $ref: "#/components/schemas/ObservabilityPipelineMemoryBufferOptions" - $ref: "#/components/schemas/ObservabilityPipelineMemoryBufferSizeOptions" ObservabilityPipelineBufferOptionsDiskType: default: disk description: The type of the buffer that will be configured, a disk buffer. enum: - disk type: string x-enum-varnames: - DISK ObservabilityPipelineBufferOptionsMemoryType: default: memory description: The type of the buffer that will be configured, a memory buffer. enum: - memory type: string x-enum-varnames: - MEMORY ObservabilityPipelineBufferOptionsWhenFull: default: block description: Behavior when the buffer is full (block and stop accepting new events, or drop new events) enum: - block - drop_newest type: string x-enum-varnames: - BLOCK - DROP_NEWEST ObservabilityPipelineClickhouseDestination: description: |- The `clickhouse` destination sends log events to a ClickHouse database table over HTTP. **Supported pipeline types:** logs. properties: auth: $ref: "#/components/schemas/ObservabilityPipelineClickhouseDestinationAuth" batch: $ref: "#/components/schemas/ObservabilityPipelineClickhouseDestinationBatch" batch_encoding: $ref: "#/components/schemas/ObservabilityPipelineClickhouseDestinationBatchEncoding" buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" compression: $ref: "#/components/schemas/ObservabilityPipelineClickhouseDestinationCompression" database: description: Optional ClickHouse database name. If omitted, the user's default database on the ClickHouse server is used. example: my_database type: string date_time_best_effort: description: When `true`, enables flexible DateTime parsing on the ClickHouse server side. example: false type: boolean endpoint_url_key: description: |- Name of the environment variable or secret that contains the ClickHouse HTTP endpoint URL. Defaults to `DESTINATION_CLICKHOUSE_ENDPOINT_URL` (prefixed with `DD_OP_` at runtime). example: CLICKHOUSE_ENDPOINT_URL type: string format: $ref: "#/components/schemas/ObservabilityPipelineClickhouseDestinationFormat" id: description: The unique identifier for this component. example: clickhouse-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array skip_unknown_fields: description: |- When `true`, fields not present in the target table schema are dropped instead of causing insert errors. When unset, the ClickHouse server's own `input_format_skip_unknown_fields` setting applies. example: true nullable: true type: boolean table: description: Target ClickHouse table name. Events are inserted into this table. example: application_logs type: string tls: $ref: "#/components/schemas/ObservabilityPipelineTls" type: $ref: "#/components/schemas/ObservabilityPipelineClickhouseDestinationType" required: - id - type - inputs - table type: object x-pipeline-types: [logs] ObservabilityPipelineClickhouseDestinationAuth: description: |- HTTP Basic Authentication credentials for the ClickHouse destination. When `strategy` is `basic`, provide `username_key` and `password_key` that reference environment variables or secrets containing the credentials. properties: password_key: description: Name of the environment variable or secret that contains the ClickHouse password. example: CLICKHOUSE_PASSWORD type: string strategy: $ref: "#/components/schemas/ObservabilityPipelineClickhouseDestinationAuthStrategy" username_key: description: Name of the environment variable or secret that contains the ClickHouse username. example: CLICKHOUSE_USERNAME type: string required: - strategy type: object ObservabilityPipelineClickhouseDestinationAuthStrategy: description: The authentication strategy for ClickHouse HTTP requests. Only `basic` is supported. enum: - basic example: basic type: string x-enum-varnames: - BASIC ObservabilityPipelineClickhouseDestinationBatch: description: Batching configuration for ClickHouse inserts. properties: max_events: description: Maximum number of events per batch before it is flushed. example: 1000 format: int64 minimum: 1 type: integer timeout_secs: description: Maximum number of seconds to wait before flushing a partial batch. example: 1 format: int64 maximum: 65535 minimum: 1 type: integer type: object ObservabilityPipelineClickhouseDestinationBatchEncoding: description: |- Batch encoding configuration for the ClickHouse destination. Required when `format` is `arrow_stream`. The `codec` field must be set to `arrow_stream`. properties: allow_nullable_fields: description: |- When `true`, null values are allowed for non-nullable fields in the ClickHouse schema. When `false` (default), missing values for non-nullable columns cause encoding errors. example: false type: boolean codec: $ref: "#/components/schemas/ObservabilityPipelineClickhouseDestinationBatchEncodingCodec" required: - codec type: object ObservabilityPipelineClickhouseDestinationBatchEncodingCodec: description: The codec used for batch encoding. Only `arrow_stream` is supported. enum: - arrow_stream example: arrow_stream type: string x-enum-varnames: - ARROW_STREAM ObservabilityPipelineClickhouseDestinationCompression: description: |- Compression setting for outbound HTTP requests to ClickHouse. Can be specified as a shorthand string (`"gzip"` or `"none"`) or as an object with an `algorithm` field and an optional `level` (gzip only, 1–9). oneOf: - $ref: "#/components/schemas/ObservabilityPipelineClickhouseDestinationCompressionAlgorithm" - $ref: "#/components/schemas/ObservabilityPipelineClickhouseDestinationCompressionObject" ObservabilityPipelineClickhouseDestinationCompressionAlgorithm: description: The compression algorithm applied to outbound HTTP requests. enum: - gzip - none example: gzip type: string x-enum-varnames: - GZIP - NONE ObservabilityPipelineClickhouseDestinationCompressionObject: description: |- Structured compression configuration for the ClickHouse destination. Use `algorithm` to specify the compression type and `level` (optional, gzip only) to control compression strength. properties: algorithm: $ref: "#/components/schemas/ObservabilityPipelineClickhouseDestinationCompressionAlgorithm" level: description: Compression level (1–9). Only applicable when `algorithm` is `gzip`. example: 6 format: int64 maximum: 9 minimum: 1 type: integer required: - algorithm type: object ObservabilityPipelineClickhouseDestinationFormat: description: |- Insert format for events sent to ClickHouse. - `json_each_row`: Maps event fields to columns by name (ClickHouse `JSONEachRow`). - `json_as_object`: Inserts each event into a single `Object('json')` / `JSON` column (ClickHouse `JSONAsObject`). - `json_as_string`: Inserts each event into a single `String`-typed column as raw JSON (ClickHouse `JSONAsString`). - `arrow_stream`: Batches events using Apache Arrow IPC streaming format. Requires `batch_encoding`. enum: - json_each_row - json_as_object - json_as_string - arrow_stream example: json_each_row type: string x-enum-varnames: - JSON_EACH_ROW - JSON_AS_OBJECT - JSON_AS_STRING - ARROW_STREAM ObservabilityPipelineClickhouseDestinationType: default: clickhouse description: The destination type. The value must be `clickhouse`. enum: - clickhouse example: clickhouse type: string x-enum-varnames: - CLICKHOUSE ObservabilityPipelineClientTls: description: Configuration for enabling TLS encryption between the pipeline component and external services. properties: ca_file: description: Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate. type: string crt_file: description: Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services. example: "/path/to/cert.crt" type: string key_file: description: Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication. type: string key_pass_key: description: Name of the environment variable or secret that holds the passphrase for the private key file. example: TLS_KEY_PASSPHRASE type: string server_name: description: Server name to use for Server Name Indication (SNI) and to verify against the certificate presented by the remote host. Use this when the address you connect to doesn't match the certificate's Common Name or Subject Alternative Name. example: server.example.com maxLength: 253 minLength: 1 type: string required: - crt_file type: object ObservabilityPipelineCloudPremDestination: description: |- The `cloud_prem` destination sends logs to Datadog CloudPrem. **Supported pipeline types:** logs properties: buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" endpoint_url_key: description: Name of the environment variable or secret that holds the CloudPrem endpoint URL. example: CLOUDPREM_ENDPOINT_URL type: string id: description: The unique identifier for this component. example: cloud-prem-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array tls: $ref: "#/components/schemas/ObservabilityPipelineClientTls" description: Configuration for TLS encryption. type: $ref: "#/components/schemas/ObservabilityPipelineCloudPremDestinationType" required: - id - type - inputs type: object x-pipeline-types: [logs] ObservabilityPipelineCloudPremDestinationType: default: cloud_prem description: The destination type. The value should always be `cloud_prem`. enum: - cloud_prem example: cloud_prem type: string x-enum-varnames: - CLOUD_PREM ObservabilityPipelineComponentDisplayName: description: The display name for a component. example: "my component" type: string ObservabilityPipelineConfig: description: Specifies the pipeline's configuration, including its sources, processors, and destinations. properties: destinations: description: A list of destination components where processed logs are sent. example: [{"id": "datadog-logs-destination", "inputs": ["my-processor-group"], "type": "datadog_logs"}] items: $ref: "#/components/schemas/ObservabilityPipelineConfigDestinationItem" type: array pipeline_type: $ref: "#/components/schemas/ObservabilityPipelineConfigPipelineType" processor_groups: description: A list of processor groups that transform or enrich log data. example: [{"enabled": true, "id": "my-processor-group", "include": "service:my-service", "inputs": ["datadog-agent-source"], "processors": [{"enabled": true, "id": "filter-processor", "include": "status:error", "type": "filter"}, {"enabled": true, "field": "message", "id": "json-processor", "include": "*", "type": "parse_json"}]}] items: $ref: "#/components/schemas/ObservabilityPipelineConfigProcessorGroup" type: array processors: deprecated: true description: |- A list of processor groups that transform or enrich log data. **Deprecated:** This field is deprecated, you should now use the processor_groups field. example: [] items: $ref: "#/components/schemas/ObservabilityPipelineConfigProcessorGroup" type: array sources: description: A list of configured data sources for the pipeline. example: [{"id": "datadog-agent-source", "type": "datadog_agent"}] items: $ref: "#/components/schemas/ObservabilityPipelineConfigSourceItem" type: array use_legacy_search_syntax: description: |- Set to `true` to continue using the legacy search syntax while migrating filter queries. After migrating all queries to the new syntax, set to `false`. The legacy syntax is deprecated and will eventually be removed. Requires Observability Pipelines Worker 2.11 or later. Only applies to `logs` pipelines. This field is ignored for `metrics` and `traces` pipelines. See [Upgrade Your Filter Queries to the New Search Syntax](https://docs.datadoghq.com/observability_pipelines/guide/upgrade_your_filter_queries_to_the_new_search_syntax/) for more information. type: boolean required: - sources - destinations type: object ObservabilityPipelineConfigDestinationItem: description: "A destination for the pipeline." oneOf: - $ref: "#/components/schemas/ObservabilityPipelineElasticsearchDestination" - $ref: "#/components/schemas/ObservabilityPipelineHttpClientDestination" - $ref: "#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestination" - $ref: "#/components/schemas/ObservabilityPipelineAmazonS3Destination" - $ref: "#/components/schemas/ObservabilityPipelineAmazonS3GenericDestination" - $ref: "#/components/schemas/ObservabilityPipelineAmazonSecurityLakeDestination" - $ref: "#/components/schemas/AzureStorageDestination" - $ref: "#/components/schemas/ObservabilityPipelineAzureDataExplorerDestination" - $ref: "#/components/schemas/ObservabilityPipelineClickhouseDestination" - $ref: "#/components/schemas/ObservabilityPipelineCloudPremDestination" - $ref: "#/components/schemas/ObservabilityPipelineCrowdStrikeNextGenSiemDestination" - $ref: "#/components/schemas/ObservabilityPipelineDatadogLogsDestination" - $ref: "#/components/schemas/ObservabilityPipelineGoogleChronicleDestination" - $ref: "#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestination" - $ref: "#/components/schemas/ObservabilityPipelineGooglePubSubDestination" - $ref: "#/components/schemas/ObservabilityPipelineKafkaDestination" - $ref: "#/components/schemas/MicrosoftSentinelDestination" - $ref: "#/components/schemas/ObservabilityPipelineNewRelicDestination" - $ref: "#/components/schemas/ObservabilityPipelineOpenSearchDestination" - $ref: "#/components/schemas/ObservabilityPipelineRsyslogDestination" - $ref: "#/components/schemas/ObservabilityPipelineSentinelOneDestination" - $ref: "#/components/schemas/ObservabilityPipelineSocketDestination" - $ref: "#/components/schemas/ObservabilityPipelineSplunkHecDestination" - $ref: "#/components/schemas/ObservabilityPipelineSumoLogicDestination" - $ref: "#/components/schemas/ObservabilityPipelineSyslogNgDestination" - $ref: "#/components/schemas/ObservabilityPipelineDatabricksZerobusDestination" - $ref: "#/components/schemas/ObservabilityPipelineDatadogMetricsDestination" - $ref: "#/components/schemas/ObservabilityPipelinePrometheusRemoteWriteDestination" - $ref: "#/components/schemas/ObservabilityPipelineSplunkHecMetricsDestination" - $ref: "#/components/schemas/ObservabilityPipelineOpentelemetryDestination" - $ref: "#/components/schemas/ObservabilityPipelineDatadogTracesDestination" ObservabilityPipelineConfigPipelineType: default: logs description: The type of data being ingested. Defaults to `logs` if not specified. enum: [logs, metrics, traces] example: logs type: string x-enum-varnames: - LOGS - METRICS - TRACES ObservabilityPipelineConfigProcessorGroup: description: "A group of processors." example: {"enabled": true, "id": "my-processor-group", "include": "service:my-service", "inputs": ["datadog-agent-source"], "processors": [{"enabled": true, "fields": [{"name": "env", "value": "prod"}], "id": "add-fields-processor", "include": "*", "type": "add_fields"}, {"enabled": true, "id": "filter-processor", "include": "status:error", "type": "filter"}]} properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Whether this processor group is enabled. example: true type: boolean id: description: The unique identifier for the processor group. example: "grouped-processors" type: string include: description: Conditional expression for when this processor group should execute. example: "service:my-service" type: string inputs: description: A list of IDs for components whose output is used as the input for this processor group. example: ["datadog-agent-source"] items: description: The ID of a component whose output is used as input. type: string type: array processors: description: Processors applied sequentially within this group. Events flow through each processor in order. Omit or use an empty array for a group without processors. example: [{"enabled": true, "fields": [{"name": "env", "value": "prod"}], "id": "add-fields-processor", "include": "*", "type": "add_fields"}, {"enabled": true, "id": "filter-processor", "include": "status:error", "type": "filter"}] items: $ref: "#/components/schemas/ObservabilityPipelineConfigProcessorItem" type: array required: - id - include - inputs - enabled type: object ObservabilityPipelineConfigProcessorItem: description: "A processor for the pipeline." oneOf: - $ref: "#/components/schemas/ObservabilityPipelineFilterProcessor" - $ref: "#/components/schemas/ObservabilityPipelineAddEnvVarsProcessor" - $ref: "#/components/schemas/ObservabilityPipelineAddFieldsProcessor" - $ref: "#/components/schemas/ObservabilityPipelineAddHostnameProcessor" - $ref: "#/components/schemas/ObservabilityPipelineDatadogTagsProcessor" - $ref: "#/components/schemas/ObservabilityPipelineDedupeProcessor" - $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableProcessor" - $ref: "#/components/schemas/ObservabilityPipelineGenerateMetricsProcessor" - $ref: "#/components/schemas/ObservabilityPipelineOcsfMapperProcessor" - $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessor" - $ref: "#/components/schemas/ObservabilityPipelineParseJSONProcessor" - $ref: "#/components/schemas/ObservabilityPipelineParseXMLProcessor" - $ref: "#/components/schemas/ObservabilityPipelineQuotaProcessor" - $ref: "#/components/schemas/ObservabilityPipelineReduceProcessor" - $ref: "#/components/schemas/ObservabilityPipelineRemoveFieldsProcessor" - $ref: "#/components/schemas/ObservabilityPipelineRenameFieldsProcessor" - $ref: "#/components/schemas/ObservabilityPipelineSpikeProtectionProcessor" - $ref: "#/components/schemas/ObservabilityPipelineSplitArrayProcessor" - $ref: "#/components/schemas/ObservabilityPipelineThrottleProcessor" - $ref: "#/components/schemas/ObservabilityPipelineCustomProcessor" - $ref: "#/components/schemas/ObservabilityPipelineGenerateMetricsV2Processor" - $ref: "#/components/schemas/ObservabilityPipelineSampleProcessor" - $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessor" - $ref: "#/components/schemas/ObservabilityPipelineAddMetricTagsProcessor" - $ref: "#/components/schemas/ObservabilityPipelineAggregateProcessor" - $ref: "#/components/schemas/ObservabilityPipelineMetricEnrichmentTableProcessor" - $ref: "#/components/schemas/ObservabilityPipelineMetricTagsProcessor" - $ref: "#/components/schemas/ObservabilityPipelineRenameMetricTagsProcessor" - $ref: "#/components/schemas/ObservabilityPipelineTagCardinalityLimitProcessor" ObservabilityPipelineConfigSourceItem: description: "A data source for the pipeline." oneOf: - $ref: "#/components/schemas/ObservabilityPipelineDatadogAgentSource" - $ref: "#/components/schemas/ObservabilityPipelineOpentelemetrySource" - $ref: "#/components/schemas/ObservabilityPipelineAmazonDataFirehoseSource" - $ref: "#/components/schemas/ObservabilityPipelineAmazonS3Source" - $ref: "#/components/schemas/ObservabilityPipelineFluentBitSource" - $ref: "#/components/schemas/ObservabilityPipelineFluentdSource" - $ref: "#/components/schemas/ObservabilityPipelineGooglePubSubSource" - $ref: "#/components/schemas/ObservabilityPipelineHttpClientSource" - $ref: "#/components/schemas/ObservabilityPipelineHttpServerSource" - $ref: "#/components/schemas/ObservabilityPipelineKafkaSource" - $ref: "#/components/schemas/ObservabilityPipelineLogstashSource" - $ref: "#/components/schemas/ObservabilityPipelineRsyslogSource" - $ref: "#/components/schemas/ObservabilityPipelineSocketSource" - $ref: "#/components/schemas/ObservabilityPipelineSplunkHecSource" - $ref: "#/components/schemas/ObservabilityPipelineSplunkTcpSource" - $ref: "#/components/schemas/ObservabilityPipelineSumoLogicSource" - $ref: "#/components/schemas/ObservabilityPipelineSyslogNgSource" - $ref: "#/components/schemas/ObservabilityPipelineWebsocketSource" - $ref: "#/components/schemas/ObservabilityPipelinePrometheusRemoteWriteSource" ObservabilityPipelineCrowdStrikeNextGenSiemDestination: description: |- The `crowdstrike_next_gen_siem` destination forwards logs to CrowdStrike Next Gen SIEM. **Supported pipeline types:** logs properties: buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" compression: $ref: "#/components/schemas/ObservabilityPipelineCrowdStrikeNextGenSiemDestinationCompression" encoding: $ref: "#/components/schemas/ObservabilityPipelineCrowdStrikeNextGenSiemDestinationEncoding" endpoint_url_key: description: Name of the environment variable or secret that holds the CrowdStrike endpoint URL. example: CROWDSTRIKE_ENDPOINT_URL type: string id: description: The unique identifier for this component. example: crowdstrike-ngsiem-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array tls: $ref: "#/components/schemas/ObservabilityPipelineTls" token_key: description: Name of the environment variable or secret that holds the CrowdStrike API token. example: CROWDSTRIKE_TOKEN type: string type: $ref: "#/components/schemas/ObservabilityPipelineCrowdStrikeNextGenSiemDestinationType" required: - id - type - inputs - encoding type: object x-pipeline-types: [logs] ObservabilityPipelineCrowdStrikeNextGenSiemDestinationCompression: description: Compression configuration for log events. properties: algorithm: $ref: "#/components/schemas/ObservabilityPipelineCrowdStrikeNextGenSiemDestinationCompressionAlgorithm" level: description: Compression level. example: 6 format: int64 type: integer required: - algorithm type: object ObservabilityPipelineCrowdStrikeNextGenSiemDestinationCompressionAlgorithm: description: Compression algorithm for log events. enum: - gzip - zlib example: gzip type: string x-enum-varnames: - GZIP - ZLIB ObservabilityPipelineCrowdStrikeNextGenSiemDestinationEncoding: description: Encoding format for log events. enum: - json - raw_message example: json type: string x-enum-varnames: - JSON - RAW_MESSAGE ObservabilityPipelineCrowdStrikeNextGenSiemDestinationType: default: crowdstrike_next_gen_siem description: The destination type. The value should always be `crowdstrike_next_gen_siem`. enum: - crowdstrike_next_gen_siem example: crowdstrike_next_gen_siem type: string x-enum-varnames: - CROWDSTRIKE_NEXT_GEN_SIEM ObservabilityPipelineCustomProcessor: description: |- The `custom_processor` processor transforms events using [Vector Remap Language (VRL)](https://vector.dev/docs/reference/vrl/) scripts with advanced filtering capabilities. **Supported pipeline types:** logs, traces properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean id: description: The unique identifier for this processor. example: remap-vrl-processor type: string include: default: "*" description: A Datadog search query used to determine which events this processor targets. This field should always be set to `*` for the custom_processor processor. example: "*" type: string remaps: description: Array of VRL remap rules. items: $ref: "#/components/schemas/ObservabilityPipelineCustomProcessorRemap" minItems: 1 type: array type: $ref: "#/components/schemas/ObservabilityPipelineCustomProcessorType" required: - id - type - include - remaps - enabled type: object x-pipeline-types: [logs, traces] ObservabilityPipelineCustomProcessorRemap: description: Defines a single VRL remap rule with its own filtering and transformation logic. properties: drop_on_error: description: Whether to drop events that caused errors during processing. example: false type: boolean enabled: description: Whether this remap rule is enabled. example: true type: boolean include: description: A Datadog search query used to filter events for this specific remap rule. example: "service:web" type: string name: description: A descriptive name for this remap rule. example: "Parse JSON from message field" type: string source: description: The VRL script source code that defines the processing logic. example: ". = parse_json!(.message)" type: string required: - include - name - source - drop_on_error type: object ObservabilityPipelineCustomProcessorType: default: custom_processor description: The processor type. The value should always be `custom_processor`. enum: - custom_processor example: custom_processor type: string x-enum-varnames: - CUSTOM_PROCESSOR ObservabilityPipelineData: description: Contains the pipeline’s ID, type, and configuration attributes. properties: attributes: $ref: "#/components/schemas/ObservabilityPipelineDataAttributes" id: description: Unique identifier for the pipeline. example: 3fa85f64-5717-4562-b3fc-2c963f66afa6 type: string type: default: pipelines description: The resource type identifier. For pipeline resources, this should always be set to `pipelines`. example: pipelines type: string required: - id - type - attributes type: object ObservabilityPipelineDataAttributes: description: Defines the pipeline’s name and its components (sources, processors, and destinations). properties: config: $ref: "#/components/schemas/ObservabilityPipelineConfig" name: description: Name of the pipeline. example: Main Observability Pipeline type: string required: - name - config type: object ObservabilityPipelineDatabricksZerobusDestination: description: |- The `databricks_zerobus` destination sends logs to Databricks using the Zerobus ingestion API, streaming data directly into your Databricks Lakehouse. **Supported pipeline types:** Logs, rehydration properties: auth: $ref: "#/components/schemas/ObservabilityPipelineDatabricksZerobusDestinationAuth" buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" id: description: The unique identifier for this component. example: databricks-zerobus-destination type: string ingestion_endpoint_key: description: Name of the environment variable or the secret identifier that references the Databricks Zerobus ingestion endpoint, which is used to stream data directly into your Databricks Lakehouse. example: DD_OP_DESTINATION_DATABRICKS_ZEROBUS_INGESTION_ENDPOINT type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array table_name: description: The fully qualified name of your target Databricks table. Make sure this table already exists in your Databricks workspace before deploying. example: catalog.schema.table type: string type: $ref: "#/components/schemas/ObservabilityPipelineDatabricksZerobusDestinationType" unity_catalog_endpoint_key: description: Name of the environment variable or the secret identifier that references your Databricks workspace URL, which is used to communicate with the Unity Catalog API. example: DD_OP_DESTINATION_DATABRICKS_ZEROBUS_UNITY_CATALOG_ENDPOINT type: string required: - id - type - inputs - table_name - auth type: object x-pipeline-types: [logs, rehydration] ObservabilityPipelineDatabricksZerobusDestinationAuth: description: OAuth credentials for authenticating with the Databricks Zerobus ingestion API. properties: client_id: description: Your service principal application ID (UUID). example: 9a8b7c6d-1234-5678-abcd-ef0123456789 type: string client_secret_key: description: Name of the environment variable or secret that holds the OAuth client secret used to authenticate with the Databricks ingestion endpoint. example: DD_OP_DESTINATION_DATABRICKS_ZEROBUS_OAUTH_CLIENT_SECRET type: string required: - client_id type: object ObservabilityPipelineDatabricksZerobusDestinationType: default: databricks_zerobus description: The destination type. The value must be `databricks_zerobus`. enum: - databricks_zerobus example: databricks_zerobus type: string x-enum-varnames: - DATABRICKS_ZEROBUS ObservabilityPipelineDatadogAgentSource: description: |- The `datadog_agent` source collects logs, metrics, or traces from the Datadog Agent. **Supported pipeline types:** logs, metrics, traces properties: address_key: description: Name of the environment variable or secret that holds the listen address for the Datadog Agent source. example: DATADOG_AGENT_ADDRESS type: string id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: "datadog-agent-source" type: string tls: $ref: "#/components/schemas/ObservabilityPipelineTls" type: $ref: "#/components/schemas/ObservabilityPipelineDatadogAgentSourceType" required: - id - type type: object x-pipeline-types: [logs, metrics, traces] ObservabilityPipelineDatadogAgentSourceType: default: datadog_agent description: The source type. The value should always be `datadog_agent`. enum: - datadog_agent example: datadog_agent type: string x-enum-varnames: - DATADOG_AGENT ObservabilityPipelineDatadogLogsDestination: description: |- The `datadog_logs` destination forwards logs to Datadog Log Management. **Supported pipeline types:** logs properties: buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" id: description: The unique identifier for this component. example: "datadog-logs-destination" type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array routes: description: A list of routing rules that forward matching logs to Datadog using dedicated API keys. example: [{"api_key_key": "API_KEY_IDENTIFIER", "include": "service:api", "route_id": "datadog-logs-route-us1", "site": "us1"}] items: $ref: "#/components/schemas/ObservabilityPipelineDatadogLogsDestinationRoute" maxItems: 100 type: array type: $ref: "#/components/schemas/ObservabilityPipelineDatadogLogsDestinationType" required: - id - type - inputs type: object x-pipeline-types: [logs] ObservabilityPipelineDatadogLogsDestinationRoute: description: Defines how the `datadog_logs` destination routes matching logs to a Datadog site using a specific API key. properties: api_key_key: description: Name of the environment variable or secret that stores the Datadog API key used by this route. example: API_KEY_IDENTIFIER type: string include: description: A Datadog search query that determines which logs are forwarded using this route. example: service:api type: string route_id: description: Unique identifier for this route within the destination. example: datadog-logs-route-us type: string site: description: Datadog site where matching logs are sent (for example, `us1`). example: us1 type: string type: object ObservabilityPipelineDatadogLogsDestinationType: default: datadog_logs description: The destination type. The value should always be `datadog_logs`. enum: - datadog_logs example: datadog_logs type: string x-enum-varnames: - DATADOG_LOGS ObservabilityPipelineDatadogMetricsDestination: description: |- The `datadog_metrics` destination forwards metrics to Datadog. **Supported pipeline types:** metrics properties: buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" id: description: The unique identifier for this component. example: datadog-metrics-destination type: string inputs: description: A list of component IDs whose output is used as the input for this component. example: ["metric-tags-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array type: $ref: "#/components/schemas/ObservabilityPipelineDatadogMetricsDestinationType" required: - id - type - inputs type: object x-pipeline-types: [metrics] ObservabilityPipelineDatadogMetricsDestinationType: default: datadog_metrics description: The destination type. The value should always be `datadog_metrics`. enum: - datadog_metrics example: datadog_metrics type: string x-enum-varnames: - DATADOG_METRICS ObservabilityPipelineDatadogTagsProcessor: description: |- The `datadog_tags` processor includes or excludes specific Datadog tags in your logs. **Supported pipeline types:** logs properties: action: $ref: "#/components/schemas/ObservabilityPipelineDatadogTagsProcessorAction" display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: "datadog-tags-processor" type: string include: description: A Datadog search query used to determine which logs this processor targets. example: "service:my-service" type: string keys: description: A list of tag keys. example: ["env", "service", "version"] items: description: A Datadog tag key to include or exclude. type: string type: array mode: $ref: "#/components/schemas/ObservabilityPipelineDatadogTagsProcessorMode" type: $ref: "#/components/schemas/ObservabilityPipelineDatadogTagsProcessorType" required: - id - type - include - mode - action - keys - enabled type: object x-pipeline-types: [logs] ObservabilityPipelineDatadogTagsProcessorAction: description: The action to take on tags with matching keys. enum: - include - exclude example: include type: string x-enum-varnames: - INCLUDE - EXCLUDE ObservabilityPipelineDatadogTagsProcessorMode: description: The processing mode. enum: - filter example: filter type: string x-enum-varnames: - FILTER ObservabilityPipelineDatadogTagsProcessorType: default: datadog_tags description: The processor type. The value should always be `datadog_tags`. enum: - datadog_tags example: datadog_tags type: string x-enum-varnames: - DATADOG_TAGS ObservabilityPipelineDatadogTracesDestination: description: |- The `datadog_traces` destination forwards traces to Datadog. **Supported pipeline types:** traces properties: buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" id: description: The unique identifier for this component. example: datadog-traces-destination type: string inputs: description: A list of component IDs whose output is used as the input for this component. example: ["trace-processor-group"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array type: $ref: "#/components/schemas/ObservabilityPipelineDatadogTracesDestinationType" required: - id - type - inputs type: object x-pipeline-types: [traces] ObservabilityPipelineDatadogTracesDestinationType: default: datadog_traces description: The destination type. The value should always be `datadog_traces`. enum: - datadog_traces example: datadog_traces type: string x-enum-varnames: - DATADOG_TRACES ObservabilityPipelineDecoding: description: The decoding format used to interpret incoming logs. enum: - bytes - gelf - json - syslog example: json type: string x-enum-varnames: - DECODE_BYTES - DECODE_GELF - DECODE_JSON - DECODE_SYSLOG ObservabilityPipelineDedupeProcessor: description: |- The `dedupe` processor removes duplicate fields in log events. **Supported pipeline types:** logs properties: cache: $ref: "#/components/schemas/ObservabilityPipelineDedupeProcessorCache" display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean fields: description: A list of log field paths to check for duplicates. example: ["log.message", "log.error"] items: description: A log field path to evaluate for duplicate values. type: string type: array id: description: The unique identifier for this processor. example: dedupe-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string mode: $ref: "#/components/schemas/ObservabilityPipelineDedupeProcessorMode" type: $ref: "#/components/schemas/ObservabilityPipelineDedupeProcessorType" required: - id - type - include - fields - mode - enabled type: object x-pipeline-types: [logs] ObservabilityPipelineDedupeProcessorCache: description: Configuration for the cache used to detect duplicates. properties: num_events: description: The number of events to cache for duplicate detection. example: 5000 format: int64 maximum: 1000000000 minimum: 1 type: integer required: - num_events type: object ObservabilityPipelineDedupeProcessorMode: description: The deduplication mode to apply to the fields. enum: - match - ignore example: match type: string x-enum-varnames: - MATCH - IGNORE ObservabilityPipelineDedupeProcessorType: default: dedupe description: The processor type. The value should always be `dedupe`. enum: - dedupe example: dedupe type: string x-enum-varnames: - DEDUPE ObservabilityPipelineDiskBufferOptions: description: Options for configuring a disk buffer. properties: max_size: description: Maximum size of the disk buffer. example: 4096 format: int64 type: integer type: $ref: "#/components/schemas/ObservabilityPipelineBufferOptionsDiskType" when_full: $ref: "#/components/schemas/ObservabilityPipelineBufferOptionsWhenFull" required: - max_size type: object ObservabilityPipelineElasticsearchDestination: description: |- The `elasticsearch` destination writes logs or metrics to an Elasticsearch cluster. **Supported pipeline types:** logs, metrics properties: api_version: $ref: "#/components/schemas/ObservabilityPipelineElasticsearchDestinationApiVersion" auth: $ref: "#/components/schemas/ObservabilityPipelineElasticsearchDestinationAuth" buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" bulk_index: description: The name of the index to write events to in Elasticsearch. example: logs-index type: string compression: $ref: "#/components/schemas/ObservabilityPipelineElasticsearchDestinationCompression" data_stream: $ref: "#/components/schemas/ObservabilityPipelineElasticsearchDestinationDataStream" endpoint_url_key: description: Name of the environment variable or secret that holds the Elasticsearch endpoint URL. example: ELASTICSEARCH_ENDPOINT_URL type: string id: description: The unique identifier for this component. example: "elasticsearch-destination" type: string id_key: description: The name of the field used as the document ID in Elasticsearch. example: id type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array pipeline: description: The name of an Elasticsearch ingest pipeline to apply to events before indexing. example: my-pipeline type: string request_retry_partial: description: When `true`, retries failed partial bulk requests when some events in a batch fail while others succeed. type: boolean tls: $ref: "#/components/schemas/ObservabilityPipelineTls" type: $ref: "#/components/schemas/ObservabilityPipelineElasticsearchDestinationType" required: - id - type - inputs type: object x-pipeline-types: [logs, metrics] ObservabilityPipelineElasticsearchDestinationApiVersion: description: The Elasticsearch API version to use. Set to `auto` to auto-detect. enum: [auto, v6, v7, v8] example: auto type: string x-enum-varnames: - AUTO - V6 - V7 - V8 ObservabilityPipelineElasticsearchDestinationAuth: description: |- Authentication settings for the Elasticsearch destination. When `strategy` is `basic`, use `username_key` and `password_key` to reference credentials stored in environment variables or secrets. properties: password_key: description: Name of the environment variable or secret that holds the Elasticsearch password (used when `strategy` is `basic`). example: ELASTICSEARCH_PASSWORD type: string strategy: $ref: "#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestinationAuthStrategy" username_key: description: Name of the environment variable or secret that holds the Elasticsearch username (used when `strategy` is `basic`). example: ELASTICSEARCH_USERNAME type: string required: - strategy type: object ObservabilityPipelineElasticsearchDestinationCompression: description: Compression configuration for the Elasticsearch destination. properties: algorithm: $ref: "#/components/schemas/ObservabilityPipelineElasticsearchDestinationCompressionAlgorithm" level: description: The compression level. Only applicable for `gzip`, `zlib`, and `zstd` algorithms. example: 6 format: int64 type: integer required: - algorithm type: object ObservabilityPipelineElasticsearchDestinationCompressionAlgorithm: description: The compression algorithm applied when sending data to Elasticsearch. enum: [none, gzip, zlib, zstd, snappy] example: gzip type: string x-enum-varnames: - NONE - GZIP - ZLIB - ZSTD - SNAPPY ObservabilityPipelineElasticsearchDestinationDataStream: description: Configuration options for writing to Elasticsearch Data Streams instead of a fixed index. properties: auto_routing: description: When `true`, automatically routes events to the appropriate data stream based on the event content. type: boolean dataset: description: The data stream dataset. This groups events by their source or application. type: string dtype: description: The data stream type. This determines how events are categorized within the data stream. type: string namespace: description: The data stream namespace. This separates events into different environments or domains. type: string sync_fields: description: When `true`, synchronizes data stream fields with the Elasticsearch index mapping. type: boolean type: object ObservabilityPipelineElasticsearchDestinationType: default: elasticsearch description: The destination type. The value should always be `elasticsearch`. enum: - elasticsearch example: elasticsearch type: string x-enum-varnames: - ELASTICSEARCH ObservabilityPipelineEnrichmentTableFieldEventLookup: description: Looks up a value from a field path in the log event. properties: event: description: The path to the field in the log event to use as the lookup key. example: log.user.id type: string required: - event type: object ObservabilityPipelineEnrichmentTableFieldSecretLookup: description: Looks up a value stored as a pipeline secret. properties: secret: description: The name of the secret containing the lookup key value. example: MY_LOOKUP_SECRET type: string required: - secret type: object ObservabilityPipelineEnrichmentTableFieldStringPath: description: A plain field path in the log event, used as the lookup key. example: log.user.id type: string ObservabilityPipelineEnrichmentTableFieldVrlLookup: description: Evaluates a VRL expression to produce the lookup key. properties: vrl: description: A VRL expression that returns the value to use as the lookup key. example: .log.user.id type: string required: - vrl type: object ObservabilityPipelineEnrichmentTableFile: description: Defines a static enrichment table loaded from a CSV file. properties: encoding: $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFileEncoding" key: description: Key fields used to look up enrichment values. items: $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFileKeyItems" type: array path: description: Path to the CSV file. example: /etc/enrichment/lookup.csv type: string schema: description: Schema defining column names and their types. items: $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFileSchemaItems" type: array required: - encoding - key - path - schema type: object ObservabilityPipelineEnrichmentTableFileEncoding: description: File encoding format. properties: delimiter: description: The `encoding` `delimiter`. example: "," type: string includes_headers: description: The `encoding` `includes_headers`. example: true type: boolean type: $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFileEncodingType" required: - type - delimiter - includes_headers type: object ObservabilityPipelineEnrichmentTableFileEncodingType: description: Specifies the encoding format (e.g., CSV) used for enrichment tables. enum: [csv] example: csv type: string x-enum-varnames: - CSV ObservabilityPipelineEnrichmentTableFileKeyItemField: description: |- Specifies the source of the key value used for enrichment table lookups. Can be a plain field path string or an object specifying `event`, `vrl`, or `secret`. example: log.user.id oneOf: - $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFieldStringPath" - $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFieldEventLookup" - $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFieldVrlLookup" - $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFieldSecretLookup" ObservabilityPipelineEnrichmentTableFileKeyItems: description: Defines how to map log fields to enrichment table columns during lookups. properties: column: description: The `items` `column`. example: user_id type: string comparison: $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFileKeyItemsComparison" field: $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFileKeyItemField" required: - column - comparison - field type: object ObservabilityPipelineEnrichmentTableFileKeyItemsComparison: description: Defines how to compare key fields for enrichment table lookups. enum: [equals] example: equals type: string x-enum-varnames: - EQUALS ObservabilityPipelineEnrichmentTableFileSchemaItems: description: Describes a single column and its type in an enrichment table schema. properties: column: description: The `items` `column`. example: region type: string type: $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFileSchemaItemsType" required: - column - type type: object ObservabilityPipelineEnrichmentTableFileSchemaItemsType: description: Declares allowed data types for enrichment table columns. enum: [string, boolean, integer, float, date, timestamp] example: string type: string x-enum-varnames: - STRING - BOOLEAN - INTEGER - FLOAT - DATE - TIMESTAMP ObservabilityPipelineEnrichmentTableGeoIp: description: Uses a GeoIP database to enrich logs based on an IP field. properties: key_field: description: Path to the IP field in the log. example: log.source.ip type: string locale: description: Locale used to resolve geographical names. example: en type: string path: description: Path to the GeoIP database file. example: /etc/geoip/GeoLite2-City.mmdb type: string required: - key_field - locale - path type: object ObservabilityPipelineEnrichmentTableProcessor: description: |- The `enrichment_table` processor enriches logs using a static CSV file, GeoIP database, or reference table. Exactly one of `file`, `geoip`, or `reference_table` must be configured. **Supported pipeline types:** logs properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean file: $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFile" geoip: $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableGeoIp" id: description: The unique identifier for this processor. example: enrichment-table-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: source:my-source type: string reference_table: $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableReferenceTable" target: description: Path where enrichment results should be stored in the log. example: enriched.geoip type: string type: $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableProcessorType" required: - id - type - include - target - enabled type: object x-pipeline-types: [logs] ObservabilityPipelineEnrichmentTableProcessorType: default: enrichment_table description: The processor type. The value should always be `enrichment_table`. enum: - enrichment_table example: enrichment_table type: string x-enum-varnames: - ENRICHMENT_TABLE ObservabilityPipelineEnrichmentTableReferenceTable: description: Uses a Datadog reference table to enrich logs. properties: app_key_key: description: Name of the environment variable or secret that holds the Datadog application key used to access the reference table. example: DD_APP_KEY type: string columns: description: List of column names to include from the reference table. If not provided, all columns are included. items: description: The name of a column to include from the reference table. type: string type: array key_field: description: Path to the field in the log event to match against the reference table. example: log.user.id type: string table_id: description: The unique identifier of the reference table. example: 550e8400-e29b-41d4-a716-446655440000 type: string required: - key_field - table_id type: object ObservabilityPipelineFieldValue: description: Represents a static key-value pair used in various processors. properties: name: description: The field name. example: "field_name" type: string value: description: The field value. example: "field_value" type: string required: - name - value type: object ObservabilityPipelineFilterProcessor: description: |- The `filter` processor allows conditional processing of logs, metrics, or traces based on a Datadog search query. Events that match the `include` query are passed through; others are discarded. **Supported pipeline types:** logs, metrics, traces properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: "filter-processor" type: string include: description: A Datadog search query used to determine which events should pass through the filter. Events that match this query continue to downstream components; others are dropped. example: "service:my-service" type: string type: $ref: "#/components/schemas/ObservabilityPipelineFilterProcessorType" required: - id - type - include - enabled type: object x-pipeline-types: [logs, metrics, traces] ObservabilityPipelineFilterProcessorType: default: filter description: The processor type. The value should always be `filter`. enum: - filter example: filter type: string x-enum-varnames: - FILTER ObservabilityPipelineFluentBitSource: description: |- The `fluent_bit` source ingests logs from Fluent Bit. **Supported pipeline types:** logs properties: address_key: description: Name of the environment variable or secret that holds the listen address for the Fluent Bit receiver. example: FLUENT_ADDRESS type: string id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: "fluent-source" type: string tls: $ref: "#/components/schemas/ObservabilityPipelineMtlsServerTls" type: $ref: "#/components/schemas/ObservabilityPipelineFluentBitSourceType" required: - id - type type: object x-pipeline-types: [logs] ObservabilityPipelineFluentBitSourceType: default: fluent_bit description: The source type. The value should always be `fluent_bit`. enum: - fluent_bit example: fluent_bit type: string x-enum-varnames: - FLUENT_BIT ObservabilityPipelineFluentdSource: description: |- The `fluentd` source ingests logs from a Fluentd-compatible service. **Supported pipeline types:** logs properties: address_key: description: Name of the environment variable or secret that holds the listen address for the Fluent receiver. example: FLUENT_ADDRESS type: string id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: "fluent-source" type: string tls: $ref: "#/components/schemas/ObservabilityPipelineMtlsServerTls" type: $ref: "#/components/schemas/ObservabilityPipelineFluentdSourceType" required: - id - type type: object x-pipeline-types: [logs] ObservabilityPipelineFluentdSourceType: default: fluentd description: The source type. The value should always be `fluentd. enum: - fluentd example: fluentd type: string x-enum-varnames: - FLUENTD ObservabilityPipelineGcpAuth: description: |- Google Cloud credentials used to authenticate with Google Cloud Storage. properties: credentials_file: description: Path to the Google Cloud service account key file. example: /var/secrets/gcp-credentials.json type: string required: - credentials_file type: object ObservabilityPipelineGenerateMetricsProcessor: deprecated: true description: |- The `generate_datadog_metrics` processor creates custom metrics from logs and sends them to Datadog. Metrics can be counters, gauges, or distributions and optionally grouped by log fields. **Supported pipeline types:** logs **Deprecated:** This processor is deprecated. Use the `generate_metrics` processor instead. properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline. example: generate-metrics-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: "service:my-service" type: string metrics: description: Configuration for generating individual metrics. items: $ref: "#/components/schemas/ObservabilityPipelineGeneratedMetric" type: array type: $ref: "#/components/schemas/ObservabilityPipelineGenerateMetricsProcessorType" required: - id - type - enabled type: object x-pipeline-types: [logs] ObservabilityPipelineGenerateMetricsProcessorType: default: generate_datadog_metrics description: The processor type. Always `generate_datadog_metrics`. enum: - generate_datadog_metrics example: generate_datadog_metrics type: string x-enum-varnames: - GENERATE_DATADOG_METRICS ObservabilityPipelineGenerateMetricsV2Processor: description: |- The `generate_metrics` processor creates custom metrics from logs or traces. Metrics can be counters, gauges, or distributions and optionally grouped by event fields. There must be a destination whose `inputs` reference this processor with the `.metrics` suffix to route the generated metrics. All destination types normally supported for `metrics` pipelines are also supported as metrics destinations in `logs` and `traces` pipelines. **Supported pipeline types:** logs, traces properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean enabled_metric_aggregation: description: >- [Recommended] Indicates whether generated metrics are automatically aggregated and enriched with the `worker_uuid` tag before being sent to the metric destination. example: true type: boolean id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline. example: generate-metrics-processor type: string include: description: A Datadog search query used to determine which events this processor targets. example: "service:my-service" type: string metrics: description: Configuration for generating individual metrics. items: $ref: "#/components/schemas/ObservabilityPipelineGeneratedMetric" type: array type: $ref: "#/components/schemas/ObservabilityPipelineGenerateMetricsV2ProcessorType" required: - id - type - enabled type: object x-pipeline-types: [logs, traces] ObservabilityPipelineGenerateMetricsV2ProcessorType: default: generate_metrics description: The processor type. Always `generate_metrics`. enum: - generate_metrics example: generate_metrics type: string x-enum-varnames: - GENERATE_METRICS ObservabilityPipelineGeneratedMetric: description: |- Defines a custom metric generated from logs or traces, including its name, type, filter, value computation strategy, and optional grouping fields. properties: group_by: description: Optional fields used to group the metric series. example: ["service", "env"] items: description: A field name used to group the metric series. type: string type: array include: description: Datadog filter query to match events for metric generation. example: service:billing type: string metric_type: $ref: "#/components/schemas/ObservabilityPipelineGeneratedMetricMetricType" name: description: Name of the custom metric to be created. example: logs.processed type: string value: $ref: "#/components/schemas/ObservabilityPipelineMetricValue" required: - name - include - metric_type - value type: object ObservabilityPipelineGeneratedMetricIncrementByField: description: Strategy that increments a generated metric based on the value of an event field. properties: field: description: Name of the field containing the numeric value to increment the metric by. example: "errors" type: string strategy: $ref: "#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByFieldStrategy" required: - strategy - field type: object ObservabilityPipelineGeneratedMetricIncrementByFieldStrategy: description: Uses a numeric field in the log event as the metric increment. enum: - increment_by_field example: increment_by_field type: string x-enum-varnames: - INCREMENT_BY_FIELD ObservabilityPipelineGeneratedMetricIncrementByOne: description: Strategy that increments a generated metric by one for each matching event. properties: strategy: $ref: "#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByOneStrategy" required: - strategy type: object ObservabilityPipelineGeneratedMetricIncrementByOneStrategy: description: Increments the metric by 1 for each matching event. enum: - increment_by_one example: increment_by_one type: string x-enum-varnames: - INCREMENT_BY_ONE ObservabilityPipelineGeneratedMetricMetricType: description: Type of metric to create. enum: - count - gauge - distribution example: count type: string x-enum-varnames: - COUNT - GAUGE - DISTRIBUTION ObservabilityPipelineGoogleChronicleDestination: description: |- The `google_chronicle` destination sends logs to Google Chronicle. **Supported pipeline types:** logs properties: auth: $ref: "#/components/schemas/ObservabilityPipelineGcpAuth" buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" customer_id: description: The Google Chronicle customer ID. example: abcdefg123456789 type: string encoding: $ref: "#/components/schemas/ObservabilityPipelineGoogleChronicleDestinationEncoding" endpoint_url_key: description: Name of the environment variable or secret that holds the Google Chronicle endpoint URL. example: CHRONICLE_ENDPOINT_URL type: string id: description: The unique identifier for this component. example: google-chronicle-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["parse-json-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array log_type: description: The log type metadata associated with the Chronicle destination. example: nginx_logs type: string type: $ref: "#/components/schemas/ObservabilityPipelineGoogleChronicleDestinationType" required: - id - type - inputs - customer_id type: object x-pipeline-types: [logs] ObservabilityPipelineGoogleChronicleDestinationEncoding: description: The encoding format for the logs sent to Chronicle. enum: - json - raw_message example: json type: string x-enum-varnames: - JSON - RAW_MESSAGE ObservabilityPipelineGoogleChronicleDestinationType: default: google_chronicle description: The destination type. The value should always be `google_chronicle`. enum: - google_chronicle example: google_chronicle type: string x-enum-varnames: - GOOGLE_CHRONICLE ObservabilityPipelineGoogleCloudStorageDestination: description: |- The `google_cloud_storage` destination stores logs in a Google Cloud Storage (GCS) bucket. It requires a bucket name, Google Cloud authentication, and metadata fields. **Supported pipeline types:** logs properties: acl: $ref: "#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationAcl" auth: $ref: "#/components/schemas/ObservabilityPipelineGcpAuth" bucket: description: Name of the GCS bucket. example: "error-logs" type: string buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" compression: $ref: "#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationCompression" id: description: Unique identifier for the destination component. example: gcs-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["datadog-agent-source"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array key_prefix: description: Optional prefix for object keys within the GCS bucket. type: string metadata: description: Custom metadata to attach to each object uploaded to the GCS bucket. items: $ref: "#/components/schemas/ObservabilityPipelineMetadataEntry" type: array storage_class: $ref: "#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationStorageClass" type: $ref: "#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationType" required: - id - type - inputs - bucket - storage_class type: object x-pipeline-types: [logs] ObservabilityPipelineGoogleCloudStorageDestinationAcl: description: Access control list setting for objects written to the bucket. enum: - private - project-private - public-read - authenticated-read - bucket-owner-read - bucket-owner-full-control example: private type: string x-enum-varnames: - PRIVATE - PROJECTNOT_PRIVATE - PUBLICNOT_READ - AUTHENTICATEDNOT_READ - BUCKETNOT_OWNERNOT_READ - BUCKETNOT_OWNERNOT_FULLNOT_CONTROL ObservabilityPipelineGoogleCloudStorageDestinationCompression: description: |- Compression configuration for archived logs. When omitted, logs are compressed with gzip for backward compatibility. oneOf: - $ref: "#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationCompressionZstd" - $ref: "#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationCompressionGzip" ObservabilityPipelineGoogleCloudStorageDestinationCompressionGzip: description: Gzip compression. properties: algorithm: $ref: "#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationCompressionGzipType" level: description: Gzip compression level. Valid values range from `1` to `9`. example: 6 format: int64 maximum: 9 minimum: 1 type: integer required: - algorithm - level type: object ObservabilityPipelineGoogleCloudStorageDestinationCompressionGzipType: default: gzip description: The compression type. Always `gzip`. enum: - gzip example: gzip type: string x-enum-varnames: - GZIP ObservabilityPipelineGoogleCloudStorageDestinationCompressionZstd: description: Zstd compression. properties: algorithm: $ref: "#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationCompressionZstdType" level: description: Zstd compression level. Valid values range from `1` to `21`. example: 3 format: int64 maximum: 21 minimum: 1 type: integer required: - algorithm - level type: object ObservabilityPipelineGoogleCloudStorageDestinationCompressionZstdType: default: zstd description: The compression type. Always `zstd`. enum: - zstd example: zstd type: string x-enum-varnames: - ZSTD ObservabilityPipelineGoogleCloudStorageDestinationStorageClass: description: Storage class used for objects stored in GCS. enum: - STANDARD - NEARLINE - COLDLINE - ARCHIVE example: STANDARD type: string x-enum-varnames: - STANDARD - NEARLINE - COLDLINE - ARCHIVE ObservabilityPipelineGoogleCloudStorageDestinationType: default: google_cloud_storage description: The destination type. Always `google_cloud_storage`. enum: - google_cloud_storage example: google_cloud_storage type: string x-enum-varnames: - GOOGLE_CLOUD_STORAGE ObservabilityPipelineGooglePubSubDestination: description: |- The `google_pubsub` destination publishes logs to a Google Cloud Pub/Sub topic. **Supported pipeline types:** logs properties: auth: $ref: "#/components/schemas/ObservabilityPipelineGcpAuth" buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" encoding: $ref: "#/components/schemas/ObservabilityPipelineGooglePubSubDestinationEncoding" endpoint_url_key: description: Name of the environment variable or secret that holds the Google Cloud Pub/Sub endpoint URL. example: GCP_PUBSUB_ENDPOINT_URL type: string id: description: The unique identifier for this component. example: google-pubsub-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array project: description: The Google Cloud project ID that owns the Pub/Sub topic. example: my-gcp-project type: string tls: $ref: "#/components/schemas/ObservabilityPipelineTls" topic: description: The Pub/Sub topic name to publish logs to. example: logs-subscription type: string type: $ref: "#/components/schemas/ObservabilityPipelineGooglePubSubDestinationType" required: - id - type - inputs - encoding - project - topic type: object x-pipeline-types: [logs] ObservabilityPipelineGooglePubSubDestinationEncoding: description: Encoding format for log events. enum: - json - raw_message example: json type: string x-enum-varnames: - JSON - RAW_MESSAGE ObservabilityPipelineGooglePubSubDestinationType: default: google_pubsub description: The destination type. The value should always be `google_pubsub`. enum: - google_pubsub example: google_pubsub type: string x-enum-varnames: - GOOGLE_PUBSUB ObservabilityPipelineGooglePubSubSource: description: |- The `google_pubsub` source ingests logs from a Google Cloud Pub/Sub subscription. **Supported pipeline types:** logs properties: auth: $ref: "#/components/schemas/ObservabilityPipelineGcpAuth" decoding: $ref: "#/components/schemas/ObservabilityPipelineDecoding" id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: google-pubsub-source type: string project: description: The Google Cloud project ID that owns the Pub/Sub subscription. example: my-gcp-project type: string subscription: description: The Pub/Sub subscription name from which messages are consumed. example: logs-subscription type: string tls: $ref: "#/components/schemas/ObservabilityPipelineTls" type: $ref: "#/components/schemas/ObservabilityPipelineGooglePubSubSourceType" required: - id - type - decoding - project - subscription type: object x-pipeline-types: [logs] ObservabilityPipelineGooglePubSubSourceType: default: google_pubsub description: The source type. The value should always be `google_pubsub`. enum: [google_pubsub] example: google_pubsub type: string x-enum-varnames: [GOOGLE_PUBSUB] ObservabilityPipelineHttpClientDestination: description: |- The `http_client` destination sends data to an HTTP endpoint. **Supported pipeline types:** logs, metrics properties: auth_strategy: $ref: "#/components/schemas/ObservabilityPipelineHttpClientDestinationAuthStrategy" buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" compression: $ref: "#/components/schemas/ObservabilityPipelineHttpClientDestinationCompression" custom_key: description: Name of the environment variable or secret that holds a custom header value (used with custom auth strategies). example: HTTP_AUTH_CUSTOM_HEADER type: string encoding: $ref: "#/components/schemas/ObservabilityPipelineHttpClientDestinationEncoding" id: description: The unique identifier for this component. example: http-client-destination type: string inputs: description: A list of component IDs whose output is used as the input for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array password_key: description: Name of the environment variable or secret that holds the password (used when `auth_strategy` is `basic`). example: HTTP_AUTH_PASSWORD type: string tls: $ref: "#/components/schemas/ObservabilityPipelineClientTls" token_key: description: Name of the environment variable or secret that holds the bearer token (used when `auth_strategy` is `bearer`). example: HTTP_AUTH_TOKEN type: string type: $ref: "#/components/schemas/ObservabilityPipelineHttpClientDestinationType" uri_key: description: Name of the environment variable or secret that holds the HTTP endpoint URI. example: HTTP_DESTINATION_URI type: string username_key: description: Name of the environment variable or secret that holds the username (used when `auth_strategy` is `basic`). example: HTTP_AUTH_USERNAME type: string required: - id - type - inputs - encoding type: object x-pipeline-types: [logs, metrics] ObservabilityPipelineHttpClientDestinationAuthStrategy: description: HTTP authentication strategy. enum: [none, basic, bearer, custom] example: basic type: string x-enum-varnames: - NONE - BASIC - BEARER - CUSTOM ObservabilityPipelineHttpClientDestinationCompression: description: Compression configuration for HTTP requests. properties: algorithm: $ref: "#/components/schemas/ObservabilityPipelineHttpClientDestinationCompressionAlgorithm" required: - algorithm type: object ObservabilityPipelineHttpClientDestinationCompressionAlgorithm: description: Compression algorithm. enum: [gzip] example: gzip type: string x-enum-varnames: - GZIP ObservabilityPipelineHttpClientDestinationEncoding: description: Encoding format for log events. enum: [json] example: json type: string x-enum-varnames: - JSON ObservabilityPipelineHttpClientDestinationType: default: http_client description: The destination type. The value should always be `http_client`. enum: [http_client] example: http_client type: string x-enum-varnames: - HTTP_CLIENT ObservabilityPipelineHttpClientSource: description: |- The `http_client` source scrapes logs from HTTP endpoints at regular intervals. **Supported pipeline types:** logs properties: auth_strategy: $ref: "#/components/schemas/ObservabilityPipelineHttpClientSourceAuthStrategy" custom_key: description: Name of the environment variable or secret that holds a custom header value (used with custom auth strategies). example: HTTP_AUTH_CUSTOM_HEADER type: string decoding: $ref: "#/components/schemas/ObservabilityPipelineDecoding" endpoint_url_key: description: Name of the environment variable or secret that holds the HTTP endpoint URL to scrape. example: HTTP_ENDPOINT_URL type: string id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: http-client-source type: string password_key: description: Name of the environment variable or secret that holds the password (used when `auth_strategy` is `basic`). example: HTTP_AUTH_PASSWORD type: string scrape_interval_secs: description: The interval (in seconds) between HTTP scrape requests. example: 60 format: int64 type: integer scrape_timeout_secs: description: The timeout (in seconds) for each scrape request. example: 10 format: int64 type: integer tls: $ref: "#/components/schemas/ObservabilityPipelineClientTls" token_key: description: Name of the environment variable or secret that holds the bearer token (used when `auth_strategy` is `bearer`). example: HTTP_AUTH_TOKEN type: string type: $ref: "#/components/schemas/ObservabilityPipelineHttpClientSourceType" username_key: description: Name of the environment variable or secret that holds the username (used when `auth_strategy` is `basic`). example: HTTP_AUTH_USERNAME type: string required: - id - type - decoding type: object x-pipeline-types: [logs] ObservabilityPipelineHttpClientSourceAuthStrategy: description: Optional authentication strategy for HTTP requests. enum: [none, basic, bearer, custom] example: basic type: string x-enum-varnames: - NONE - BASIC - BEARER - CUSTOM ObservabilityPipelineHttpClientSourceType: default: http_client description: The source type. The value should always be `http_client`. enum: [http_client] example: http_client type: string x-enum-varnames: [HTTP_CLIENT] ObservabilityPipelineHttpServerSource: description: |- The `http_server` source collects logs over HTTP POST from external services. **Supported pipeline types:** logs properties: address_key: description: Name of the environment variable or secret that holds the listen address for the HTTP server. example: HTTP_SERVER_ADDRESS type: string auth_strategy: $ref: "#/components/schemas/ObservabilityPipelineHttpServerSourceAuthStrategy" custom_key: description: Name of the environment variable or secret that holds a custom header value (used with custom auth strategies). example: HTTP_AUTH_CUSTOM_HEADER type: string decoding: $ref: "#/components/schemas/ObservabilityPipelineDecoding" id: description: Unique ID for the HTTP server source. example: "http-server-source" type: string password_key: description: Name of the environment variable or secret that holds the password (used when `auth_strategy` is `plain`). example: HTTP_AUTH_PASSWORD type: string tls: $ref: "#/components/schemas/ObservabilityPipelineMtlsServerTls" type: $ref: "#/components/schemas/ObservabilityPipelineHttpServerSourceType" username_key: description: Name of the environment variable or secret that holds the username (used when `auth_strategy` is `plain`). example: HTTP_AUTH_USERNAME type: string valid_tokens: description: |- A list of tokens that are accepted for authenticating incoming HTTP requests. When set, the source rejects any request whose token does not match an enabled entry in this list. Cannot be combined with the `plain` auth strategy. items: $ref: "#/components/schemas/ObservabilityPipelineHttpServerSourceValidToken" maxItems: 1000 minItems: 1 type: array required: - id - type - auth_strategy - decoding type: object x-pipeline-types: [logs] ObservabilityPipelineHttpServerSourceAuthStrategy: description: HTTP authentication method. enum: - none - plain example: plain type: string x-enum-varnames: - NONE - PLAIN ObservabilityPipelineHttpServerSourceType: default: http_server description: The source type. The value should always be `http_server`. enum: [http_server] example: http_server type: string x-enum-varnames: - HTTP_SERVER ObservabilityPipelineHttpServerSourceValidToken: description: An accepted token used to authenticate incoming HTTP server requests. properties: enabled: default: true description: |- Indicates whether this token is currently accepted. Disabled tokens are rejected without being removed from the configuration. example: true type: boolean field_to_add: $ref: "#/components/schemas/ObservabilityPipelineSourceValidTokenFieldToAdd" path_to_token: $ref: "#/components/schemas/ObservabilityPipelineHttpServerSourceValidTokenPathToToken" token_key: description: Name of the environment variable or secret that holds the expected token value. example: HTTP_SERVER_TOKEN pattern: "^[A-Za-z0-9_]+$" type: string required: - token_key type: object ObservabilityPipelineHttpServerSourceValidTokenPathToToken: description: |- Specifies where the worker extracts the token from in the incoming HTTP request. This can be either a built-in location (`path` or `address`) or an HTTP header object. oneOf: - $ref: "#/components/schemas/ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation" - $ref: "#/components/schemas/ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader" ObservabilityPipelineHttpServerSourceValidTokenPathToTokenHeader: description: Extract the token from a specific HTTP request header. properties: header: description: The name of the HTTP header that carries the token. example: X-Token type: string required: - header type: object ObservabilityPipelineHttpServerSourceValidTokenPathToTokenLocation: description: Built-in token location on the incoming HTTP request. enum: - path - address example: path type: string x-enum-varnames: - PATH - ADDRESS ObservabilityPipelineKafkaDestination: description: |- The `kafka` destination sends logs to Apache Kafka topics. **Supported pipeline types:** logs properties: bootstrap_servers_key: description: Name of the environment variable or secret that holds the Kafka bootstrap servers list. example: KAFKA_BOOTSTRAP_SERVERS type: string buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" compression: $ref: "#/components/schemas/ObservabilityPipelineKafkaDestinationCompression" encoding: $ref: "#/components/schemas/ObservabilityPipelineKafkaDestinationEncoding" headers_key: description: The field name to use for Kafka message headers. example: headers type: string id: description: The unique identifier for this component. example: kafka-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array key_field: description: The field name to use as the Kafka message key. example: message_id type: string librdkafka_options: description: Optional list of advanced Kafka producer configuration options, defined as key-value pairs. items: $ref: "#/components/schemas/ObservabilityPipelineKafkaLibrdkafkaOption" type: array message_timeout_ms: description: Maximum time in milliseconds to wait for message delivery confirmation. example: 300000 format: int64 minimum: 1 type: integer rate_limit_duration_secs: description: Duration in seconds for the rate limit window. example: 1 format: int64 minimum: 1 type: integer rate_limit_num: description: Maximum number of messages allowed per rate limit duration. example: 1000 format: int64 minimum: 1 type: integer sasl: $ref: "#/components/schemas/ObservabilityPipelineKafkaSasl" socket_timeout_ms: description: Socket timeout in milliseconds for network requests. example: 60000 format: int64 maximum: 300000 minimum: 10 type: integer tls: $ref: "#/components/schemas/ObservabilityPipelineTls" topic: description: The Kafka topic name to publish logs to. example: logs-topic type: string type: $ref: "#/components/schemas/ObservabilityPipelineKafkaDestinationType" required: - id - type - inputs - topic - encoding type: object x-pipeline-types: [logs] ObservabilityPipelineKafkaDestinationCompression: description: Compression codec for Kafka messages. enum: - none - gzip - snappy - lz4 - zstd example: gzip type: string x-enum-varnames: - NONE - GZIP - SNAPPY - LZ4 - ZSTD ObservabilityPipelineKafkaDestinationEncoding: description: Encoding format for log events. enum: - json - raw_message example: json type: string x-enum-varnames: - JSON - RAW_MESSAGE ObservabilityPipelineKafkaDestinationType: default: kafka description: The destination type. The value should always be `kafka`. enum: - kafka example: kafka type: string x-enum-varnames: - KAFKA ObservabilityPipelineKafkaLibrdkafkaOption: description: Represents a key-value pair used to configure low-level `librdkafka` client options for Kafka source and destination, such as timeouts, buffer sizes, and security settings. properties: name: description: The name of the `librdkafka` configuration option to set. example: "fetch.message.max.bytes" type: string value: description: The value assigned to the specified `librdkafka` configuration option. example: "1048576" type: string required: - name - value type: object ObservabilityPipelineKafkaSasl: description: Specifies the SASL mechanism for authenticating with a Kafka cluster. properties: mechanism: $ref: "#/components/schemas/ObservabilityPipelineKafkaSaslMechanism" password_key: description: Name of the environment variable or secret that holds the SASL password. example: KAFKA_SASL_PASSWORD type: string username_key: description: Name of the environment variable or secret that holds the SASL username. example: KAFKA_SASL_USERNAME type: string type: object ObservabilityPipelineKafkaSaslMechanism: description: SASL mechanism used for Kafka authentication. enum: - PLAIN - SCRAM-SHA-256 - SCRAM-SHA-512 type: string x-enum-varnames: - PLAIN - SCRAMNOT_SHANOT_256 - SCRAMNOT_SHANOT_512 ObservabilityPipelineKafkaSource: description: |- The `kafka` source ingests data from Apache Kafka topics. **Supported pipeline types:** logs properties: bootstrap_servers_key: description: Name of the environment variable or secret that holds the Kafka bootstrap servers list. example: KAFKA_BOOTSTRAP_SERVERS type: string group_id: description: Consumer group ID used by the Kafka client. example: "consumer-group-0" type: string id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: "kafka-source" type: string librdkafka_options: description: Optional list of advanced Kafka client configuration options, defined as key-value pairs. items: $ref: "#/components/schemas/ObservabilityPipelineKafkaLibrdkafkaOption" type: array sasl: $ref: "#/components/schemas/ObservabilityPipelineKafkaSasl" tls: $ref: "#/components/schemas/ObservabilityPipelineTls" topics: description: A list of Kafka topic names to subscribe to. The source ingests messages from each topic specified. example: ["topic1", "topic2"] items: description: A Kafka topic name to subscribe to. type: string type: array type: $ref: "#/components/schemas/ObservabilityPipelineKafkaSourceType" required: - id - type - group_id - topics type: object x-pipeline-types: [logs] ObservabilityPipelineKafkaSourceType: default: kafka description: The source type. The value should always be `kafka`. enum: - kafka example: kafka type: string x-enum-varnames: - KAFKA ObservabilityPipelineLogstashSource: description: |- The `logstash` source ingests logs from a Logstash forwarder. **Supported pipeline types:** logs properties: address_key: description: Name of the environment variable or secret that holds the listen address for the Logstash receiver. example: LOGSTASH_ADDRESS type: string id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: logstash-source type: string tls: $ref: "#/components/schemas/ObservabilityPipelineMtlsServerTls" type: $ref: "#/components/schemas/ObservabilityPipelineLogstashSourceType" required: - id - type type: object x-pipeline-types: [logs] ObservabilityPipelineLogstashSourceType: default: logstash description: The source type. The value should always be `logstash`. enum: - logstash example: logstash type: string x-enum-varnames: - LOGSTASH ObservabilityPipelineMemoryBufferOptions: description: Options for configuring a memory buffer by byte size. properties: max_size: description: Maximum size of the memory buffer. example: 4096 format: int64 type: integer type: $ref: "#/components/schemas/ObservabilityPipelineBufferOptionsMemoryType" when_full: $ref: "#/components/schemas/ObservabilityPipelineBufferOptionsWhenFull" required: - max_size type: object ObservabilityPipelineMemoryBufferSizeOptions: description: Options for configuring a memory buffer by queue length. properties: max_events: description: Maximum events for the memory buffer. example: 500 format: int64 type: integer type: $ref: "#/components/schemas/ObservabilityPipelineBufferOptionsMemoryType" when_full: $ref: "#/components/schemas/ObservabilityPipelineBufferOptionsWhenFull" required: - max_events type: object ObservabilityPipelineMetadataEntry: description: A custom metadata entry. properties: name: description: The metadata key. example: environment type: string value: description: The metadata value. example: production type: string required: - name - value type: object ObservabilityPipelineMetricEnrichmentTableFile: description: Defines a static enrichment table loaded from a CSV file for metric enrichment. properties: encoding: $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableFileEncoding" key: $ref: "#/components/schemas/ObservabilityPipelineMetricEnrichmentTableFileKey" path: description: Path to the CSV file. example: /etc/enrichment/lookup.csv type: string required: - encoding - key - path type: object ObservabilityPipelineMetricEnrichmentTableFileKey: description: Defines how to map a metric lookup value to a CSV column during enrichment table lookups. properties: column: description: The CSV column name or index to match against the lookup value. example: service type: string source: $ref: "#/components/schemas/ObservabilityPipelineMetricEnrichmentTableLookupSource" required: - column - source type: object ObservabilityPipelineMetricEnrichmentTableFileProcessor: description: An `enrichment_table` processor that enriches metrics using a static CSV file. properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean file: $ref: "#/components/schemas/ObservabilityPipelineMetricEnrichmentTableFile" id: description: |- The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: enrichment-table-processor type: string include: description: A Datadog search query used to determine which metrics this processor targets. example: "*" type: string type: $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableProcessorType" required: - id - type - include - file - enabled type: object ObservabilityPipelineMetricEnrichmentTableLookupSource: description: |- Specifies the source of the key value used for metric enrichment table lookups. The lookup key can be either the metric name or a metric tag. oneOf: - $ref: "#/components/schemas/ObservabilityPipelineMetricEnrichmentTableMetricNameLookup" - $ref: "#/components/schemas/ObservabilityPipelineMetricEnrichmentTableTagLookup" ObservabilityPipelineMetricEnrichmentTableMetricNameLookup: description: Uses the metric name as the lookup key for enrichment table matching. properties: type: $ref: "#/components/schemas/ObservabilityPipelineMetricEnrichmentTableMetricNameLookupType" required: - type type: object ObservabilityPipelineMetricEnrichmentTableMetricNameLookupType: default: metric_name description: The lookup source type. The value should always be `metric_name`. enum: [metric_name] example: metric_name type: string x-enum-varnames: - METRIC_NAME ObservabilityPipelineMetricEnrichmentTableProcessor: description: |- The `enrichment_table` processor enriches metrics with tags from a static CSV file or a Datadog reference table. It looks up a row using the metric name or a metric tag value. It then adds each column of the matching row as a metric tag, overwriting any existing tag with the same key. Exactly one of `file` or `reference_table` must be configured. **Supported pipeline types:** metrics oneOf: - $ref: "#/components/schemas/ObservabilityPipelineMetricEnrichmentTableFileProcessor" - $ref: "#/components/schemas/ObservabilityPipelineMetricEnrichmentTableReferenceTableProcessor" x-pipeline-types: [metrics] ObservabilityPipelineMetricEnrichmentTableReferenceKey: description: Defines the metric lookup value used as the reference-table row ID. properties: source: $ref: "#/components/schemas/ObservabilityPipelineMetricEnrichmentTableLookupSource" required: - source type: object ObservabilityPipelineMetricEnrichmentTableReferenceTable: description: Uses a Datadog reference table to enrich metrics. properties: app_key_key: description: |- The name of the environment variable or secret that holds the Datadog application key used to access the reference table. example: DD_APP_KEY type: string columns: description: |- A list of column names to include from the reference table. If not provided, all columns are included. items: description: The name of a column to include from the reference table. type: string maxItems: 50 type: array key: $ref: "#/components/schemas/ObservabilityPipelineMetricEnrichmentTableReferenceKey" table_id: description: The unique identifier of the reference table. example: 550e8400-e29b-41d4-a716-446655440000 type: string required: - key - table_id type: object ObservabilityPipelineMetricEnrichmentTableReferenceTableProcessor: description: An `enrichment_table` processor that enriches metrics using a Datadog reference table. properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean id: description: |- The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: enrichment-table-processor type: string include: description: A Datadog search query used to determine which metrics this processor targets. example: "*" type: string reference_table: $ref: "#/components/schemas/ObservabilityPipelineMetricEnrichmentTableReferenceTable" type: $ref: "#/components/schemas/ObservabilityPipelineEnrichmentTableProcessorType" required: - id - type - include - reference_table - enabled type: object ObservabilityPipelineMetricEnrichmentTableTagLookup: description: Uses a metric tag as the lookup key for enrichment table matching. properties: name: description: The Datadog tag key used as the lookup key. example: service maxLength: 200 type: string type: $ref: "#/components/schemas/ObservabilityPipelineMetricEnrichmentTableTagLookupType" required: - type - name type: object ObservabilityPipelineMetricEnrichmentTableTagLookupType: default: tag description: The lookup source type. The value should always be `tag`. enum: [tag] example: tag type: string x-enum-varnames: - TAG ObservabilityPipelineMetricTagsProcessor: description: |- The `metric_tags` processor filters metrics based on their tags using Datadog tag key patterns. **Supported pipeline types:** metrics properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: metric-tags-processor type: string include: description: A Datadog search query that determines which metrics the processor targets. example: "*" type: string rules: description: A list of rules for filtering metric tags. items: $ref: "#/components/schemas/ObservabilityPipelineMetricTagsProcessorRule" maxItems: 100 minItems: 1 type: array type: $ref: "#/components/schemas/ObservabilityPipelineMetricTagsProcessorType" required: - id - type - include - rules - enabled type: object x-pipeline-types: [metrics] ObservabilityPipelineMetricTagsProcessorRule: description: Defines a rule for filtering metric tags based on key patterns. properties: action: $ref: "#/components/schemas/ObservabilityPipelineMetricTagsProcessorRuleAction" include: description: A Datadog search query used to determine which metrics this rule targets. example: "*" type: string keys: description: A list of tag keys to include or exclude. example: ["env", "service", "version"] items: description: A metric tag key to include or exclude based on the action. type: string type: array mode: $ref: "#/components/schemas/ObservabilityPipelineMetricTagsProcessorRuleMode" required: - include - mode - action - keys type: object ObservabilityPipelineMetricTagsProcessorRuleAction: description: The action to take on tags with matching keys. enum: [include, exclude] example: include type: string x-enum-varnames: - INCLUDE - EXCLUDE ObservabilityPipelineMetricTagsProcessorRuleMode: description: The processing mode for tag filtering. enum: [filter] example: filter type: string x-enum-varnames: - FILTER ObservabilityPipelineMetricTagsProcessorType: default: metric_tags description: The processor type. The value should always be `metric_tags`. enum: [metric_tags] example: metric_tags type: string x-enum-varnames: - METRIC_TAGS ObservabilityPipelineMetricValue: description: Specifies how the value of the generated metric is computed. oneOf: - $ref: "#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByOne" - $ref: "#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByField" ObservabilityPipelineMtlsServerTls: description: Configuration for enabling TLS encryption between the pipeline component and external connecting clients. properties: ca_file: description: Path to the Certificate Authority (CA) file used to validate connecting clients' TLS certificates. type: string crt_file: description: Path to the TLS server certificate file used to used to identify the pipeline component to connecting clients. example: "/path/to/cert.crt" type: string key_file: description: Path to the private key file associated with the TLS server certificate. type: string key_pass_key: description: Name of the environment variable or secret that holds the passphrase for the private key file. example: TLS_KEY_PASSPHRASE type: string verify_certificate: description: When `true`, requires client connections to present a valid certificate, enabling mutual TLS authentication. type: boolean required: - crt_file type: object ObservabilityPipelineNewRelicDestination: description: |- The `new_relic` destination sends logs to the New Relic platform. **Supported pipeline types:** logs properties: account_id_key: description: Name of the environment variable or secret that holds the New Relic account ID. example: NEW_RELIC_ACCOUNT_ID type: string buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" id: description: The unique identifier for this component. example: new-relic-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["parse-json-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array license_key_key: description: Name of the environment variable or secret that holds the New Relic license key. example: NEW_RELIC_LICENSE_KEY type: string region: $ref: "#/components/schemas/ObservabilityPipelineNewRelicDestinationRegion" type: $ref: "#/components/schemas/ObservabilityPipelineNewRelicDestinationType" required: - id - type - inputs - region type: object x-pipeline-types: [logs] ObservabilityPipelineNewRelicDestinationRegion: description: The New Relic region. enum: - us - eu example: us type: string x-enum-varnames: - US - EU ObservabilityPipelineNewRelicDestinationType: default: new_relic description: The destination type. The value should always be `new_relic`. enum: - new_relic example: new_relic type: string x-enum-varnames: - NEW_RELIC ObservabilityPipelineOcsfMapperProcessor: description: |- The `ocsf_mapper` processor transforms logs into the OCSF schema using a predefined mapping configuration. **Supported pipeline types:** logs properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline. example: ocsf-mapper-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string keep_unmatched: description: Whether to keep an event that does not match any of the mapping filters. example: false type: boolean mappings: description: A list of mapping rules to convert events to the OCSF format. items: $ref: "#/components/schemas/ObservabilityPipelineOcsfMapperProcessorMapping" type: array type: $ref: "#/components/schemas/ObservabilityPipelineOcsfMapperProcessorType" required: - id - type - include - mappings - enabled type: object x-pipeline-types: [logs] ObservabilityPipelineOcsfMapperProcessorMapping: description: Defines how specific events are transformed to OCSF using a mapping configuration. properties: include: description: A Datadog search query used to select the logs that this mapping should apply to. example: service:my-service type: string mapping: $ref: "#/components/schemas/ObservabilityPipelineOcsfMapperProcessorMappingMapping" required: - include - mapping type: object ObservabilityPipelineOcsfMapperProcessorMappingMapping: description: Defines a single mapping rule for transforming logs into the OCSF schema. example: CloudTrail Account Change oneOf: - $ref: "#/components/schemas/ObservabilityPipelineOcsfMappingLibrary" - $ref: "#/components/schemas/ObservabilityPipelineOcsfMappingCustom" ObservabilityPipelineOcsfMapperProcessorType: default: ocsf_mapper description: The processor type. The value should always be `ocsf_mapper`. enum: - ocsf_mapper example: ocsf_mapper type: string x-enum-varnames: - OCSF_MAPPER ObservabilityPipelineOcsfMappingCustom: description: Custom OCSF mapping configuration for transforming logs. properties: mapping: description: A list of field mapping rules for transforming log fields to OCSF schema fields. items: $ref: "#/components/schemas/ObservabilityPipelineOcsfMappingCustomFieldMapping" type: array metadata: $ref: "#/components/schemas/ObservabilityPipelineOcsfMappingCustomMetadata" version: description: The version of the custom mapping configuration. example: 1 format: int64 type: integer required: - mapping - metadata - version type: object ObservabilityPipelineOcsfMappingCustomFieldMapping: description: Defines a single field mapping rule for transforming a source field to an OCSF destination field. properties: default: description: The default value to use if the source field is missing or empty. example: "" dest: description: The destination OCSF field path. example: device.type type: string lookup: $ref: "#/components/schemas/ObservabilityPipelineOcsfMappingCustomLookup" source: description: The source field path from the log event. example: host.type sources: description: Multiple source field paths for combined mapping. example: - field1 - field2 value: description: A static value to use for the destination field. example: static_value required: - dest type: object ObservabilityPipelineOcsfMappingCustomLookup: description: Lookup table configuration for mapping source values to destination values. properties: default: description: The default value to use if no lookup match is found. example: unknown table: description: A list of lookup table entries for value transformation. items: $ref: "#/components/schemas/ObservabilityPipelineOcsfMappingCustomLookupTableEntry" type: array type: object ObservabilityPipelineOcsfMappingCustomLookupTableEntry: description: A single entry in a lookup table for value transformation. properties: contains: description: The substring to match in the source value. example: Desktop type: string equals: description: The exact value to match in the source. example: desktop equals_source: description: The source field to match against. example: device_type type: string matches: description: A regex pattern to match in the source value. example: "^Desktop.*" type: string not_matches: description: A regex pattern that must not match the source value. example: "^Mobile.*" type: string value: description: The value to use when a match is found. example: desktop type: object ObservabilityPipelineOcsfMappingCustomMetadata: description: Metadata for the custom OCSF mapping. properties: class: description: The OCSF event class name. example: Device Inventory Info type: string profiles: description: A list of OCSF profiles to apply. example: - container items: description: The name of an OCSF profile to apply to the event. type: string type: array version: description: The OCSF schema version. example: "1.3.0" type: string required: - class - version type: object ObservabilityPipelineOcsfMappingLibrary: description: Predefined library mappings for common log formats. enum: - CloudTrail Account Change - GCP Cloud Audit CreateBucket - GCP Cloud Audit CreateSink - GCP Cloud Audit SetIamPolicy - GCP Cloud Audit UpdateSink - Github Audit Log API Activity - Google Workspace Admin Audit addPrivilege - Microsoft 365 Defender Incident - Microsoft 365 Defender UserLoggedIn - Okta System Log Authentication - Palo Alto Networks Firewall Traffic example: CloudTrail Account Change type: string x-enum-varnames: - CLOUDTRAIL_ACCOUNT_CHANGE - GCP_CLOUD_AUDIT_CREATEBUCKET - GCP_CLOUD_AUDIT_CREATESINK - GCP_CLOUD_AUDIT_SETIAMPOLICY - GCP_CLOUD_AUDIT_UPDATESINK - GITHUB_AUDIT_LOG_API_ACTIVITY - GOOGLE_WORKSPACE_ADMIN_AUDIT_ADDPRIVILEGE - MICROSOFT_365_DEFENDER_INCIDENT - MICROSOFT_365_DEFENDER_USERLOGGEDIN - OKTA_SYSTEM_LOG_AUTHENTICATION - PALO_ALTO_NETWORKS_FIREWALL_TRAFFIC ObservabilityPipelineOpenSearchDestination: description: |- The `opensearch` destination writes logs to an OpenSearch cluster. **Supported pipeline types:** logs properties: auth: $ref: "#/components/schemas/ObservabilityPipelineElasticsearchDestinationAuth" buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" bulk_index: description: The index to write logs to. example: logs-index type: string data_stream: $ref: "#/components/schemas/ObservabilityPipelineOpenSearchDestinationDataStream" endpoint_url_key: description: Name of the environment variable or secret that holds the OpenSearch endpoint URL. example: OPENSEARCH_ENDPOINT_URL type: string id: description: The unique identifier for this component. example: "opensearch-destination" type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array type: $ref: "#/components/schemas/ObservabilityPipelineOpenSearchDestinationType" required: - id - type - inputs type: object x-pipeline-types: [logs] ObservabilityPipelineOpenSearchDestinationDataStream: description: Configuration options for writing to OpenSearch Data Streams instead of a fixed index. properties: dataset: description: The data stream dataset for your logs. This groups logs by their source or application. type: string dtype: description: The data stream type for your logs. This determines how logs are categorized within the data stream. type: string namespace: description: The data stream namespace for your logs. This separates logs into different environments or domains. type: string type: object ObservabilityPipelineOpenSearchDestinationType: default: opensearch description: The destination type. The value should always be `opensearch`. enum: - opensearch example: opensearch type: string x-enum-varnames: - OPENSEARCH ObservabilityPipelineOpentelemetryDestination: description: |- The `opentelemetry` destination forwards metrics or traces using the OpenTelemetry Protocol (OTLP) over HTTP. **Supported pipeline types:** metrics, traces properties: buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" http_client_uri_key: default: DESTINATION_OTEL_HTTP_CLIENT_URI description: Environment variable name containing the URI of the OTLP HTTP endpoint to send metrics or traces to. example: DESTINATION_OTEL_HTTP_CLIENT_URI type: string id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: opentelemetry-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["metrics-filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array tls: $ref: "#/components/schemas/ObservabilityPipelineTls" type: $ref: "#/components/schemas/ObservabilityPipelineOpentelemetryDestinationType" required: - id - type - inputs type: object x-pipeline-types: [metrics, traces] ObservabilityPipelineOpentelemetryDestinationType: default: opentelemetry description: The destination type. Always `opentelemetry`. enum: - opentelemetry example: opentelemetry type: string x-enum-varnames: - OPENTELEMETRY ObservabilityPipelineOpentelemetrySource: description: |- The `opentelemetry` source receives telemetry data using the OpenTelemetry Protocol (OTLP) over gRPC and HTTP. **Supported pipeline types:** logs, metrics, traces properties: grpc_address_key: description: Environment variable name containing the gRPC server address for receiving OTLP data. Must be a valid environment variable name (alphanumeric characters and underscores only). example: OTEL_GRPC_ADDRESS type: string http_address_key: description: Environment variable name containing the HTTP server address for receiving OTLP data. Must be a valid environment variable name (alphanumeric characters and underscores only). example: OTEL_HTTP_ADDRESS type: string id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: opentelemetry-source type: string tls: $ref: "#/components/schemas/ObservabilityPipelineMtlsServerTls" type: $ref: "#/components/schemas/ObservabilityPipelineOpentelemetrySourceType" required: - id - type type: object x-pipeline-types: [logs, metrics, traces] ObservabilityPipelineOpentelemetrySourceType: default: opentelemetry description: The source type. The value should always be `opentelemetry`. enum: [opentelemetry] example: opentelemetry type: string x-enum-varnames: - OPENTELEMETRY ObservabilityPipelineParseGrokProcessor: description: |- The `parse_grok` processor extracts structured fields from unstructured log messages using Grok patterns. **Supported pipeline types:** logs example: id: "parse-grok-processor" include: "service:my-service" type: "parse_grok" properties: disable_library_rules: default: false description: If set to `true`, disables the default Grok rules provided by Datadog. example: true type: boolean display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean field: default: "message" description: The log field to parse with the Grok rules. example: "message" type: string id: description: A unique identifier for this processor. example: "parse-grok-processor" type: string include: description: A Datadog search query used to determine which logs this processor targets. example: "service:my-service" type: string rules: description: The list of custom Grok parsing rules selected by either source field or include query. Omit to use only the Datadog library rules. items: $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorRuleItem" type: array type: $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorType" required: - id - type - include - enabled type: object x-pipeline-types: [logs] ObservabilityPipelineParseGrokProcessorIncludeRule: description: |- A Grok parsing rule selected using the `include` query. Each rule defines how to extract structured fields from logs matching a Datadog search query. properties: include: description: A Datadog search query used to determine which logs this Grok rule targets. example: "service:my-service" type: string match_rules: description: |- A list of Grok parsing rules that define how to extract fields from matching logs. Each rule must contain a name and a valid Grok pattern. example: - name: "MyParsingRule" rule: '%{word:user} connected on %{date("MM/dd/yyyy"):date}' items: $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorRuleMatchRule" type: array support_rules: description: A list of Grok helper rules that can be referenced by the parsing rules. example: - name: "user" rule: "%{word:user.name}" items: $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorRuleSupportRule" type: array required: - include - match_rules type: object ObservabilityPipelineParseGrokProcessorRule: description: |- A Grok parsing rule used in the `parse_grok` processor. Each rule defines how to extract structured fields from a specific log field using Grok patterns. properties: match_rules: description: |- A list of Grok parsing rules that define how to extract fields from the source field. Each rule must contain a name and a valid Grok pattern. example: - name: "MyParsingRule" rule: '%{word:user} connected on %{date("MM/dd/yyyy"):date}' items: $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorRuleMatchRule" type: array source: description: The value of the source field in log events to be processed by the Grok rules. example: "message" type: string support_rules: description: |- A list of Grok helper rules that can be referenced by the parsing rules. example: - name: "user" rule: "%{word:user.name}" items: $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorRuleSupportRule" type: array required: - source - match_rules type: object ObservabilityPipelineParseGrokProcessorRuleItem: description: A single Grok parsing rule, selected by either source field or include query. oneOf: - $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorRule" - $ref: "#/components/schemas/ObservabilityPipelineParseGrokProcessorIncludeRule" ObservabilityPipelineParseGrokProcessorRuleMatchRule: description: |- Defines a Grok parsing rule, which extracts structured fields from log content using named Grok patterns. Each rule must have a unique name and a valid Datadog Grok pattern that will be applied to the source field. properties: name: description: The name of the rule. example: "MyParsingRule" type: string rule: description: The definition of the Grok rule. example: '%{word:user} connected on %{date("MM/dd/yyyy"):date}' type: string required: - name - rule type: object ObservabilityPipelineParseGrokProcessorRuleSupportRule: description: The Grok helper rule referenced in the parsing rules. properties: name: description: The name of the Grok helper rule. example: "user" type: string rule: description: The definition of the Grok helper rule. example: " %{word:user.name}" type: string required: - name - rule type: object ObservabilityPipelineParseGrokProcessorType: default: parse_grok description: The processor type. The value should always be `parse_grok`. enum: [parse_grok] example: parse_grok type: string x-enum-varnames: - PARSE_GROK ObservabilityPipelineParseJSONProcessor: description: |- The `parse_json` processor extracts JSON from a specified field and flattens it into the event. This is useful when logs contain embedded JSON as a string. **Supported pipeline types:** logs properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean field: description: The name of the log field that contains a JSON string. example: "message" type: string id: description: A unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: "parse-json-processor" type: string include: description: A Datadog search query used to determine which logs this processor targets. example: "service:my-service" type: string type: $ref: "#/components/schemas/ObservabilityPipelineParseJSONProcessorType" required: - id - type - include - field - enabled type: object x-pipeline-types: [logs] ObservabilityPipelineParseJSONProcessorType: default: parse_json description: The processor type. The value should always be `parse_json`. enum: - parse_json example: parse_json type: string x-enum-varnames: - PARSE_JSON ObservabilityPipelineParseXMLProcessor: description: |- The `parse_xml` processor parses XML from a specified field and extracts it into the event. **Supported pipeline types:** logs properties: always_use_text_key: description: Whether to always use a text key for element content. type: boolean attr_prefix: description: The prefix to use for XML attributes in the parsed output. type: string display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean field: description: The name of the log field that contains an XML string. example: "message" type: string id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: parse-xml-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: "service:my-service" type: string include_attr: description: Whether to include XML attributes in the parsed output. type: boolean parse_bool: description: Whether to parse boolean values from strings. type: boolean parse_null: description: Whether to parse null values. type: boolean parse_number: description: Whether to parse numeric values from strings. type: boolean text_key: description: The key name to use for text content within XML elements. Must be at least 1 character if specified. minLength: 1 type: string type: $ref: "#/components/schemas/ObservabilityPipelineParseXMLProcessorType" required: - id - type - include - field - enabled type: object x-pipeline-types: [logs] ObservabilityPipelineParseXMLProcessorType: default: parse_xml description: The processor type. The value should always be `parse_xml`. enum: - parse_xml example: parse_xml type: string x-enum-varnames: - PARSE_XML ObservabilityPipelinePrometheusRemoteWriteDestination: description: |- The `prometheus_remote_write` destination forwards metrics to an endpoint that supports the Prometheus Remote Write protocol. **Supported pipeline types:** metrics properties: auth_strategy: $ref: "#/components/schemas/ObservabilityPipelinePrometheusRemoteWriteDestinationAuthStrategy" buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" default_namespace: description: The default namespace to add as a prefix to metric names that do not already have one. example: datadog type: string endpoint_url_key: description: |- Name of the environment variable or secret that holds the Prometheus Remote Write endpoint URL. Defaults to `DESTINATION_PROMETHEUS_REMOTE_WRITE_ENDPOINT_URL` (prefixed with `DD_OP_` at runtime). example: PROMETHEUS_REMOTE_WRITE_ENDPOINT_URL type: string id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: prometheus-remote-write-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["metrics-filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array password_key: description: Name of the environment variable or secret that holds the password (used when `auth_strategy` is `basic`). example: PROMETHEUS_REMOTE_WRITE_PASSWORD type: string tenant_id: description: The tenant ID to include with outgoing requests. Used by multi-tenant Prometheus Remote Write receivers. example: my-tenant type: string tls: $ref: "#/components/schemas/ObservabilityPipelineClientTls" token_key: description: Name of the environment variable or secret that holds the bearer token (used when `auth_strategy` is `bearer`). example: PROMETHEUS_REMOTE_WRITE_TOKEN type: string type: $ref: "#/components/schemas/ObservabilityPipelinePrometheusRemoteWriteDestinationType" username_key: description: Name of the environment variable or secret that holds the username (used when `auth_strategy` is `basic`). example: PROMETHEUS_REMOTE_WRITE_USERNAME type: string required: - id - type - inputs type: object x-pipeline-types: [metrics] ObservabilityPipelinePrometheusRemoteWriteDestinationAuthStrategy: description: The authentication strategy to use for outgoing Prometheus Remote Write requests. enum: - none - basic - bearer example: basic type: string x-enum-varnames: - NONE - BASIC - BEARER ObservabilityPipelinePrometheusRemoteWriteDestinationType: default: prometheus_remote_write description: The destination type. The value should always be `prometheus_remote_write`. enum: - prometheus_remote_write example: prometheus_remote_write type: string x-enum-varnames: - PROMETHEUS_REMOTE_WRITE ObservabilityPipelinePrometheusRemoteWriteSource: description: |- The `prometheus_remote_write` source ingests metrics pushed over the Prometheus Remote Write protocol. **Supported pipeline types:** metrics properties: address_key: description: Name of the environment variable or secret that holds the listen address for the Prometheus Remote Write endpoint. example: PROMETHEUS_REMOTE_WRITE_ADDRESS type: string auth_strategy: $ref: "#/components/schemas/ObservabilityPipelinePrometheusRemoteWriteSourceAuthStrategy" id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: prometheus-remote-write-source type: string password_key: description: Name of the environment variable or secret that holds the password (used when `auth_strategy` is `plain`). example: PROMETHEUS_REMOTE_WRITE_PASSWORD type: string path: description: The HTTP path on which the source listens for incoming Prometheus Remote Write requests. example: "/api/v1/write" type: string tls: $ref: "#/components/schemas/ObservabilityPipelineMtlsServerTls" type: $ref: "#/components/schemas/ObservabilityPipelinePrometheusRemoteWriteSourceType" username_key: description: Name of the environment variable or secret that holds the username (used when `auth_strategy` is `plain`). example: PROMETHEUS_REMOTE_WRITE_USERNAME type: string valid_tokens: description: |- A list of tokens that are accepted for authenticating incoming requests. When set, the source rejects any request whose token does not match an enabled entry in this list. items: $ref: "#/components/schemas/ObservabilityPipelinePrometheusRemoteWriteSourceValidToken" type: array required: - id - type - auth_strategy - path type: object x-pipeline-types: [metrics] ObservabilityPipelinePrometheusRemoteWriteSourceAuthStrategy: description: HTTP authentication method. enum: - none - plain example: plain type: string x-enum-varnames: - NONE - PLAIN ObservabilityPipelinePrometheusRemoteWriteSourceType: default: prometheus_remote_write description: The source type. The value should always be `prometheus_remote_write`. enum: [prometheus_remote_write] example: prometheus_remote_write type: string x-enum-varnames: - PROMETHEUS_REMOTE_WRITE ObservabilityPipelinePrometheusRemoteWriteSourceValidToken: description: An accepted token used to authenticate incoming Prometheus Remote Write requests. properties: enabled: default: true description: |- Indicates whether this token is currently accepted. Disabled tokens are rejected without being removed from the configuration. example: true type: boolean path_to_token: $ref: "#/components/schemas/ObservabilityPipelineHttpServerSourceValidTokenPathToToken" token_key: description: Name of the environment variable or secret that holds the expected token value. example: PROMETHEUS_REMOTE_WRITE_TOKEN pattern: "^[A-Za-z0-9_]+$" type: string required: - token_key type: object ObservabilityPipelineQuotaProcessor: description: |- The `quota` processor measures logging traffic for logs that match a specified filter. When the configured daily quota is met, the processor can drop or alert. **Supported pipeline types:** logs properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" drop_events: description: |- If set to `true`, logs that match the quota filter and are sent after the quota is exceeded are dropped. Logs that do not match the filter continue through the pipeline. **Note**: You can set either `drop_events` or `overflow_action`, but not both. example: false type: boolean enabled: description: Indicates whether the processor is enabled. example: true type: boolean id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: "quota-processor" type: string ignore_when_missing_partitions: description: If `true`, the processor skips quota checks when partition fields are missing from the logs. type: boolean include: description: A Datadog search query used to determine which logs this processor targets. example: "service:my-service" type: string limit: $ref: "#/components/schemas/ObservabilityPipelineQuotaProcessorLimit" name: description: Name of the quota. example: MyQuota type: string overflow_action: $ref: "#/components/schemas/ObservabilityPipelineQuotaProcessorOverflowAction" overrides: description: A list of alternate quota rules that apply to specific sets of events, identified by matching field values. Each override can define a custom limit. items: $ref: "#/components/schemas/ObservabilityPipelineQuotaProcessorOverride" type: array partition_fields: description: A list of fields used to segment log traffic for quota enforcement. Quotas are tracked independently by unique combinations of these field values. items: description: The name of a log field used to partition quota enforcement. type: string type: array too_many_buckets_action: $ref: "#/components/schemas/ObservabilityPipelineQuotaProcessorOverflowAction" type: $ref: "#/components/schemas/ObservabilityPipelineQuotaProcessorType" required: - id - type - include - name - limit - enabled type: object x-pipeline-types: [logs] ObservabilityPipelineQuotaProcessorLimit: description: The maximum amount of data or number of events allowed before the quota is enforced. Can be specified in bytes or events. properties: enforce: $ref: "#/components/schemas/ObservabilityPipelineQuotaProcessorLimitEnforceType" limit: description: The limit for quota enforcement. example: 1000 format: int64 type: integer required: - enforce - limit type: object ObservabilityPipelineQuotaProcessorLimitEnforceType: description: Unit for quota enforcement in bytes for data size or events for count. enum: - bytes - events example: bytes type: string x-enum-varnames: - BYTES - EVENTS ObservabilityPipelineQuotaProcessorOverflowAction: description: |- The action to take when the quota or bucket limit is exceeded. Options: - `drop`: Drop the event. - `no_action`: Let the event pass through. - `overflow_routing`: Route to an overflow destination. When `overflow_routing` is used, there must be a destination whose `inputs` reference this processor with the `.overflow_events` suffix to route the overflowing events. Only the following destination types support overflow inputs: `amazon_s3_generic`, `amazon_s3`, `google_cloud_storage`, and `azure_storage`. enum: - drop - no_action - overflow_routing example: drop type: string x-enum-varnames: - DROP - NO_ACTION - OVERFLOW_ROUTING ObservabilityPipelineQuotaProcessorOverride: description: Defines a custom quota limit that applies to specific log events based on matching field values. properties: fields: description: A list of field matchers used to apply a specific override. If an event matches all listed key-value pairs, the corresponding override limit is enforced. items: $ref: "#/components/schemas/ObservabilityPipelineFieldValue" type: array limit: $ref: "#/components/schemas/ObservabilityPipelineQuotaProcessorLimit" required: - fields - limit type: object ObservabilityPipelineQuotaProcessorType: default: quota description: The processor type. The value should always be `quota`. enum: - quota example: quota type: string x-enum-varnames: - QUOTA ObservabilityPipelineReduceProcessor: description: |- The `reduce` processor aggregates and merges logs based on matching keys and merge strategies. **Supported pipeline types:** logs properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean group_by: description: A list of fields used to group log events for merging. example: ["log.user.id", "log.device.id"] items: description: A log field path used to group events for aggregation. type: string type: array id: description: The unique identifier for this processor. example: reduce-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: env:prod type: string merge_strategies: description: List of merge strategies defining how values from grouped events should be combined. items: $ref: "#/components/schemas/ObservabilityPipelineReduceProcessorMergeStrategy" type: array type: $ref: "#/components/schemas/ObservabilityPipelineReduceProcessorType" required: - id - type - include - group_by - merge_strategies - enabled type: object x-pipeline-types: [logs] ObservabilityPipelineReduceProcessorMergeStrategy: description: Defines how a specific field should be merged across grouped events. properties: path: description: The field path in the log event. example: log.user.roles type: string strategy: $ref: "#/components/schemas/ObservabilityPipelineReduceProcessorMergeStrategyStrategy" required: - path - strategy type: object ObservabilityPipelineReduceProcessorMergeStrategyStrategy: description: The merge strategy to apply. enum: - discard - retain - sum - max - min - array - concat - concat_newline - concat_raw - shortest_array - longest_array - flat_unique example: flat_unique type: string x-enum-varnames: - DISCARD - RETAIN - SUM - MAX - MIN - ARRAY - CONCAT - CONCAT_NEWLINE - CONCAT_RAW - SHORTEST_ARRAY - LONGEST_ARRAY - FLAT_UNIQUE ObservabilityPipelineReduceProcessorType: default: reduce description: The processor type. The value should always be `reduce`. enum: - reduce example: reduce type: string x-enum-varnames: - REDUCE ObservabilityPipelineRemoveFieldsProcessor: description: |- The `remove_fields` processor deletes specified fields from logs. **Supported pipeline types:** logs properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean fields: description: A list of field names to be removed from each log event. example: ["field1", "field2"] items: description: The name of a field to remove from the log event. type: string type: array id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: "remove-fields-processor" type: string include: description: A Datadog search query used to determine which logs this processor targets. example: "service:my-service" type: string type: $ref: "#/components/schemas/ObservabilityPipelineRemoveFieldsProcessorType" required: - id - type - include - fields - enabled type: object x-pipeline-types: [logs] ObservabilityPipelineRemoveFieldsProcessorType: default: remove_fields description: The processor type. The value should always be `remove_fields`. enum: - remove_fields example: remove_fields type: string x-enum-varnames: - REMOVE_FIELDS ObservabilityPipelineRenameFieldsProcessor: description: |- The `rename_fields` processor changes field names. **Supported pipeline types:** logs properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean fields: description: A list of rename rules specifying which fields to rename in the event, what to rename them to, and whether to preserve the original fields. items: $ref: "#/components/schemas/ObservabilityPipelineRenameFieldsProcessorField" type: array id: description: A unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: "rename-fields-processor" type: string include: description: A Datadog search query used to determine which logs this processor targets. example: "service:my-service" type: string type: $ref: "#/components/schemas/ObservabilityPipelineRenameFieldsProcessorType" required: - id - type - include - fields - enabled type: object x-pipeline-types: [logs] ObservabilityPipelineRenameFieldsProcessorField: description: Defines how to rename a field in log events. properties: destination: description: The field name to assign the renamed value to. example: "destination_field" type: string preserve_source: description: Indicates whether the original field, that is received from the source, should be kept (`true`) or removed (`false`) after renaming. example: false type: boolean source: description: The original field name in the log event that should be renamed. example: "source_field" type: string required: - source - destination - preserve_source type: object ObservabilityPipelineRenameFieldsProcessorType: default: rename_fields description: The processor type. The value should always be `rename_fields`. enum: - rename_fields example: rename_fields type: string x-enum-varnames: - RENAME_FIELDS ObservabilityPipelineRenameMetricTagsProcessor: description: |- The `rename_metric_tags` processor changes the keys of tags on metrics. **Supported pipeline types:** metrics properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: "rename-metric-tags-processor" type: string include: description: A Datadog search query used to determine which metrics this processor targets. example: "*" type: string tags: description: A list of rename rules specifying which tag keys to rename on each metric. items: $ref: "#/components/schemas/ObservabilityPipelineRenameMetricTagsProcessorTag" maxItems: 15 type: array type: $ref: "#/components/schemas/ObservabilityPipelineRenameMetricTagsProcessorType" required: - id - type - include - tags - enabled type: object x-pipeline-types: [metrics] ObservabilityPipelineRenameMetricTagsProcessorTag: description: Defines how to rename a tag on metric events. properties: rename_to: description: The new tag key to assign in place of the original. example: "destination_tag" type: string tag: description: The original tag key on the metric event. example: "source_tag" type: string required: - tag - rename_to type: object ObservabilityPipelineRenameMetricTagsProcessorType: default: rename_metric_tags description: The processor type. The value must be `rename_metric_tags`. enum: [rename_metric_tags] example: rename_metric_tags type: string x-enum-varnames: - RENAME_METRIC_TAGS ObservabilityPipelineRsyslogDestination: description: |- The `rsyslog` destination forwards logs to an external `rsyslog` server over TCP or UDP using the syslog protocol. **Supported pipeline types:** logs properties: buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" endpoint_url_key: description: Name of the environment variable or secret that holds the syslog server endpoint URL. example: SYSLOG_ENDPOINT_URL type: string id: description: The unique identifier for this component. example: "rsyslog-destination" type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array keepalive: description: Optional socket keepalive duration in milliseconds. example: 60000 format: int64 minimum: 0 type: integer tls: $ref: "#/components/schemas/ObservabilityPipelineTls" type: $ref: "#/components/schemas/ObservabilityPipelineRsyslogDestinationType" required: - id - type - inputs type: object x-pipeline-types: [logs] ObservabilityPipelineRsyslogDestinationType: default: rsyslog description: The destination type. The value should always be `rsyslog`. enum: [rsyslog] example: rsyslog type: string x-enum-varnames: - RSYSLOG ObservabilityPipelineRsyslogSource: description: |- The `rsyslog` source listens for logs over TCP or UDP from an `rsyslog` server using the syslog protocol. **Supported pipeline types:** logs properties: address_key: description: Name of the environment variable or secret that holds the listen address for the syslog receiver. example: SYSLOG_ADDRESS type: string id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: "rsyslog-source" type: string mode: $ref: "#/components/schemas/ObservabilityPipelineSyslogSourceMode" tls: $ref: "#/components/schemas/ObservabilityPipelineMtlsServerTls" type: $ref: "#/components/schemas/ObservabilityPipelineRsyslogSourceType" required: - id - type - mode type: object x-pipeline-types: [logs] ObservabilityPipelineRsyslogSourceType: default: rsyslog description: The source type. The value should always be `rsyslog`. enum: [rsyslog] example: rsyslog type: string x-enum-varnames: - RSYSLOG ObservabilityPipelineSampleProcessor: description: |- The `sample` processor allows probabilistic sampling of logs or traces at a fixed rate. **Supported pipeline types:** logs, traces properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean group_by: description: Optional list of fields to group events by. Each group is sampled independently. example: ["service", "host"] items: description: A field name used to group events for independent sampling. type: string minItems: 1 type: array id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: "sample-processor" type: string include: description: A Datadog search query used to determine which events this processor targets. example: "service:my-service" type: string percentage: description: The percentage of events to sample. example: 10.0 format: double type: number type: $ref: "#/components/schemas/ObservabilityPipelineSampleProcessorType" required: - id - type - include - percentage - enabled type: object x-pipeline-types: [logs, traces] ObservabilityPipelineSampleProcessorType: default: sample description: The processor type. The value should always be `sample`. enum: [sample] example: sample type: string x-enum-varnames: - SAMPLE ObservabilityPipelineSensitiveDataScannerProcessor: description: |- The `sensitive_data_scanner` processor detects and optionally redacts sensitive data in log or trace events. **Supported pipeline types:** logs, traces properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: "sensitive-scanner" type: string include: description: A Datadog search query used to determine which events this processor targets. example: "source:prod" type: string rules: description: A list of rules for identifying and acting on sensitive data patterns. items: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorRule" type: array type: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorType" required: - id - type - include - rules - enabled type: object x-pipeline-types: [logs, traces] ObservabilityPipelineSensitiveDataScannerProcessorAction: description: Defines what action to take when sensitive data is matched. oneOf: - $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionRedact" - $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionHash" - $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedact" ObservabilityPipelineSensitiveDataScannerProcessorActionHash: description: Configuration for hashing matched sensitive values. properties: action: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionHashAction" options: description: |- Optional settings for the hash action. When omitted or empty, matched sensitive data is replaced with a deterministic hashed value that preserves structure for analytics while protecting the original content. Reserved for future hash configuration (for example, algorithm or salt). type: object required: [action] type: object ObservabilityPipelineSensitiveDataScannerProcessorActionHashAction: description: Action type that replaces the matched sensitive data with a hashed representation, preserving structure while securing content. enum: [hash] example: hash type: string x-enum-varnames: - HASH ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedact: description: Configuration for partially redacting matched sensitive data. properties: action: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactAction" options: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptions" required: [action, options] type: object ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactAction: description: Action type that redacts part of the sensitive data while preserving a configurable number of characters, typically used for masking purposes (e.g., show last 4 digits of a credit card). enum: [partial_redact] example: partial_redact type: string x-enum-varnames: - PARTIAL_REDACT ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptions: description: Controls how partial redaction is applied, including character count and direction. properties: characters: description: Number of characters to leave visible from the start or end of the matched value; the rest are redacted. example: 4 format: int64 type: integer direction: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptionsDirection" required: [characters, direction] type: object ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptionsDirection: description: Indicates whether to redact characters from the first or last part of the matched value. enum: [first, last] example: last type: string x-enum-varnames: - FIRST - LAST ObservabilityPipelineSensitiveDataScannerProcessorActionRedact: description: Configuration for completely redacting matched sensitive data. properties: action: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionRedactAction" options: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionRedactOptions" required: [action, options] type: object ObservabilityPipelineSensitiveDataScannerProcessorActionRedactAction: description: Action type that completely replaces the matched sensitive data with a fixed replacement string to remove all visibility. enum: [redact] example: redact type: string x-enum-varnames: - REDACT ObservabilityPipelineSensitiveDataScannerProcessorActionRedactOptions: description: Configuration for fully redacting sensitive data. properties: replace: description: The string used to replace matched sensitive data (for example, "***" or "[REDACTED]"). example: "***" type: string required: [replace] type: object ObservabilityPipelineSensitiveDataScannerProcessorCustomPattern: description: Defines a custom regex-based pattern for identifying sensitive data in logs. properties: options: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternOptions" type: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternType" required: [type, options] type: object ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternOptions: description: Options for defining a custom regex pattern. properties: description: description: Human-readable description providing context about a sensitive data scanner rule example: Custom regex for internal API keys type: string rule: description: A regular expression used to detect sensitive values. Must be a valid regex. example: "\\b\\d{16}\\b" type: string required: [rule] type: object ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternType: description: Indicates a custom regular expression is used for matching. enum: [custom] example: custom type: string x-enum-varnames: - CUSTOM ObservabilityPipelineSensitiveDataScannerProcessorKeywordOptions: description: Configuration for keywords used to reinforce sensitive data pattern detection. properties: keywords: description: A list of keywords to match near the sensitive pattern. example: ["ssn", "card", "account"] items: description: A keyword string that reinforces detection when found near the sensitive pattern. type: string type: array proximity: description: Maximum number of tokens between a keyword and a sensitive value match. example: 5 format: int64 type: integer required: [keywords, proximity] type: object ObservabilityPipelineSensitiveDataScannerProcessorLibraryPattern: description: Specifies a pattern from Datadog’s sensitive data detection library to match known sensitive data types. properties: options: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternOptions" type: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternType" required: [type, options] type: object ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternOptions: description: Options for selecting a predefined library pattern and enabling keyword support. properties: description: description: Human-readable description providing context about a sensitive data scanner rule example: Credit card pattern type: string id: description: Identifier for a predefined pattern from the sensitive data scanner pattern library. example: credit_card type: string use_recommended_keywords: description: Whether to augment the pattern with recommended keywords (optional). type: boolean required: [id] type: object ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternType: description: Indicates that a predefined library pattern is used. enum: [library] example: library type: string x-enum-varnames: - LIBRARY ObservabilityPipelineSensitiveDataScannerProcessorPattern: description: Pattern detection configuration for identifying sensitive data using either a custom regex or a library reference. oneOf: - $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPattern" - $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorLibraryPattern" ObservabilityPipelineSensitiveDataScannerProcessorRule: description: Defines a rule for detecting sensitive data, including matching pattern, scope, and the action to take. properties: keyword_options: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorKeywordOptions" name: description: A name identifying the rule. example: "Redact Credit Card Numbers" type: string on_match: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorAction" pattern: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorPattern" scope: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScope" tags: description: Tags assigned to this rule for filtering and classification. example: ["pii", "ccn"] items: description: A tag string used to classify and filter this sensitive data rule. type: string type: array required: - name - pattern - scope - on_match type: object ObservabilityPipelineSensitiveDataScannerProcessorScope: description: Determines which parts of the log the pattern-matching rule should be applied to. oneOf: - $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeInclude" - $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeExclude" - $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeAll" ObservabilityPipelineSensitiveDataScannerProcessorScopeAll: description: Applies scanning across all available fields. properties: target: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeAllTarget" required: [target] type: object ObservabilityPipelineSensitiveDataScannerProcessorScopeAllTarget: description: Applies the rule to all fields. enum: [all] example: all type: string x-enum-varnames: - ALL ObservabilityPipelineSensitiveDataScannerProcessorScopeExclude: description: Excludes specific fields from sensitive data scanning. properties: options: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions" target: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeExcludeTarget" required: [target, options] type: object ObservabilityPipelineSensitiveDataScannerProcessorScopeExcludeTarget: description: Excludes specific fields from processing. enum: [exclude] example: exclude type: string x-enum-varnames: - EXCLUDE ObservabilityPipelineSensitiveDataScannerProcessorScopeInclude: description: Includes only specific fields for sensitive data scanning. properties: options: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions" target: $ref: "#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeIncludeTarget" required: [target, options] type: object ObservabilityPipelineSensitiveDataScannerProcessorScopeIncludeTarget: description: Applies the rule only to included fields. enum: [include] example: include type: string x-enum-varnames: - INCLUDE ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions: description: Fields to which the scope rule applies. properties: fields: description: List of log attribute names (field paths) to which the scope applies. Only these fields are included in or excluded from pattern matching. example: - "" items: description: A log field path to include or exclude from sensitive data scanning. type: string type: array required: [fields] type: object ObservabilityPipelineSensitiveDataScannerProcessorType: default: sensitive_data_scanner description: The processor type. The value should always be `sensitive_data_scanner`. enum: [sensitive_data_scanner] example: sensitive_data_scanner type: string x-enum-varnames: - SENSITIVE_DATA_SCANNER ObservabilityPipelineSentinelOneDestination: description: |- The `sentinel_one` destination sends logs to SentinelOne. **Supported pipeline types:** logs properties: buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" id: description: The unique identifier for this component. example: sentinelone-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array region: $ref: "#/components/schemas/ObservabilityPipelineSentinelOneDestinationRegion" token_key: description: Name of the environment variable or secret that holds the SentinelOne API token. example: SENTINELONE_TOKEN type: string type: $ref: "#/components/schemas/ObservabilityPipelineSentinelOneDestinationType" required: - id - type - inputs - region type: object x-pipeline-types: [logs] ObservabilityPipelineSentinelOneDestinationRegion: description: The SentinelOne region to send logs to. enum: - us - eu - ca - data_set_us example: us type: string x-enum-varnames: - US - EU - CA - DATA_SET_US ObservabilityPipelineSentinelOneDestinationType: default: sentinel_one description: The destination type. The value should always be `sentinel_one`. enum: - sentinel_one example: sentinel_one type: string x-enum-varnames: - SENTINEL_ONE ObservabilityPipelineSocketDestination: description: |- The `socket` destination sends logs over TCP or UDP to a remote server. **Supported pipeline types:** logs properties: address_key: description: Name of the environment variable or secret that holds the socket address (host:port). example: SOCKET_ADDRESS type: string buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" encoding: $ref: "#/components/schemas/ObservabilityPipelineSocketDestinationEncoding" framing: $ref: "#/components/schemas/ObservabilityPipelineSocketDestinationFraming" id: description: The unique identifier for this component. example: socket-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array mode: $ref: "#/components/schemas/ObservabilityPipelineSocketDestinationMode" tls: $ref: "#/components/schemas/ObservabilityPipelineClientTls" description: TLS configuration. Relevant only when `mode` is `tcp`. type: $ref: "#/components/schemas/ObservabilityPipelineSocketDestinationType" required: - id - type - inputs - encoding - framing - mode type: object x-pipeline-types: [logs] ObservabilityPipelineSocketDestinationEncoding: description: Encoding format for log events. enum: [json, raw_message] example: json type: string x-enum-varnames: - JSON - RAW_MESSAGE ObservabilityPipelineSocketDestinationFraming: description: Framing method configuration. oneOf: - $ref: "#/components/schemas/ObservabilityPipelineSocketDestinationFramingNewlineDelimited" - $ref: "#/components/schemas/ObservabilityPipelineSocketDestinationFramingBytes" - $ref: "#/components/schemas/ObservabilityPipelineSocketDestinationFramingCharacterDelimited" ObservabilityPipelineSocketDestinationFramingBytes: description: Event data is not delimited at all. properties: method: $ref: "#/components/schemas/ObservabilityPipelineSocketDestinationFramingBytesMethod" required: [method] type: object ObservabilityPipelineSocketDestinationFramingBytesMethod: description: The definition of `ObservabilityPipelineSocketDestinationFramingBytesMethod` object. enum: [bytes] example: bytes type: string x-enum-varnames: - BYTES ObservabilityPipelineSocketDestinationFramingCharacterDelimited: description: Each log event is separated using the specified delimiter character. properties: delimiter: description: A single ASCII character used as a delimiter. example: "|" maxLength: 1 minLength: 1 type: string method: $ref: "#/components/schemas/ObservabilityPipelineSocketDestinationFramingCharacterDelimitedMethod" required: [method, delimiter] type: object ObservabilityPipelineSocketDestinationFramingCharacterDelimitedMethod: description: The definition of `ObservabilityPipelineSocketDestinationFramingCharacterDelimitedMethod` object. enum: [character_delimited] example: character_delimited type: string x-enum-varnames: - CHARACTER_DELIMITED ObservabilityPipelineSocketDestinationFramingNewlineDelimited: description: Each log event is delimited by a newline character. properties: method: $ref: "#/components/schemas/ObservabilityPipelineSocketDestinationFramingNewlineDelimitedMethod" required: [method] type: object ObservabilityPipelineSocketDestinationFramingNewlineDelimitedMethod: description: The definition of `ObservabilityPipelineSocketDestinationFramingNewlineDelimitedMethod` object. enum: [newline_delimited] example: newline_delimited type: string x-enum-varnames: - NEWLINE_DELIMITED ObservabilityPipelineSocketDestinationMode: description: Protocol used to send logs. enum: [tcp, udp] example: tcp type: string x-enum-varnames: - TCP - UDP ObservabilityPipelineSocketDestinationType: default: socket description: The destination type. The value should always be `socket`. enum: [socket] example: socket type: string x-enum-varnames: - SOCKET ObservabilityPipelineSocketSource: description: |- The `socket` source ingests logs over TCP or UDP. **Supported pipeline types:** logs properties: address_key: description: Name of the environment variable or secret that holds the listen address for the socket. example: SOCKET_ADDRESS type: string framing: $ref: "#/components/schemas/ObservabilityPipelineSocketSourceFraming" id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: socket-source type: string mode: $ref: "#/components/schemas/ObservabilityPipelineSocketSourceMode" tls: $ref: "#/components/schemas/ObservabilityPipelineMtlsServerTls" description: TLS configuration. Relevant only when `mode` is `tcp`. type: $ref: "#/components/schemas/ObservabilityPipelineSocketSourceType" required: - id - type - mode - framing type: object x-pipeline-types: [logs] ObservabilityPipelineSocketSourceFraming: description: Framing method configuration for the socket source. oneOf: - $ref: "#/components/schemas/ObservabilityPipelineSocketSourceFramingNewlineDelimited" - $ref: "#/components/schemas/ObservabilityPipelineSocketSourceFramingBytes" - $ref: "#/components/schemas/ObservabilityPipelineSocketSourceFramingCharacterDelimited" - $ref: "#/components/schemas/ObservabilityPipelineSocketSourceFramingOctetCounting" - $ref: "#/components/schemas/ObservabilityPipelineSocketSourceFramingChunkedGelf" ObservabilityPipelineSocketSourceFramingBytes: description: Byte frames are passed through as-is according to the underlying I/O boundaries (for example, split between messages or stream segments). properties: method: $ref: "#/components/schemas/ObservabilityPipelineSocketSourceFramingBytesMethod" required: [method] type: object ObservabilityPipelineSocketSourceFramingBytesMethod: description: Byte frames are passed through as-is according to the underlying I/O boundaries (for example, split between messages or stream segments). enum: [bytes] example: bytes type: string x-enum-varnames: - BYTES ObservabilityPipelineSocketSourceFramingCharacterDelimited: description: Byte frames which are delimited by a chosen character. properties: delimiter: description: A single ASCII character used to delimit events. example: "|" maxLength: 1 minLength: 1 type: string method: $ref: "#/components/schemas/ObservabilityPipelineSocketSourceFramingCharacterDelimitedMethod" required: [method, delimiter] type: object ObservabilityPipelineSocketSourceFramingCharacterDelimitedMethod: description: Byte frames which are delimited by a chosen character. enum: [character_delimited] example: character_delimited type: string x-enum-varnames: - CHARACTER_DELIMITED ObservabilityPipelineSocketSourceFramingChunkedGelf: description: Byte frames which are chunked GELF messages. properties: method: $ref: "#/components/schemas/ObservabilityPipelineSocketSourceFramingChunkedGelfMethod" required: [method] type: object ObservabilityPipelineSocketSourceFramingChunkedGelfMethod: description: Byte frames which are chunked GELF messages. enum: [chunked_gelf] example: chunked_gelf type: string x-enum-varnames: - CHUNKED_GELF ObservabilityPipelineSocketSourceFramingNewlineDelimited: description: Byte frames which are delimited by a newline character. properties: method: $ref: "#/components/schemas/ObservabilityPipelineSocketSourceFramingNewlineDelimitedMethod" required: [method] type: object ObservabilityPipelineSocketSourceFramingNewlineDelimitedMethod: description: Byte frames which are delimited by a newline character. enum: [newline_delimited] example: newline_delimited type: string x-enum-varnames: - NEWLINE_DELIMITED ObservabilityPipelineSocketSourceFramingOctetCounting: description: Byte frames according to the octet counting format as per RFC6587. properties: method: $ref: "#/components/schemas/ObservabilityPipelineSocketSourceFramingOctetCountingMethod" required: [method] type: object ObservabilityPipelineSocketSourceFramingOctetCountingMethod: description: Byte frames according to the octet counting format as per RFC6587. enum: [octet_counting] example: octet_counting type: string x-enum-varnames: - OCTET_COUNTING ObservabilityPipelineSocketSourceMode: description: Protocol used to receive logs. enum: [tcp, udp] example: tcp type: string x-enum-varnames: - TCP - UDP ObservabilityPipelineSocketSourceType: default: socket description: The source type. The value should always be `socket`. enum: [socket] example: socket type: string x-enum-varnames: - SOCKET ObservabilityPipelineSourceValidTokenFieldToAdd: description: |- An optional metadata field that is attached to every event authenticated by the associated token. Both `key` and `value` must match `^[A-Za-z0-9_]+$`. properties: key: description: The metadata field name to add to incoming events. example: token_name maxLength: 256 pattern: "^[A-Za-z0-9_]+$" type: string value: description: The metadata field value to add to incoming events. example: my_token maxLength: 1024 pattern: "^[A-Za-z0-9_]+$" type: string required: - key - value type: object ObservabilityPipelineSpec: description: Input schema representing an observability pipeline configuration. Used in create and validate requests. properties: data: $ref: "#/components/schemas/ObservabilityPipelineSpecData" required: - data type: object ObservabilityPipelineSpecData: description: Contains the the pipeline configuration. properties: attributes: $ref: "#/components/schemas/ObservabilityPipelineDataAttributes" type: default: pipelines description: The resource type identifier. For pipeline resources, this should always be set to `pipelines`. example: pipelines type: string required: - type - attributes type: object ObservabilityPipelineSpikeProtectionProcessor: description: |- The `spike_protection` processor learns the normal ingestion volume for the logs that match a specified filter and takes action when the volume spikes unexpectedly. **Supported pipeline types:** logs properties: action_when_missing_partitions: $ref: "#/components/schemas/ObservabilityPipelineSpikeProtectionProcessorActionWhenMissingPartitions" display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: "spike-protection-processor" type: string include: description: A Datadog search query used to determine which logs this processor targets. example: "service:my-service" type: string minimal_threshold: description: The minimum volume, in bytes, that must be observed within 24 hours before spike protection can activate. Defaults to 100 GiB. example: 107374182400 format: int64 type: integer minimal_threshold_overrides: description: A list of per-partition overrides for the minimal threshold, identified by matching field values. Requires `partition_fields` to be set. items: $ref: "#/components/schemas/ObservabilityPipelineSpikeProtectionProcessorThresholdOverride" type: array name: description: Name of the spike protection rule. example: MySpikeProtection type: string partition_fields: description: A list of fields used to segment log traffic. Volume is learned and evaluated independently for each unique combination of these field values. A maximum of five fields is supported. items: description: The name of a log field used to partition spike detection. maxLength: 128 type: string maxItems: 5 type: array uniqueItems: true spike_action: $ref: "#/components/schemas/ObservabilityPipelineSpikeProtectionProcessorSpikeAction" spike_threshold: description: The number of standard deviations above the learned mean volume that must be exceeded before a spike is detected. Defaults to `5`. example: 5 format: double type: number type: $ref: "#/components/schemas/ObservabilityPipelineSpikeProtectionProcessorType" required: - id - type - include - name - spike_action - enabled type: object x-pipeline-types: [logs] ObservabilityPipelineSpikeProtectionProcessorActionWhenMissingPartitions: default: ignore description: |- How to handle logs that are missing one of the `partition_fields`. Options: - `ignore`: Forward the event without applying spike protection. - `default_bucket`: Assign the event to a default partition. enum: - ignore - default_bucket example: ignore type: string x-enum-varnames: - IGNORE - DEFAULT_BUCKET ObservabilityPipelineSpikeProtectionProcessorMinimalThreshold: description: The minimal threshold to apply to the matching partition. oneOf: - $ref: "#/components/schemas/ObservabilityPipelineSpikeProtectionProcessorMinimalThresholdBytes" - $ref: "#/components/schemas/ObservabilityPipelineSpikeProtectionProcessorMinimalThresholdAlwaysKeep" ObservabilityPipelineSpikeProtectionProcessorMinimalThresholdAlwaysKeep: description: Never activates spike protection for the matching partition, regardless of volume. properties: type: $ref: "#/components/schemas/ObservabilityPipelineSpikeProtectionProcessorMinimalThresholdAlwaysKeepType" required: - type type: object ObservabilityPipelineSpikeProtectionProcessorMinimalThresholdAlwaysKeepType: default: always_keep description: The minimal threshold type. The value should always be `always_keep`. enum: - always_keep example: always_keep type: string x-enum-varnames: - ALWAYS_KEEP ObservabilityPipelineSpikeProtectionProcessorMinimalThresholdBytes: description: Sets a specific byte threshold for the matching partition. properties: bytes: description: The minimal threshold, in bytes, for the matching partition. example: 107374182400 format: int64 type: integer type: $ref: "#/components/schemas/ObservabilityPipelineSpikeProtectionProcessorMinimalThresholdBytesType" required: - type - bytes type: object ObservabilityPipelineSpikeProtectionProcessorMinimalThresholdBytesType: default: threshold description: The minimal threshold type. The value should always be `threshold`. enum: - threshold example: threshold type: string x-enum-varnames: - THRESHOLD ObservabilityPipelineSpikeProtectionProcessorSpikeAction: description: |- The action to take with matching logs while spike protection is active. Options: - `drop`: Drop the event. - `no_action`: Let the event pass through. - `overflow_routing`: Route to an overflow destination. When `overflow_routing` is used, there must be a destination whose `inputs` reference this processor with the `.overflow_events` suffix to route the overflowing events. enum: - drop - no_action - overflow_routing example: drop type: string x-enum-varnames: - DROP - NO_ACTION - OVERFLOW_ROUTING ObservabilityPipelineSpikeProtectionProcessorThresholdOverride: description: Defines a minimal threshold that applies to a specific partition instead of the processor-wide `minimal_threshold`. properties: fields: description: The set of field matchers that identifies the partition this override applies to. Every field name listed must also appear in `partition_fields`. items: $ref: "#/components/schemas/ObservabilityPipelineFieldValue" type: array minimal_threshold: $ref: "#/components/schemas/ObservabilityPipelineSpikeProtectionProcessorMinimalThreshold" required: - fields - minimal_threshold type: object ObservabilityPipelineSpikeProtectionProcessorType: default: spike_protection description: The processor type. The value should always be `spike_protection`. enum: - spike_protection example: spike_protection type: string x-enum-varnames: - SPIKE_PROTECTION ObservabilityPipelineSplitArrayProcessor: description: |- The `split_array` processor splits array fields into separate events based on configured rules. **Supported pipeline types:** logs properties: arrays: description: A list of array split configurations. items: $ref: "#/components/schemas/ObservabilityPipelineSplitArrayProcessorArrayConfig" maxItems: 15 minItems: 1 type: array display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: split-array-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. For split_array, this should typically be `*`. example: "*" type: string type: $ref: "#/components/schemas/ObservabilityPipelineSplitArrayProcessorType" required: - id - type - include - arrays - enabled type: object x-pipeline-types: [logs] ObservabilityPipelineSplitArrayProcessorArrayConfig: description: Configuration for a single array split operation. properties: field: description: The path to the array field to split. example: "tags" type: string include: description: A Datadog search query used to determine which logs this array split operation targets. example: "*" type: string required: - include - field type: object ObservabilityPipelineSplitArrayProcessorType: default: split_array description: The processor type. The value should always be `split_array`. enum: - split_array example: split_array type: string x-enum-varnames: - SPLIT_ARRAY ObservabilityPipelineSplunkHecDestination: description: |- The `splunk_hec` destination forwards logs to Splunk using the HTTP Event Collector (HEC). **Supported pipeline types:** logs properties: auto_extract_timestamp: description: |- If `true`, Splunk tries to extract timestamps from incoming log events. If `false`, Splunk assigns the time the event was received. Only applies when `endpoint_target` is `event`; cannot be `true` when `endpoint_target` is `raw`. example: true type: boolean buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" encoding: $ref: "#/components/schemas/ObservabilityPipelineSplunkHecDestinationEncoding" endpoint_target: $ref: "#/components/schemas/ObservabilityPipelineSplunkHecDestinationEndpointTarget" endpoint_url_key: description: Name of the environment variable or secret that holds the Splunk HEC endpoint URL. example: SPLUNK_HEC_ENDPOINT_URL type: string id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: splunk-hec-destination type: string index: description: Optional name of the Splunk index where logs are written. example: "main" type: string indexed_fields: description: List of log field names to send as indexed fields to Splunk HEC. Available only when `encoding` is `json`. example: ["service", "host"] items: description: A log field name to index in Splunk. type: string type: array inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array sourcetype: description: The Splunk sourcetype to assign to log events. example: "custom_sourcetype" type: string token_key: description: Name of the environment variable or secret that holds the Splunk HEC token. example: SPLUNK_HEC_TOKEN type: string token_strategy: $ref: "#/components/schemas/ObservabilityPipelineSplunkHecDestinationTokenStrategy" type: $ref: "#/components/schemas/ObservabilityPipelineSplunkHecDestinationType" required: - id - type - inputs type: object x-pipeline-types: [logs] ObservabilityPipelineSplunkHecDestinationEncoding: description: Encoding format for log events. enum: - json - raw_message example: json type: string x-enum-varnames: - JSON - RAW_MESSAGE ObservabilityPipelineSplunkHecDestinationEndpointTarget: description: The Splunk HEC endpoint to send events to. Use `event` to send structured events to the `/event` endpoint, or `raw` to send the raw message to the `/raw` endpoint. enum: - event - raw example: event type: string x-enum-varnames: - EVENT - RAW ObservabilityPipelineSplunkHecDestinationTokenStrategy: description: Controls how the Splunk HEC token is supplied. Use `custom` to provide a token with `token_key`, or `from_source` to forward the token received from an upstream Splunk HEC source. enum: - custom - from_source example: custom type: string x-enum-varnames: - CUSTOM - FROM_SOURCE ObservabilityPipelineSplunkHecDestinationType: default: splunk_hec description: The destination type. Always `splunk_hec`. enum: - splunk_hec example: splunk_hec type: string x-enum-varnames: - SPLUNK_HEC ObservabilityPipelineSplunkHecMetricsDestination: description: |- The `splunk_hec_metrics` destination forwards metrics to Splunk using the HTTP Event Collector (HEC). **Supported pipeline types:** metrics properties: buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" compression: $ref: "#/components/schemas/ObservabilityPipelineSplunkHecMetricsDestinationCompression" default_namespace: description: Optional default namespace for metrics sent to Splunk HEC. example: "custom_namespace" type: string endpoint_url_key: description: Name of the environment variable or secret that holds the Splunk HEC endpoint URL. example: SPLUNK_HEC_ENDPOINT_URL type: string id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: splunk-hec-metrics-destination type: string index: description: Optional name of the Splunk index where metrics are written. example: "metrics" type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["metrics-filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array source: description: The Splunk source field value for metric events. example: "observability_pipelines" type: string sourcetype: description: The Splunk sourcetype to assign to metric events. example: "custom_sourcetype" type: string tls: $ref: "#/components/schemas/ObservabilityPipelineTls" token_key: description: Name of the environment variable or secret that holds the Splunk HEC token. example: SPLUNK_HEC_TOKEN type: string type: $ref: "#/components/schemas/ObservabilityPipelineSplunkHecMetricsDestinationType" required: - id - type - inputs type: object x-pipeline-types: [metrics] ObservabilityPipelineSplunkHecMetricsDestinationCompression: default: none description: Compression algorithm applied when sending metrics to Splunk HEC. enum: - none - gzip example: none type: string x-enum-varnames: - NONE - GZIP ObservabilityPipelineSplunkHecMetricsDestinationType: default: splunk_hec_metrics description: The destination type. Always `splunk_hec_metrics`. enum: - splunk_hec_metrics example: splunk_hec_metrics type: string x-enum-varnames: - SPLUNK_HEC_METRICS ObservabilityPipelineSplunkHecSource: description: |- The `splunk_hec` source implements the Splunk HTTP Event Collector (HEC) API. **Supported pipeline types:** logs properties: address_key: description: Name of the environment variable or secret that holds the listen address for the HEC API. example: SPLUNK_HEC_ADDRESS type: string id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: splunk-hec-source type: string store_hec_token: description: |- When `true`, the Splunk HEC token from the incoming request is stored in the event metadata. This allows downstream components to forward the token to other Splunk HEC destinations. example: true type: boolean tls: $ref: "#/components/schemas/ObservabilityPipelineMtlsServerTls" type: $ref: "#/components/schemas/ObservabilityPipelineSplunkHecSourceType" valid_tokens: description: |- A list of tokens that are accepted for authenticating incoming HEC requests. When set, the source rejects any request whose HEC token does not match an enabled entry in this list. items: $ref: "#/components/schemas/ObservabilityPipelineSplunkHecSourceValidToken" maxItems: 1000 minItems: 1 type: array required: - id - type type: object x-pipeline-types: [logs] ObservabilityPipelineSplunkHecSourceType: default: splunk_hec description: The source type. Always `splunk_hec`. enum: - splunk_hec example: splunk_hec type: string x-enum-varnames: - SPLUNK_HEC ObservabilityPipelineSplunkHecSourceValidToken: description: An accepted HEC token used to authenticate incoming Splunk HEC requests. properties: enabled: default: true description: |- Indicates whether this token is currently accepted. Disabled tokens are rejected without being removed from the configuration. example: true type: boolean field_to_add: $ref: "#/components/schemas/ObservabilityPipelineSourceValidTokenFieldToAdd" token_key: description: Name of the environment variable or secret that holds the expected HEC token value. example: SPLUNK_HEC_TOKEN pattern: "^[A-Za-z0-9_]+$" type: string required: - token_key type: object ObservabilityPipelineSplunkTcpSource: description: |- The `splunk_tcp` source receives logs from a Splunk Universal Forwarder over TCP. TLS is supported for secure transmission. **Supported pipeline types:** logs properties: address_key: description: Name of the environment variable or secret that holds the listen address for the Splunk TCP receiver. example: SPLUNK_TCP_ADDRESS type: string id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: splunk-tcp-source type: string max_connection_duration_secs: description: Maximum duration, in seconds, that a connection can remain open before it is closed. When unset, connections can remain open indefinitely. example: 3600 format: int64 maximum: 9007199254740991 minimum: 1 type: integer tls: $ref: "#/components/schemas/ObservabilityPipelineMtlsServerTls" type: $ref: "#/components/schemas/ObservabilityPipelineSplunkTcpSourceType" required: - id - type type: object x-pipeline-types: [logs] ObservabilityPipelineSplunkTcpSourceType: default: splunk_tcp description: The source type. Always `splunk_tcp`. enum: - splunk_tcp example: splunk_tcp type: string x-enum-varnames: - SPLUNK_TCP ObservabilityPipelineSumoLogicDestination: description: |- The `sumo_logic` destination forwards logs to Sumo Logic. **Supported pipeline types:** logs properties: buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" encoding: $ref: "#/components/schemas/ObservabilityPipelineSumoLogicDestinationEncoding" endpoint_url_key: description: Name of the environment variable or secret that holds the Sumo Logic HTTP endpoint URL. example: SUMO_LOGIC_ENDPOINT_URL type: string header_custom_fields: description: A list of custom headers to include in the request to Sumo Logic. items: $ref: "#/components/schemas/ObservabilityPipelineSumoLogicDestinationHeaderCustomFieldsItem" type: array header_host_name: description: Optional override for the host name header. example: "host-123" type: string header_source_category: description: Optional override for the source category header. example: "source-category" type: string header_source_name: description: Optional override for the source name header. example: "source-name" type: string id: description: The unique identifier for this component. example: "sumo-logic-destination" type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array type: $ref: "#/components/schemas/ObservabilityPipelineSumoLogicDestinationType" required: - id - type - inputs type: object x-pipeline-types: [logs] ObservabilityPipelineSumoLogicDestinationEncoding: description: The output encoding format. enum: [json, raw_message, logfmt] example: json type: string x-enum-varnames: - JSON - RAW_MESSAGE - LOGFMT ObservabilityPipelineSumoLogicDestinationHeaderCustomFieldsItem: description: Single key-value pair used as a custom log header for Sumo Logic. properties: name: description: The header field name. example: "X-Sumo-Category" type: string value: description: The header field value. example: "my-app-logs" type: string required: - name - value type: object ObservabilityPipelineSumoLogicDestinationType: default: sumo_logic description: The destination type. The value should always be `sumo_logic`. enum: - sumo_logic example: sumo_logic type: string x-enum-varnames: - SUMO_LOGIC ObservabilityPipelineSumoLogicSource: description: |- The `sumo_logic` source receives logs from Sumo Logic collectors. **Supported pipeline types:** logs properties: address_key: description: Name of the environment variable or secret that holds the listen address for the Sumo Logic receiver. example: SUMO_LOGIC_ADDRESS type: string id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: "sumo-logic-source" type: string type: $ref: "#/components/schemas/ObservabilityPipelineSumoLogicSourceType" required: - id - type type: object x-pipeline-types: [logs] ObservabilityPipelineSumoLogicSourceType: default: sumo_logic description: The source type. The value should always be `sumo_logic`. enum: - sumo_logic example: sumo_logic type: string x-enum-varnames: - SUMO_LOGIC ObservabilityPipelineSyslogNgDestination: description: |- The `syslog_ng` destination forwards logs to an external `syslog-ng` server over TCP or UDP using the syslog protocol. **Supported pipeline types:** logs properties: buffer: $ref: "#/components/schemas/ObservabilityPipelineBufferOptions" endpoint_url_key: description: Name of the environment variable or secret that holds the syslog-ng server endpoint URL. example: SYSLOG_ENDPOINT_URL type: string id: description: The unique identifier for this component. example: "syslog-ng-destination" type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: ["filter-processor"] items: description: The ID of a component whose output is used as input for this destination. type: string type: array keepalive: description: Optional socket keepalive duration in milliseconds. example: 60000 format: int64 minimum: 0 type: integer tls: $ref: "#/components/schemas/ObservabilityPipelineClientTls" type: $ref: "#/components/schemas/ObservabilityPipelineSyslogNgDestinationType" required: - id - type - inputs type: object x-pipeline-types: [logs] ObservabilityPipelineSyslogNgDestinationType: default: syslog_ng description: The destination type. The value should always be `syslog_ng`. enum: [syslog_ng] example: syslog_ng type: string x-enum-varnames: - SYSLOG_NG ObservabilityPipelineSyslogNgSource: description: |- The `syslog_ng` source listens for logs over TCP or UDP from a `syslog-ng` server using the syslog protocol. **Supported pipeline types:** logs properties: address_key: description: Name of the environment variable or secret that holds the listen address for the syslog-ng receiver. example: SYSLOG_ADDRESS type: string id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: "syslog-ng-source" type: string mode: $ref: "#/components/schemas/ObservabilityPipelineSyslogSourceMode" tls: $ref: "#/components/schemas/ObservabilityPipelineMtlsServerTls" type: $ref: "#/components/schemas/ObservabilityPipelineSyslogNgSourceType" required: - id - type - mode type: object x-pipeline-types: [logs] ObservabilityPipelineSyslogNgSourceType: default: syslog_ng description: The source type. The value should always be `syslog_ng`. enum: [syslog_ng] example: syslog_ng type: string x-enum-varnames: - SYSLOG_NG ObservabilityPipelineSyslogSourceMode: description: Protocol used by the syslog source to receive messages. enum: [tcp, udp] example: tcp type: string x-enum-varnames: - TCP - UDP ObservabilityPipelineTagCardinalityLimitProcessor: description: |- The `tag_cardinality_limit` processor caps the number of distinct tag value combinations on metrics, dropping tags or events once the limit is exceeded. **Supported pipeline types:** metrics properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean id: description: The unique identifier for this component. Used in other parts of the pipeline to reference this component (for example, as the `input` to downstream components). example: "tag-cardinality-limit-processor" type: string include: description: A Datadog search query used to determine which metrics this processor targets. example: "*" type: string limit_exceeded_action: $ref: "#/components/schemas/ObservabilityPipelineTagCardinalityLimitProcessorAction" per_metric_limits: description: A list of per-metric cardinality overrides that take precedence over the default `value_limit`. items: $ref: "#/components/schemas/ObservabilityPipelineTagCardinalityLimitProcessorPerMetricLimit" maxItems: 100 type: array tracking_mode: $ref: "#/components/schemas/ObservabilityPipelineTagCardinalityLimitProcessorTrackingMode" type: $ref: "#/components/schemas/ObservabilityPipelineTagCardinalityLimitProcessorType" value_limit: description: The default maximum number of distinct tag value combinations allowed per metric. example: 10000 format: int64 maximum: 1000000 minimum: 0 type: integer required: - id - type - include - limit_exceeded_action - tracking_mode - value_limit - enabled type: object x-pipeline-types: [metrics] ObservabilityPipelineTagCardinalityLimitProcessorAction: description: The action to take when the cardinality limit is exceeded. enum: - drop_tag - drop_event example: drop_tag type: string x-enum-varnames: - DROP_TAG - DROP_EVENT ObservabilityPipelineTagCardinalityLimitProcessorOverrideType: description: How the override is applied. `limit_override` enforces a custom limit; `excluded` omits the metric or tag from cardinality tracking. enum: - limit_override - excluded example: limit_override type: string x-enum-varnames: - LIMIT_OVERRIDE - EXCLUDED ObservabilityPipelineTagCardinalityLimitProcessorPerMetricLimit: description: A cardinality override applied to a specific metric. properties: limit_exceeded_action: $ref: "#/components/schemas/ObservabilityPipelineTagCardinalityLimitProcessorAction" metric_name: description: The name of the metric this override applies to. example: "system.cpu.user" type: string override_type: $ref: "#/components/schemas/ObservabilityPipelineTagCardinalityLimitProcessorOverrideType" per_tag_limits: description: A list of per-tag cardinality overrides that apply within this metric. Must be omitted when `override_type` is `excluded`. items: $ref: "#/components/schemas/ObservabilityPipelineTagCardinalityLimitProcessorPerTagLimit" maxItems: 50 type: array value_limit: description: The maximum number of distinct tag value combinations allowed for this metric. Required when `override_type` is `limit_override`. Must be omitted when `override_type` is `excluded`. example: 10000 format: int64 maximum: 1000000 minimum: 0 type: integer required: - metric_name - override_type type: object ObservabilityPipelineTagCardinalityLimitProcessorPerTagLimit: description: A cardinality override for a specific tag key within a per-metric limit. properties: override_type: $ref: "#/components/schemas/ObservabilityPipelineTagCardinalityLimitProcessorOverrideType" tag_key: description: The tag key this override applies to. example: "host" type: string value_limit: description: The maximum number of distinct values allowed for this tag. Required when `override_type` is `limit_override`. Must be omitted when `override_type` is `excluded`. example: 5000 format: int64 maximum: 1000000 minimum: 0 type: integer required: - tag_key - override_type type: object ObservabilityPipelineTagCardinalityLimitProcessorTrackingMode: description: Controls whether the processor uses exact or probabilistic tag tracking. properties: mode: $ref: "#/components/schemas/ObservabilityPipelineTagCardinalityLimitProcessorTrackingModeMode" required: - mode type: object ObservabilityPipelineTagCardinalityLimitProcessorTrackingModeMode: description: The cardinality tracking algorithm to use. enum: - exact_fingerprint - probabilistic example: exact_fingerprint type: string x-enum-varnames: - EXACT_FINGERPRINT - PROBABILISTIC ObservabilityPipelineTagCardinalityLimitProcessorType: default: tag_cardinality_limit description: The processor type. The value must be `tag_cardinality_limit`. enum: [tag_cardinality_limit] example: tag_cardinality_limit type: string x-enum-varnames: - TAG_CARDINALITY_LIMIT ObservabilityPipelineThrottleProcessor: description: |- The `throttle` processor limits the number of events that pass through over a given time window. **Supported pipeline types:** logs properties: display_name: $ref: "#/components/schemas/ObservabilityPipelineComponentDisplayName" enabled: description: Indicates whether the processor is enabled. example: true type: boolean group_by: description: Optional list of fields used to group events before the threshold has been reached. example: ["log.user.id"] items: description: A log field name used to group events for independent throttling. type: string type: array id: description: The unique identifier for this processor. example: throttle-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: env:prod type: string threshold: description: the number of events allowed in a given time window. Events sent after the threshold has been reached, are dropped. example: 1000 format: int64 type: integer type: $ref: "#/components/schemas/ObservabilityPipelineThrottleProcessorType" window: description: The time window in seconds over which the threshold applies. example: 60.0 format: double type: number required: - id - type - include - threshold - window - enabled type: object x-pipeline-types: [logs] ObservabilityPipelineThrottleProcessorType: default: throttle description: The processor type. The value should always be `throttle`. enum: - throttle example: throttle type: string x-enum-varnames: - THROTTLE ObservabilityPipelineTls: description: Configuration for enabling TLS encryption between the pipeline component and external services. properties: ca_file: description: Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate. type: string crt_file: description: Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services. example: "/path/to/cert.crt" type: string key_file: description: Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication. type: string key_pass_key: description: Name of the environment variable or secret that holds the passphrase for the private key file. example: TLS_KEY_PASSPHRASE type: string required: - crt_file type: object ObservabilityPipelineWebsocketSource: description: |- The `websocket` source ingests logs from a WebSocket server using the `ws://` or `wss://` protocol. **Supported pipeline types:** logs. properties: auth_strategy: $ref: "#/components/schemas/ObservabilityPipelineWebsocketSourceAuthStrategy" custom_key: description: Name of the environment variable or secret that holds the custom authorization header value. Used when `auth_strategy` is `custom`. example: WS_AUTH_CUSTOM_HEADER type: string decoding: $ref: "#/components/schemas/ObservabilityPipelineDecoding" id: description: The unique identifier for this component. example: websocket-source type: string password_key: description: Name of the environment variable or secret that holds the password. Used when `auth_strategy` is `basic`. example: WS_AUTH_PASSWORD type: string tls: $ref: "#/components/schemas/ObservabilityPipelineWebsocketSourceTls" token_key: description: Name of the environment variable or secret that holds the bearer token. Used when `auth_strategy` is `bearer`. example: WS_BEARER_TOKEN type: string type: $ref: "#/components/schemas/ObservabilityPipelineWebsocketSourceType" uri_key: description: Name of the environment variable or secret that holds the WebSocket server URI (`ws://` or `wss://`). example: WS_URI type: string username_key: description: Name of the environment variable or secret that holds the username. Used when `auth_strategy` is `basic`. example: WS_AUTH_USERNAME type: string required: - id - type - decoding - auth_strategy type: object x-pipeline-types: [logs] ObservabilityPipelineWebsocketSourceAuthStrategy: description: Authentication strategy for the WebSocket source connection. enum: - none - basic - bearer - custom example: bearer type: string x-enum-varnames: - NONE - BASIC - BEARER - CUSTOM ObservabilityPipelineWebsocketSourceTls: description: TLS configuration for the WebSocket source. Use `enabled` for standard `wss://` connections, or `with_client_cert` to present a client certificate for mutual TLS. oneOf: - $ref: "#/components/schemas/ObservabilityPipelineWebsocketSourceTlsEnabled" - $ref: "#/components/schemas/ObservabilityPipelineWebsocketSourceTlsWithClientCert" ObservabilityPipelineWebsocketSourceTlsEnabled: description: TLS configuration that enables encryption without a client certificate. Use this for standard `wss://` connections that do not require mutual TLS. properties: mode: $ref: "#/components/schemas/ObservabilityPipelineWebsocketSourceTlsEnabledMode" required: - mode type: object ObservabilityPipelineWebsocketSourceTlsEnabledMode: description: TLS mode. Must be `enabled`. enum: - enabled example: enabled type: string x-enum-varnames: - ENABLED ObservabilityPipelineWebsocketSourceTlsWithClientCert: description: TLS configuration that enables encryption and presents a client certificate for mutual TLS authentication. properties: ca_file: description: Path to the Certificate Authority (CA) file used to validate the remote server's TLS certificate. example: /path/to/ca.crt type: string crt_file: description: Path to the TLS client certificate file used to identify this source to the remote server. example: /path/to/client.crt type: string key_file: description: Path to the private key file associated with the client certificate. example: /path/to/client.key type: string key_pass_key: description: Name of the environment variable or secret that holds the passphrase for the private key file. example: WS_TLS_KEY_PASSPHRASE type: string mode: $ref: "#/components/schemas/ObservabilityPipelineWebsocketSourceTlsWithClientCertMode" required: - mode - crt_file type: object ObservabilityPipelineWebsocketSourceTlsWithClientCertMode: description: TLS mode. Must be `with_client_cert`. enum: - with_client_cert example: with_client_cert type: string x-enum-varnames: - WITH_CLIENT_CERT ObservabilityPipelineWebsocketSourceType: default: websocket description: The source type. The value should always be `websocket`. enum: - websocket example: websocket type: string x-enum-varnames: - WEBSOCKET OktaAPIToken: description: The definition of the `OktaAPIToken` object. properties: api_token: $ref: "#/components/schemas/OktaAPITokenApiToken" domain: $ref: "#/components/schemas/OktaAPITokenDomain" type: $ref: "#/components/schemas/OktaAPITokenType" required: - type - domain - api_token type: object OktaAPITokenApiToken: description: The `OktaAPIToken` `api_token`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" OktaAPITokenDomain: description: The `OktaAPIToken` `domain`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" OktaAPITokenType: description: The definition of the `OktaAPIToken` object. enum: - OktaAPIToken example: OktaAPIToken type: string x-enum-varnames: - OKTAAPITOKEN OktaAPITokenUpdate: description: The definition of the `OktaAPIToken` object. properties: api_token: $ref: "#/components/schemas/OktaAPITokenUpdateApiToken" domain: $ref: "#/components/schemas/OktaAPITokenUpdateDomain" type: $ref: "#/components/schemas/OktaAPITokenType" required: - type type: object OktaAPITokenUpdateApiToken: description: The `OktaAPITokenUpdate` `api_token`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" OktaAPITokenUpdateDomain: description: The `OktaAPITokenUpdate` `domain`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" OktaAccount: description: Schema for an Okta account. properties: attributes: $ref: "#/components/schemas/OktaAccountAttributes" id: description: The ID of the Okta account, a UUID hash of the account name. example: "f749daaf-682e-4208-a38d-c9b43162c609" type: string type: $ref: "#/components/schemas/OktaAccountType" required: - attributes - type type: object OktaAccountAttributes: description: Attributes object for an Okta account. properties: api_key: description: The API key of the Okta account. type: string writeOnly: true auth_method: description: The authorization method for an Okta account. example: "oauth" type: string client_id: description: The Client ID of an Okta app integration. type: string client_secret: description: The client secret of an Okta app integration. type: string writeOnly: true domain: description: The domain of the Okta account. example: "https://example.okta.com/" type: string name: description: The name of the Okta account. example: "Okta-Prod" type: string required: - auth_method - domain - name type: object OktaAccountRequest: description: Request object for an Okta account. properties: data: $ref: "#/components/schemas/OktaAccount" required: - data type: object OktaAccountResponse: description: Response object for an Okta account. properties: data: $ref: "#/components/schemas/OktaAccount" type: object OktaAccountResponseData: description: Data object of an Okta account properties: attributes: $ref: "#/components/schemas/OktaAccountAttributes" id: description: The ID of the Okta account, a UUID hash of the account name. example: "f749daaf-682e-4208-a38d-c9b43162c609" type: string type: $ref: "#/components/schemas/OktaAccountType" required: - attributes - id - type type: object OktaAccountType: default: okta-accounts description: Account type for an Okta account. enum: - okta-accounts example: okta-accounts type: string x-enum-varnames: - OKTA_ACCOUNTS OktaAccountUpdateRequest: description: Payload schema when updating an Okta account. properties: data: $ref: "#/components/schemas/OktaAccountUpdateRequestData" required: - data type: object OktaAccountUpdateRequestAttributes: description: Attributes object for updating an Okta account. properties: api_key: description: The API key of the Okta account. type: string writeOnly: true auth_method: description: The authorization method for an Okta account. example: "oauth" type: string client_id: description: The Client ID of an Okta app integration. type: string client_secret: description: The client secret of an Okta app integration. type: string writeOnly: true domain: description: The domain associated with an Okta account. example: "https://dev-test.okta.com/" type: string required: - auth_method - domain type: object OktaAccountUpdateRequestData: description: Data object for updating an Okta account. properties: attributes: $ref: "#/components/schemas/OktaAccountUpdateRequestAttributes" type: $ref: "#/components/schemas/OktaAccountType" type: object OktaAccountsResponse: description: The expected response schema when getting Okta accounts. properties: data: description: List of Okta accounts. items: $ref: "#/components/schemas/OktaAccountResponseData" type: array type: object OktaCredentials: description: The definition of the `OktaCredentials` object. oneOf: - $ref: "#/components/schemas/OktaAPIToken" OktaCredentialsUpdate: description: The definition of the `OktaCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/OktaAPITokenUpdate" OktaIntegration: description: The definition of the `OktaIntegration` object. properties: credentials: $ref: "#/components/schemas/OktaCredentials" type: $ref: "#/components/schemas/OktaIntegrationType" required: - type - credentials type: object OktaIntegrationType: description: The definition of the `OktaIntegrationType` object. enum: - Okta example: Okta type: string x-enum-varnames: - OKTA OktaIntegrationUpdate: description: The definition of the `OktaIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/OktaCredentialsUpdate" type: $ref: "#/components/schemas/OktaIntegrationType" required: - type type: object OnCallNotificationRule: description: A top-level wrapper for a notification rule example: data: attributes: "category": "high_urgency" channel_settings: method: "sms" type: "phone" "delay_minutes": 1 id: 27590dae-47be-4a7d-9abf-8f4e45124020 relationships: channel: data: id: 1562fab3-a8c2-49e2-8f3a-28dcda2405e2 type: notification_channels type: notification_rules properties: data: $ref: "#/components/schemas/OnCallNotificationRuleData" included: items: $ref: "#/components/schemas/OnCallNotificationRulesIncluded" type: array required: - data type: object OnCallNotificationRuleAttributes: description: Attributes for an on-call notification rule. properties: category: $ref: "#/components/schemas/OnCallNotificationRuleCategory" channel_settings: $ref: "#/components/schemas/OnCallNotificationRuleChannelSettings" description: Configuration for the associated channel, if necessary nullable: true delay_minutes: description: The number of minutes that will elapse before this rule is evaluated. 0 indicates immediate evaluation format: int64 type: integer type: object OnCallNotificationRuleCategory: default: high_urgency description: "Specifies the category a notification rule will apply to" enum: - high_urgency - low_urgency type: string x-enum-varnames: - HIGH_URGENCY - LOW_URGENCY OnCallNotificationRuleChannelRelationship: description: Relationship object for creating a notification rule properties: data: $ref: "#/components/schemas/OnCallNotificationRuleChannelRelationshipData" required: - data type: object OnCallNotificationRuleChannelRelationshipData: description: Channel relationship data for creating a notification rule properties: id: description: ID of the notification channel type: string type: $ref: "#/components/schemas/NotificationChannelType" type: object OnCallNotificationRuleChannelSettings: description: "Defines the configuration for a channel associated with a notification rule" oneOf: - $ref: "#/components/schemas/OnCallPhoneNotificationRuleSettings" OnCallNotificationRuleData: description: Data for an on-call notification rule properties: attributes: $ref: "#/components/schemas/OnCallNotificationRuleAttributes" id: description: Unique identifier for the rule type: string relationships: $ref: "#/components/schemas/OnCallNotificationRuleRelationships" type: $ref: "#/components/schemas/OnCallNotificationRuleType" required: - type type: object OnCallNotificationRuleRelationships: description: Relationship object for creating a notification rule properties: channel: $ref: "#/components/schemas/OnCallNotificationRuleChannelRelationship" type: object OnCallNotificationRuleRequestAttributes: description: Attributes for creating or modifying an on-call notification rule. properties: category: $ref: "#/components/schemas/OnCallNotificationRuleCategory" channel_settings: $ref: "#/components/schemas/OnCallNotificationRuleChannelSettings" description: Configuration for the associated channel, if necessary nullable: true delay_minutes: description: The number of minutes that will elapse before this rule is evaluated. 0 indicates immediate evaluation format: int64 type: integer type: object OnCallNotificationRuleType: default: notification_rules description: "Indicates that the resource is of type `notification_rules`." enum: - notification_rules example: notification_rules type: string x-enum-varnames: - NOTIFICATION_RULES OnCallNotificationRulesIncluded: description: Represents additional included resources for a on-call notification rules oneOf: - $ref: "#/components/schemas/NotificationChannelData" OnCallPageAuthorRelationship: description: Reference to the entity that performed an action on the Page. properties: data: $ref: "#/components/schemas/OnCallPageAuthorRelationshipData" type: object OnCallPageAuthorRelationshipData: description: Reference to the author of a Page action. nullable: true properties: id: description: The ID of the author. example: 00000000-0000-0000-0000-000000000000 type: string type: description: |- The resource type of the author, for example `users`, `monitors`, `incident_authors`, or `security_signal`. example: users type: string required: - id - type type: object OnCallPageData: description: An On-Call Page. properties: attributes: $ref: "#/components/schemas/OnCallPageDataAttributes" id: description: The unique ID of the Page. example: 15e74b8b-f865-48d0-bcc5-453323ed2c8f format: uuid type: string relationships: $ref: "#/components/schemas/OnCallPageDataRelationships" type: $ref: "#/components/schemas/OnCallPageDataType" required: - id - type type: object OnCallPageDataAttributes: description: The attributes of an On-Call Page. properties: acknowledged_at: description: The time when the Page was first acknowledged. example: "2026-01-01T10:05:00Z" format: date-time type: string closed_at: description: The time when the Page was resolved. example: "2026-01-01T10:30:00Z" format: date-time type: string comment_count: description: The number of comments on the Page. example: 2 format: int64 type: integer created_at: description: The time when the Page was created. example: "2026-01-01T10:00:00Z" format: date-time type: string description: description: A short summary of the issue or context. example: Page details. type: string escalation_policy_uuid: description: The ID of the escalation policy used to route the Page. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string key: description: An alternative numeric identifier of the Page, as displayed in the Datadog UI. example: "25137717" type: string live_call: $ref: "#/components/schemas/OnCallPageLiveCall" modified_at: description: The time when the Page was last modified. example: "2026-01-01T10:30:00Z" format: date-time type: string release_at: description: The time when the snooze ends. Only set while the Page is snoozed, together with `release_origin`. example: "2026-01-01T11:00:00Z" format: date-time type: string release_origin: $ref: "#/components/schemas/OnCallPageReleaseOrigin" responders_added_at: description: The time when responders were first added to the Page. example: "2026-01-01T10:01:00Z" format: date-time type: string services: description: The services associated with the Page. example: - service-a items: description: A service name. type: string type: array status: $ref: "#/components/schemas/OnCallPageStatus" tags: description: Tags associated with the Page. example: - service:test items: description: A tag. type: string type: array title: description: The title of the Page. example: "Service: Test is down" type: string urgency: $ref: "#/components/schemas/PageUrgency" required: - title - key - status - description - tags - urgency - created_at type: object OnCallPageDataRelationships: description: The relationships of an On-Call Page. properties: author: $ref: "#/components/schemas/OnCallPageAuthorRelationship" closed_by: $ref: "#/components/schemas/OnCallPageAuthorRelationship" jira_issue: $ref: "#/components/schemas/OnCallPageJiraIssueRelationship" links: $ref: "#/components/schemas/OnCallPageLinksRelationship" responders: $ref: "#/components/schemas/OnCallPageRespondersRelationship" scheduled_action: $ref: "#/components/schemas/OnCallPageScheduledActionRelationship" service_now_incident: $ref: "#/components/schemas/OnCallPageServiceNowIncidentRelationship" target: $ref: "#/components/schemas/OnCallPageTargetRelationship" team_routing_rule: $ref: "#/components/schemas/OnCallPageTeamRoutingRuleRelationship" type: object OnCallPageDataType: default: pages description: "Indicates that the resource is of type `pages`." enum: - pages example: pages type: string x-enum-varnames: - PAGES OnCallPageJiraIssueRelationship: description: The Jira issue linked to the Page. properties: data: $ref: "#/components/schemas/OnCallPageJiraIssueRelationshipData" type: object OnCallPageJiraIssueRelationshipData: description: Reference to a Jira issue. properties: id: description: The ID of the Jira issue, in the form `:`. example: "123456:10001" type: string type: $ref: "#/components/schemas/OnCallPageJiraIssueType" required: - id - type type: object OnCallPageJiraIssueType: default: jira_issues description: Jira issue resource type. enum: - jira_issues example: jira_issues type: string x-enum-varnames: - JIRA_ISSUES OnCallPageLink: description: A link between a Page and another Datadog resource, such as an incident. properties: attributes: $ref: "#/components/schemas/OnCallPageLinkAttributes" id: description: The ID of the link. example: 00000000-0000-0000-0000-000000000003 type: string type: $ref: "#/components/schemas/OnCallPageLinkType" required: - id - type type: object OnCallPageLinkAttributes: description: |- The attributes of a Page link. A Page can be the child of another Datadog resource (for example, when an incident triggers it), or the parent of one (for example, when the Page is escalated to an incident). properties: child_entity_id: description: The ID of the child resource. example: 15e74b8b-f865-48d0-bcc5-453323ed2c8f type: string child_entity_type: $ref: "#/components/schemas/OnCallPageLinkEntityType" parent_entity_id: description: The ID of the parent resource. example: 00000000-0000-0000-0000-000000000002 type: string parent_entity_type: $ref: "#/components/schemas/OnCallPageLinkEntityType" relationship: $ref: "#/components/schemas/OnCallPageLinkRelationshipType" required: - child_entity_id - child_entity_type - parent_entity_id - parent_entity_type - relationship type: object OnCallPageLinkEntityType: description: The type of a resource linked to a Page. enum: - case - incident - page - agent_conversation example: page type: string x-enum-varnames: - CASE - INCIDENT - PAGE - AGENT_CONVERSATION OnCallPageLinkRelationshipData: description: Reference to a Page link. properties: id: description: The ID of the link. example: 00000000-0000-0000-0000-000000000003 type: string type: $ref: "#/components/schemas/OnCallPageLinkType" required: - id - type type: object OnCallPageLinkRelationshipType: description: How the parent resource relates to the child resource. enum: - relates_to - causes - blocks - duplicates - parent_of - successor_of - escalates_to - pages example: pages type: string x-enum-varnames: - RELATES_TO - CAUSES - BLOCKS - DUPLICATES - PARENT_OF - SUCCESSOR_OF - ESCALATES_TO - PAGES OnCallPageLinkType: default: links description: Page link resource type. enum: - links example: links type: string x-enum-varnames: - LINKS OnCallPageLinksRelationship: description: Links between the Page and other Datadog resources, such as incidents. Always empty when listing Pages. properties: data: description: The list of Page links. items: $ref: "#/components/schemas/OnCallPageLinkRelationshipData" type: array type: object OnCallPageLiveCall: description: Live call information for a Page triggered by a live call route. properties: call_over: $ref: "#/components/schemas/OnCallPageLiveCallOver" type: object OnCallPageLiveCallOutcome: description: The outcome of a live call that has ended. enum: - success_call_answered - failure_no_responder - failure_caller_abandoned - failure_outside_support_hours - failure_internal_error example: success_call_answered type: string x-enum-varnames: - SUCCESS_CALL_ANSWERED - FAILURE_NO_RESPONDER - FAILURE_CALLER_ABANDONED - FAILURE_OUTSIDE_SUPPORT_HOURS - FAILURE_INTERNAL_ERROR OnCallPageLiveCallOver: description: Information about a live call that has ended. properties: outcome: $ref: "#/components/schemas/OnCallPageLiveCallOutcome" support_hours_start_at: description: When support hours start, if the call was placed outside support hours. example: "2026-01-01T09:00:00Z" format: date-time type: string type: object OnCallPageReleaseOrigin: description: |- What snoozed the Page. Only set while the Page is snoozed, together with `release_at`. `ack_timeout`: the acknowledgment timeout. `team_rules_active_hours`: the Page was triggered outside of the active hours of the team's routing rules. `manual_snooze`: a user snoozed the Page. enum: - ack_timeout - team_rules_active_hours - manual_snooze example: manual_snooze type: string x-enum-varnames: - ACK_TIMEOUT - TEAM_RULES_ACTIVE_HOURS - MANUAL_SNOOZE OnCallPageRespondersRelationship: description: The users responding to the Page. properties: data: description: The list of responders. items: $ref: "#/components/schemas/OnCallPageUserRelationshipData" type: array type: object OnCallPageResponse: description: A single On-Call Page with its related included resources. properties: data: $ref: "#/components/schemas/OnCallPageData" included: description: Resources related to the Page, such as users, teams, scheduled actions, and links. items: $ref: "#/components/schemas/OnCallPagesIncluded" type: array required: - data type: object OnCallPageScheduledAction: description: The next action scheduled on a Page, such as an escalation or an automatic resolution. properties: attributes: $ref: "#/components/schemas/OnCallPageScheduledActionAttributes" id: description: The ID of the scheduled action. Equal to the Page ID. example: 15e74b8b-f865-48d0-bcc5-453323ed2c8f type: string relationships: $ref: "#/components/schemas/OnCallPageScheduledActionRelationships" type: $ref: "#/components/schemas/OnCallPageScheduledActionType" required: - id - type type: object OnCallPageScheduledActionAttributes: description: The attributes of a scheduled action. properties: at: description: The time when the action is scheduled to run. example: "2026-01-01T10:15:00Z" format: date-time type: string type: $ref: "#/components/schemas/OnCallPageScheduledActionAttributesType" type: object OnCallPageScheduledActionAttributesType: description: The kind of action that is scheduled. enum: - escalate - resolve - release - retrigger example: escalate type: string x-enum-varnames: - ESCALATE - RESOLVE - RELEASE - RETRIGGER OnCallPageScheduledActionRelationship: description: The next action scheduled on the Page, such as an escalation. properties: data: $ref: "#/components/schemas/OnCallPageScheduledActionRelationshipData" type: object OnCallPageScheduledActionRelationshipData: description: Reference to the next scheduled action on the Page. nullable: true properties: id: description: The ID of the scheduled action. Equal to the Page ID. example: 15e74b8b-f865-48d0-bcc5-453323ed2c8f type: string type: $ref: "#/components/schemas/OnCallPageScheduledActionType" required: - id - type type: object OnCallPageScheduledActionRelationships: description: The relationships of a scheduled action. properties: schedules: $ref: "#/components/schemas/OnCallPageScheduledActionRelationshipsSchedules" users: $ref: "#/components/schemas/OnCallPageScheduledActionRelationshipsUsers" type: object OnCallPageScheduledActionRelationshipsSchedules: description: The schedules the action escalates to. properties: data: description: The list of schedules. items: $ref: "#/components/schemas/OnCallPageScheduledActionRelationshipsSchedulesData" type: array type: object OnCallPageScheduledActionRelationshipsSchedulesData: description: Reference to a schedule. properties: id: description: The schedule ID. example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string type: $ref: "#/components/schemas/ScheduleDataType" required: - id - type type: object OnCallPageScheduledActionRelationshipsUsers: description: The users the action escalates to. properties: data: description: The list of users. items: $ref: "#/components/schemas/OnCallPageUserRelationshipData" type: array type: object OnCallPageScheduledActionType: default: scheduled_actions description: Scheduled action resource type. enum: - scheduled_actions example: scheduled_actions type: string x-enum-varnames: - SCHEDULED_ACTIONS OnCallPageServiceNowIncidentRelationship: description: The ServiceNow incident linked to the Page. properties: data: $ref: "#/components/schemas/OnCallPageServiceNowIncidentRelationshipData" type: object OnCallPageServiceNowIncidentRelationshipData: description: Reference to a ServiceNow incident. properties: id: description: The ID of the ServiceNow incident. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: "#/components/schemas/OnCallPageServiceNowIncidentType" required: - id - type type: object OnCallPageServiceNowIncidentType: default: service_now_incidents description: ServiceNow incident resource type. enum: - service_now_incidents example: service_now_incidents type: string x-enum-varnames: - SERVICE_NOW_INCIDENTS OnCallPageStatus: description: The current status of the On-Call Page. enum: - triggered - acknowledged - resolved example: triggered type: string x-enum-varnames: - TRIGGERED - ACKNOWLEDGED - RESOLVED OnCallPageTargetRelationship: description: The team, user, or cross-organization handle that was paged. properties: data: $ref: "#/components/schemas/OnCallPageTargetRelationshipData" type: object OnCallPageTargetRelationshipData: description: Reference to the target of the Page. nullable: true properties: id: description: The ID of the target. example: 00000000-da3a-0000-0000-000000000000 type: string type: $ref: "#/components/schemas/OnCallPageTargetRelationshipDataType" required: - id - type type: object OnCallPageTargetRelationshipDataType: description: The resource type of the Page target. enum: - teams - users - cross_org_handles example: teams type: string x-enum-varnames: - TEAMS - USERS - CROSS_ORG_HANDLES OnCallPageTargetType: description: The kind of target, `team_id` | `team_handle` | `user_id`. enum: - team_id - team_handle - user_id example: team_id type: string x-enum-varnames: - TEAM_ID - TEAM_HANDLE - USER_ID OnCallPageTeamRoutingRuleRelationship: description: The team routing rule that matched the Page. properties: data: $ref: "#/components/schemas/OnCallPageTeamRoutingRuleRelationshipData" type: object OnCallPageTeamRoutingRuleRelationshipData: description: Reference to a team routing rule. properties: id: description: The ID of the team routing rule. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: "#/components/schemas/TeamRoutingRulesDataRelationshipsRulesDataItemsType" required: - id - type type: object OnCallPageUserRelationshipData: description: Reference to a user. properties: id: description: The user ID. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: "#/components/schemas/ScheduleUserType" required: - id - type type: object OnCallPagesIncluded: description: A resource related to a Page. oneOf: - $ref: "#/components/schemas/ScheduleUser" - $ref: "#/components/schemas/TeamReference" - $ref: "#/components/schemas/OnCallPageScheduledAction" - $ref: "#/components/schemas/OnCallPageLink" OnCallPagesResponse: description: A list of On-Call Pages with pagination metadata and related included resources. properties: data: description: A list of Pages. items: $ref: "#/components/schemas/OnCallPageData" type: array included: description: Resources related to the Pages, such as users, teams, and scheduled actions. items: $ref: "#/components/schemas/OnCallPagesIncluded" type: array meta: $ref: "#/components/schemas/SchedulesResponseMeta" required: - data type: object OnCallPagesSort: default: created_at description: Sorting options for Pages. Prefix a field with `-` to sort in descending order. enum: - created_at - -created_at - modified_at - -modified_at - status - -status - priority - -priority type: string x-enum-varnames: - CREATED_AT_ASCENDING - CREATED_AT_DESCENDING - MODIFIED_AT_ASCENDING - MODIFIED_AT_DESCENDING - STATUS_ASCENDING - STATUS_DESCENDING - PRIORITY_ASCENDING - PRIORITY_DESCENDING OnCallPhoneNotificationRuleMethod: description: "Specifies the method in which a phone is used in a notification rule" enum: - sms - voice example: sms type: string x-enum-varnames: - SMS - VOICE OnCallPhoneNotificationRuleSettings: description: "Configuration for using a phone notification channel in a notification rule" properties: method: $ref: "#/components/schemas/OnCallPhoneNotificationRuleMethod" type: $ref: "#/components/schemas/NotificationChannelPhoneConfigType" required: - type - method type: object OnCallShiftChangeTrigger: description: "Trigger a workflow when an On-Call shift changes. The workflow must be published." properties: rateLimit: $ref: "#/components/schemas/TriggerRateLimit" type: object OnCallShiftChangeTriggerWrapper: description: "Schema for an On-Call shift change trigger." properties: onCallShiftChangeTrigger: $ref: "#/components/schemas/OnCallShiftChangeTrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - onCallShiftChangeTrigger type: object OnCallTrigger: description: "Trigger a workflow from an On-Call Page or On-Call Handover. For automatic triggering a handle must be configured and the workflow must be published." properties: rateLimit: $ref: "#/components/schemas/TriggerRateLimit" type: object OnCallTriggerWrapper: description: "Schema for an On-Call-based trigger." properties: onCallTrigger: $ref: "#/components/schemas/OnCallTrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - onCallTrigger type: object OnDemandConcurrencyCap: description: On-demand concurrency cap. properties: attributes: $ref: "#/components/schemas/OnDemandConcurrencyCapAttributes" type: $ref: "#/components/schemas/OnDemandConcurrencyCapType" type: object OnDemandConcurrencyCapAttributes: description: On-demand concurrency cap attributes. properties: on_demand_concurrency_cap: description: Value of the on-demand concurrency cap. format: double type: number type: object OnDemandConcurrencyCapResponse: description: On-demand concurrency cap response. properties: data: $ref: "#/components/schemas/OnDemandConcurrencyCap" type: object OnDemandConcurrencyCapType: description: On-demand concurrency cap type. enum: - on_demand_concurrency_cap type: string x-enum-varnames: - ON_DEMAND_CONCURRENCY_CAP OpenAIAPIKey: description: The definition of the `OpenAIAPIKey` object. properties: api_token: $ref: "#/components/schemas/OpenAIAPIKeyApiToken" type: $ref: "#/components/schemas/OpenAIAPIKeyType" required: - type - api_token type: object OpenAIAPIKeyApiToken: description: The `OpenAIAPIKey` `api_token`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" OpenAIAPIKeyType: description: The definition of the `OpenAIAPIKey` object. enum: - OpenAIAPIKey example: OpenAIAPIKey type: string x-enum-varnames: - OPENAIAPIKEY OpenAIAPIKeyUpdate: description: The definition of the `OpenAIAPIKey` object. properties: api_token: $ref: "#/components/schemas/OpenAIAPIKeyUpdateApiToken" type: $ref: "#/components/schemas/OpenAIAPIKeyType" required: - type type: object OpenAIAPIKeyUpdateApiToken: description: The `OpenAIAPIKeyUpdate` `api_token`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" OpenAICredentials: description: The definition of the `OpenAICredentials` object. oneOf: - $ref: "#/components/schemas/OpenAIAPIKey" OpenAICredentialsUpdate: description: The definition of the `OpenAICredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/OpenAIAPIKeyUpdate" OpenAIIntegration: description: The definition of the `OpenAIIntegration` object. properties: credentials: $ref: "#/components/schemas/OpenAICredentials" type: $ref: "#/components/schemas/OpenAIIntegrationType" required: - type - credentials type: object OpenAIIntegrationType: description: The definition of the `OpenAIIntegrationType` object. enum: - OpenAI example: OpenAI type: string x-enum-varnames: - OPENAI OpenAIIntegrationUpdate: description: The definition of the `OpenAIIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/OpenAICredentialsUpdate" type: $ref: "#/components/schemas/OpenAIIntegrationType" required: - type type: object OpenAPIEndpoint: description: Endpoint info extracted from an `OpenAPI` specification. properties: method: description: The endpoint method. type: string path: description: The endpoint path. type: string type: object OpenAPIFile: description: Object for API data in an `OpenAPI` format as a file. properties: openapi_spec_file: description: Binary `OpenAPI` spec file format: binary type: string type: object OpsgenieAccountCreateAttributes: description: The Opsgenie account attributes for a create request. properties: api_key: description: The Opsgenie API key for your Opsgenie account. example: "00000000-0000-0000-0000-000000000000" minLength: 1 type: string region: $ref: "#/components/schemas/OpsgenieServiceRegionType" required: - api_key - region type: object OpsgenieAccountCreateData: description: Opsgenie account data for a create request. properties: attributes: $ref: "#/components/schemas/OpsgenieAccountCreateAttributes" type: $ref: "#/components/schemas/OpsgenieAccountType" required: - type - attributes type: object OpsgenieAccountCreateRequest: description: Create request for an Opsgenie account. properties: data: $ref: "#/components/schemas/OpsgenieAccountCreateData" required: - data type: object OpsgenieAccountResponse: description: Response containing an Opsgenie account. properties: data: $ref: "#/components/schemas/OpsgenieAccountResponseData" required: - data type: object OpsgenieAccountResponseAttributes: description: The attributes from an Opsgenie account response. properties: region: $ref: "#/components/schemas/OpsgenieServiceRegionType" type: object OpsgenieAccountResponseData: description: Opsgenie account data from a response. properties: attributes: $ref: "#/components/schemas/OpsgenieAccountResponseAttributes" id: description: The ID of the Opsgenie account. example: "596da4af-0563-4097-90ff-07230c3f9db3" maxLength: 100 minLength: 1 type: string type: $ref: "#/components/schemas/OpsgenieAccountType" required: - id - type - attributes type: object OpsgenieAccountType: default: opsgenie-account description: Opsgenie account resource type. enum: - opsgenie-account example: opsgenie-account type: string x-enum-varnames: - OPSGENIE_ACCOUNT OpsgenieAccountUpdateAttributes: description: The Opsgenie account attributes for an update request. properties: api_key: description: The Opsgenie API key for your Opsgenie account. example: "00000000-0000-0000-0000-000000000000" minLength: 1 type: string region: $ref: "#/components/schemas/OpsgenieServiceRegionType" type: object OpsgenieAccountUpdateData: description: Opsgenie account data for an update request. properties: attributes: $ref: "#/components/schemas/OpsgenieAccountUpdateAttributes" id: description: The ID of the Opsgenie account. example: "596da4af-0563-4097-90ff-07230c3f9db3" maxLength: 100 minLength: 1 type: string type: $ref: "#/components/schemas/OpsgenieAccountType" required: - id - type - attributes type: object OpsgenieAccountUpdateRequest: description: Update request for an Opsgenie account. properties: data: $ref: "#/components/schemas/OpsgenieAccountUpdateData" required: - data type: object OpsgenieAccountsResponse: description: Response with a list of Opsgenie accounts. properties: data: description: An array of Opsgenie accounts. example: [{"attributes": {"region": "us"}, "id": "596da4af-0563-4097-90ff-07230c3f9db3", "type": "opsgenie-account"}, {"attributes": {"region": "eu"}, "id": "0d2937f1-b561-44fa-914a-99910f848014", "type": "opsgenie-account"}] items: $ref: "#/components/schemas/OpsgenieAccountResponseData" type: array required: - data type: object OpsgenieServiceCreateAttributes: description: The Opsgenie service attributes for a create request. properties: custom_url: description: The custom URL for a custom region. example: "https://example.com" type: string name: description: The name for the Opsgenie service. example: "fake-opsgenie-service-name" maxLength: 100 type: string opsgenie_api_key: description: The Opsgenie API key for your Opsgenie service. example: "00000000-0000-0000-0000-000000000000" type: string region: $ref: "#/components/schemas/OpsgenieServiceRegionType" required: - name - opsgenie_api_key - region type: object OpsgenieServiceCreateData: description: Opsgenie service data for a create request. properties: attributes: $ref: "#/components/schemas/OpsgenieServiceCreateAttributes" type: $ref: "#/components/schemas/OpsgenieServiceType" required: - type - attributes type: object OpsgenieServiceCreateRequest: description: Create request for an Opsgenie service. properties: data: $ref: "#/components/schemas/OpsgenieServiceCreateData" required: - data type: object OpsgenieServiceRegionType: description: The region for the Opsgenie service. enum: - us - eu - custom example: "us" type: string x-enum-varnames: - US - EU - CUSTOM OpsgenieServiceResponse: description: Response of an Opsgenie service. properties: data: $ref: "#/components/schemas/OpsgenieServiceResponseData" required: - data type: object OpsgenieServiceResponseAttributes: description: The attributes from an Opsgenie service response. properties: custom_url: description: The custom URL for a custom region. example: nullable: true type: string name: description: The name for the Opsgenie service. example: "fake-opsgenie-service-name" maxLength: 100 type: string region: $ref: "#/components/schemas/OpsgenieServiceRegionType" type: object OpsgenieServiceResponseData: description: Opsgenie service data from a response. properties: attributes: $ref: "#/components/schemas/OpsgenieServiceResponseAttributes" id: description: The ID of the Opsgenie service. example: "596da4af-0563-4097-90ff-07230c3f9db3" maxLength: 100 minLength: 1 type: string type: $ref: "#/components/schemas/OpsgenieServiceType" required: - id - type - attributes type: object OpsgenieServiceType: default: opsgenie-service description: Opsgenie service resource type. enum: - opsgenie-service example: opsgenie-service type: string x-enum-varnames: - OPSGENIE_SERVICE OpsgenieServiceUpdateAttributes: description: The Opsgenie service attributes for an update request. properties: custom_url: description: The custom URL for a custom region. example: "https://example.com" nullable: true type: string name: description: The name for the Opsgenie service. example: "fake-opsgenie-service-name" maxLength: 100 type: string opsgenie_api_key: description: The Opsgenie API key for your Opsgenie service. example: "00000000-0000-0000-0000-000000000000" type: string region: $ref: "#/components/schemas/OpsgenieServiceRegionType" type: object OpsgenieServiceUpdateData: description: Opsgenie service for an update request. properties: attributes: $ref: "#/components/schemas/OpsgenieServiceUpdateAttributes" id: description: The ID of the Opsgenie service. example: "596da4af-0563-4097-90ff-07230c3f9db3" maxLength: 100 minLength: 1 type: string type: $ref: "#/components/schemas/OpsgenieServiceType" required: - id - type - attributes type: object OpsgenieServiceUpdateRequest: description: Update request for an Opsgenie service. properties: data: $ref: "#/components/schemas/OpsgenieServiceUpdateData" required: - data type: object OpsgenieServicesResponse: description: Response with a list of Opsgenie services. properties: data: description: An array of Opsgenie services. example: [{"attributes": {"custom_url": null, "name": "fake-opsgenie-service-name", "region": "us"}, "id": "596da4af-0563-4097-90ff-07230c3f9db3", "type": "opsgenie-service"}, {"attributes": {"custom_url": null, "name": "fake-opsgenie-service-name-2", "region": "eu"}, "id": "0d2937f1-b561-44fa-914a-99910f848014", "type": "opsgenie-service"}] items: $ref: "#/components/schemas/OpsgenieServiceResponseData" type: array required: - data type: object OrderDirection: description: The sort direction for results. enum: - asc - desc example: asc type: string x-enum-varnames: - ASC - DESC OrgAttributes: description: Attributes of an organization. properties: created_at: description: The creation timestamp of the organization. example: "2019-09-26T17:28:28Z" format: date-time type: string description: description: A description of the organization. example: "Production organization." type: string disabled: description: Whether the organization is disabled. example: false type: boolean modified_at: description: The last modification timestamp of the organization. example: "2024-01-15T10:30:00Z" format: date-time type: string name: description: The name of the organization. example: "My Organization" type: string public_id: description: The public identifier of the organization. example: "abcdef12345" type: string sharing: description: The sharing setting of the organization. example: "none" type: string url: description: The URL of the organization. example: "https://app.datadoghq.com/account/my-org" type: string required: - public_id - name - description - sharing - url - disabled - created_at - modified_at type: object OrgAuthorizedClientAttributes: description: Attributes of an org authorized client. properties: disabled: description: Whether the organization has disabled this client. example: false type: boolean last_exercised: description: The date and time this client was last exercised. example: "2024-01-15T10:30:00+00:00" format: date-time nullable: true type: string user_count: description: The number of users in the organization who have authorized this client. example: 2 format: int64 type: integer required: - last_exercised - disabled - user_count type: object OrgAuthorizedClientData: description: Data object representing an org authorized client. properties: attributes: $ref: "#/components/schemas/OrgAuthorizedClientAttributes" id: description: The unique identifier of the org authorized client. example: "00000000-0000-0000-0000-000000000001" type: string relationships: $ref: "#/components/schemas/OrgAuthorizedClientRelationships" type: $ref: "#/components/schemas/OrgAuthorizedClientType" required: - id - type - attributes - relationships type: object OrgAuthorizedClientDataList: description: List of org authorized client data objects. items: $ref: "#/components/schemas/OrgAuthorizedClientData" type: array OrgAuthorizedClientRelationshipOAuth2Client: description: Relationship to the OAuth2 client for this org authorized client. properties: data: $ref: "#/components/schemas/OrgAuthorizedClientRelationshipOAuth2ClientData" required: - data type: object OrgAuthorizedClientRelationshipOAuth2ClientData: description: Data identifying the OAuth2 client associated with this org authorized client. properties: id: description: The ID of the OAuth2 client. example: "00000000-0000-0000-0000-000000000010" type: string type: $ref: "#/components/schemas/OrgAuthorizedClientRelationshipOAuth2ClientDataType" required: - type - id type: object OrgAuthorizedClientRelationshipOAuth2ClientDataType: description: OAuth2 client resource type. enum: - oauth2_clients example: oauth2_clients type: string x-enum-varnames: - OAUTH2_CLIENTS OrgAuthorizedClientRelationshipUserAuthorizedClients: description: Relationship to the user authorized clients for this org authorized client. properties: data: $ref: "#/components/schemas/OrgAuthorizedClientRelationshipUserAuthorizedClientsDataList" links: $ref: "#/components/schemas/OrgAuthorizedClientRelationshipUserAuthorizedClientsLinks" required: - links - data type: object OrgAuthorizedClientRelationshipUserAuthorizedClientsData: description: Data identifying a user authorized client. properties: id: description: The ID of the user authorized client. example: "00000000-0000-0000-0000-000000000020" type: string type: $ref: "#/components/schemas/OrgAuthorizedClientRelationshipUserAuthorizedClientsDataType" required: - type - id type: object OrgAuthorizedClientRelationshipUserAuthorizedClientsDataList: description: List of user authorized client relationship data objects. items: $ref: "#/components/schemas/OrgAuthorizedClientRelationshipUserAuthorizedClientsData" type: array OrgAuthorizedClientRelationshipUserAuthorizedClientsDataType: description: User authorized client resource type. enum: - user_authorized_clients example: user_authorized_clients type: string x-enum-varnames: - USER_AUTHORIZED_CLIENTS OrgAuthorizedClientRelationshipUserAuthorizedClientsLinks: description: Links for the user authorized clients relationship. properties: related: description: Link to the user authorized clients for this org authorized client. example: "/api/v2/org_authorized_clients/00000000-0000-0000-0000-000000000001/user_authorized_clients" type: string required: - related type: object OrgAuthorizedClientRelationships: description: Relationships for an org authorized client. properties: oauth2_client: $ref: "#/components/schemas/OrgAuthorizedClientRelationshipOAuth2Client" user_authorized_clients: $ref: "#/components/schemas/OrgAuthorizedClientRelationshipUserAuthorizedClients" required: - oauth2_client - user_authorized_clients type: object OrgAuthorizedClientResponse: description: Response containing a single org authorized client. properties: data: $ref: "#/components/schemas/OrgAuthorizedClientData" required: - data type: object OrgAuthorizedClientType: description: The resource type for org authorized clients. enum: - org_authorized_clients example: org_authorized_clients type: string x-enum-varnames: - ORG_AUTHORIZED_CLIENTS OrgAuthorizedClientUpdateAttributes: description: Attributes for updating an org authorized client. properties: disabled: description: Whether to disable or enable this client for the organization. example: true type: boolean type: object OrgAuthorizedClientUpdateData: description: Data object for updating an org authorized client. properties: attributes: $ref: "#/components/schemas/OrgAuthorizedClientUpdateAttributes" id: description: The unique identifier of the org authorized client to update. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/OrgAuthorizedClientType" required: - id - type type: object OrgAuthorizedClientUpdateRequest: description: Request body for updating an org authorized client. properties: data: $ref: "#/components/schemas/OrgAuthorizedClientUpdateData" required: - data type: object OrgAuthorizedClientUserAuthorizationsSort: description: Field to sort user authorizations by. enum: - user.name - user.email - oauth2_client.name example: user.name type: string x-enum-varnames: - USER_NAME - USER_EMAIL - OAUTH2_CLIENT_NAME OrgAuthorizedClientsResponse: description: Response containing a list of org authorized clients. properties: data: $ref: "#/components/schemas/OrgAuthorizedClientDataList" meta: $ref: "#/components/schemas/ResponseMetaAttributes" required: - data - meta type: object OrgConfigGetResponse: description: A response with a single Org Config. properties: data: $ref: "#/components/schemas/OrgConfigRead" required: [data] type: object OrgConfigListResponse: description: A response with multiple Org Configs. properties: data: description: An array of Org Configs. items: $ref: "#/components/schemas/OrgConfigRead" type: array required: [data] type: object OrgConfigRead: description: A single Org Config. properties: attributes: $ref: "#/components/schemas/OrgConfigReadAttributes" id: description: A unique identifier for an Org Config. example: abcd1234 type: string type: $ref: "#/components/schemas/OrgConfigType" required: [id, type, attributes] type: object OrgConfigReadAttributes: description: Readable attributes of an Org Config. properties: description: description: The description of an Org Config. example: Frobulate the turbo encabulator manifold type: string modified_at: description: The timestamp of the last Org Config update (if any). format: date-time nullable: true type: string name: description: The machine-friendly name of an Org Config. example: monitor_timezone type: string value: description: The value of an Org Config. value_type: description: The type of an Org Config value. example: bool type: string required: [name, description, value_type, value] type: object OrgConfigType: description: Data type of an Org Config. enum: [org_configs] example: org_configs type: string x-enum-varnames: - ORG_CONFIGS OrgConfigWrite: description: An Org Config write operation. properties: attributes: $ref: "#/components/schemas/OrgConfigWriteAttributes" type: $ref: "#/components/schemas/OrgConfigType" required: [type, attributes] type: object OrgConfigWriteAttributes: description: Writable attributes of an Org Config. properties: value: description: The value of an Org Config. required: [value] type: object OrgConfigWriteRequest: description: A request to update an Org Config. properties: data: $ref: "#/components/schemas/OrgConfigWrite" required: [data] type: object OrgConnection: description: An org connection. properties: attributes: $ref: "#/components/schemas/OrgConnectionAttributes" id: description: The unique identifier of the org connection. example: "f9ec96b0-8c8a-4b0a-9b0a-1b2c3d4e5f6a" format: uuid type: string relationships: $ref: "#/components/schemas/OrgConnectionRelationships" type: $ref: "#/components/schemas/OrgConnectionType" required: [id, type, attributes, relationships] type: object OrgConnectionAttributes: description: Org connection attributes. properties: connection_types: description: List of connection types. example: ["logs", "metrics"] items: $ref: "#/components/schemas/OrgConnectionTypeEnum" type: array created_at: description: Timestamp when the connection was created. example: "2023-01-01T12:00:00Z" format: date-time type: string required: [connection_types, created_at] type: object OrgConnectionCreate: description: Org connection creation data. properties: attributes: $ref: "#/components/schemas/OrgConnectionCreateAttributes" relationships: $ref: "#/components/schemas/OrgConnectionCreateRelationships" type: $ref: "#/components/schemas/OrgConnectionType" required: [type, attributes, relationships] type: object OrgConnectionCreateAttributes: description: Attributes for creating an org connection. properties: connection_types: description: List of connection types to establish. example: ["logs"] items: $ref: "#/components/schemas/OrgConnectionTypeEnum" minItems: 1 type: array required: [connection_types] type: object OrgConnectionCreateRelationships: description: Relationships for org connection creation. properties: sink_org: $ref: "#/components/schemas/OrgConnectionOrgRelationship" required: [sink_org] type: object OrgConnectionCreateRequest: description: Request to create an org connection. properties: data: $ref: "#/components/schemas/OrgConnectionCreate" required: [data] type: object OrgConnectionListResponse: description: Response containing a list of org connections. properties: data: description: List of org connections. items: $ref: "#/components/schemas/OrgConnection" type: array meta: $ref: "#/components/schemas/OrgConnectionListResponseMeta" required: [data] type: object OrgConnectionListResponseMeta: description: Pagination metadata. properties: page: $ref: "#/components/schemas/OrgConnectionListResponseMetaPage" type: object OrgConnectionListResponseMetaPage: description: Page information. properties: total_count: description: Total number of org connections. example: 0 format: int64 type: integer total_filtered_count: description: Total number of org connections matching the filter. example: 0 format: int64 type: integer type: object OrgConnectionOrgRelationship: description: Org relationship. properties: data: $ref: "#/components/schemas/OrgConnectionOrgRelationshipData" type: object OrgConnectionOrgRelationshipData: description: The definition of `OrgConnectionOrgRelationshipData` object. properties: id: description: Org UUID. example: "f9ec96b0-8c8a-4b0a-9b0a-1b2c3d4e5f6a" type: string name: description: Org name. example: "Example Org" type: string type: $ref: "#/components/schemas/OrgConnectionOrgRelationshipDataType" type: object OrgConnectionOrgRelationshipDataType: description: The type of the organization relationship. enum: [orgs] example: "orgs" type: string x-enum-varnames: - ORGS OrgConnectionRelationships: description: Related organizations and user. properties: created_by: $ref: "#/components/schemas/OrgConnectionUserRelationship" sink_org: $ref: "#/components/schemas/OrgConnectionOrgRelationship" source_org: $ref: "#/components/schemas/OrgConnectionOrgRelationship" type: object OrgConnectionResponse: description: Response containing a single org connection. properties: data: $ref: "#/components/schemas/OrgConnection" required: [data] type: object OrgConnectionType: description: Org connection type. enum: [org_connection] example: "org_connection" type: string x-enum-varnames: - ORG_CONNECTION OrgConnectionTypeEnum: description: Available connection types between organizations. enum: - logs - metrics - audit - ci_pipelines - ci_tests example: "logs" type: string x-enum-varnames: - LOGS - METRICS - AUDIT - CI_PIPELINES - CI_TESTS OrgConnectionUpdate: description: Org connection update data. properties: attributes: $ref: "#/components/schemas/OrgConnectionUpdateAttributes" id: description: The unique identifier of the org connection. example: "f9ec96b0-8c8a-4b0a-9b0a-1b2c3d4e5f6a" format: uuid type: string type: $ref: "#/components/schemas/OrgConnectionType" required: [type, id, attributes] type: object OrgConnectionUpdateAttributes: description: Attributes for updating an org connection. properties: connection_types: description: Updated list of connection types. example: ["logs", "metrics"] items: $ref: "#/components/schemas/OrgConnectionTypeEnum" minItems: 1 type: array required: [connection_types] type: object OrgConnectionUpdateRequest: description: Request to update an org connection. properties: data: $ref: "#/components/schemas/OrgConnectionUpdate" required: [data] type: object OrgConnectionUserRelationship: description: User relationship. properties: data: $ref: "#/components/schemas/OrgConnectionUserRelationshipData" type: object OrgConnectionUserRelationshipData: description: The data for a user relationship. properties: id: description: User UUID. example: "usr123abc456" type: string name: description: User name. example: "John Doe" type: string type: $ref: "#/components/schemas/OrgConnectionUserRelationshipDataType" type: object OrgConnectionUserRelationshipDataType: description: The type of the user relationship. enum: [users] example: "users" type: string x-enum-varnames: - USERS OrgData: description: An organization resource. properties: attributes: $ref: "#/components/schemas/OrgAttributes" id: description: The UUID of the organization. example: "4dee724d-00cc-11ea-a77b-570c9d03c6c5" format: uuid type: string type: $ref: "#/components/schemas/OrgResourceType" required: - id - type - attributes type: object OrgGroupAttributes: description: Attributes of an org group. properties: created_at: description: Timestamp when the org group was created. example: "2024-01-15T10:30:00Z" format: date-time type: string modified_at: description: Timestamp when the org group was last modified. example: "2024-01-15T10:30:00Z" format: date-time type: string name: description: The name of the org group. example: "My Org Group" type: string owner_org_site: description: The site of the organization that owns this org group. example: "us1" type: string owner_org_uuid: description: The UUID of the organization that owns this org group. example: "b2c3d4e5-f6a7-8901-bcde-f01234567890" format: uuid type: string required: - name - owner_org_uuid - owner_org_site - created_at - modified_at type: object OrgGroupCreateAttributes: description: Attributes for creating an org group. properties: name: description: The name of the org group. example: "My Org Group" type: string required: - name type: object OrgGroupCreateData: description: Data for creating an org group. properties: attributes: $ref: "#/components/schemas/OrgGroupCreateAttributes" type: $ref: "#/components/schemas/OrgGroupType" required: - type - attributes type: object OrgGroupCreateRequest: description: Request to create an org group. properties: data: $ref: "#/components/schemas/OrgGroupCreateData" required: - data type: object OrgGroupData: description: An org group resource. properties: attributes: $ref: "#/components/schemas/OrgGroupAttributes" id: description: The ID of the org group. example: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" format: uuid type: string type: $ref: "#/components/schemas/OrgGroupType" required: - id - type - attributes type: object OrgGroupListResponse: description: Response containing a list of org groups. properties: data: description: An array of org groups. items: $ref: "#/components/schemas/OrgGroupData" type: array links: $ref: "#/components/schemas/OrgGroupPaginationLinks" meta: $ref: "#/components/schemas/OrgGroupPaginationMeta" required: - data type: object OrgGroupMembershipAttributes: description: Attributes of an org group membership. properties: created_at: description: Timestamp when the membership was created. example: "2024-01-15T10:30:00Z" format: date-time type: string modified_at: description: Timestamp when the membership was last modified. example: "2024-01-15T10:30:00Z" format: date-time type: string org_name: description: The name of the member organization. example: "Acme Corp" type: string org_site: description: The site of the member organization. example: "us1" type: string org_uuid: description: The UUID of the member organization. example: "c3d4e5f6-a7b8-9012-cdef-012345678901" format: uuid type: string required: - org_name - org_uuid - org_site - created_at - modified_at type: object OrgGroupMembershipBulkDeleteRequest: description: Request to delete a batch of org group memberships. properties: data: description: >- The memberships to delete, specified as membership resource identifiers. Each request must include between 1 and 100 unique membership IDs. items: $ref: "#/components/schemas/OrgGroupMembershipBulkDeleteRequestData" maxItems: 100 minItems: 1 type: array uniqueItems: true required: - data type: object OrgGroupMembershipBulkDeleteRequestData: description: A resource identifier for an org group membership to delete. properties: id: description: The ID of the org group membership. example: "f1e2d3c4-b5a6-7890-1234-567890abcdef" format: uuid type: string type: $ref: "#/components/schemas/OrgGroupMembershipType" required: - id - type type: object OrgGroupMembershipBulkUpdateAttributes: description: Attributes for bulk updating org group memberships. properties: orgs: description: >- List of organizations to move. Each request must include between 1 and 100 organizations. Each `org_uuid` and `org_site` pair must be unique. items: $ref: "#/components/schemas/GlobalOrgIdentifier" maxItems: 100 minItems: 1 type: array uniqueItems: true required: - orgs type: object OrgGroupMembershipBulkUpdateData: description: Data for bulk updating org group memberships. properties: attributes: $ref: "#/components/schemas/OrgGroupMembershipBulkUpdateAttributes" relationships: $ref: "#/components/schemas/OrgGroupMembershipBulkUpdateRelationships" type: $ref: "#/components/schemas/OrgGroupMembershipBulkUpdateType" required: - type - attributes - relationships type: object OrgGroupMembershipBulkUpdateRelationships: description: Relationships for bulk updating memberships. properties: source_org_group: $ref: "#/components/schemas/OrgGroupRelationshipToOne" target_org_group: $ref: "#/components/schemas/OrgGroupRelationshipToOne" required: - source_org_group - target_org_group type: object OrgGroupMembershipBulkUpdateRequest: description: Request to bulk update org group memberships. properties: data: $ref: "#/components/schemas/OrgGroupMembershipBulkUpdateData" required: - data type: object OrgGroupMembershipBulkUpdateType: description: Org group membership bulk update resource type. enum: - org_group_membership_bulk_updates example: org_group_membership_bulk_updates type: string x-enum-varnames: - ORG_GROUP_MEMBERSHIP_BULK_UPDATES OrgGroupMembershipCreateAttributes: description: Attributes for adding organizations to an org group. properties: orgs: description: >- List of organizations to add. Each request must include between 1 and 100 organizations. Each `org_uuid` and `org_site` pair must be unique. items: $ref: "#/components/schemas/GlobalOrgIdentifier" maxItems: 100 minItems: 1 type: array uniqueItems: true required: - orgs type: object OrgGroupMembershipCreateData: description: Data for adding organizations to an org group. properties: attributes: $ref: "#/components/schemas/OrgGroupMembershipCreateAttributes" relationships: $ref: "#/components/schemas/OrgGroupMembershipCreateRelationships" type: $ref: "#/components/schemas/OrgGroupMembershipType" required: - type - attributes - relationships type: object OrgGroupMembershipCreateRelationships: description: Relationships for adding organizations to an org group. properties: org_group: $ref: "#/components/schemas/OrgGroupRelationshipToOne" required: - org_group type: object OrgGroupMembershipCreateRequest: description: Request to add organizations to an org group. properties: data: $ref: "#/components/schemas/OrgGroupMembershipCreateData" required: - data type: object OrgGroupMembershipData: description: An org group membership resource. properties: attributes: $ref: "#/components/schemas/OrgGroupMembershipAttributes" id: description: The ID of the org group membership. example: "f1e2d3c4-b5a6-7890-1234-567890abcdef" format: uuid type: string relationships: $ref: "#/components/schemas/OrgGroupMembershipRelationships" type: $ref: "#/components/schemas/OrgGroupMembershipType" required: - id - type - attributes type: object OrgGroupMembershipListResponse: description: Response containing a list of org group memberships. properties: data: description: An array of org group memberships. items: $ref: "#/components/schemas/OrgGroupMembershipData" type: array links: $ref: "#/components/schemas/OrgGroupPaginationLinks" meta: $ref: "#/components/schemas/OrgGroupPaginationMeta" required: - data type: object OrgGroupMembershipRelationships: description: Relationships of an org group membership. properties: org_group: $ref: "#/components/schemas/OrgGroupRelationshipToOne" type: object OrgGroupMembershipResponse: description: Response containing a single org group membership. properties: data: $ref: "#/components/schemas/OrgGroupMembershipData" required: - data type: object OrgGroupMembershipSortOption: default: uuid description: Field to sort memberships by. enum: - name - -name - uuid - -uuid example: uuid type: string x-enum-varnames: - NAME - MINUS_NAME - UUID - MINUS_UUID OrgGroupMembershipType: description: Org group memberships resource type. enum: - org_group_memberships example: org_group_memberships type: string x-enum-varnames: - ORG_GROUP_MEMBERSHIPS OrgGroupMembershipUpdateData: description: Data for updating an org group membership. properties: id: description: The ID of the membership. example: "f1e2d3c4-b5a6-7890-1234-567890abcdef" format: uuid type: string relationships: $ref: "#/components/schemas/OrgGroupMembershipUpdateRelationships" type: $ref: "#/components/schemas/OrgGroupMembershipType" required: - id - type - relationships type: object OrgGroupMembershipUpdateRelationships: description: Relationships for updating a membership. properties: org_group: $ref: "#/components/schemas/OrgGroupRelationshipToOne" required: - org_group type: object OrgGroupMembershipUpdateRequest: description: Request to update an org group membership. properties: data: $ref: "#/components/schemas/OrgGroupMembershipUpdateData" required: - data type: object OrgGroupPaginationLinks: description: Pagination links for navigating between pages of an org group list response. properties: first: description: Link to the first page. type: string last: description: Link to the last page. type: string next: description: Link to the next page. nullable: true type: string prev: description: Link to the previous page. nullable: true type: string self: description: Link to the current page. type: string type: object OrgGroupPaginationMeta: description: Pagination metadata for org group list responses. properties: page: $ref: "#/components/schemas/OrgGroupPaginationMetaPage" type: object OrgGroupPaginationMetaPage: description: Page-based pagination details for org group list responses. properties: first_number: description: First page number. format: int64 type: integer last_number: description: Last page number. format: int64 nullable: true type: integer next_number: description: Next page number. format: int64 nullable: true type: integer number: description: Page number. format: int64 type: integer prev_number: description: Previous page number. format: int64 nullable: true type: integer size: description: Page size. format: int64 type: integer total: description: Total number of results. format: int64 type: integer type: description: Pagination type. example: "number_size" type: string type: object OrgGroupPolicyAttributes: description: Attributes of an org group policy. properties: content: additionalProperties: {} description: >- The policy content as key-value pairs. For `org_config` policies, an arbitrary key-value map (for example, `{"value": "UTC"}`). For `role` policies, a `permissions` key containing an array of permission UUIDs (for example, `{"permissions": ["", ...]}`). example: value: "UTC" type: object enforcement_tier: $ref: "#/components/schemas/OrgGroupPolicyEnforcementTier" modified_at: description: Timestamp when the policy was last modified. example: "2024-01-15T10:30:00Z" format: date-time type: string policy_name: description: >- The name of the policy. This becomes the name of the resource created across orgs in the group (for example, for `role` policies, the name of the created role). example: "monitor_timezone" type: string policy_type: $ref: "#/components/schemas/OrgGroupPolicyPolicyType" required: - policy_name - policy_type - enforcement_tier - modified_at type: object OrgGroupPolicyConfigAttributes: description: Attributes of an org group policy config. properties: allowed_values: description: The allowed values for this config. example: ["UTC", "US/Eastern", "US/Pacific"] items: description: An allowed value for this config. type: string type: array default_value: description: The default value for this config. example: "UTC" description: description: The description of the policy config. example: "The default timezone for monitors." type: string name: description: The name of the policy config. example: "monitor_timezone" type: string value_type: description: The type of the value for this config. example: "string" type: string required: - name - description - value_type - allowed_values - default_value type: object OrgGroupPolicyConfigData: description: An org group policy config resource. properties: attributes: $ref: "#/components/schemas/OrgGroupPolicyConfigAttributes" id: description: The identifier of the policy config (uses the config name). example: "monitor_timezone" type: string type: $ref: "#/components/schemas/OrgGroupPolicyConfigType" required: - id - type - attributes type: object OrgGroupPolicyConfigListResponse: description: Response containing a list of org group policy configs. properties: data: description: An array of org group policy configs. items: $ref: "#/components/schemas/OrgGroupPolicyConfigData" type: array required: - data type: object OrgGroupPolicyConfigType: description: Org group policy configs resource type. enum: - org_group_policy_configs example: org_group_policy_configs type: string x-enum-varnames: - ORG_GROUP_POLICY_CONFIGS OrgGroupPolicyCreateAttributes: description: >- Attributes for creating an org group policy. If `policy_type` is not provided, it defaults to `org_config`. `enforcement_tier` is optional; if not provided, the resulting value depends on `policy_type` and is otherwise unspecified. properties: content: additionalProperties: {} description: >- The policy content as key-value pairs. For `org_config` policies, an arbitrary key-value map (for example, `{"value": "UTC"}`). For `role` policies, a `permissions` key containing an array of permission UUIDs (for example, `{"permissions": ["", ...]}`). example: value: "UTC" type: object enforcement_tier: $ref: "#/components/schemas/OrgGroupPolicyEnforcementTier" policy_name: description: >- The name of the policy. This becomes the name of the resource created across orgs in the group (for example, for `role` policies, the name of the created role). example: "monitor_timezone" type: string policy_type: $ref: "#/components/schemas/OrgGroupPolicyPolicyType" required: - policy_name - content type: object OrgGroupPolicyCreateData: description: Data for creating an org group policy. properties: attributes: $ref: "#/components/schemas/OrgGroupPolicyCreateAttributes" relationships: $ref: "#/components/schemas/OrgGroupPolicyCreateRelationships" type: $ref: "#/components/schemas/OrgGroupPolicyType" required: - type - attributes - relationships type: object OrgGroupPolicyCreateRelationships: description: Relationships for creating a policy. properties: org_group: $ref: "#/components/schemas/OrgGroupRelationshipToOne" required: - org_group type: object OrgGroupPolicyCreateRequest: description: Request to create an org group policy. properties: data: $ref: "#/components/schemas/OrgGroupPolicyCreateData" required: - data type: object OrgGroupPolicyData: description: An org group policy resource. properties: attributes: $ref: "#/components/schemas/OrgGroupPolicyAttributes" id: description: The ID of the org group policy. example: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" format: uuid type: string relationships: $ref: "#/components/schemas/OrgGroupPolicyRelationships" type: $ref: "#/components/schemas/OrgGroupPolicyType" required: - id - type - attributes type: object OrgGroupPolicyEnforcementTier: description: >- The enforcement tier of the policy. `OVERRIDE_ALLOWED` means the policy is set but member orgs may mutate it. `GROUP_MANAGED` means the policy is strictly controlled and mutations are blocked for affected orgs. `DELEGATE` means each member org controls its own value. `role` policies only support `GROUP_MANAGED` and `DELEGATE` — `OVERRIDE_ALLOWED` is rejected for this policy type. Transitioning a `role` policy to `DELEGATE` (disabling it) is one-way — the policy cannot be transitioned back to `GROUP_MANAGED` afterward. enum: - OVERRIDE_ALLOWED - GROUP_MANAGED - DELEGATE example: OVERRIDE_ALLOWED type: string x-enum-varnames: - OVERRIDE_ALLOWED - GROUP_MANAGED - DELEGATE OrgGroupPolicyFilterPolicyTypeValue: description: >- The type of the policy to filter by. `org_config` indicates a policy backed by an organization configuration setting. `role` indicates a policy backed by a Datadog custom role. enum: - org_config - role example: org_config type: string x-enum-varnames: - ORG_CONFIG - ROLE OrgGroupPolicyListResponse: description: Response containing a list of org group policies. properties: data: description: An array of org group policies. items: $ref: "#/components/schemas/OrgGroupPolicyData" type: array links: $ref: "#/components/schemas/OrgGroupPaginationLinks" meta: $ref: "#/components/schemas/OrgGroupPaginationMeta" required: - data type: object OrgGroupPolicyOverrideAttributes: description: Attributes of an org group policy override. properties: content: additionalProperties: {} description: The override content as key-value pairs. type: object created_at: description: Timestamp when the override was created. example: "2024-01-15T10:30:00Z" format: date-time type: string modified_at: description: Timestamp when the override was last modified. example: "2024-01-15T10:30:00Z" format: date-time type: string org_site: description: The site of the organization that has the override. example: "us1" type: string org_uuid: description: The UUID of the organization that has the override. example: "c3d4e5f6-a7b8-9012-cdef-012345678901" format: uuid type: string required: - org_uuid - org_site - created_at - modified_at type: object OrgGroupPolicyOverrideCreateAttributes: description: Attributes for creating a policy override. properties: org_site: description: The site of the organization. example: "us1" type: string org_uuid: description: The UUID of the organization to grant the override. example: "c3d4e5f6-a7b8-9012-cdef-012345678901" format: uuid type: string required: - org_uuid - org_site type: object OrgGroupPolicyOverrideCreateData: description: Data for creating an org group policy override. properties: attributes: $ref: "#/components/schemas/OrgGroupPolicyOverrideCreateAttributes" relationships: $ref: "#/components/schemas/OrgGroupPolicyOverrideCreateRelationships" type: $ref: "#/components/schemas/OrgGroupPolicyOverrideType" required: - type - attributes - relationships type: object OrgGroupPolicyOverrideCreateRelationships: description: Relationships for creating a policy override. properties: org_group: $ref: "#/components/schemas/OrgGroupRelationshipToOne" org_group_policy: $ref: "#/components/schemas/OrgGroupPolicyRelationshipToOne" required: - org_group - org_group_policy type: object OrgGroupPolicyOverrideCreateRequest: description: Request to create an org group policy override. properties: data: $ref: "#/components/schemas/OrgGroupPolicyOverrideCreateData" required: - data type: object OrgGroupPolicyOverrideData: description: An org group policy override resource. properties: attributes: $ref: "#/components/schemas/OrgGroupPolicyOverrideAttributes" id: description: The ID of the policy override. example: "9f8e7d6c-5b4a-3210-fedc-ba0987654321" format: uuid type: string relationships: $ref: "#/components/schemas/OrgGroupPolicyOverrideRelationships" type: $ref: "#/components/schemas/OrgGroupPolicyOverrideType" required: - id - type - attributes type: object OrgGroupPolicyOverrideListResponse: description: Response containing a list of org group policy overrides. properties: data: description: An array of org group policy overrides. items: $ref: "#/components/schemas/OrgGroupPolicyOverrideData" type: array links: $ref: "#/components/schemas/OrgGroupPaginationLinks" meta: $ref: "#/components/schemas/OrgGroupPaginationMeta" required: - data type: object OrgGroupPolicyOverrideRelationships: description: Relationships of an org group policy override. properties: org_group: $ref: "#/components/schemas/OrgGroupRelationshipToOne" org_group_policy: $ref: "#/components/schemas/OrgGroupPolicyRelationshipToOne" type: object OrgGroupPolicyOverrideResponse: description: Response containing a single org group policy override. properties: data: $ref: "#/components/schemas/OrgGroupPolicyOverrideData" required: - data type: object OrgGroupPolicyOverrideSortOption: default: id description: Field to sort overrides by. enum: - id - -id - org_uuid - -org_uuid example: id type: string x-enum-varnames: - ID - MINUS_ID - ORG_UUID - MINUS_ORG_UUID OrgGroupPolicyOverrideType: description: Org group policy overrides resource type. enum: - org_group_policy_overrides example: org_group_policy_overrides type: string x-enum-varnames: - ORG_GROUP_POLICY_OVERRIDES OrgGroupPolicyOverrideUpdateAttributes: description: >- Attributes for updating a policy override. The `org_uuid` and `org_site` fields must match the existing override and cannot be changed. properties: org_site: description: The site of the organization. example: "us1" type: string org_uuid: description: The UUID of the organization. example: "c3d4e5f6-a7b8-9012-cdef-012345678901" format: uuid type: string required: - org_uuid - org_site type: object OrgGroupPolicyOverrideUpdateData: description: Data for updating a policy override. properties: attributes: $ref: "#/components/schemas/OrgGroupPolicyOverrideUpdateAttributes" id: description: The ID of the policy override. example: "9f8e7d6c-5b4a-3210-fedc-ba0987654321" format: uuid type: string type: $ref: "#/components/schemas/OrgGroupPolicyOverrideType" required: - id - type - attributes type: object OrgGroupPolicyOverrideUpdateRequest: description: Request to update an org group policy override. properties: data: $ref: "#/components/schemas/OrgGroupPolicyOverrideUpdateData" required: - data type: object OrgGroupPolicyPolicyType: default: org_config description: >- The type of the policy. `org_config` indicates a policy backed by an organization configuration setting. `role` indicates a policy backed by a Datadog custom role. enum: - org_config - role example: org_config type: string x-enum-varnames: - ORG_CONFIG - ROLE OrgGroupPolicyRelationshipToOne: description: Relationship to a single org group policy. properties: data: $ref: "#/components/schemas/OrgGroupPolicyRelationshipToOneData" required: - data type: object OrgGroupPolicyRelationshipToOneData: description: A reference to an org group policy. properties: id: description: The ID of the policy. example: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" format: uuid type: string type: $ref: "#/components/schemas/OrgGroupPolicyType" required: - id - type type: object OrgGroupPolicyRelationships: description: Relationships of an org group policy. properties: org_group: $ref: "#/components/schemas/OrgGroupRelationshipToOne" type: object OrgGroupPolicyResponse: description: Response containing a single org group policy. properties: data: $ref: "#/components/schemas/OrgGroupPolicyData" required: - data type: object OrgGroupPolicySortOption: default: id description: Field to sort policies by. enum: - id - -id - name - -name example: id type: string x-enum-varnames: - ID - MINUS_ID - NAME - MINUS_NAME OrgGroupPolicySuggestionAttributes: description: Attributes of an org group policy suggestion. properties: consensus_ratio: description: The ratio of member orgs whose configuration agrees on the recommended value. example: 0.75 format: double maximum: 1 minimum: 0 type: number policy_name: description: The name of the suggested policy. example: "monitor_timezone" type: string recommended_value: description: The recommended value for the policy, based on member org consensus. example: "UTC" status: $ref: "#/components/schemas/OrgGroupPolicySuggestionStatus" required: - policy_name - status - consensus_ratio - recommended_value type: object OrgGroupPolicySuggestionData: description: An org group policy suggestion resource. properties: attributes: $ref: "#/components/schemas/OrgGroupPolicySuggestionAttributes" id: description: The ID of the org group policy suggestion. example: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" type: string relationships: $ref: "#/components/schemas/OrgGroupPolicySuggestionRelationships" type: $ref: "#/components/schemas/OrgGroupPolicySuggestionType" required: - id - type - attributes type: object OrgGroupPolicySuggestionListResponse: description: Response containing a list of org group policy suggestions. properties: data: description: An array of org group policy suggestions. items: $ref: "#/components/schemas/OrgGroupPolicySuggestionData" type: array required: - data type: object OrgGroupPolicySuggestionRelationships: description: Relationships of an org group policy suggestion. properties: org_group: $ref: "#/components/schemas/OrgGroupRelationshipToOne" type: object OrgGroupPolicySuggestionStatus: description: The status of the policy suggestion. enum: - pending - accepted - dismissed example: pending type: string x-enum-varnames: - PENDING - ACCEPTED - DISMISSED OrgGroupPolicySuggestionType: description: Org group policy suggestions resource type. enum: - org_group_policy_suggestions example: org_group_policy_suggestions type: string x-enum-varnames: - ORG_GROUP_POLICY_SUGGESTIONS OrgGroupPolicyType: description: Org group policies resource type. enum: - org_group_policies example: org_group_policies type: string x-enum-varnames: - ORG_GROUP_POLICIES OrgGroupPolicyUpdateAttributes: description: >- Attributes for updating an org group policy. `policy_name`, `content`, and `enforcement_tier` may be omitted individually to leave them unchanged. properties: content: additionalProperties: {} description: >- The policy content as key-value pairs. For `org_config` policies, an arbitrary key-value map (for example, `{"value": "UTC"}`). For `role` policies, a `permissions` key containing an array of permission UUIDs (for example, `{"permissions": ["", ...]}`). example: value: "UTC" type: object enforcement_tier: $ref: "#/components/schemas/OrgGroupPolicyEnforcementTier" policy_name: description: >- The name of the policy. This becomes the name of the resource created across orgs in the group (for example, for `role` policies, the name of the created role). Omit to leave unchanged. example: "monitor_timezone" type: string type: object OrgGroupPolicyUpdateData: description: Data for updating an org group policy. properties: attributes: $ref: "#/components/schemas/OrgGroupPolicyUpdateAttributes" id: description: The ID of the policy. example: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" format: uuid type: string type: $ref: "#/components/schemas/OrgGroupPolicyType" required: - id - type - attributes type: object OrgGroupPolicyUpdateRequest: description: Request to update an org group policy. properties: data: $ref: "#/components/schemas/OrgGroupPolicyUpdateData" required: - data type: object OrgGroupRelationshipToOne: description: Relationship to a single org group. properties: data: $ref: "#/components/schemas/OrgGroupRelationshipToOneData" required: - data type: object OrgGroupRelationshipToOneData: description: A reference to an org group. properties: id: description: The ID of the org group. example: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" format: uuid type: string type: $ref: "#/components/schemas/OrgGroupType" required: - id - type type: object OrgGroupResponse: description: Response containing a single org group. properties: data: $ref: "#/components/schemas/OrgGroupData" required: - data type: object OrgGroupSortOption: default: uuid description: Field to sort org groups by. enum: - name - -name - uuid - -uuid example: name type: string x-enum-varnames: - NAME - MINUS_NAME - UUID - MINUS_UUID OrgGroupType: description: Org groups resource type. enum: - org_groups example: org_groups type: string x-enum-varnames: - ORG_GROUPS OrgGroupUpdateAttributes: description: Attributes for updating an org group. properties: name: description: The name of the org group. example: "Updated Org Group Name" type: string required: - name type: object OrgGroupUpdateData: description: Data for updating an org group. properties: attributes: $ref: "#/components/schemas/OrgGroupUpdateAttributes" id: description: The ID of the org group. example: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" format: uuid type: string type: $ref: "#/components/schemas/OrgGroupType" required: - id - type - attributes type: object OrgGroupUpdateRequest: description: Request to update an org group. properties: data: $ref: "#/components/schemas/OrgGroupUpdateData" required: - data type: object OrgRelationshipData: description: Reference to an organization resource. properties: id: description: The UUID of the organization. example: "4dee724d-00cc-11ea-a77b-570c9d03c6c5" format: uuid type: string type: $ref: "#/components/schemas/OrgResourceType" required: - id - type type: object OrgResourceType: description: The resource type for organizations. enum: [orgs] example: "orgs" type: string x-enum-varnames: - ORGS OrgSAMLPreferencesAttributes: description: Attributes for updating an organization's SAML preferences. properties: default_role_uuids: description: |- The UUID of the default role assigned to just-in-time provisioned users. Exactly one role UUID must be provided. example: - 8dd1cf3c-0c75-11ea-ad28-fb5701eabc7d items: description: The UUID of a role. example: 8dd1cf3c-0c75-11ea-ad28-fb5701eabc7d format: uuid type: string maxItems: 1 minItems: 1 type: array jit_domains: description: |- Email domains for which users are automatically provisioned on first SAML login (just-in-time provisioning). example: - example.com items: description: An email domain for just-in-time user provisioning. example: example.com maxLength: 256 minLength: 1 type: string maxItems: 50 type: array required: - jit_domains - default_role_uuids type: object OrgSAMLPreferencesData: description: Data for updating an organization's SAML preferences. properties: attributes: $ref: "#/components/schemas/OrgSAMLPreferencesAttributes" id: description: The identifier of the SAML preferences resource. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: "#/components/schemas/OrgSAMLPreferencesType" required: - type - attributes type: object OrgSAMLPreferencesType: default: saml_preferences description: SAML preferences resource type. enum: - saml_preferences example: saml_preferences type: string x-enum-varnames: - SAML_PREFERENCES OrgSAMLPreferencesUpdateRequest: description: Request to update an organization's SAML preferences. properties: data: $ref: "#/components/schemas/OrgSAMLPreferencesData" required: - data type: object Organization: description: Organization object. properties: attributes: $ref: "#/components/schemas/OrganizationAttributes" id: description: ID of the organization. type: string type: $ref: "#/components/schemas/OrganizationsType" required: - type type: object OrganizationAttributes: description: Attributes of the organization. properties: created_at: description: Creation time of the organization. format: date-time type: string description: description: Description of the organization. type: string disabled: description: Whether or not the organization is disabled. type: boolean modified_at: description: Time of last organization modification. format: date-time type: string name: description: Name of the organization. type: string public_id: description: Public ID of the organization. type: string sharing: description: Sharing type of the organization. type: string url: description: URL of the site that this organization exists at. type: string type: object OrganizationsType: default: orgs description: Organizations resource type. enum: - orgs example: orgs type: string x-enum-varnames: - ORGS OutboundEdge: description: The definition of `OutboundEdge` object. properties: branchName: description: The `OutboundEdge` `branchName`. example: main minLength: 1 type: string nextStepName: description: The `OutboundEdge` `nextStepName`. example: Step2 minLength: 1 type: string required: - nextStepName - branchName type: object OutcomeType: default: outcome description: The JSON:API type for an outcome. enum: - outcome example: outcome type: string x-enum-varnames: - OUTCOME OutcomesBatchAttributes: description: The JSON:API attributes for a batched set of scorecard outcomes. properties: results: description: Set of scorecard outcomes to update. items: $ref: "#/components/schemas/OutcomesBatchRequestItem" type: array type: object OutcomesBatchRequest: description: Scorecard outcomes batch request. properties: data: $ref: "#/components/schemas/OutcomesBatchRequestData" type: object OutcomesBatchRequestData: description: Scorecard outcomes batch request data. properties: attributes: $ref: "#/components/schemas/OutcomesBatchAttributes" type: $ref: "#/components/schemas/OutcomesBatchType" type: object OutcomesBatchRequestItem: description: Scorecard outcome for a specific rule, for a given service within a batched update. properties: remarks: description: >- Any remarks regarding the scorecard rule's evaluation, and supports HTML hyperlinks. example: 'See: Services' type: string rule_id: $ref: "#/components/schemas/RuleId" service_name: description: The unique name for a service in the catalog. example: my-service type: string state: $ref: "#/components/schemas/State" required: - rule_id - service_name - state type: object OutcomesBatchResponse: description: Scorecard outcomes batch response. properties: data: $ref: "#/components/schemas/OutcomesBatchResponseData" example: - attributes: service_name: my-service state: pass id: "outcome-abc123" type: rule-outcome meta: $ref: "#/components/schemas/OutcomesBatchResponseMeta" required: - data - meta type: object OutcomesBatchResponseAttributes: description: The JSON:API attributes for an outcome. properties: created_at: description: Creation time of the rule outcome. format: date-time type: string modified_at: description: Time of last rule outcome modification. format: date-time type: string remarks: description: >- Any remarks regarding the scorecard rule's evaluation, and supports HTML hyperlinks. example: 'See: Services' type: string service_name: description: The unique name for a service in the catalog. example: my-service type: string state: $ref: "#/components/schemas/State" type: object OutcomesBatchResponseData: description: List of rule outcomes which were affected during the bulk operation. items: $ref: "#/components/schemas/OutcomesResponseDataItem" type: array OutcomesBatchResponseMeta: description: Metadata pertaining to the bulk operation. properties: total_received: description: Total number of scorecard results received during the bulk operation. format: int64 type: integer total_updated: description: Total number of scorecard results modified during the bulk operation. format: int64 type: integer type: object OutcomesBatchType: default: batched-outcome description: The JSON:API type for scorecard outcomes. enum: [batched-outcome] example: batched-outcome type: string x-enum-varnames: [BATCHED_OUTCOME] OutcomesResponse: description: Scorecard outcomes - the result of a rule for a service. properties: data: $ref: "#/components/schemas/OutcomesResponseData" included: $ref: "#/components/schemas/OutcomesResponseIncluded" links: $ref: "#/components/schemas/OutcomesResponseLinks" meta: $ref: "#/components/schemas/PaginatedResponseMeta" type: object OutcomesResponseData: description: List of rule outcomes. items: $ref: "#/components/schemas/OutcomesResponseDataItem" type: array OutcomesResponseDataItem: description: A single rule outcome. properties: attributes: $ref: "#/components/schemas/OutcomesBatchResponseAttributes" id: description: The unique ID for a rule outcome. type: string relationships: $ref: "#/components/schemas/RuleOutcomeRelationships" type: $ref: "#/components/schemas/OutcomeType" type: object OutcomesResponseIncluded: description: Array of rule details. items: $ref: "#/components/schemas/OutcomesResponseIncludedItem" type: array OutcomesResponseIncludedItem: description: Attributes of the included rule. properties: attributes: $ref: "#/components/schemas/OutcomesResponseIncludedRuleAttributes" id: $ref: "#/components/schemas/RuleId" type: $ref: "#/components/schemas/RuleType" type: object OutcomesResponseIncludedRuleAttributes: description: Details of a rule. properties: name: description: Name of the rule. example: Team Defined type: string scorecard_name: description: The scorecard name to which this rule must belong. example: Observability Best Practices type: string type: object OutcomesResponseLinks: description: Pagination links for rule outcomes. properties: first: description: Link for the first set of results. example: "/api/v2/scorecard/outcomes?include=rule&page%5Blimit%5D=100&page%5Boffset%5D=0" type: string last: description: Link for the last set of results. example: "/api/v2/scorecard/outcomes?include=rule&page%5Blimit%5D=100&page%5Boffset%5D=200" type: string next: description: |- Link for the next set of results. example: "/api/v2/scorecard/outcomes?include=rule&page%5Blimit%5D=100&page%5Boffset%5D=200" type: string previous: description: Link for the previous set of results. example: "/api/v2/scorecard/outcomes?include=rule&page%5Blimit%5D=100&page%5Boffset%5D=0" type: string self: description: Link for the current set of results. example: "/api/v2/scorecard/outcomes?include=rule&page%5Blimit%5D=100&page%5Boffset%5D=100" type: string type: object OutputSchema: description: "A list of output parameters for the workflow." properties: parameters: description: The `OutputSchema` `parameters`. items: $ref: "#/components/schemas/OutputSchemaParameters" type: array type: object OutputSchemaParameters: description: The definition of `OutputSchemaParameters` object. properties: defaultValue: description: The `OutputSchemaParameters` `defaultValue`. description: description: The `OutputSchemaParameters` `description`. type: string label: description: The `OutputSchemaParameters` `label`. type: string name: description: The `OutputSchemaParameters` `name`. example: "" type: string type: $ref: "#/components/schemas/OutputSchemaParametersType" value: description: The `OutputSchemaParameters` `value`. required: - name - type type: object OutputSchemaParametersType: description: The definition of `OutputSchemaParametersType` object. enum: - STRING - NUMBER - BOOLEAN - OBJECT - ARRAY_STRING - ARRAY_NUMBER - ARRAY_BOOLEAN - ARRAY_OBJECT example: STRING type: string x-enum-varnames: - STRING - NUMBER - BOOLEAN - OBJECT - ARRAY_STRING - ARRAY_NUMBER - ARRAY_BOOLEAN - ARRAY_OBJECT OverrideAttributes: description: Attributes for an on-call schedule override. properties: end: description: The end time of the override. format: date-time type: string inactive: description: Whether the override is inactive (for example, because its time range has ended). type: boolean start: description: The start time of the override. format: date-time type: string type: object OverrideCreateResponse: description: The on-call schedule overrides that were created, and any related included resources (such as users). example: data: - attributes: end: "2024-01-08T02:53:01.000000000Z" inactive: false start: "2024-01-07T02:53:01.000000000Z" id: 00000000-0000-0000-0000-000000000000 relationships: schedule: data: id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: schedules user: data: id: 00000000-aba1-0000-0000-000000000000 type: users type: overrides included: - attributes: email: jane.doe@example.com name: "Jane Doe" status: "" id: 00000000-aba1-0000-0000-000000000000 type: users properties: data: description: The on-call schedule overrides that were created. items: $ref: "#/components/schemas/OverrideData" type: array included: description: Related resources referenced in the overrides' relationships, such as users. items: $ref: "#/components/schemas/OverrideIncluded" type: array required: - data type: object OverrideData: description: Data for an on-call schedule override. properties: attributes: $ref: "#/components/schemas/OverrideAttributes" id: description: The unique identifier of the override. example: "00000000-0000-0000-0000-000000000000" type: string relationships: $ref: "#/components/schemas/OverrideRelationships" type: $ref: "#/components/schemas/OverrideDataType" required: - type - id type: object OverrideDataType: default: overrides description: "Indicates that the resource is of type `overrides`." enum: - overrides example: overrides type: string x-enum-varnames: - OVERRIDES OverrideIncluded: description: Included data for on-call schedule override operations. oneOf: - $ref: "#/components/schemas/ScheduleUser" OverrideRelationships: description: Relationships for an on-call schedule override. properties: overridden_user: $ref: "#/components/schemas/OverrideRelationshipsUser" schedule: $ref: "#/components/schemas/OverrideRelationshipsSchedule" user: $ref: "#/components/schemas/OverrideRelationshipsUser" type: object OverrideRelationshipsSchedule: description: "Defines the relationship between an override and the schedule it belongs to." properties: data: $ref: "#/components/schemas/OverrideRelationshipsScheduleData" required: - data type: object OverrideRelationshipsScheduleData: description: "A reference to the schedule the override belongs to, containing the schedule's ID and resource type." properties: id: description: "The unique identifier of the schedule." example: "3653d3c6-0c75-11ea-ad28-fb5701eabc7d" type: string type: $ref: "#/components/schemas/OverrideRelationshipsScheduleDataType" required: - type - id type: object OverrideRelationshipsScheduleDataType: default: schedules description: "Indicates that the related resource is of type `schedules`." enum: - schedules example: schedules type: string x-enum-varnames: - SCHEDULES OverrideRelationshipsUser: description: "Defines the relationship between an override and one of its associated users." properties: data: $ref: "#/components/schemas/OverrideRelationshipsUserData" nullable: true required: - data type: object OverrideRelationshipsUserData: description: "A reference to a user, containing the user's ID and resource type." properties: id: description: "The unique identifier of the user." example: "00000000-0000-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/OverrideRelationshipsUserDataType" required: - type - id type: object OverrideRelationshipsUserDataType: default: users description: "Indicates that the related resource is of type `users`." enum: - users example: users type: string x-enum-varnames: - USERS Overrides: description: A list of on-call schedule overrides and any related included resources (such as users). example: data: - attributes: end: "2024-01-08T02:53:01.000000000Z" inactive: false start: "2024-01-07T02:53:01.000000000Z" id: 00000000-0000-0000-0000-000000000000 relationships: schedule: data: id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: schedules user: data: id: 00000000-aba1-0000-0000-000000000000 type: users type: overrides included: - attributes: email: jane.doe@example.com name: "Jane Doe" status: "" id: 00000000-aba1-0000-0000-000000000000 type: users properties: data: description: A list of on-call schedule overrides. items: $ref: "#/components/schemas/OverrideData" type: array included: description: Related resources referenced in the overrides' relationships, such as users. items: $ref: "#/components/schemas/OverrideIncluded" type: array required: - data type: object OverwriteAllocationsRequest: description: Request to overwrite targeting rules (allocations) for a feature flag in an environment. properties: data: description: Targeting rules (allocations) to replace existing ones with. items: $ref: "#/components/schemas/AllocationDataRequest" type: array required: - data type: object OwnershipConfidenceLevel: description: The ownership confidence level. enum: - high - medium - low example: high type: string x-enum-varnames: - HIGH - MEDIUM - LOW OwnershipEvidenceAttributes: description: The attributes of an ownership evidence response. properties: evidence_versions: $ref: "#/components/schemas/OwnershipEvidenceVersions" required: - evidence_versions type: object OwnershipEvidenceData: description: The data wrapper for an ownership evidence response. properties: attributes: $ref: "#/components/schemas/OwnershipEvidenceAttributes" id: description: The identifier of the resource the evidence applies to. example: test-resource type: string type: $ref: "#/components/schemas/OwnershipEvidenceType" required: - id - type - attributes type: object OwnershipEvidenceResponse: description: The response returned when retrieving the evidence backing an ownership inference for an owner type. properties: data: $ref: "#/components/schemas/OwnershipEvidenceData" required: - data type: object OwnershipEvidenceType: default: ownership_evidence description: The type of the ownership evidence resource. The value should always be `ownership_evidence`. enum: - ownership_evidence example: ownership_evidence type: string x-enum-varnames: - OWNERSHIP_EVIDENCE OwnershipEvidenceVersion: additionalProperties: {} description: A single evidence version entry describing how an inference was produced. example: pipeline_id: p1 version: v3 type: object OwnershipEvidenceVersions: description: The list of evidence versions associated with an inference. example: - pipeline_id: p1 version: v3 items: $ref: "#/components/schemas/OwnershipEvidenceVersion" nullable: true type: array OwnershipFeedbackAction: description: The feedback action to apply to an inference. enum: - confirm - reject - correct - persist example: confirm type: string x-enum-varnames: - CONFIRM - REJECT - CORRECT - PERSIST OwnershipFeedbackRequest: description: The request body for submitting ownership feedback. properties: data: $ref: "#/components/schemas/OwnershipFeedbackRequestData" required: - data type: object OwnershipFeedbackRequestAttributes: description: The attributes of an ownership feedback request. properties: action: $ref: "#/components/schemas/OwnershipFeedbackAction" corrected_owner_handle: description: The corrected owner handle. Required when `action` is `correct`. example: team-b nullable: true type: string corrected_owner_type: description: The corrected owner type. Required when `action` is `correct`. example: team nullable: true type: string inference_checksum: description: The checksum of the inference being acted upon. Must match the current inference checksum or the request returns a conflict. example: abc123 type: string reason: description: An optional free-form reason explaining the feedback. example: Confirmed by team lead. nullable: true type: string required: - action - inference_checksum type: object OwnershipFeedbackRequestData: description: The data wrapper for an ownership feedback request. properties: attributes: $ref: "#/components/schemas/OwnershipFeedbackRequestAttributes" type: $ref: "#/components/schemas/OwnershipFeedbackType" required: - type - attributes type: object OwnershipFeedbackResponse: description: The response returned after applying ownership feedback to an inference. properties: data: $ref: "#/components/schemas/OwnershipFeedbackResultData" required: - data type: object OwnershipFeedbackResultAttributes: description: The attributes of an ownership feedback result. properties: action: $ref: "#/components/schemas/OwnershipFeedbackAction" checksum: description: The checksum of the inference after the feedback was applied. example: abc123 type: string new_status: $ref: "#/components/schemas/OwnershipInferenceStatus" owner_type: $ref: "#/components/schemas/OwnershipOwnerType" previous_status: $ref: "#/components/schemas/OwnershipInferenceStatus" primary_contact_ref: description: The primary contact reference for the inferred owner after the feedback was applied, formatted as `ref:handle/`. example: ref:handle/team-a nullable: true type: string updated_at: description: The time when the inference was updated by the feedback. example: "2026-01-15T10:00:00Z" format: date-time type: string required: - action - previous_status - new_status - owner_type - checksum - updated_at type: object OwnershipFeedbackResultData: description: The data wrapper for an ownership feedback result response. properties: attributes: $ref: "#/components/schemas/OwnershipFeedbackResultAttributes" id: description: The identifier of the resource that the feedback was applied to. example: res-1 type: string type: $ref: "#/components/schemas/OwnershipFeedbackResultType" required: - id - type - attributes type: object OwnershipFeedbackResultType: default: ownership_feedback_result description: The type of the ownership feedback result resource. The value should always be `ownership_feedback_result`. enum: - ownership_feedback_result example: ownership_feedback_result type: string x-enum-varnames: - OWNERSHIP_FEEDBACK_RESULT OwnershipFeedbackType: default: ownership_feedback description: The type of the ownership feedback request resource. The value should always be `ownership_feedback`. enum: - ownership_feedback example: ownership_feedback type: string x-enum-varnames: - OWNERSHIP_FEEDBACK OwnershipHistoryAttributes: description: The attributes of an ownership history response. properties: items: $ref: "#/components/schemas/OwnershipHistoryItems" pagination: $ref: "#/components/schemas/OwnershipHistoryPagination" required: - items - pagination type: object OwnershipHistoryData: description: The data wrapper for an ownership history response. properties: attributes: $ref: "#/components/schemas/OwnershipHistoryAttributes" id: description: The resource identifier for which history is returned. example: res-1 type: string type: $ref: "#/components/schemas/OwnershipHistoryType" required: - id - type - attributes type: object OwnershipHistoryItem: description: A single ownership inference history entry. properties: checksum: description: A checksum identifying the state of the inference at this point in time. example: "" type: string confidence: description: The confidence score of the inference, expressed as a numeric string with up to four decimal places. example: "0.9000" type: string created_at: description: The time this history entry was created. example: "2026-01-15T10:00:00Z" format: date-time type: string evidence_versions: $ref: "#/components/schemas/OwnershipEvidenceVersions" explanation: description: A human-readable explanation of how the inference was produced. example: "" type: string failed_at: description: The time when this inference failed, if applicable. example: "2026-01-15T10:00:00Z" format: date-time nullable: true type: string failure_reason: description: The reason why this inference failed, if applicable. example: missing evidence nullable: true type: string id: description: The unique identifier of the history entry. example: 100 format: int64 type: integer owner_type: $ref: "#/components/schemas/OwnershipOwnerType" primary_contact_ref: description: The primary contact reference for the inferred owner, formatted as `ref:handle/`. example: ref:handle/team-a nullable: true type: string resource_id: description: The identifier of the resource that the inference applies to. example: res-1 type: string retry_schedule: description: The scheduled retry time for a failed inference, if applicable. example: "2026-01-15T11:00:00Z" format: date-time nullable: true type: string sources: $ref: "#/components/schemas/OwnershipInferenceSources" status: $ref: "#/components/schemas/OwnershipInferenceStatus" required: - id - resource_id - owner_type - confidence - explanation - evidence_versions - sources - checksum - status - created_at type: object OwnershipHistoryItems: description: The list of history entries returned for this page. items: $ref: "#/components/schemas/OwnershipHistoryItem" type: array OwnershipHistoryPagination: description: Cursor-based pagination metadata for the history response. properties: has_more: description: Whether more history entries are available beyond this page. example: false type: boolean next_cursor: description: An opaque, base64-encoded cursor token. Pass it as the `cursor` query parameter to retrieve the next page. Absent or `null` when there are no further pages. example: eyJpZCI6OTh9 nullable: true type: string required: - has_more type: object OwnershipHistoryResponse: description: The response returned when listing the inference history for a resource. properties: data: $ref: "#/components/schemas/OwnershipHistoryData" required: - data type: object OwnershipHistoryType: default: ownership_history description: The type of the ownership history resource. The value should always be `ownership_history`. enum: - ownership_history example: ownership_history type: string x-enum-varnames: - OWNERSHIP_HISTORY OwnershipInferenceAttributes: description: The attributes of a single ownership inference. properties: checksum: description: A checksum that uniquely identifies the current state of the inference. Required when submitting feedback. example: abc123 type: string confidence: description: The confidence score of the inference, expressed as a numeric string with up to four decimal places. example: "0.9500" type: string created_at: description: The time when the inference was created. example: "2026-01-15T10:00:00Z" format: date-time type: string evidence_versions: $ref: "#/components/schemas/OwnershipEvidenceVersions" explanation: description: A human-readable explanation of how the inference was produced. example: High confidence match type: string owner_type: $ref: "#/components/schemas/OwnershipOwnerType" primary_contact_ref: description: The primary contact reference for the inferred owner, formatted as `ref:handle/`. example: ref:handle/team-a nullable: true type: string sources: $ref: "#/components/schemas/OwnershipInferenceSources" status: $ref: "#/components/schemas/OwnershipInferenceStatus" updated_at: description: The time when the inference was last updated. example: "2026-01-15T10:00:00Z" format: date-time type: string required: - owner_type - confidence - explanation - evidence_versions - sources - status - checksum - created_at - updated_at type: object OwnershipInferenceData: description: The data wrapper for a single ownership inference response. properties: attributes: $ref: "#/components/schemas/OwnershipInferenceAttributes" id: description: The identifier of the inference, formatted as `resource_id:owner_type`. example: test-resource:team type: string type: $ref: "#/components/schemas/OwnershipInferenceType" required: - id - type - attributes type: object OwnershipInferenceItem: description: A single ownership inference, scoped to a specific owner type. properties: checksum: description: A checksum that uniquely identifies the current state of the inference. Required when submitting feedback. example: abc123 type: string confidence: description: The confidence score of the inference, expressed as a numeric string with up to four decimal places. example: "0.9500" type: string created_at: description: The time when the inference was created. example: "2026-01-15T10:00:00Z" format: date-time type: string evidence_versions: $ref: "#/components/schemas/OwnershipEvidenceVersions" explanation: description: A human-readable explanation of how the inference was produced. example: High confidence match type: string id: description: The identifier of the inference, formatted as `resource_id:owner_type`. example: test-resource:team type: string owner_type: $ref: "#/components/schemas/OwnershipOwnerType" primary_contact_ref: description: The primary contact reference for the inferred owner, formatted as `ref:handle/`. example: ref:handle/team-a nullable: true type: string sources: $ref: "#/components/schemas/OwnershipInferenceSources" status: $ref: "#/components/schemas/OwnershipInferenceStatus" updated_at: description: The time when the inference was last updated. example: "2026-01-15T10:00:00Z" format: date-time type: string required: - id - owner_type - confidence - explanation - evidence_versions - sources - status - checksum - created_at - updated_at type: object OwnershipInferenceItems: description: The list of inferences for a resource, with one inference per owner type. items: $ref: "#/components/schemas/OwnershipInferenceItem" type: array OwnershipInferenceListAttributes: description: The attributes of the ownership inferences collection response. properties: items: $ref: "#/components/schemas/OwnershipInferenceItems" required: - items type: object OwnershipInferenceListData: description: The data wrapper for the ownership inferences collection response. properties: attributes: $ref: "#/components/schemas/OwnershipInferenceListAttributes" id: description: The resource identifier associated with the returned inferences. example: test-resource type: string type: $ref: "#/components/schemas/OwnershipInferencesType" required: - id - type - attributes type: object OwnershipInferenceListResponse: description: The response returned when listing all current ownership inferences for a resource. properties: data: $ref: "#/components/schemas/OwnershipInferenceListData" required: - data type: object OwnershipInferenceResponse: description: The response returned when retrieving a single ownership inference for an owner type. properties: data: $ref: "#/components/schemas/OwnershipInferenceData" required: - data type: object OwnershipInferenceSource: additionalProperties: {} description: A source describing how an inference was derived. example: kind: code_owners type: object OwnershipInferenceSources: description: The list of sources backing an ownership inference. Empty when the inference status is not whitelisted to expose sources. example: - kind: code_owners items: $ref: "#/components/schemas/OwnershipInferenceSource" type: array OwnershipInferenceStatus: description: The lifecycle status of an ownership inference. enum: - suggested - persisted - overridden - failed - unknown example: suggested type: string x-enum-varnames: - SUGGESTED - PERSISTED - OVERRIDDEN - FAILED - UNKNOWN OwnershipInferenceType: default: ownership_inference description: The type of the ownership inference resource. The value should always be `ownership_inference`. enum: - ownership_inference example: ownership_inference type: string x-enum-varnames: - OWNERSHIP_INFERENCE OwnershipInferencesType: default: ownership_inferences description: The type of the ownership inferences collection resource. The value should always be `ownership_inferences`. enum: - ownership_inferences example: ownership_inferences type: string x-enum-varnames: - OWNERSHIP_INFERENCES OwnershipOwnerType: description: The owner type for an ownership inference. enum: - user - team - service - unknown example: team type: string x-enum-varnames: - USER - TEAM - SERVICE - UNKNOWN OwnershipSettingsAttributes: description: The attributes of the ownership settings response. properties: auto_tag: description: Whether automatic ownership tagging is enabled. example: true type: boolean confidence_level: $ref: "#/components/schemas/OwnershipConfidenceLevel" version: description: The current version of the ownership settings. example: 1 format: int64 type: integer required: - version - auto_tag - confidence_level type: object OwnershipSettingsData: description: The data wrapper for an ownership settings response. properties: attributes: $ref: "#/components/schemas/OwnershipSettingsAttributes" id: description: The identifier of the ownership settings resource. example: settings type: string type: $ref: "#/components/schemas/OwnershipSettingsType" required: - id - type - attributes type: object OwnershipSettingsRequest: description: The request body for updating ownership settings. properties: data: $ref: "#/components/schemas/OwnershipSettingsRequestData" required: - data type: object OwnershipSettingsRequestAttributes: description: The attributes of an ownership settings request. properties: auto_tag: description: Whether automatic ownership tagging is enabled. example: true type: boolean confidence_level: $ref: "#/components/schemas/OwnershipConfidenceLevel" required: - auto_tag - confidence_level type: object OwnershipSettingsRequestData: description: The data wrapper for an ownership settings request. properties: attributes: $ref: "#/components/schemas/OwnershipSettingsRequestAttributes" type: $ref: "#/components/schemas/OwnershipSettingsType" required: - type - attributes type: object OwnershipSettingsResponse: description: The response returned when retrieving or updating ownership settings. properties: data: $ref: "#/components/schemas/OwnershipSettingsData" required: - data type: object OwnershipSettingsType: default: ownership_settings description: The type of the ownership settings resource. The value should always be `ownership_settings`. enum: - ownership_settings example: ownership_settings type: string x-enum-varnames: - OWNERSHIP_SETTINGS OwnershipUntaggedFindingsAttributes: description: The counts of findings without a team tag by ownership confidence. properties: high_confidence: description: The number of high confidence findings without a team tag. example: 30 format: int64 type: integer low_confidence: description: The number of low confidence findings without a team tag. example: 42 format: int64 type: integer medium_confidence: description: The number of medium confidence findings without a team tag. example: 70 format: int64 type: integer total: description: The total number of findings without a team tag. example: 142 format: int64 type: integer required: - total - high_confidence - medium_confidence - low_confidence type: object OwnershipUntaggedFindingsData: description: The data wrapper for an ownership untagged findings response. properties: attributes: $ref: "#/components/schemas/OwnershipUntaggedFindingsAttributes" id: description: The identifier of the ownership untagged findings resource. example: untagged type: string type: $ref: "#/components/schemas/OwnershipUntaggedFindingsType" required: - id - type - attributes type: object OwnershipUntaggedFindingsResponse: description: The response returned when counting findings without a team tag by ownership confidence. properties: data: $ref: "#/components/schemas/OwnershipUntaggedFindingsData" required: - data type: object OwnershipUntaggedFindingsType: default: ownership_untagged_findings description: The type of the ownership untagged findings resource. The value should always be `ownership_untagged_findings`. enum: - ownership_untagged_findings example: ownership_untagged_findings type: string x-enum-varnames: - OWNERSHIP_UNTAGGED_FINDINGS PRCoverageSummaryRequest: description: Request object for getting code coverage summary for a pull request. properties: data: $ref: "#/components/schemas/PRCoverageSummaryRequestData" required: - data type: object PRCoverageSummaryRequestAttributes: description: Attributes for requesting code coverage summary for a pull request. properties: pr_number: description: The pull request number. Must be a positive integer. example: 42 format: int64 minimum: 1 type: integer repository_url: description: The repository URL. Accepts a full URL with or without a scheme (for example, `https://github.com/org/repo` or `github.com/org/repo`). example: https://github.com/datadog/shopist minLength: 1 type: string required: - repository_url - pr_number type: object PRCoverageSummaryRequestData: description: Data object for PR summary request. properties: attributes: $ref: "#/components/schemas/PRCoverageSummaryRequestAttributes" type: $ref: "#/components/schemas/PRCoverageSummaryRequestType" required: - type - attributes type: object PRCoverageSummaryRequestType: description: JSON:API type for PR coverage summary request. The value must always be `ci_app_coverage_pr_summary_request`. enum: - ci_app_coverage_pr_summary_request example: ci_app_coverage_pr_summary_request type: string x-enum-varnames: - CI_APP_COVERAGE_PR_SUMMARY_REQUEST PageAnnotationsAttributes: description: Attributes of the annotations on a page. properties: annotations: $ref: "#/components/schemas/AnnotationsInPageMap" global_annotations: $ref: "#/components/schemas/GlobalAnnotationIds" widget_mapping: $ref: "#/components/schemas/WidgetAnnotationsMap" required: - annotations - widget_mapping - global_annotations type: object PageAnnotationsData: description: Annotations grouped by widget for a single page. properties: attributes: $ref: "#/components/schemas/PageAnnotationsAttributes" id: description: |- ID of the page, prefixed with the page type and joined by a colon (for example, `dashboard:abc-def-xyz` or `notebook:1234567890`). example: "dashboard:abc-def-xyz" type: string type: $ref: "#/components/schemas/PageAnnotationsType" required: - id - type - attributes type: object PageAnnotationsResponse: description: Response containing all annotations on a page, grouped by widget. properties: data: $ref: "#/components/schemas/PageAnnotationsData" required: - data type: object PageAnnotationsType: description: Page annotations resource type. enum: - page_annotations example: page_annotations type: string x-enum-varnames: - PAGE_ANNOTATIONS PageUrgency: default: high description: On-Call Page urgency level. enum: - low - high example: high type: string x-enum-varnames: - LOW - HIGH PaginatedResponseMeta: description: Metadata for scores response. properties: count: description: Number of entities in this response. example: 10 format: int64 type: integer limit: description: Pagination limit. example: 10 format: int64 type: integer offset: description: Pagination offset. example: 0 format: int64 type: integer total: description: Total number of entities available. example: 150 format: int64 type: integer required: - count - total - limit - offset type: object Pagination: description: Pagination object. properties: total_count: description: Total count. format: int64 type: integer total_filtered_count: description: Total count of elements matched by the filter. format: int64 type: integer type: object PaginationMeta: description: Response metadata. properties: page: $ref: "#/components/schemas/PaginationMetaPage" readOnly: true type: object PaginationMetaPage: description: Offset-based pagination schema. example: first_offset: 0 last_offset: 900 limit: 100 next_offset: 100 offset: 0 prev_offset: 100 total: 1000 type: offset_limit properties: first_offset: description: Integer representing the offset to fetch the first page of results. example: 0 format: int64 type: integer last_offset: description: Integer representing the offset to fetch the last page of results. example: 900 format: int64 nullable: true type: integer limit: description: Integer representing the number of elements to be returned in the results. example: 100 format: int64 type: integer next_offset: description: >- Integer representing the index of the first element in the next page of results. Equal to page size added to the current offset. example: 100 format: int64 nullable: true type: integer offset: description: Integer representing the index of the first element in the results. example: 0 format: int64 type: integer prev_offset: description: Integer representing the index of the first element in the previous page of results. example: 100 format: int64 nullable: true type: integer total: description: Integer representing the total number of elements available. example: 1000 format: int64 nullable: true type: integer type: $ref: "#/components/schemas/PaginationMetaPageType" type: object PaginationMetaPageType: default: offset_limit description: The pagination type used for offset-based pagination. enum: - offset_limit example: offset_limit type: string x-enum-varnames: - OFFSET_LIMIT Parameter: description: The definition of `Parameter` object. properties: name: description: The `Parameter` `name`. example: "" minLength: 1 type: string value: description: The `Parameter` `value`. required: - name - value type: object PartialAPIKey: description: Partial Datadog API key. properties: attributes: $ref: "#/components/schemas/PartialAPIKeyAttributes" id: description: ID of the API key. type: string relationships: $ref: "#/components/schemas/APIKeyRelationships" type: $ref: "#/components/schemas/APIKeysType" type: object PartialAPIKeyAttributes: description: Attributes of a partial API key. properties: category: description: The category of the API key. type: string created_at: description: Creation date of the API key. example: "2020-11-23T10:00:00.000Z" readOnly: true type: string date_last_used: description: Date the API Key was last used. example: "2020-11-27T10:00:00.000Z" format: date-time nullable: true readOnly: true type: string last4: description: The last four characters of the API key. example: "abcd" maxLength: 4 minLength: 4 readOnly: true type: string modified_at: description: Date the API key was last modified. example: "2020-11-23T10:00:00.000Z" readOnly: true type: string name: description: Name of the API key. example: "API Key for submitting metrics" type: string private_action_runner_enroll_enabled: description: Whether the API key can enroll a Private Action Runner. type: boolean remote_config_read_enabled: description: The remote config read enabled status. type: boolean type: object PartialApplicationKey: description: Partial Datadog application key. properties: attributes: $ref: "#/components/schemas/PartialApplicationKeyAttributes" id: description: ID of the application key. type: string relationships: $ref: "#/components/schemas/ApplicationKeyRelationships" type: $ref: "#/components/schemas/ApplicationKeysType" type: object PartialApplicationKeyAttributes: description: Attributes of a partial application key. properties: created_at: description: Creation date of the application key. example: "2020-11-23T10:00:00.000Z" readOnly: true type: string last4: description: The last four characters of the application key. example: "abcd" maxLength: 4 minLength: 4 readOnly: true type: string last_used_at: description: Last usage timestamp of the application key. example: "2020-12-20T10:00:00.000Z" nullable: true readOnly: true type: string name: description: Name of the application key. example: "Application Key for managing dashboards" type: string scopes: description: Array of scopes to grant the application key. example: ["dashboards_read", "dashboards_write", "dashboards_public_share"] items: description: Name of scope. type: string nullable: true type: array type: object PartialApplicationKeyResponse: description: Response for retrieving a partial application key. properties: data: $ref: "#/components/schemas/PartialApplicationKey" included: description: Array of objects related to the application key. items: $ref: "#/components/schemas/ApplicationKeyResponseIncludedItem" type: array type: object PatchAttachmentRequest: description: Request to update an attachment. properties: data: $ref: "#/components/schemas/PatchAttachmentRequestData" type: object PatchAttachmentRequestData: description: Attachment data for an update request. properties: attributes: $ref: "#/components/schemas/PatchAttachmentRequestDataAttributes" id: description: The unique identifier of the attachment. example: "00000000-abcd-0002-0000-000000000000" type: string type: $ref: "#/components/schemas/IncidentAttachmentType" required: - type type: object PatchAttachmentRequestDataAttributes: description: The attributes for updating an attachment. properties: attachment: $ref: "#/components/schemas/PatchAttachmentRequestDataAttributesAttachment" type: object PatchAttachmentRequestDataAttributesAttachment: description: The updated attachment object. properties: documentUrl: description: The updated URL for the attachment. example: https://app.datadoghq.com/notebook/124/Postmortem-IR-124 type: string title: description: The updated title for the attachment. example: Postmortem-IR-124 type: string type: object PatchComponentRequest: description: Request object for updating a component. example: data: attributes: name: Metrics Intake Service position: 4 id: 1234abcd-12ab-34cd-56ef-123456abcdef type: components properties: data: $ref: "#/components/schemas/PatchComponentRequestData" type: object PatchComponentRequestData: description: The data object for updating a component. properties: attributes: $ref: "#/components/schemas/PatchComponentRequestDataAttributes" id: description: The ID of the component. example: "1234abcd-12ab-34cd-56ef-123456abcdef" format: uuid type: string type: $ref: "#/components/schemas/StatusPagesComponentGroupType" required: - attributes - id - type type: object PatchComponentRequestDataAttributes: description: The supported attributes for updating a component. properties: name: description: The name of the component. example: Web App type: string position: description: The position of the component. If the component belongs to a group, the position is relative to the other components in the group. example: 1 format: int64 type: integer type: object PatchDegradationRequest: description: Request object for updating a degradation. example: data: attributes: components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: operational description: We've deployed a fix and latency has returned to normal. This issue has been resolved. status: resolved id: 1234abcd-12ab-34cd-56ef-123456abcdef type: degradations properties: data: $ref: "#/components/schemas/PatchDegradationRequestData" meta: $ref: "#/components/schemas/DegradationRequestMeta" description: The supported metadata for updating a degradation. type: object PatchDegradationRequestData: description: The data object for updating a degradation. properties: attributes: $ref: "#/components/schemas/PatchDegradationRequestDataAttributes" id: description: The ID of the degradation. example: "1234abcd-12ab-34cd-56ef-123456abcdef" format: uuid type: string relationships: $ref: "#/components/schemas/PatchDegradationRequestDataRelationships" type: $ref: "#/components/schemas/PatchDegradationRequestDataType" required: - attributes - id - type type: object PatchDegradationRequestDataAttributes: description: The supported attributes for updating a degradation. properties: components_affected: description: The components affected by the degradation. example: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: operational items: $ref: "#/components/schemas/PatchDegradationRequestDataAttributesComponentsAffectedItems" type: array description: description: The description of the degradation. example: We've deployed a fix and latency has returned to normal. This issue has been resolved. type: string status: $ref: "#/components/schemas/PatchDegradationRequestDataAttributesStatus" example: resolved title: description: The title of the degradation. example: Elevated API Latency type: string type: object PatchDegradationRequestDataAttributesComponentsAffectedItems: description: A component affected by a degradation. properties: id: description: The ID of the component. Must be a component of type `component`. example: "1234abcd-12ab-34cd-56ef-123456abcdef" format: uuid type: string name: description: The name of the component. readOnly: true type: string status: $ref: "#/components/schemas/StatusPagesComponentDataAttributesStatus" required: - id - status type: object PatchDegradationRequestDataAttributesStatus: description: The status of the degradation. enum: - investigating - identified - monitoring - resolved type: string x-enum-varnames: - INVESTIGATING - IDENTIFIED - MONITORING - RESOLVED PatchDegradationRequestDataRelationships: description: The supported relationships for updating a degradation. properties: template: $ref: "#/components/schemas/PatchDegradationRequestDataRelationshipsTemplate" description: The template used to create the degradation. type: object PatchDegradationRequestDataRelationshipsTemplate: description: The template used to create the degradation. properties: data: $ref: "#/components/schemas/PatchDegradationRequestDataRelationshipsTemplateData" required: - data type: object PatchDegradationRequestDataRelationshipsTemplateData: description: The data object identifying the template used to create the degradation. properties: id: description: The ID of the degradation template. example: "" type: string type: $ref: "#/components/schemas/PatchDegradationTemplateRequestDataType" required: - type - id type: object PatchDegradationRequestDataType: default: degradations description: Degradations resource type. enum: - degradations example: degradations type: string x-enum-varnames: - DEGRADATIONS PatchDegradationTemplateRequest: description: Request object for updating a degradation template. properties: data: $ref: "#/components/schemas/PatchDegradationTemplateRequestData" type: object PatchDegradationTemplateRequestData: description: The data object for updating a degradation template. properties: attributes: $ref: "#/components/schemas/PatchDegradationTemplateRequestDataAttributes" id: description: The ID of the degradation template. example: "" type: string type: $ref: "#/components/schemas/PatchDegradationTemplateRequestDataType" required: - type - id type: object PatchDegradationTemplateRequestDataAttributes: description: The supported attributes for updating a degradation template. properties: components_affected: description: The components affected by a degradation created from this template. items: $ref: "#/components/schemas/PatchDegradationTemplateRequestDataAttributesComponentsAffectedItems" type: array degradation_title: description: The title used for a degradation created from this template. type: string name: description: The name of the degradation template. type: string updates: description: The pre-filled updates for a degradation created from this template. items: $ref: "#/components/schemas/PatchDegradationTemplateRequestDataAttributesUpdatesItems" type: array type: object PatchDegradationTemplateRequestDataAttributesComponentsAffectedItems: description: A component affected by a degradation created from this template. properties: id: description: The ID of the component. Must be a component of type `component`. example: "" type: string name: description: The name of the component. readOnly: true type: string status: $ref: "#/components/schemas/PatchDegradationTemplateRequestDataAttributesComponentsAffectedItemsStatus" required: - id - status type: object PatchDegradationTemplateRequestDataAttributesComponentsAffectedItemsStatus: description: The status of the component. enum: - operational - degraded - partial_outage - major_outage example: operational type: string x-enum-varnames: - OPERATIONAL - DEGRADED - PARTIAL_OUTAGE - MAJOR_OUTAGE PatchDegradationTemplateRequestDataAttributesUpdatesItems: description: A pre-filled update for a degradation created from this template. properties: message: description: The message of the update. type: string status: $ref: "#/components/schemas/CreateDegradationRequestDataAttributesStatus" required: - status type: object PatchDegradationTemplateRequestDataType: default: degradation_templates description: Degradation templates resource type. enum: - degradation_templates example: degradation_templates type: string x-enum-varnames: - DEGRADATION_TEMPLATES PatchDegradationUpdateRequest: description: Request object for editing a degradation update. example: data: attributes: description: We've identified the source of the latency increase and are deploying a fix. status: identified id: 00000000-0000-0000-0000-000000000000 type: degradation_updates properties: data: $ref: "#/components/schemas/PatchDegradationUpdateRequestData" type: object PatchDegradationUpdateRequestData: description: The data object for editing a degradation update. properties: attributes: $ref: "#/components/schemas/PatchDegradationUpdateRequestDataAttributes" id: description: The ID of the degradation update to edit. type: string type: $ref: "#/components/schemas/PatchDegradationUpdateRequestDataType" required: - type type: object PatchDegradationUpdateRequestDataAttributes: description: Attributes for editing a degradation update. properties: description: description: The message body of the update. type: string status: $ref: "#/components/schemas/PatchDegradationUpdateRequestDataAttributesStatus" type: object PatchDegradationUpdateRequestDataAttributesStatus: description: The status of the degradation update. enum: - investigating - identified - monitoring type: string x-enum-varnames: - INVESTIGATING - IDENTIFIED - MONITORING PatchDegradationUpdateRequestDataType: default: degradation_updates description: Degradation updates resource type. enum: - degradation_updates example: degradation_updates type: string x-enum-varnames: - DEGRADATION_UPDATES PatchIncidentNotificationTemplateRequest: description: Update request for a notification template. properties: data: $ref: "#/components/schemas/IncidentNotificationTemplateUpdateData" required: - data type: object PatchMaintenanceRequest: description: Request object for updating a maintenance. example: data: attributes: completed_date: "2026-02-18T20:01:13.332360075Z" in_progress_description: We are currently performing maintenance on the API to improve performance for 40 minutes. scheduled_description: We will be performing maintenance on the API to improve performance for 40 minutes. start_date: "2026-02-18T19:21:13.332360075Z" title: API Maintenance id: 1234abcd-12ab-34cd-56ef-123456abcdef type: maintenances properties: data: $ref: "#/components/schemas/PatchMaintenanceRequestData" type: object PatchMaintenanceRequestData: description: The data object for updating a maintenance. properties: attributes: $ref: "#/components/schemas/PatchMaintenanceRequestDataAttributes" id: description: The ID of the maintenance. example: "1234abcd-12ab-34cd-56ef-123456abcdef" format: uuid type: string relationships: $ref: "#/components/schemas/PatchMaintenanceRequestDataRelationships" type: $ref: "#/components/schemas/PatchMaintenanceRequestDataType" required: - attributes - type - id type: object PatchMaintenanceRequestDataAttributes: description: The supported attributes for updating a maintenance. properties: canceled_description: description: The description shown when the maintenance is canceled. type: string completed_date: description: Timestamp of when the maintenance was completed. format: date-time type: string completed_description: description: The description shown when the maintenance is completed. type: string components_affected: description: The components affected by the maintenance. items: $ref: "#/components/schemas/PatchMaintenanceRequestDataAttributesComponentsAffectedItems" type: array in_progress_description: description: The description shown while the maintenance is in progress. type: string scheduled_description: description: The description shown when the maintenance is scheduled. type: string start_date: description: Timestamp of when the maintenance is scheduled to start. format: date-time type: string status: $ref: "#/components/schemas/MaintenanceDataAttributesStatus" description: The status of the maintenance. title: description: The title of the maintenance. type: string type: object PatchMaintenanceRequestDataAttributesComponentsAffectedItems: description: A component affected by a maintenance. properties: id: description: The ID of the component. Must be a component of type `component`. example: "1234abcd-12ab-34cd-56ef-123456abcdef" format: uuid type: string name: description: The name of the component. readOnly: true type: string status: $ref: "#/components/schemas/PatchMaintenanceRequestDataAttributesComponentsAffectedItemsStatus" required: - id - status type: object PatchMaintenanceRequestDataAttributesComponentsAffectedItemsStatus: description: The status of the component. enum: - operational - maintenance example: operational type: string x-enum-varnames: - OPERATIONAL - MAINTENANCE PatchMaintenanceRequestDataRelationships: description: The supported relationships for updating a maintenance. properties: template: $ref: "#/components/schemas/PatchMaintenanceRequestDataRelationshipsTemplate" description: The template used to create the maintenance. type: object PatchMaintenanceRequestDataRelationshipsTemplate: description: The template used to create the maintenance. properties: data: $ref: "#/components/schemas/PatchMaintenanceRequestDataRelationshipsTemplateData" required: - data type: object PatchMaintenanceRequestDataRelationshipsTemplateData: description: The data object identifying the template used to create the maintenance. properties: id: description: The ID of the maintenance template. example: "" type: string type: $ref: "#/components/schemas/PatchMaintenanceTemplateRequestDataType" required: - type - id type: object PatchMaintenanceRequestDataType: default: maintenances description: Maintenances resource type. enum: - maintenances example: maintenances type: string x-enum-varnames: - MAINTENANCES PatchMaintenanceTemplateRequest: description: Request object for updating a maintenance template. properties: data: $ref: "#/components/schemas/PatchMaintenanceTemplateRequestData" type: object PatchMaintenanceTemplateRequestData: description: The data object for updating a maintenance template. properties: attributes: $ref: "#/components/schemas/PatchMaintenanceTemplateRequestDataAttributes" id: description: The ID of the maintenance template. example: "" type: string type: $ref: "#/components/schemas/PatchMaintenanceTemplateRequestDataType" required: - type - id type: object PatchMaintenanceTemplateRequestDataAttributes: description: The supported attributes for updating a maintenance template. properties: completed_description: description: The description shown when a maintenance created from this template is completed. type: string component_ids: description: The IDs of the components affected by a maintenance created from this template. items: type: string type: array in_progress_description: description: The description shown while a maintenance created from this template is in progress. type: string maintenance_title: description: The title used for a maintenance created from this template. type: string name: description: The name of the maintenance template. type: string scheduled_description: description: The description shown when a maintenance created from this template is scheduled. type: string type: object PatchMaintenanceTemplateRequestDataType: default: maintenance_templates description: Maintenance templates resource type. enum: - maintenance_templates example: maintenance_templates type: string x-enum-varnames: - MAINTENANCE_TEMPLATES PatchMaintenanceUpdateRequest: description: Request object for editing a maintenance update. example: data: attributes: description: We have completed maintenance on the API to improve performance. id: 00000000-0000-0000-0000-000000000000 type: maintenance_updates properties: data: $ref: "#/components/schemas/PatchMaintenanceUpdateRequestData" type: object PatchMaintenanceUpdateRequestData: description: The data object for editing a maintenance update. properties: attributes: $ref: "#/components/schemas/PatchMaintenanceUpdateRequestDataAttributes" id: description: The ID of the maintenance update to edit. Must match the `update_id` path parameter. example: "1234abcd-12ab-34cd-56ef-123456abcdef" type: string type: $ref: "#/components/schemas/PatchMaintenanceUpdateRequestDataType" required: - id - type type: object PatchMaintenanceUpdateRequestDataAttributes: description: Attributes for editing a maintenance update. properties: description: description: The message body of the update. example: "" type: string type: object PatchMaintenanceUpdateRequestDataType: default: maintenance_updates description: Maintenance updates resource type. enum: - maintenance_updates example: maintenance_updates type: string x-enum-varnames: - MAINTENANCE_UPDATES PatchNotificationRuleParameters: description: Body of the notification rule patch request. properties: data: $ref: "#/components/schemas/PatchNotificationRuleParametersData" type: object PatchNotificationRuleParametersData: description: |- Data of the notification rule patch request: the rule ID, the rule type, and the rule attributes. All fields are required. properties: attributes: $ref: "#/components/schemas/PatchNotificationRuleParametersDataAttributes" id: $ref: "#/components/schemas/ID" type: $ref: "#/components/schemas/NotificationRulesType" required: - attributes - id - type type: object PatchNotificationRuleParametersDataAttributes: description: |- Attributes of the notification rule patch request. It is required to update the version of the rule when patching it. properties: enabled: $ref: "#/components/schemas/Enabled" name: $ref: "#/components/schemas/RuleName" routing: $ref: "#/components/schemas/NotificationRuleRouting" selectors: $ref: "#/components/schemas/Selectors" targets: $ref: "#/components/schemas/Targets" time_aggregation: $ref: "#/components/schemas/TimeAggregation" version: $ref: "#/components/schemas/Version" type: object PatchSavedFilterAttributes: description: Fields to update. At least one of `name`, `description`, or `targeting_rules` must have a non-null value. Omitted or null fields are preserved. The creation type cannot be changed. properties: description: description: The new description. Send an empty string to clear the description. If omitted or null, the existing description is preserved. example: Updated early access users. nullable: true type: string last_updated_at: description: The `updated_at` value returned by a previous read, as an RFC 3339 timestamp. If it differs from the stored update time, truncated to seconds, the request returns a 409 response. For metadata-only updates, this check does not prevent all concurrent writes. This field alone does not constitute an update. example: "2026-01-02T12:00:00Z" format: date-time nullable: true type: string name: description: The new name of the saved filter. Must not be empty. example: Early access users minLength: 1 nullable: true type: string targeting_rules: description: The complete replacement targeting rules, combined with OR. Conditions within each rule are combined with AND. Replaces all existing rules. Values are not appended. Must contain at least one rule. Saved filters cannot reference other saved filters. items: $ref: "#/components/schemas/SavedFilterTargetingRuleRequest" minItems: 1 nullable: true type: array type: object PatchSavedFilterConflictResponse: description: A stale update, duplicate name, or other conflict, or a resource listing consumer flags requiring approval. oneOf: - $ref: "#/components/schemas/SavedFilterJSONAPIErrorResponse" - $ref: "#/components/schemas/SavedFilterApprovalConflictResponse" PatchSavedFilterData: description: The saved filter fields to update. properties: attributes: $ref: "#/components/schemas/PatchSavedFilterAttributes" type: $ref: "#/components/schemas/SavedFilterDataType" required: - type - attributes type: object PatchSavedFilterForbiddenResponse: description: An authentication or permission error, or a resource listing consumer flags that the caller cannot edit. oneOf: - $ref: "#/components/schemas/SavedFilterAPIErrorResponse" - $ref: "#/components/schemas/SavedFilterJSONAPIErrorResponse" - $ref: "#/components/schemas/SavedFilterPermissionDeniedResponse" PatchSavedFilterRequest: description: Request to partially update a saved filter. properties: data: $ref: "#/components/schemas/PatchSavedFilterData" required: - data type: object PatchStatusPageRequest: description: Request object for updating a status page. example: data: attributes: company_logo: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAIKMMMM domain_prefix: status-page-us1-east email_header_image: data:image/png;base64,pQSLAw0KGgoAAAANSUhEUgAAAQ4AASJKFF favicon: data:image/png;base64,kWMRNw0KGgoAAAANSUhEUgAAAEAAAABACA name: Status Page US1 East subscriptions_enabled: false type: internal visualization_type: bars_only id: 1234abcd-12ab-34cd-56ef-123456abcdef type: status_pages properties: data: $ref: "#/components/schemas/PatchStatusPageRequestData" type: object PatchStatusPageRequestData: description: The data object for updating a status page. properties: attributes: $ref: "#/components/schemas/PatchStatusPageRequestDataAttributes" id: description: The ID of the status page. example: "1234abcd-12ab-34cd-56ef-123456abcdef" format: uuid type: string type: $ref: "#/components/schemas/StatusPageDataType" required: - attributes - id - type type: object PatchStatusPageRequestDataAttributes: description: The supported attributes for updating a status page. properties: company_logo: description: The base64-encoded image data displayed on the status page. example: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAIKMMMM type: string domain_prefix: description: The subdomain of the status page's url taking the form `https://{domain_prefix}.statuspage.datadoghq.com`. Globally unique across Datadog Status Pages. example: status-page-us1 type: string email_header_image: description: The base64-encoded image data displayed in email notifications sent to status page subscribers. example: data:image/png;base64,pQSLAw0KGgoAAAANSUhEUgAAAQ4AASJKFF type: string favicon: description: The base64-encoded image data displayed in the browser tab. example: data:image/png;base64,kWMRNw0KGgoAAAANSUhEUgAAAEAAAABACA type: string name: description: The name of the status page. example: Status Page US1 type: string rss_feed_enabled: description: Whether the RSS feed is enabled for the status page. type: boolean slack_app_icon: description: The Slack app icon URL for the status page. type: string slack_subscriptions_enabled: description: Whether Slack subscriptions are enabled for the status page. type: boolean subscriptions_enabled: description: Whether users can subscribe to the status page. example: true type: boolean type: $ref: "#/components/schemas/CreateStatusPageRequestDataAttributesType" example: public visualization_layout: $ref: "#/components/schemas/CreateStatusPageRequestDataAttributesVisualizationLayout" example: list visualization_type: $ref: "#/components/schemas/CreateStatusPageRequestDataAttributesVisualizationType" example: bars_and_uptime_percentage type: object PatchTableRequest: description: Request body for updating an existing reference table. example: data: attributes: description: this is a cloud table generated via a cloud bucket sync file_metadata: access_details: aws_detail: aws_account_id: test-account-id aws_bucket_name: test-bucket file_path: test_rt.csv sync_enabled: true schema: fields: - name: id type: INT32 - name: name type: STRING primary_keys: - id tags: - test_tag type: reference_table properties: data: $ref: "#/components/schemas/PatchTableRequestData" type: object PatchTableRequestData: additionalProperties: false description: The data object containing the partial table definition updates. properties: attributes: $ref: "#/components/schemas/PatchTableRequestDataAttributes" type: $ref: "#/components/schemas/PatchTableRequestDataType" required: - type type: object PatchTableRequestDataAttributes: description: Attributes that define the updates to the reference table's configuration and properties. properties: description: description: Optional text describing the purpose or contents of this reference table. example: "example description" type: string file_metadata: $ref: "#/components/schemas/PatchTableRequestDataAttributesFileMetadata" schema: $ref: "#/components/schemas/PatchTableRequestDataAttributesSchema" tags: description: Tags for organizing and filtering reference tables. example: - "tag_1" - "tag_2" items: description: A tag associated with the reference table. type: string type: array type: object PatchTableRequestDataAttributesFileMetadata: description: Metadata specifying where and how to access the reference table's data file. oneOf: - $ref: "#/components/schemas/PatchTableRequestDataAttributesFileMetadataCloudStorage" - $ref: "#/components/schemas/PatchTableRequestDataAttributesFileMetadataLocalFile" PatchTableRequestDataAttributesFileMetadataCloudStorage: additionalProperties: false description: >- Cloud storage file metadata for patch requests. Allows partial updates of access_details and sync_enabled. properties: access_details: $ref: "#/components/schemas/PatchTableRequestDataAttributesFileMetadataOneOfAccessDetails" sync_enabled: description: Whether this table is synced automatically. example: false type: boolean title: CloudFileMetadataV2 type: object PatchTableRequestDataAttributesFileMetadataLocalFile: additionalProperties: false description: Local file metadata for patch requests using upload ID. properties: upload_id: description: The upload ID. example: "00000000-0000-0000-0000-000000000000" type: string required: - upload_id title: LocalFileMetadataV2 type: object PatchTableRequestDataAttributesFileMetadataOneOfAccessDetails: description: Cloud storage access configuration for the reference table data file. properties: aws_detail: $ref: "#/components/schemas/PatchTableRequestDataAttributesFileMetadataOneOfAccessDetailsAwsDetail" azure_detail: $ref: "#/components/schemas/PatchTableRequestDataAttributesFileMetadataOneOfAccessDetailsAzureDetail" gcp_detail: $ref: "#/components/schemas/PatchTableRequestDataAttributesFileMetadataOneOfAccessDetailsGcpDetail" type: object PatchTableRequestDataAttributesFileMetadataOneOfAccessDetailsAwsDetail: description: Amazon Web Services S3 storage access configuration. properties: aws_account_id: description: AWS account ID where the S3 bucket is located. example: "123456789000" type: string aws_bucket_name: description: S3 bucket containing the CSV file. example: "example-data-bucket" type: string file_path: description: The relative file path from the S3 bucket root to the CSV file. example: "reference-tables/users.csv" type: string type: object x-oneOf-parent: - AwsDetail PatchTableRequestDataAttributesFileMetadataOneOfAccessDetailsAzureDetail: description: Azure Blob Storage access configuration. properties: azure_client_id: description: Azure service principal (application) client ID with permissions to read from the container. example: "aaaaaaaa-1111-2222-3333-bbbbbbbbbbbb" type: string azure_container_name: description: Azure Blob Storage container containing the CSV file. example: "reference-data" type: string azure_storage_account_name: description: Azure storage account where the container is located. example: "examplestorageaccount" type: string azure_tenant_id: description: Azure Active Directory tenant ID. example: "cccccccc-4444-5555-6666-dddddddddddd" type: string file_path: description: The relative file path from the Azure container root to the CSV file. example: "tables/users.csv" type: string type: object x-oneOf-parent: - AzureDetail PatchTableRequestDataAttributesFileMetadataOneOfAccessDetailsGcpDetail: description: Google Cloud Platform storage access configuration. properties: file_path: description: The relative file path from the GCS bucket root to the CSV file. example: "data/reference_tables/users.csv" type: string gcp_bucket_name: description: GCP bucket containing the CSV file. example: "example-data-bucket" type: string gcp_project_id: description: GCP project ID where the bucket is located. example: "example-gcp-project-12345" type: string gcp_service_account_email: description: Service account email with read permissions for the GCS bucket. example: "example-service@example-gcp-project-12345.iam.gserviceaccount.com" type: string type: object x-oneOf-parent: - GcpDetail PatchTableRequestDataAttributesSchema: description: >- Schema defining the updates to the structure and columns of the reference table. Schema fields cannot be deleted or renamed. properties: fields: description: The schema fields. Maximum of 200 columns. items: $ref: "#/components/schemas/PatchTableRequestDataAttributesSchemaFieldsItems" maxItems: 200 minItems: 1 type: array primary_keys: description: >- List of field names that serve as primary keys for the table. Only one primary key is supported, and it is used as an ID to retrieve rows. Primary keys cannot be changed after table creation. example: - "field_1" items: description: A field name used as a primary key. type: string type: array required: - fields - primary_keys type: object PatchTableRequestDataAttributesSchemaFieldsItems: description: >- A single field (column) in the reference table schema to be updated. Schema fields cannot be deleted or renamed. properties: name: description: The field name. example: "field_1" type: string type: $ref: "#/components/schemas/ReferenceTableSchemaFieldType" required: - name - type type: object PatchTableRequestDataType: default: reference_table description: Reference table resource type. enum: - reference_table example: reference_table type: string x-enum-varnames: - REFERENCE_TABLE Permission: description: Permission object. properties: attributes: $ref: "#/components/schemas/PermissionAttributes" id: description: ID of the permission. type: string type: $ref: "#/components/schemas/PermissionsType" required: - type type: object PermissionAttributes: description: Attributes of a permission. properties: created: description: Creation time of the permission. format: date-time type: string description: description: Description of the permission. type: string display_name: description: Displayed name for the permission. type: string display_type: description: Display type. type: string group_name: description: Name of the permission group. type: string name: description: Name of the permission. type: string name_aliases: description: List of alias names for the permission. items: description: An alternative name for the permission. type: string type: array restricted: description: Whether or not the permission is restricted. type: boolean type: object PermissionsResponse: description: Payload with API-returned permissions. properties: data: description: Array of permissions. items: $ref: "#/components/schemas/Permission" type: array type: object PermissionsType: default: permissions description: Permissions resource type. enum: - permissions example: permissions type: string x-enum-varnames: - PERMISSIONS PersonalAccessToken: description: Datadog access token. properties: attributes: $ref: "#/components/schemas/PersonalAccessTokenAttributes" id: description: ID of the access token. type: string relationships: $ref: "#/components/schemas/PersonalAccessTokenRelationships" type: $ref: "#/components/schemas/PersonalAccessTokensType" type: object PersonalAccessTokenAttributes: description: Attributes of an access token. properties: created_at: description: Creation date of the access token. example: "2024-01-01T00:00:00+00:00" format: date-time readOnly: true type: string expires_at: description: Expiration date of the access token. example: "2025-12-31T23:59:59+00:00" format: date-time nullable: true readOnly: true type: string last_used_at: description: Date the access token was last used. example: "2025-06-15T12:30:00+00:00" format: date-time nullable: true readOnly: true type: string modified_at: description: Date of last modification of the access token. example: "2024-06-01T00:00:00+00:00" format: date-time nullable: true readOnly: true type: string name: description: Name of the access token. example: "My Access Token" type: string public_portion: description: The public portion of the access token. example: "ddpat_abc123" readOnly: true type: string scopes: description: Array of scopes granted to the access token. example: - "dashboards_read" - "dashboards_write" items: description: Name of scope. type: string type: array type: object PersonalAccessTokenCreateAttributes: description: Attributes used to create an access token. properties: expires_at: description: Expiration date of the access token. Must be at least 24 hours in the future. example: "2025-12-31T23:59:59+00:00" format: date-time type: string name: description: Name of the access token. example: "My Personal Access Token" type: string scopes: description: Array of scopes to grant the access token. example: - "dashboards_read" - "dashboards_write" items: description: Name of scope. type: string type: array required: - name - scopes - expires_at type: object PersonalAccessTokenCreateData: description: Object used to create an access token. properties: attributes: $ref: "#/components/schemas/PersonalAccessTokenCreateAttributes" type: $ref: "#/components/schemas/PersonalAccessTokensType" required: - attributes - type type: object PersonalAccessTokenCreateRequest: description: Request used to create an access token. properties: data: $ref: "#/components/schemas/PersonalAccessTokenCreateData" required: - data type: object PersonalAccessTokenCreateResponse: description: Response for creating an access token. Includes the token key. properties: data: $ref: "#/components/schemas/FullPersonalAccessToken" type: object PersonalAccessTokenRelationships: description: Resources related to the access token. properties: leak_information: $ref: "#/components/schemas/RelationshipToLeakedKey" owned_by: $ref: "#/components/schemas/RelationshipToUser" type: object PersonalAccessTokenResponse: description: Response for retrieving an access token. properties: data: $ref: "#/components/schemas/PersonalAccessToken" included: $ref: "#/components/schemas/AccessTokenResponseIncludedArray" type: object PersonalAccessTokenResponseMeta: description: Additional information related to the access token response. properties: page: $ref: "#/components/schemas/PersonalAccessTokenResponseMetaPage" type: object PersonalAccessTokenResponseMetaPage: description: Pagination information. properties: total_filtered_count: description: Total filtered access token count. format: int64 type: integer type: object PersonalAccessTokenUpdateAttributes: description: Attributes used to update an access token. properties: name: description: Name of the access token. example: "Updated Personal Access Token" type: string scopes: description: Array of scopes to grant the access token. example: - "dashboards_read" - "dashboards_write" items: description: Name of scope. type: string type: array type: object PersonalAccessTokenUpdateData: description: Object used to update an access token. properties: attributes: $ref: "#/components/schemas/PersonalAccessTokenUpdateAttributes" id: description: ID of the access token. example: "00112233-4455-6677-8899-aabbccddeeff" type: string type: $ref: "#/components/schemas/PersonalAccessTokensType" required: - attributes - id - type type: object PersonalAccessTokenUpdateRequest: description: Request used to update an access token. properties: data: $ref: "#/components/schemas/PersonalAccessTokenUpdateData" required: - data type: object PersonalAccessTokensIncludeQueryParameterItem: description: Relationship object that should be included in the response. enum: - leak_information example: "leak_information" type: string x-enum-varnames: - LEAK_INFORMATION PersonalAccessTokensSort: default: name description: Sorting options enum: - name - -name - created_at - -created_at - expires_at - -expires_at - last_used_at - -last_used_at - leaked - -leaked type: string x-enum-varnames: - NAME_ASCENDING - NAME_DESCENDING - CREATED_AT_ASCENDING - CREATED_AT_DESCENDING - EXPIRES_AT_ASCENDING - EXPIRES_AT_DESCENDING - LAST_USED_AT_ASCENDING - LAST_USED_AT_DESCENDING - LEAKED_ASCENDING - LEAKED_DESCENDING PersonalAccessTokensType: default: personal_access_tokens description: Personal access tokens resource type. enum: - personal_access_tokens example: personal_access_tokens type: string x-enum-varnames: - PERSONAL_ACCESS_TOKENS Playlist: description: A single RUM replay playlist resource returned by create, update, or get operations. properties: data: $ref: "#/components/schemas/PlaylistData" required: - data type: object PlaylistArray: description: A list of RUM replay playlists returned by a list operation. properties: data: description: Array of playlist data objects. items: $ref: "#/components/schemas/PlaylistData" type: array required: - data type: object PlaylistData: description: Data object representing a RUM replay playlist, including its identifier, type, and attributes. properties: attributes: $ref: "#/components/schemas/PlaylistDataAttributes" id: description: Unique identifier of the playlist. type: string type: $ref: "#/components/schemas/PlaylistDataType" required: - type type: object PlaylistDataAttributes: description: Attributes of a RUM replay playlist, including its name, description, session count, and audit timestamps. properties: created_at: description: Timestamp when the playlist was created. format: date-time type: string created_by: $ref: "#/components/schemas/PlaylistDataAttributesCreatedBy" description: description: Optional human-readable description of the playlist's purpose or contents. type: string name: description: Human-readable name of the playlist. example: My Playlist type: string session_count: description: Number of replay sessions in the playlist. format: int64 type: integer updated_at: description: Timestamp when the playlist was last updated. format: date-time type: string required: - name type: object PlaylistDataAttributesCreatedBy: description: Information about the user who created the playlist. properties: handle: description: Email handle of the user who created the playlist. example: john.doe@example.com type: string icon: description: URL or identifier of the user's avatar icon. type: string id: description: Unique identifier of the user who created the playlist. example: 00000000-0000-0000-0000-000000000001 type: string name: description: Display name of the user who created the playlist. type: string uuid: description: UUID of the user who created the playlist. example: 00000000-0000-0000-0000-000000000001 type: string required: - handle - id - uuid type: object PlaylistDataType: default: rum_replay_playlist description: Rum replay playlist resource type. enum: - rum_replay_playlist example: rum_replay_playlist type: string x-enum-varnames: - RUM_REPLAY_PLAYLIST PlaylistsSession: description: A single RUM replay session resource as it appears within a playlist context. properties: data: $ref: "#/components/schemas/PlaylistsSessionData" required: - data type: object PlaylistsSessionArray: description: A list of RUM replay sessions belonging to a playlist. properties: data: description: Array of playlist session data objects. items: $ref: "#/components/schemas/PlaylistsSessionData" type: array required: - data type: object PlaylistsSessionData: description: Data object representing a session within a playlist, including its identifier, type, and attributes. properties: attributes: $ref: "#/components/schemas/PlaylistsSessionDataAttributes" id: description: Unique identifier of the RUM replay session. type: string type: $ref: "#/components/schemas/ViewershipHistorySessionDataType" required: - type type: object PlaylistsSessionDataAttributes: description: Attributes of a session within a playlist, including the session event data and its replay track. properties: session_event: additionalProperties: {} description: Raw event data associated with the replay session. type: object track: description: Replay track identifier indicating which recording track the session belongs to. type: string type: object PortablePdbSourcemapAttributes: description: Attributes of a Portable PDB file. properties: build_id: description: The build identifier. example: 550e8400e29b41d4a71644665544000012345678 type: string created_at: description: The timestamp when the symbol file was created. example: "2024-01-01T00:00:00Z" format: date-time type: string file_name: description: The file name of the symbol file. example: MyApplication.pdb type: string mapkind: $ref: "#/components/schemas/PortablePdbSourcemapMapKind" size: description: The size of the symbol file in bytes. example: 4096 format: int64 type: integer required: - mapkind type: object PortablePdbSourcemapData: description: Portable PDB file data object. properties: attributes: $ref: "#/components/schemas/PortablePdbSourcemapAttributes" id: description: The unique identifier of the source map. example: "10" type: string type: $ref: "#/components/schemas/SourcemapDataType" required: - id - type - attributes type: object PortablePdbSourcemapMapKind: description: The type of source map. Always `portable_pdb` for Portable PDB files. enum: - portable_pdb example: portable_pdb type: string x-enum-varnames: - PORTABLE_PDB PostmortemAttachmentRequest: description: Request body for creating a postmortem attachment. properties: data: $ref: "#/components/schemas/PostmortemAttachmentRequestData" required: - data type: object PostmortemAttachmentRequestAttributes: description: Postmortem attachment attributes properties: cells: description: The cells of the postmortem items: $ref: "#/components/schemas/PostmortemCell" type: array content: description: The content of the postmortem example: |- # Incident Report - IR-123 [...] type: string postmortem_template_id: description: The ID of the postmortem template example: "93645509-874e-45c4-adfa-623bfeaead89-123" type: string title: description: The title of the postmortem example: Postmortem-IR-123 type: string type: object PostmortemAttachmentRequestData: description: Postmortem attachment data properties: attributes: $ref: "#/components/schemas/PostmortemAttachmentRequestAttributes" type: $ref: "#/components/schemas/IncidentAttachmentType" required: - type - attributes type: object PostmortemCell: description: A cell in the postmortem properties: attributes: $ref: "#/components/schemas/PostmortemCellAttributes" id: description: The unique identifier of the cell example: "cell-1" type: string type: $ref: "#/components/schemas/PostmortemCellType" type: object PostmortemCellAttributes: description: Attributes of a postmortem cell properties: definition: $ref: "#/components/schemas/PostmortemCellDefinition" type: object PostmortemCellDefinition: description: Definition of a postmortem cell properties: content: description: The content of the cell in markdown format example: |- ## Incident Summary This incident was caused by... type: string type: object PostmortemCellType: description: The postmortem cell resource type. enum: - markdown example: markdown type: string x-enum-varnames: - MARKDOWN PostmortemTemplateAttributesRequest: description: Attributes for creating or updating a postmortem template. properties: confluence_postmortem_settings: $ref: "#/components/schemas/ConfluencePostmortemSettings" content: description: The templated content of the postmortem, supporting Markdown and incident template variables. example: "# Overview\n\n# What Happened\n\n# Timeline\n\n# Action Items" type: string google_docs_postmortem_settings: $ref: "#/components/schemas/GoogleDocsPostmortemSettings" is_default: description: When set, marks this template as a default. The effective default for an incident type is the template with the most recent `is_default` timestamp. Set to `null` to unset. example: "2024-01-01T00:00:00+00:00" format: date-time nullable: true type: string location: $ref: "#/components/schemas/PostmortemTemplateLocation" name: description: The name of the template. example: "Standard Postmortem Template" type: string required: - name type: object PostmortemTemplateAttributesResponse: description: Attributes of a postmortem template returned in a response. properties: confluence_postmortem_settings: $ref: "#/components/schemas/ConfluencePostmortemSettings" content: description: The templated content of the postmortem, supporting Markdown and incident template variables. example: "# Overview\n\n# What Happened\n\n# Timeline\n\n# Action Items" type: string createdAt: description: When the template was created. example: "2026-01-13T17:15:53.208340Z" format: date-time type: string google_docs_postmortem_settings: $ref: "#/components/schemas/GoogleDocsPostmortemSettings" is_default: description: When set, marks this template as a default. The effective default for an incident type is the template with the most recent `is_default` timestamp. example: "2024-01-01T00:00:00+00:00" format: date-time nullable: true type: string location: $ref: "#/components/schemas/PostmortemTemplateLocation" modifiedAt: description: When the template was last modified. example: "2026-01-13T17:15:53.208340Z" format: date-time type: string name: description: The name of the template. example: "Standard Postmortem Template" type: string required: - name - content - is_default - location - createdAt - modifiedAt type: object PostmortemTemplateCreateRelationships: description: Relationships for a postmortem template. `incident_type` is required when creating a template and is immutable afterwards. properties: incident_type: $ref: "#/components/schemas/PostmortemTemplateIncidentTypeRelationship" type: object PostmortemTemplateDataRequest: description: Data object for creating or updating a postmortem template. properties: attributes: $ref: "#/components/schemas/PostmortemTemplateAttributesRequest" id: description: The ID of the template. Required when updating. example: 00000000-0000-0000-0000-000000000000 type: string relationships: $ref: "#/components/schemas/PostmortemTemplateCreateRelationships" type: $ref: "#/components/schemas/PostmortemTemplateType" required: - type - attributes type: object PostmortemTemplateDataResponse: description: Data object for a postmortem template returned in a response. properties: attributes: $ref: "#/components/schemas/PostmortemTemplateAttributesResponse" id: description: The ID of the template. example: 00000000-0000-0000-0000-000000000000 type: string relationships: $ref: "#/components/schemas/PostmortemTemplateResponseRelationships" type: $ref: "#/components/schemas/PostmortemTemplateType" required: - id - type - attributes type: object PostmortemTemplateIncidentTypeRelationship: description: Relationship to the incident type this template belongs to. properties: data: $ref: "#/components/schemas/PostmortemTemplateIncidentTypeRelationshipData" required: - data type: object PostmortemTemplateIncidentTypeRelationshipData: description: Incident type relationship data. properties: id: description: The incident type identifier. example: 00000000-0000-0000-0000-000000000009 format: uuid type: string type: description: The incident type resource type. example: incident_types type: string required: - id - type type: object PostmortemTemplateLocation: default: datadog_notebooks description: The location where the postmortem is created and stored. enum: - datadog_notebooks - confluence - google_docs example: datadog_notebooks type: string x-enum-varnames: - DATADOG_NOTEBOOKS - CONFLUENCE - GOOGLE_DOCS PostmortemTemplateRequest: description: Request body for creating or updating a postmortem template. properties: data: $ref: "#/components/schemas/PostmortemTemplateDataRequest" required: - data type: object PostmortemTemplateResponse: description: Response containing a single postmortem template. properties: data: $ref: "#/components/schemas/PostmortemTemplateDataResponse" required: - data type: object PostmortemTemplateResponseRelationships: description: Relationships of a postmortem template returned in a response. properties: incident_type: $ref: "#/components/schemas/PostmortemTemplateIncidentTypeRelationship" last_modified_by_user: $ref: "#/components/schemas/PostmortemTemplateUserRelationship" type: object PostmortemTemplateType: description: Postmortem template resource type. enum: - postmortem_templates - postmortem_template example: postmortem_templates type: string x-enum-varnames: - POSTMORTEM_TEMPLATES - POSTMORTEM_TEMPLATE PostmortemTemplateUserRelationship: description: Relationship to a user. properties: data: $ref: "#/components/schemas/PostmortemTemplateUserRelationshipData" required: - data type: object PostmortemTemplateUserRelationshipData: description: User relationship data. properties: id: description: The user identifier. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string type: description: The user resource type. example: users type: string required: - id - type type: object PostmortemTemplatesResponse: description: Response containing a list of postmortem templates. properties: data: description: An array of postmortem template data objects. items: $ref: "#/components/schemas/PostmortemTemplateDataResponse" type: array required: - data type: object Powerpack: description: |- Powerpacks are templated groups of dashboard widgets you can save from an existing dashboard and turn into reusable packs in the widget tray. properties: data: $ref: "#/components/schemas/PowerpackData" type: object PowerpackAttributes: description: Powerpack attribute object. properties: description: description: Description of this powerpack. example: "Powerpack for ABC" type: string group_widget: $ref: "#/components/schemas/PowerpackGroupWidget" name: description: Name of the powerpack. example: "Sample Powerpack" type: string tags: description: List of tags to identify this powerpack. example: ["tag:foo1"] items: description: A tag to identify this powerpack. maxLength: 80 type: string maxItems: 8 type: array template_variables: description: List of template variables for this powerpack. example: [{"defaults": ["*"], "name": "test"}] items: $ref: "#/components/schemas/PowerpackTemplateVariable" type: array required: - group_widget - name type: object PowerpackData: description: Powerpack data object. properties: attributes: $ref: "#/components/schemas/PowerpackAttributes" id: description: ID of the powerpack. type: string relationships: $ref: "#/components/schemas/PowerpackRelationships" type: description: Type of widget, must be powerpack. example: "powerpack" type: string type: object PowerpackGroupWidget: description: Powerpack group widget definition object. properties: definition: $ref: "#/components/schemas/PowerpackGroupWidgetDefinition" layout: $ref: "#/components/schemas/PowerpackGroupWidgetLayout" live_span: $ref: "#/components/schemas/WidgetLiveSpan" required: - definition type: object PowerpackGroupWidgetDefinition: description: Powerpack group widget object. properties: layout_type: description: Layout type of widgets. example: ordered type: string show_title: description: Boolean indicating whether powerpack group title should be visible or not. example: true type: boolean title: description: Name for the group widget. example: Sample Powerpack type: string type: description: Type of widget, must be group. example: group type: string widgets: description: Widgets inside the powerpack. example: [{"definition": {"content": "example", "type": "note"}, "layout": {"height": 5, "width": 10, "x": 0, "y": 0}}] items: $ref: "#/components/schemas/PowerpackInnerWidgets" type: array required: - widgets - layout_type - type type: object PowerpackGroupWidgetLayout: description: Powerpack group widget layout. properties: height: description: The height of the widget. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer width: description: The width of the widget. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer x: description: The position of the widget on the x (horizontal) axis. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer y: description: The position of the widget on the y (vertical) axis. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer required: - x - y - width - height type: object PowerpackInnerWidgetLayout: description: Powerpack inner widget layout. properties: height: description: The height of the widget. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer width: description: The width of the widget. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer x: description: The position of the widget on the x (horizontal) axis. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer y: description: The position of the widget on the y (vertical) axis. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer required: - x - y - width - height type: object PowerpackInnerWidgets: description: Powerpack group widget definition of individual widgets. properties: definition: additionalProperties: {} description: Information about widget. example: {"definition": {"content": "example", "type": "note"}} type: object layout: $ref: "#/components/schemas/PowerpackInnerWidgetLayout" required: - definition type: object PowerpackRelationships: description: Powerpack relationship object. properties: author: $ref: "#/components/schemas/RelationshipToUser" type: object PowerpackResponse: description: Response object which includes a single powerpack configuration. properties: data: $ref: "#/components/schemas/PowerpackData" included: description: Array of objects related to the users. items: $ref: "#/components/schemas/User" type: array readOnly: true type: object PowerpackResponseLinks: description: Links attributes. properties: first: description: Link to last page. type: string last: description: Link to first page. example: "https://app.datadoghq.com/api/v2/powerpacks?page[offset]=0&page[limit]=25" nullable: true type: string next: description: Link for the next set of results. example: "https://app.datadoghq.com/api/v2/powerpacks?page[offset]=25&page[limit]=25" type: string prev: description: Link for the previous set of results. nullable: true type: string self: description: Link to current page. example: "https://app.datadoghq.com/api/v2/powerpacks" type: string type: object PowerpackTemplateVariable: description: Powerpack template variables. properties: available_values: description: The list of values that the template variable drop-down is limited to. example: ["my-host", "host1", "host2"] items: description: Template variable value. type: string nullable: true type: array defaults: description: One or many template variable default values within the saved view, which are unioned together using `OR` if more than one is specified. items: description: One or many default values of the template variable. minLength: 1 type: string type: array name: description: The name of the variable. example: datacenter type: string prefix: description: The tag prefix associated with the variable. Only tags with this prefix appear in the variable drop-down. example: host nullable: true type: string required: - name type: object PowerpacksResponseMeta: description: Powerpack response metadata. properties: pagination: $ref: "#/components/schemas/PowerpacksResponseMetaPagination" type: object PowerpacksResponseMetaPagination: description: Powerpack response pagination metadata. properties: first_offset: description: The first offset. format: int64 type: integer last_offset: description: The last offset. format: int64 nullable: true type: integer limit: description: Pagination limit. format: int64 type: integer next_offset: description: The next offset. format: int64 type: integer offset: description: The offset. format: int64 type: integer prev_offset: description: The previous offset. format: int64 type: integer total: description: Total results. format: int64 type: integer type: description: Offset type. type: string type: object PreviewEntityResponseData: description: Entity data returned in a preview response, including attributes, relationships, and type. properties: attributes: $ref: "#/components/schemas/EntityResponseDataAttributes" id: description: Entity unique identifier. type: string relationships: $ref: "#/components/schemas/EntityResponseDataRelationships" type: $ref: "#/components/schemas/EntityResponseDataType" required: - type type: object PrintReportRequest: description: Request body for initiating a print-only report. properties: data: $ref: "#/components/schemas/PrintReportRequestData" required: - data type: object PrintReportRequestAttributes: description: |- The configuration for a print-only report. Specify exactly one of `timeframe` (for a relative time window) or both `from_ts` and `to_ts` (for an absolute time range). properties: from_ts: description: |- The start of an absolute time range, as a Unix timestamp in milliseconds. Required when `timeframe` is omitted. example: 1780318800000 format: int64 type: integer resource_id: description: The identifier of the dashboard or integration dashboard to render. example: "abc-def-ghi" type: string resource_type: $ref: "#/components/schemas/ReportScheduleResourceType" template_variables: description: The dashboard template variables applied when rendering the report. items: $ref: "#/components/schemas/ReportScheduleTemplateVariable" type: array timeframe: description: |- A relative time window (for example `1w` or `calendar_month`). Mutually exclusive with `from_ts` and `to_ts`. example: "1w" type: string timezone: description: The IANA time zone identifier used to evaluate the time window. example: "America/New_York" type: string to_ts: description: |- The end of an absolute time range, as a Unix timestamp in milliseconds. Required when `timeframe` is omitted. example: 1780923600000 format: int64 type: integer required: - resource_id - resource_type - timezone - template_variables type: object PrintReportRequestData: description: The JSON:API data object for a print report request. properties: attributes: $ref: "#/components/schemas/PrintReportRequestAttributes" type: $ref: "#/components/schemas/PrintReportType" required: - type - attributes type: object PrintReportResponse: description: Response containing the initiated print-only report. properties: data: $ref: "#/components/schemas/PrintReportResponseData" required: - data type: object PrintReportResponseAttributes: description: The configuration and download URL for the initiated print-only report. properties: download_url: description: The URL from which the rendered PDF report can be downloaded. example: "https://app.datadoghq.com/..." type: string from_ts: description: The start of the rendered time range, as a Unix timestamp in milliseconds. example: 1780318800000 format: int64 type: integer resource_id: description: The identifier of the dashboard or integration dashboard. example: "abc-def-ghi" type: string resource_type: $ref: "#/components/schemas/ReportScheduleResourceType" template_variables: description: The dashboard template variables applied when rendering the report. items: $ref: "#/components/schemas/ReportScheduleTemplateVariable" type: array timeframe: description: The relative time window used, if one was specified in the request. example: "1w" type: string timezone: description: The IANA time zone identifier used when rendering the report. example: "America/New_York" type: string to_ts: description: The end of the rendered time range, as a Unix timestamp in milliseconds. example: 1780923600000 format: int64 type: integer required: - resource_id - resource_type - timezone - template_variables - from_ts - to_ts - download_url type: object PrintReportResponseData: description: The JSON:API data object for a print-only report. properties: attributes: $ref: "#/components/schemas/PrintReportResponseAttributes" id: description: The unique identifier of the report. example: "11111111-2222-3333-4444-555555555555" format: uuid type: string type: $ref: "#/components/schemas/PrintReportType" required: - id - type - attributes type: object PrintReportType: description: JSON:API resource type for a print-only report. enum: - report example: report type: string x-enum-varnames: - REPORT ProcessDataSource: default: process description: A data source for process-level infrastructure metrics. enum: - process example: process type: string x-enum-varnames: - PROCESS ProcessScalarQuery: description: |- Per-process metrics from Live Processes. Queries without `aggregator` fail. To scope to one process, set `tag_filters` to its `identifying_tags` from `GET /api/v2/processes`. properties: aggregator: $ref: "#/components/schemas/MetricsAggregator" cross_org_uuids: $ref: "#/components/schemas/CrossOrgUuids" data_source: $ref: "#/components/schemas/ProcessDataSource" is_normalized_cpu: description: Whether CPU metrics should be normalized by core count. type: boolean limit: description: |- Maximum number of processes or groups to return. Large values can fail with an `Unprocessable Content` error. If so, retry with a smaller limit. format: int64 type: integer metric: description: |- The process metric to query, such as `process.stat.cpu.total_pct`, `process.stat.memory.rss`, or `process.stat.memory.vms`. example: process.stat.cpu.total_pct type: string name: description: The variable name for use in formulas. example: query1 type: string sort: $ref: "#/components/schemas/QuerySortOrder" tag_filters: description: |- Tags to narrow down processes. To scope to one process, use its `identifying_tags` from `GET /api/v2/processes`, for example `host:web-01` and `pid:1234`. items: description: A tag filter value. example: "env:prod" type: string type: array text_filter: description: A full-text search filter to match process names or commands. type: string required: - data_source - name - metric type: object ProcessSummariesMeta: description: Response metadata object. properties: page: $ref: "#/components/schemas/ProcessSummariesMetaPage" type: object ProcessSummariesMetaPage: description: Paging attributes. properties: after: description: |- The cursor used to get the next results, if any. To make the next request, use the same parameters with the addition of the `page[cursor]`. example: 911abf1204838d9cdfcb9a96d0b6a1bd03e1b514074f1ce1737c4cbd type: string size: description: Number of results returned. format: int32 maximum: 10000 minimum: 0 type: integer type: object ProcessSummariesResponse: description: List of process summaries. properties: data: description: Array of process summary objects. items: $ref: "#/components/schemas/ProcessSummary" type: array meta: $ref: "#/components/schemas/ProcessSummariesMeta" type: object ProcessSummary: description: Process summary object. properties: attributes: $ref: "#/components/schemas/ProcessSummaryAttributes" id: description: Process ID. type: string type: $ref: "#/components/schemas/ProcessSummaryType" type: object ProcessSummaryAttributes: description: Attributes for a process summary. properties: cmdline: description: Process command line. type: string executable: description: Path to the process executable. type: string host: description: Host running the process. type: string identifying_tags: description: |- Tags that uniquely identify the process: a host identity tag (`host`, `task_arn`, or `eks_fargate_node`) and a `pid` tag. Omitted if either tag is unavailable. items: description: A tag identifying the process. type: string type: array pid: description: Process ID. format: int64 type: integer ppid: description: Parent process ID. format: int64 type: integer start: description: Time the process was started. type: string tags: description: List of tags associated with the process. items: description: A tag associated with the process. type: string type: array timestamp: description: Time the process was seen. type: string user: description: Process owner. type: string type: object ProcessSummaryType: default: process description: Type of process summary. enum: - process example: process type: string x-enum-varnames: - PROCESS ProcessTimeseriesQuery: description: |- Per-process metrics from Live Processes over time, such as CPU and memory usage. To scope to one process, set `tag_filters` to its `identifying_tags` from `GET /api/v2/processes`. properties: cross_org_uuids: $ref: "#/components/schemas/CrossOrgUuids" data_source: $ref: "#/components/schemas/ProcessDataSource" is_normalized_cpu: description: Whether CPU metrics should be normalized by core count. type: boolean limit: description: |- Maximum number of processes or groups to return. Large values can fail with an `Unprocessable Content` error. If so, retry with a smaller limit. format: int64 type: integer metric: description: |- The process metric to query, such as `process.stat.cpu.total_pct`, `process.stat.memory.rss`, or `process.stat.memory.vms`. example: process.stat.cpu.total_pct type: string name: description: The variable name for use in formulas. example: query1 type: string sort: $ref: "#/components/schemas/QuerySortOrder" tag_filters: description: |- Tags to narrow down processes. To scope to one process, use its `identifying_tags` from `GET /api/v2/processes`, for example `host:web-01` and `pid:1234`. items: description: A tag filter value. example: "env:prod" type: string type: array text_filter: description: A full-text search filter to match process names or commands. type: string required: - data_source - name - metric type: object ProductAnalyticsAnalyticsListQuery: description: |- The analytics list query definition. It selects the events to return with `query`, then chooses the columns on each event row, the sort applied to those rows, and a row limit. Unlike the scalar and timeseries queries, a list query returns raw event rows rather than aggregates, so it takes no compute or group-by rule. properties: audience_filters: $ref: "#/components/schemas/ProductAnalyticsAudienceFilters" columns: description: Attribute columns to include in each event row. items: description: The name of an attribute to return as a column. type: string type: array limit: description: Maximum number of event rows to return. example: 100 format: int64 maximum: 1000 minimum: 1 type: integer query: $ref: "#/components/schemas/ProductAnalyticsBaseQuery" sort: $ref: "#/components/schemas/ProductAnalyticsAnalyticsListSort" required: - query type: object ProductAnalyticsAnalyticsListRecord: additionalProperties: description: The value of one column of the event row. description: A single event row, keyed by column name. type: object ProductAnalyticsAnalyticsListRequest: description: Request for listing the individual event records matching an analytics query. example: data: attributes: from: 1771232048460 query: columns: - "@view.name" limit: 100 query: data_source: product_analytics search: query: "@type:view" to: 1771836848262 type: formula_analytics_extended_list_request properties: data: $ref: "#/components/schemas/ProductAnalyticsAnalyticsListRequestData" required: - data type: object ProductAnalyticsAnalyticsListRequestAttributes: description: Attributes for an analytics list request. properties: from: description: Start time in epoch milliseconds. Must be less than `to`. example: 1771232048460 format: int64 type: integer query: $ref: "#/components/schemas/ProductAnalyticsAnalyticsListQuery" to: description: End time in epoch milliseconds. example: 1771836848262 format: int64 type: integer required: - from - to - query type: object ProductAnalyticsAnalyticsListRequestData: description: Data object for an analytics list request. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsAnalyticsListRequestAttributes" type: $ref: "#/components/schemas/ProductAnalyticsAnalyticsListRequestType" required: - type - attributes type: object ProductAnalyticsAnalyticsListRequestType: description: The resource type for analytics list requests. enum: - formula_analytics_extended_list_request example: formula_analytics_extended_list_request type: string x-enum-varnames: - FORMULA_ANALYTICS_EXTENDED_LIST_REQUEST ProductAnalyticsAnalyticsListResponse: description: Response for an analytics list query, containing individual event records. properties: data: $ref: "#/components/schemas/ProductAnalyticsAnalyticsListResponseData" meta: $ref: "#/components/schemas/ProductAnalyticsResponseMeta" required: - data type: object ProductAnalyticsAnalyticsListResponseAttributes: description: Attributes of an analytics list response, containing the matching event rows. properties: records: description: The event rows, each holding the values of the requested columns. items: $ref: "#/components/schemas/ProductAnalyticsAnalyticsListRecord" type: array total_count: description: Total number of records matching the query, before the row limit is applied. format: int64 type: integer type: object ProductAnalyticsAnalyticsListResponseData: description: Data object for an analytics list response. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsAnalyticsListResponseAttributes" id: description: Unique identifier for this response data object. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: "#/components/schemas/ProductAnalyticsAnalyticsListResponseType" required: - id - type - attributes type: object ProductAnalyticsAnalyticsListResponseType: description: The resource type identifier for an analytics list response. enum: - list_response example: list_response type: string x-enum-varnames: - LIST_RESPONSE ProductAnalyticsAnalyticsListSort: description: The sort applied to the returned event rows. properties: facet: description: Name of the facet to sort the rows by. type: string order: $ref: "#/components/schemas/ProductAnalyticsAnalyticsListSortOrder" type: object ProductAnalyticsAnalyticsListSortOrder: description: The direction rows are sorted in. enum: - asc - desc type: string x-enum-varnames: - ASC - DESC ProductAnalyticsAnalyticsQuery: description: The analytics query definition containing a base query, compute rule, and optional grouping. properties: audience_filters: $ref: "#/components/schemas/ProductAnalyticsAudienceFilters" compute: $ref: "#/components/schemas/ProductAnalyticsCompute" group_by: description: Group-by rules for segmenting results. items: $ref: "#/components/schemas/ProductAnalyticsGroupBy" type: array indexes: deprecated: true description: |- Deprecated. Index selection is a rollout detail and will be removed. Do not set this field. items: description: Index name to restrict the query to. type: string maxItems: 1 type: array query: $ref: "#/components/schemas/ProductAnalyticsBaseQuery" required: - query - compute type: object ProductAnalyticsAnalyticsRequest: description: Request for computing analytics results (scalar or timeseries). example: data: attributes: from: 1771232048460 query: compute: aggregation: count query: data_source: product_analytics search: query: "@type:view" to: 1771836848262 type: formula_analytics_extended_request properties: data: $ref: "#/components/schemas/ProductAnalyticsAnalyticsRequestData" required: - data type: object ProductAnalyticsAnalyticsRequestAttributes: description: Attributes for an analytics request. properties: enforced_execution_type: $ref: "#/components/schemas/ProductAnalyticsExecutionType" deprecated: true description: |- Deprecated. Selects the internal query execution infrastructure and will be removed. Do not set this field. from: description: Start time in epoch milliseconds. Must be less than `to`. example: 1771232048460 format: int64 type: integer query: $ref: "#/components/schemas/ProductAnalyticsAnalyticsQuery" request_id: description: Unique identifier of the query. type: string to: description: End time in epoch milliseconds. example: 1771836848262 format: int64 type: integer required: - from - to - query type: object ProductAnalyticsAnalyticsRequestData: description: Data object for an analytics request. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsAnalyticsRequestAttributes" type: $ref: "#/components/schemas/ProductAnalyticsAnalyticsRequestType" required: - type - attributes type: object ProductAnalyticsAnalyticsRequestType: description: The resource type for analytics requests. enum: - formula_analytics_extended_request example: formula_analytics_extended_request type: string x-enum-varnames: - FORMULA_ANALYTICS_EXTENDED_REQUEST ProductAnalyticsAudienceAccountSubquery: description: An account-based audience query. properties: name: description: Name of this query, referenced in the formula. example: "" type: string query: description: Search query for filtering accounts. type: string required: - name type: object ProductAnalyticsAudienceFilters: description: Audience filter definitions for targeting specific user segments. properties: accounts: description: Account audience queries. items: $ref: "#/components/schemas/ProductAnalyticsAudienceAccountSubquery" type: array formula: description: Boolean formula combining audience queries by name. example: "u" type: string segments: description: Segment audience queries. items: $ref: "#/components/schemas/ProductAnalyticsAudienceSegmentSubquery" type: array users: description: User audience queries. items: $ref: "#/components/schemas/ProductAnalyticsAudienceUserSubquery" type: array type: object ProductAnalyticsAudienceSegmentSubquery: description: A segment-based audience query. properties: name: description: Name of this query, referenced in the formula. example: "" type: string segment_id: description: UUID of the segment to filter by. example: 00000000-0000-0000-0000-000000000000 format: uuid type: string required: - name - segment_id type: object ProductAnalyticsAudienceUserSubquery: description: A user-based audience query. properties: name: description: Name of this query, referenced in the formula. example: u type: string query: description: Search query for filtering users. example: "*" type: string required: - name type: object ProductAnalyticsBaseQuery: description: |- A query definition discriminated by the `data_source` field. Use `product_analytics` for standard event queries, or `product_analytics_occurrence` for occurrence-filtered queries. oneOf: - $ref: "#/components/schemas/ProductAnalyticsEventQuery" - $ref: "#/components/schemas/ProductAnalyticsOccurrenceQuery" ProductAnalyticsCalendarInterval: description: A calendar-aligned bucket definition, such as "every 1 week starting on Monday". properties: alignment: description: |- Where each bucket starts within the calendar unit. Use an hour for `day` (for example `1am` or `14`), a day name for `week` (for example `monday`), or an ordinal for `month` (for example `1st`). example: monday type: string quantity: description: Number of calendar units per bucket. example: 1 format: int64 minimum: 1 type: integer timezone: description: Timezone used to align the buckets. example: UTC type: string type: $ref: "#/components/schemas/ProductAnalyticsCalendarIntervalType" required: - type type: object ProductAnalyticsCalendarIntervalType: description: Calendar unit used to bucket cohorts. enum: - minute - hour - day - week - month - quarter - year example: week type: string x-enum-varnames: - MINUTE - HOUR - DAY - WEEK - MONTH - QUARTER - YEAR ProductAnalyticsCompute: description: A compute rule for aggregating data. properties: aggregation: description: The aggregation function (count, cardinality, avg, sum, min, max, etc.). example: count type: string interval: description: |- Time bucket size in milliseconds. Required for timeseries queries; ignored by the scalar endpoint, which returns a single value. example: 3600000 format: int64 type: integer metric: description: The metric to aggregate on. Required for non-count aggregations. example: "@session.time_spent" type: string required: - aggregation type: object ProductAnalyticsElapsedTime: description: Elapsed time statistics (min/max/avg in milliseconds). properties: avg: description: Average elapsed time to reach the next step, in milliseconds. example: 5100 format: int64 type: integer max: description: Maximum elapsed time to reach the next step, in milliseconds. example: 42000 format: int64 type: integer min: description: Minimum elapsed time to reach the next step, in milliseconds. example: 900 format: int64 type: integer required: - min - max - avg type: object ProductAnalyticsEventQuery: description: A standard Product Analytics event query. properties: data_source: $ref: "#/components/schemas/ProductAnalyticsEventQueryDataSource" search: $ref: "#/components/schemas/ProductAnalyticsEventSearch" required: - data_source - search type: object ProductAnalyticsEventQueryDataSource: description: The data source identifier. enum: - product_analytics example: product_analytics type: string x-enum-varnames: - PRODUCT_ANALYTICS ProductAnalyticsEventSearch: description: Search parameters for an event query. properties: query: description: The search query using Datadog search syntax. example: "@type:view" type: string type: object ProductAnalyticsExecutionType: description: Override the query execution strategy. enum: - simple - background - trino-multistep - materialized-view type: string x-enum-varnames: - SIMPLE - BACKGROUND - TRINO_MULTISTEP - MATERIALIZED_VIEW ProductAnalyticsFormulaJourneyQuery: description: Query definition for a journey timeseries request. properties: compute: $ref: "#/components/schemas/ProductAnalyticsGraphQueryCompute" group_by: description: Segments the results by the values of one or more facets. items: $ref: "#/components/schemas/ProductAnalyticsGraphQueryGroupBy" type: array query_id: description: Caller-defined identifier echoed back in the results. type: string search: $ref: "#/components/schemas/ProductAnalyticsJourneySearch" required: - search - compute type: object ProductAnalyticsFormulaJourneyRequest: description: Request body for a journey timeseries query. properties: data: $ref: "#/components/schemas/ProductAnalyticsFormulaJourneyRequestData" required: - data type: object ProductAnalyticsFormulaJourneyRequestAttributes: description: Attributes of a journey timeseries request. properties: from: description: Start of the query window, in epoch milliseconds. example: 1756425600000 format: int64 type: integer interval: description: Time bucket interval in milliseconds. format: int64 type: integer query: $ref: "#/components/schemas/ProductAnalyticsFormulaJourneyQuery" to: description: End of the query window, in epoch milliseconds. example: 1756857600000 format: int64 type: integer required: - from - to - query type: object ProductAnalyticsFormulaJourneyRequestData: description: |- The single JSON:API resource carrying a journey timeseries query. Its attributes hold the time window, the bucket interval that splits it, and the journey metric to compute per bucket. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsFormulaJourneyRequestAttributes" type: $ref: "#/components/schemas/ProductAnalyticsFormulaJourneyRequestType" required: - type - attributes type: object ProductAnalyticsFormulaJourneyRequestType: description: The resource type identifier for a journey timeseries or scalar request. enum: - formula_journey_request example: formula_journey_request type: string x-enum-varnames: - FORMULA_JOURNEY_REQUEST ProductAnalyticsFormulaRetentionQuery: description: Query definition for a retention scalar or retention timeseries request. properties: computation_scope: $ref: "#/components/schemas/ProductAnalyticsRetentionScope" compute: $ref: "#/components/schemas/ProductAnalyticsRetentionCompute" group_by: description: Splits the results by the values of one or more facets. items: $ref: "#/components/schemas/ProductAnalyticsRetentionGroupBy" type: array search: $ref: "#/components/schemas/ProductAnalyticsRetentionSearch" required: - search - compute type: object ProductAnalyticsFormulaRetentionRequest: description: Request body for a retention scalar or retention timeseries query. properties: data: $ref: "#/components/schemas/ProductAnalyticsFormulaRetentionRequestData" required: - data type: object ProductAnalyticsFormulaRetentionRequestAttributes: description: Attributes of a retention scalar or retention timeseries request. properties: exclude_anonymous_traffic: default: false description: Whether to exclude sessions that are not tied to an identified user. type: boolean from: description: Start of the query window, in epoch milliseconds. example: 1756425600000 format: int64 type: integer query: $ref: "#/components/schemas/ProductAnalyticsFormulaRetentionQuery" to: description: End of the query window, in epoch milliseconds. example: 1756857600000 format: int64 type: integer required: - from - to - query type: object ProductAnalyticsFormulaRetentionRequestData: description: |- The single JSON:API resource carrying a retention scalar or timeseries query. Its attributes hold the time window to query and the retention query definition to evaluate. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsFormulaRetentionRequestAttributes" type: $ref: "#/components/schemas/ProductAnalyticsFormulaRetentionRequestType" required: - type - attributes type: object ProductAnalyticsFormulaRetentionRequestType: description: The resource type identifier for a retention scalar or retention timeseries request. enum: - formula_retention_request example: formula_retention_request type: string x-enum-varnames: - FORMULA_RETENTION_REQUEST ProductAnalyticsGraphQueryCompute: description: Defines the metric computed over the journey. properties: aggregation: description: |- Aggregation function: `count`, `cardinality`, `avg`, `median`, `min`, `max`, `sum`, or a percentile of the form `pc` such as `pc95`. Defaults to `cardinality`. example: count pattern: "^(count|cardinality|avg|median|min|max|sum|pc[0-9]{1,2})$" type: string interval: description: Time bucket interval in milliseconds, used by timeseries queries. format: int64 type: integer metric: description: |- Metric to aggregate on. Use a facet path such as `@view.time_spent`, or one of the journey metrics `__dd.conversion`, `__dd.conversion_rate`, `__dd.time_to_convert`, or `__dd.dropoff_rate`. Defaults to `__dd.conversion`. type: string target: $ref: "#/components/schemas/ProductAnalyticsJourneyTarget" required: - aggregation type: object ProductAnalyticsGraphQueryGroupBy: description: Segments journey results by the values of a facet. properties: facet: description: Attribute path to group by. example: "@geo.country" type: string limit: description: Maximum number of groups to return. Omit it to let the service choose. format: int64 minimum: 1 type: integer should_exclude_missing: default: false description: Whether to exclude entities that have no value for this facet. type: boolean sort: $ref: "#/components/schemas/ProductAnalyticsGroupBySort" source: $ref: "#/components/schemas/ProductAnalyticsGraphQueryGroupBySource" target: $ref: "#/components/schemas/ProductAnalyticsJourneyTarget" value_filters: description: Restricts the results to these facet values. items: description: A facet value to keep. type: string type: array required: - facet type: object ProductAnalyticsGraphQueryGroupBySource: description: Audience dimension to group by, instead of an event facet. enum: - product_analytics_audience_filters.users - product_analytics_audience_filters.accounts example: product_analytics_audience_filters.users type: string x-enum-varnames: - USERS - ACCOUNTS ProductAnalyticsGroupBy: description: A group-by rule for segmenting results by facet values. properties: facet: description: The facet to group by. example: "@view.name" type: string limit: description: Maximum number of groups to return. example: 10 format: int64 type: integer should_exclude_missing: default: false description: Exclude results with missing facet values. type: boolean sort: $ref: "#/components/schemas/ProductAnalyticsGroupBySort" source: description: The source for audience-filter-based group-by. type: string required: - facet type: object ProductAnalyticsGroupBySort: description: Sort configuration for group-by results. properties: aggregation: description: The aggregation function to sort by. example: count type: string metric: description: The metric to sort by. type: string order: $ref: "#/components/schemas/QuerySortOrder" type: object ProductAnalyticsInterval: description: An interval definition in a timeseries response. properties: milliseconds: description: The duration of each time bucket in milliseconds. format: int64 type: integer start_time: description: The start of this interval as an epoch timestamp in milliseconds. format: int64 type: integer times: description: Epoch timestamps (in milliseconds) for each bucket in this interval. items: description: Epoch timestamp in milliseconds for a time bucket boundary. format: int64 type: integer type: array type: description: The interval type (e.g., fixed or auto-computed bucket size). type: string type: object ProductAnalyticsJoinKeys: description: Identity join keys used to stitch events belonging to the same user or session. properties: primary: description: Primary identity join key. Defaults to `@session.id`. example: "@session.id" type: string secondary: description: Additional identity join keys. items: description: An identity join key facet. type: string type: array type: object ProductAnalyticsJourneyAudienceAccountQuery: description: A named sub-query selecting a set of accounts. properties: name: description: Unique name for this sub-query, referenced from `formula`. example: enterprise_accounts type: string query: description: Search query selecting the accounts. type: string required: - name type: object ProductAnalyticsJourneyAudienceFilters: description: |- Restricts the journey to an audience built from named sub-queries. Sub-query names must be unique across `users`, `segments`, and `accounts`. properties: accounts: description: Named account sub-queries. items: $ref: "#/components/schemas/ProductAnalyticsJourneyAudienceAccountQuery" type: array formula: description: |- Boolean expression combining the sub-query names with `AND`, `OR`, and `NOT`. When empty, all sub-queries are combined with `AND`. example: power_users AND NOT trial_segment type: string segments: description: Named segment sub-queries. items: $ref: "#/components/schemas/ProductAnalyticsJourneyAudienceSegmentQuery" type: array users: description: Named user sub-queries. items: $ref: "#/components/schemas/ProductAnalyticsJourneyAudienceUserQuery" type: array type: object ProductAnalyticsJourneyAudienceSegmentQuery: description: A named sub-query selecting a saved segment. properties: name: description: Unique name for this sub-query, referenced from `formula`. example: trial_segment type: string segment_id: description: Identifier of the saved segment. example: 00000000-0000-0000-0000-000000000000 type: string required: - name - segment_id type: object ProductAnalyticsJourneyAudienceUserQuery: description: A named sub-query selecting a set of users. properties: name: description: Unique name for this sub-query, referenced from `formula`. example: power_users type: string query: description: Search query selecting the users. type: string required: - name type: object ProductAnalyticsJourneyComputedColumn: description: |- A computed column added to each row. Requesting `first_conversion_timestamps` adds one `_timestamp` key per step. properties: name: $ref: "#/components/schemas/ProductAnalyticsJourneyComputedColumnName" required: - name type: object ProductAnalyticsJourneyComputedColumnName: description: Name of a computed column to add to each row. enum: - first_conversion_timestamps example: first_conversion_timestamps type: string x-enum-varnames: - FIRST_CONVERSION_TIMESTAMPS ProductAnalyticsJourneyConversionType: description: Whether to return the entities that converted at the target step, or those that dropped off. enum: - conversion - drop-off example: conversion type: string x-enum-varnames: - CONVERSION - DROP_OFF ProductAnalyticsJourneyEntity: description: The kind of entity returned by a journey list query. enum: - session - user - account example: session type: string x-enum-varnames: - SESSION - USER - ACCOUNT ProductAnalyticsJourneyFunnelCompute: description: Defines the metric computed at each funnel step. properties: aggregation: description: |- Aggregation function: `count`, `cardinality`, `avg`, `median`, `min`, `max`, `sum`, or a percentile of the form `pc` such as `pc95`. Defaults to `cardinality`. pattern: "^(count|cardinality|avg|median|min|max|sum|pc[0-9]{1,2})$" type: string metric: description: Metric to aggregate on. Defaults to the identity join key. type: string type: object ProductAnalyticsJourneyFunnelQuery: description: Query definition for a journey funnel request. properties: compute: $ref: "#/components/schemas/ProductAnalyticsJourneyFunnelCompute" group_by: description: Segments the funnel by the values of one or more facets. items: $ref: "#/components/schemas/ProductAnalyticsGraphQueryGroupBy" type: array search: $ref: "#/components/schemas/ProductAnalyticsJourneySearch" required: - search type: object ProductAnalyticsJourneyFunnelRequest: description: Request body for a journey funnel analysis. properties: data: $ref: "#/components/schemas/ProductAnalyticsJourneyFunnelRequestData" required: - data type: object ProductAnalyticsJourneyFunnelRequestAttributes: description: Attributes of a journey funnel request. properties: exclude_anonymous_traffic: default: false description: Whether to exclude sessions that are not tied to an identified user. type: boolean from: description: Start of the query window, in epoch milliseconds. example: 1756425600000 format: int64 type: integer query: $ref: "#/components/schemas/ProductAnalyticsJourneyFunnelQuery" to: description: End of the query window, in epoch milliseconds. example: 1756857600000 format: int64 type: integer required: - from - to - query type: object ProductAnalyticsJourneyFunnelRequestData: description: |- The single JSON:API resource carrying a funnel query. Its attributes hold the time window to query and the journey whose step-to-step conversion should be measured. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsJourneyFunnelRequestAttributes" type: $ref: "#/components/schemas/ProductAnalyticsJourneyRequestType" required: - type - attributes type: object ProductAnalyticsJourneyFunnelResponse: description: Response for a journey funnel analysis. properties: data: $ref: "#/components/schemas/ProductAnalyticsJourneyFunnelResponseData" required: - data type: object ProductAnalyticsJourneyFunnelResponseAttributes: description: Attributes of a journey funnel response. properties: end_to_end_conversion_rate: description: Conversion rate from the first step to the last step. example: 0.42 format: double type: number end_to_end_elapsed_time: $ref: "#/components/schemas/ProductAnalyticsElapsedTime" funnel_steps: description: The funnel steps, in the order given by the search expression. items: $ref: "#/components/schemas/ProductAnalyticsJourneyFunnelStep" type: array initial_count: description: Number of entities that entered the funnel. example: 1200 format: int64 type: integer required: - initial_count - end_to_end_conversion_rate - end_to_end_elapsed_time - funnel_steps type: object ProductAnalyticsJourneyFunnelResponseData: description: |- The single JSON:API resource holding a computed funnel. Its attributes contain the number of entities that entered, the end-to-end conversion, and one entry per funnel step. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsJourneyFunnelResponseAttributes" id: description: Identifier of this result. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: "#/components/schemas/ProductAnalyticsJourneyFunnelResponseType" required: - id - type - attributes type: object ProductAnalyticsJourneyFunnelResponseType: description: The resource type identifier for a journey funnel response. enum: - funnel_response example: funnel_response type: string x-enum-varnames: - FUNNEL_RESPONSE ProductAnalyticsJourneyFunnelStep: description: A single step of the funnel with its conversion counts and timings. properties: elapsed_time_to_next_step: $ref: "#/components/schemas/ProductAnalyticsElapsedTime" groups: description: Breakdown of this step by the requested group-by facets. items: $ref: "#/components/schemas/ProductAnalyticsJourneyFunnelStepGroup" type: array label: description: Label of the step, derived from the node alias. example: A type: string unit: description: Unit of the elapsed time values. example: millisecond type: string value: description: Value of the computed metric at this step. example: 1200 format: double type: number required: - value - label - unit - elapsed_time_to_next_step - groups type: object ProductAnalyticsJourneyFunnelStepGroup: description: Breakdown of a funnel step for one combination of group-by values. properties: conversion_count: description: Number of entities in this group that reached the next step. example: 210 format: int64 type: integer elapsed_time_to_next_step: $ref: "#/components/schemas/ProductAnalyticsElapsedTime" group_tags: description: Group-by values identifying this cohort. example: - United States items: description: A group-by value. type: string type: array value: description: Value of the computed metric for this group at this step. example: 480 format: double type: number required: - group_tags - value - conversion_count - elapsed_time_to_next_step type: object ProductAnalyticsJourneyListQuery: description: Query definition for a journey list request. properties: computed_columns: description: Computed columns to add to each row. items: $ref: "#/components/schemas/ProductAnalyticsJourneyComputedColumn" type: array conversion_type: $ref: "#/components/schemas/ProductAnalyticsJourneyConversionType" entity_columns: description: Attribute columns to return for each row, in addition to the identity join key and `timestamp`. items: description: An attribute column to return. type: string type: array entity_filters: description: Additional search query applied to the returned rows. type: string group_by: description: Segments the results by the values of one or more facets. items: $ref: "#/components/schemas/ProductAnalyticsGraphQueryGroupBy" type: array limit: description: Maximum number of rows to return. Omit it to let the service choose. format: int64 minimum: 1 type: integer search: $ref: "#/components/schemas/ProductAnalyticsJourneySearch" sort: $ref: "#/components/schemas/ProductAnalyticsJourneyListSort" target: $ref: "#/components/schemas/ProductAnalyticsJourneyTarget" required: - search type: object ProductAnalyticsJourneyListRecord: additionalProperties: {} description: |- A single row. Keys are the returned column names: the identity join key, `timestamp`, each entry of `entity_columns`, and any computed columns. A value is null when the column has no value for that row. type: object ProductAnalyticsJourneyListRequest: description: Request body for a journey list query. properties: data: $ref: "#/components/schemas/ProductAnalyticsJourneyListRequestData" required: - data type: object ProductAnalyticsJourneyListRequestAttributes: description: Attributes of a journey list request. properties: from: description: Start of the query window, in epoch milliseconds. example: 1756425600000 format: int64 type: integer query: $ref: "#/components/schemas/ProductAnalyticsJourneyListQuery" to: description: End of the query window, in epoch milliseconds. example: 1756857600000 format: int64 type: integer required: - from - to - query type: object ProductAnalyticsJourneyListRequestData: description: |- The single JSON:API resource carrying a journey list query. Its attributes hold the time window and the journey whose matching entities should be listed, one row each. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsJourneyListRequestAttributes" type: $ref: "#/components/schemas/ProductAnalyticsJourneyListRequestType" required: - type - attributes type: object ProductAnalyticsJourneyListRequestType: description: The resource type identifier for a journey list request. enum: - journey_list_request example: journey_list_request type: string x-enum-varnames: - JOURNEY_LIST_REQUEST ProductAnalyticsJourneyListResponse: description: Response for a journey list query. properties: data: $ref: "#/components/schemas/ProductAnalyticsJourneyListResponseData" required: - data type: object ProductAnalyticsJourneyListResponseAttributes: description: Attributes of a journey list response. properties: entity: $ref: "#/components/schemas/ProductAnalyticsJourneyEntity" records: description: The returned rows. items: $ref: "#/components/schemas/ProductAnalyticsJourneyListRecord" type: array total_count: description: Total number of rows matching the query, ignoring `limit`. example: 231 format: int64 type: integer required: - entity - total_count - records type: object ProductAnalyticsJourneyListResponseData: description: |- The single JSON:API resource holding the entities matching a journey. Its attributes contain the returned rows and the total number of rows that matched, ignoring `limit`. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsJourneyListResponseAttributes" id: description: Identifier of this result. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: "#/components/schemas/ProductAnalyticsJourneyListResponseType" required: - id - type - attributes type: object ProductAnalyticsJourneyListResponseType: description: The resource type identifier for a journey list response. enum: - journey_list_response example: journey_list_response type: string x-enum-varnames: - JOURNEY_LIST_RESPONSE ProductAnalyticsJourneyListSort: description: |- Sort configuration for the returned rows. The sort is applied only when `facet` is one of the returned columns; otherwise it is ignored. properties: facet: description: Column to sort on. type: string order: $ref: "#/components/schemas/QuerySortOrder" type: object ProductAnalyticsJourneyNodeTarget: description: A reference to a single step of the journey. properties: type: $ref: "#/components/schemas/ProductAnalyticsJourneyNodeTargetType" value: description: Alias of the targeted node. example: A type: string required: - type - value type: object ProductAnalyticsJourneyNodeTargetType: description: The discriminator identifying a target that references a single step. enum: - node example: node type: string x-enum-varnames: - NODE ProductAnalyticsJourneyPathTarget: description: A reference to the range of steps between two nodes of the journey. properties: end: description: Alias of the node the path ends at. example: B type: string start: description: Alias of the node the path starts at. example: A type: string type: $ref: "#/components/schemas/ProductAnalyticsJourneyPathTargetType" required: - type - start - end type: object ProductAnalyticsJourneyPathTargetType: description: The discriminator identifying a target that references a range of steps. enum: - path example: path type: string x-enum-varnames: - PATH ProductAnalyticsJourneyRequestType: description: The resource type identifier for a journey funnel request. enum: - journey_request example: journey_request type: string x-enum-varnames: - JOURNEY_REQUEST ProductAnalyticsJourneyScalarCompute: description: Defines the metric computed over the journey for a scalar query. properties: aggregation: description: |- Aggregation function: `count`, `cardinality`, `avg`, `median`, `min`, `max`, `sum`, or a percentile of the form `pc` such as `pc95`. Defaults to `cardinality`. example: count pattern: "^(count|cardinality|avg|median|min|max|sum|pc[0-9]{1,2})$" type: string metric: description: |- Metric to aggregate on. Use a facet path such as `@view.time_spent`, or one of the journey metrics `__dd.conversion`, `__dd.conversion_rate`, `__dd.time_to_convert`, or `__dd.dropoff_rate`. Defaults to `__dd.conversion`. type: string target: $ref: "#/components/schemas/ProductAnalyticsJourneyTarget" required: - aggregation type: object ProductAnalyticsJourneyScalarQuery: description: Query definition for a journey scalar request. properties: compute: $ref: "#/components/schemas/ProductAnalyticsJourneyScalarCompute" group_by: description: Segments the results by the values of one or more facets. items: $ref: "#/components/schemas/ProductAnalyticsGraphQueryGroupBy" type: array query_id: description: Caller-defined identifier echoed back in the results. type: string search: $ref: "#/components/schemas/ProductAnalyticsJourneySearch" required: - search - compute type: object ProductAnalyticsJourneyScalarRequest: description: Request body for a journey scalar query. properties: data: $ref: "#/components/schemas/ProductAnalyticsJourneyScalarRequestData" required: - data type: object ProductAnalyticsJourneyScalarRequestAttributes: description: Attributes of a journey scalar request. properties: from: description: Start of the query window, in epoch milliseconds. example: 1756425600000 format: int64 type: integer query: $ref: "#/components/schemas/ProductAnalyticsJourneyScalarQuery" to: description: End of the query window, in epoch milliseconds. example: 1756857600000 format: int64 type: integer required: - from - to - query type: object ProductAnalyticsJourneyScalarRequestData: description: |- The single JSON:API resource carrying a journey scalar query. Its attributes hold the time window and the journey metric to reduce to one value over that window. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsJourneyScalarRequestAttributes" type: $ref: "#/components/schemas/ProductAnalyticsFormulaJourneyRequestType" required: - type - attributes type: object ProductAnalyticsJourneyScalarResponse: description: Response for a journey scalar query. properties: data: $ref: "#/components/schemas/ProductAnalyticsJourneyScalarResponseData" required: - data type: object ProductAnalyticsJourneyScalarResponseData: description: |- The single JSON:API resource holding journey scalar results. Its attributes contain one value per group, suitable for a query value or top list widget. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsScalarResponseAttributes" id: description: Identifier of this result. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: "#/components/schemas/ProductAnalyticsJourneyScalarResponseType" required: - id - type - attributes type: object ProductAnalyticsJourneyScalarResponseType: description: The resource type identifier for a journey scalar response. enum: - journey_scalar_response example: journey_scalar_response type: string x-enum-varnames: - JOURNEY_SCALAR_RESPONSE ProductAnalyticsJourneySearch: description: Defines the steps of the journey and the filters applied to it. properties: expression: description: Expression combining the node aliases in order, for example `A -> B -> C`. example: A -> B type: string filters: $ref: "#/components/schemas/ProductAnalyticsJourneySearchFilters" join_keys: $ref: "#/components/schemas/ProductAnalyticsJoinKeys" node_objects: additionalProperties: $ref: "#/components/schemas/ProductAnalyticsBaseQuery" description: |- Map of node alias to the query matching that step of the journey. Every alias used in `expression` must have an entry here. example: A: data_source: product_analytics search: query: "@type:view @view.name:Login" B: data_source: product_analytics search: query: "@type:action @action.target.name:Submit" type: object required: - expression - node_objects type: object ProductAnalyticsJourneySearchFilters: description: Filters applied on top of the journey step expression. properties: audience_filters: $ref: "#/components/schemas/ProductAnalyticsJourneyAudienceFilters" graph_filters: description: Filters on journey-level metrics such as time to convert. items: $ref: "#/components/schemas/ProductAnalyticsJourneySearchGraphFilter" type: array string_filter: description: Free-text search query applied to the whole journey. type: string type: object ProductAnalyticsJourneySearchGraphFilter: description: A filter applied to a step, or a range of steps, of the journey graph. properties: name: $ref: "#/components/schemas/ProductAnalyticsJourneySearchGraphFilterName" operator: $ref: "#/components/schemas/ProductAnalyticsJourneySearchGraphFilterOperator" target: $ref: "#/components/schemas/ProductAnalyticsJourneyTarget" value: description: Value compared against the metric. Durations are expressed in milliseconds. example: 60000 format: int64 type: integer required: - name - operator - value type: object ProductAnalyticsJourneySearchGraphFilterName: description: The journey-level metric the graph filter applies to. enum: - __dd.time_to_convert - __dd.session - __dd.dropoff_rate example: __dd.time_to_convert type: string x-enum-varnames: - TIME_TO_CONVERT - SESSION - DROPOFF_RATE ProductAnalyticsJourneySearchGraphFilterOperator: description: Comparison operator applied to the graph filter value. enum: - "=" - "<" - ">" - "<=" - ">=" example: "<=" type: string x-enum-varnames: - EQUAL - LESS_THAN - GREATER_THAN - LESS_THAN_OR_EQUAL - GREATER_THAN_OR_EQUAL ProductAnalyticsJourneyTarget: description: |- A reference to a step, or a range of steps, in the journey. Use a `node` target to name a single step, or a `path` target to name the range between two steps. oneOf: - $ref: "#/components/schemas/ProductAnalyticsJourneyNodeTarget" - $ref: "#/components/schemas/ProductAnalyticsJourneyPathTarget" ProductAnalyticsJourneyTimeseriesResponse: description: Response for a journey timeseries query. properties: data: $ref: "#/components/schemas/ProductAnalyticsJourneyTimeseriesResponseData" required: - data type: object ProductAnalyticsJourneyTimeseriesResponseData: description: |- The single JSON:API resource holding journey timeseries results. Its attributes contain one series per group along with the timestamps the points fall on. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsTimeseriesResponseAttributes" id: description: Identifier of this result. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: "#/components/schemas/ProductAnalyticsJourneyTimeseriesResponseType" required: - id - type - attributes type: object ProductAnalyticsJourneyTimeseriesResponseType: description: The resource type identifier for a journey timeseries response. enum: - journey_timeseries_response example: journey_timeseries_response type: string x-enum-varnames: - JOURNEY_TIMESERIES_RESPONSE ProductAnalyticsOccurrenceFilter: description: Filter for occurrence-based queries. properties: meta: additionalProperties: type: string description: Additional metadata. type: object operator: description: Comparison operator (=, >=, <=, >, <). example: ">=" type: string value: description: The occurrence count threshold as a string. example: "1" type: string required: - operator - value type: object ProductAnalyticsOccurrenceQuery: description: A Product Analytics occurrence-filtered query. properties: data_source: $ref: "#/components/schemas/ProductAnalyticsOccurrenceQueryDataSource" search: $ref: "#/components/schemas/ProductAnalyticsOccurrenceSearch" required: - data_source - search type: object ProductAnalyticsOccurrenceQueryDataSource: description: The data source identifier for occurrence queries. enum: - product_analytics_occurrence example: product_analytics_occurrence type: string x-enum-varnames: - PRODUCT_ANALYTICS_OCCURRENCE ProductAnalyticsOccurrenceSearch: description: Search parameters for an occurrence query. properties: occurrences: $ref: "#/components/schemas/ProductAnalyticsOccurrenceFilter" query: description: The search query using Datadog search syntax. example: "@type:action" type: string type: object ProductAnalyticsResponseMeta: description: Metadata for a Product Analytics query response. properties: request_id: description: Unique identifier of the query. type: string status: $ref: "#/components/schemas/ProductAnalyticsResponseMetaStatus" type: object ProductAnalyticsResponseMetaStatus: description: The execution status of a Product Analytics query. enum: - done - running - timeout type: string x-enum-varnames: - DONE - RUNNING - TIMEOUT ProductAnalyticsRetentionAggregationTarget: description: Selects the rolled-up row that aggregates every cohort, rather than a single cohort. properties: type: $ref: "#/components/schemas/ProductAnalyticsRetentionAggregationTargetType" value: description: The aggregation that produced the rolled-up row. example: weighted_avg type: string required: - type - value type: object ProductAnalyticsRetentionAggregationTargetType: description: The discriminator identifying a target selected by aggregation. enum: - aggregation example: aggregation type: string x-enum-varnames: - AGGREGATION ProductAnalyticsRetentionCalendarTimeInterval: description: A retention interval aligned to calendar boundaries. properties: type: $ref: "#/components/schemas/ProductAnalyticsRetentionCalendarTimeIntervalType" value: $ref: "#/components/schemas/ProductAnalyticsCalendarInterval" required: - type - value type: object ProductAnalyticsRetentionCalendarTimeIntervalType: description: The discriminator identifying a calendar-aligned retention interval. enum: - calendar example: calendar type: string x-enum-varnames: - CALENDAR ProductAnalyticsRetentionCellScope: description: Narrows a retention query to a single cell, at the intersection of one cohort and one return period. properties: cohort_target: $ref: "#/components/schemas/ProductAnalyticsRetentionCohortTarget" return_period_target: $ref: "#/components/schemas/ProductAnalyticsRetentionIndexTarget" type: $ref: "#/components/schemas/ProductAnalyticsRetentionCellScopeType" required: - type - cohort_target - return_period_target type: object ProductAnalyticsRetentionCellScopeType: description: The discriminator identifying a scope narrowed to one grid cell. enum: - cell example: cell type: string x-enum-varnames: - CELL ProductAnalyticsRetentionCohortCriteria: description: Defines the event that places an entity into a cohort, and how cohorts are bucketed over time. properties: base_query: $ref: "#/components/schemas/ProductAnalyticsBaseQuery" time_interval: $ref: "#/components/schemas/ProductAnalyticsRetentionTimeInterval" required: - base_query - time_interval type: object ProductAnalyticsRetentionCohortScope: description: Narrows a retention query to a single cohort row. properties: target: $ref: "#/components/schemas/ProductAnalyticsRetentionCohortTarget" type: $ref: "#/components/schemas/ProductAnalyticsRetentionCohortScopeType" required: - type - target type: object ProductAnalyticsRetentionCohortScopeType: description: The discriminator identifying a scope narrowed to one cohort. enum: - cohort example: cohort type: string x-enum-varnames: - COHORT ProductAnalyticsRetentionCohortTarget: description: Selects a cohort, either by index or by the aggregation that rolls all cohorts together. oneOf: - $ref: "#/components/schemas/ProductAnalyticsRetentionIndexTarget" - $ref: "#/components/schemas/ProductAnalyticsRetentionAggregationTarget" ProductAnalyticsRetentionCompute: description: The metric and aggregation applied to a retention query. properties: aggregation: description: The aggregation function applied to the metric, such as `count` or `avg`. example: count type: string metric: $ref: "#/components/schemas/ProductAnalyticsRetentionComputeMetric" required: - metric - aggregation type: object ProductAnalyticsRetentionComputeMetric: description: The retention metric to compute, either an absolute count or a rate. enum: - "__dd.retention" - "__dd.retention_rate" example: "__dd.retention_rate" type: string x-enum-varnames: - RETENTION - RETENTION_RATE ProductAnalyticsRetentionEntity: description: The entity whose retention is measured. enum: - "@usr.id" - "@account.id" example: "@usr.id" type: string x-enum-varnames: - USER_ID - ACCOUNT_ID ProductAnalyticsRetentionFilters: description: Filters narrowing the events considered by a retention query. properties: audience_filters: $ref: "#/components/schemas/ProductAnalyticsAudienceFilters" string_filter: description: Free-text search query applied to the events. type: string type: object ProductAnalyticsRetentionFixedTimeInterval: description: A retention interval of fixed length, such as "7 days". properties: type: $ref: "#/components/schemas/ProductAnalyticsRetentionFixedTimeIntervalType" unit: $ref: "#/components/schemas/ProductAnalyticsRetentionFixedTimeIntervalUnit" value: description: Length of the interval, expressed in `unit`. example: 7 exclusiveMinimum: true format: double minimum: 0 type: number required: - type - value - unit type: object ProductAnalyticsRetentionFixedTimeIntervalType: description: The discriminator identifying a fixed-length retention interval. enum: - fixed example: fixed type: string x-enum-varnames: - FIXED ProductAnalyticsRetentionFixedTimeIntervalUnit: description: Time unit for a fixed-length retention interval. enum: - day - week - month example: day type: string x-enum-varnames: - DAY - WEEK - MONTH ProductAnalyticsRetentionGridCohort: description: One row of the retention grid, holding the results for a single cohort. properties: cells: description: The cells of the row, one per return period. items: $ref: "#/components/schemas/ProductAnalyticsRetentionGridCohortCell" type: array cohort_end_time: description: End of the cohort window, in epoch milliseconds. format: int64 type: integer cohort_index: description: Zero-based index of the cohort in the grid. format: int64 type: integer cohort_size: description: Number of entities in the cohort. format: int64 type: integer cohort_start_time: description: Start of the cohort window, in epoch milliseconds. format: int64 type: integer group_tags: description: The group-by facet values that identify this row. items: description: A tag value for a group-by facet. type: string type: array name: description: Label identifying the cohort, such as the week it started. type: string type: $ref: "#/components/schemas/ProductAnalyticsRetentionGridCohortType" unit: description: Unit definitions for the cell values. items: $ref: "#/components/schemas/ProductAnalyticsUnit" type: array type: object ProductAnalyticsRetentionGridCohortCell: description: |- One cell of the retention grid, holding the result for a single cohort over a single return period. Aggregated rows omit the time and count fields. properties: cell_count: description: Number of entities that returned during the period. format: int64 type: integer cell_rate: description: Fraction of the cohort that returned, between `0` and `1`. format: double type: number cell_relative_value_change: description: Change in the metric relative to the cohort baseline. format: double nullable: true type: number cell_value: description: Value of the computed metric, when a metric other than the retention rate is requested. format: double nullable: true type: number is_partial_data: description: Whether the return period is still open, so the numbers are not yet final. type: boolean return_period_end_time: description: End of the return period, in epoch milliseconds. format: int64 type: integer return_period_index: description: Zero-based index of the return period this cell belongs to. format: int64 type: integer return_period_start_time: description: Start of the return period, in epoch milliseconds. format: int64 type: integer type: $ref: "#/components/schemas/ProductAnalyticsRetentionGridCohortType" type: object ProductAnalyticsRetentionGridCohortType: description: |- Whether the row holds one cohort's own numbers, or the weighted roll-up across every cohort. enum: - raw - aggregated example: raw type: string x-enum-varnames: - RAW - AGGREGATED ProductAnalyticsRetentionGridQuery: description: Query definition for a retention grid or retention metadata request. properties: computation_scope: $ref: "#/components/schemas/ProductAnalyticsRetentionScope" compute: $ref: "#/components/schemas/ProductAnalyticsRetentionCompute" group_by: description: Splits the results by the values of one or more facets. items: $ref: "#/components/schemas/ProductAnalyticsRetentionGroupBy" type: array search: $ref: "#/components/schemas/ProductAnalyticsRetentionSearch" required: - search - compute type: object ProductAnalyticsRetentionGridRequest: description: Request body for a retention grid query. properties: data: $ref: "#/components/schemas/ProductAnalyticsRetentionGridRequestData" required: - data type: object ProductAnalyticsRetentionGridRequestAttributes: description: Attributes of a retention grid request. properties: exclude_anonymous_traffic: default: false description: Whether to exclude sessions that are not tied to an identified user. type: boolean from: description: Start of the query window, in epoch milliseconds. example: 1756425600000 format: int64 type: integer query: $ref: "#/components/schemas/ProductAnalyticsRetentionGridQuery" to: description: End of the query window, in epoch milliseconds. example: 1756857600000 format: int64 type: integer required: - from - to - query type: object ProductAnalyticsRetentionGridRequestData: description: |- The single JSON:API resource carrying a retention grid query. Its attributes hold the time window to query and the cohort and return criteria that define the grid. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsRetentionGridRequestAttributes" type: $ref: "#/components/schemas/ProductAnalyticsRetentionGridRequestType" required: - type - attributes type: object ProductAnalyticsRetentionGridRequestType: description: The resource type identifier for a retention grid request. enum: - retention_grid_request example: retention_grid_request type: string x-enum-varnames: - RETENTION_GRID_REQUEST ProductAnalyticsRetentionGridResponse: description: Response for a retention grid query. properties: data: $ref: "#/components/schemas/ProductAnalyticsRetentionGridResponseData" required: - data type: object ProductAnalyticsRetentionGridResponseAttributes: description: Attributes of a retention grid response, containing the cohort rows and the period columns. properties: cohorts: description: The cohorts forming the rows of the grid. items: $ref: "#/components/schemas/ProductAnalyticsRetentionGridCohort" type: array retention_entity: description: The entity whose retention was measured. type: string retention_periods: description: The return periods forming the columns of the grid. items: $ref: "#/components/schemas/ProductAnalyticsRetentionPeriod" type: array unit: description: Unit definitions for the grid values. items: $ref: "#/components/schemas/ProductAnalyticsUnit" type: array type: object ProductAnalyticsRetentionGridResponseData: description: |- The single JSON:API resource holding a computed retention grid. Its attributes contain the return periods forming the columns and the cohorts forming the rows. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsRetentionGridResponseAttributes" id: description: Unique identifier for this response data object. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: "#/components/schemas/ProductAnalyticsRetentionGridResponseType" required: - id - type - attributes type: object ProductAnalyticsRetentionGridResponseType: description: The resource type identifier for a retention grid response. enum: - retention_grid_response example: retention_grid_response type: string x-enum-varnames: - RETENTION_GRID_RESPONSE ProductAnalyticsRetentionGroupBy: description: Splits retention results by the values of a facet. properties: facet: description: The attribute path to group by. example: "@geo.country" type: string limit: description: Maximum number of groups to return. Omit it to let the service choose. example: 10 format: int64 minimum: 1 type: integer should_exclude_missing: default: false description: Whether to drop entities that have no value for the facet. type: boolean sort: $ref: "#/components/schemas/ProductAnalyticsGroupBySort" source: description: Audience source backing the group-by, when grouping by an audience rather than a facet. type: string target: $ref: "#/components/schemas/ProductAnalyticsRetentionGroupByTarget" required: - target - facet type: object ProductAnalyticsRetentionGroupByTarget: description: Which axis of the retention grid a group-by applies to. enum: - cohort - return_period example: cohort type: string x-enum-varnames: - COHORT - RETURN_PERIOD ProductAnalyticsRetentionIndexTarget: description: Selects a cohort or return period by its zero-based position in the grid. properties: type: $ref: "#/components/schemas/ProductAnalyticsRetentionIndexTargetType" value: description: Zero-based index of the targeted cohort or return period. example: 0 format: int64 minimum: 0 type: integer required: - type - value type: object ProductAnalyticsRetentionIndexTargetType: description: The discriminator identifying a target selected by index. enum: - index example: index type: string x-enum-varnames: - INDEX ProductAnalyticsRetentionListColumn: description: A column to include in each returned entity row. properties: field: $ref: "#/components/schemas/ProductAnalyticsRetentionListColumnField" type: object ProductAnalyticsRetentionListColumnField: description: The attribute selected for a column. properties: path: description: Attribute path of the column. example: "@usr.email" type: string type: object ProductAnalyticsRetentionListQuery: description: Query definition for a retention list request. properties: columns: description: The attribute columns to include in each returned row. items: $ref: "#/components/schemas/ProductAnalyticsRetentionListColumn" type: array computation_scope: $ref: "#/components/schemas/ProductAnalyticsRetentionCellScope" limit: description: Maximum number of rows to return. Use `0` for no limit. example: 100 format: int64 minimum: 0 type: integer search: $ref: "#/components/schemas/ProductAnalyticsRetentionSearch" required: - search - computation_scope type: object ProductAnalyticsRetentionListRecord: additionalProperties: {} description: A single entity row, keyed by the requested column paths. type: object ProductAnalyticsRetentionListRequest: description: Request body listing the individual entities behind one cell of the retention grid. properties: data: $ref: "#/components/schemas/ProductAnalyticsRetentionListRequestData" required: - data type: object ProductAnalyticsRetentionListRequestAttributes: description: Attributes of a retention list request. properties: from: description: Start of the query window, in epoch milliseconds. example: 1756425600000 format: int64 type: integer query: $ref: "#/components/schemas/ProductAnalyticsRetentionListQuery" to: description: End of the query window, in epoch milliseconds. example: 1756857600000 format: int64 type: integer required: - from - to - query type: object ProductAnalyticsRetentionListRequestData: description: |- The single JSON:API resource carrying a retention list query. Its attributes hold the time window, the cell to list, and the columns to return for each entity. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsRetentionListRequestAttributes" type: $ref: "#/components/schemas/ProductAnalyticsRetentionListRequestType" required: - type - attributes type: object ProductAnalyticsRetentionListRequestType: description: The resource type identifier for a retention list request. enum: - retention_list_request example: retention_list_request type: string x-enum-varnames: - RETENTION_LIST_REQUEST ProductAnalyticsRetentionListResponse: description: Response for a retention list query. properties: data: $ref: "#/components/schemas/ProductAnalyticsRetentionListResponseData" required: - data type: object ProductAnalyticsRetentionListResponseAttributes: description: Attributes of a retention list response, containing the matching entity rows. properties: records: description: The matching entity rows. items: $ref: "#/components/schemas/ProductAnalyticsRetentionListRecord" type: array retention_entity: description: The entity whose retention was measured. type: string type: object ProductAnalyticsRetentionListResponseData: description: |- The single JSON:API resource holding the entities behind one retention cell. Its attributes contain the entity whose retention was measured and one row per matching entity. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsRetentionListResponseAttributes" id: description: Unique identifier for this response data object. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: "#/components/schemas/ProductAnalyticsRetentionListResponseType" required: - id - type - attributes type: object ProductAnalyticsRetentionListResponseType: description: The resource type identifier for a retention list response. enum: - retention_list_response example: retention_list_response type: string x-enum-varnames: - RETENTION_LIST_RESPONSE ProductAnalyticsRetentionPeriod: description: A return period definition, such as "1 week". properties: unit: description: Time unit of the period, such as `day`, `week`, `month`, or `year`. example: week type: string value: description: Length of the period, expressed in `unit`. example: 1 format: int64 type: integer type: object ProductAnalyticsRetentionReturnCondition: description: |- When an entity counts as having returned. Use `conversion_on` to count only entities that returned during the period itself, or `conversion_on_or_after` to also count later returns. enum: - conversion_on - conversion_on_or_after example: conversion_on_or_after type: string x-enum-varnames: - CONVERSION_ON - CONVERSION_ON_OR_AFTER ProductAnalyticsRetentionReturnCriteria: description: Defines the event that counts as a return, and the window in which it must occur. properties: base_query: $ref: "#/components/schemas/ProductAnalyticsBaseQuery" time_interval: $ref: "#/components/schemas/ProductAnalyticsRetentionTimeInterval" required: - base_query type: object ProductAnalyticsRetentionReturnPeriodScope: description: Narrows a retention query to a single return-period column. properties: target: $ref: "#/components/schemas/ProductAnalyticsRetentionIndexTarget" type: $ref: "#/components/schemas/ProductAnalyticsRetentionReturnPeriodScopeType" required: - type - target type: object ProductAnalyticsRetentionReturnPeriodScopeType: description: The discriminator identifying a scope narrowed to one return period. enum: - return_period example: return_period type: string x-enum-varnames: - RETURN_PERIOD ProductAnalyticsRetentionScope: description: |- Restricts a retention query to part of the grid, so that results can be examined in detail. Omit it to compute the whole grid. oneOf: - $ref: "#/components/schemas/ProductAnalyticsRetentionCohortScope" - $ref: "#/components/schemas/ProductAnalyticsRetentionReturnPeriodScope" - $ref: "#/components/schemas/ProductAnalyticsRetentionCellScope" ProductAnalyticsRetentionSearch: description: Defines the cohort and return criteria that make up a retention query. properties: cohort_criteria: $ref: "#/components/schemas/ProductAnalyticsRetentionCohortCriteria" filters: $ref: "#/components/schemas/ProductAnalyticsRetentionFilters" retention_entity: $ref: "#/components/schemas/ProductAnalyticsRetentionEntity" return_condition: $ref: "#/components/schemas/ProductAnalyticsRetentionReturnCondition" return_criteria: $ref: "#/components/schemas/ProductAnalyticsRetentionReturnCriteria" required: - cohort_criteria - retention_entity - return_condition type: object ProductAnalyticsRetentionTimeInterval: description: |- A retention interval, either aligned to calendar boundaries or of a fixed length. Cohort criteria use calendar intervals; return criteria use fixed intervals. oneOf: - $ref: "#/components/schemas/ProductAnalyticsRetentionCalendarTimeInterval" - $ref: "#/components/schemas/ProductAnalyticsRetentionFixedTimeInterval" ProductAnalyticsSankeyAggregatedNode: description: One of the nodes rolled up into an aggregated node, retained so the roll-up can be broken down. properties: id: description: Unique identifier for the node. type: string incoming_value: description: Number of sessions entering the node. format: int64 type: integer name: description: The facet value the node represents. type: string outgoing_value: description: Number of sessions leaving the node. format: int64 type: integer type: $ref: "#/components/schemas/ProductAnalyticsSankeyAggregatedNodeType" value: description: Number of sessions passing through the node. format: int64 type: integer type: object ProductAnalyticsSankeyAggregatedNodeType: description: The resource type identifier for a node rolled up into an aggregated node. enum: - aggregated type: string x-enum-varnames: - AGGREGATED ProductAnalyticsSankeyDefinition: description: The shape of the Sankey diagram, expressed as the facets to flow between and how many steps to show. properties: entries_per_step: description: |- Maximum number of nodes to keep in each column. Remaining values are rolled up into an aggregated node. Omit it, or send `0`, to use the default of `5`. example: 10 format: int64 maximum: 10 minimum: 0 type: integer number_of_steps: description: |- Number of intermediate columns between the source and the target. Omit it, or send `0`, to use the default of `5`. example: 3 format: int64 maximum: 10 minimum: 0 type: integer source: description: Facet forming the first column of the diagram. example: "@view.name" type: string target: description: Facet forming the last column of the diagram. example: "@view.name" type: string required: - source - target type: object ProductAnalyticsSankeyLink: description: A link of the Sankey diagram, representing the sessions flowing between two nodes. properties: column: description: Zero-based index of the column the link starts from. format: int64 type: integer id: description: Unique identifier for the link. type: string source: description: Identifier of the node the link starts at. type: string target: description: Identifier of the node the link ends at. type: string value: description: Number of sessions flowing along the link. format: int64 type: integer type: object ProductAnalyticsSankeyNode: description: A node of the Sankey diagram, representing one facet value in one column. properties: aggregated_nodes: description: The nodes rolled up into this one, when the node is an aggregate. items: $ref: "#/components/schemas/ProductAnalyticsSankeyAggregatedNode" type: array column: description: Zero-based index of the column the node sits in. format: int64 type: integer dropoff_value: description: Number of sessions that ended at the node. format: int64 type: integer id: description: Unique identifier for the node. type: string incoming_value: description: Number of sessions entering the node. format: int64 type: integer name: description: The facet value the node represents. type: string outgoing_value: description: Number of sessions leaving the node. format: int64 type: integer type: $ref: "#/components/schemas/ProductAnalyticsSankeyNodeType" value: description: Number of sessions passing through the node. format: int64 type: integer type: object ProductAnalyticsSankeyNodeType: description: |- The kind of node. `regular` is a single facet value, `other` rolls up the values that did not fit within `entries_per_step`, and `dropoff` collects the sessions that ended at this column. enum: - regular - other - dropoff type: string x-enum-varnames: - REGULAR - OTHER - DROPOFF ProductAnalyticsSankeyRequest: description: Request body for a Sankey diagram query. properties: data: $ref: "#/components/schemas/ProductAnalyticsSankeyRequestData" required: - data type: object ProductAnalyticsSankeyRequestAttributes: description: Attributes of a Sankey request. properties: definition: $ref: "#/components/schemas/ProductAnalyticsSankeyDefinition" search: $ref: "#/components/schemas/ProductAnalyticsSankeySearch" time: $ref: "#/components/schemas/ProductAnalyticsSankeyTime" required: - time - search - definition type: object ProductAnalyticsSankeyRequestData: description: |- The single JSON:API resource carrying a Sankey query. Its attributes hold the time window to query, the search that selects the sessions, and the definition of the diagram to build. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsSankeyRequestAttributes" type: $ref: "#/components/schemas/ProductAnalyticsSankeyRequestType" required: - type - attributes type: object ProductAnalyticsSankeyRequestType: description: The resource type identifier for a Sankey request. enum: - sankey_request example: sankey_request type: string x-enum-varnames: - SANKEY_REQUEST ProductAnalyticsSankeyResponse: description: Response for a Sankey diagram query. properties: data: $ref: "#/components/schemas/ProductAnalyticsSankeyResponseData" required: - data type: object ProductAnalyticsSankeyResponseAttributes: description: Attributes of a Sankey response, containing the nodes and the links between them. properties: links: description: The links of the diagram, one per pair of connected nodes. items: $ref: "#/components/schemas/ProductAnalyticsSankeyLink" type: array nodes: description: The nodes of the diagram, one per facet value and column. items: $ref: "#/components/schemas/ProductAnalyticsSankeyNode" type: array type: object ProductAnalyticsSankeyResponseData: description: |- The single JSON:API resource holding a computed Sankey diagram. Its attributes contain the nodes of every column and the links that carry sessions between them. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsSankeyResponseAttributes" id: description: Unique identifier for this response data object. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: "#/components/schemas/ProductAnalyticsSankeyResponseType" required: - id - type - attributes type: object ProductAnalyticsSankeyResponseType: description: The resource type identifier for a Sankey response. enum: - sankey_response example: sankey_response type: string x-enum-varnames: - SANKEY_RESPONSE ProductAnalyticsSankeySearch: description: Selects the sessions a Sankey diagram is built from. properties: audience_filters: $ref: "#/components/schemas/ProductAnalyticsAudienceFilters" join_keys: $ref: "#/components/schemas/ProductAnalyticsJoinKeys" query: description: Datadog search query restricting the events considered. example: "@type:view" type: string type: object ProductAnalyticsSankeyTime: description: The time window a Sankey query covers. properties: from: description: Start of the query window, in epoch milliseconds. example: 1756425600000 format: int64 type: integer to: description: End of the query window, in epoch milliseconds. example: 1756857600000 format: int64 type: integer required: - from - to type: object ProductAnalyticsScalarColumn: description: A column in a scalar response. properties: meta: $ref: "#/components/schemas/ProductAnalyticsScalarColumnMeta" name: description: Column name (facet name for group-by, or "query"). type: string type: $ref: "#/components/schemas/ProductAnalyticsScalarColumnType" values: description: Column values. items: description: A single cell value within the column (string for group-by columns, number for metric columns). type: array type: object ProductAnalyticsScalarColumnMeta: description: Metadata associated with a scalar response column, including optional unit information. properties: unit: description: Unit definitions for the column values, if applicable. items: $ref: "#/components/schemas/ProductAnalyticsUnit" nullable: true type: array type: object ProductAnalyticsScalarColumnType: description: Column type. enum: - number - group type: string x-enum-varnames: - NUMBER - GROUP ProductAnalyticsScalarResponse: description: Response for a scalar analytics query. properties: data: $ref: "#/components/schemas/ProductAnalyticsScalarResponseData" meta: $ref: "#/components/schemas/ProductAnalyticsResponseMeta" type: object ProductAnalyticsScalarResponseAttributes: description: Attributes of a scalar analytics response, containing the result columns. properties: columns: description: The list of result columns, each containing values and metadata. items: $ref: "#/components/schemas/ProductAnalyticsScalarColumn" type: array type: object ProductAnalyticsScalarResponseData: description: Data object for a scalar response. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsScalarResponseAttributes" id: description: Unique identifier for this response data object. type: string type: $ref: "#/components/schemas/ProductAnalyticsScalarResponseType" type: object ProductAnalyticsScalarResponseType: description: The resource type identifier for a scalar analytics response. enum: - scalar_response type: string x-enum-varnames: - SCALAR_RESPONSE ProductAnalyticsSerie: description: A series in a timeseries response. properties: group_tags: description: The group-by tag values that identify this series. items: description: A tag value for a group-by facet. type: string type: array query_index: description: The index of the query that produced this series. format: int64 type: integer unit: description: Unit definitions for the series values. items: $ref: "#/components/schemas/ProductAnalyticsUnit" type: array type: object ProductAnalyticsServerSideEventError: description: Error details. properties: detail: description: Error message. example: "Malformed payload" type: string status: description: Error code. example: "400" type: string title: description: Error title. example: "Bad Request" type: string type: object ProductAnalyticsServerSideEventErrors: description: Error response. properties: errors: description: Structured errors. items: $ref: "#/components/schemas/ProductAnalyticsServerSideEventError" type: array type: object ProductAnalyticsServerSideEventItem: description: A Product Analytics server-side event. properties: account: $ref: "#/components/schemas/ProductAnalyticsServerSideEventItemAccount" application: $ref: "#/components/schemas/ProductAnalyticsServerSideEventItemApplication" event: $ref: "#/components/schemas/ProductAnalyticsServerSideEventItemEvent" session: $ref: "#/components/schemas/ProductAnalyticsServerSideEventItemSession" type: $ref: "#/components/schemas/ProductAnalyticsServerSideEventItemType" usr: $ref: "#/components/schemas/ProductAnalyticsServerSideEventItemUsr" required: - application - event - type type: object ProductAnalyticsServerSideEventItemAccount: description: The account linked to your event. properties: id: description: The account ID used in Datadog. example: "account-67890" type: string required: - id type: object ProductAnalyticsServerSideEventItemApplication: description: The application in which you want to send your events. properties: id: description: |- The application ID of your application. It can be found in your [application management page](https://app.datadoghq.com/rum/list). example: "123abcde-123a-123b-1234-123456789abc" type: string required: - id type: object ProductAnalyticsServerSideEventItemEvent: description: Fields used for the event. properties: name: description: |- The name of your event, which is used for search in the same way as view or action names. example: "payment.processed" type: string required: - name type: object ProductAnalyticsServerSideEventItemSession: description: The session linked to your event. properties: id: description: The session ID captured by the SDK. example: "session-abcdef" type: string required: - id type: object ProductAnalyticsServerSideEventItemType: description: The type of Product Analytics event. Must be `server` for server-side events. enum: - server example: server type: string x-enum-varnames: - SERVER ProductAnalyticsServerSideEventItemUsr: description: The user linked to your event. properties: id: description: The user ID used in Datadog. example: "user-12345" type: string required: - id type: object ProductAnalyticsTimeseriesResponse: description: Response for a timeseries analytics query. properties: data: $ref: "#/components/schemas/ProductAnalyticsTimeseriesResponseData" meta: $ref: "#/components/schemas/ProductAnalyticsResponseMeta" type: object ProductAnalyticsTimeseriesResponseAttributes: description: |- Attributes of a timeseries analytics response, containing series data, timestamps, and interval definitions. properties: intervals: description: Interval definitions describing the time buckets used in the response. items: $ref: "#/components/schemas/ProductAnalyticsInterval" type: array series: description: The list of series, each corresponding to a query or group-by combination. items: $ref: "#/components/schemas/ProductAnalyticsSerie" type: array times: description: Timestamps for each data point (epoch milliseconds). items: description: Epoch timestamp in milliseconds. format: int64 type: integer type: array values: description: Values for each series at each time point. items: description: Array of numeric values for a single series across all time points. items: description: Numeric value at a time point, or null if no data is available. format: double nullable: true type: number type: array type: array type: object ProductAnalyticsTimeseriesResponseData: description: Data object for a timeseries analytics response. properties: attributes: $ref: "#/components/schemas/ProductAnalyticsTimeseriesResponseAttributes" id: description: Unique identifier for this response data object. type: string type: $ref: "#/components/schemas/ProductAnalyticsTimeseriesResponseType" type: object ProductAnalyticsTimeseriesResponseType: description: The resource type identifier for a timeseries analytics response. enum: - timeseries_response type: string x-enum-varnames: - TIMESERIES_RESPONSE ProductAnalyticsUnit: description: A unit definition for metric values. properties: family: description: The unit family (e.g., time, bytes). example: time type: string id: description: Numeric identifier for the unit. format: int64 type: integer name: description: The full name of the unit (e.g., nanosecond). example: nanosecond type: string plural: description: Plural form of the unit name (e.g., nanoseconds). type: string scale_factor: description: Conversion factor relative to the base unit of the family. format: double type: number short_name: description: Abbreviated unit name (e.g., ns). type: string type: object ProductCatalogSKUAllotment: description: |- A quantity of one SKU that is included with, and consumed before, the billable usage of another SKU. properties: child_sku_code: description: The code of the SKU that receives the allotment. example: CUSTOM-EVENTS type: string hourly_quantity: description: |- The quantity allotted per hour. Fractional for some allotments, and equal to `monthly_quantity` for others, depending on how the child SKU meters usage. example: 0.684932 format: double type: number monthly_quantity: description: The quantity allotted per month. example: 500 format: int64 type: integer parent_sku_code: description: |- The code of the SKU that provides the allotment. Always the code of the SKU the allotment is returned under. example: HOSTS-PRO type: string required: - parent_sku_code - child_sku_code - monthly_quantity - hourly_quantity type: object ProductCatalogSKUDataAttributesResponse: description: The pricing and allotment metadata of a SKU. properties: allotments: description: |- The allotments the SKU provides to other SKUs. Every entry carries the code of this SKU as its `parent_sku_code`. Empty when the SKU provides no allotments. items: $ref: "#/components/schemas/ProductCatalogSKUAllotment" type: array billing_dimension: description: |- The identifier of the billing dimension the SKU is billed on, as used by the usage metering endpoints. Several SKUs can share one billing dimension, so this value does not identify a SKU. example: infra_host type: string billing_units: description: |- The billable usage unit the SKU is priced per. `null` for SKUs that are not priced per unit of usage, such as those whose `pricing_type` is `percent`. example: hosts nullable: true type: string currency: description: The ISO-4217 code of the currency the prices are expressed in. example: USD type: string default_on_demand_option: $ref: "#/components/schemas/ProductCatalogSKUOnDemandOption" number_of_units_included_in_price: description: |- The number of billable usage units that one unit of price covers. Divide measured usage by this value before multiplying by the price. For example, a SKU priced at `18.00` with `number_of_units_included_in_price` of `1` costs `18.00` per host, while a SKU priced at `12.00` with `number_of_units_included_in_price` of `10000` costs `12.00` per 10,000 requests. It is a scaling factor on the price, not a free allotment; included quantities are in `allotments`. The same factor applies to the price of a tier in `on_demand_tiered` whose `pricing_unit_type` is `unit`. It does not apply to a tier whose `pricing_unit_type` is `block`: that tier's `price` is charged for the whole block bounded by `min_usage_quantity` and `max_usage_quantity`, however much of the block is used. `0` for SKUs that are not priced per unit of usage, such as those whose `pricing_type` is `percent`. example: 1 format: int64 type: integer on_demand_list_price: description: |- The public list price of on-demand usage of the SKU, as a decimal string. The number of decimal places is not normalized, so values such as `0`, `0.9`, and `30000.00` all occur. `null` when the SKU is priced with tiers, in which case the prices are in `on_demand_tiered`. example: "18.00" nullable: true type: string on_demand_tiered: $ref: "#/components/schemas/ProductCatalogSKUTieredPricing" pricing_type: $ref: "#/components/schemas/ProductCatalogSKUPricingType" sku_name: description: The human-readable name of the SKU. example: Infra Host (Pro) type: string required: - billing_dimension - sku_name - billing_units - default_on_demand_option - number_of_units_included_in_price - on_demand_list_price - pricing_type - currency - allotments - on_demand_tiered type: object ProductCatalogSKUDataResponse: description: A SKU and the pricing metadata that applies to it. properties: attributes: $ref: "#/components/schemas/ProductCatalogSKUDataAttributesResponse" id: description: The code that identifies the SKU. example: HOSTS-PRO type: string type: $ref: "#/components/schemas/ProductCatalogSKUType" required: - id - type - attributes type: object ProductCatalogSKUOnDemandOption: description: The billing frequency applied to on-demand usage of the SKU by default. enum: - hourly - monthly example: monthly type: string x-enum-varnames: - HOURLY - MONTHLY ProductCatalogSKUPricingTier: description: A usage range and the price that applies to usage falling inside it. properties: max_usage_quantity: description: |- The exclusive upper bound of the usage range the tier prices. `null` on the final tier, which is unbounded. example: 100000 format: int64 nullable: true type: integer min_usage_quantity: description: The inclusive lower bound of the usage range the tier prices. example: 1 format: int64 type: integer price: description: |- The price applied to usage in the tier, as a decimal string. The number of decimal places is not normalized, so free tiers appear as either `0` or `0.00`. example: "120.00" type: string pricing_unit_type: $ref: "#/components/schemas/ProductCatalogSKUPricingUnitType" required: - min_usage_quantity - max_usage_quantity - price - pricing_unit_type type: object ProductCatalogSKUPricingType: description: |- How the SKU is priced. `usage` prices each billable usage unit, and `percent` prices a percentage; percent-priced SKUs have no `billing_units`. enum: - usage - percent example: usage type: string x-enum-varnames: - USAGE - PERCENT ProductCatalogSKUPricingUnitType: description: |- Whether the tier's price applies per unit of usage or to a block of usage. enum: - block - unit example: unit type: string x-enum-varnames: - BLOCK - UNIT ProductCatalogSKUTieredPricing: description: |- The tiered pricing applied to on-demand usage of the SKU. `null` when the SKU is priced with a single list price instead. nullable: true properties: tiers: description: The pricing tiers, ordered by ascending usage quantity. items: $ref: "#/components/schemas/ProductCatalogSKUPricingTier" type: array required: - tiers type: object ProductCatalogSKUType: description: The SKU resource type. enum: - Sku example: Sku type: string x-enum-varnames: - SKU ProductCatalogSKUsAPIVersion: description: The version of the product catalog contract to return. enum: - v1 example: v1 type: string x-enum-varnames: - V1 ProductCatalogSKUsResponse: description: Response containing the generally available SKUs and their pricing metadata. properties: data: description: The generally available SKUs, sorted by SKU code in ascending order. items: $ref: "#/components/schemas/ProductCatalogSKUDataResponse" type: array required: - data type: object Project: description: A Project. properties: attributes: $ref: "#/components/schemas/ProjectAttributes" id: description: The Project's identifier. example: aeadc05e-98a8-11ec-ac2c-da7ad0900001 type: string relationships: $ref: "#/components/schemas/ProjectRelationships" type: $ref: "#/components/schemas/ProjectResourceType" required: - id - type - attributes type: object ProjectAttributes: description: Project attributes. properties: columns_config: $ref: "#/components/schemas/ProjectColumnsConfig" enabled_custom_case_types: description: List of enabled custom work item type IDs. items: description: A custom work item type identifier. type: string type: array key: description: The project's key. example: CASEM type: string name: description: Project's name. example: "Security Investigation" type: string restricted: description: Whether the project is restricted. type: boolean settings: $ref: "#/components/schemas/ProjectSettings" type: object ProjectColumnsConfig: description: Project columns configuration. properties: columns: description: List of column configurations for the project board view. items: $ref: "#/components/schemas/ProjectColumnsConfigColumnsItems" type: array type: object ProjectColumnsConfigColumnsItems: description: Configuration for a single column in a project board view. properties: sort: $ref: "#/components/schemas/ProjectColumnsConfigColumnsItemsSort" sort_field: description: The field used to sort items in this column. type: string type: description: The type of column. type: string type: object ProjectColumnsConfigColumnsItemsSort: description: Sort configuration for a project board column. properties: ascending: description: Whether to sort in ascending order. type: boolean priority: description: The sort priority order for this column. format: int64 type: integer type: object ProjectCreate: description: Project create. properties: attributes: $ref: "#/components/schemas/ProjectCreateAttributes" type: $ref: "#/components/schemas/ProjectResourceType" required: - attributes - type type: object ProjectCreateAttributes: description: Project creation attributes. properties: enabled_custom_case_types: description: List of enabled custom work item type IDs. items: description: A custom work item type identifier. type: string type: array key: description: Project's key. Cannot be "CASE". example: "SEC" type: string name: description: Project name. example: "Security Investigation" type: string team_uuid: description: Team UUID to associate with the project. type: string required: - name - key type: object ProjectCreateRequest: description: Project create request. properties: data: $ref: "#/components/schemas/ProjectCreate" required: - data type: object ProjectFavorite: description: Represents a Work Management project that the current user has bookmarked for quick access. Favorited projects appear prominently in the Work Management UI. properties: id: description: The UUID of the favorited project. example: "e555e290-ed65-49bd-ae18-8acbfcf18db7" type: string type: $ref: "#/components/schemas/ProjectFavoriteResourceType" required: - id - type type: object ProjectFavoriteResourceType: default: project_favorite description: "JSON:API resource type for project favorites." enum: - project_favorite example: project_favorite type: string x-enum-varnames: - PROJECT_FAVORITE ProjectFavoritesResponse: description: Response containing the list of projects the current user has favorited. properties: data: description: List of project favorites. items: $ref: "#/components/schemas/ProjectFavorite" type: array required: - data type: object ProjectNotificationSettings: description: Project notification settings. properties: destinations: description: Notification destinations (1=email, 2=slack, 3=in-app). items: description: Notification channel identifier (1=email, 2=slack, 3=in-app). format: int64 type: integer type: array enabled: description: Whether notifications are enabled. type: boolean notify_on_case_assignment: description: Whether to send a notification when a work item is assigned. type: boolean notify_on_case_closed: description: Whether to send a notification when a work item is closed. type: boolean notify_on_case_comment: description: Whether to send a notification when a comment is added to a work item. type: boolean notify_on_case_comment_mention: description: Whether to send a notification when a user is mentioned in a work item comment. type: boolean notify_on_case_priority_change: description: Whether to send a notification when a work item's priority changes. type: boolean notify_on_case_status_change: description: Whether to send a notification when a work item's status changes. type: boolean notify_on_case_unassignment: description: Whether to send a notification when a work item is unassigned. type: boolean type: object ProjectRelationship: description: Relationship to project. properties: data: $ref: "#/components/schemas/ProjectRelationshipData" required: - data type: object ProjectRelationshipData: description: Relationship to project object. properties: id: description: A unique identifier that represents the project. example: "e555e290-ed65-49bd-ae18-8acbfcf18db7" type: string type: $ref: "#/components/schemas/ProjectResourceType" required: - id - type type: object ProjectRelationships: description: Project relationships. properties: member_team: $ref: "#/components/schemas/RelationshipToTeamLinks" member_user: $ref: "#/components/schemas/UsersRelationship" type: object ProjectResourceType: default: project description: Project resource type. enum: - project example: project type: string x-enum-varnames: - PROJECT ProjectResponse: description: Project response. properties: data: $ref: "#/components/schemas/Project" type: object ProjectSettings: description: Project settings. properties: auto_close_inactive_cases: $ref: "#/components/schemas/AutoCloseInactiveCases" auto_transition_assigned_cases: $ref: "#/components/schemas/AutoTransitionAssignedCases" integration_incident: $ref: "#/components/schemas/IntegrationIncident" integration_jira: $ref: "#/components/schemas/IntegrationJira" integration_monitor: $ref: "#/components/schemas/IntegrationMonitor" integration_on_call: $ref: "#/components/schemas/IntegrationOnCall" integration_service_now: $ref: "#/components/schemas/IntegrationServiceNow" notification: $ref: "#/components/schemas/ProjectNotificationSettings" type: object ProjectUpdate: description: Project update. properties: attributes: $ref: "#/components/schemas/ProjectUpdateAttributes" type: $ref: "#/components/schemas/ProjectResourceType" required: - type type: object ProjectUpdateAttributes: description: Project update attributes. properties: columns_config: $ref: "#/components/schemas/ProjectColumnsConfig" enabled_custom_case_types: description: List of enabled custom work item type IDs. items: description: A custom work item type identifier. type: string type: array name: description: Project name. type: string settings: $ref: "#/components/schemas/ProjectSettings" team_uuid: description: Team UUID to associate with the project. type: string type: object ProjectUpdateRequest: description: Project update request. properties: data: $ref: "#/components/schemas/ProjectUpdate" required: - data type: object ProjectedCost: description: Projected Cost data. properties: attributes: $ref: "#/components/schemas/ProjectedCostAttributes" id: description: Unique ID of the response. type: string type: $ref: "#/components/schemas/ProjectedCostType" type: object ProjectedCostAttributes: description: Projected Cost attributes data. properties: account_name: description: The account name. type: string account_public_id: description: The account public ID. type: string charges: description: List of charges data reported for the requested month. items: $ref: "#/components/schemas/ChargebackBreakdown" type: array date: description: The month requested. format: date-time type: string org_name: description: The organization name. type: string projected_total_cost: description: The total projected cost of products for the month. format: double type: number public_id: description: The organization public ID. type: string region: description: The region of the Datadog instance that the organization belongs to. type: string type: object ProjectedCostResponse: description: Projected Cost response. properties: data: description: Response containing Projected Cost. items: $ref: "#/components/schemas/ProjectedCost" type: array type: object ProjectedCostType: default: projected_cost description: Type of cost data. enum: - projected_cost example: projected_cost type: string x-enum-varnames: - PROJECt_COST ProjectsResponse: description: Response with projects. properties: data: description: Projects response data. items: $ref: "#/components/schemas/Project" type: array type: object PrunedTraceAttributes: description: The attributes of a pruned trace returned by the Get pruned trace by ID endpoint. properties: is_truncated: description: |- Indicates whether the underlying trace was truncated because its size exceeded the maximum that can be retrieved from storage. example: false type: boolean size_bytes: description: The size, in bytes, of the original (non-pruned) trace before summarization. example: 12345 format: int32 maximum: 2147483647 type: integer summarized_trace: $ref: "#/components/schemas/SummarizedTrace" required: - summarized_trace - is_truncated - size_bytes type: object PrunedTraceData: description: A pruned trace resource document. properties: attributes: $ref: "#/components/schemas/PrunedTraceAttributes" id: description: The full 128-bit trace ID, encoded as a 32-character hexadecimal string. example: "0000000000000000abc1230000000000" type: string type: $ref: "#/components/schemas/PrunedTraceType" required: - id - type - attributes type: object PrunedTraceResponse: description: Response containing a single pruned trace. properties: data: $ref: "#/components/schemas/PrunedTraceData" required: - data type: object PrunedTraceType: description: The type of the pruned trace resource. The value is always `pruned_trace`. enum: - pruned_trace example: pruned_trace type: string x-enum-varnames: - PRUNED_TRACE PublishAppResponse: description: The response object after an app is successfully published. properties: data: $ref: "#/components/schemas/Deployment" type: object PublishFormData: description: The data for publishing a form version. properties: attributes: $ref: "#/components/schemas/PublishFormDataAttributes" type: $ref: "#/components/schemas/FormPublicationType" required: - type - attributes type: object PublishFormDataAttributes: description: The attributes for publishing a form version. properties: version: description: The version number to publish. example: 1 format: int64 type: integer required: - version type: object PublishFormRequest: description: A request to publish a form version. properties: data: $ref: "#/components/schemas/PublishFormData" required: - data type: object PublishRequestType: default: publishRequest description: The publish-request resource type. enum: - publishRequest example: publishRequest type: string x-enum-varnames: - PUBLISHREQUEST PutAppsDatastoreItemResponseArray: description: Response after successfully inserting multiple items into a datastore, containing the identifiers of the created items. properties: data: description: An array of data objects containing the identifiers of the successfully inserted items. items: $ref: "#/components/schemas/PutAppsDatastoreItemResponseData" maxItems: 100 type: array required: - data type: object PutAppsDatastoreItemResponseData: description: Data containing the identifier of a single item that was successfully inserted into the datastore. properties: id: description: The unique identifier assigned to the inserted item. type: string type: $ref: "#/components/schemas/DatastoreItemsDataType" required: - type type: object PutIncidentNotificationRuleRequest: description: Put request for a notification rule. properties: data: $ref: "#/components/schemas/IncidentNotificationRuleUpdateData" required: - data type: object Query: description: A data query used by an app. This can take the form of an external action, a data transformation, or a state variable. oneOf: - $ref: "#/components/schemas/ActionQuery" - $ref: "#/components/schemas/DataTransform" - $ref: "#/components/schemas/StateVariable" QueryAccountRequest: description: Request body for querying accounts with optional filtering, column selection, and sorting. example: data: attributes: limit: 20 query: plan_type:enterprise AND user_count:>100 AND subscription_status:active select_columns: - account_id - account_name - user_count - plan_type - subscription_status - created_at - mrr - industry sort: field: user_count order: DESC wildcard_search_term: tech id: query_account_request type: query_account_request properties: data: $ref: "#/components/schemas/QueryAccountRequestData" type: object QueryAccountRequestData: description: The data object containing the resource type and attributes for querying accounts. properties: attributes: $ref: "#/components/schemas/QueryAccountRequestDataAttributes" id: description: Unique identifier for the query account request resource. type: string type: $ref: "#/components/schemas/QueryAccountRequestDataType" required: - type type: object QueryAccountRequestDataAttributes: description: Attributes for filtering and shaping the account query results. properties: limit: description: Maximum number of account records to return in the response. format: int64 type: integer query: description: Filter expression using account attribute conditions to narrow results. type: string select_columns: description: List of account attribute column names to include in the response. items: description: Name of an account attribute column to include in the response. type: string type: array sort: $ref: "#/components/schemas/QueryAccountRequestDataAttributesSort" wildcard_search_term: description: Free-text term used for wildcard search across account attribute values. type: string type: object QueryAccountRequestDataAttributesSort: description: Sorting configuration specifying the field and direction for ordering query results. properties: field: description: The attribute field name to sort results by. type: string order: description: The sort direction, either ascending or descending. type: string type: object QueryAccountRequestDataType: default: query_account_request description: Query account request resource type. enum: - query_account_request example: query_account_request type: string x-enum-varnames: - QUERY_ACCOUNT_REQUEST QueryEventFilteredUsersRequest: description: Request body for querying users filtered by user properties combined with event platform activity. example: data: attributes: event_query: query: "@type:view AND @view.loading_time:>3000 AND @application.name:ecommerce-platform" time_frame: end: 1761309676 start: 1760100076 include_row_count: true limit: 25 query: user_org_id:5001 AND first_country_code:US AND first_browser_name:Chrome select_columns: - user_id - user_email - first_country_code - first_browser_name - events_count - session_count - error_count - avg_loading_time id: query_event_filtered_users_request type: query_event_filtered_users_request properties: data: $ref: "#/components/schemas/QueryEventFilteredUsersRequestData" type: object QueryEventFilteredUsersRequestData: description: The data object containing the resource type and attributes for querying event-filtered users. properties: attributes: $ref: "#/components/schemas/QueryEventFilteredUsersRequestDataAttributes" id: description: Unique identifier for the query event filtered users request resource. type: string type: $ref: "#/components/schemas/QueryEventFilteredUsersRequestDataType" required: - type type: object QueryEventFilteredUsersRequestDataAttributes: description: Attributes for filtering users by both user properties and event platform activity. properties: event_query: $ref: "#/components/schemas/QueryEventFilteredUsersRequestDataAttributesEventQuery" include_row_count: description: Whether to include the total count of matching users in the response. type: boolean limit: description: Maximum number of user records to return in the response. format: int64 type: integer query: description: Filter expression using user attribute conditions to narrow results. type: string select_columns: description: List of user attribute column names to include in the response. items: description: Name of a user attribute column to include in the response. type: string type: array type: object QueryEventFilteredUsersRequestDataAttributesEventQuery: description: Event platform query used to filter users based on their event activity within a specified time window. properties: query: description: The event platform query expression for filtering users by their event activity. type: string time_frame: $ref: "#/components/schemas/QueryEventFilteredUsersRequestDataAttributesEventQueryTimeFrame" type: object QueryEventFilteredUsersRequestDataAttributesEventQueryTimeFrame: description: The time window defining the start and end of the event query period as Unix timestamps. properties: end: description: End of the time frame as a Unix timestamp in seconds. format: int64 type: integer start: description: Start of the time frame as a Unix timestamp in seconds. format: int64 type: integer type: object QueryEventFilteredUsersRequestDataType: default: query_event_filtered_users_request description: Query event filtered users request resource type. enum: - query_event_filtered_users_request example: query_event_filtered_users_request type: string x-enum-varnames: - QUERY_EVENT_FILTERED_USERS_REQUEST QueryFormula: description: A formula for calculation based on one or more queries. properties: formula: description: Formula string, referencing one or more queries with their name property. example: "a+b" type: string limit: $ref: "#/components/schemas/FormulaLimit" required: - formula type: object QueryResponse: description: Response containing the query results with matched records and total count. example: data: attributes: hits: - first_browser_name: Chrome first_city: San Francisco first_country_code: US first_device_type: Desktop last_seen: "2025-08-14T06:45:12.142Z" session_count: 47 user_created: "2024-12-15T08:42:33.287Z" user_email: john.smith@techcorp.com user_id: "150847" user_name: John Smith user_org_id: "5001" - first_browser_name: Chrome first_city: Austin first_country_code: US first_device_type: Desktop last_seen: "2025-08-14T05:22:08.951Z" session_count: 89 user_created: "2024-11-28T14:17:45.634Z" user_email: john.williams@techcorp.com user_id: "150848" user_name: John Williams user_org_id: "5001" - first_browser_name: Chrome first_city: Seattle first_country_code: US first_device_type: Desktop last_seen: "2025-08-14T04:18:34.726Z" session_count: 23 user_created: "2025-01-03T16:33:21.445Z" user_email: john.jones@techcorp.com user_id: "150849" user_name: John Jones user_org_id: "5001" total: 147 id: query_response type: query_response properties: data: $ref: "#/components/schemas/QueryResponseData" type: object QueryResponseData: description: The data object containing the resource type and attributes of the query response. properties: attributes: $ref: "#/components/schemas/QueryResponseDataAttributes" id: description: Unique identifier for the query response resource. type: string type: $ref: "#/components/schemas/QueryResponseDataType" required: - type type: object QueryResponseDataAttributes: description: Attributes of the query response, containing the matched records and total count. properties: hits: description: The list of matching records returned by the query, each as a map of attribute names to values. items: additionalProperties: {} description: A single matched record represented as a map of attribute names to their values. type: array total: description: Total number of records matching the query, regardless of the limit applied. format: int64 type: integer type: object QueryResponseDataType: default: query_response description: Query response resource type. enum: - query_response example: query_response type: string x-enum-varnames: - QUERY_RESPONSE QuerySortOrder: default: desc description: Direction of sort. enum: - asc - desc type: string x-enum-varnames: - ASC - DESC QueryUsersRequest: description: Request body for querying users with optional filtering, column selection, and sorting. example: data: attributes: limit: 25 query: user_email:*@techcorp.com AND first_country_code:US AND first_browser_name:Chrome select_columns: - user_id - user_email - user_name - user_org_id - first_country_code - first_browser_name - first_device_type - last_seen sort: field: first_seen order: DESC wildcard_search_term: john id: query_users_request type: query_users_request properties: data: $ref: "#/components/schemas/QueryUsersRequestData" type: object QueryUsersRequestData: description: The data object containing the resource type and attributes for querying users. properties: attributes: $ref: "#/components/schemas/QueryUsersRequestDataAttributes" id: description: Unique identifier for the query users request resource. type: string type: $ref: "#/components/schemas/QueryUsersRequestDataType" required: - type type: object QueryUsersRequestDataAttributes: description: Attributes for filtering and shaping the user query results. properties: limit: description: Maximum number of user records to return in the response. format: int64 type: integer query: description: Filter expression using user attribute conditions to narrow results. type: string select_columns: description: List of user attribute column names to include in the response. items: description: Name of a user attribute column to include in the response. type: string type: array sort: $ref: "#/components/schemas/QueryUsersRequestDataAttributesSort" wildcard_search_term: description: Free-text term used for wildcard search across user attribute values. type: string type: object QueryUsersRequestDataAttributesSort: description: Sorting configuration specifying the field and direction for ordering user query results. properties: field: description: The user attribute field name to sort results by. type: string order: description: The sort direction, either ascending or descending. type: string type: object QueryUsersRequestDataType: default: query_users_request description: Query users request resource type. enum: - query_users_request example: query_users_request type: string x-enum-varnames: - QUERY_USERS_REQUEST RUMAggregateBucketValue: description: A bucket value, can be either a timeseries or a single value. oneOf: - $ref: "#/components/schemas/RUMAggregateBucketValueSingleString" - $ref: "#/components/schemas/RUMAggregateBucketValueSingleNumber" - $ref: "#/components/schemas/RUMAggregateBucketValueTimeseries" RUMAggregateBucketValueSingleNumber: description: A single number value. format: double type: number RUMAggregateBucketValueSingleString: description: A single string value. type: string RUMAggregateBucketValueTimeseries: description: A timeseries array. items: $ref: "#/components/schemas/RUMAggregateBucketValueTimeseriesPoint" type: array x-generate-alias-as-model: true RUMAggregateBucketValueTimeseriesPoint: description: A timeseries point. properties: time: description: The time value for this point. example: "2020-06-08T11:55:00.123Z" format: date-time type: string value: description: The value for this point. example: 19 format: double type: number type: object RUMAggregateRequest: description: The object sent with the request to retrieve aggregation buckets of RUM events from your organization. properties: compute: description: The list of metrics or timeseries to compute for the retrieved buckets. items: $ref: "#/components/schemas/RUMCompute" type: array filter: $ref: "#/components/schemas/RUMQueryFilter" group_by: description: The rules for the group by. items: $ref: "#/components/schemas/RUMGroupBy" type: array options: $ref: "#/components/schemas/RUMQueryOptions" page: $ref: "#/components/schemas/RUMQueryPageOptions" type: object RUMAggregateSort: description: A sort rule. example: {"aggregation": "count", "order": "asc"} properties: aggregation: $ref: "#/components/schemas/RUMAggregationFunction" metric: description: The metric to sort by (only used for `type=measure`). example: "@duration" type: string order: $ref: "#/components/schemas/RUMSortOrder" type: $ref: "#/components/schemas/RUMAggregateSortType" type: object RUMAggregateSortType: default: "alphabetical" description: The type of sorting algorithm. enum: ["alphabetical", "measure"] type: string x-enum-varnames: ["ALPHABETICAL", "MEASURE"] RUMAggregationBucketsResponse: description: The query results. properties: buckets: description: The list of matching buckets, one item per bucket. items: $ref: "#/components/schemas/RUMBucketResponse" type: array type: object RUMAggregationFunction: description: An aggregation function. enum: ["count", "cardinality", "pc75", "pc90", "pc95", "pc98", "pc99", "sum", "min", "max", "avg", "median"] example: "pc90" type: string x-enum-varnames: ["COUNT", "CARDINALITY", "PERCENTILE_75", "PERCENTILE_90", "PERCENTILE_95", "PERCENTILE_98", "PERCENTILE_99", "SUM", "MIN", "MAX", "AVG", "MEDIAN"] RUMAnalyticsAggregateResponse: description: The response object for the RUM events aggregate API endpoint. properties: data: $ref: "#/components/schemas/RUMAggregationBucketsResponse" links: $ref: "#/components/schemas/RUMResponseLinks" meta: $ref: "#/components/schemas/RUMResponseMetadata" type: object RUMApplication: description: RUM application. properties: attributes: $ref: "#/components/schemas/RUMApplicationAttributes" id: description: RUM application ID. example: abcd1234-0000-0000-abcd-1234abcd5678 type: string type: $ref: "#/components/schemas/RUMApplicationType" required: - attributes - id - type type: object RUMApplicationAttributes: description: RUM application attributes. properties: api_key_id: description: ID of the API key associated with the application. example: 123456789 format: int32 maximum: 2147483647 type: integer apm_rum_flat_sampling_replay_enabled: description: Indicates if flat sampling of Session Replay for APM-correlated RUM sessions is enabled. example: false type: boolean apm_rum_flat_sampling_replay_sample_rate: description: Sample rate (0-100) of Session Replay for APM-correlated RUM sessions when flat sampling is enabled. example: 0 format: double type: number application_id: description: ID of the RUM application. example: abcd1234-0000-0000-abcd-1234abcd5678 type: string client_token: description: Client token of the RUM application. example: abcd1234efgh5678ijkl90abcd1234efgh0 type: string created_at: description: Timestamp in ms of the creation date. example: 1659479836169 format: int64 type: integer created_by_handle: description: Handle of the creator user. example: john.doe type: string disabled_at: description: Timestamp in ms of the date the RUM application was disabled. Only present if the application was disabled. example: 1659479836169 format: int64 type: integer disabled_by_handle: description: Handle of the user who disabled the RUM application. Only present if the application was disabled. example: jane.doe type: string error_tracking_exclusion_filter_enabled: description: Indicates if Error Tracking exclusion filters are enabled for the application. example: false type: boolean external_feeds: description: Non-native ingestion paths the RUM application sends its data through. `otel` means the application sends RUM data through OpenTelemetry instead of the Datadog RUM SDK. example: - otel items: description: External feed name. type: string type: array hash: description: Hash of the RUM application. Optional. type: string is_active: description: Indicates if the RUM application is active. example: true type: boolean name: description: Name of the RUM application. example: my_rum_application type: string ootb_metrics_installed: description: Indicates if the out-of-the-box RUM metrics are installed for the application. example: true type: boolean org_id: description: Org ID of the RUM application. example: 999 format: int32 maximum: 2147483647 type: integer product_analytics_preview_disabled: description: Indicates that the Product Analytics preview is disabled for the application. Only present (and `true`) when the Product Analytics retention state is not preview. example: true type: boolean product_analytics_replay_sample_rate: description: Sample rate (0-100) of Session Replay for Product Analytics sessions. example: 0 format: int32 maximum: 2147483647 type: integer product_scales: $ref: "#/components/schemas/RUMProductScales" remote_config_id: description: ID of the RUM SDK remote configuration for the application, if one exists. example: abc12345-1234-5678-abcd-ef1234567890 type: string short_name: description: Short name of the RUM application. example: my_rum_application type: string tags: description: List of tags associated with the RUM application. example: - "team:rum" items: description: Tag associated with the RUM application. type: string type: array type: description: "Type of the RUM application. Supported values are `browser`, `ios`, `android`, `react-native`, `flutter`, `roku`, `electron`, `unity`, `kotlin-multiplatform`." example: browser type: string updated_at: description: Timestamp in ms of the last update date. example: 1659479836169 format: int64 type: integer updated_by_handle: description: Handle of the updater user. example: jane.doe type: string required: - application_id - client_token - created_at - created_by_handle - name - org_id - type - updated_at - updated_by_handle type: object RUMApplicationCreate: description: RUM application creation. properties: attributes: $ref: "#/components/schemas/RUMApplicationCreateAttributes" type: $ref: "#/components/schemas/RUMApplicationCreateType" required: - attributes - type type: object RUMApplicationCreateAttributes: description: RUM application creation attributes. properties: create_default_retention_filters: default: true description: |- Whether to create the default retention filters when the application is created: `Sessions with errors` and `Sessions`, each with a 100% retention rate. Set to `false` to create the application without them, for example when you add your own retention filters right after creating it. Until you add retention filters, the application only retains sessions matched by its [permanent retention filters](https://docs.datadoghq.com/real_user_monitoring/rum_without_limits/retention_filters/#permanent-retention-filters). This setting doesn't affect permanent retention filters (sessions with forced replays, Synthetics sessions and RUM-APM flat sampling). example: false type: boolean name: description: Name of the RUM application. example: my_new_rum_application type: string product_analytics_retention_state: $ref: "#/components/schemas/RUMProductAnalyticsRetentionState" rum_event_processing_state: $ref: "#/components/schemas/RUMEventProcessingState" type: description: "Type of the RUM application. Supported values are `browser`, `ios`, `android`, `react-native`, `flutter`, `roku`, `electron`, `unity`, `kotlin-multiplatform`." example: browser type: string required: - name type: object RUMApplicationCreateRequest: description: RUM application creation request attributes. properties: data: $ref: "#/components/schemas/RUMApplicationCreate" required: - data type: object RUMApplicationCreateType: default: rum_application_create description: RUM application creation type. enum: - rum_application_create example: rum_application_create type: string x-enum-varnames: - RUM_APPLICATION_CREATE RUMApplicationList: description: RUM application list. properties: attributes: $ref: "#/components/schemas/RUMApplicationListAttributes" id: description: RUM application ID. example: abcd1234-0000-0000-abcd-1234abcd5678 type: string type: $ref: "#/components/schemas/RUMApplicationListType" required: - attributes - type type: object RUMApplicationListAttributes: description: RUM application list attributes. properties: api_key_id: description: ID of the API key associated with the application. example: 123456789 format: int32 maximum: 2147483647 type: integer apm_rum_flat_sampling_replay_enabled: description: Indicates if flat sampling of Session Replay for APM-correlated RUM sessions is enabled. example: false type: boolean apm_rum_flat_sampling_replay_sample_rate: description: Sample rate (0-100) of Session Replay for APM-correlated RUM sessions when flat sampling is enabled. example: 0 format: double type: number application_id: description: ID of the RUM application. example: abcd1234-0000-0000-abcd-1234abcd5678 type: string created_at: description: Timestamp in ms of the creation date. example: 1659479836169 format: int64 type: integer created_by_handle: description: Handle of the creator user. example: john.doe type: string disabled_at: description: Timestamp in ms of the date the RUM application was disabled. Only present if the application was disabled. example: 1659479836169 format: int64 type: integer disabled_by_handle: description: Handle of the user who disabled the RUM application. Only present if the application was disabled. example: jane.doe type: string error_tracking_exclusion_filter_enabled: description: Indicates if Error Tracking exclusion filters are enabled for the application. example: false type: boolean external_feeds: description: Non-native ingestion paths the RUM application sends its data through. `otel` means the application sends RUM data through OpenTelemetry instead of the Datadog RUM SDK. example: - otel items: description: External feed name. type: string type: array hash: description: Hash of the RUM application. Optional. type: string is_active: description: Indicates if the RUM application is active. example: true type: boolean name: description: Name of the RUM application. example: my_rum_application type: string ootb_metrics_installed: description: Indicates if the out-of-the-box RUM metrics are installed for the application. example: true type: boolean org_id: description: Org ID of the RUM application. example: 999 format: int32 maximum: 2147483647 type: integer product_analytics_preview_disabled: description: Indicates that the Product Analytics preview is disabled for the application. Only present (and `true`) when the Product Analytics retention state is not preview. example: true type: boolean product_analytics_replay_sample_rate: description: Sample rate (0-100) of Session Replay for Product Analytics sessions. example: 0 format: int32 maximum: 2147483647 type: integer product_scales: $ref: "#/components/schemas/RUMProductScales" remote_config_id: description: ID of the RUM SDK remote configuration for the application, if one exists. example: abc12345-1234-5678-abcd-ef1234567890 type: string short_name: description: Short name of the RUM application. example: my_rum_application type: string tags: description: List of tags associated with the RUM application. example: - "team:rum" items: description: Tag associated with the RUM application. type: string type: array type: description: Type of the RUM application. Supported values are `browser`, `ios`, `android`, `react-native`, `flutter`, `roku`, `electron`, `unity`, `kotlin-multiplatform`. example: browser type: string updated_at: description: Timestamp in ms of the last update date. example: 1659479836169 format: int64 type: integer updated_by_handle: description: Handle of the updater user. example: jane.doe type: string required: - application_id - created_at - created_by_handle - name - org_id - type - updated_at - updated_by_handle type: object RUMApplicationListType: default: rum_application description: RUM application list type. enum: - rum_application example: rum_application type: string x-enum-varnames: - RUM_APPLICATION RUMApplicationResponse: description: RUM application response. properties: data: $ref: "#/components/schemas/RUMApplication" type: object RUMApplicationType: default: rum_application description: RUM application response type. enum: - rum_application example: rum_application type: string x-enum-varnames: - RUM_APPLICATION RUMApplicationUpdate: description: RUM application update. properties: attributes: $ref: "#/components/schemas/RUMApplicationUpdateAttributes" id: description: RUM application ID. example: abcd1234-0000-0000-abcd-1234abcd5678 type: string type: $ref: "#/components/schemas/RUMApplicationUpdateType" required: - id - type type: object RUMApplicationUpdateAttributes: description: RUM application update attributes. properties: name: description: Name of the RUM application. example: updated_name_for_my_existing_rum_application type: string product_analytics_retention_state: $ref: "#/components/schemas/RUMProductAnalyticsRetentionState" rum_event_processing_state: $ref: "#/components/schemas/RUMEventProcessingState" type: description: "Type of the RUM application. Supported values are `browser`, `ios`, `android`, `react-native`, `flutter`, `roku`, `electron`, `unity`, `kotlin-multiplatform`." example: browser type: string type: object RUMApplicationUpdateRequest: description: RUM application update request. properties: data: $ref: "#/components/schemas/RUMApplicationUpdate" required: - data type: object RUMApplicationUpdateType: default: rum_application_update description: RUM application update type. enum: - rum_application_update example: rum_application_update type: string x-enum-varnames: - RUM_APPLICATION_UPDATE RUMApplicationsResponse: description: RUM applications response. properties: data: description: RUM applications array response. items: $ref: "#/components/schemas/RUMApplicationList" type: array type: object RUMBucketGroupByValue: description: The value of a group-by facet for this bucket. A string for string facets, a number for numeric facets and histograms. oneOf: - type: string - format: double type: number RUMBucketResponse: description: Bucket values. properties: by: additionalProperties: $ref: "#/components/schemas/RUMBucketGroupByValue" description: The key-value pairs for each group-by. example: {"@session.type": "user", "@view.time_spent": 1000000000} type: object computes: additionalProperties: $ref: "#/components/schemas/RUMAggregateBucketValue" description: A map of the metric name to value for regular compute, or a list of values for a timeseries. type: object type: object RUMCompute: description: A compute rule to compute metrics or timeseries. properties: aggregation: $ref: "#/components/schemas/RUMAggregationFunction" interval: description: |- The time buckets' size (only used for type=timeseries) Defaults to a resolution of 150 points. example: "5m" type: string metric: description: The metric to use. example: "@duration" type: string type: $ref: "#/components/schemas/RUMComputeType" required: - aggregation type: object RUMComputeType: default: "total" description: The type of compute. enum: ["timeseries", "total"] type: string x-enum-varnames: ["TIMESERIES", "TOTAL"] RUMEvent: description: Object description of a RUM event after being processed and stored by Datadog. properties: attributes: $ref: "#/components/schemas/RUMEventAttributes" id: description: Unique ID of the event. example: "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA" type: string type: $ref: "#/components/schemas/RUMEventType" type: object RUMEventAttributes: description: JSON object containing all event attributes and their associated values. properties: attributes: additionalProperties: {} description: JSON object of attributes from RUM events. example: {"customAttribute": 123, "duration": 2345} type: object service: description: |- The name of the application or service generating RUM events. It is used to switch from RUM to APM, so make sure you define the same value when you use both products. example: "web-app" type: string tags: description: Array of tags associated with your event. example: ["team:A"] items: description: Tag associated with your event. type: string type: array timestamp: description: Timestamp of your event. example: "2019-01-02T09:42:36.320Z" format: date-time type: string type: object RUMEventProcessingScale: description: RUM event processing scale configuration. properties: last_modified_at: description: Timestamp in milliseconds when this scale was last modified. example: 1721897494108 format: int64 type: integer state: $ref: "#/components/schemas/RUMEventProcessingState" type: object RUMEventProcessingState: description: Configures which RUM events are processed and stored for the application. enum: - ALL - ERROR_FOCUSED_MODE - NONE example: ALL type: string x-enum-descriptions: - Process and store all RUM events (sessions, views, actions, resources, errors) - Process and store only error events and related critical events - Disable RUM event processing—no events are stored x-enum-varnames: - ALL - ERROR_FOCUSED_MODE - NONE RUMEventType: default: rum description: Type of the event. enum: - rum example: "rum" type: string x-enum-varnames: - RUM RUMEventsResponse: description: Response object with all events matching the request and pagination information. properties: data: description: Array of events matching the request. items: $ref: "#/components/schemas/RUMEvent" type: array links: $ref: "#/components/schemas/RUMResponseLinks" meta: $ref: "#/components/schemas/RUMResponseMetadata" type: object RUMGroupBy: description: A group-by rule. properties: facet: description: The name of the facet to use (required). example: "@view.time_spent" type: string histogram: $ref: "#/components/schemas/RUMGroupByHistogram" limit: default: 10 description: The maximum buckets to return for this group-by. format: int64 type: integer missing: $ref: "#/components/schemas/RUMGroupByMissing" sort: $ref: "#/components/schemas/RUMAggregateSort" total: $ref: "#/components/schemas/RUMGroupByTotal" required: - facet type: object RUMGroupByHistogram: description: |- Used to perform a histogram computation (only for measure facets). Note: At most 100 buckets are allowed, the number of buckets is (max - min)/interval. properties: interval: description: The bin size of the histogram buckets. example: 10 format: double type: number max: description: |- The maximum value for the measure used in the histogram (values greater than this one are filtered out). example: 100 format: double type: number min: description: |- The minimum value for the measure used in the histogram (values smaller than this one are filtered out). example: 50 format: double type: number required: - interval - min - max type: object RUMGroupByMissing: description: The value to use for logs that don't have the facet used to group by. oneOf: - $ref: "#/components/schemas/RUMGroupByMissingString" - $ref: "#/components/schemas/RUMGroupByMissingNumber" RUMGroupByMissingNumber: description: The missing value to use if there is a number valued facet. format: double type: number RUMGroupByMissingString: description: The missing value to use if there is string valued facet. type: string RUMGroupByTotal: default: false description: |- A resulting object to put the given computes in over all the matching records. oneOf: - $ref: "#/components/schemas/RUMGroupByTotalBoolean" - $ref: "#/components/schemas/RUMGroupByTotalString" - $ref: "#/components/schemas/RUMGroupByTotalNumber" RUMGroupByTotalBoolean: description: If set to true, creates an additional bucket labeled "$facet_total". type: boolean RUMGroupByTotalNumber: description: A number to use as the key value for the total bucket. format: double type: number RUMGroupByTotalString: description: A string to use as the key value for the total bucket. type: string RUMOperationCreateRequest: description: The request body for creating a RUM operation. properties: data: $ref: "#/components/schemas/RUMOperationCreateRequestData" required: - data type: object RUMOperationCreateRequestData: description: The data object for creating a RUM operation. properties: attributes: $ref: "#/components/schemas/RUMOperationRequestAttributes" type: $ref: "#/components/schemas/RUMOperationType" required: - type - attributes type: object RUMOperationJourneyCompositeRule: description: |- A composite rule combining several predicates. Used as an alternative to `nodes` on a journey step when several conditions must be matched together, in any order or in a specific order. properties: composite_rule_id: description: The unique identifier of the composite rule. Generated by the server if omitted. readOnly: true type: string config_version: description: A hash of the composite rule's configuration, computed by the server. readOnly: true type: string kind: $ref: "#/components/schemas/RUMOperationJourneyCompositeRuleKind" max_window_ms: description: The maximum time window, in milliseconds, in which all predicates must match. example: 30000 format: int64 type: integer predicates: description: The list of predicates that must be matched by RUM events. items: $ref: "#/components/schemas/RUMOperationJourneyPredicate" type: array required: - kind - predicates type: object RUMOperationJourneyCompositeRuleKind: description: |- The rule used to combine the composite rule's predicates. `all_of` requires every predicate to match, in any order. `in_order` requires every predicate to match in the given order. enum: - all_of - in_order example: all_of type: string x-enum-varnames: - ALL_OF - IN_ORDER RUMOperationJourneyNode: description: A single node within a RUM operation journey step, matching RUM events with a query. properties: id: description: The unique identifier of the node. Generated by the server if omitted. readOnly: true type: string query: description: The RUM search query used to match events for this node. example: "@type:action @action.type:click" type: string required: - query type: object RUMOperationJourneyPredicate: description: A single predicate within a composite rule, matching RUM events with a query. properties: query: description: The RUM search query used to match events for this predicate. example: "@type:action @action.type:click" type: string required: - query type: object RUMOperationJourneyRum: description: The definition of a RUM operation's journey, used to detect it from RUM events. properties: rum_steps: description: The ordered list of steps composing the RUM journey. items: $ref: "#/components/schemas/RUMOperationJourneyStep" type: array required: - rum_steps type: object RUMOperationJourneyStep: description: |- A single step of a RUM operation's journey. Matches RUM events either through a list of `nodes` or through a `composite` rule; the two are mutually exclusive. properties: composite: $ref: "#/components/schemas/RUMOperationJourneyCompositeRule" nodes: description: The list of nodes that can match this step. Mutually exclusive with `composite`. items: $ref: "#/components/schemas/RUMOperationJourneyNode" type: array type: $ref: "#/components/schemas/RUMOperationJourneyStepType" required: - type type: object RUMOperationJourneyStepType: description: The type of a step within a RUM operation's journey. enum: - start - update - stop - error - abandoned example: start type: string x-enum-varnames: - START - UPDATE - STOP - ERROR - ABANDONED RUMOperationRequestAttributes: description: Attributes for creating or updating a RUM operation. properties: application_id: description: The RUM application ID the operation belongs to. example: "abc12345-1234-5678-abcd-ef1234567890" format: uuid type: string category: description: The category of the RUM operation. nullable: true type: string description: description: A description of the RUM operation. nullable: true type: string display_name: description: A human-readable display name for the RUM operation. example: Checkout completed type: string feature_ids: description: The list of journey IDs associated with the RUM operation. items: type: string type: array journey_rum: $ref: "#/components/schemas/RUMOperationJourneyRum" name: description: The unique name of the RUM operation. Must not contain spaces. example: checkout_completed type: string tags: description: A list of tags associated with the RUM operation. example: - "team:checkout" items: type: string type: array required: - name - tags - journey_rum type: object RUMOperationResponse: description: The response for a single RUM operation. properties: data: $ref: "#/components/schemas/RUMOperationResponseData" required: - data type: object RUMOperationResponseAttributes: description: Attributes of a RUM operation response. properties: application_id: description: The RUM application ID the operation belongs to. format: uuid nullable: true type: string category: description: The category of the RUM operation. nullable: true type: string created_at: description: The timestamp when the RUM operation was created. format: date-time readOnly: true type: string created_by: $ref: "#/components/schemas/RUMOperationUser" description: description: A description of the RUM operation. nullable: true type: string display_name: description: A human-readable display name for the RUM operation. example: Checkout completed type: string feature_ids: description: The list of journey IDs associated with the RUM operation. items: type: string type: array journey_rum: $ref: "#/components/schemas/RUMOperationJourneyRum" name: description: The unique name of the RUM operation. Must not contain spaces. example: checkout_completed type: string org_id: description: The ID of the organization the RUM operation belongs to. format: int64 readOnly: true type: integer tags: description: A list of tags associated with the RUM operation. example: - "team:checkout" items: type: string type: array updated_at: description: The timestamp when the RUM operation was last updated. format: date-time nullable: true readOnly: true type: string updated_by: $ref: "#/components/schemas/RUMOperationUser" required: - name - tags - journey_rum type: object RUMOperationResponseData: description: The data object in a RUM operation response. properties: attributes: $ref: "#/components/schemas/RUMOperationResponseAttributes" id: description: The unique identifier of the RUM operation. example: "abc12345-1234-5678-abcd-ef1234567890" readOnly: true type: string type: $ref: "#/components/schemas/RUMOperationType" required: - id - type - attributes type: object RUMOperationStrongLinkCreateRequest: description: The request body for creating a RUM operation link. properties: data: $ref: "#/components/schemas/RUMOperationStrongLinkCreateRequestData" required: - data type: object RUMOperationStrongLinkCreateRequestAttributes: description: Attributes for creating a RUM operation link. properties: application_id: description: The RUM application ID used when creating a stub operation from `operation_name`. format: uuid type: string description: description: A description of the link. nullable: true type: string feature_id: description: The unique identifier of the journey to link. example: "journey-123" type: string operation_id: description: |- The unique identifier of the RUM operation to link. Either `operation_id` or `operation_name` is required. example: "abc12345-1234-5678-abcd-ef1234567890" type: string operation_name: description: |- The name of the RUM operation to link. Either `operation_id` or `operation_name` is required. If no operation with this name exists, a stub operation is created. type: string status: $ref: "#/components/schemas/RUMOperationStrongLinkStatus" tags: description: A list of tags associated with the link. items: type: string type: array required: - feature_id type: object RUMOperationStrongLinkCreateRequestData: description: The data object for creating a RUM operation link. properties: attributes: $ref: "#/components/schemas/RUMOperationStrongLinkCreateRequestAttributes" type: $ref: "#/components/schemas/RUMOperationStrongLinkType" required: - type - attributes type: object RUMOperationStrongLinkResponse: description: The response for a single RUM operation link. properties: data: $ref: "#/components/schemas/RUMOperationStrongLinkResponseData" required: - data type: object RUMOperationStrongLinkResponseAttributes: description: Attributes of a RUM operation link response. properties: created_at: description: The timestamp when the link was created. format: date-time readOnly: true type: string description: description: A description of the link. nullable: true type: string feature_id: description: The unique identifier of the linked journey. example: "journey-123" readOnly: true type: string operation_id: description: The unique identifier of the linked RUM operation. example: "abc12345-1234-5678-abcd-ef1234567890" readOnly: true type: string status: $ref: "#/components/schemas/RUMOperationStrongLinkStatus" tags: description: A list of tags associated with the link. items: type: string type: array updated_at: description: The timestamp when the link was last updated. format: date-time nullable: true readOnly: true type: string required: - operation_id - feature_id - status type: object RUMOperationStrongLinkResponseData: description: The data object in a RUM operation link response. properties: attributes: $ref: "#/components/schemas/RUMOperationStrongLinkResponseAttributes" id: description: The unique identifier of the link, formatted as `:`. example: "abc12345-1234-5678-abcd-ef1234567890:journey-123" readOnly: true type: string type: $ref: "#/components/schemas/RUMOperationStrongLinkType" required: - id - type - attributes type: object RUMOperationStrongLinkStatus: description: The status of a RUM operation link. enum: - DRAFT - CONFIRMED - REJECTED example: CONFIRMED type: string x-enum-varnames: - DRAFT - CONFIRMED - REJECTED RUMOperationStrongLinkType: description: The JSON:API type for RUM operation link resources. enum: - strong_links example: strong_links type: string x-enum-varnames: - STRONG_LINKS RUMOperationStrongLinkUpdateRequest: description: The request body for updating a RUM operation link. properties: data: $ref: "#/components/schemas/RUMOperationStrongLinkUpdateRequestData" required: - data type: object RUMOperationStrongLinkUpdateRequestAttributes: description: Attributes for updating a RUM operation link. properties: status: $ref: "#/components/schemas/RUMOperationStrongLinkUpdateStatus" required: - status type: object RUMOperationStrongLinkUpdateRequestData: description: The data object for updating a RUM operation link. properties: attributes: $ref: "#/components/schemas/RUMOperationStrongLinkUpdateRequestAttributes" type: $ref: "#/components/schemas/RUMOperationStrongLinkType" required: - type - attributes type: object RUMOperationStrongLinkUpdateStatus: description: The status of a RUM operation link. Can only be set to `CONFIRMED` or `REJECTED`. enum: - CONFIRMED - REJECTED example: CONFIRMED type: string x-enum-varnames: - CONFIRMED - REJECTED RUMOperationStrongLinksListResponse: description: The response for a list of RUM operation links. properties: data: items: $ref: "#/components/schemas/RUMOperationStrongLinkResponseData" type: array meta: $ref: "#/components/schemas/RUMOperationStrongLinksListResponseMeta" required: - data type: object RUMOperationStrongLinksListResponseMeta: description: Metadata for a list of RUM operation links. properties: limit: description: The pagination limit. format: int64 type: integer offset: description: The current offset. format: int64 type: integer total: description: The total number of links matching the request. format: int64 type: integer type: object RUMOperationType: description: The JSON:API type for RUM operation resources. enum: - operations example: operations type: string x-enum-varnames: - OPERATIONS RUMOperationUpdateRequest: description: The request body for updating a RUM operation. properties: data: $ref: "#/components/schemas/RUMOperationUpdateRequestData" required: - data type: object RUMOperationUpdateRequestData: description: The data object for updating a RUM operation. properties: attributes: $ref: "#/components/schemas/RUMOperationRequestAttributes" id: description: The unique identifier of the RUM operation. Must match the ID in the URL path. example: "abc12345-1234-5678-abcd-ef1234567890" type: string type: $ref: "#/components/schemas/RUMOperationType" required: - id - type - attributes type: object RUMOperationUser: description: A Datadog user referenced by a RUM operation. properties: email: description: The email of the user. readOnly: true type: string handle: description: The handle of the user. readOnly: true type: string name: description: The name of the user. readOnly: true type: string uuid: description: The UUID of the user. readOnly: true type: string type: object RUMOperationsListResponse: description: The response for a list of RUM operations. properties: data: items: $ref: "#/components/schemas/RUMOperationResponseData" type: array meta: $ref: "#/components/schemas/RUMOperationsListResponseMeta" required: - data type: object RUMOperationsListResponseMeta: description: Metadata for a list of RUM operations. properties: page: $ref: "#/components/schemas/RUMOperationsListResponseMetaPage" type: object RUMOperationsListResponseMetaPage: description: Pagination metadata for a list of RUM operations. properties: first_offset: description: The offset of the first page. format: int64 type: integer last_offset: description: The offset of the last page. format: int64 type: integer limit: description: The pagination limit. format: int64 type: integer next_offset: description: The offset of the next page, if any. format: int64 nullable: true type: integer offset: description: The current offset. format: int64 type: integer prev_offset: description: The offset of the previous page, if any. format: int64 nullable: true type: integer total: description: The total number of RUM operations matching the search. format: int64 type: integer type: description: The type of pagination used. example: offset type: string type: object RUMProductAnalyticsRetentionScale: description: Product Analytics retention scale configuration. properties: last_modified_at: description: Timestamp in milliseconds when this scale was last modified. example: 1747922145974 format: int64 type: integer state: $ref: "#/components/schemas/RUMProductAnalyticsRetentionState" type: object RUMProductAnalyticsRetentionState: description: Controls the retention policy for Product Analytics data derived from RUM events. enum: - MAX - NONE example: MAX type: string x-enum-descriptions: - Store Product Analytics data for the maximum available retention period - Do not store Product Analytics data x-enum-varnames: - MAX - NONE RUMProductScales: description: Product Scales configuration for the RUM application. properties: product_analytics_retention_scale: $ref: "#/components/schemas/RUMProductAnalyticsRetentionScale" rum_event_processing_scale: $ref: "#/components/schemas/RUMEventProcessingScale" type: object RUMQueryFilter: description: The search and filter query settings. properties: from: default: "now-15m" description: The minimum time for the requested events; supports date (in [ISO 8601](https://www.w3.org/TR/NOTE-datetime) format with full date, hours, minutes, and the `Z` UTC indicator - seconds and fractional seconds are optional), math, and regular timestamps (in milliseconds). example: "now-15m" type: string query: default: "*" description: The search query following the RUM search syntax. example: "@type:session AND @session.type:user" type: string to: default: "now" description: The maximum time for the requested events; supports date (in [ISO 8601](https://www.w3.org/TR/NOTE-datetime) format with full date, hours, minutes, and the `Z` UTC indicator - seconds and fractional seconds are optional), math, and regular timestamps (in milliseconds). example: "now" type: string type: object RUMQueryOptions: description: |- Global query options that are used during the query. Note: Only supply timezone or time offset, not both. Otherwise, the query fails. properties: time_offset: description: The time offset (in seconds) to apply to the query. format: int64 type: integer timezone: default: "UTC" description: |- The timezone can be specified as GMT, UTC, an offset from UTC (like UTC+1), or as a Timezone Database identifier (like America/New_York). example: "GMT" type: string type: object RUMQueryPageOptions: description: Paging attributes for listing events. properties: cursor: description: |- List following results with a cursor provided in the previous query. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string limit: default: 10 description: Maximum number of events in the response. example: 25 format: int32 maximum: 1000 type: integer type: object RUMResponseLinks: description: Links attributes. properties: next: description: |- Link for the next set of results. Note that the request can also be made using the POST endpoint. example: "https://app.datadoghq.com/api/v2/rum/event?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string type: object RUMResponseMetadata: description: The metadata associated with a request. properties: elapsed: description: The time elapsed in milliseconds. example: 132 format: int64 type: integer page: $ref: "#/components/schemas/RUMResponsePage" request_id: description: The identifier of the request. example: "MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR" type: string status: $ref: "#/components/schemas/RUMResponseStatus" warnings: description: |- A list of warnings (non-fatal errors) encountered. Partial results may return if warnings are present in the response. items: $ref: "#/components/schemas/RUMWarning" type: array type: object RUMResponsePage: description: Paging attributes. properties: after: description: |- The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of `page[cursor]`. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string type: object RUMResponseStatus: description: The status of the response. enum: ["done", "timeout"] example: "done" type: string x-enum-varnames: ["DONE", "TIMEOUT"] RUMSearchEventsRequest: description: The request for a RUM events list. properties: filter: $ref: "#/components/schemas/RUMQueryFilter" options: $ref: "#/components/schemas/RUMQueryOptions" page: $ref: "#/components/schemas/RUMQueryPageOptions" sort: $ref: "#/components/schemas/RUMSort" type: object RUMSort: description: Sort parameters when querying events. enum: - timestamp - -timestamp type: string x-enum-varnames: - TIMESTAMP_ASCENDING - TIMESTAMP_DESCENDING RUMSortOrder: description: The order to use, ascending or descending. enum: - "asc" - "desc" example: "asc" type: string x-enum-varnames: - "ASCENDING" - "DESCENDING" RUMWarning: description: A warning message indicating something that went wrong with the query. properties: code: description: A unique code for this type of warning. example: "unknown_index" type: string detail: description: A detailed explanation of this specific warning. example: "indexes: foo, bar" type: string title: description: A short human-readable summary of the warning. example: "One or several indexes are missing or invalid, results hold data from the other indexes" type: string type: object RawErrorBudgetRemaining: description: The raw error budget remaining for the SLO. properties: unit: description: The unit of the error budget (for example, `seconds`, `requests`). example: seconds type: string value: description: The numeric value of the remaining error budget. example: 86400.5 format: double type: number required: - value - unit type: object ReactNativeSourcemapAttributes: description: Attributes of a React Native source map. properties: build_number: description: The build number. example: "100" type: string bundle_name: description: The bundle name. example: com.example.app type: string bundle_version: description: The bundle version. example: "1.0" type: string created_at: description: The timestamp when the source map was created. example: "2024-01-01T00:00:00Z" format: date-time type: string debug_id: description: The debug identifier (UUID format). example: 550e8400-e29b-41d4-a716-446655440000 type: string mapkind: $ref: "#/components/schemas/ReactNativeSourcemapMapKind" platform: description: The platform the source map was built for (e.g., `ios`, `android`). example: ios type: string service: description: The service name associated with the source map. example: my-react-native-app type: string size: description: The size of the source map file in bytes. example: 2048 format: int64 type: integer version: description: The version of the service associated with the source map. example: 1.0.0 type: string required: - mapkind - size - created_at type: object ReactNativeSourcemapData: description: React Native source map data object. properties: attributes: $ref: "#/components/schemas/ReactNativeSourcemapAttributes" id: description: The unique identifier of the source map. example: "10" type: string type: $ref: "#/components/schemas/SourcemapDataType" required: - id - type - attributes type: object ReactNativeSourcemapMapKind: description: The type of source map. Always `react` for React Native source maps. enum: - react example: react type: string x-enum-varnames: - REACT ReadinessGate: additionalProperties: false description: Used to merge multiple branches into a single branch. properties: thresholdType: $ref: "#/components/schemas/ReadinessGateThresholdType" required: - thresholdType type: object ReadinessGateThresholdType: description: The definition of `ReadinessGateThresholdType` object. enum: - ANY - ALL example: ANY type: string x-enum-varnames: - ANY - ALL RecentlyUpdatedEntitiesResponse: description: Response from the recently updated entities endpoint, containing the entities with the most recent updates in the requested time range, ordered from most to least recently updated. properties: data: description: The list of entities with the most recent updates, ordered from most to least recently updated. items: $ref: "#/components/schemas/EntityContextEntity" type: array required: - data type: object RecommendationsFilterRequest: description: JSON:API request body for filtering cost recommendations. example: data: attributes: scope: ccm sort: - expression: "@potential_daily_savings" order: DESC id: "@resource_table:aws_ec2_instance" type: recommendations_filter properties: data: $ref: "#/components/schemas/RecommendationsFilterRequestData" required: - data type: object RecommendationsFilterRequestData: description: |- JSON:API resource containing the cost recommendations filter. This legacy search contract uses the resource ID for the filter expression rather than as a persistent resource identifier. properties: attributes: $ref: "#/components/schemas/RecommendationsFilterRequestDataAttributes" id: description: |- Filter expression applied to the recommendations when `attributes.filter` is omitted. When supplied, `attributes.filter` overrides this value, including when empty. If the resulting filter is empty, it defaults to `*`. Scope, view, and pagination still apply. example: "@resource_table:aws_ec2_instance" type: string type: $ref: "#/components/schemas/RecommendationsFilterRequestDataType" required: - type type: object RecommendationsFilterRequestDataAttributes: description: Attributes used to filter and sort cost recommendations. properties: filter: description: |- Filter expression applied to the recommendations. When supplied, this attribute overrides `data.id`, including when empty. When omitted, `data.id` is used. If the resulting filter is empty, it defaults to `*`. Scope, view, and pagination still apply. example: "@resource_table:aws_ec2_instance" type: string scope: $ref: "#/components/schemas/RecommendationsFilterRequestScope" sort: description: Ordered list of sort clauses applied to the result set. items: $ref: "#/components/schemas/RecommendationsFilterRequestSortItems" type: array view: description: |- Status view to return: `all`, `active` (not dismissed), `dismissed`, `open`, `in-progress`, or `completed`. Defaults to `all`, which returns recommendations in every status. example: active type: string type: object RecommendationsFilterRequestDataType: default: recommendations_filter description: Legacy JSON:API resource type required by the cost recommendations search decoder. enum: - recommendations_filter example: recommendations_filter type: string x-enum-varnames: - RECOMMENDATIONS_FILTER RecommendationsFilterRequestScope: description: |- Recommendations scope. Defaults to `ccm`; use `experiment` for experimental recommendations or `*` for both. An empty value is treated as `ccm`. enum: - ccm - experiment - "*" - "" example: ccm type: string x-enum-varnames: - CCM - EXPERIMENT - ALL - EMPTY RecommendationsFilterRequestSortItems: description: A single sort clause applied to the cost recommendations result set. properties: expression: description: Field to sort by (for example, `@potential_daily_savings`). example: "@potential_daily_savings" type: string order: description: Sort direction, either `ASC` or `DESC` (case-insensitive). example: DESC type: string required: - order type: object RecommendationsPageMeta: description: Top-level JSON:API meta object for paginated cost recommendation responses. properties: page: $ref: "#/components/schemas/RecommendationsPageMetaPage" type: object RecommendationsPageMetaPage: description: Pagination metadata for a page of cost recommendations. properties: filter: description: The filter expression that was applied to produce this page. type: string next_page_token: description: Opaque token used to fetch the next page; absent on the last page. type: string page_size: description: Number of items returned in this page (1–5000). format: int32 maximum: 5000 minimum: 1 type: integer page_token: description: Pagination token echoed back from the request. type: string type: object ReferenceTableCreateSourceType: description: >- The source type for creating reference table data. Only these source types can be created through this API. enum: - LOCAL_FILE - S3 - GCS - AZURE example: "LOCAL_FILE" type: string x-enum-varnames: - LOCAL_FILE - S3 - GCS - AZURE ReferenceTableSchemaFieldType: description: The field type for reference table schema fields. enum: - STRING - INT32 example: "STRING" type: string x-enum-varnames: - STRING - INT32 ReferenceTableSortType: default: "-updated_at" description: >- Sort field and direction for reference tables. Use field name for ascending, prefix with "-" for descending. enum: - updated_at - table_name - status - "-updated_at" - "-table_name" - "-status" type: string x-enum-varnames: - UPDATED_AT - TABLE_NAME - STATUS - MINUS_UPDATED_AT - MINUS_TABLE_NAME - MINUS_STATUS ReferenceTableSourceType: description: >- The source type for reference table data. Includes all possible source types that can appear in responses. enum: - LOCAL_FILE - S3 - GCS - AZURE - SERVICENOW - SALESFORCE - DATABRICKS - SNOWFLAKE example: "LOCAL_FILE" type: string x-enum-varnames: - LOCAL_FILE - S3 - GCS - AZURE - SERVICENOW - SALESFORCE - DATABRICKS - SNOWFLAKE RegisterAppKeyResponse: description: The response object after creating an app key registration. properties: data: $ref: "#/components/schemas/AppKeyRegistrationData" type: object RelationAttributes: description: Relation attributes. properties: from: $ref: "#/components/schemas/RelationEntity" to: $ref: "#/components/schemas/RelationEntity" type: $ref: "#/components/schemas/RelationType" type: object RelationEntity: description: Relation entity reference. properties: kind: description: Entity kind. type: string name: description: Entity name. type: string namespace: description: Entity namespace. type: string type: object RelationIncludeType: description: Supported include types for relations. enum: - entity - schema type: string x-enum-varnames: - ENTITY - SCHEMA RelationMeta: description: Relation metadata. properties: createdAt: description: Relation creation time. format: date-time type: string definedBy: description: Relation defined by. type: string modifiedAt: description: Relation modification time. format: date-time type: string source: description: Relation source. type: string type: object RelationRelationships: description: Relation relationships. properties: fromEntity: $ref: "#/components/schemas/RelationToEntity" toEntity: $ref: "#/components/schemas/RelationToEntity" type: object RelationResponse: description: Relation response data. properties: attributes: $ref: "#/components/schemas/RelationAttributes" id: description: Relation ID. type: string meta: $ref: "#/components/schemas/RelationMeta" relationships: $ref: "#/components/schemas/RelationRelationships" subtype: description: Relation subtype. type: string type: $ref: "#/components/schemas/RelationResponseType" type: object RelationResponseData: description: Array of relation responses items: $ref: "#/components/schemas/RelationResponse" type: array RelationResponseMeta: description: Relation response metadata. properties: count: description: Total relations count. format: int64 type: integer includeCount: description: Total included data count. format: int64 type: integer type: object RelationResponseType: description: Relation type. enum: [relation] type: string x-enum-varnames: - RELATION RelationToEntity: description: Relation to entity. properties: data: $ref: "#/components/schemas/RelationshipItem" meta: $ref: "#/components/schemas/EntityMeta" type: object RelationType: description: Supported relation types. enum: - RelationTypeOwns - RelationTypeOwnedBy - RelationTypeDependsOn - RelationTypeDependencyOf - RelationTypePartsOf - RelationTypeHasPart - RelationTypeOtherOwns - RelationTypeOtherOwnedBy - RelationTypeImplementedBy - RelationTypeImplements type: string x-enum-varnames: - RELATIONTYPEOWNS - RELATIONTYPEOWNEDBY - RELATIONTYPEDEPENDSON - RELATIONTYPEDEPENDENCYOF - RELATIONTYPEPARTSOF - RELATIONTYPEHASPART - RELATIONTYPEOTHEROWNS - RELATIONTYPEOTHEROWNEDBY - RELATIONTYPEIMPLEMENTEDBY - RELATIONTYPEIMPLEMENTS RelationshipArray: description: Relationships. items: $ref: "#/components/schemas/RelationshipItem" type: array RelationshipItem: description: Relationship entry. properties: id: description: Associated data ID. type: string type: description: Relationship type. type: string type: object RelationshipToAccessTokenOwner: description: Relationship to the access token's owner. properties: data: $ref: "#/components/schemas/RelationshipToAccessTokenOwnerData" required: - data type: object RelationshipToAccessTokenOwnerData: description: Relationship to the access token's owner. properties: id: description: A unique identifier that represents the owner. example: "00000000-0000-0000-2345-000000000000" type: string type: $ref: "#/components/schemas/AccessTokenOwnerType" required: - id - type type: object RelationshipToIncident: description: Relationship to incident. properties: data: $ref: "#/components/schemas/RelationshipToIncidentData" required: - data type: object RelationshipToIncidentAttachment: description: A relationship reference for attachments. properties: data: description: |- An array of incident attachments. items: $ref: "#/components/schemas/RelationshipToIncidentAttachmentData" type: array required: - data type: object RelationshipToIncidentAttachmentData: description: The attachment relationship data. properties: id: description: A unique identifier that represents the attachment. example: "00000000-0000-abcd-1000-000000000000" type: string type: $ref: "#/components/schemas/IncidentAttachmentType" required: - id - type type: object RelationshipToIncidentData: description: Relationship to incident object. properties: id: description: A unique identifier that represents the incident. example: "00000000-0000-0000-1234-000000000000" type: string type: $ref: "#/components/schemas/IncidentType" required: - id - type type: object RelationshipToIncidentImpactData: description: Relationship to impact object. properties: id: description: A unique identifier that represents the impact. example: "00000000-0000-0000-2345-000000000000" type: string type: $ref: "#/components/schemas/IncidentImpactsType" required: - id - type type: object RelationshipToIncidentImpacts: description: Relationship to impacts. properties: data: description: An array of incident impacts. items: $ref: "#/components/schemas/RelationshipToIncidentImpactData" type: array required: - data type: object RelationshipToIncidentIntegrationMetadataData: description: A relationship reference for an integration metadata object. example: {"id": "00000000-abcd-0002-0000-000000000000", "type": "incident_integrations"} properties: id: description: A unique identifier that represents the integration metadata. example: "00000000-abcd-0001-0000-000000000000" type: string type: $ref: "#/components/schemas/IncidentIntegrationMetadataType" required: - id - type type: object RelationshipToIncidentIntegrationMetadatas: description: A relationship reference for multiple integration metadata objects. example: {"data": [{"id": "00000000-abcd-0005-0000-000000000000", "type": "incident_integrations"}, {"id": "00000000-abcd-0006-0000-000000000000", "type": "incident_integrations"}]} properties: data: description: Integration metadata relationship array example: [{"id": "00000000-abcd-0003-0000-000000000000", "type": "incident_integrations"}, {"id": "00000000-abcd-0004-0000-000000000000", "type": "incident_integrations"}] items: $ref: "#/components/schemas/RelationshipToIncidentIntegrationMetadataData" type: array required: - data type: object RelationshipToIncidentNotificationTemplate: description: A relationship reference to a notification template. properties: data: $ref: "#/components/schemas/RelationshipToIncidentNotificationTemplateData" required: - data type: object RelationshipToIncidentNotificationTemplateData: description: The notification template relationship data. properties: id: description: The unique identifier of the notification template. example: "00000000-0000-0000-0000-000000000001" format: uuid type: string type: $ref: "#/components/schemas/IncidentNotificationTemplateType" required: - id - type type: object RelationshipToIncidentPostmortem: description: A relationship reference for postmortems. example: {"data": {"id": "00000000-0000-abcd-3000-000000000000", "type": "incident_postmortems"}} properties: data: $ref: "#/components/schemas/RelationshipToIncidentPostmortemData" required: - data type: object RelationshipToIncidentPostmortemData: description: The postmortem relationship data. example: {"id": "00000000-0000-abcd-2000-000000000000", "type": "incident_postmortems"} properties: id: description: A unique identifier that represents the postmortem. example: "00000000-0000-abcd-1000-000000000000" type: string type: $ref: "#/components/schemas/IncidentPostmortemType" required: - id - type type: object RelationshipToIncidentRequest: description: Relationship to incident request properties: data: $ref: "#/components/schemas/IncidentRelationshipData" required: - data type: object RelationshipToIncidentResponderData: description: Relationship to impact object. properties: id: description: A unique identifier that represents the responder. example: "00000000-0000-0000-2345-000000000000" type: string type: $ref: "#/components/schemas/IncidentRespondersType" required: - id - type type: object RelationshipToIncidentResponders: description: Relationship to incident responders. properties: data: description: An array of incident responders. items: $ref: "#/components/schemas/RelationshipToIncidentResponderData" type: array required: - data type: object RelationshipToIncidentType: description: Relationship to an incident type. properties: data: $ref: "#/components/schemas/RelationshipToIncidentTypeData" required: - data type: object RelationshipToIncidentTypeData: description: Relationship to incident type object. properties: id: description: The incident type's ID. example: "00000000-0000-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/IncidentTypeType" required: - id - type type: object RelationshipToIncidentUserDefinedFieldData: description: Relationship to impact object. properties: id: description: A unique identifier that represents the responder. example: "00000000-0000-0000-2345-000000000000" type: string type: $ref: "#/components/schemas/IncidentUserDefinedFieldType" required: - id - type type: object RelationshipToIncidentUserDefinedFields: description: Relationship to incident user defined fields. properties: data: description: An array of user defined fields. items: $ref: "#/components/schemas/RelationshipToIncidentUserDefinedFieldData" type: array required: - data type: object RelationshipToLeakedKey: description: Relationship to the leak the access token was found in. `data` is null when the access token has not been detected as leaked. properties: data: $ref: "#/components/schemas/RelationshipToLeakedKeyData" required: - data type: object RelationshipToLeakedKeyData: description: Relationship to the leak the access token was found in. nullable: true properties: id: description: A unique identifier that represents the leak. example: "00000000-0000-1234-0000-000000000000" type: string type: $ref: "#/components/schemas/LeakedKeyType" required: - id - type type: object RelationshipToOrganization: description: Relationship to an organization. properties: data: $ref: "#/components/schemas/RelationshipToOrganizationData" required: - data type: object RelationshipToOrganizationData: description: Relationship to organization object. properties: id: description: ID of the organization. example: "00000000-0000-beef-0000-000000000000" type: string type: $ref: "#/components/schemas/OrganizationsType" required: - id - type type: object RelationshipToOrganizations: description: Relationship to organizations. properties: data: description: Relationships to organization objects. example: [] items: $ref: "#/components/schemas/RelationshipToOrganizationData" type: array required: - data type: object RelationshipToOutcome: description: The JSON:API relationship to a scorecard outcome. properties: data: $ref: "#/components/schemas/RelationshipToOutcomeData" type: object RelationshipToOutcomeData: description: The JSON:API relationship to an outcome, which returns the related rule id. properties: id: $ref: "#/components/schemas/RuleId" type: $ref: "#/components/schemas/RuleType" type: object RelationshipToPermission: description: Relationship to a permissions object. properties: data: $ref: "#/components/schemas/RelationshipToPermissionData" type: object RelationshipToPermissionData: description: Relationship to permission object. properties: id: description: ID of the permission. type: string type: $ref: "#/components/schemas/PermissionsType" type: object RelationshipToPermissions: description: Relationship to multiple permissions objects. properties: data: description: Relationships to permission objects. items: $ref: "#/components/schemas/RelationshipToPermissionData" type: array type: object RelationshipToRole: description: Relationship to role. properties: data: $ref: "#/components/schemas/RelationshipToRoleData" type: object RelationshipToRoleData: description: Relationship to role object. properties: id: description: The unique identifier of the role. example: "3653d3c6-0c75-11ea-ad28-fb5701eabc7d" type: string type: $ref: "#/components/schemas/RolesType" type: object RelationshipToRoles: description: Relationship to roles. properties: data: description: An array containing type and the unique identifier of a role. items: $ref: "#/components/schemas/RelationshipToRoleData" type: array type: object RelationshipToRule: description: Scorecard create rule response relationship. properties: scorecard: $ref: "#/components/schemas/RelationshipToRuleData" type: object RelationshipToRuleData: description: Relationship data for a rule. properties: data: $ref: "#/components/schemas/RelationshipToRuleDataObject" type: object RelationshipToRuleDataObject: description: Rule relationship data. properties: id: description: The unique ID for a scorecard. example: q8MQxk8TCqrHnWkp type: string type: $ref: "#/components/schemas/ScorecardType" type: object RelationshipToSAMLAssertionAttribute: description: AuthN Mapping relationship to SAML Assertion Attribute. properties: data: $ref: "#/components/schemas/RelationshipToSAMLAssertionAttributeData" required: - data type: object RelationshipToSAMLAssertionAttributeData: description: Data of AuthN Mapping relationship to SAML Assertion Attribute. properties: id: description: The ID of the SAML assertion attribute. example: "0" type: string type: $ref: "#/components/schemas/SAMLAssertionAttributesType" required: - id - type type: object RelationshipToServiceAccount: description: Relationship to service account. properties: data: $ref: "#/components/schemas/RelationshipToServiceAccountData" required: - data type: object RelationshipToServiceAccountData: description: Relationship to service account object. properties: id: description: A unique identifier that represents the service account. example: "00000000-0000-0000-2345-000000000000" type: string type: $ref: "#/components/schemas/ServiceAccountType" required: - id - type type: object RelationshipToTeam: description: Relationship to team. properties: data: $ref: "#/components/schemas/RelationshipToTeamData" type: object RelationshipToTeamData: description: Relationship to Team object. properties: id: description: The unique identifier of the team. example: f9bb8444-af7f-11ec-ac2c-da7ad0900001 type: string type: $ref: "#/components/schemas/TeamType" type: object RelationshipToTeamLinkData: description: Relationship between a link and a team properties: id: description: The team link's identifier example: f9bb8444-af7f-11ec-ac2c-da7ad0900001 type: string type: $ref: "#/components/schemas/TeamLinkType" required: - id - type type: object RelationshipToTeamLinks: description: Relationship between a team and a team link properties: data: description: Related team links items: $ref: "#/components/schemas/RelationshipToTeamLinkData" type: array links: $ref: "#/components/schemas/TeamRelationshipsLinks" type: object RelationshipToUser: description: Relationship to user. properties: data: $ref: "#/components/schemas/RelationshipToUserData" required: - data type: object RelationshipToUserData: description: Relationship to user object. properties: id: description: A unique identifier that represents the user. example: "00000000-0000-0000-2345-000000000000" type: string type: $ref: "#/components/schemas/UsersType" required: - id - type type: object RelationshipToUserTeamPermission: description: Relationship between a user team permission and a team properties: data: $ref: "#/components/schemas/RelationshipToUserTeamPermissionData" links: $ref: "#/components/schemas/TeamRelationshipsLinks" type: object RelationshipToUserTeamPermissionData: description: Related user team permission data nullable: true properties: id: description: The ID of the user team permission example: UserTeamPermissions-aeadc05e-98a8-11ec-ac2c-da7ad0900001-416595 type: string type: $ref: "#/components/schemas/UserTeamPermissionType" required: - id - type type: object RelationshipToUserTeamTeam: description: Relationship between team membership and team properties: data: $ref: "#/components/schemas/RelationshipToUserTeamTeamData" required: - data type: object RelationshipToUserTeamTeamData: description: The team associated with the membership properties: id: description: The ID of the team associated with the membership example: d7e15d9d-d346-43da-81d8-3d9e71d9a5e9 type: string type: $ref: "#/components/schemas/UserTeamTeamType" required: - id - type type: object RelationshipToUserTeamUser: description: Relationship between team membership and user properties: data: $ref: "#/components/schemas/RelationshipToUserTeamUserData" required: - data type: object RelationshipToUserTeamUserData: description: A user's relationship with a team properties: id: description: The ID of the user associated with the team example: b8626d7e-cedd-11eb-abf5-da7ad0900001 type: string type: $ref: "#/components/schemas/UserTeamUserType" required: - id - type type: object RelationshipToUsers: description: Relationship to users. properties: data: description: Relationships to user objects. example: [] items: $ref: "#/components/schemas/RelationshipToUserData" type: array required: - data type: object Remediation: description: Vulnerability remediation. properties: auto_solvable: description: Whether the vulnerability can be resolved when recompiling the package or not. example: false type: boolean avoided_advisories: description: Avoided advisories. items: $ref: "#/components/schemas/Advisory" type: array fixed_advisories: description: Remediation fixed advisories. items: $ref: "#/components/schemas/Advisory" type: array library_name: description: Library name remediating the vulnerability. example: stdlib type: string library_version: description: Library version remediating the vulnerability. example: Upgrade to a version >= 1.20.0 type: string new_advisories: description: New advisories. items: $ref: "#/components/schemas/Advisory" type: array remaining_advisories: description: Remaining advisories. items: $ref: "#/components/schemas/Advisory" type: array type: description: Remediation type. example: text type: string required: - type - library_name - library_version - auto_solvable - fixed_advisories - remaining_advisories - new_advisories - avoided_advisories type: object ReorderRetentionFiltersRequest: description: A list of retention filters to reorder. properties: data: description: A list of retention filters objects. items: $ref: "#/components/schemas/RetentionFilterWithoutAttributes" type: array required: - data type: object ReorderRuleResourceArray: description: The definition of `ReorderRuleResourceArray` object. example: data: - id: "456" type: arbitrary_rule - id: "123" type: arbitrary_rule - id: "789" type: arbitrary_rule properties: data: description: The `ReorderRuleResourceArray` `data`. items: $ref: "#/components/schemas/ReorderRuleResourceData" type: array required: - data type: object ReorderRuleResourceData: description: The definition of `ReorderRuleResourceData` object. properties: id: description: The `ReorderRuleResourceData` `id`. type: string type: $ref: "#/components/schemas/ReorderRuleResourceDataType" required: - type type: object ReorderRuleResourceDataType: default: arbitrary_rule description: Arbitrary rule resource type. enum: - arbitrary_rule example: arbitrary_rule type: string x-enum-varnames: - ARBITRARY_RULE ReorderRulesetResourceArray: description: The definition of `ReorderRulesetResourceArray` object. example: data: - id: "55ef2385-9ae1-4410-90c4-5ac1b60fec10" type: ruleset - id: "a7b8c9d0-1234-5678-9abc-def012345678" type: ruleset - id: "f1e2d3c4-b5a6-9780-1234-567890abcdef" type: ruleset properties: data: description: The `ReorderRulesetResourceArray` `data`. items: $ref: "#/components/schemas/ReorderRulesetResourceData" type: array required: - data type: object ReorderRulesetResourceData: description: The definition of `ReorderRulesetResourceData` object. properties: id: description: The `ReorderRulesetResourceData` `id`. type: string type: $ref: "#/components/schemas/ReorderRulesetResourceDataType" required: - type type: object ReorderRulesetResourceDataType: default: ruleset description: Ruleset resource type. enum: - ruleset example: ruleset type: string x-enum-varnames: - RULESET ReportScheduleAuthor: description: A user included as a related JSON:API resource. properties: attributes: $ref: "#/components/schemas/ReportScheduleAuthorAttributes" id: description: The user UUID. example: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" type: string type: $ref: "#/components/schemas/ReportScheduleAuthorType" required: - type - id - attributes type: object ReportScheduleAuthorAttributes: description: Attributes of the report author. properties: email: description: The email address of the report author, or `null` if unavailable. example: "user@example.com" nullable: true type: string name: description: The display name of the report author, or `null` if unavailable. example: "Example User" nullable: true type: string required: - name - email type: object ReportScheduleAuthorRelationship: description: Relationship to the author of the report schedule. properties: data: $ref: "#/components/schemas/ReportScheduleAuthorRelationshipData" required: - data type: object ReportScheduleAuthorRelationshipData: description: Relationship data for the author of the report schedule. properties: id: description: The user UUID of the report schedule author. example: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" type: string type: $ref: "#/components/schemas/ReportScheduleAuthorType" required: - id - type type: object ReportScheduleAuthorType: description: JSON:API resource type for the included report author. enum: - users example: users type: string x-enum-varnames: - USERS ReportScheduleCreateRequest: description: Request body for creating a report schedule. properties: data: $ref: "#/components/schemas/ReportScheduleCreateRequestData" required: - data type: object ReportScheduleCreateRequestAttributes: description: The configuration of the report schedule to create. properties: delivery_format: $ref: "#/components/schemas/ReportScheduleDeliveryFormat" description: description: A description of the report, up to 4096 characters. example: "Weekly summary of infrastructure health." maxLength: 4096 type: string recipients: description: |- The recipients of the report. Each entry is an email address, a Slack channel reference in the form `slack:{team_id}.{channel_id}.{channel_name}`, or a Microsoft Teams channel reference in the form `teams:{tenant_id}|{team_id}|{channel_id}`. example: - "user@example.com" - "slack:T01234567.C01234567.alerts" - "teams:11111111-1111-1111-1111-111111111111|22222222-2222-2222-2222-222222222222|19:exampleChannelId@thread.tacv2" items: description: A single recipient (email address, Slack channel reference, or Microsoft Teams channel reference). type: string type: array resource_id: description: The identifier of the dashboard or integration dashboard to render in the report. example: "abc-def-ghi" type: string resource_type: $ref: "#/components/schemas/ReportScheduleResourceType" rrule: description: The recurrence rule for the schedule, expressed as an iCalendar `RRULE` string. example: "DTSTART;TZID=America/New_York:20260601T090000\nRRULE:FREQ=WEEKLY;BYDAY=MO;BYHOUR=9;BYMINUTE=0" type: string tab_id: description: The identifier of the dashboard tab to render, when the dashboard has tabs. example: "66666666-7777-8888-9999-000000000000" format: uuid type: string template_variables: description: The dashboard template variables applied when rendering the report. items: $ref: "#/components/schemas/ReportScheduleTemplateVariable" type: array timeframe: description: The relative timeframe of data to include in the report. example: "1w" type: string timezone: description: The IANA time zone identifier the recurrence rule is evaluated in. example: "America/New_York" type: string title: description: The title of the report, between 1 and 78 characters. example: "Weekly Infrastructure Report" maxLength: 78 minLength: 1 type: string required: - resource_id - resource_type - recipients - rrule - timezone - template_variables - timeframe - title - description type: object ReportScheduleCreateRequestData: description: The JSON:API data object for a report schedule creation request. properties: attributes: $ref: "#/components/schemas/ReportScheduleCreateRequestAttributes" type: $ref: "#/components/schemas/ReportScheduleType" required: - type - attributes type: object ReportScheduleDeliveryFormat: description: |- How a PDF-export report is delivered. `pdf` attaches a PDF file, `png` embeds an inline PNG image, and `pdf_and_png` delivers both. enum: - pdf - png - pdf_and_png example: pdf type: string x-enum-varnames: - PDF - PNG - PDF_AND_PNG ReportScheduleIncludedResource: description: A related resource included with a report schedule. oneOf: - $ref: "#/components/schemas/ReportScheduleAuthor" - $ref: "#/components/schemas/ReportScheduleResource" ReportScheduleIncludedResourceType: description: JSON:API resource type for an included report resource. enum: - resource example: resource type: string x-enum-varnames: - RESOURCE ReportScheduleIndexTemplateVariable: description: Template variable metadata from a dashboard index. properties: available_values: description: Available values for the template variable. example: - prod - staging items: type: string nullable: true type: array defaults: description: Default values for the template variable. example: - prod items: type: string nullable: true type: array name: description: The template variable name. example: env nullable: true type: string prefix: description: The tag prefix for the template variable, when available. example: env nullable: true type: string type: object ReportScheduleListResourceRelationship: description: Relationship to the report target resource. properties: data: $ref: "#/components/schemas/ReportScheduleListResourceRelationshipData" required: - data type: object ReportScheduleListResourceRelationshipData: description: Relationship data for the report target resource. properties: id: description: The resource identifier. example: "abc-def-ghi" type: string type: $ref: "#/components/schemas/ReportScheduleIncludedResourceType" required: - id - type type: object ReportScheduleListResponse: description: Response containing a list of report schedules. properties: data: description: The list of report schedules. items: $ref: "#/components/schemas/ReportScheduleListResponseData" type: array included: description: Related resources included with the report schedules, such as authors and rendered resources. items: $ref: "#/components/schemas/ReportScheduleIncludedResource" type: array links: $ref: "#/components/schemas/ReportScheduleListResponseLinks" meta: $ref: "#/components/schemas/ReportScheduleListResponseMeta" required: - data type: object ReportScheduleListResponseAttributes: description: The configuration and derived state of a report schedule in a list response. properties: delivery_format: $ref: "#/components/schemas/ReportScheduleResponseAttributesDeliveryFormat" description: description: The description of the report. example: "Weekly summary of infrastructure health." type: string next_recurrence: description: The Unix timestamp, in milliseconds, of the next scheduled delivery, or `null` if none is scheduled. example: 1780923600000 format: int64 nullable: true type: integer recipients: description: The recipients of the report (email addresses, Slack channel references, or Microsoft Teams channel references). example: - "user@example.com" - "slack:T01234567.C01234567.alerts" - "teams:11111111-1111-1111-1111-111111111111|22222222-2222-2222-2222-222222222222|19:exampleChannelId@thread.tacv2" items: description: A single recipient (email address, Slack channel reference, or Microsoft Teams channel reference). type: string type: array resource_id: description: The identifier of the resource rendered in the report. example: "abc-def-ghi" type: string resource_type: $ref: "#/components/schemas/ReportScheduleResourceType" rrule: description: The recurrence rule for the schedule, expressed as an iCalendar `RRULE` string. example: "DTSTART;TZID=America/New_York:20260601T090000\nRRULE:FREQ=WEEKLY;BYDAY=MO;BYHOUR=9;BYMINUTE=0" type: string status: $ref: "#/components/schemas/ReportScheduleStatus" template_variables: description: The dashboard template variables applied when rendering the report. items: $ref: "#/components/schemas/ReportScheduleTemplateVariable" type: array timeframe: description: The relative timeframe of data included in the report, or `null` if not set. example: "1w" nullable: true type: string timezone: description: The IANA time zone identifier the recurrence rule is evaluated in. example: "America/New_York" type: string title: description: The title of the report. example: "Weekly Infrastructure Report" type: string required: - status - resource_id - resource_type - recipients - rrule - timezone - template_variables - title - description - timeframe - next_recurrence type: object ReportScheduleListResponseData: description: The JSON:API data object representing a report schedule in a list response. properties: attributes: $ref: "#/components/schemas/ReportScheduleListResponseAttributes" id: description: The unique identifier of the report schedule. example: "11111111-2222-3333-4444-555555555555" type: string relationships: $ref: "#/components/schemas/ReportScheduleListResponseRelationships" type: $ref: "#/components/schemas/ReportScheduleType" required: - id - type - attributes - relationships type: object ReportScheduleListResponseLinks: description: Pagination links for navigating a report schedule list response. properties: first: description: Link to the first page. example: "https://api.datadoghq.com/api/v2/reporting/schedule/list?page[offset]=0&page[limit]=25" nullable: true type: string last: description: Link to the last page, or `null` if it is unavailable. example: "https://api.datadoghq.com/api/v2/reporting/schedule/list?page[offset]=0&page[limit]=25" nullable: true type: string next: description: Link to the next page, or `null` if it is unavailable. example: "https://api.datadoghq.com/api/v2/reporting/schedule/list?page[offset]=25&page[limit]=25" nullable: true type: string prev: description: Link to the previous page, or `null` if it is unavailable. example: "https://api.datadoghq.com/api/v2/reporting/schedule/list?page[offset]=0&page[limit]=25" nullable: true type: string self: description: Link to the current page. example: "https://api.datadoghq.com/api/v2/reporting/schedule/list?page[limit]=25" nullable: true type: string type: object ReportScheduleListResponseMeta: description: Metadata for a paginated report schedule list response. properties: pagination: $ref: "#/components/schemas/ReportScheduleListResponsePagination" type: object ReportScheduleListResponsePagination: description: Offset and limit pagination metadata for a report schedule list response. properties: first_offset: description: The first offset. example: 0 format: int64 type: integer last_offset: description: The last offset when the total count is known, or `null` if it is unavailable. example: 0 format: int64 nullable: true type: integer limit: description: The maximum number of schedules returned. example: 25 format: int64 type: integer next_offset: description: The next offset. example: 25 format: int64 type: integer offset: description: The current offset. example: 0 format: int64 type: integer prev_offset: description: The previous offset. example: 0 format: int64 type: integer total: description: The total number of matching schedules. example: 1 format: int64 type: integer type: $ref: "#/components/schemas/ReportScheduleListResponsePaginationType" type: object ReportScheduleListResponsePaginationType: description: The pagination type. enum: - offset_limit example: offset_limit type: string x-enum-varnames: - OFFSET_LIMIT ReportScheduleListResponseRelationships: description: Relationships for a report schedule in a list response. properties: author: $ref: "#/components/schemas/ReportScheduleAuthorRelationship" resource: $ref: "#/components/schemas/ReportScheduleListResourceRelationship" required: - author type: object ReportSchedulePatchRequest: description: Request body for updating a report schedule. properties: data: $ref: "#/components/schemas/ReportSchedulePatchRequestData" required: - data type: object ReportSchedulePatchRequestAttributes: description: |- The updated configuration of the report schedule. These values replace the existing ones; the targeted resource (`resource_id` and `resource_type`) cannot be changed. properties: delivery_format: $ref: "#/components/schemas/ReportScheduleDeliveryFormat" description: description: A description of the report, up to 4096 characters. example: "Updated weekly summary of infrastructure health." maxLength: 4096 type: string recipients: description: |- The recipients of the report. Each entry is an email address, a Slack channel reference in the form `slack:{team_id}.{channel_id}.{channel_name}`, or a Microsoft Teams channel reference in the form `teams:{tenant_id}|{team_id}|{channel_id}`. example: - "user@example.com" - "slack:T01234567.C01234567.alerts" - "teams:11111111-1111-1111-1111-111111111111|22222222-2222-2222-2222-222222222222|19:exampleChannelId@thread.tacv2" items: description: A single recipient (email address, Slack channel reference, or Microsoft Teams channel reference). type: string type: array rrule: description: The recurrence rule for the schedule, expressed as an iCalendar `RRULE` string. example: "DTSTART;TZID=America/New_York:20260601T090000\nRRULE:FREQ=WEEKLY;BYDAY=MO;BYHOUR=9;BYMINUTE=0" type: string tab_id: description: The identifier of the dashboard tab to render, when the dashboard has tabs. example: "66666666-7777-8888-9999-000000000000" format: uuid type: string template_variables: description: The dashboard template variables applied when rendering the report. items: $ref: "#/components/schemas/ReportScheduleTemplateVariable" type: array timeframe: description: The relative timeframe of data to include in the report. example: "1w" type: string timezone: description: The IANA time zone identifier the recurrence rule is evaluated in. example: "America/New_York" type: string title: description: The title of the report, between 1 and 78 characters. example: "Weekly Infrastructure Report" maxLength: 78 minLength: 1 type: string required: - recipients - rrule - timezone - template_variables - timeframe - title - description type: object ReportSchedulePatchRequestData: description: The JSON:API data object for a report schedule update request. properties: attributes: $ref: "#/components/schemas/ReportSchedulePatchRequestAttributes" type: $ref: "#/components/schemas/ReportScheduleType" required: - type - attributes type: object ReportScheduleResource: description: A report target resource included as a related JSON:API resource. properties: attributes: $ref: "#/components/schemas/ReportScheduleResourceAttributes" id: description: The resource identifier. example: "abc-def-ghi" type: string type: $ref: "#/components/schemas/ReportScheduleIncludedResourceType" required: - type - id - attributes type: object ReportScheduleResourceAttributes: description: Attributes of an included report target resource. properties: resource_type: $ref: "#/components/schemas/ReportScheduleResourceType" template_variables: description: Template variable metadata from the dashboard resource, when available. items: $ref: "#/components/schemas/ReportScheduleIndexTemplateVariable" nullable: true type: array title: description: The title of the dashboard or integration dashboard resource, when available. example: "Infrastructure Overview" nullable: true type: string required: - resource_type type: object ReportScheduleResourceType: description: The type of dashboard resource the report schedule targets. enum: - dashboard - integration_dashboard example: dashboard type: string x-enum-varnames: - DASHBOARD - INTEGRATION_DASHBOARD ReportScheduleResponse: description: Response containing a single report schedule. properties: data: $ref: "#/components/schemas/ReportScheduleResponseData" included: description: Related resources included with the report schedule, such as the author. items: $ref: "#/components/schemas/ReportScheduleIncludedResource" type: array required: - data type: object ReportScheduleResponseAttributes: description: The configuration and derived state of a report schedule. properties: delivery_format: $ref: "#/components/schemas/ReportScheduleResponseAttributesDeliveryFormat" description: description: The description of the report. example: "Weekly summary of infrastructure health." type: string next_recurrence: description: The Unix timestamp, in milliseconds, of the next scheduled delivery, or `null` if none is scheduled. example: 1780923600000 format: int64 nullable: true type: integer recipients: description: The recipients of the report (email addresses, Slack channel references, or Microsoft Teams channel references). example: - "user@example.com" - "slack:T01234567.C01234567.alerts" - "teams:11111111-1111-1111-1111-111111111111|22222222-2222-2222-2222-222222222222|19:exampleChannelId@thread.tacv2" items: description: A single recipient (email address, Slack channel reference, or Microsoft Teams channel reference). type: string type: array resource_id: description: The identifier of the resource rendered in the report. example: "abc-def-ghi" type: string resource_type: $ref: "#/components/schemas/ReportScheduleResourceType" rrule: description: The recurrence rule for the schedule, expressed as an iCalendar `RRULE` string. example: "DTSTART;TZID=America/New_York:20260601T090000\nRRULE:FREQ=WEEKLY;BYDAY=MO;BYHOUR=9;BYMINUTE=0" type: string status: $ref: "#/components/schemas/ReportScheduleStatus" tab_id: description: The identifier of the dashboard tab rendered in the report, or `null` if not set. example: "66666666-7777-8888-9999-000000000000" nullable: true type: string template_variables: description: The dashboard template variables applied when rendering the report. items: $ref: "#/components/schemas/ReportScheduleTemplateVariable" type: array timeframe: description: The relative timeframe of data included in the report, or `null` if not set. example: "1w" nullable: true type: string timezone: description: The IANA time zone identifier the recurrence rule is evaluated in. example: "America/New_York" type: string title: description: The title of the report. example: "Weekly Infrastructure Report" type: string required: - status - resource_id - resource_type - recipients - rrule - timezone - template_variables - title - description - timeframe - next_recurrence - tab_id type: object ReportScheduleResponseAttributesDeliveryFormat: description: The delivery format for dashboard report schedules, or `null` if not set. enum: - pdf - png - pdf_and_png example: pdf nullable: true type: string x-enum-varnames: - PDF - PNG - PDF_AND_PNG ReportScheduleResponseData: description: The JSON:API data object representing a report schedule. properties: attributes: $ref: "#/components/schemas/ReportScheduleResponseAttributes" id: description: The unique identifier of the report schedule. example: "11111111-2222-3333-4444-555555555555" type: string relationships: $ref: "#/components/schemas/ReportScheduleResponseRelationships" type: $ref: "#/components/schemas/ReportScheduleType" required: - id - type - attributes - relationships type: object ReportScheduleResponseRelationships: description: Relationships for the report schedule. properties: author: $ref: "#/components/schemas/ReportScheduleAuthorRelationship" required: - author type: object ReportScheduleStatus: description: Whether the schedule is currently delivering reports (`active`) or paused (`inactive`). enum: - active - inactive example: active type: string x-enum-varnames: - ACTIVE - INACTIVE ReportScheduleTemplateVariable: description: A dashboard template variable applied when rendering the report. properties: name: description: The name of the template variable. example: env type: string values: description: The selected values for the template variable. example: - "prod" items: description: A single selected template variable value. type: string type: array required: - name - values type: object ReportScheduleToggleRequest: description: Request body for toggling a report schedule. properties: data: $ref: "#/components/schemas/ReportScheduleToggleRequestData" required: - data type: object ReportScheduleToggleRequestAttributes: description: The status to set on the report schedule. properties: status: $ref: "#/components/schemas/ReportScheduleStatus" required: - status type: object ReportScheduleToggleRequestData: description: The JSON:API data object for a report schedule toggle request. properties: attributes: $ref: "#/components/schemas/ReportScheduleToggleRequestAttributes" type: $ref: "#/components/schemas/ReportScheduleType" required: - type - attributes type: object ReportScheduleType: description: JSON:API resource type for report schedules. enum: - schedule example: schedule type: string x-enum-varnames: - SCHEDULE RerouteOnCallPageRequest: description: Full request to reroute an On-Call Page to a different team or user. example: data: attributes: comment: Rerouting to the database team. target: identifier: my-team type: team_handle type: reroute properties: data: $ref: "#/components/schemas/RerouteOnCallPageRequestData" required: - data type: object RerouteOnCallPageRequestData: description: The data for rerouting an On-Call Page, including attributes and resource type. properties: attributes: $ref: "#/components/schemas/RerouteOnCallPageRequestDataAttributes" type: $ref: "#/components/schemas/RerouteOnCallPageRequestDataType" required: - attributes - type type: object RerouteOnCallPageRequestDataAttributes: description: Details about where to reroute the On-Call Page. properties: comment: description: An optional comment explaining why the page is being rerouted. example: Rerouting to the database team. type: string target: $ref: "#/components/schemas/CreatePageRequestDataAttributesTarget" required: - target type: object RerouteOnCallPageRequestDataType: default: reroute description: The type of resource used when rerouting an On-Call Page. enum: - reroute example: reroute type: string x-enum-varnames: - REROUTE ResolveVulnerableSymbolsRequest: description: The top-level request object for resolving vulnerable symbols in a set of packages. properties: data: $ref: "#/components/schemas/ResolveVulnerableSymbolsRequestData" type: object ResolveVulnerableSymbolsRequestData: description: >- The data object in a request to resolve vulnerable symbols, containing the package PURLs and request type. properties: attributes: $ref: "#/components/schemas/ResolveVulnerableSymbolsRequestDataAttributes" id: description: An optional identifier for this request data object. type: string type: $ref: "#/components/schemas/ResolveVulnerableSymbolsRequestDataType" required: - type type: object ResolveVulnerableSymbolsRequestDataAttributes: description: >- The attributes of a request to resolve vulnerable symbols, containing the list of package PURLs to check. properties: purls: description: The list of Package URLs (PURLs) for which to resolve vulnerable symbols. items: description: A Package URL (PURL) identifying a specific package and version. type: string type: array type: object ResolveVulnerableSymbolsRequestDataType: default: resolve-vulnerable-symbols-request description: The type identifier for requests to resolve vulnerable symbols. enum: - resolve-vulnerable-symbols-request example: resolve-vulnerable-symbols-request type: string x-enum-varnames: - RESOLVE_VULNERABLE_SYMBOLS_REQUEST ResolveVulnerableSymbolsResponse: description: The top-level response object returned when resolving vulnerable symbols for a set of packages. properties: data: $ref: "#/components/schemas/ResolveVulnerableSymbolsResponseData" type: object ResolveVulnerableSymbolsResponseData: description: >- The data object in a response for resolving vulnerable symbols, containing the result attributes and response type. properties: attributes: $ref: "#/components/schemas/ResolveVulnerableSymbolsResponseDataAttributes" id: description: The unique identifier for this response data object. type: string type: $ref: "#/components/schemas/ResolveVulnerableSymbolsResponseDataType" required: - type type: object ResolveVulnerableSymbolsResponseDataAttributes: description: The attributes of a response containing resolved vulnerable symbols, organized by package. properties: results: description: The list of resolved vulnerable symbol results, one entry per queried package. items: $ref: "#/components/schemas/ResolveVulnerableSymbolsResponseResults" type: array type: object ResolveVulnerableSymbolsResponseDataType: default: resolve-vulnerable-symbols-response description: The type identifier for responses containing resolved vulnerable symbols. enum: - resolve-vulnerable-symbols-response example: resolve-vulnerable-symbols-response type: string x-enum-varnames: - RESOLVE_VULNERABLE_SYMBOLS_RESPONSE ResolveVulnerableSymbolsResponseResults: description: The result of resolving vulnerable symbols for a specific package, identified by its PURL. properties: purl: description: >- The Package URL (PURL) uniquely identifying the package for which vulnerable symbols are resolved. type: string vulnerable_symbols: description: The list of vulnerable symbol groups found in this package, organized by advisory. items: $ref: "#/components/schemas/ResolveVulnerableSymbolsResponseResultsVulnerableSymbols" type: array type: object ResolveVulnerableSymbolsResponseResultsVulnerableSymbols: description: A collection of vulnerable symbols associated with a specific security advisory. properties: advisory_id: description: The identifier of the security advisory that describes the vulnerability. type: string symbols: description: The list of symbols that are vulnerable according to this advisory. items: $ref: "#/components/schemas/ResolveVulnerableSymbolsResponseResultsVulnerableSymbolsSymbols" type: array type: object ResolveVulnerableSymbolsResponseResultsVulnerableSymbolsSymbols: description: A symbol identified as vulnerable within a dependency, including its name, type, and value. properties: name: description: The name of the vulnerable symbol. type: string type: description: The type classification of the vulnerable symbol (e.g., function, class, variable). type: string value: description: The value or identifier associated with the vulnerable symbol. type: string type: object ResourceFilterAttributes: description: Attributes of a resource filter. example: aws: "123456789": - environment:production - team:devops azure: sub-001: - app:frontend gcp: project-abc: - region:us-central1 properties: cloud_provider: additionalProperties: additionalProperties: items: description: Tag filter in format "key:value" example: environment:production type: string type: array type: object description: A map of cloud provider names (e.g., "aws", "gcp", "azure") to a map of account/resource IDs and their associated tag filters. type: object uuid: description: The UUID of the resource filter. type: string required: - cloud_provider type: object ResourceFilterRequestType: description: Constant string to identify the request type. enum: - csm_resource_filter example: csm_resource_filter type: string x-enum-varnames: - CSM_RESOURCE_FILTER ResponseMetaAttributes: description: Object describing meta attributes of response. properties: page: $ref: "#/components/schemas/Pagination" type: object RestrictionPolicy: description: Restriction policy object. properties: attributes: $ref: "#/components/schemas/RestrictionPolicyAttributes" id: description: The identifier, always equivalent to the value specified in the `resource_id` path parameter. example: "dashboard:abc-def-ghi" type: string type: $ref: "#/components/schemas/RestrictionPolicyType" required: - type - id - attributes type: object RestrictionPolicyAttributes: description: Restriction policy attributes. example: {"bindings": []} properties: bindings: description: An array of bindings. items: $ref: "#/components/schemas/RestrictionPolicyBinding" type: array required: - bindings type: object RestrictionPolicyBinding: description: Specifies which principals are associated with a relation. properties: principals: description: |- An array of principals. A principal is a subject or group of subjects. Each principal is formatted as `type:id`. Supported types: `role`, `team`, `user`, and `org`. The org ID can be obtained through the api/v2/current_user API. The user principal type accepts service account IDs. example: ["role:00000000-0000-1111-0000-000000000000"] items: description: |- Subject or group of subjects. Each principal is formatted as `type:id`. Supported types: `role`, `team`, `user`, and `org`. The org ID can be obtained through the api/v2/current_user API. The user principal type accepts service account IDs. type: string type: array relation: description: The role/level of access. example: editor type: string required: - relation - principals type: object RestrictionPolicyResponse: description: Response containing information about a single restriction policy. properties: data: $ref: "#/components/schemas/RestrictionPolicy" required: - data type: object RestrictionPolicyType: default: restriction_policy description: Restriction policy type. enum: - restriction_policy example: restriction_policy type: string x-enum-varnames: - RESTRICTION_POLICY RestrictionPolicyUpdateRequest: description: Update request for a restriction policy. properties: data: $ref: "#/components/schemas/RestrictionPolicy" required: - data type: object RestrictionQueryAttributes: description: Attributes of the restriction query. properties: created_at: description: Creation time of the restriction query. example: "2020-03-17T21:06:44.000Z" format: date-time readOnly: true type: string last_modifier_email: description: Email of the user who last modified this restriction query. example: "user@example.com" readOnly: true type: string last_modifier_name: description: Name of the user who last modified this restriction query. example: "John Doe" readOnly: true type: string modified_at: description: Time of last restriction query modification. example: "2020-03-17T21:15:15.000Z" format: date-time readOnly: true type: string restriction_query: description: The query that defines the restriction. Only the content matching the query can be returned. example: "env:sandbox" type: string role_count: description: Number of roles associated with this restriction query. example: 3 format: int64 readOnly: true type: integer user_count: description: Number of users associated with this restriction query. example: 5 format: int64 readOnly: true type: integer type: object RestrictionQueryCreateAttributes: description: Attributes of the created restriction query. properties: restriction_query: description: The restriction query. example: "env:sandbox" type: string required: - restriction_query type: object RestrictionQueryCreateData: description: Data related to the creation of a restriction query. properties: attributes: $ref: "#/components/schemas/RestrictionQueryCreateAttributes" type: $ref: "#/components/schemas/LogsRestrictionQueriesType" type: object RestrictionQueryCreatePayload: description: Create a restriction query. properties: data: $ref: "#/components/schemas/RestrictionQueryCreateData" type: object RestrictionQueryListResponse: description: Response containing information about multiple restriction queries. properties: data: description: Array of returned restriction queries. items: $ref: "#/components/schemas/RestrictionQueryWithoutRelationships" type: array type: object RestrictionQueryResponseIncludedItem: description: An object related to a restriction query. oneOf: - $ref: "#/components/schemas/RestrictionQueryRole" RestrictionQueryRole: description: Partial role object. properties: attributes: $ref: "#/components/schemas/RestrictionQueryRoleAttribute" id: description: ID of the role. example: "" type: string type: $ref: "#/components/schemas/RolesType" required: - type - id - attributes type: object RestrictionQueryRoleAttribute: description: Attributes of the role for a restriction query. properties: name: description: The role name. example: "Datadog Admin Role" type: string type: object RestrictionQueryRolesResponse: description: Response containing information about roles attached to a restriction query. properties: data: description: Array of roles. items: $ref: "#/components/schemas/RestrictionQueryRole" type: array type: object RestrictionQueryUpdateAttributes: description: Attributes of the edited restriction query. properties: restriction_query: description: The restriction query. example: "env:sandbox" type: string required: - restriction_query type: object RestrictionQueryUpdateData: description: Data related to the update of a restriction query. properties: attributes: $ref: "#/components/schemas/RestrictionQueryUpdateAttributes" type: $ref: "#/components/schemas/LogsRestrictionQueriesType" type: object RestrictionQueryUpdatePayload: description: Update a restriction query. properties: data: $ref: "#/components/schemas/RestrictionQueryUpdateData" type: object RestrictionQueryWithRelationships: description: Restriction query object returned by the API. properties: attributes: $ref: "#/components/schemas/RestrictionQueryAttributes" id: description: ID of the restriction query. example: "79a0e60a-644a-11ea-ad29-43329f7f58b5" type: string relationships: $ref: "#/components/schemas/UserRelationships" type: $ref: "#/components/schemas/LogsRestrictionQueriesType" type: object RestrictionQueryWithRelationshipsResponse: description: Response containing information about a single restriction query. properties: data: $ref: "#/components/schemas/RestrictionQueryWithRelationships" included: description: Array of objects related to the restriction query. items: $ref: "#/components/schemas/RestrictionQueryResponseIncludedItem" type: array type: object RestrictionQueryWithoutRelationships: description: Restriction query object returned by the API. properties: attributes: $ref: "#/components/schemas/RestrictionQueryAttributes" id: description: ID of the restriction query. example: "79a0e60a-644a-11ea-ad29-43329f7f58b5" type: string type: default: logs_restriction_queries description: Restriction queries type. example: "logs_restriction_queries" readOnly: true type: string type: object RestrictionQueryWithoutRelationshipsResponse: description: Response containing information about a single restriction query. properties: data: $ref: "#/components/schemas/RestrictionQueryWithoutRelationships" type: object RetentionFilter: description: The definition of the retention filter. properties: attributes: $ref: "#/components/schemas/RetentionFilterAttributes" id: description: The ID of the retention filter. example: "7RBOb7dLSYWI01yc3pIH8w" type: string type: $ref: "#/components/schemas/ApmRetentionFilterType" required: - id - type - attributes type: object RetentionFilterAll: description: The definition of the retention filter. properties: attributes: $ref: "#/components/schemas/RetentionFilterAllAttributes" id: description: The ID of the retention filter. example: "7RBOb7dLSYWI01yc3pIH8w" type: string type: $ref: "#/components/schemas/ApmRetentionFilterType" required: - id - type - attributes type: object RetentionFilterAllAttributes: description: The attributes of the retention filter. properties: created_at: description: The creation timestamp of the retention filter. format: int64 type: integer created_by: description: The creator of the retention filter. type: string editable: description: Shows whether the filter can be edited. example: true type: boolean enabled: description: The status of the retention filter (Enabled/Disabled). example: true type: boolean execution_order: description: The execution order of the retention filter. format: int64 type: integer filter: $ref: "#/components/schemas/SpansFilter" filter_type: $ref: "#/components/schemas/RetentionFilterAllType" modified_at: description: The modification timestamp of the retention filter. format: int64 type: integer modified_by: description: The modifier of the retention filter. type: string name: description: The name of the retention filter. example: my retention filter type: string rate: description: |- Sample rate to apply to spans going through this retention filter. A value of 1.0 keeps all spans matching the query. example: 1.0 format: double type: number trace_rate: description: |- Sample rate to apply to traces containing spans going through this retention filter. A value of 1.0 keeps all traces with spans matching the query. example: 1.0 format: double type: number type: object RetentionFilterAllType: default: spans-sampling-processor description: The type of retention filter. enum: - spans-sampling-processor - spans-errors-sampling-processor - spans-appsec-sampling-processor example: spans-sampling-processor type: string x-enum-varnames: - SPANS_SAMPLING_PROCESSOR - SPANS_ERRORS_SAMPLING_PROCESSOR - SPANS_APPSEC_SAMPLING_PROCESSOR RetentionFilterAttributes: description: The attributes of the retention filter. properties: created_at: description: The creation timestamp of the retention filter. format: int64 type: integer created_by: description: The creator of the retention filter. type: string editable: description: Shows whether the filter can be edited. example: true type: boolean enabled: description: The status of the retention filter (Enabled/Disabled). example: true type: boolean execution_order: description: The execution order of the retention filter. format: int64 type: integer filter: $ref: "#/components/schemas/SpansFilter" filter_type: $ref: "#/components/schemas/RetentionFilterType" modified_at: description: The modification timestamp of the retention filter. format: int64 type: integer modified_by: description: The modifier of the retention filter. type: string name: description: The name of the retention filter. example: my retention filter type: string rate: description: |- Sample rate to apply to spans going through this retention filter. A value of 1.0 keeps all spans matching the query. example: 1.0 format: double type: number trace_rate: description: |- Sample rate to apply to traces containing spans going through this retention filter. A value of 1.0 keeps all traces with spans matching the query. example: 1.0 format: double type: number type: object RetentionFilterCreateAttributes: description: The object describing the configuration of the retention filter to create/update. properties: enabled: description: Enable/Disable the retention filter. example: true type: boolean filter: $ref: "#/components/schemas/SpansFilterCreate" filter_type: $ref: "#/components/schemas/RetentionFilterType" name: description: The name of the retention filter. example: my retention filter type: string rate: description: |- Sample rate to apply to spans going through this retention filter. A value of 1.0 keeps all spans matching the query. example: 1.0 format: double type: number trace_rate: description: |- Sample rate to apply to traces containing spans going through this retention filter. A value of 1.0 keeps all traces with spans matching the query. example: 1.0 format: double type: number required: - name - filter - enabled - filter_type - rate type: object RetentionFilterCreateData: description: The body of the retention filter to be created. properties: attributes: $ref: "#/components/schemas/RetentionFilterCreateAttributes" type: $ref: "#/components/schemas/ApmRetentionFilterType" required: - attributes - type type: object RetentionFilterCreateRequest: description: The body of the retention filter to be created. properties: data: $ref: "#/components/schemas/RetentionFilterCreateData" required: - data type: object RetentionFilterCreateResponse: description: The retention filters definition. properties: data: $ref: "#/components/schemas/RetentionFilter" type: object RetentionFilterResponse: description: The retention filters definition. properties: data: $ref: "#/components/schemas/RetentionFilterAll" type: object RetentionFilterType: default: spans-sampling-processor description: The type of retention filter. The value should always be spans-sampling-processor. enum: - spans-sampling-processor example: spans-sampling-processor type: string x-enum-varnames: - SPANS_SAMPLING_PROCESSOR RetentionFilterUpdateAttributes: description: The object describing the configuration of the retention filter to create/update. properties: enabled: description: Enable/Disable the retention filter. example: true type: boolean filter: $ref: "#/components/schemas/SpansFilterCreate" filter_type: $ref: "#/components/schemas/RetentionFilterAllType" name: description: The name of the retention filter. example: my retention filter type: string rate: description: |- Sample rate to apply to spans going through this retention filter. A value of 1.0 keeps all spans matching the query. example: 1.0 format: double type: number trace_rate: description: |- Sample rate to apply to traces containing spans going through this retention filter. A value of 1.0 keeps all traces with spans matching the query. example: 1.0 format: double type: number required: - name - filter - enabled - filter_type - rate type: object RetentionFilterUpdateData: description: The body of the retention filter to be updated. properties: attributes: $ref: "#/components/schemas/RetentionFilterUpdateAttributes" id: description: The ID of the retention filter. example: "retention-filter-id" type: string type: $ref: "#/components/schemas/ApmRetentionFilterType" required: - id - attributes - type type: object RetentionFilterUpdateRequest: description: The body of the retention filter to be updated. properties: data: $ref: "#/components/schemas/RetentionFilterUpdateData" required: - data type: object RetentionFilterWithoutAttributes: description: The retention filter object . properties: id: description: The ID of the retention filter. example: "7RBOb7dLSYWI01yc3pIH8w" type: string type: $ref: "#/components/schemas/ApmRetentionFilterType" required: - id - type type: object RetentionFiltersResponse: description: An ordered list of retention filters. properties: data: description: A list of retention filters objects. items: $ref: "#/components/schemas/RetentionFilterAll" type: array required: - data type: object RetryStrategy: additionalProperties: false description: The definition of `RetryStrategy` object. properties: kind: $ref: "#/components/schemas/RetryStrategyKind" linear: $ref: "#/components/schemas/RetryStrategyLinear" required: - kind - linear type: object RetryStrategyKind: description: The definition of `RetryStrategyKind` object. enum: - RETRY_STRATEGY_LINEAR example: RETRY_STRATEGY_LINEAR type: string x-enum-varnames: - RETRY_STRATEGY_LINEAR RetryStrategyLinear: additionalProperties: false description: The definition of `RetryStrategyLinear` object. properties: interval: description: The `RetryStrategyLinear` `interval`. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s example: "" pattern: ^[1-9][0-9]*s$ type: string maxRetries: description: The `RetryStrategyLinear` `maxRetries`. example: 0 format: int32 maximum: 2147483647 minimum: 0 type: integer required: - interval - maxRetries type: object RevertCustomRuleRevisionDataType: description: Request type enum: [revert_custom_rule_revision_request] type: string x-enum-varnames: - REVERT_CUSTOM_RULE_REVISION_REQUEST RevertCustomRuleRevisionRequest: description: Request body for reverting a custom rule to a previous revision. properties: data: $ref: "#/components/schemas/RevertCustomRuleRevisionRequestData" type: object RevertCustomRuleRevisionRequestData: description: Data object for a request to revert a custom rule to a previous revision. properties: attributes: $ref: "#/components/schemas/RevertCustomRuleRevisionRequestDataAttributes" id: description: Request identifier type: string type: $ref: "#/components/schemas/RevertCustomRuleRevisionDataType" type: object RevertCustomRuleRevisionRequestDataAttributes: description: Attributes specifying the current and target revision IDs for a revert operation. properties: currentRevision: description: Current revision ID type: string revertToRevision: description: Target revision ID to revert to type: string type: object Role: description: Role object returned by the API. properties: attributes: $ref: "#/components/schemas/RoleAttributes" id: description: The unique identifier of the role. type: string relationships: $ref: "#/components/schemas/RoleResponseRelationships" type: $ref: "#/components/schemas/RolesType" required: - type type: object RoleAttributes: additionalProperties: {} description: Attributes of the role. properties: created_at: description: Creation time of the role. format: date-time readOnly: true type: string modified_at: description: Time of last role modification. format: date-time readOnly: true type: string name: description: The name of the role. The name is neither unique nor a stable identifier of the role. type: string receives_permissions_from: description: |- The managed role from which this role automatically inherits new permissions. Specify one of the following: "Datadog Admin Role", "Datadog Standard Role", or "Datadog Read Only Role". If empty or not specified, the role does not automatically inherit permissions from any managed role. items: description: Name of a managed role to inherit permissions from. type: string type: array user_count: description: Number of users with that role. format: int64 readOnly: true type: integer type: object RoleClone: description: Data for the clone role request. properties: attributes: $ref: "#/components/schemas/RoleCloneAttributes" type: $ref: "#/components/schemas/RolesType" required: - type - attributes type: object RoleCloneAttributes: description: Attributes required to create a new role by cloning an existing one. properties: name: description: Name of the new role that is cloned. example: "cloned-role" type: string receives_permissions_from: description: |- The managed role from which this role automatically inherits new permissions. Specify one of the following: "Datadog Admin Role", "Datadog Standard Role", or "Datadog Read Only Role". If empty or not specified, the role does not automatically inherit permissions from any managed role. items: description: Name of a managed role to inherit permissions from. type: string type: array required: - name type: object RoleCloneRequest: description: Request to create a role by cloning an existing role. properties: data: $ref: "#/components/schemas/RoleClone" required: - data type: object RoleCreateAttributes: description: Attributes of the created role. properties: created_at: description: Creation time of the role. format: date-time readOnly: true type: string default_permissions_opt_out: description: |- Whether to exclude restricted default permissions from this role. Restricted default permissions are automatically assigned to every role by default. Set this field to `true` to exclude them. Some of these permissions can only be excluded after Minimal Access Roles is enabled for the organization. type: boolean modified_at: description: Time of last role modification. format: date-time readOnly: true type: string name: description: Name of the role. example: developers type: string receives_permissions_from: description: |- The managed role from which this role automatically inherits new permissions. Specify one of the following: "Datadog Admin Role", "Datadog Standard Role", or "Datadog Read Only Role". If empty or not specified, the role does not automatically inherit permissions from any managed role. items: description: Name of a managed role to inherit permissions from. type: string type: array required: - name type: object RoleCreateData: description: Data related to the creation of a role. properties: attributes: $ref: "#/components/schemas/RoleCreateAttributes" relationships: $ref: "#/components/schemas/RoleRelationships" type: $ref: "#/components/schemas/RolesType" required: - attributes type: object RoleCreateRequest: description: Create a role. properties: data: $ref: "#/components/schemas/RoleCreateData" required: - data type: object RoleCreateResponse: description: Response containing information about a created role. properties: data: $ref: "#/components/schemas/RoleCreateResponseData" type: object RoleCreateResponseData: description: Role object returned by the API. properties: attributes: $ref: "#/components/schemas/RoleCreateAttributes" id: description: The unique identifier of the role. type: string relationships: $ref: "#/components/schemas/RoleResponseRelationships" type: $ref: "#/components/schemas/RolesType" required: - type type: object RoleRelationships: description: Relationships of the role object. properties: permissions: $ref: "#/components/schemas/RelationshipToPermissions" type: object RoleResponse: description: Response containing information about a single role. properties: data: $ref: "#/components/schemas/Role" type: object RoleResponseRelationships: description: Relationships of the role object returned by the API. properties: permissions: $ref: "#/components/schemas/RelationshipToPermissions" type: object RoleTemplateArray: description: The definition of `RoleTemplateArray` object. properties: data: description: The `RoleTemplateArray` `data`. items: $ref: "#/components/schemas/RoleTemplateData" type: array required: - data type: object RoleTemplateData: description: The definition of `RoleTemplateData` object. properties: attributes: $ref: "#/components/schemas/RoleTemplateDataAttributes" id: description: The `RoleTemplateData` `id`. type: string relationships: $ref: "#/components/schemas/RoleResponseRelationships" type: $ref: "#/components/schemas/RoleTemplateDataType" required: - type type: object RoleTemplateDataAttributes: description: The definition of `RoleTemplateDataAttributes` object. properties: description: description: The `attributes` `description`. type: string name: description: The `attributes` `name`. type: string type: object RoleTemplateDataType: default: roles description: Roles resource type. enum: - roles example: roles type: string x-enum-varnames: - ROLES RoleUpdateAttributes: description: Attributes of the role. properties: created_at: description: Creation time of the role. format: date-time readOnly: true type: string default_permissions_opt_out: description: |- Whether to exclude restricted default permissions from this role. Restricted default permissions are automatically assigned to every role by default. Set this field to `true` to exclude them. Some of these permissions can only be excluded after Minimal Access Roles is enabled for the organization. type: boolean modified_at: description: Time of last role modification. format: date-time readOnly: true type: string name: description: Name of the role. type: string receives_permissions_from: description: |- The managed role from which this role automatically inherits new permissions. Specify one of the following: "Datadog Admin Role", "Datadog Standard Role", or "Datadog Read Only Role". If empty or not specified, the role does not automatically inherit permissions from any managed role. items: description: Name of a managed role to inherit permissions from. type: string type: array team_count: description: Number of teams with that role. format: int64 readOnly: true type: integer user_count: description: The user count. format: int32 maximum: 2147483647 type: integer type: object RoleUpdateData: description: Data related to the update of a role. properties: attributes: $ref: "#/components/schemas/RoleUpdateAttributes" id: description: The unique identifier of the role. example: "00000000-0000-1111-0000-000000000000" type: string relationships: $ref: "#/components/schemas/RoleRelationships" type: $ref: "#/components/schemas/RolesType" required: - attributes - type - id type: object RoleUpdateRequest: description: Update a role. properties: data: $ref: "#/components/schemas/RoleUpdateData" required: - data type: object RoleUpdateResponse: description: Response containing information about an updated role. properties: data: $ref: "#/components/schemas/RoleUpdateResponseData" type: object RoleUpdateResponseData: description: Role object returned by the API. properties: attributes: $ref: "#/components/schemas/RoleUpdateAttributes" id: description: The unique identifier of the role. type: string relationships: $ref: "#/components/schemas/RoleResponseRelationships" type: $ref: "#/components/schemas/RolesType" required: - type type: object RolesResponse: description: Response containing information about multiple roles. properties: data: description: Array of returned roles. items: $ref: "#/components/schemas/Role" type: array meta: $ref: "#/components/schemas/ResponseMetaAttributes" type: object RolesSort: default: name description: Sorting options for roles. enum: - name - -name - modified_at - -modified_at - user_count - -user_count type: string x-enum-varnames: - NAME_ASCENDING - NAME_DESCENDING - MODIFIED_AT_ASCENDING - MODIFIED_AT_DESCENDING - USER_COUNT_ASCENDING - USER_COUNT_DESCENDING RolesType: default: roles description: Roles type. enum: - roles example: roles type: string x-enum-varnames: - ROLES RolloutOptions: description: Applied progression options for a progressive rollout. properties: autostart: description: Whether the schedule starts automatically. example: false type: boolean selection_interval_ms: description: Interval in milliseconds for uniform interval strategies. example: 3600000 format: int64 type: integer strategy: $ref: "#/components/schemas/RolloutStrategy" required: - strategy - autostart - selection_interval_ms type: object RolloutOptionsRequest: description: Rollout options request payload. properties: autostart: description: Whether the schedule should begin automatically. example: false nullable: true type: boolean selection_interval_ms: description: Interval in milliseconds for uniform interval strategies. example: 3600000 format: int64 type: integer strategy: $ref: "#/components/schemas/RolloutStrategy" required: - strategy type: object RolloutStrategy: description: The progression strategy used by a progressive rollout. enum: - UNIFORM_INTERVALS - NO_ROLLOUT example: "UNIFORM_INTERVALS" type: string x-enum-varnames: - UNIFORM_INTERVALS - NO_ROLLOUT RoutingRule: description: Represents a routing rule, including its attributes, relationships, and unique identifier. properties: attributes: $ref: "#/components/schemas/RoutingRuleAttributes" id: description: Specifies the unique identifier of this routing rule. type: string relationships: $ref: "#/components/schemas/RoutingRuleRelationships" type: $ref: "#/components/schemas/RoutingRuleType" required: - type type: object RoutingRuleAction: description: "Defines an action that is executed when a routing rule matches certain criteria." oneOf: - $ref: "#/components/schemas/SendSlackMessageAction" - $ref: "#/components/schemas/SendTeamsMessageAction" - $ref: "#/components/schemas/TriggerWorkflowAutomationAction" - $ref: "#/components/schemas/RoutingRuleEscalationPolicyAction" - $ref: "#/components/schemas/RoutingRuleRerouteToTeamAction" RoutingRuleAttributes: description: Defines the configurable attributes of a routing rule, such as actions, query, time restriction, and urgency. properties: actions: description: Specifies the list of actions to perform when the routing rule matches. items: $ref: "#/components/schemas/RoutingRuleAction" type: array query: description: Defines the query or condition that triggers this routing rule. type: string time_restriction: $ref: "#/components/schemas/TimeRestrictions" nullable: true urgency: $ref: "#/components/schemas/Urgency" type: object RoutingRuleEscalationPolicyAction: description: "Triggers an escalation policy." properties: ack_timeout_minutes: description: "The number of minutes before an acknowledged Page is re-triggered." example: 30 format: int64 type: integer policy_id: description: "The ID of the escalation policy to route to." example: "00000000-0000-0000-0000-000000000000" type: string support_hours: $ref: "#/components/schemas/RoutingRuleEscalationPolicyActionSupportHours" type: $ref: "#/components/schemas/RoutingRuleEscalationPolicyActionType" urgency: $ref: "#/components/schemas/Urgency" required: - type - policy_id type: object RoutingRuleEscalationPolicyActionSupportHours: description: "Support hours during which the escalation policy will be executed. Outside of these hours, the escalation policy will be on hold and triggered once the next support hours window starts. This is mutually exclusive with the top-level `time_restriction` field on the routing rule." properties: restrictions: description: "The list of support hours time windows." items: $ref: "#/components/schemas/TimeRestriction" type: array time_zone: description: "The time zone in which the support hours are expressed." example: "" type: string required: - time_zone type: object RoutingRuleEscalationPolicyActionType: default: escalation_policy description: "Indicates that the action pages an escalation policy. This action can be set once per routing rule item, and is mutually exclusive with the top-level `policy_id` field on the routing rule." enum: - escalation_policy example: escalation_policy type: string x-enum-varnames: - ESCALATION_POLICY RoutingRuleRelationships: description: Specifies relationships for a routing rule, linking to associated policy resources. properties: policy: $ref: "#/components/schemas/RoutingRuleRelationshipsPolicy" type: object RoutingRuleRelationshipsPolicy: description: Defines the relationship that links a routing rule to a policy. properties: data: $ref: "#/components/schemas/RoutingRuleRelationshipsPolicyData" nullable: true type: object RoutingRuleRelationshipsPolicyData: description: Represents the policy data reference, containing the policy's ID and resource type. properties: id: description: Specifies the unique identifier of the policy. example: "" type: string type: $ref: "#/components/schemas/RoutingRuleRelationshipsPolicyDataType" required: - type - id type: object RoutingRuleRelationshipsPolicyDataType: default: policies description: "Indicates that the resource is of type `policies`." enum: - policies example: policies type: string x-enum-varnames: - POLICIES RoutingRuleRerouteToTeamAction: description: "Reroutes the Page to another team, which then evaluates it against its own routing rules. Each routing rule can include this action only once. It can be combined only with `send_slack_message` and `send_teams_message` actions. It can't be used with `escalation_policy` or `workflow` actions, or when the routing rule sets `policy_id`." properties: destination_team_id: description: "The ID of the team to reroute the Page to." example: "00000000-0000-0000-0000-000000000000" format: uuid type: string type: $ref: "#/components/schemas/RoutingRuleRerouteToTeamActionType" required: - type - destination_team_id type: object RoutingRuleRerouteToTeamActionType: default: reroute_to_team description: "Indicates that the action reroutes the Page to another team's routing rules." enum: - reroute_to_team example: reroute_to_team type: string x-enum-varnames: - REROUTE_TO_TEAM RoutingRuleType: default: team_routing_rules description: Team routing rules resource type. enum: - team_routing_rules example: team_routing_rules type: string x-enum-varnames: - TEAM_ROUTING_RULES RuleAttributes: description: Details of a rule. properties: category: deprecated: true description: The scorecard name to which this rule must belong. type: string created_at: description: Creation time of the rule outcome. format: date-time type: string custom: description: Defines if the rule is a custom rule. type: boolean description: description: Explanation of the rule. type: string enabled: description: If enabled, the rule is calculated as part of the score. example: true type: boolean level: $ref: "#/components/schemas/RuleLevel" modified_at: description: Time of the last rule outcome modification. format: date-time type: string name: description: Name of the rule. example: Team Defined type: string owner: description: Owner of the rule. type: string scope_query: description: A query to filter which entities this rule applies to. example: "kind:service" type: string scorecard_name: description: The scorecard name to which this rule must belong. example: Deployments automated via Deployment Trains type: string type: object RuleAttributesRequest: description: Attributes for creating or updating a rule. Server-managed fields (created_at, modified_at, custom) are excluded. properties: description: description: Explanation of the rule. type: string enabled: description: If enabled, the rule is calculated as part of the score. example: true type: boolean level: $ref: "#/components/schemas/RuleLevel" name: description: Name of the rule. example: Team Defined type: string owner: description: Owner of the rule. type: string scope_query: description: A query to filter which entities this rule applies to. example: "kind:service" type: string scorecard_name: description: The scorecard name to which this rule must belong. example: Deployments automated via Deployment Trains type: string type: object RuleBasedViewAttributes: description: Attributes of the rule-based view. properties: count: description: Total number of rules in the view. example: 1 format: int64 type: integer rules: $ref: "#/components/schemas/RuleBasedViewRules" required: - count - rules type: object RuleBasedViewComplianceFramework: description: Compliance framework mapping for a rule. properties: control: description: Identifier of the control inside the requirement. example: 164.308-a-4-i type: string framework: description: Handle of the compliance framework. example: hipaa type: string is_default: description: Whether the framework is a Datadog default framework. `true` indicates a Datadog framework and `false` indicates a custom framework. example: true type: boolean message: description: Optional message describing the framework mapping for the rule. example: "" type: string requirement: description: Name of the requirement that contains the control. example: Information-Access-Management type: string version: description: Version of the compliance framework. example: "1" type: string type: object RuleBasedViewComplianceFrameworks: description: List of compliance framework mappings associated with the rule. items: $ref: "#/components/schemas/RuleBasedViewComplianceFramework" type: array RuleBasedViewData: description: Data envelope for the rule-based view response. properties: attributes: $ref: "#/components/schemas/RuleBasedViewAttributes" id: description: Unique identifier of the rule-based view document. example: JSONAPI_USELESS_ID type: string type: $ref: "#/components/schemas/RuleBasedViewType" required: - attributes - id - type type: object RuleBasedViewResourceAttributes: description: List of resource attribute names exposed by the rule. example: - instance_id items: description: Name of a resource attribute exposed by the rule. example: instance_id type: string type: array RuleBasedViewResponse: description: Response containing an aggregated view of compliance rules with their finding statistics. properties: data: $ref: "#/components/schemas/RuleBasedViewData" required: - data type: object RuleBasedViewRule: description: A compliance rule along with its evaluation statistics and framework mappings. properties: compliance_frameworks: $ref: "#/components/schemas/RuleBasedViewComplianceFrameworks" enabled: description: Whether the rule is enabled. example: true type: boolean id: description: Unique identifier of the rule. example: qjx-udx-xo8 type: string name: description: Human-readable name of the rule. example: IAM roles should not allow untrusted GitHub Actions to assume them type: string resourceAttributes: $ref: "#/components/schemas/RuleBasedViewResourceAttributes" resourceCategory: description: Resource category targeted by the rule. example: identity type: string resourceType: description: Resource type targeted by the rule. example: aws_iam_role type: string stats: $ref: "#/components/schemas/RuleBasedViewRuleStats" status: description: Severity associated with the rule (for example, `info`, `low`, `medium`, `high`, or `critical`). example: critical type: string tags: $ref: "#/components/schemas/RuleBasedViewRuleTags" type: $ref: "#/components/schemas/RuleBasedViewRuleCategory" required: - compliance_frameworks - enabled - id - name - resourceAttributes - resourceCategory - resourceType - stats - status - tags - type type: object RuleBasedViewRuleCategory: description: The category of the security rule. enum: - cloud_configuration - infrastructure_configuration - api_security example: cloud_configuration type: string x-enum-varnames: - CLOUD_CONFIGURATION - INFRASTRUCTURE_CONFIGURATION - API_SECURITY RuleBasedViewRuleStats: description: Counts of findings for the rule, grouped by their evaluation status. properties: fail: description: Number of findings that failed evaluation. example: 0 format: int64 type: integer muted: description: Number of findings that have been muted. example: 0 format: int64 type: integer pass: description: Number of findings that passed evaluation. example: 3 format: int64 type: integer required: - fail - pass - muted type: object RuleBasedViewRuleTags: description: List of tags attached to the rule. example: - security:compliance items: description: A tag attached to the rule. example: security:compliance type: string type: array RuleBasedViewRules: description: List of rules in the rule-based view. items: $ref: "#/components/schemas/RuleBasedViewRule" type: array RuleBasedViewType: default: rule_based_view description: The type of the resource. The value should always be `rule_based_view`. enum: - rule_based_view example: rule_based_view type: string x-enum-varnames: - RULE_BASED_VIEW RuleId: description: The unique ID for a scorecard rule. example: q8MQxk8TCqrHnWkx type: string RuleLevel: description: The maturity level of the rule (1, 2, or 3). example: 2 format: int32 maximum: 3 minimum: 1 type: integer RuleName: description: Name of the notification rule. example: Rule 1 type: string RuleOutcomeRelationships: description: The JSON:API relationship to a scorecard rule. properties: rule: $ref: "#/components/schemas/RelationshipToOutcome" type: object RuleSeverity: description: Severity of a security rule. enum: - critical - high - medium - low - unknown - info example: critical type: string x-enum-varnames: - CRITICAL - HIGH - MEDIUM - LOW - UNKNOWN - INFO RuleType: default: rule description: The JSON:API type for scorecard rules. enum: - rule example: rule type: string x-enum-varnames: - RULE RuleTypes: description: Security rule types used as filters in security rules. example: [misconfiguration, attack_path] items: $ref: "#/components/schemas/RuleTypesItems" type: array RuleTypesItems: description: |- Security rule type which can be used in security rules. Signal-based notification rules can filter signals based on rule types application_security, log_detection, workload_security, signal_correlation, cloud_configuration and infrastructure_configuration. Vulnerability-based notification rules can filter vulnerabilities based on rule types application_code_vulnerability, application_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration, api_security, host_vulnerability, iac_misconfiguration, sast_vulnerability, secret_vulnerability, workload_activity, sensitive_data and serverless_function_code_vulnerability. enum: - application_security - log_detection - workload_security - signal_correlation - cloud_configuration - infrastructure_configuration - application_code_vulnerability - application_library_vulnerability - attack_path - container_image_vulnerability - identity_risk - misconfiguration - api_security - host_vulnerability - iac_misconfiguration - sast_vulnerability - secret_vulnerability - workload_activity - sensitive_data - serverless_function_code_vulnerability example: log_detection type: string x-enum-varnames: - APPLICATION_SECURITY - LOG_DETECTION - WORKLOAD_SECURITY - SIGNAL_CORRELATION - CLOUD_CONFIGURATION - INFRASTRUCTURE_CONFIGURATION - APPLICATION_CODE_VULNERABILITY - APPLICATION_LIBRARY_VULNERABILITY - ATTACK_PATH - CONTAINER_IMAGE_VULNERABILITY - IDENTITY_RISK - MISCONFIGURATION - API_SECURITY - HOST_VULNERABILITY - IAC_MISCONFIGURATION - SAST_VULNERABILITY - SECRET_VULNERABILITY - WORKLOAD_ACTIVITY - SENSITIVE_DATA - SERVERLESS_FUNCTION_CODE_VULNERABILITY RuleUser: description: User creating or modifying a rule. properties: handle: description: The user handle. example: john.doe@domain.com type: string name: description: The user name. example: John Doe type: string type: object RuleVersionHistory: description: Response object containing the version history of a rule. properties: count: description: The number of rule versions. format: int32 maximum: 2147483647 type: integer data: additionalProperties: $ref: "#/components/schemas/RuleVersions" description: A rule version with a list of updates. description: The `RuleVersionHistory` `data`. type: object type: object RuleVersions: description: A rule version with a list of updates. properties: changes: description: A list of changes. items: $ref: "#/components/schemas/VersionHistoryUpdate" type: array rule: $ref: "#/components/schemas/SecurityMonitoringRuleResponse" type: object RulesValidateQueryRequest: description: The definition of `RulesValidateQueryRequest` object. example: data: attributes: Query: example:query AND test:true type: validate_query properties: data: $ref: "#/components/schemas/RulesValidateQueryRequestData" type: object RulesValidateQueryRequestData: description: The definition of `RulesValidateQueryRequestData` object. properties: attributes: $ref: "#/components/schemas/RulesValidateQueryRequestDataAttributes" id: description: The `RulesValidateQueryRequestData` `id`. type: string type: $ref: "#/components/schemas/RulesValidateQueryRequestDataType" required: - type type: object RulesValidateQueryRequestDataAttributes: description: The definition of `RulesValidateQueryRequestDataAttributes` object. properties: Query: description: The `attributes` `Query`. example: "" type: string required: - Query type: object RulesValidateQueryRequestDataType: default: validate_query description: Validate query resource type. enum: - validate_query example: validate_query type: string x-enum-varnames: - VALIDATE_QUERY RulesValidateQueryResponse: description: The definition of `RulesValidateQueryResponse` object. example: data: attributes: Canonical: canonical query representation type: validate_response properties: data: $ref: "#/components/schemas/RulesValidateQueryResponseData" type: object RulesValidateQueryResponseData: description: The definition of `RulesValidateQueryResponseData` object. properties: attributes: $ref: "#/components/schemas/RulesValidateQueryResponseDataAttributes" id: description: The `RulesValidateQueryResponseData` `id`. type: string type: $ref: "#/components/schemas/RulesValidateQueryResponseDataType" required: - type type: object RulesValidateQueryResponseDataAttributes: description: The definition of `RulesValidateQueryResponseDataAttributes` object. properties: Canonical: description: The `attributes` `Canonical`. example: "" type: string required: - Canonical type: object RulesValidateQueryResponseDataType: default: validate_response description: Validate response resource type. enum: - validate_response example: validate_response type: string x-enum-varnames: - VALIDATE_RESPONSE RulesetItemMetadata: additionalProperties: type: string description: The `items` `metadata`. nullable: true type: object RulesetResp: description: The definition of `RulesetResp` object. example: data: attributes: created: enabled: true last_modified_user_uuid: "" modified: name: Example Ruleset position: 0 rules: - enabled: false mapping: metadata: name: RC test rule edited1 query: addition: key: abc value: ww case_insensitivity: false if_tag_exists: do_not_apply query: billingcurrency:"USD" AND account_name:"SZA96462" AND billingcurrency:"USD" reference_table: - enabled: true mapping: destination_key: h if_tag_exists: do_not_apply source_keys: - accountname - accountownerid metadata: name: rule with empty source key query: reference_table: - enabled: true mapping: metadata: name: New table rule with new UI query: reference_table: case_insensitivity: true field_pairs: - input_column: status_type output_key: status - input_column: status_description output_key: dess if_tag_exists: append source_keys: - http_status - status_description table_name: http_status_codes version: 1 id: "12345" type: ruleset properties: data: $ref: "#/components/schemas/RulesetRespData" type: object RulesetRespArray: description: The definition of `RulesetRespArray` object. example: data: - attributes: created: enabled: true last_modified_user_uuid: "" modified: name: Production Cost Allocation Rules position: 0 rules: - enabled: true mapping: metadata: name: AWS Production Account Tagging query: addition: key: environment value: production case_insensitivity: false if_tag_exists: do_not_apply query: billingcurrency:"USD" AND account_name:"prod-account" reference_table: - enabled: true mapping: destination_key: team_owner if_tag_exists: do_not_apply source_keys: - account_name - service metadata: name: Team Mapping Rule query: reference_table: - enabled: true mapping: metadata: name: New table rule with new UI query: reference_table: case_insensitivity: true field_pairs: - input_column: status_type output_key: status - input_column: status_description output_key: dess if_tag_exists: append source_keys: - http_status - status_description table_name: http_status_codes version: 2 id: "55ef2385-9ae1-4410-90c4-5ac1b60fec10" type: ruleset - attributes: created: enabled: true last_modified_user_uuid: "" modified: name: Development Environment Rules position: 0 rules: - enabled: true mapping: metadata: name: Dev Account Cost Center query: addition: key: cost_center value: engineering case_insensitivity: true if_tag_exists: do_not_apply query: account_name:"dev-*" reference_table: version: 1 id: "a7b8c9d0-1234-5678-9abc-def012345678" type: ruleset properties: data: description: The `RulesetRespArray` `data`. items: $ref: "#/components/schemas/RulesetRespData" type: array required: - data type: object RulesetRespData: description: The definition of `RulesetRespData` object. properties: attributes: $ref: "#/components/schemas/RulesetRespDataAttributes" id: description: The `RulesetRespData` `id`. type: string type: $ref: "#/components/schemas/RulesetRespDataType" required: - type type: object RulesetRespDataAttributes: description: The definition of `RulesetRespDataAttributes` object. properties: created: $ref: "#/components/schemas/RulesetRespDataAttributesCreated" enabled: description: The `attributes` `enabled`. example: false type: boolean last_modified_user_uuid: description: The `attributes` `last_modified_user_uuid`. example: "" type: string modified: $ref: "#/components/schemas/RulesetRespDataAttributesModified" name: description: The `attributes` `name`. example: "" type: string position: description: The `attributes` `position`. example: 0 format: int32 maximum: 2147483647 type: integer processing_status: description: The `attributes` `processing_status`. example: "" type: string rules: description: The `attributes` `rules`. items: $ref: "#/components/schemas/RulesetRespDataAttributesRulesItems" type: array version: description: The `attributes` `version`. example: 0 format: int64 type: integer required: - created - enabled - last_modified_user_uuid - modified - name - position - rules - version type: object RulesetRespDataAttributesCreated: description: The definition of `RulesetRespDataAttributesCreated` object. properties: nanos: description: The `created` `nanos`. format: int32 maximum: 2147483647 type: integer seconds: description: The `created` `seconds`. format: int64 type: integer type: object RulesetRespDataAttributesModified: description: The definition of `RulesetRespDataAttributesModified` object. properties: nanos: description: The `modified` `nanos`. format: int32 maximum: 2147483647 type: integer seconds: description: The `modified` `seconds`. format: int64 type: integer type: object RulesetRespDataAttributesRulesItems: description: The definition of `RulesetRespDataAttributesRulesItems` object. properties: enabled: description: The `items` `enabled`. example: false type: boolean mapping: $ref: "#/components/schemas/DataAttributesRulesItemsMapping" metadata: $ref: "#/components/schemas/RulesetItemMetadata" name: description: The `items` `name`. example: "" type: string query: $ref: "#/components/schemas/RulesetRespDataAttributesRulesItemsQuery" reference_table: $ref: "#/components/schemas/RulesetRespDataAttributesRulesItemsReferenceTable" required: - enabled - name type: object RulesetRespDataAttributesRulesItemsQuery: description: The definition of `RulesetRespDataAttributesRulesItemsQuery` object. nullable: true properties: addition: $ref: "#/components/schemas/RulesetRespDataAttributesRulesItemsQueryAddition" case_insensitivity: description: The `query` `case_insensitivity`. type: boolean if_not_exists: deprecated: true description: Deprecated. Use `if_tag_exists` instead. The `query` `if_not_exists`. type: boolean if_tag_exists: $ref: "#/components/schemas/DataAttributesRulesItemsIfTagExists" query: description: The `query` `query`. example: "" type: string required: - addition - query type: object RulesetRespDataAttributesRulesItemsQueryAddition: description: The definition of `RulesetRespDataAttributesRulesItemsQueryAddition` object. nullable: true properties: key: description: The `addition` `key`. example: "" type: string value: description: The `addition` `value`. example: "" type: string required: - key - value type: object RulesetRespDataAttributesRulesItemsReferenceTable: description: The definition of `RulesetRespDataAttributesRulesItemsReferenceTable` object. nullable: true properties: case_insensitivity: description: The `reference_table` `case_insensitivity`. type: boolean field_pairs: description: The `reference_table` `field_pairs`. items: $ref: "#/components/schemas/RulesetRespDataAttributesRulesItemsReferenceTableFieldPairsItems" type: array if_not_exists: deprecated: true description: Deprecated. Use `if_tag_exists` instead. The `reference_table` `if_not_exists`. type: boolean if_tag_exists: $ref: "#/components/schemas/DataAttributesRulesItemsIfTagExists" source_keys: description: The `reference_table` `source_keys`. example: - "" items: description: A source key for the reference table lookup. type: string type: array table_name: description: The `reference_table` `table_name`. example: "" type: string required: - field_pairs - source_keys - table_name type: object RulesetRespDataAttributesRulesItemsReferenceTableFieldPairsItems: description: The definition of `RulesetRespDataAttributesRulesItemsReferenceTableFieldPairsItems` object. properties: input_column: description: The `items` `input_column`. example: "" type: string output_key: description: The `items` `output_key`. example: "" type: string required: - input_column - output_key type: object RulesetRespDataType: default: ruleset description: Ruleset resource type. enum: - ruleset example: ruleset type: string x-enum-varnames: - RULESET RulesetStatusRespArray: description: Processing statuses for all tag pipeline rulesets in the specified organization. example: data: - attributes: processing_status: processing id: 55ef2385-9ae1-4410-90c4-5ac1b60fec10 type: ruleset_status - attributes: processing_status: done id: a7b8c9d0-1234-5678-9abc-def012345678 type: ruleset_status properties: data: description: Processing status for a tag pipeline ruleset. items: $ref: "#/components/schemas/RulesetStatusRespData" type: array required: - data type: object RulesetStatusRespData: description: Processing status for a tag pipeline ruleset. properties: attributes: $ref: "#/components/schemas/RulesetStatusRespDataAttributes" id: description: The unique identifier of the ruleset. example: 55ef2385-9ae1-4410-90c4-5ac1b60fec10 type: string type: $ref: "#/components/schemas/RulesetStatusRespDataType" required: - id - type - attributes type: object RulesetStatusRespDataAttributes: description: Processing status for a tag pipeline ruleset. properties: processing_status: description: The processing status of the ruleset. example: processing type: string required: - processing_status type: object RulesetStatusRespDataType: default: ruleset_status description: Ruleset status resource type. enum: - ruleset_status example: ruleset_status type: string x-enum-varnames: - RULESET_STATUS RumArchiveConfig: description: JSON:API resource. properties: attributes: $ref: "#/components/schemas/RumArchiveConfigAttributes" id: description: Resource identifier. example: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 type: string type: $ref: "#/components/schemas/RumArchiveConfigType" required: - id - type - attributes type: object RumArchiveConfigAttributes: description: Archive configuration. properties: enabled: description: Whether archiving is enabled. example: true type: boolean org_id: description: Organization ID. example: 123 format: int64 type: integer retention_days: description: >- Configured retention in days; omitted when unset. When archiving is enabled, this is 30, 90, or 180. example: 90 format: int32 maximum: 180 type: integer updated_at: description: Last update time. example: "2026-09-21T12:00:00Z" format: date-time type: string updated_by: description: Handle of the user who last updated the configuration. example: user@example.com type: string required: - org_id - enabled type: object RumArchiveConfigListResponse: description: JSON:API document. properties: data: description: Configurations in page order. items: $ref: "#/components/schemas/RumArchiveConfig" type: array meta: $ref: "#/components/schemas/RumArchiveConfigMeta" required: - data - meta type: object RumArchiveConfigMeta: description: Pagination metadata. properties: page: $ref: "#/components/schemas/RumArchiveConfigPage" required: - page type: object RumArchiveConfigPage: description: Page information. properties: total_filtered_count: description: Total configurations for the organization. example: 0 format: int64 minimum: 0 type: integer required: - total_filtered_count type: object RumArchiveConfigResponse: description: JSON:API document. properties: data: $ref: "#/components/schemas/RumArchiveConfig" required: - data type: object RumArchiveConfigType: description: JSON:API resource type. enum: - rum_archive_config example: rum_archive_config type: string x-enum-varnames: - RUM_ARCHIVE_CONFIG RumArchiveConfigUpsertAttributes: description: >- Archive configuration to save. When enabled is true, retention_days is required and must be 30, 90, or 180. When disabled, retention_days can be omitted. properties: enabled: description: Whether archiving is enabled. example: true type: boolean retention_days: description: >- Retention in days. When enabled is true, required and restricted to 30, 90, or 180. When enabled is false, this field can be omitted. example: 90 format: int32 maximum: 180 type: integer required: - enabled type: object RumArchiveConfigUpsertData: description: JSON:API resource. properties: attributes: $ref: "#/components/schemas/RumArchiveConfigUpsertAttributes" id: description: Resource identifier. example: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 type: string type: $ref: "#/components/schemas/RumArchiveConfigType" required: - id - type - attributes type: object RumArchiveConfigUpsertRequest: description: JSON:API document. properties: data: $ref: "#/components/schemas/RumArchiveConfigUpsertData" required: - data type: object RumArchiveSession: description: JSON:API resource. properties: attributes: $ref: "#/components/schemas/RumArchiveSessionAttributes" id: description: Resource identifier. example: 11111111-1111-4111-8111-111111111111 type: string type: $ref: "#/components/schemas/RumArchiveSessionType" required: - id - type - attributes type: object RumArchiveSessionAttributes: description: Archived session metadata. properties: account_id: description: Session account id, or null when unavailable. example: account-123 nullable: true type: string anonymous_id: description: Session anonymous id, or null when unavailable. example: anonymous-123 nullable: true type: string application_id: description: Application UUID. example: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 format: uuid type: string country: description: Session country, or null when unavailable. example: US nullable: true type: string recovery_status: $ref: "#/components/schemas/RumArchiveSessionRecoveryStatus" service: description: Service name. example: web type: string session_id: description: Session identifier. example: 00000000-0000-4000-8000-000000000001 type: string timestamp: description: Session timestamp in Unix milliseconds. example: 1789905600000 format: int64 type: integer user_id: description: Session user id, or null when unavailable. example: user-123 nullable: true type: string version: description: Session version, or null when unavailable. example: 1.0.0 nullable: true type: string required: - session_id - application_id - timestamp - service - user_id - anonymous_id - account_id - country - version - recovery_status type: object RumArchiveSessionRecoveryStatus: description: >- Session recovery state. A missing recovery record can be represented as null. Optional request_id and recovered_at are omitted when unavailable. nullable: true properties: recovered_at: description: Recovery timestamp, when available. example: example format: date-time type: string request_id: description: Associated recovery request ID. example: 11111111-1111-4111-8111-111111111111 type: string status: $ref: "#/components/schemas/RumRecoverySessionStatus" required: - status type: object RumArchiveSessionType: description: JSON:API resource type. enum: - rum_archive_session example: rum_archive_session type: string x-enum-varnames: - RUM_ARCHIVE_SESSION RumArchiveSessionsMeta: description: Search metadata. properties: page: $ref: "#/components/schemas/RumArchiveSessionsPage" required: - page type: object RumArchiveSessionsPage: description: Search pagination. properties: next_cursor: description: Opaque continuation cursor. Omitted when no further page is available. example: example type: string total_count: description: >- Search result count. Can be zero on continuation pages even when sessions are returned. Use `next_cursor` to determine whether more pages are available. example: 0 format: int64 minimum: 0 type: integer required: - total_count type: object RumArchiveSessionsResponse: description: JSON:API document. properties: data: description: Archived sessions. items: $ref: "#/components/schemas/RumArchiveSession" type: array meta: $ref: "#/components/schemas/RumArchiveSessionsMeta" required: - data - meta type: object RumArchiveSessionsSearchAttributes: description: >- Archived-session query. A window wider than configured archive retention is narrowed before searching. properties: cursor: description: Opaque next-page cursor. Keep the query, time range, and hide_retained value unchanged. example: example type: string from: description: Start of the range in Unix milliseconds. Must be positive and earlier than to. example: 1789905600000 format: int64 minimum: 1 type: integer hide_retained: default: false description: >- When true, exclude sessions already present in hot RUM storage. When false, those sessions can appear in the results. Keep this value unchanged when continuing with a cursor. example: false type: boolean limit: default: 50 description: Page size, at most 1000 (default 50). Values at or below zero use 50. example: 0 format: int32 maximum: 1000 type: integer query: description: RUM search query. Must not be empty. example: service:web type: string to: description: End of the range in Unix milliseconds. example: 1789992000000 format: int64 minimum: 1 type: integer required: - query - from - to type: object RumArchiveSessionsSearchData: description: JSON:API resource. properties: attributes: $ref: "#/components/schemas/RumArchiveSessionsSearchAttributes" id: description: >- Optional resource identifier. example: 11111111-1111-4111-8111-111111111111 type: string type: description: >- JSON:API resource type. example: rum_archive_sessions_request type: string required: - attributes type: object RumArchiveSessionsSearchRequest: description: JSON:API document. properties: data: $ref: "#/components/schemas/RumArchiveSessionsSearchData" required: - data type: object RumConfigAttributes: description: Attributes of the RUM configuration. properties: disabled: description: Whether the RUM configuration is disabled for the organization. example: false type: boolean enforced_application_tags: description: Whether application tags are enforced for the RUM applications in the organization. example: true type: boolean enforced_application_tags_updated_at: description: Timestamp of when the enforced application tags setting was last updated. example: "2024-01-15T09:30:00.000Z" format: date-time type: string enforced_application_tags_updated_by: description: Handle of the user who last updated the enforced application tags setting. example: "user@example.com" type: string ootb_metrics_version: description: Version of the out-of-the-box metrics installed for the organization. example: 5 format: int64 type: integer ootb_metrics_version_installed_at: description: Timestamp of when the out-of-the-box metrics version was installed. example: "2024-01-15T09:30:00.000Z" format: date-time type: string retention_filters_enabled: description: Whether retention filters are enabled for the organization. example: true type: boolean retention_filters_enabled_updated_at: description: Timestamp of when the retention filters setting was last updated. example: "2024-01-15T09:30:00.000Z" format: date-time type: string retention_filters_enabled_updated_by: description: Handle of the user or job who last updated the retention filters setting. example: "contract-update-job" type: string required: - enforced_application_tags - retention_filters_enabled type: object RumConfigCreateAttributes: description: Attributes of the RUM configuration to create. properties: enforced_application_tags: description: Whether application tags are enforced for the RUM applications in the organization. example: true type: boolean required: - enforced_application_tags type: object RumConfigCreateData: description: Object describing the RUM configuration to create. properties: attributes: $ref: "#/components/schemas/RumConfigCreateAttributes" type: $ref: "#/components/schemas/RumConfigType" required: - type - attributes type: object RumConfigCreateRequest: description: Request body for creating the RUM configuration. properties: data: $ref: "#/components/schemas/RumConfigCreateData" required: - data type: object RumConfigData: description: The RUM configuration data. properties: attributes: $ref: "#/components/schemas/RumConfigAttributes" id: description: The organization ID associated with the RUM configuration. example: "1234" type: string type: $ref: "#/components/schemas/RumConfigType" required: - id - type - attributes type: object RumConfigResponse: description: The RUM configuration object. properties: data: $ref: "#/components/schemas/RumConfigData" required: - data type: object RumConfigType: default: rum_config description: The type of the resource. The value should always be `rum_config`. enum: - rum_config example: rum_config type: string x-enum-varnames: - RUM_CONFIG RumConfigUpdateAttributes: description: Attributes of the RUM configuration to update. properties: enforced_application_tags: description: Whether application tags are enforced for the RUM applications in the organization. example: true type: boolean required: - enforced_application_tags type: object RumConfigUpdateData: description: Object describing the RUM configuration to update. properties: attributes: $ref: "#/components/schemas/RumConfigUpdateAttributes" type: $ref: "#/components/schemas/RumConfigType" required: - type - attributes type: object RumConfigUpdateRequest: description: Request body for updating the RUM configuration. properties: data: $ref: "#/components/schemas/RumConfigUpdateData" required: - data type: object RumCrossProductSampling: description: The configuration for cross-product retention filters. properties: trace_enabled: description: Whether the cross-product retention filter for APM traces is enabled. example: true type: boolean trace_sample_rate: description: The sample rate for the APM cross-product retention filter, between 0 and 100. Values returned by the API are rounded to two decimal places. example: 25.0 format: double maximum: 100 minimum: 0 type: number type: object RumCrossProductSamplingCreate: description: The configuration for cross-product retention filters. properties: trace_enabled: description: Whether the cross-product retention filter for APM traces is enabled. example: true type: boolean trace_sample_rate: description: The sample rate for the APM cross-product retention filter, between 0 and 100. example: 25.0 format: double maximum: 100 minimum: 0 type: number required: - trace_sample_rate type: object RumCrossProductSamplingUpdate: description: The configuration for cross-product retention filters. All fields are optional for partial updates. properties: trace_enabled: description: Whether the cross-product retention filter for APM traces is enabled. example: true type: boolean trace_sample_rate: description: The sample rate for the APM cross-product retention filter, between 0 and 100. example: 25.0 format: double maximum: 100 minimum: 0 type: number type: object RumExclusionFilterAttributes: description: The attributes of an exclusion filter. properties: enabled: $ref: "#/components/schemas/RumExclusionFilterEnabled" event_type: $ref: "#/components/schemas/RumExclusionFilterEventType" name: $ref: "#/components/schemas/RumExclusionFilterName" query: $ref: "#/components/schemas/RumExclusionFilterQuery" type: object RumExclusionFilterCreateAttributes: description: The attributes of an exclusion filter to create. properties: enabled: description: Whether the exclusion filter is active. Defaults to `true`. example: true type: boolean event_type: $ref: "#/components/schemas/RumExclusionFilterEventType" name: $ref: "#/components/schemas/RumExclusionFilterName" query: $ref: "#/components/schemas/RumExclusionFilterQuery" required: - name type: object RumExclusionFilterCreateData: description: The new exclusion filter properties to create. properties: attributes: $ref: "#/components/schemas/RumExclusionFilterCreateAttributes" type: $ref: "#/components/schemas/RumExclusionFilterType" required: - type - attributes type: object RumExclusionFilterCreateRequest: description: The exclusion filter body to create. properties: data: $ref: "#/components/schemas/RumExclusionFilterCreateData" required: - data type: object RumExclusionFilterData: description: An exclusion filter. properties: attributes: $ref: "#/components/schemas/RumExclusionFilterAttributes" id: description: The ID of the exclusion filter. example: "051601eb-54a0-abc0-03f9-cc02efa18892" type: string meta: $ref: "#/components/schemas/RumExclusionFilterMeta" type: $ref: "#/components/schemas/RumExclusionFilterType" required: - id - type type: object RumExclusionFilterEnabled: description: Whether the exclusion filter is active. example: true type: boolean RumExclusionFilterEventType: description: The type of RUM events to filter on. enum: - session - view - action - error - resource - long_task - vital example: error type: string x-enum-varnames: - SESSION - VIEW - ACTION - ERROR - RESOURCE - LONG_TASK - VITAL RumExclusionFilterMeta: description: Metadata about the exclusion filter. properties: enabled_at: description: Unix epoch (in milliseconds) when the exclusion filter was last enabled. example: 1735689600000 format: int64 type: integer updated_at: description: Unix epoch (in milliseconds) of the last update. example: 1735689600000 format: int64 type: integer updated_by_handle: description: Handle of the user who last updated the exclusion filter. example: jane.doe@example.com type: string type: object RumExclusionFilterName: description: The name of the exclusion filter. example: Exclude noisy browser extension errors type: string RumExclusionFilterQuery: description: |- Additional query used to further restrict which RUM events are excluded. Combined with `event_type` when both are provided. example: "@error.message:*extension*" type: string RumExclusionFilterResponse: description: An exclusion filter response body. properties: data: $ref: "#/components/schemas/RumExclusionFilterData" type: object RumExclusionFilterType: default: exclusion_filters description: The resource type. The value must be `exclusion_filters`. enum: - exclusion_filters example: exclusion_filters type: string x-enum-varnames: - EXCLUSION_FILTERS RumExclusionFilterUpdateAttributes: description: |- The attributes of an exclusion filter that can be updated. For the built-in Error Tracking exclusion filter, only `enabled` can be set; `name`, `event_type`, and `query` must be omitted. properties: enabled: $ref: "#/components/schemas/RumExclusionFilterEnabled" event_type: $ref: "#/components/schemas/RumExclusionFilterEventType" name: $ref: "#/components/schemas/RumExclusionFilterName" query: $ref: "#/components/schemas/RumExclusionFilterQuery" type: object RumExclusionFilterUpdateData: description: The exclusion filter properties to update. properties: attributes: $ref: "#/components/schemas/RumExclusionFilterUpdateAttributes" id: description: The ID of the exclusion filter. Must match the `ef_id` path parameter. example: "051601eb-54a0-abc0-03f9-cc02efa18892" type: string type: $ref: "#/components/schemas/RumExclusionFilterType" required: - id - type - attributes type: object RumExclusionFilterUpdateRequest: description: The exclusion filter body to update. properties: data: $ref: "#/components/schemas/RumExclusionFilterUpdateData" required: - data type: object RumExclusionFiltersResponse: description: All exclusion filters for a RUM application. properties: data: description: A list of exclusion filters. items: $ref: "#/components/schemas/RumExclusionFilterData" type: array type: object RumManagedArchiveErrorResponse: description: API error response. properties: errors: description: Errors as plain-text messages or JSON:API error objects containing status, title, and detail. example: - Forbidden items: description: A plain-text message or a JSON:API error object. type: array required: - errors type: object RumMetricCompute: description: The compute rule to compute the RUM-based metric. It is set at creation and only `include_percentiles` can be updated afterward. properties: aggregation_type: $ref: "#/components/schemas/RumMetricComputeAggregationType" include_percentiles: $ref: "#/components/schemas/RumMetricComputeIncludePercentiles" path: description: |- The path of the numeric RUM event attribute the metric aggregates on. Only valid when `aggregation_type` is `distribution`. example: "@duration" type: string required: - aggregation_type type: object RumMetricComputeAggregationType: description: |- The type of aggregation to use. `count` counts the matching events. `distribution` aggregates the values found at `path`. enum: ["count", "distribution"] example: "distribution" type: string x-enum-varnames: ["COUNT", "DISTRIBUTION"] RumMetricComputeIncludePercentiles: description: |- Toggle to include or exclude percentile aggregations (p50, p75, p90, p95, p99) for distribution metrics. Required when `aggregation_type` is `distribution`, and must be omitted otherwise. example: true type: boolean RumMetricCreateAttributes: description: The object describing the Datadog RUM-based metric to create. properties: compute: $ref: "#/components/schemas/RumMetricCompute" event_type: $ref: "#/components/schemas/RumMetricEventType" filter: $ref: "#/components/schemas/RumMetricFilter" group_by: description: The rules to group the metric by. Each rule creates a tag on the generated metric. If omitted, the metric is not grouped. items: $ref: "#/components/schemas/RumMetricGroupBy" type: array uniqueness: $ref: "#/components/schemas/RumMetricUniqueness" required: - event_type - compute type: object RumMetricCreateData: description: The new RUM-based metric properties. properties: attributes: $ref: "#/components/schemas/RumMetricCreateAttributes" id: $ref: "#/components/schemas/RumMetricID" type: $ref: "#/components/schemas/RumMetricType" required: - id - type - attributes type: object RumMetricCreateRequest: description: The new RUM-based metric body. properties: data: $ref: "#/components/schemas/RumMetricCreateData" required: - data type: object RumMetricEventType: description: The type of RUM events the metric is generated from. It is set at creation and cannot be changed. enum: ["session", "view", "action", "error", "resource", "long_task", "vital"] example: "session" type: string x-enum-varnames: ["SESSION", "VIEW", "ACTION", "ERROR", "RESOURCE", "LONG_TASK", "VITAL"] RumMetricFilter: description: The RUM-based metric filter. Events matching this filter are aggregated in this metric. The `event_type` filter is added automatically. properties: query: default: "*" description: |- The search query, following the [RUM search syntax](https://docs.datadoghq.com/real_user_monitoring/explorer/search_syntax/). Do not include a `@type` filter, it is derived from `event_type`. It must not contain invisible or control characters such as non-breaking or zero-width spaces. When updating a metric, an empty query leaves the filter unchanged. example: "@service:web-ui" type: string required: - query type: object RumMetricGroupBy: description: A group by rule. properties: path: description: The path of the RUM event attribute to group the metric by. example: "@browser.name" type: string tag_name: description: |- Name of the tag that gets created on the metric. By default, `path` is used as the tag name. It must be at most 200 characters long, start with a letter, and contain only lowercase letters, digits, underscores, hyphens, colons, periods, and slashes. example: "browser_name" maxLength: 200 type: string required: - path type: object RumMetricID: description: |- The name of the RUM-based metric. On creation, it must be 1 to 200 characters long, contain only ASCII letters, digits, underscores, and periods, start with a letter, and not start with `rum.measure` or `rum.investigate`. It cannot be changed after creation. example: "rum.sessions.webui.count" maxLength: 200 type: string RumMetricResponse: description: The RUM-based metric object. properties: data: $ref: "#/components/schemas/RumMetricResponseData" type: object RumMetricResponseAttributes: description: The object describing a Datadog RUM-based metric. properties: compute: $ref: "#/components/schemas/RumMetricResponseCompute" event_type: $ref: "#/components/schemas/RumMetricEventType" filter: $ref: "#/components/schemas/RumMetricResponseFilter" group_by: description: The rules the metric is grouped by. An empty array is returned if the metric is not grouped. items: $ref: "#/components/schemas/RumMetricResponseGroupBy" type: array uniqueness: $ref: "#/components/schemas/RumMetricResponseUniqueness" type: object RumMetricResponseCompute: description: The compute rule of the RUM-based metric. properties: aggregation_type: $ref: "#/components/schemas/RumMetricComputeAggregationType" include_percentiles: $ref: "#/components/schemas/RumMetricComputeIncludePercentiles" path: description: |- The path of the numeric RUM event attribute the metric aggregates on. Only present when `aggregation_type` is `distribution`. example: "@duration" type: string type: object RumMetricResponseData: description: The RUM-based metric properties. properties: attributes: $ref: "#/components/schemas/RumMetricResponseAttributes" id: $ref: "#/components/schemas/RumMetricID" type: $ref: "#/components/schemas/RumMetricType" type: object RumMetricResponseFilter: description: The RUM-based metric filter. RUM events matching this filter are aggregated in this metric. Omitted if the metric only filters on the event type. properties: query: description: The search query, following the [RUM search syntax](https://docs.datadoghq.com/real_user_monitoring/explorer/search_syntax/). It does not include the event type filter. example: "service:web* AND @http.status_code:[200 TO 299]" type: string type: object RumMetricResponseGroupBy: description: A group by rule. properties: path: description: The path of the RUM event attribute the metric is grouped by. example: "@http.status_code" type: string tag_name: description: Name of the tag created on the metric. By default, `path` is used as the tag name. example: "status_code" type: string type: object RumMetricResponseUniqueness: description: The rule to count updatable events. Only present if `event_type` is `session` or `view`, and absent on older metrics created before this setting existed. properties: when: $ref: "#/components/schemas/RumMetricUniquenessWhen" type: object RumMetricType: default: rum_metrics description: The type of the resource. The value must be `rum_metrics`. enum: - rum_metrics example: rum_metrics type: string x-enum-varnames: ["RUM_METRICS"] RumMetricUniqueness: description: |- The rule to count updatable events. Required when `event_type` is `session` or `view`, and must be omitted for other event types. It cannot be changed after creation. properties: when: $ref: "#/components/schemas/RumMetricUniquenessWhen" required: - when type: object RumMetricUniquenessWhen: description: When to count updatable events. `match` when the event is first seen, or `end` when the event is complete. Sessions and views are updated over time, and each one is counted once. enum: ["match", "end"] example: "match" type: string x-enum-varnames: ["WHEN_MATCH", "WHEN_END"] RumMetricUpdateAttributes: description: The RUM-based metric properties to update. Omitted properties keep their current value. properties: compute: $ref: "#/components/schemas/RumMetricUpdateCompute" filter: $ref: "#/components/schemas/RumMetricFilter" group_by: description: The rules to group the metric by. When provided, replaces all the existing group by rules. items: $ref: "#/components/schemas/RumMetricGroupBy" type: array type: object RumMetricUpdateCompute: description: The compute rule properties that can be updated. Only valid for metrics whose `aggregation_type` is `distribution`. properties: include_percentiles: $ref: "#/components/schemas/RumMetricComputeIncludePercentiles" type: object RumMetricUpdateData: description: The RUM-based metric properties to update. `id` is required by the API and must match the `metric_id` path parameter. properties: attributes: $ref: "#/components/schemas/RumMetricUpdateAttributes" id: $ref: "#/components/schemas/RumMetricID" type: $ref: "#/components/schemas/RumMetricType" required: - type - attributes type: object RumMetricUpdateRequest: description: The RUM-based metric update body. properties: data: $ref: "#/components/schemas/RumMetricUpdateData" required: - data type: object RumMetricsResponse: description: All the available RUM-based metric objects. properties: data: description: A list of RUM-based metric objects. items: $ref: "#/components/schemas/RumMetricResponseData" type: array type: object RumPermanentRetentionFilterAttributes: description: The attributes of a permanent RUM retention filter. properties: cross_product_sampling: $ref: "#/components/schemas/RumCrossProductSampling" description: description: A description of what the filter retains. example: "All sessions generated by Synthetics are retained at 100%." type: string editability: $ref: "#/components/schemas/RumPermanentRetentionFilterEditability" name: description: The display name of the permanent retention filter. example: "Synthetics Sessions" type: string type: object RumPermanentRetentionFilterData: description: A permanent RUM retention filter. properties: attributes: $ref: "#/components/schemas/RumPermanentRetentionFilterAttributes" id: $ref: "#/components/schemas/RumPermanentRetentionFilterID" type: $ref: "#/components/schemas/RumPermanentRetentionFilterType" type: object RumPermanentRetentionFilterEditability: description: Indicates which cross-product fields of a permanent RUM retention filter can be updated. properties: trace_editable: description: Whether the APM trace cross-product configuration of the filter can be updated. example: true type: boolean type: object RumPermanentRetentionFilterID: description: The identifier of a permanent RUM retention filter. enum: - rum_apm_flat_sampling - synthetics_sessions - forced_replay_sessions example: synthetics_sessions type: string x-enum-varnames: ["RUM_APM_FLAT_SAMPLING", "SYNTHETICS_SESSIONS", "FORCED_REPLAY_SESSIONS"] RumPermanentRetentionFilterResponse: description: A permanent RUM retention filter object. properties: data: $ref: "#/components/schemas/RumPermanentRetentionFilterData" type: object RumPermanentRetentionFilterType: default: permanent_retention_filters description: The type of the resource. The value should always be `permanent_retention_filters`. enum: - permanent_retention_filters example: permanent_retention_filters type: string x-enum-varnames: ["PERMANENT_RETENTION_FILTERS"] RumPermanentRetentionFilterUpdateAttributes: description: The configuration to update on a permanent RUM retention filter. properties: cross_product_sampling: $ref: "#/components/schemas/RumCrossProductSamplingUpdate" type: object RumPermanentRetentionFilterUpdateData: description: The new permanent RUM retention filter configuration to update. properties: attributes: $ref: "#/components/schemas/RumPermanentRetentionFilterUpdateAttributes" id: $ref: "#/components/schemas/RumPermanentRetentionFilterID" type: $ref: "#/components/schemas/RumPermanentRetentionFilterType" required: - id - type - attributes type: object RumPermanentRetentionFilterUpdateRequest: description: The permanent RUM retention filter body to update. properties: data: $ref: "#/components/schemas/RumPermanentRetentionFilterUpdateData" required: - data type: object RumPermanentRetentionFiltersResponse: description: All permanent RUM retention filters for a RUM application. properties: data: description: A list of permanent RUM retention filters. items: $ref: "#/components/schemas/RumPermanentRetentionFilterData" type: array type: object RumRecoveredSession: description: Progress for one targeted session. properties: application_id: description: Application UUID. example: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 format: uuid type: string error_message: description: Failure details, if present. example: example type: string events_recovered: description: Recovered event count. example: 0 format: int64 minimum: 0 type: integer session_id: description: Session identifier. example: 00000000-0000-4000-8000-000000000001 format: uuid type: string status: $ref: "#/components/schemas/RumRecoverySessionStatus" required: - session_id - application_id - status - events_recovered type: object RumRecoveryBatchCreateAttributes: description: >- Recover sessions selected by a query. The range cannot exceed 180 days; from cannot be more than 4 years ago and to cannot be more than 1 hour in the future. Session availability depends on the configured archive retention. properties: estimated_count: description: >- Optional client estimate. Creation validates and stores a fresh server estimate instead of this value. example: 0 format: int64 minimum: 0 type: integer from: description: Start of the range in Unix milliseconds. Must be positive and earlier than to. example: 1789905600000 format: int64 minimum: 1 type: integer query: description: RUM search query. Not blank, at most 4096 bytes for batch creation and count. example: service:web type: string request_type: $ref: "#/components/schemas/RumRecoveryBatchRequestType" to: description: End of the range in Unix milliseconds. example: 1789992000000 format: int64 minimum: 1 type: integer required: - request_type - query - from - to type: object RumRecoveryBatchListAttributes: description: >- Batch recovery progress. Status updates can appear here before they appear in request details. properties: created_at: description: Creation time. example: "2026-09-21T12:00:00Z" format: date-time type: string discovery_status: $ref: "#/components/schemas/RumRecoveryDiscoveryStatus" estimated_count: description: >- Batch estimate stored at creation, when present. New batches use a fresh server estimate; older batches may contain a client-supplied estimate. example: 0 format: int64 minimum: 0 type: integer from: description: Start of the range in Unix milliseconds. Must be positive and earlier than to. example: 1789905600000 format: int64 minimum: 1 type: integer query: description: RUM search query. Not blank, at most 4096 bytes for batch creation and count. example: service:web type: string sessions_discovered: description: Discovered sessions. example: 0 format: int64 minimum: 0 type: integer sessions_failed: description: Failed sessions. example: 0 format: int64 minimum: 0 type: integer sessions_processed: description: Processed sessions. example: 0 format: int64 minimum: 0 type: integer slices_completed: description: Completed slices. example: 0 format: int64 minimum: 0 type: integer slices_failed: description: Failed slices. example: 0 format: int64 minimum: 0 type: integer status: $ref: "#/components/schemas/RumRecoveryRequestStatus" to: description: End of the range in Unix milliseconds. example: 1789992000000 format: int64 minimum: 1 type: integer total_slices: description: Total discovery slices. example: 0 format: int64 minimum: 0 type: integer updated_at: description: Last update time. example: "2026-09-21T12:00:00Z" format: date-time type: string required: - status - discovery_status - created_at - updated_at - query - from - to - total_slices - slices_completed - slices_failed - sessions_discovered - sessions_processed - sessions_failed type: object RumRecoveryBatchListData: description: JSON:API resource. properties: attributes: $ref: "#/components/schemas/RumRecoveryBatchListAttributes" id: description: Resource identifier. example: 11111111-1111-4111-8111-111111111111 type: string type: $ref: "#/components/schemas/RumRecoveryBatchListDataType" required: - id - type - attributes type: object RumRecoveryBatchListDataType: description: JSON:API resource type. enum: - rum_batch_recovery_request example: rum_batch_recovery_request type: string x-enum-varnames: - RUM_BATCH_RECOVERY_REQUEST RumRecoveryBatchListMeta: description: Batch-list pagination metadata. properties: next_cursor: description: Opaque next-page cursor. Omitted on the final page. example: example type: string type: object RumRecoveryBatchListResponse: description: JSON:API document. properties: data: description: >- Batch requests ordered newest first. A filtered page can be empty while meta.next_cursor is present. items: $ref: "#/components/schemas/RumRecoveryBatchListData" type: array meta: $ref: "#/components/schemas/RumRecoveryBatchListMeta" required: - data - meta type: object RumRecoveryBatchRequestType: description: Query-based batch recovery. enum: - batch example: batch type: string x-enum-varnames: - BATCH RumRecoveryCancelAttributes: description: Batch cancellation. properties: status: $ref: "#/components/schemas/RumRecoveryCancelStatus" required: - status type: object RumRecoveryCancelData: description: JSON:API resource. properties: attributes: $ref: "#/components/schemas/RumRecoveryCancelAttributes" id: description: >- Optional resource identifier. example: 11111111-1111-4111-8111-111111111111 type: string type: description: >- JSON:API resource type. example: rum_recovery_request type: string required: - attributes type: object RumRecoveryCancelRequest: description: JSON:API document. properties: data: $ref: "#/components/schemas/RumRecoveryCancelData" required: - data type: object RumRecoveryCancelResponse: description: JSON:API document. properties: data: $ref: "#/components/schemas/RumRecoveryCancelResponseData" required: - data type: object RumRecoveryCancelResponseAttributes: description: >- Batch cancellation acknowledgment. properties: cancelled_at: description: Cancellation time. example: "2026-09-21T12:00:00Z" format: date-time type: string cancelled_by: description: Handle of the user who canceled the batch. example: user@example.com type: string discovery_status: $ref: "#/components/schemas/RumRecoveryDiscoveryStatus" required: - discovery_status - cancelled_at - cancelled_by type: object RumRecoveryCancelResponseData: description: JSON:API resource. properties: attributes: $ref: "#/components/schemas/RumRecoveryCancelResponseAttributes" id: description: Resource identifier. example: 11111111-1111-4111-8111-111111111111 type: string type: $ref: "#/components/schemas/RumRecoveryRequestType" required: - id - type - attributes type: object RumRecoveryCancelStatus: description: Requested cancellation state. enum: - cancelled example: cancelled type: string x-enum-varnames: - CANCELLED RumRecoveryCountAttributes: description: >- Query for a recovery estimate. The range cannot exceed 180 days; from cannot be more than 4 years ago and to cannot be more than 1 hour in the future. Session availability depends on the configured archive retention. properties: from: description: Start of the range in Unix milliseconds. Must be positive and earlier than to. example: 1789905600000 format: int64 minimum: 1 type: integer query: description: RUM search query. Not blank, at most 4096 bytes for batch creation and count. example: service:web type: string to: description: End of the range in Unix milliseconds. example: 1789992000000 format: int64 minimum: 1 type: integer required: - query - from - to type: object RumRecoveryCountRequest: description: JSON:API document. properties: data: $ref: "#/components/schemas/RumRecoveryCountRequestData" required: - data type: object RumRecoveryCountRequestData: description: JSON:API resource. properties: attributes: $ref: "#/components/schemas/RumRecoveryCountAttributes" id: description: >- Optional resource identifier. example: 11111111-1111-4111-8111-111111111111 type: string type: description: >- JSON:API resource type. example: rum_recovery_count type: string required: - attributes type: object RumRecoveryCountResponse: description: JSON:API document. properties: data: $ref: "#/components/schemas/RumRecoveryCountResponseData" required: - data type: object RumRecoveryCountResponseAttributes: description: Approximate recoverable count. properties: estimated_count: description: >- Estimated distinct recoverable sessions not already retained in hot storage. The full estimate is returned without capping it at max_recoverable_sessions. example: 0 format: int64 minimum: 0 type: integer max_recoverable_sessions: description: >- Configured maximum estimated recoverable sessions per batch (100,000 by default). Estimates equal to this value are accepted at creation. example: 100000 format: int64 maximum: 2147483647 minimum: 1 type: integer required: - estimated_count - max_recoverable_sessions type: object RumRecoveryCountResponseData: description: JSON:API resource. properties: attributes: $ref: "#/components/schemas/RumRecoveryCountResponseAttributes" id: description: Resource identifier. example: count type: string type: $ref: "#/components/schemas/RumRecoveryCountResponseDataType" required: - id - type - attributes type: object RumRecoveryCountResponseDataType: description: JSON:API resource type. enum: - rum_recovery_count example: rum_recovery_count type: string x-enum-varnames: - RUM_RECOVERY_COUNT RumRecoveryCreateAttributes: description: Targeted recovery (the default) or query-based batch recovery. oneOf: - $ref: "#/components/schemas/RumRecoverySessionsCreateAttributes" - $ref: "#/components/schemas/RumRecoveryBatchCreateAttributes" RumRecoveryCreateData: description: JSON:API resource. properties: attributes: $ref: "#/components/schemas/RumRecoveryCreateAttributes" type: description: >- JSON:API resource type. example: rum_recovery_request type: string required: - attributes type: object RumRecoveryCreateRequest: description: JSON:API document. properties: data: $ref: "#/components/schemas/RumRecoveryCreateData" required: - data type: object RumRecoveryCreateResponse: description: JSON:API document. properties: data: $ref: "#/components/schemas/RumRecoveryCreateResponseData" required: - data type: object RumRecoveryCreateResponseAttributes: description: Accepted recovery request. properties: created_at: description: Creation time. example: "2026-09-21T12:00:00Z" format: date-time type: string discovery_status: $ref: "#/components/schemas/RumRecoveryDiscoveryStatus" estimated_count: description: >- Batch estimate stored at creation, when present. New batches use a fresh server estimate; older batches may contain a client-supplied estimate. example: 0 format: int64 minimum: 0 type: integer failed_sessions: description: Failed session count. example: 0 format: int64 minimum: 0 type: integer processed_sessions: description: Processed session count. example: 0 format: int64 minimum: 0 type: integer status: $ref: "#/components/schemas/RumRecoveryRequestStatus" total_sessions: description: Total targeted sessions. Omitted while a batch total is unknown. example: 0 format: int64 minimum: 0 type: integer required: - status - processed_sessions - failed_sessions - created_at type: object RumRecoveryCreateResponseData: description: JSON:API resource. properties: attributes: $ref: "#/components/schemas/RumRecoveryCreateResponseAttributes" id: description: Resource identifier. example: 11111111-1111-4111-8111-111111111111 type: string type: $ref: "#/components/schemas/RumRecoveryRequestType" required: - id - type - attributes type: object RumRecoveryDiscoveryStatus: description: Batch discovery state. QUEUED indicates that the request is waiting for processing capacity. enum: - QUEUED - PENDING - SLICING - DISCOVERED - PROCESSING - COMPLETED - FAILED - CANCELLED example: QUEUED type: string x-enum-varnames: - QUEUED - PENDING - SLICING - DISCOVERED - PROCESSING - COMPLETED - FAILED - CANCELLED RumRecoveryRequestAttributes: description: >- Recovery progress. Batch-only attributes are omitted for targeted requests; request_type is also omitted for targeted requests. properties: created_at: description: Creation time. example: "2026-09-21T12:00:00Z" format: date-time type: string discovery_status: $ref: "#/components/schemas/RumRecoveryDiscoveryStatus" error_message: description: Failure details, if present. example: example type: string estimated_count: description: >- Batch estimate stored at creation, when present. New batches use a fresh server estimate; older batches may contain a client-supplied estimate. example: 0 format: int64 minimum: 0 type: integer failed_sessions: description: Failed session count. example: 0 format: int64 minimum: 0 type: integer from: description: Start of the range in Unix milliseconds. Must be positive and earlier than to. example: 1789905600000 format: int64 minimum: 1 type: integer processed_sessions: description: Processed session count. example: 0 format: int64 minimum: 0 type: integer query: description: RUM search query. Not blank, at most 4096 bytes for batch creation and count. example: service:web type: string request_type: $ref: "#/components/schemas/RumRecoveryBatchRequestType" sessions: description: Targeted session progress. Omitted when empty or not applicable. items: $ref: "#/components/schemas/RumRecoveredSession" type: array sessions_discovered: description: Discovered sessions. example: 0 format: int64 minimum: 0 type: integer sessions_failed: description: Failed sessions. example: 0 format: int64 minimum: 0 type: integer sessions_processed: description: Processed sessions. example: 0 format: int64 minimum: 0 type: integer slices_completed: description: Completed slices. example: 0 format: int64 minimum: 0 type: integer slices_failed: description: Failed slices. example: 0 format: int64 minimum: 0 type: integer status: $ref: "#/components/schemas/RumRecoveryRequestStatus" to: description: End of the range in Unix milliseconds. example: 1789992000000 format: int64 minimum: 1 type: integer total_sessions: description: Total targeted sessions. Omitted while a batch total is unknown. example: 0 format: int64 minimum: 0 type: integer total_slices: description: Total discovery slices. example: 0 format: int64 minimum: 0 type: integer updated_at: description: Last update time. example: "2026-09-21T12:00:00Z" format: date-time type: string required: - status - processed_sessions - failed_sessions - created_at - updated_at type: object RumRecoveryRequestData: description: JSON:API resource. properties: attributes: $ref: "#/components/schemas/RumRecoveryRequestAttributes" id: description: Resource identifier. example: 11111111-1111-4111-8111-111111111111 type: string type: $ref: "#/components/schemas/RumRecoveryRequestType" required: - id - type - attributes type: object RumRecoveryRequestResponse: description: JSON:API document. properties: data: $ref: "#/components/schemas/RumRecoveryRequestData" required: - data type: object RumRecoveryRequestStatus: description: >- Recovery request state. enum: - PENDING - PROCESSING - COMPLETED - FAILED - CANCELLED - EXPIRED example: PENDING type: string x-enum-varnames: - PENDING - PROCESSING - COMPLETED - FAILED - CANCELLED - EXPIRED RumRecoveryRequestType: description: JSON:API resource type. enum: - rum_recovery_request example: rum_recovery_request type: string x-enum-varnames: - RUM_RECOVERY_REQUEST RumRecoverySessionInput: description: Archived session to recover. properties: application_id: description: Application UUID. example: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 format: uuid type: string session_id: description: Session UUID. example: 00000000-0000-4000-8000-000000000001 format: uuid type: string required: - application_id - session_id type: object RumRecoverySessionStatus: description: >- Session availability or recovery state. `RECOVERED` indicates that the session is ready to query. enum: - AVAILABLE - PENDING - PROCESSING - RECOVERED - FAILED - RETAINED - EXPIRED - CANCELLED example: AVAILABLE type: string x-enum-varnames: - AVAILABLE - PENDING - PROCESSING - RECOVERED - FAILED - RETAINED - EXPIRED - CANCELLED RumRecoverySessionsCreateAttributes: description: Recover 1 to 100 explicit archived sessions. Session IDs must be unique within the request. properties: request_type: $ref: "#/components/schemas/RumRecoverySessionsRequestType" sessions: description: Sessions to recover. items: $ref: "#/components/schemas/RumRecoverySessionInput" maxItems: 100 minItems: 1 type: array required: - sessions type: object RumRecoverySessionsRequestType: default: sessions description: Targeted recovery. Omitted request_type defaults to sessions. enum: - sessions example: sessions type: string x-enum-varnames: - SESSIONS RumRetentionFilterAttributes: description: The object describing attributes of a RUM retention filter. properties: cross_product_sampling: $ref: "#/components/schemas/RumCrossProductSampling" enabled: $ref: "#/components/schemas/RumRetentionFilterEnabled" event_type: $ref: "#/components/schemas/RumRetentionFilterEventType" name: $ref: "#/components/schemas/RunRetentionFilterName" query: $ref: "#/components/schemas/RumRetentionFilterQuery" sample_rate: $ref: "#/components/schemas/RumRetentionFilterSampleRate" type: object RumRetentionFilterCreateAttributes: description: The object describing attributes of a RUM retention filter to create. properties: cross_product_sampling: $ref: "#/components/schemas/RumCrossProductSamplingCreate" enabled: $ref: "#/components/schemas/RumRetentionFilterEnabled" event_type: $ref: "#/components/schemas/RumRetentionFilterEventType" name: $ref: "#/components/schemas/RunRetentionFilterName" query: $ref: "#/components/schemas/RumRetentionFilterQuery" sample_rate: $ref: "#/components/schemas/RumRetentionFilterSampleRate" required: - event_type - name - sample_rate type: object RumRetentionFilterCreateData: description: The new RUM retention filter properties to create. properties: attributes: $ref: "#/components/schemas/RumRetentionFilterCreateAttributes" type: $ref: "#/components/schemas/RumRetentionFilterType" required: - type - attributes type: object RumRetentionFilterCreateRequest: description: The RUM retention filter body to create. properties: data: $ref: "#/components/schemas/RumRetentionFilterCreateData" required: - data type: object RumRetentionFilterData: description: The RUM retention filter. properties: attributes: $ref: "#/components/schemas/RumRetentionFilterAttributes" id: $ref: "#/components/schemas/RumRetentionFilterID" type: $ref: "#/components/schemas/RumRetentionFilterType" type: object RumRetentionFilterEnabled: description: Whether the retention filter is enabled. example: true type: boolean RumRetentionFilterEventType: description: The type of RUM events to filter on. enum: ["session", "view", "action", "error", "resource", "long_task", "vital"] example: "session" type: string x-enum-varnames: ["SESSION", "VIEW", "ACTION", "ERROR", "RESOURCE", "LONG_TASK", "VITAL"] RumRetentionFilterID: description: ID of retention filter in UUID. example: "051601eb-54a0-abc0-03f9-cc02efa18892" type: string RumRetentionFilterQuery: description: The query string for a RUM retention filter. example: "@session.has_replay:true" type: string RumRetentionFilterResponse: description: The RUM retention filter object. properties: data: $ref: "#/components/schemas/RumRetentionFilterData" type: object RumRetentionFilterSampleRate: description: The sample rate for a RUM retention filter, between 0.1 and 100. Values are truncated to one decimal place. example: 50.5 format: double maximum: 100 minimum: 0.1 type: number RumRetentionFilterType: default: retention_filters description: The type of the resource. The value should always be retention_filters. enum: - retention_filters example: retention_filters type: string x-enum-varnames: ["RETENTION_FILTERS"] RumRetentionFilterUpdateAttributes: description: The object describing attributes of a RUM retention filter to update. properties: cross_product_sampling: $ref: "#/components/schemas/RumCrossProductSamplingUpdate" enabled: $ref: "#/components/schemas/RumRetentionFilterEnabled" event_type: $ref: "#/components/schemas/RumRetentionFilterEventType" name: $ref: "#/components/schemas/RunRetentionFilterName" query: $ref: "#/components/schemas/RumRetentionFilterQuery" sample_rate: $ref: "#/components/schemas/RumRetentionFilterSampleRate" type: object RumRetentionFilterUpdateData: description: The new RUM retention filter properties to update. properties: attributes: $ref: "#/components/schemas/RumRetentionFilterUpdateAttributes" id: $ref: "#/components/schemas/RumRetentionFilterID" type: $ref: "#/components/schemas/RumRetentionFilterType" required: - id - type - attributes type: object RumRetentionFilterUpdateRequest: description: The RUM retention filter body to update. properties: data: $ref: "#/components/schemas/RumRetentionFilterUpdateData" required: - data type: object RumRetentionFiltersOrderData: description: The RUM retention filter data for ordering. properties: id: $ref: "#/components/schemas/RumRetentionFilterID" type: $ref: "#/components/schemas/RumRetentionFilterType" required: - id - type type: object RumRetentionFiltersOrderRequest: description: |- The list of RUM retention filter IDs along with their corresponding type to reorder. All retention filter IDs should be included in the list created for a RUM application. properties: data: description: A list of RUM retention filter IDs along with type. items: $ref: "#/components/schemas/RumRetentionFiltersOrderData" type: array type: object RumRetentionFiltersOrderResponse: description: The list of RUM retention filter IDs along with type. properties: data: description: A list of RUM retention filter IDs along with type. items: $ref: "#/components/schemas/RumRetentionFiltersOrderData" type: array type: object RumRetentionFiltersResponse: description: All RUM retention filters for a RUM application. properties: data: description: A list of RUM retention filters. items: $ref: "#/components/schemas/RumRetentionFilterData" type: array type: object RumRetentionQuotaConfigAttributes: description: The RUM retention quota configuration properties. properties: custom: $ref: "#/components/schemas/RumRetentionQuotaCustomConfig" mode: $ref: "#/components/schemas/RumRetentionQuotaMode" org_id: description: The ID of the organization the retention quota configuration belongs to. example: 2 format: int64 type: integer updated_at: description: The date the retention quota configuration was last updated. example: "2026-03-04T15:37:54.951447Z" format: date-time type: string updated_by: description: The handle of the user who last updated the retention quota configuration. example: test@example.com type: string required: - mode - org_id type: object RumRetentionQuotaConfigData: description: The RUM retention quota configuration object. properties: attributes: $ref: "#/components/schemas/RumRetentionQuotaConfigAttributes" id: description: The identifier of the scope the retention quota configuration applies to. example: cd73a516-a481-4af5-8352-9b577465c77b type: string type: $ref: "#/components/schemas/RumRetentionQuotaConfigType" required: - id - type - attributes type: object RumRetentionQuotaConfigResponse: description: The RUM retention quota configuration response. properties: data: $ref: "#/components/schemas/RumRetentionQuotaConfigData" required: - data type: object RumRetentionQuotaConfigType: default: rum_quota_config description: The type of the resource, always `rum_quota_config`. enum: - rum_quota_config example: rum_quota_config type: string x-enum-varnames: ["RUM_QUOTA_CONFIG"] RumRetentionQuotaConfigUpdateAttributes: description: The RUM retention quota configuration properties to create or update. properties: custom: $ref: "#/components/schemas/RumRetentionQuotaCustomConfig" mode: $ref: "#/components/schemas/RumRetentionQuotaMode" required: - mode type: object RumRetentionQuotaConfigUpdateData: description: The RUM retention quota configuration to create or update. properties: attributes: $ref: "#/components/schemas/RumRetentionQuotaConfigUpdateAttributes" id: description: |- The identifier of the scope the retention quota configuration applies to. Must match `scope_id` in the path. example: cd73a516-a481-4af5-8352-9b577465c77b type: string type: $ref: "#/components/schemas/RumRetentionQuotaConfigType" required: - id - type - attributes type: object RumRetentionQuotaConfigUpdateRequest: description: The body of a request to create or update a RUM retention quota configuration. properties: data: $ref: "#/components/schemas/RumRetentionQuotaConfigUpdateData" required: - data type: object RumRetentionQuotaCustomConfig: description: The configuration used when `mode` is `custom`. properties: daily_reset_time: description: The time of day when the daily quota resets, in `HH:MM` 24-hour format. example: "08:00" pattern: "^([01]\\d|2[0-3]):[0-5]\\d$" type: string daily_reset_timezone: description: The timezone offset used for the daily reset time, in `±HH:MM` format. example: "+09:00" pattern: "^[+-](0\\d|1[0-4]):[0-5]\\d$" type: string quota_reached_action: $ref: "#/components/schemas/RumRetentionQuotaReachedAction" session_limit: description: The maximum number of sessions allowed within the window. Must be at least `1000`. example: 1000000 format: int64 minimum: 1000 type: integer window_type: $ref: "#/components/schemas/RumRetentionQuotaWindowType" required: - window_type - session_limit - daily_reset_time - daily_reset_timezone - quota_reached_action type: object RumRetentionQuotaMode: description: |- The retention quota mode. `custom` enforces a fixed session limit. `custom` is the only supported mode. enum: - custom example: custom type: string x-enum-varnames: ["CUSTOM"] RumRetentionQuotaReachedAction: description: The action to take when the session quota is reached. enum: - stop - slowdown example: stop type: string x-enum-varnames: ["STOP", "SLOWDOWN"] RumRetentionQuotaScopeType: default: application description: |- The type of scope the retention quota configuration applies to. `application` is the only supported scope type. enum: - application example: application type: string x-enum-varnames: ["APPLICATION"] RumRetentionQuotaWindowType: description: The window type over which the session limit is enforced. enum: - daily example: daily type: string x-enum-varnames: ["DAILY"] RumSdkConfigAllowedTracingUrlList: description: A list of URL configurations for distributed tracing. items: $ref: "#/components/schemas/RumSdkConfigTracingUrlConfig" type: array RumSdkConfigAllowedTrackingOriginList: description: A list of origin patterns allowed for cross-origin session tracking. items: $ref: "#/components/schemas/RumSdkConfigMatchOption" type: array RumSdkConfigAttributes: description: Attributes of the RUM SDK configuration. properties: rum: $ref: "#/components/schemas/RumSdkConfigRumAttributes" required: - rum type: object RumSdkConfigData: description: The RUM SDK configuration data object. properties: attributes: $ref: "#/components/schemas/RumSdkConfigAttributes" id: description: The unique identifier of the RUM SDK configuration. example: "abc12345-1234-5678-abcd-ef1234567890" type: string meta: $ref: "#/components/schemas/RumSdkConfigMeta" type: $ref: "#/components/schemas/RumSdkConfigType" required: - id - type - attributes type: object RumSdkConfigDynamicOption: description: A dynamic configuration option that extracts a value at runtime using a specified strategy. properties: attribute: description: The element attribute to read. Used when `strategy` is `dom`. example: "data-version" type: string extractor: $ref: "#/components/schemas/RumSdkConfigSerializedRegex" key: description: The `localStorage` key to read. Required when `strategy` is `localStorage`. example: "app.version" type: string name: description: The cookie name to read. Required when `strategy` is `cookie`. example: "app_version" type: string path: description: The JavaScript path used to extract the value. Required when `strategy` is `js`. example: "application.version" type: string rc_serialized_type: $ref: "#/components/schemas/RumSdkConfigDynamicOptionSerializedType" selector: description: The CSS selector to read from the page. Required when `strategy` is `dom`. example: "#app-version" type: string strategy: $ref: "#/components/schemas/RumSdkConfigDynamicOptionStrategy" required: - rc_serialized_type - strategy type: object RumSdkConfigDynamicOptionPair: description: A key-value pair where the value is a dynamic configuration option. properties: key: description: The key name for this dynamic configuration pair. example: "id" type: string value: $ref: "#/components/schemas/RumSdkConfigDynamicOption" required: - key - value type: object RumSdkConfigDynamicOptionPairList: description: A list of dynamic option key-value pairs. items: $ref: "#/components/schemas/RumSdkConfigDynamicOptionPair" type: array RumSdkConfigDynamicOptionSerializedType: description: The type identifier for a dynamic option. Always `dynamic`. enum: - dynamic example: dynamic type: string x-enum-varnames: - DYNAMIC RumSdkConfigDynamicOptionStrategy: description: The strategy used to extract the dynamic value. enum: - js - cookie - dom - localStorage example: js type: string x-enum-varnames: - JS - COOKIE - DOM - LOCAL_STORAGE RumSdkConfigMatchOption: description: A match option used for URL or origin pattern matching. properties: rc_serialized_type: $ref: "#/components/schemas/RumSdkConfigMatchOptionSerializedType" value: description: The value to match against. example: "https://app.datadoghq.com" type: string required: - rc_serialized_type - value type: object RumSdkConfigMatchOptionSerializedType: description: The type of match pattern, either a literal string or a regex. enum: - string - regex example: string type: string x-enum-varnames: - STRING - REGEX RumSdkConfigMeta: description: Metadata associated with a RUM SDK configuration. properties: updated_at: description: The timestamp of the last update to this configuration. example: "2024-01-15T09:30:00.000Z" format: date-time type: string updated_by: description: The handle of the user who last updated this configuration. example: "user@datadoghq.com" type: string required: - updated_at - updated_by type: object RumSdkConfigResponse: description: Response containing a RUM SDK configuration. properties: data: $ref: "#/components/schemas/RumSdkConfigData" required: - data type: object RumSdkConfigRumAttributes: description: The RUM SDK settings for a configuration. properties: allowed_tracing_urls: $ref: "#/components/schemas/RumSdkConfigAllowedTracingUrlList" allowed_tracking_origins: $ref: "#/components/schemas/RumSdkConfigAllowedTrackingOriginList" application_id: description: The ID of the RUM application this configuration belongs to. example: "f80e917c-3cd0-4048-ade7-1c4c207baa99" type: string context: $ref: "#/components/schemas/RumSdkConfigDynamicOptionPairList" default_privacy_level: description: The default privacy masking level applied to all RUM data. example: "mask-user-input" type: string enable_privacy_for_action_name: description: Whether to mask user-interaction action names for privacy. example: false type: boolean env: description: The environment tag for the RUM application. example: "production" type: string service: description: The service name tag for the RUM application. example: "my-service" type: string session_replay_sample_rate: description: The percentage of collected sessions for which a replay is captured (0–100). example: 10 format: int64 maximum: 100 minimum: 0 type: integer session_sample_rate: description: The percentage of user sessions to collect (0–100). example: 50 format: int64 maximum: 100 minimum: 0 type: integer trace_sample_rate: description: The percentage of requests to forward as APM traces (0–100). example: 100 format: int64 maximum: 100 minimum: 0 type: integer track_session_across_subdomains: description: Whether to share a session across subdomains of the same site. example: false type: boolean user: $ref: "#/components/schemas/RumSdkConfigDynamicOptionPairList" version: $ref: "#/components/schemas/RumSdkConfigDynamicOption" required: - application_id - session_sample_rate - session_replay_sample_rate - default_privacy_level - enable_privacy_for_action_name type: object RumSdkConfigRumUpdateAttributes: description: The RUM SDK settings to apply when updating a configuration. properties: allowed_tracing_urls: $ref: "#/components/schemas/RumSdkConfigAllowedTracingUrlList" allowed_tracking_origins: $ref: "#/components/schemas/RumSdkConfigAllowedTrackingOriginList" context: $ref: "#/components/schemas/RumSdkConfigDynamicOptionPairList" default_privacy_level: description: The default privacy masking level applied to all RUM data. example: "mask" type: string enable_privacy_for_action_name: description: Whether to mask user-interaction action names for privacy. example: true type: boolean env: description: The environment tag for the RUM application. example: "production" type: string service: description: The service name tag for the RUM application. example: "my-service" type: string session_replay_sample_rate: description: The percentage of collected sessions for which a replay is captured (0–100). example: 20 format: int64 maximum: 100 minimum: 0 type: integer session_sample_rate: description: The percentage of user sessions to collect (0–100). example: 75 format: int64 maximum: 100 minimum: 0 type: integer trace_sample_rate: description: The percentage of requests to forward as APM traces (0–100). example: 100 format: int64 maximum: 100 minimum: 0 type: integer track_session_across_subdomains: description: Whether to share a session across subdomains of the same site. example: false type: boolean user: $ref: "#/components/schemas/RumSdkConfigDynamicOptionPairList" version: $ref: "#/components/schemas/RumSdkConfigDynamicOption" required: - session_sample_rate - session_replay_sample_rate - default_privacy_level - enable_privacy_for_action_name type: object RumSdkConfigSerializedRegex: description: A serialized regex used as an extractor in dynamic options. properties: rc_serialized_type: $ref: "#/components/schemas/RumSdkConfigSerializedRegexType" value: description: The regex pattern used for extraction. example: "^https://app-.*.datadoghq.com" type: string required: - rc_serialized_type - value type: object RumSdkConfigSerializedRegexType: description: The type identifier for a serialized regex. Always `regex`. enum: - regex example: regex type: string x-enum-varnames: - REGEX RumSdkConfigTracingUrlConfig: description: Configuration for a URL that should have distributed tracing enabled. properties: match: $ref: "#/components/schemas/RumSdkConfigMatchOption" propagator_types: description: The list of trace propagator types to use for this URL. example: - datadog - tracecontext items: $ref: "#/components/schemas/RumSdkConfigTracingUrlPropagatorType" type: array required: - match - propagator_types type: object RumSdkConfigTracingUrlPropagatorType: description: A trace propagator type. enum: - datadog - b3 - b3multi - tracecontext example: datadog type: string x-enum-varnames: - DATADOG - B3 - B3MULTI - TRACECONTEXT RumSdkConfigType: default: rum_sdk_config description: The type of the resource. The value should always be `rum_sdk_config`. enum: - rum_sdk_config example: rum_sdk_config type: string x-enum-varnames: - RUM_SDK_CONFIG RumSdkConfigUpdateAttributes: description: Attributes of the RUM SDK configuration to update. properties: rum: $ref: "#/components/schemas/RumSdkConfigRumUpdateAttributes" required: - rum type: object RumSdkConfigUpdateData: description: The data object for updating a RUM SDK configuration. properties: attributes: $ref: "#/components/schemas/RumSdkConfigUpdateAttributes" id: description: The ID of the RUM SDK configuration to update. example: "abc12345-1234-5678-abcd-ef1234567890" type: string type: $ref: "#/components/schemas/RumSdkConfigType" required: - id - type - attributes type: object RumSdkConfigUpdateRequest: description: Request body for updating a RUM SDK configuration. properties: data: $ref: "#/components/schemas/RumSdkConfigUpdateData" required: - data type: object RunDataObservabilityMonitorResponse: description: The response returned when a data observability monitor run is triggered. properties: data: $ref: "#/components/schemas/RunDataObservabilityMonitorResponseData" required: - data type: object RunDataObservabilityMonitorResponseData: description: The data object returned when a data observability monitor run is triggered. properties: id: description: The unique identifier of the monitor run. example: "abc123def456" type: string type: $ref: "#/components/schemas/DataObservabilityMonitorRunType" required: - id - type type: object RunHistoricalJobRequest: description: Run a historical job request. properties: data: $ref: "#/components/schemas/RunHistoricalJobRequestData" type: object RunHistoricalJobRequestAttributes: description: Run a historical job request. properties: fromRule: $ref: "#/components/schemas/JobDefinitionFromRule" jobDefinition: $ref: "#/components/schemas/JobDefinition" signalOutput: description: Whether the job outputs signals when results are converted. type: boolean type: object RunHistoricalJobRequestData: description: Data for running a historical job request. properties: attributes: $ref: "#/components/schemas/RunHistoricalJobRequestAttributes" type: $ref: "#/components/schemas/RunHistoricalJobRequestDataType" type: object RunHistoricalJobRequestDataType: description: Type of data. enum: - historicalDetectionsJobCreate type: string x-enum-varnames: - HISTORICALDETECTIONSJOBCREATE RunRetentionFilterName: description: The name of a RUM retention filter. example: "Retention filter for session" type: string SAMLAssertionAttribute: description: SAML assertion attribute. properties: attributes: $ref: "#/components/schemas/SAMLAssertionAttributeAttributes" id: description: The ID of the SAML assertion attribute. example: "0" type: string type: $ref: "#/components/schemas/SAMLAssertionAttributesType" required: - id - type type: object SAMLAssertionAttributeAttributes: description: Key/Value pair of attributes used in SAML assertion attributes. properties: attribute_key: description: Key portion of a key/value pair of the attribute sent from the Identity Provider. example: member-of type: string attribute_value: description: Value portion of a key/value pair of the attribute sent from the Identity Provider. example: Development type: string type: object SAMLAssertionAttributesType: default: saml_assertion_attributes description: SAML assertion attributes resource type. enum: - saml_assertion_attributes example: saml_assertion_attributes type: string x-enum-varnames: - SAML_ASSERTION_ATTRIBUTES SAMLConfiguration: description: A SAML configuration object. properties: attributes: $ref: "#/components/schemas/SAMLConfigurationAttributes" id: description: The UUID of the SAML configuration. example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string relationships: $ref: "#/components/schemas/SAMLConfigurationRelationships" type: $ref: "#/components/schemas/SAMLConfigurationsType" required: - id - type type: object SAMLConfigurationAttributes: description: Attributes of a SAML configuration. properties: assertion_consumer_service: description: The assertion consumer service (ACS) URLs that the identity provider posts SAML responses to. example: - https://app.datadoghq.com/account/saml/assertion items: description: An assertion consumer service URL. example: https://app.datadoghq.com/account/saml/assertion type: string type: array created_at: description: Creation time of the SAML configuration. format: date-time readOnly: true type: string entity_id: description: The service provider entity ID Datadog presents to the identity provider. example: https://app.datadoghq.com/account/saml/metadata.xml?id=00000000-0000-0000-0000-000000000000 type: string expires_at: description: Expiration time of the uploaded identity provider metadata. example: "2010-10-26T13:31:15+00:00" format: date-time nullable: true type: string idp_initiated: description: Whether identity-provider-initiated login is enabled for the organization. example: true type: boolean jit_domains: description: |- Email domains for which users are automatically provisioned on first SAML login (just-in-time provisioning). example: - example.com items: description: An email domain for just-in-time user provisioning. example: example.com type: string type: array modified_at: description: Time of the last SAML configuration modification. format: date-time readOnly: true type: string sso_url: description: |- The single sign-on URL users can visit to start a SAML login. Returns `null` when the organization is identity-provider-initiated and has no subdomain. example: https://app.datadoghq.com/account/login/id/00000000-0000-0000-0000-000000000000 nullable: true type: string type: object SAMLConfigurationRelationships: description: Relationships of a SAML configuration. properties: default_roles: $ref: "#/components/schemas/RelationshipToRoles" type: object SAMLConfigurationResponse: description: Response containing a single SAML configuration. properties: data: $ref: "#/components/schemas/SAMLConfiguration" included: description: Resources related to the SAML configuration, such as the default roles. items: $ref: "#/components/schemas/Role" type: array required: - data type: object SAMLConfigurationUpdateAttributes: description: Attributes for updating a SAML configuration. properties: idp_initiated: description: Whether identity-provider-initiated login is enabled for the organization. example: true type: boolean jit_domains: description: |- Email domains for which users are automatically provisioned on first SAML login (just-in-time provisioning). A default role is required to enable just-in-time provisioning. example: - example.com items: description: An email domain for just-in-time user provisioning. example: example.com maxLength: 255 minLength: 1 type: string maxItems: 50 minItems: 0 type: array type: object SAMLConfigurationUpdateData: description: Data for updating a SAML configuration. properties: attributes: $ref: "#/components/schemas/SAMLConfigurationUpdateAttributes" id: description: The UUID of the SAML configuration to update. Must match the UUID in the URL path. example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d maxLength: 39 type: string relationships: $ref: "#/components/schemas/SAMLConfigurationRelationships" type: $ref: "#/components/schemas/SAMLConfigurationsType" required: - id - type type: object SAMLConfigurationUpdateRequest: description: Request to update a SAML configuration. properties: data: $ref: "#/components/schemas/SAMLConfigurationUpdateData" required: - data type: object SAMLConfigurationsResponse: description: Response containing a list of SAML configurations. properties: data: description: Array of SAML configurations. An organization has at most one SAML configuration. items: $ref: "#/components/schemas/SAMLConfiguration" type: array included: description: Resources related to the SAML configurations, such as the default roles. items: $ref: "#/components/schemas/Role" type: array type: object SAMLConfigurationsType: default: saml_configurations description: SAML configurations resource type. enum: - saml_configurations example: saml_configurations type: string x-enum-varnames: - SAML_CONFIGURATIONS SBOM: description: A single SBOM properties: attributes: $ref: "#/components/schemas/SBOMAttributes" id: description: The unique ID for this SBOM (it is equivalent to the `asset_name` or `asset_name@repo_digest` (Image) example: "github.com/datadog/datadog-agent" type: string type: $ref: "#/components/schemas/SBOMType" type: object SBOMAttributes: description: The JSON:API attributes of the SBOM. properties: bomFormat: description: Specifies the format of the BOM. This helps to identify the file as CycloneDX since BOM do not have a filename convention nor does JSON schema support namespaces. This value MUST be `CycloneDX`. example: CycloneDX type: string components: description: A list of software and hardware components. items: $ref: "#/components/schemas/SBOMComponent" type: array dependencies: description: List of dependencies between components of the SBOM. items: $ref: "#/components/schemas/SBOMComponentDependency" type: array metadata: $ref: "#/components/schemas/SBOMMetadata" serialNumber: description: Every BOM generated has a unique serial number, even if the contents of the BOM have not changed overt time. The serial number follows [RFC-4122](https://datatracker.ietf.org/doc/html/rfc4122) example: urn:uuid:f7119d2f-1vgh-24b5-91f0-12010db72da7 type: string specVersion: $ref: "#/components/schemas/SpecVersion" version: description: It increments when a BOM is modified. The default value is 1. example: 1 format: int64 type: integer required: - bomFormat - specVersion - components - metadata - serialNumber - version - dependencies type: object SBOMComponent: description: Software or hardware component. properties: bom-ref: description: An optional identifier that can be used to reference the component elsewhere in the BOM. example: "pkg:golang/google.golang.org/grpc@1.68.1" type: string licenses: description: The software licenses of the SBOM component. items: $ref: "#/components/schemas/SBOMComponentLicense" type: array name: description: The name of the component. This will often be a shortened, single name of the component. example: "google.golang.org/grpc" type: string properties: description: The custom properties of the component of the SBOM. items: $ref: "#/components/schemas/SBOMComponentProperty" type: array purl: description: Specifies the package-url (purl). The purl, if specified, MUST be valid and conform to the [specification](https://github.com/package-url/purl-spec). example: "pkg:golang/google.golang.org/grpc@1.68.1" type: string supplier: $ref: "#/components/schemas/SBOMComponentSupplier" type: $ref: "#/components/schemas/SBOMComponentType" version: description: The component version. example: "1.68.1" type: string required: - type - name - version - supplier type: object SBOMComponentDependency: description: The dependencies of a component of the SBOM. properties: dependsOn: description: The components that are dependencies of the ref component. items: description: A package URL (purl) identifying a dependency of the component. example: pkg:golang/google.golang.org/grpc@1.68.1 type: string required: - ref - dependsOn type: array ref: description: The identifier for the related component. example: Repository|github.com/datadog/datadog-agent type: string type: object SBOMComponentLicense: description: The software license of the component of the SBOM. properties: license: $ref: "#/components/schemas/SBOMComponentLicenseLicense" required: - license type: object SBOMComponentLicenseLicense: description: The software license of the component of the SBOM. properties: name: description: The name of the software license of the component of the SBOM. example: MIT type: string required: - name type: object SBOMComponentLicenseType: description: The SBOM component license type. enum: - network_strong_copyleft - non_standard_copyleft - other_non_free - other_non_standard - permissive - public_domain - strong_copyleft - weak_copyleft example: application type: string x-enum-varnames: - NETWORK_STRONG_COPYLEFT - NON_STANDARD_COPYLEFT - OTHER_NON_FREE - OTHER_NON_STANDARD - PERMISSIVE - PUBLIC_DOMAIN - STRONG_COPYLEFT - WEAK_COPYLEFT SBOMComponentProperty: description: The custom property of the component of the SBOM. properties: name: description: The name of the custom property of the component of the SBOM. example: license_type type: string value: description: The value of the custom property of the component of the SBOM. example: permissive type: string required: - name - value type: object SBOMComponentSupplier: description: The supplier of the component. properties: name: description: Identifier of the supplier of the component. example: https://go.dev type: string required: - name type: object SBOMComponentType: description: The SBOM component type enum: - application - container - data - device - device-driver - file - firmware - framework - library - machine-learning-model - operating-system - platform example: application type: string x-enum-varnames: - APPLICATION - CONTAINER - DATA - DEVICE - DEVICE_DRIVER - FILE - FIRMWARE - FRAMEWORK - LIBRARY - MACHINE_LEARNING_MODEL - OPERATING_SYSTEM - PLATFORM SBOMFormat: description: The SBOM standard enum: - CycloneDX - SPDX example: CycloneDX type: string x-enum-varnames: - CYCLONEDX - SPDX SBOMMetadata: description: Provides additional information about a BOM. properties: authors: description: List of authors of the SBOM. items: $ref: "#/components/schemas/SBOMMetadataAuthor" type: array component: $ref: "#/components/schemas/SBOMMetadataComponent" timestamp: description: The timestamp of the SBOM creation. example: "2025-07-08T07:24:53Z" type: string type: object SBOMMetadataAuthor: description: Author of the SBOM. properties: name: description: The identifier of the Author of the SBOM. example: "Datadog, Inc." type: string type: object SBOMMetadataComponent: description: The component that the BOM describes. properties: name: description: The name of the component. This will often be a shortened, single name of the component. example: "github.com/datadog/datadog-agent" type: string type: description: Specifies the type of the component. example: application type: string type: object SBOMType: description: The JSON:API type. enum: - sboms example: sboms type: string x-enum-varnames: - SBOMS SLOReportInterval: description: |- The frequency at which report data is to be generated. enum: - daily - weekly - monthly example: weekly type: string x-enum-varnames: - DAILY - WEEKLY - MONTHLY SLOReportPostResponse: description: The SLO report response. properties: data: $ref: "#/components/schemas/SLOReportPostResponseData" type: object SLOReportPostResponseData: description: The data portion of the SLO report response. properties: id: description: The ID of the report job. example: "dc8d92aa-e0af-11ee-af21-1feeaccaa3a3" type: string type: description: The type of ID. example: "report_id" type: string type: object SLOReportStatus: description: The status of the SLO report job. enum: - in_progress - completed - completed_with_errors - failed example: "completed" type: string x-enum-varnames: - IN_PROGRESS - COMPLETED - COMPLETED_WITH_ERRORS - FAILED SLOReportStatusGetResponse: description: The SLO report status response. properties: data: $ref: "#/components/schemas/SLOReportStatusGetResponseData" type: object SLOReportStatusGetResponseAttributes: description: The attributes portion of the SLO report status response. properties: status: $ref: "#/components/schemas/SLOReportStatus" type: object SLOReportStatusGetResponseData: description: The data portion of the SLO report status response. properties: attributes: $ref: "#/components/schemas/SLOReportStatusGetResponseAttributes" id: description: The ID of the report job. example: "dc8d92aa-e0af-11ee-af21-1feeaccaa3a3" type: string type: description: The type of ID. example: "report_id" type: string type: object STIXBundleRequest: additionalProperties: {} description: A STIX 2.1 bundle containing threat intelligence indicator objects. properties: id: description: The STIX bundle identifier. example: bundle--11111111-1111-4111-8111-111111111111 type: string objects: description: >- The STIX objects included in the bundle. Indicator objects are processed and ingested; all other STIX object types are ignored and are not included in the response counters. example: - created: "2026-07-22T12:00:00Z" id: indicator--22222222-2222-4222-8222-222222222222 modified: "2026-07-22T12:00:00Z" pattern: "[ipv4-addr:value = '198.51.100.42']" pattern_type: stix spec_version: "2.1" type: indicator valid_from: "2026-07-22T12:00:00Z" items: $ref: "#/components/schemas/STIXObject" type: array spec_version: $ref: "#/components/schemas/STIXSpecVersion" type: $ref: "#/components/schemas/STIXBundleType" required: - type - id - objects type: object STIXBundleType: description: The STIX object type for a bundle. enum: - bundle example: bundle type: string x-enum-varnames: - BUNDLE STIXContentEncoding: description: The content encoding applied to the request body. enum: - gzip example: gzip type: string x-enum-varnames: - GZIP STIXIngestResponse: description: The response from a completed STIX ingestion request. properties: data: $ref: "#/components/schemas/STIXIngestResponseData" required: - data type: object STIXIngestResponseAttributes: description: Counters describing the result of the STIX ingestion request. properties: accepted: description: The number of supported indicators accepted. example: 1 format: int64 minimum: 0 type: integer invalid: description: The number of indicators with patterns that could not be parsed. example: 0 format: int64 minimum: 0 type: integer unsupported: description: >- The number of indicator objects with an unsupported STIX version or a pattern that produced no supported observable values. example: 0 format: int64 minimum: 0 type: integer required: - accepted - unsupported - invalid type: object STIXIngestResponseData: description: The JSON:API resource describing the completed STIX ingestion request. properties: attributes: $ref: "#/components/schemas/STIXIngestResponseAttributes" id: description: The normalized vendor identifier. example: acme type: string type: $ref: "#/components/schemas/STIXIngestResponseType" required: - type - id - attributes type: object STIXIngestResponseType: description: The STIX ingestion resource type. enum: - threat-intel-stix-ingest example: threat-intel-stix-ingest type: string x-enum-varnames: - THREAT_INTEL_STIX_INGEST STIXMetadataObject: additionalProperties: {} description: An opaque STIX metadata object. type: object STIXObject: additionalProperties: {} description: >- A STIX 2.1 object. Indicator objects are processed and ingested; all other STIX object types are ignored and are not included in the response counters. properties: confidence: description: The confidence in the correctness of the indicator, from 0 through 100. example: 80 format: int32 maximum: 100 minimum: 0 type: integer created: description: The time when the object was created. example: "2026-07-22T12:00:00Z" format: date-time type: string external_references: description: Optional external reference metadata preserved with the indicator but not interpreted during ingestion. items: $ref: "#/components/schemas/STIXMetadataObject" type: array id: description: The STIX object identifier. example: indicator--22222222-2222-4222-8222-222222222222 type: string indicator_types: description: The open vocabulary terms that categorize the indicator. example: - malicious-activity items: type: string type: array kill_chain_phases: description: Optional kill chain metadata preserved with the indicator but not interpreted during ingestion. items: $ref: "#/components/schemas/STIXMetadataObject" type: array labels: description: Labels associated with the indicator. example: - synthetic items: type: string type: array modified: description: The time when the object was last modified. example: "2026-07-22T12:00:00Z" format: date-time type: string object_marking_refs: description: References to marking definition objects that apply to the indicator. example: - marking-definition--33333333-3333-4333-8333-333333333333 items: type: string type: array pattern: description: The STIX pattern that identifies the observable. Present on indicator objects. example: "[ipv4-addr:value = '198.51.100.42']" type: string pattern_type: $ref: "#/components/schemas/STIXPatternType" revoked: description: Whether the indicator has been revoked. example: false type: boolean spec_version: description: The STIX specification version declared on the object. Objects with an unsupported version are accepted and counted in the `unsupported` response counter. example: "2.1" type: string type: description: The STIX object type. example: indicator type: string valid_from: description: The time from which the indicator is considered valid. Present on indicator objects. example: "2026-07-22T12:00:00Z" format: date-time type: string valid_until: description: The time until which the indicator is considered valid. example: "2027-07-22T12:00:00Z" format: date-time type: string required: - type - id type: object STIXPatternType: description: The supported STIX pattern language. enum: - stix example: stix type: string x-enum-varnames: - STIX STIXSpecVersion: description: The supported STIX specification version. enum: - "2.1" example: "2.1" type: string x-enum-varnames: - VERSION_2_1 SampleLogGenerationBulkSubscriptionAttributes: description: The attributes for creating sample log generation subscriptions for multiple content packs. properties: content_pack_ids: description: The identifiers of the Cloud SIEM content packs to subscribe to. At most five content packs can be requested in a single call. example: - aws-cloudtrail items: description: A Cloud SIEM content pack identifier. type: string maxItems: 5 type: array duration: $ref: "#/components/schemas/SampleLogGenerationDuration" required: - content_pack_ids type: object SampleLogGenerationBulkSubscriptionData: description: The bulk subscription request body. properties: attributes: $ref: "#/components/schemas/SampleLogGenerationBulkSubscriptionAttributes" type: $ref: "#/components/schemas/SampleLogGenerationBulkSubscriptionRequestType" required: - type - attributes type: object SampleLogGenerationBulkSubscriptionItemMeta: description: Per-item status returned for a bulk subscription request. properties: error: description: A description of the error encountered for this content pack, if the subscription could not be created. example: content pack does not exist type: string status: description: The HTTP status code that resulted from creating the subscription for this content pack. example: 200 format: int32 maximum: 599 type: integer required: - status type: object SampleLogGenerationBulkSubscriptionRequest: description: Request body to create sample log generation subscriptions for multiple content packs at once. properties: data: $ref: "#/components/schemas/SampleLogGenerationBulkSubscriptionData" required: - data type: object SampleLogGenerationBulkSubscriptionRequestType: default: bulk_subscription_requests description: The type of the resource. The value should always be `bulk_subscription_requests`. enum: - bulk_subscription_requests example: bulk_subscription_requests type: string x-enum-varnames: - BULK_SUBSCRIPTION_REQUESTS SampleLogGenerationBulkSubscriptionResponse: description: Response containing the per-content-pack results of a bulk subscription request. properties: data: description: The list of bulk subscription results, one per requested content pack. items: $ref: "#/components/schemas/SampleLogGenerationBulkSubscriptionResultItem" type: array required: - data type: object SampleLogGenerationBulkSubscriptionResultItem: description: A single result entry returned by the bulk subscription endpoint. properties: attributes: $ref: "#/components/schemas/SampleLogGenerationSubscriptionAttributes" id: description: The unique identifier of the subscription, when one was created. example: "123" type: string meta: $ref: "#/components/schemas/SampleLogGenerationBulkSubscriptionItemMeta" type: $ref: "#/components/schemas/SampleLogGenerationSubscriptionResourceType" required: - id - type - attributes - meta type: object SampleLogGenerationDuration: default: 3d description: How long the subscription should remain active before expiring. enum: - 1h - 1d - 3d - 7d example: 3d type: string x-enum-varnames: - ONE_HOUR - ONE_DAY - THREE_DAYS - SEVEN_DAYS SampleLogGenerationSubscriptionAttributes: description: The attributes describing a sample log generation subscription. properties: content_pack_id: description: The identifier of the Cloud SIEM content pack the subscription targets. example: aws-cloudtrail type: string created_at: description: The time at which the subscription was created. example: "2026-05-08T20:02:13.77481Z" format: date-time type: string expires_at: description: The time at which the subscription expires and stops generating logs. example: "2026-05-11T20:02:13.77481Z" format: date-time type: string is_active: description: Whether the subscription is currently active and generating logs. example: true type: boolean status: $ref: "#/components/schemas/SampleLogGenerationSubscriptionStatus" required: - content_pack_id - status - is_active - created_at - expires_at type: object SampleLogGenerationSubscriptionCreateAttributes: description: The attributes for creating a sample log generation subscription. properties: content_pack_id: description: The identifier of the Cloud SIEM content pack to subscribe to. example: aws-cloudtrail type: string duration: $ref: "#/components/schemas/SampleLogGenerationDuration" required: - content_pack_id type: object SampleLogGenerationSubscriptionCreateData: description: The subscription request body. properties: attributes: $ref: "#/components/schemas/SampleLogGenerationSubscriptionCreateAttributes" type: $ref: "#/components/schemas/SampleLogGenerationSubscriptionRequestType" required: - type - attributes type: object SampleLogGenerationSubscriptionCreateRequest: description: Request body to create a sample log generation subscription for a single content pack. properties: data: $ref: "#/components/schemas/SampleLogGenerationSubscriptionCreateData" required: - data type: object SampleLogGenerationSubscriptionData: description: A sample log generation subscription. properties: attributes: $ref: "#/components/schemas/SampleLogGenerationSubscriptionAttributes" id: description: The unique identifier of the subscription. example: "789" type: string type: $ref: "#/components/schemas/SampleLogGenerationSubscriptionResourceType" required: - id - type - attributes type: object SampleLogGenerationSubscriptionRequestType: default: subscription_requests description: The type of the resource. The value should always be `subscription_requests`. enum: - subscription_requests example: subscription_requests type: string x-enum-varnames: - SUBSCRIPTION_REQUESTS SampleLogGenerationSubscriptionResourceType: default: subscriptions description: The type of the resource. The value should always be `subscriptions`. enum: - subscriptions example: subscriptions type: string x-enum-varnames: - SUBSCRIPTIONS SampleLogGenerationSubscriptionResponse: description: Response containing a single sample log generation subscription. properties: data: $ref: "#/components/schemas/SampleLogGenerationSubscriptionData" required: - data type: object SampleLogGenerationSubscriptionStatus: description: The status of the subscription. enum: - subscribed - renewed - unsubscribed - no_active_subscription - not_available - active - expired example: subscribed type: string x-enum-varnames: - SUBSCRIBED - RENEWED - UNSUBSCRIBED - NO_ACTIVE_SUBSCRIPTION - NOT_AVAILABLE - ACTIVE - EXPIRED SampleLogGenerationSubscriptionsResponse: description: Response containing a list of sample log generation subscriptions. properties: data: description: The list of sample log generation subscriptions. items: $ref: "#/components/schemas/SampleLogGenerationSubscriptionData" type: array meta: $ref: "#/components/schemas/SampleLogGenerationSubscriptionsResponseMeta" required: - data - meta type: object SampleLogGenerationSubscriptionsResponseMeta: description: Metadata returned alongside a list of sample log generation subscriptions. properties: total_subscriptions: description: The total number of subscriptions matching the request, irrespective of pagination. example: 1 format: int32 maximum: 2147483647 type: integer required: - total_subscriptions type: object SampleLogGenerationSubscriptionsStatusFilter: default: active description: Filter that controls whether to return only active subscriptions or every subscription on record. enum: - active - all example: active type: string x-enum-varnames: - ACTIVE - ALL SastRulesetData: description: The primary data object representing a SAST ruleset. properties: attributes: $ref: "#/components/schemas/SastRulesetDataAttributes" id: description: The unique identifier of the ruleset resource. example: python-best-practices type: string type: $ref: "#/components/schemas/GetMultipleRulesetsResponseDataAttributesRulesetsItemsDataType" required: - id - type - attributes type: object SastRulesetDataAttributes: description: The attributes of a SAST ruleset, including its name, description, and rules. properties: description: description: A detailed description of the ruleset's purpose and the types of issues it targets. example: A collection of Python best practice rules. type: string name: description: The unique name of the ruleset. example: python-best-practices type: string rules: description: The list of static analysis rules included in this ruleset. items: $ref: "#/components/schemas/GetMultipleRulesetsResponseDataAttributesRulesetsItemsRulesItems" type: array short_description: description: A brief summary of the ruleset, suitable for display in listings. example: Python best practices ruleset. type: string required: - name - short_description - description - rules type: object SastRulesetResponse: description: The response payload containing a single SAST ruleset and its rules. properties: data: $ref: "#/components/schemas/SastRulesetData" required: - data type: object SastRulesetsResponse: description: The response payload containing a list of SAST rulesets and their rules. properties: data: description: The list of SAST rulesets returned in the response. items: $ref: "#/components/schemas/SastRulesetData" type: array required: - data type: object SavedFilterAPIErrorResponse: additionalProperties: false description: A saved filter authorization error containing at least one error message. properties: errors: description: The authorization error messages. example: - Forbidden - Failed permission authorization checks items: type: string minItems: 1 type: array required: - errors type: object SavedFilterApprovalConflictAttributes: description: One or more feature flags that reference this saved filter require approval for the rule update. properties: approval_required_flags: description: Feature flags preventing this update. items: $ref: "#/components/schemas/SavedFilterFlagReference" type: array message: description: The reason the saved filter update was rejected. example: One or more feature flags that reference this saved filter require approval for the rule update. type: string required: - message - approval_required_flags type: object SavedFilterApprovalConflictData: description: One or more feature flags that reference this saved filter require approval for the rule update. properties: attributes: $ref: "#/components/schemas/SavedFilterApprovalConflictAttributes" id: description: The ID of the saved filter. example: 550e8400-e29b-41d4-a716-446655440090 format: uuid type: string type: $ref: "#/components/schemas/SavedFilterApprovalConflictType" required: - id - type - attributes type: object SavedFilterApprovalConflictResponse: additionalProperties: false description: One or more feature flags that reference this saved filter require approval for the rule update. properties: data: $ref: "#/components/schemas/SavedFilterApprovalConflictData" required: - data type: object SavedFilterApprovalConflictType: description: The resource type for this saved filter update error. enum: - update-approval-conflict example: update-approval-conflict type: string x-enum-varnames: - UPDATE_APPROVAL_CONFLICT SavedFilterAttributes: description: Saved filter details, including the full targeting rules and conditions. properties: archived_at: description: The time the saved filter was archived. Omitted when the filter is not archived. example: "2026-01-03T12:00:00Z" format: date-time type: string created_at: description: The time the saved filter was created. example: "2026-01-01T12:00:00Z" format: date-time type: string created_by: description: The ID of the user who created the saved filter. example: "550e8400-e29b-41d4-a716-446655440091" type: string creation_type: $ref: "#/components/schemas/SavedFilterCreationType" description: description: A description of the saved filter. Omitted when no description is set. example: Users selected by email address or organization ID. type: string migration_metadata: description: Optional JSON metadata supplied by migration tools for tracking the source of a saved filter. example: provider: launchdarkly segment_key: early-access-users name: description: The name of the saved filter. example: Early access users type: string targeting_rules: description: Targeting rules combined with OR. Conditions within each rule are combined with AND. Both saved lists and saved rules use this structure. items: $ref: "#/components/schemas/SavedFilterTargetingRule" type: array updated_at: description: The time the saved filter was last updated. example: "2026-01-02T12:00:00Z" format: date-time type: string required: - name - creation_type - targeting_rules - created_by - created_at - updated_at type: object SavedFilterCondition: description: An inline condition in a saved filter targeting rule. properties: attribute: description: The attribute evaluated by the condition. example: email type: string id: description: The ID of the condition. example: "550e8400-e29b-41d4-a716-446655440093" format: uuid type: string operator: $ref: "#/components/schemas/SavedFilterConditionOperator" value: description: Values used by the condition operator. example: - user@example.com items: type: string type: array required: - id - operator - attribute - value type: object SavedFilterConditionOperator: description: The comparison operator used by a saved filter condition. enum: - LT - LTE - GT - GTE - MATCHES - NOT_MATCHES - ONE_OF - NOT_ONE_OF - IS_NULL - EQUALS - SEMVER_EQ - SEMVER_NEQ - SEMVER_LT - SEMVER_LTE - SEMVER_GT - SEMVER_GTE example: ONE_OF type: string x-enum-varnames: - LT - LTE - GT - GTE - MATCHES - NOT_MATCHES - ONE_OF - NOT_ONE_OF - IS_NULL - EQUALS - SEMVER_EQ - SEMVER_NEQ - SEMVER_LT - SEMVER_LTE - SEMVER_GT - SEMVER_GTE SavedFilterConditionRequest: description: An inline condition to write in a saved filter. Nested saved-filter references are not supported. properties: attribute: description: The attribute evaluated by the condition. example: user_id minLength: 1 type: string operator: $ref: "#/components/schemas/SavedFilterConditionOperator" value: description: Values used by the condition operator. Values must satisfy the selected operator and the organization targeting limits. example: - test-user-1 - test-user-2 items: type: string minItems: 1 type: array required: - operator - attribute - value type: object SavedFilterCreationType: description: How the saved filter was authored. RULES indicates rule-based authoring and LIST indicates list import. Both types return targeting rules and conditions. enum: - RULES - LIST example: RULES type: string x-enum-varnames: - RULES - LIST SavedFilterData: description: A saved filter resource. properties: attributes: $ref: "#/components/schemas/SavedFilterAttributes" id: description: The ID of the saved filter. example: "550e8400-e29b-41d4-a716-446655440090" format: uuid type: string type: $ref: "#/components/schemas/SavedFilterDataType" required: - id - type - attributes type: object SavedFilterDataType: description: The saved filter resource type. enum: - saved-filters example: saved-filters type: string x-enum-varnames: - SAVED_FILTERS SavedFilterFlagReference: description: A feature flag that references the saved filter. properties: id: description: The ID of the feature flag. example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string name: description: The name of the feature flag. example: Early access type: string required: - id - name type: object SavedFilterJSONAPIErrorResponse: additionalProperties: false description: A saved filter error containing at least one JSON:API error object. properties: errors: description: The error details. example: - detail: A saved filter with this name already exists. status: "409" title: Conflict items: $ref: "#/components/schemas/JSONAPIErrorItem" minItems: 1 type: array required: - errors type: object SavedFilterPermissionDeniedAttributes: description: The caller lacks edit permission on one or more feature flags that reference this saved filter. properties: denied_flags: description: Feature flags preventing this update. items: $ref: "#/components/schemas/SavedFilterFlagReference" type: array message: description: The reason the saved filter update was rejected. example: The caller lacks edit permission on one or more feature flags that reference this saved filter. type: string required: - message - denied_flags type: object SavedFilterPermissionDeniedData: description: The caller lacks edit permission on one or more feature flags that reference this saved filter. properties: attributes: $ref: "#/components/schemas/SavedFilterPermissionDeniedAttributes" id: description: The ID of the saved filter. example: 550e8400-e29b-41d4-a716-446655440090 format: uuid type: string type: $ref: "#/components/schemas/SavedFilterPermissionDeniedType" required: - id - type - attributes type: object SavedFilterPermissionDeniedResponse: additionalProperties: false description: The caller lacks edit permission on one or more feature flags that reference this saved filter. properties: data: $ref: "#/components/schemas/SavedFilterPermissionDeniedData" required: - data type: object SavedFilterPermissionDeniedType: description: The resource type for this saved filter update error. enum: - update-grace-denied example: update-grace-denied type: string x-enum-varnames: - UPDATE_GRACE_DENIED SavedFilterResponse: description: Response containing a saved filter and its targeting rules. properties: data: $ref: "#/components/schemas/SavedFilterData" required: - data type: object SavedFilterTargetingRule: description: A targeting rule in a saved filter. A rule matches when all its conditions match. properties: conditions: description: Conditions combined with AND within this targeting rule. items: $ref: "#/components/schemas/SavedFilterCondition" type: array id: description: The ID of the targeting rule. example: "550e8400-e29b-41d4-a716-446655440092" format: uuid type: string required: - id - conditions type: object SavedFilterTargetingRuleRequest: description: A replacement saved filter targeting rule. properties: conditions: description: Inline conditions combined with AND. Must contain at least one condition. items: $ref: "#/components/schemas/SavedFilterConditionRequest" minItems: 1 type: array required: - conditions type: object ScaRequest: description: The top-level request object for submitting a Software Composition Analysis (SCA) scan result. properties: data: $ref: "#/components/schemas/ScaRequestData" type: object ScaRequestData: description: The data object in an SCA request, containing the dependency graph attributes and request type. properties: attributes: $ref: "#/components/schemas/ScaRequestDataAttributes" id: description: An optional identifier for this SCA request data object. type: string type: $ref: "#/components/schemas/ScaRequestDataType" required: - type type: object ScaRequestDataAttributes: description: >- The attributes of an SCA request, containing dependency graph data, vulnerability information, and repository context. properties: commit: $ref: "#/components/schemas/ScaRequestDataAttributesCommit" dependencies: description: The list of dependencies discovered in the repository. items: $ref: "#/components/schemas/ScaRequestDataAttributesDependenciesItems" type: array env: description: The environment context in which the SCA scan was performed (e.g., production, staging). type: string files: description: The list of dependency manifest files found in the repository. items: $ref: "#/components/schemas/ScaRequestDataAttributesFilesItems" type: array relations: description: The dependency relations describing the inter-component dependency graph. items: $ref: "#/components/schemas/ScaRequestDataAttributesRelationsItems" type: array repository: $ref: "#/components/schemas/ScaRequestDataAttributesRepository" scan_start_timestamp: $ref: "#/components/schemas/ScaRequestDataAttributesScanStartTimestamp" service: description: The name of the service or application being analyzed. type: string tags: $ref: "#/components/schemas/ScaRequestDataAttributesTags" vulnerabilities: description: The list of vulnerabilities identified in the dependency graph. items: $ref: "#/components/schemas/ScaRequestDataAttributesVulnerabilitiesItems" type: array type: object ScaRequestDataAttributesCommit: description: >- Metadata about the commit associated with the SCA scan, including author, committer, and branch information. properties: author_date: description: The date when the commit was authored. type: string author_email: description: The email address of the commit author. type: string author_name: description: The full name of the commit author. type: string branch: description: The branch name on which the commit was made. type: string committer_email: description: The email address of the person who committed the change. type: string committer_name: description: The full name of the person who committed the change. type: string sha: description: The SHA hash uniquely identifying the commit. type: string type: object ScaRequestDataAttributesDependenciesItems: description: A dependency found in the repository, including its identity, location, and `reachability metadata`. properties: exclusions: description: A list of patterns or identifiers that should be excluded from analysis for this dependency. items: description: An exclusion pattern or identifier. type: string type: array group: description: The group or organization namespace of the dependency (e.g., Maven group ID). nullable: true type: string is_dev: description: Indicates whether this is a development-only dependency not used in production. type: boolean is_direct: description: Indicates whether this is a direct dependency (as opposed to a transitive one). nullable: true type: boolean language: description: The programming language ecosystem of this dependency (e.g., java, python, javascript). type: string locations: $ref: "#/components/schemas/ScaRequestDataAttributesDependenciesItemsLocations" name: description: The name of the dependency package. type: string opaque: description: Indicates whether dependency details are intentionally opaque. type: boolean package_manager: description: The package manager responsible for this dependency (e.g., maven, pip, npm). type: string purl: description: The Package URL (PURL) uniquely identifying this dependency. type: string reachable_symbol_properties: description: Properties describing symbols from this dependency that are reachable in the application code. items: $ref: "#/components/schemas/ScaRequestDataAttributesDependenciesItemsReachableSymbolPropertiesItems" type: array requires_transitive_enrichment: description: Indicates whether this dependency requires transitive dependency enrichment. type: boolean target_frameworks: description: The target framework identifiers associated with this dependency. items: description: A target framework identifier. type: string type: array version: description: The version of the dependency. nullable: true type: string version_constraint: description: Indicates whether the version value represents a version constraint. type: boolean version_range: description: The version range associated with this dependency when a manifest declares a range. type: string type: object ScaRequestDataAttributesDependenciesItemsLocations: description: The list of source file locations where this dependency is declared. items: $ref: "#/components/schemas/ScaRequestDataAttributesDependenciesItemsLocationsItems" nullable: true type: array ScaRequestDataAttributesDependenciesItemsLocationsItems: description: >- The source code location where a dependency is declared, including block, name, namespace, and version positions within the file. properties: block: $ref: "#/components/schemas/ScaRequestDataAttributesDependenciesItemsLocationsItemsFilePosition" name: $ref: "#/components/schemas/ScaRequestDataAttributesDependenciesItemsLocationsItemsNullableFilePosition" namespace: $ref: "#/components/schemas/ScaRequestDataAttributesDependenciesItemsLocationsItemsNullableFilePosition" version: $ref: "#/components/schemas/ScaRequestDataAttributesDependenciesItemsLocationsItemsNullableFilePosition" type: object ScaRequestDataAttributesDependenciesItemsLocationsItemsFilePosition: description: A range within a file defined by a start and end position, along with the file name. properties: end: $ref: "#/components/schemas/ScaRequestDataAttributesDependenciesItemsLocationsItemsPosition" file_name: description: The name or path of the file containing this location. type: string role: description: The semantic role associated with this file location. type: string start: $ref: "#/components/schemas/ScaRequestDataAttributesDependenciesItemsLocationsItemsPosition" type: object ScaRequestDataAttributesDependenciesItemsLocationsItemsNullableFilePosition: description: A nullable range within a file defined by a start and end position, along with the file name. nullable: true properties: end: $ref: "#/components/schemas/ScaRequestDataAttributesDependenciesItemsLocationsItemsPosition" file_name: description: The name or path of the file containing this location. type: string role: description: The semantic role associated with this file location. type: string start: $ref: "#/components/schemas/ScaRequestDataAttributesDependenciesItemsLocationsItemsPosition" type: object ScaRequestDataAttributesDependenciesItemsLocationsItemsPosition: description: A specific position (line and column) within a source file. properties: col: description: The column number of the position within the line. format: int32 maximum: 2147483647 type: integer line: description: The line number of the position within the file. format: int32 maximum: 2147483647 type: integer type: object ScaRequestDataAttributesDependenciesItemsReachableSymbolPropertiesItems: description: A key-value property describing a reachable symbol within a dependency. properties: name: description: The name of the reachable symbol property. type: string value: description: The value of the reachable symbol property. type: string type: object ScaRequestDataAttributesFilesItems: description: A file entry in the repository associated with a dependency manifest. properties: name: description: The name or path of the file within the repository. type: string purl: description: The Package URL (PURL) associated with the dependency declared in this file. type: string type: object ScaRequestDataAttributesRelationsItems: description: A dependency relation describing which other components a given component depends on. properties: depends_on: description: The list of BOM references that this component directly depends on. items: description: A BOM reference of a dependency. type: string type: array ref: description: The BOM reference of the component that has dependencies. type: string type: object ScaRequestDataAttributesRepository: description: Information about the source code repository being analyzed. properties: url: description: The URL of the repository. type: string type: object ScaRequestDataAttributesScanStartTimestamp: additionalProperties: false description: The time when the SCA scan started. nullable: true properties: nanos: description: Non-negative fractions of a second at nanosecond resolution. format: int32 maximum: 999999999 minimum: 0 type: integer seconds: description: Seconds of UTC time since Unix epoch. format: int64 type: integer type: object ScaRequestDataAttributesTags: additionalProperties: type: string description: A map of tags providing additional metadata for the SCA scan. properties: tool: $ref: "#/components/schemas/ScaRequestDataAttributesTagsTool" type: object ScaRequestDataAttributesTagsTool: additionalProperties: false description: Tool metadata included in SCA tags. properties: generator: $ref: "#/components/schemas/ScaRequestDataAttributesTagsToolGenerator" type: object ScaRequestDataAttributesTagsToolGenerator: additionalProperties: false description: Metadata about the tool that generated the SCA tags. properties: name: description: The name of the tag generator. type: string version: description: The version of the tag generator. type: string type: object ScaRequestDataAttributesVulnerabilitiesItems: description: >- A vulnerability entry from the Software Bill of Materials (SBOM), describing a known security issue and the components it affects. properties: affects: description: The list of components affected by this vulnerability. items: $ref: "#/components/schemas/ScaRequestDataAttributesVulnerabilitiesItemsAffectsItems" type: array bom_ref: description: The unique BOM reference identifier for this vulnerability entry. type: string id: description: The vulnerability identifier (e.g., CVE ID or similar). type: string type: object ScaRequestDataAttributesVulnerabilitiesItemsAffectsItems: description: A reference to a component affected by a vulnerability. properties: ref: description: The BOM reference identifying the affected component. type: string type: object ScaRequestDataType: default: scarequests description: The type identifier for SCA dependency analysis requests. enum: - scarequests example: scarequests type: string x-enum-varnames: - SCAREQUESTS ScalarColumn: description: A single column in a scalar query response. oneOf: - $ref: "#/components/schemas/GroupScalarColumn" - $ref: "#/components/schemas/DataScalarColumn" ScalarColumnTypeGroup: default: group description: The type of column present for groups. enum: - group example: group type: string x-enum-varnames: - GROUP ScalarColumnTypeNumber: default: number description: The type of column present for numbers. enum: - number example: number type: string x-enum-varnames: - NUMBER ScalarFormulaQueryRequest: description: A wrapper request around one scalar query to be executed. properties: data: $ref: "#/components/schemas/ScalarFormulaRequest" required: - data type: object ScalarFormulaQueryResponse: description: A message containing one or more responses to scalar queries. properties: data: $ref: "#/components/schemas/ScalarResponse" errors: description: An error generated when processing a request. type: string type: object ScalarFormulaRequest: description: A single scalar query to be executed. properties: attributes: $ref: "#/components/schemas/ScalarFormulaRequestAttributes" type: $ref: "#/components/schemas/ScalarFormulaRequestType" required: - type - attributes type: object ScalarFormulaRequestAttributes: description: The object describing a scalar formula request. properties: formulas: description: List of formulas to be calculated and returned as responses. items: $ref: "#/components/schemas/QueryFormula" type: array from: description: Start date (inclusive) of the query in milliseconds since the Unix epoch. example: 1568899800000 format: int64 type: integer queries: $ref: "#/components/schemas/ScalarFormulaRequestQueries" to: description: End date (exclusive) of the query in milliseconds since the Unix epoch. example: 1568923200000 format: int64 type: integer required: - to - from - queries type: object ScalarFormulaRequestQueries: description: List of queries to be run and used as inputs to the formulas. example: - aggregator: avg data_source: metrics query: "avg:system.cpu.user{*} by {env}" items: $ref: "#/components/schemas/ScalarQuery" type: array ScalarFormulaRequestType: default: "scalar_request" description: The type of the resource. The value should always be scalar_request. enum: ["scalar_request"] example: "scalar_request" type: string x-enum-varnames: ["SCALAR_REQUEST"] ScalarFormulaResponseAtrributes: description: The object describing a scalar response. properties: columns: description: List of response columns, each corresponding to an individual formula or query in the request and with values in parallel arrays matching the series list. items: $ref: "#/components/schemas/ScalarColumn" type: array type: object ScalarFormulaResponseType: default: "scalar_response" description: The type of the resource. The value should always be scalar_response. enum: ["scalar_response"] example: "scalar_response" type: string x-enum-varnames: ["SCALAR_RESPONSE"] ScalarMeta: description: Metadata for the resulting numerical values. properties: unit: description: |- Detailed information about the unit. First element describes the "primary unit" (for example, `bytes` in `bytes per second`). The second element describes the "per unit" (for example, `second` in `bytes per second`). If the second element is not present, the API returns null. items: $ref: "#/components/schemas/Unit" nullable: true type: array type: object ScalarQuery: description: An individual scalar query to one of the basic Datadog data sources. example: aggregator: avg data_source: metrics query: "avg:system.cpu.user{*} by {env}" oneOf: - $ref: "#/components/schemas/MetricsScalarQuery" - $ref: "#/components/schemas/EventsScalarQuery" - $ref: "#/components/schemas/ApmResourceStatsQuery" - $ref: "#/components/schemas/ApmMetricsQuery" - $ref: "#/components/schemas/ApmDependencyStatsQuery" - $ref: "#/components/schemas/SloQuery" - $ref: "#/components/schemas/ProcessScalarQuery" - $ref: "#/components/schemas/ContainerScalarQuery" ScalarResponse: description: A message containing the response to a scalar query. properties: attributes: $ref: "#/components/schemas/ScalarFormulaResponseAtrributes" type: $ref: "#/components/schemas/ScalarFormulaResponseType" type: object ScanResultResponse: description: |- The raw scan result document produced by the SCA processor. The contents reflect the vulnerabilities and metadata produced for the libraries submitted in the original scan request. oneOf: - $ref: "#/components/schemas/AnyValueObject" ScannedAssetMetadata: description: The metadata of a scanned asset. properties: attributes: $ref: "#/components/schemas/ScannedAssetMetadataAttributes" id: description: The ID of the scanned asset metadata. example: "Host|i-0fc7edef1ab26d7ef" type: string type: $ref: "#/components/schemas/ScannedAssetMetadataType" required: - id - type - attributes type: object ScannedAssetMetadataAsset: description: The asset of a scanned asset metadata. properties: name: description: The name of the asset. example: "i-0fc7edef1ab26d7ef" type: string type: $ref: "#/components/schemas/CloudAssetType" required: - type - name type: object ScannedAssetMetadataAttributes: description: The attributes of a scanned asset metadata. properties: asset: $ref: "#/components/schemas/ScannedAssetMetadataAsset" first_success_timestamp: description: The timestamp when the scan of the asset was performed for the first time. example: "2025-07-08T07:24:53Z" type: string last_success: $ref: "#/components/schemas/ScannedAssetMetadataLastSuccess" required: - asset - last_success - first_success_timestamp type: object ScannedAssetMetadataLastSuccess: description: Metadata for the last successful scan of an asset. properties: env: description: The environment of the last success scan of the asset. example: "prod" type: string origin: description: The list of origins of the last success scan of the asset. example: - production items: description: An origin identifier for the last successful scan of the asset. example: production type: string type: array timestamp: description: The timestamp of the last success scan of the asset. example: "2025-07-08T07:24:53Z" type: string required: - timestamp type: object ScannedAssetMetadataType: description: The JSON:API type. enum: - scanned-assets-metadata example: scanned-assets-metadata type: string x-enum-varnames: - SCANNED_ASSETS_METADATA ScannedAssetsMetadata: description: The expected response schema when listing scanned assets metadata. properties: data: description: List of scanned assets metadata. items: $ref: "#/components/schemas/ScannedAssetMetadata" type: array links: $ref: "#/components/schemas/Links" meta: $ref: "#/components/schemas/Metadata" required: - data type: object Schedule: description: Top-level container for a schedule object, including both the `data` payload and any related `included` resources (such as teams, layers, or members). example: data: attributes: max_responders: 1 name: On-Call Schedule time_zone: America/New_York id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d relationships: layers: data: - id: 00000000-0000-0000-0000-000000000001 type: layers teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: schedules included: - attributes: avatar: "" description: Team 1 description handle: team1 name: Team 1 id: 00000000-da3a-0000-0000-000000000000 type: teams - attributes: effective_date: "2025-02-03T05:00:00Z" end_date: "2025-12-31T00:00:00Z" interval: days: 1 name: Layer 1 restrictions: - end_day: friday end_time: "17:00:00" start_day: monday start_time: "09:00:00" rotation_start: "2025-02-01T00:00:00Z" id: 00000000-0000-0000-0000-000000000001 relationships: members: data: - id: 00000000-0000-0000-0000-000000000002 type: members type: layers - id: 00000000-0000-0000-0000-000000000002 relationships: user: data: id: 00000000-aba1-0000-0000-000000000000 type: users type: members - attributes: email: foo@bar.com name: User 1 id: 00000000-aba1-0000-0000-000000000000 type: users properties: data: $ref: "#/components/schemas/ScheduleData" included: description: Any additional resources related to this schedule, such as teams and layers. items: $ref: "#/components/schemas/ScheduleDataIncludedItem" type: array type: object ScheduleCreateRequest: description: The top-level request body for schedule creation, wrapping a `data` object. example: data: attributes: layers: - effective_date: "2025-02-03T05:00:00Z" end_date: "2025-12-31T00:00:00Z" interval: days: 1 members: - user: id: 00000000-aba1-0000-0000-000000000000 name: Layer 1 restrictions: - end_day: friday end_time: "17:00:00" start_day: monday start_time: "09:00:00" rotation_start: "2025-02-01T00:00:00Z" max_responders: 1 name: On-Call Schedule time_zone: America/New_York relationships: teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: schedules properties: data: $ref: "#/components/schemas/ScheduleCreateRequestData" required: - data type: object ScheduleCreateRequestData: description: The core data wrapper for creating a schedule, encompassing attributes, relationships, and the resource type. properties: attributes: $ref: "#/components/schemas/ScheduleCreateRequestDataAttributes" relationships: $ref: "#/components/schemas/ScheduleCreateRequestDataRelationships" type: $ref: "#/components/schemas/ScheduleCreateRequestDataType" required: - type - attributes type: object ScheduleCreateRequestDataAttributes: description: Describes the main attributes for creating a new schedule, including name, layers, and time zone. properties: layers: description: The layers of On-Call coverage that define rotation intervals and restrictions. items: $ref: "#/components/schemas/ScheduleCreateRequestDataAttributesLayersItems" type: array max_responders: description: |- Maximum number of users who can be on call at the same time. The value must be between 1 and the number of layers, and no greater than 10. example: 1 format: int64 maximum: 10 minimum: 1 type: integer name: description: A human-readable name for the new schedule. example: Team A On-Call type: string time_zone: description: The time zone in which the schedule is defined. example: America/New_York type: string required: - name - time_zone - layers type: object ScheduleCreateRequestDataAttributesLayersItems: description: |- Describes a schedule layer, including rotation intervals, members, restrictions, and timeline settings. properties: effective_date: description: The date/time when this layer becomes active (in ISO 8601). example: "2025-01-01T00:00:00Z" format: date-time type: string end_date: description: The date/time after which this layer no longer applies (in ISO 8601). format: date-time type: string interval: $ref: "#/components/schemas/LayerAttributesInterval" members: description: A list of members who participate in this layer's rotation. items: $ref: "#/components/schemas/ScheduleRequestDataAttributesLayersItemsMembersItems" type: array name: description: The name of this layer. example: Primary On-Call Layer type: string restrictions: description: Zero or more time-based restrictions (for example, only weekdays, during business hours). items: $ref: "#/components/schemas/TimeRestriction" type: array rotation_start: description: The date/time when the rotation for this layer starts (in ISO 8601). example: "2025-01-01T00:00:00Z" format: date-time type: string time_zone: description: The time zone for this layer. example: "America/New_York" type: string required: - name - interval - rotation_start - effective_date - members type: object ScheduleCreateRequestDataRelationships: description: Gathers relationship objects for the schedule creation request, including the teams to associate. properties: teams: $ref: "#/components/schemas/DataRelationshipsTeams" type: object ScheduleCreateRequestDataType: default: schedules description: |- Schedules resource type. enum: - schedules example: schedules type: string x-enum-varnames: - SCHEDULES ScheduleData: description: Represents the primary data object for a schedule, linking attributes and relationships. properties: attributes: $ref: "#/components/schemas/ScheduleDataAttributes" id: description: The schedule's unique identifier. example: "3653d3c6-0c75-11ea-ad28-fb5701eabc7d" type: string relationships: $ref: "#/components/schemas/ScheduleDataRelationships" type: $ref: "#/components/schemas/ScheduleDataType" required: - type type: object ScheduleDataAttributes: description: Provides core properties of a schedule object such as its name and time zone. properties: max_responders: description: |- Maximum number of users who can be on call at the same time. The value is between 1 and the number of layers, and no greater than 10. example: 1 format: int64 maximum: 10 minimum: 1 type: integer name: description: A short name for the schedule. example: Primary On-Call type: string tags: description: A list of tags associated with the schedule. items: type: string type: array time_zone: description: The time zone in which this schedule operates. example: America/New_York type: string type: object ScheduleDataIncludedItem: description: Any additional resources related to this schedule, such as teams and layers. oneOf: - $ref: "#/components/schemas/TeamReference" - $ref: "#/components/schemas/Layer" - $ref: "#/components/schemas/ScheduleMember" - $ref: "#/components/schemas/ScheduleUser" ScheduleDataRelationships: description: Groups the relationships for a schedule object, referencing layers and teams. properties: layers: $ref: "#/components/schemas/ScheduleDataRelationshipsLayers" teams: $ref: "#/components/schemas/DataRelationshipsTeams" type: object ScheduleDataRelationshipsLayers: description: Associates layers with this schedule in a data structure. properties: data: description: An array of layer references for this schedule. items: $ref: "#/components/schemas/ScheduleDataRelationshipsLayersDataItems" type: array type: object ScheduleDataRelationshipsLayersDataItems: description: |- Relates a layer to this schedule, identified by `id` and `type` (must be `layers`). properties: id: description: The unique identifier of the layer in this relationship. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/ScheduleDataRelationshipsLayersDataItemsType" required: - type - id type: object ScheduleDataRelationshipsLayersDataItemsType: default: layers description: |- Layers resource type. enum: - layers example: layers type: string x-enum-varnames: - LAYERS ScheduleDataType: default: schedules description: |- Schedules resource type. enum: - schedules example: schedules type: string x-enum-varnames: - SCHEDULES ScheduleListItem: description: Represents a summary of a schedule, linking its core attributes and team relationships. properties: attributes: $ref: "#/components/schemas/ScheduleDataAttributes" id: description: The schedule's unique identifier. example: "3653d3c6-0c75-11ea-ad28-fb5701eabc7d" type: string relationships: $ref: "#/components/schemas/ScheduleListItemRelationships" type: $ref: "#/components/schemas/ScheduleDataType" required: - id - type type: object ScheduleListItemRelationships: description: Groups the relationships for a schedule summary, referencing its teams. properties: teams: $ref: "#/components/schemas/DataRelationshipsTeams" type: object ScheduleMember: description: Represents a single member entry in a schedule, referencing a specific user. properties: id: description: The unique identifier for this schedule member. type: string relationships: $ref: "#/components/schemas/ScheduleMemberRelationships" type: $ref: "#/components/schemas/ScheduleMemberType" required: - type type: object ScheduleMemberRelationships: description: Defines relationships for a schedule member, primarily referencing a single user. properties: user: $ref: "#/components/schemas/ScheduleMemberRelationshipsUser" type: object ScheduleMemberRelationshipsUser: description: Wraps the user data reference for a schedule member. properties: data: $ref: "#/components/schemas/ScheduleMemberRelationshipsUserData" required: - data type: object ScheduleMemberRelationshipsUserData: description: Points to the user data associated with this schedule member, including an ID and type. properties: id: description: The user's unique identifier. example: "00000000-aba1-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/ScheduleMemberRelationshipsUserDataType" required: - type - id type: object ScheduleMemberRelationshipsUserDataType: default: users description: |- Users resource type. enum: - users example: users type: string x-enum-varnames: - USERS ScheduleMemberType: default: members description: |- Schedule Members resource type. enum: - members example: members type: string x-enum-varnames: - MEMBERS ScheduleOnCallResponderData: description: Represents one position's (previous, current, or next) group of on-call responder shifts. Positions with no matching shift are omitted entirely from the response. properties: attributes: $ref: "#/components/schemas/ScheduleOnCallResponderDataAttributes" id: description: Unique identifier of this responder group. type: string relationships: $ref: "#/components/schemas/ScheduleOnCallResponderDataRelationships" type: $ref: "#/components/schemas/ScheduleOnCallResponderDataType" required: - type type: object ScheduleOnCallResponderDataAttributes: description: Attributes for one position's (previous, current, or next) group of on-call responder shifts. properties: position: $ref: "#/components/schemas/ScheduleTargetPosition" type: object ScheduleOnCallResponderDataRelationships: description: Relationships for a single position's (previous, current, or next) responder group. properties: shifts: $ref: "#/components/schemas/ScheduleOnCallResponderDataRelationshipsShifts" type: object ScheduleOnCallResponderDataRelationshipsShifts: description: Defines the list of shifts satisfying this responder group's position. Multiple shifts occur when a schedule has multiple concurrent on-call responders at that position. properties: data: description: Array of references to the shifts included in the response. items: $ref: "#/components/schemas/ScheduleOnCallResponderDataRelationshipsShiftsDataItems" type: array type: object ScheduleOnCallResponderDataRelationshipsShiftsDataItems: description: Represents a reference to one of the shifts satisfying this responder group's position. properties: id: description: Unique identifier of the shift. example: "00000000-0000-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/ScheduleOnCallResponderDataRelationshipsShiftsDataItemsType" required: - type - id type: object ScheduleOnCallResponderDataRelationshipsShiftsDataItemsType: default: shifts description: "Indicates that the related resource is of type `shifts`." enum: - shifts example: shifts type: string x-enum-varnames: - SHIFTS ScheduleOnCallResponderDataType: default: schedule_oncall_responder description: Represents the resource type for a single position's (previous, current, or next) group of on-call responder shifts. enum: - schedule_oncall_responder example: schedule_oncall_responder type: string x-enum-varnames: - SCHEDULE_ONCALL_RESPONDER ScheduleOnCallResponders: description: Root object representing a schedule's on-call responders, grouped by position (previous, current, next), for a given point in time. example: data: attributes: scheduled_at: "2024-05-07T02:53:01.000000000Z" id: "3653d3c6-0c75-11ea-ad28-fb5701eabc7d-1715054400" relationships: responders: data: - id: "3653d3c6-0c75-11ea-ad28-fb5701eabc7d-1715054400-current" type: schedule_oncall_responder schedule: data: id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: schedules type: schedule_oncall_responders included: - attributes: position: current id: "3653d3c6-0c75-11ea-ad28-fb5701eabc7d-1715054400-current" relationships: shifts: data: - id: 00000000-0000-0000-0000-000000000000 type: shifts type: schedule_oncall_responder - attributes: end: "2024-05-08T02:53:01.000000000Z" start: "2024-05-07T02:53:01.000000000Z" id: 00000000-0000-0000-0000-000000000000 relationships: user: data: id: 00000000-aba1-0000-0000-000000000000 type: users type: shifts - attributes: email: test@test.com name: Test User status: active id: 00000000-aba1-0000-0000-000000000000 type: users properties: data: $ref: "#/components/schemas/ScheduleOnCallRespondersData" included: description: Related resources referenced in the responder groups' relationships, such as shifts, schedules, and users. items: $ref: "#/components/schemas/ScheduleOnCallRespondersIncluded" type: array type: object ScheduleOnCallRespondersData: description: The main data object representing a schedule's on-call responders lookup, including relationships and metadata. properties: attributes: $ref: "#/components/schemas/ScheduleOnCallRespondersDataAttributes" id: description: Unique identifier of this on-call responders lookup. type: string relationships: $ref: "#/components/schemas/ScheduleOnCallRespondersDataRelationships" type: $ref: "#/components/schemas/ScheduleOnCallRespondersDataType" required: - type type: object ScheduleOnCallRespondersDataAttributes: description: Attributes for a schedule's on-call responders lookup. properties: scheduled_at: description: The timestamp the responders were resolved at. format: date-time type: string type: object ScheduleOnCallRespondersDataRelationships: description: Relationships for a schedule's on-call responders lookup, including the schedule and its responder groups. properties: responders: $ref: "#/components/schemas/ScheduleOnCallRespondersDataRelationshipsResponders" schedule: $ref: "#/components/schemas/ScheduleOnCallRespondersDataRelationshipsSchedule" type: object ScheduleOnCallRespondersDataRelationshipsResponders: description: Defines the list of per-position (previous, current, next) responder groups for the schedule. properties: data: description: Array of references to the responder groups included in the response. items: $ref: "#/components/schemas/ScheduleOnCallRespondersDataRelationshipsRespondersDataItems" type: array type: object ScheduleOnCallRespondersDataRelationshipsRespondersDataItems: description: Represents a reference to one position's (previous, current, or next) responder group. properties: id: description: Unique identifier of the responder group. example: "" type: string type: $ref: "#/components/schemas/ScheduleOnCallRespondersDataRelationshipsRespondersDataItemsType" required: - type - id type: object ScheduleOnCallRespondersDataRelationshipsRespondersDataItemsType: default: schedule_oncall_responder description: Identifies the resource type for a responder group linked to a schedule's on-call responders lookup. enum: - schedule_oncall_responder example: schedule_oncall_responder type: string x-enum-varnames: - SCHEDULE_ONCALL_RESPONDER ScheduleOnCallRespondersDataRelationshipsSchedule: description: Defines the relationship to the schedule this on-call responders lookup was performed for. properties: data: $ref: "#/components/schemas/ScheduleOnCallRespondersDataRelationshipsScheduleData" type: object ScheduleOnCallRespondersDataRelationshipsScheduleData: description: Represents a reference to the schedule this on-call responders lookup was performed for. properties: id: description: Unique identifier of the schedule. example: "3653d3c6-0c75-11ea-ad28-fb5701eabc7d" type: string type: $ref: "#/components/schemas/ScheduleOnCallRespondersDataRelationshipsScheduleDataType" required: - type - id type: object ScheduleOnCallRespondersDataRelationshipsScheduleDataType: default: schedules description: Identifies the resource type for the schedule associated with this on-call responders lookup. enum: - schedules example: schedules type: string x-enum-varnames: - SCHEDULES ScheduleOnCallRespondersDataType: default: schedule_oncall_responders description: Represents the resource type for a schedule's grouped on-call responders across the previous, current, and next positions. enum: - schedule_oncall_responders example: schedule_oncall_responders type: string x-enum-varnames: - SCHEDULE_ONCALL_RESPONDERS ScheduleOnCallRespondersIncluded: description: Represents a union of related resources included in the response, such as responder groups, shifts, schedules, and users. oneOf: - $ref: "#/components/schemas/ScheduleOnCallResponderData" - $ref: "#/components/schemas/ShiftData" - $ref: "#/components/schemas/ScheduleData" - $ref: "#/components/schemas/User" ScheduleRequestDataAttributesLayersItemsMembersItems: description: |- Defines a single member within a schedule layer, including the reference to the underlying user. properties: user: $ref: "#/components/schemas/ScheduleRequestDataAttributesLayersItemsMembersItemsUser" type: object ScheduleRequestDataAttributesLayersItemsMembersItemsUser: description: Identifies the user participating in this layer as a single object with an `id`. properties: id: description: The user's ID. example: "00000000-aba1-0000-0000-000000000000" type: string type: object ScheduleTarget: description: "Represents a schedule target for an escalation policy step, including its ID and resource type. This is a shortcut for a configured schedule target with position set to 'current'." properties: id: description: "Specifies the unique identifier of the schedule resource." example: "00000000-aba1-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/ScheduleTargetType" required: - type - id type: object ScheduleTargetPosition: description: "Specifies the position of a schedule target (example `previous`, `current`, or `next`)." enum: - previous - current - next example: previous type: string x-enum-varnames: - PREVIOUS - CURRENT - NEXT ScheduleTargetType: default: schedules description: "Indicates that the resource is of type `schedules`." enum: - schedules example: schedules type: string x-enum-varnames: - SCHEDULES ScheduleTrigger: description: "Trigger a workflow from a Schedule. The workflow must be published." properties: overlapBehavior: $ref: "#/components/schemas/ScheduleTriggerOverlapBehavior" rruleExpression: description: "Recurrence rule expression for scheduling." example: "" type: string required: - rruleExpression type: object ScheduleTriggerOverlapBehavior: default: EXCLUSIVE_RUN description: Controls whether a scheduled workflow run may start while another instance is still running. enum: - EXCLUSIVE_RUN - OVERLAP_ALLOWED example: EXCLUSIVE_RUN type: string x-enum-varnames: - EXCLUSIVE_RUN - OVERLAP_ALLOWED ScheduleTriggerWrapper: description: "Schema for a Schedule-based trigger." properties: scheduleTrigger: $ref: "#/components/schemas/ScheduleTrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - scheduleTrigger type: object ScheduleUpdateRequest: description: A top-level wrapper for a schedule update request, referring to the `data` object with the new details. example: data: attributes: layers: - effective_date: "2025-02-03T05:00:00Z" end_date: "2025-12-31T00:00:00Z" interval: seconds: 3600 members: - user: id: 00000000-aba1-0000-0000-000000000000 name: Layer 1 restrictions: - end_day: friday end_time: "17:00:00" start_day: monday start_time: "09:00:00" rotation_start: "2025-02-01T00:00:00Z" max_responders: 1 name: On-Call Schedule Updated time_zone: America/New_York id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d relationships: teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: schedules properties: data: $ref: "#/components/schemas/ScheduleUpdateRequestData" required: - data type: object ScheduleUpdateRequestData: description: Contains all data needed to update an existing schedule, including its attributes (such as name and time zone) and any relationships to teams. properties: attributes: $ref: "#/components/schemas/ScheduleUpdateRequestDataAttributes" id: description: The ID of the schedule to be updated. example: "3653d3c6-0c75-11ea-ad28-fb5701eabc7d" type: string relationships: $ref: "#/components/schemas/ScheduleUpdateRequestDataRelationships" type: $ref: "#/components/schemas/ScheduleUpdateRequestDataType" required: - type - id - attributes type: object ScheduleUpdateRequestDataAttributes: description: |- Defines the updatable attributes for a schedule, such as name, time zone, and layers. properties: layers: description: The updated list of layers (rotations) for this schedule. items: $ref: "#/components/schemas/ScheduleUpdateRequestDataAttributesLayersItems" type: array max_responders: description: |- Maximum number of users who can be on call at the same time. The value must be between 1 and the number of layers, and no greater than 10. example: 1 format: int64 maximum: 10 minimum: 1 type: integer name: description: A short name for the schedule. example: Primary On-Call type: string time_zone: description: The time zone used when interpreting rotation times. example: America/New_York type: string required: - name - time_zone - layers type: object ScheduleUpdateRequestDataAttributesLayersItems: description: |- Represents a layer within a schedule update, including rotation details, members, and optional restrictions. properties: effective_date: description: When this updated layer takes effect (ISO 8601 format). example: "2025-02-03T05:00:00Z" format: date-time type: string end_date: description: When this updated layer should stop being active (ISO 8601 format). example: "2025-12-31T00:00:00Z" format: date-time type: string id: description: A unique identifier for the layer being updated. example: "00000000-0000-0000-0000-000000000001" type: string interval: $ref: "#/components/schemas/LayerAttributesInterval" members: description: The members assigned to this layer. items: $ref: "#/components/schemas/ScheduleRequestDataAttributesLayersItemsMembersItems" type: array name: description: The name for this layer (for example, "Secondary Coverage"). example: "Primary On-Call Layer" type: string restrictions: description: Any time restrictions that define when this layer is active. items: $ref: "#/components/schemas/TimeRestriction" type: array rotation_start: description: The date/time at which the rotation begins (ISO 8601 format). example: "2025-02-01T00:00:00Z" format: date-time type: string time_zone: description: The time zone for this layer. example: "America/New_York" type: string required: - effective_date - interval - members - name - rotation_start type: object ScheduleUpdateRequestDataRelationships: description: |- Houses relationships for the schedule update, typically referencing teams. properties: teams: $ref: "#/components/schemas/DataRelationshipsTeams" type: object ScheduleUpdateRequestDataType: default: schedules description: |- Schedules resource type. enum: - schedules example: schedules type: string x-enum-varnames: - SCHEDULES ScheduleUser: description: Represents a user object in the context of a schedule, including their `id`, type, and basic attributes. properties: attributes: $ref: "#/components/schemas/ScheduleUserAttributes" id: description: The unique user identifier. example: "00000000-0000-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/ScheduleUserType" required: - type - id type: object ScheduleUserAttributes: description: Provides basic user information for a schedule, including a name and email address. properties: color: description: "The user's on-call color, as a hex code (for example, `#FF0000`). Included only when `user.color` is requested in the `include` parameter." example: "#FF0000" type: string email: description: The user's email address. example: "jane.doe@example.com" type: string name: description: The user's name. example: "Jane Doe" type: string status: $ref: "#/components/schemas/UserAttributesStatus" type: object ScheduleUserType: default: users description: |- Users resource type. enum: - users example: users type: string x-enum-varnames: - USERS Schedules: description: A list of schedules with pagination metadata and any related included resources (such as teams). example: data: - attributes: max_responders: 1 name: Primary On-Call tags: [] time_zone: America/New_York id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d relationships: teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: schedules meta: page: first_number: 0 last_number: 0 next_number: number: 0 prev_number: size: 10 total: 1 type: number_size properties: data: description: A list of schedules. items: $ref: "#/components/schemas/ScheduleListItem" type: array included: description: Any additional resources related to the schedules, such as teams. items: $ref: "#/components/schemas/TeamReference" type: array meta: $ref: "#/components/schemas/SchedulesResponseMeta" type: object SchedulesResponseMeta: description: Metadata that is included in the response when listing On-Call resources. properties: page: $ref: "#/components/schemas/SchedulesResponseMetaPage" type: object SchedulesResponseMetaPage: description: Metadata related to pagination information that is included in the response when listing On-Call resources. properties: first_number: description: First page number. format: int64 type: integer last_number: description: Last page number. format: int64 type: integer next_number: description: Next page number. format: int64 nullable: true type: integer number: description: Page number. format: int64 type: integer prev_number: description: Previous page number. format: int64 nullable: true type: integer size: description: Page size. format: int64 type: integer total: description: Total number of results. format: int64 type: integer type: description: Pagination type. example: "number_size" type: string type: object ScorecardListResponseAttributes: description: Scorecard attributes. properties: created_at: description: Creation time of the scorecard. example: "2023-01-15T10:30:00Z" format: date-time type: string description: description: The description of the scorecard. example: Best practices for observability. type: string modified_at: description: Time of last scorecard modification. example: "2024-01-05T14:20:00Z" format: date-time type: string name: description: The name of the scorecard. example: Observability Best Practices type: string required: - name - created_at - modified_at type: object ScorecardListResponseData: description: Scorecard data. properties: attributes: $ref: "#/components/schemas/ScorecardListResponseAttributes" id: description: The unique ID of the scorecard. example: q8MQxk8TCqrHnWkx type: string type: $ref: "#/components/schemas/ScorecardListType" required: - id - type - attributes type: object ScorecardListType: description: The JSON:API type for scorecard list. enum: - scorecard example: scorecard type: string x-enum-varnames: - SCORECARD ScorecardScoreAttributes: description: Attributes of a scorecard score. properties: aggregation: $ref: "#/components/schemas/ScorecardScoresAggregation" denominator: description: The denominator used to compute the score ratio. format: int64 type: integer level: description: The maturity level of the associated rule. format: int64 type: integer numerator: description: The numerator used to compute the score ratio. format: int64 type: integer score: description: The computed score ratio (numerator/denominator), from 0 to 1. format: double type: number total_entities: description: The total number of entities evaluated. format: int64 type: integer total_fail: description: The number of rules that failed. format: int64 type: integer total_no_data: description: The number of rules with no data. format: int64 type: integer total_pass: description: The number of rules that passed. format: int64 type: integer total_skip: description: The number of rules that were skipped. format: int64 type: integer type: object ScorecardScoreData: description: A scorecard score object for a single entity, rule, scorecard, service, or team. properties: attributes: $ref: "#/components/schemas/ScorecardScoreAttributes" id: description: The ID of the entity or resource being scored. example: "" type: string relationships: $ref: "#/components/schemas/ScorecardScoreRelationships" type: $ref: "#/components/schemas/ScorecardScoreDataType" required: - id - type type: object ScorecardScoreDataType: default: score description: The JSON:API resource type. enum: [score] example: score type: string x-enum-varnames: - SCORE ScorecardScoreRelationshipData: description: A relationship data object for a score. properties: id: description: The ID of the related resource. example: "" type: string type: description: The type of the related resource. example: "" type: string required: - id - type type: object ScorecardScoreRelationshipItem: description: A relationship item for a score. properties: data: $ref: "#/components/schemas/ScorecardScoreRelationshipData" type: object ScorecardScoreRelationships: description: Relationships for a scorecard score, depending on the aggregation type. properties: entity: $ref: "#/components/schemas/ScorecardScoreRelationshipItem" rule: $ref: "#/components/schemas/ScorecardScoreRelationshipItem" scorecard: $ref: "#/components/schemas/ScorecardScoreRelationshipItem" service: $ref: "#/components/schemas/ScorecardScoreRelationshipItem" team: $ref: "#/components/schemas/ScorecardScoreRelationshipItem" type: object ScorecardScoresAggregation: description: Dimension to group scores by. enum: [by-entity, by-rule, by-scorecard, by-team, by-kind] example: by-entity type: string x-enum-varnames: - BY_ENTITY - BY_RULE - BY_SCORECARD - BY_TEAM - BY_KIND ScorecardType: default: scorecard description: The JSON:API type for scorecard. enum: - scorecard example: scorecard type: string x-enum-varnames: - SCORECARD SearchIssuesIncludeQueryParameterItem: description: Relationship object that should be included in the search response. enum: - issue - issue.assignee - issue.case - issue.team_owners example: "issue.case" type: string x-enum-varnames: - ISSUE - ISSUE_ASSIGNEE - ISSUE_CASE - ISSUE_TEAM_OWNERS SeatAssignmentsDataType: default: seat-assignments description: Seat assignments resource type. enum: - seat-assignments example: seat-assignments type: string x-enum-varnames: - SEAT_ASSIGNMENTS SeatUserData: description: A seat user resource object containing its ID, type, and associated attributes. properties: attributes: $ref: "#/components/schemas/SeatUserDataAttributes" description: The attributes of the seat user. id: description: The ID of the seat user. example: "00000000-0000-0000-0000-000000000000" nullable: true type: string type: $ref: "#/components/schemas/SeatUserDataType" type: object SeatUserDataArray: description: A paginated list of seat user resources with associated pagination metadata. properties: data: description: The list of seat users. items: $ref: "#/components/schemas/SeatUserData" type: array meta: $ref: "#/components/schemas/SeatUserMeta" description: The metadata of the seat users. type: object SeatUserDataAttributes: description: Attributes of a user assigned to a seat, including their email, name, and assignment timestamp. properties: assigned_at: description: The date and time the seat was assigned. example: "2021-01-01T00:00:00Z" format: date-time nullable: true type: string email: description: The email of the user. example: "user@example.com" nullable: true type: string name: description: The name of the user. example: "John Doe" nullable: true type: string type: object SeatUserDataType: default: seat-users description: Seat users resource type. enum: - seat-users example: seat-users type: string x-enum-varnames: - SEAT_USERS SeatUserMeta: description: Pagination metadata for the seat users list response. properties: cursor: description: The cursor for the seat users. type: string limit: description: The limit for the seat users. format: int64 type: integer next_cursor: description: The next cursor for the seat users. type: string type: object SecretRuleArray: description: A collection of secret detection rules returned by the list endpoint. properties: data: description: The list of secret detection rules. items: $ref: "#/components/schemas/SecretRuleData" type: array required: - data type: object SecretRuleData: description: The data object representing a secret detection rule, including its attributes and resource type. properties: attributes: $ref: "#/components/schemas/SecretRuleDataAttributes" id: description: The unique identifier of the secret rule resource. type: string type: $ref: "#/components/schemas/SecretRuleDataType" required: - type type: object SecretRuleDataAttributes: description: The attributes of a secret detection rule, including its pattern, priority, and validation configuration. properties: default_included_keywords: description: A list of keywords that are included by default when scanning for secrets matching this rule. items: description: A keyword used to narrow down secret detection to relevant contexts. type: string type: array description: description: A detailed explanation of what type of secret this rule detects. type: string license: description: The license under which this secret rule is distributed. type: string match_validation: $ref: "#/components/schemas/SecretRuleDataAttributesMatchValidation" name: description: The unique name of the secret detection rule. type: string pattern: description: The regular expression pattern used to identify potential secrets in source code or configuration. type: string priority: description: The priority level of this rule, used to rank findings when multiple rules match. type: string sds_id: description: The identifier of the corresponding Sensitive Data Scanner rule, if one exists. type: string validators: description: A list of validator identifiers used to further confirm a detected secret is genuine. items: description: A validator identifier applied to refine secret detection accuracy. type: string type: array type: object SecretRuleDataAttributesMatchValidation: description: Configuration for validating whether a detected secret is active by making an HTTP request and inspecting the response. properties: endpoint: description: The URL endpoint to call when validating a detected secret. type: string hosts: description: The list of hostnames to include when performing secret match validation. items: description: A hostname used during match validation. type: string type: array http_method: description: The HTTP method (e.g., GET, POST) to use when making the validation request. type: string invalid_http_status_code: description: The HTTP status code ranges that indicate the detected secret is invalid or inactive. items: $ref: "#/components/schemas/SecretRuleDataAttributesMatchValidationInvalidHttpStatusCodeItems" type: array request_headers: additionalProperties: type: string description: A map of HTTP header names to values to include in the validation request. type: object timeout_seconds: description: The maximum number of seconds to wait for a response during validation before timing out. format: int64 maximum: 1.8446744073709551e+19 minimum: 0 type: integer type: description: The type of match validation to perform (e.g., http). type: string valid_http_status_code: description: The HTTP status code ranges that indicate the detected secret is valid and active. items: $ref: "#/components/schemas/SecretRuleDataAttributesMatchValidationValidHttpStatusCodeItems" type: array type: object SecretRuleDataAttributesMatchValidationInvalidHttpStatusCodeItems: description: An HTTP status code range that indicates an invalid (unsuccessful) secret match during validation. properties: end: description: The inclusive upper bound of the HTTP status code range. format: int64 maximum: 1.8446744073709551e+19 minimum: 0 type: integer start: description: The inclusive lower bound of the HTTP status code range. format: int64 maximum: 1.8446744073709551e+19 minimum: 0 type: integer type: object SecretRuleDataAttributesMatchValidationValidHttpStatusCodeItems: description: An HTTP status code range that indicates a valid (successful) secret match during validation. properties: end: description: The inclusive upper bound of the HTTP status code range. format: int64 maximum: 1.8446744073709551e+19 minimum: 0 type: integer start: description: The inclusive lower bound of the HTTP status code range. format: int64 maximum: 1.8446744073709551e+19 minimum: 0 type: integer type: object SecretRuleDataType: default: secret_rule description: Secret rule resource type. enum: - secret_rule example: secret_rule type: string x-enum-varnames: - SECRET_RULE SecureEmbedCreateRequest: description: Request to create a secure embed shared dashboard. properties: data: $ref: "#/components/schemas/SecureEmbedCreateRequestData" required: - data type: object SecureEmbedCreateRequestAttributes: description: Attributes for creating a secure embed shared dashboard. properties: global_time: $ref: "#/components/schemas/SecureEmbedGlobalTime" global_time_selectable: description: Whether viewers can change the time range. example: true type: boolean selectable_template_vars: description: Template variables viewers can modify. items: $ref: "#/components/schemas/SecureEmbedSelectableTemplateVariable" type: array status: $ref: "#/components/schemas/SecureEmbedStatus" title: description: Display title for the shared dashboard. example: "Q1 Metrics Dashboard" type: string viewing_preferences: $ref: "#/components/schemas/SecureEmbedViewingPreferences" required: - status - title - global_time_selectable - selectable_template_vars - viewing_preferences - global_time type: object SecureEmbedCreateRequestData: description: Data object for creating a secure embed. properties: attributes: $ref: "#/components/schemas/SecureEmbedCreateRequestAttributes" type: $ref: "#/components/schemas/SecureEmbedRequestType" required: - type - attributes type: object SecureEmbedCreateResponse: description: Response for creating a secure embed shared dashboard. properties: data: $ref: "#/components/schemas/SecureEmbedCreateResponseData" required: - data type: object SecureEmbedCreateResponseAttributes: description: Attributes of a newly created secure embed shared dashboard. properties: created_at: description: Creation timestamp. example: "2026-03-11T18:30:00.000000" readOnly: true type: string credential: description: >- The secret credential used for HMAC signing. Returned only on creation. Store securely — it cannot be retrieved again. example: "A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8S9t0U1v2" readOnly: true type: string dashboard_id: description: The source dashboard ID. example: "abc-def-ghi" readOnly: true type: string global_time: $ref: "#/components/schemas/SecureEmbedGlobalTime" global_time_selectable: description: Whether time range is viewer-selectable. example: true type: boolean id: description: Internal share ID. example: "12345" readOnly: true type: string selectable_template_vars: description: Template variables with their configuration. items: $ref: "#/components/schemas/SecureEmbedSelectableTemplateVariable" type: array share_type: $ref: "#/components/schemas/SecureEmbedShareType" status: $ref: "#/components/schemas/SecureEmbedStatus" title: description: Display title. example: "Q1 Metrics Dashboard" type: string token: description: Public share token. example: "s3cur3t0k3n-abcdef123456" readOnly: true type: string url: description: CDN URL for the shared dashboard. example: "https://p.datadoghq.com/sb/secure-embed/s3cur3t0k3n-abcdef123456" readOnly: true type: string viewing_preferences: $ref: "#/components/schemas/SecureEmbedViewingPreferences" type: object SecureEmbedCreateResponseData: description: Data object for a secure embed create response. properties: attributes: $ref: "#/components/schemas/SecureEmbedCreateResponseAttributes" id: description: Internal share ID. example: "12345" type: string type: $ref: "#/components/schemas/SecureEmbedCreateResponseType" required: - type - id - attributes type: object SecureEmbedCreateResponseType: description: Resource type for secure embed create responses. enum: - secure_embed_create_response example: "secure_embed_create_response" type: string x-enum-varnames: - SECURE_EMBED_CREATE_RESPONSE SecureEmbedGetResponse: description: Response for getting a secure embed shared dashboard. properties: data: $ref: "#/components/schemas/SecureEmbedGetResponseData" required: - data type: object SecureEmbedGetResponseAttributes: description: Attributes of an existing secure embed shared dashboard. properties: created_at: description: Creation timestamp. example: "2026-03-11T18:30:00.000000" readOnly: true type: string credential_suffix: description: Last 4 characters of the credential. Defaults to `0000` if unavailable. example: "ab3f" readOnly: true type: string dashboard_id: description: The source dashboard ID. example: "abc-def-ghi" readOnly: true type: string global_time: $ref: "#/components/schemas/SecureEmbedGlobalTime" global_time_selectable: description: Whether time range is viewer-selectable. example: true type: boolean id: description: Internal share ID. example: "12345" readOnly: true type: string selectable_template_vars: description: Template variables with their configuration. items: $ref: "#/components/schemas/SecureEmbedSelectableTemplateVariable" type: array share_type: $ref: "#/components/schemas/SecureEmbedShareType" status: $ref: "#/components/schemas/SecureEmbedStatus" title: description: Display title. example: "Q1 Metrics Dashboard" type: string token: description: Public share token. example: "s3cur3t0k3n-abcdef123456" readOnly: true type: string url: description: CDN URL for the shared dashboard. example: "https://p.datadoghq.com/sb/secure-embed/s3cur3t0k3n-abcdef123456" readOnly: true type: string viewing_preferences: $ref: "#/components/schemas/SecureEmbedViewingPreferences" type: object SecureEmbedGetResponseData: description: Data object for a secure embed get response. properties: attributes: $ref: "#/components/schemas/SecureEmbedGetResponseAttributes" id: description: Internal share ID. example: "12345" type: string type: $ref: "#/components/schemas/SecureEmbedGetResponseType" required: - type - id - attributes type: object SecureEmbedGetResponseType: description: Resource type for secure embed get responses. enum: - secure_embed_get_response example: "secure_embed_get_response" type: string x-enum-varnames: - SECURE_EMBED_GET_RESPONSE SecureEmbedGlobalTime: description: Default time range configuration for the secure embed. properties: live_span: $ref: "#/components/schemas/SecureEmbedGlobalTimeLiveSpan" type: object SecureEmbedGlobalTimeLiveSpan: description: Dashboard global time live_span selection. enum: - 15m - 1h - 4h - 1d - 2d - 1w - 1mo - 3mo example: "1h" type: string x-enum-varnames: - PAST_FIFTEEN_MINUTES - PAST_ONE_HOUR - PAST_FOUR_HOURS - PAST_ONE_DAY - PAST_TWO_DAYS - PAST_ONE_WEEK - PAST_ONE_MONTH - PAST_THREE_MONTHS SecureEmbedRequestType: description: Resource type for secure embed create requests. enum: - secure_embed_request example: "secure_embed_request" type: string x-enum-varnames: - SECURE_EMBED_REQUEST SecureEmbedSelectableTemplateVariable: description: A template variable that viewers can modify on the secure embed shared dashboard. properties: default_values: description: Default selected values for the variable. example: ["1"] items: description: A default value for the template variable. type: string type: array name: description: Name of the template variable. Usually matches the prefix unless you want a different display name. example: "org_id" type: string prefix: description: Tag prefix for the variable (e.g., `environment`, `service`). example: "org_id" type: string visible_tags: description: Restrict which tag values are visible to the viewer. example: ["1"] items: description: A visible tag value for the template variable. type: string type: array type: object SecureEmbedShareType: description: The type of share. Always `secure_embed`. enum: - secure_embed example: "secure_embed" type: string x-enum-varnames: - SECURE_EMBED SecureEmbedStatus: description: The status of the secure embed share. Active means the shared dashboard is available. Paused means it is not. enum: - active - paused example: "active" type: string x-enum-varnames: - ACTIVE - PAUSED SecureEmbedUpdateRequest: description: Request to update a secure embed shared dashboard. properties: data: $ref: "#/components/schemas/SecureEmbedUpdateRequestData" required: - data type: object SecureEmbedUpdateRequestAttributes: description: Attributes for updating a secure embed shared dashboard. All fields are optional. properties: global_time: $ref: "#/components/schemas/SecureEmbedGlobalTime" global_time_selectable: description: Updated time selectability. example: true type: boolean selectable_template_vars: description: Updated template variables. items: $ref: "#/components/schemas/SecureEmbedSelectableTemplateVariable" type: array status: $ref: "#/components/schemas/SecureEmbedStatus" title: description: Updated title. example: "Q1 Metrics Dashboard (Updated)" type: string viewing_preferences: $ref: "#/components/schemas/SecureEmbedViewingPreferences" type: object SecureEmbedUpdateRequestData: description: Data object for updating a secure embed. properties: attributes: $ref: "#/components/schemas/SecureEmbedUpdateRequestAttributes" type: $ref: "#/components/schemas/SecureEmbedUpdateRequestType" required: - type - attributes type: object SecureEmbedUpdateRequestType: description: Resource type for secure embed update requests. enum: - secure_embed_update_request example: "secure_embed_update_request" type: string x-enum-varnames: - SECURE_EMBED_UPDATE_REQUEST SecureEmbedUpdateResponse: description: Response for updating a secure embed shared dashboard. properties: data: $ref: "#/components/schemas/SecureEmbedUpdateResponseData" required: - data type: object SecureEmbedUpdateResponseAttributes: description: Attributes of an updated secure embed shared dashboard. properties: created_at: description: Creation timestamp. example: "2026-03-11T18:30:00.000000" readOnly: true type: string credential_suffix: description: Last 4 characters of the credential. Defaults to `0000` if unavailable. example: "ab3f" readOnly: true type: string dashboard_id: description: The source dashboard ID. example: "abc-def-ghi" readOnly: true type: string global_time: $ref: "#/components/schemas/SecureEmbedGlobalTime" global_time_selectable: description: Whether time range is viewer-selectable. example: true type: boolean id: description: Internal share ID. example: "12345" readOnly: true type: string selectable_template_vars: description: Template variables with their configuration. items: $ref: "#/components/schemas/SecureEmbedSelectableTemplateVariable" type: array share_type: $ref: "#/components/schemas/SecureEmbedShareType" status: $ref: "#/components/schemas/SecureEmbedStatus" title: description: Display title. example: "Q1 Metrics Dashboard (Updated)" type: string token: description: Public share token. example: "s3cur3t0k3n-abcdef123456" readOnly: true type: string url: description: CDN URL for the shared dashboard. example: "https://p.datadoghq.com/sb/secure-embed/s3cur3t0k3n-abcdef123456" readOnly: true type: string viewing_preferences: $ref: "#/components/schemas/SecureEmbedViewingPreferences" type: object SecureEmbedUpdateResponseData: description: Data object for a secure embed update response. properties: attributes: $ref: "#/components/schemas/SecureEmbedUpdateResponseAttributes" id: description: Internal share ID. example: "12345" type: string type: $ref: "#/components/schemas/SecureEmbedUpdateResponseType" required: - type - id - attributes type: object SecureEmbedUpdateResponseType: description: Resource type for secure embed update responses. enum: - secure_embed_update_response example: "secure_embed_update_response" type: string x-enum-varnames: - SECURE_EMBED_UPDATE_RESPONSE SecureEmbedViewingPreferences: description: Display settings for the secure embed shared dashboard. properties: high_density: description: Whether widgets are displayed in high density mode. example: false type: boolean theme: $ref: "#/components/schemas/SecureEmbedViewingPreferencesTheme" type: object SecureEmbedViewingPreferencesTheme: description: The theme of the shared dashboard view. `system` follows the viewer's system default. enum: - system - light - dark example: "system" type: string x-enum-varnames: - SYSTEM - LIGHT - DARK SecurityAgentInvestigationAttributes: description: |- Attributes of an investigation. When `fields[investigations]` is set, only listed attributes are returned. Attributes the investigation doesn't have yet are absent. properties: conclusion: description: Summary of the investigation's findings. example: The login came from a location the user travels to regularly, on a known device. type: string created_at: description: When the investigation started. example: "2026-10-30T14:02:40Z" format: date-time type: string key_entities: $ref: "#/components/schemas/SecurityAgentInvestigationKeyEntities" key_evidence: description: The evidence the verdict rests on. items: $ref: "#/components/schemas/SecurityAgentInvestigationKeyEvidence" type: array response_suggestions: $ref: "#/components/schemas/SecurityAgentInvestigationResponseSuggestions" rule_id: description: ID of the detection rule that generated the signal. example: abc-def-ghi type: string signal: $ref: "#/components/schemas/SecurityAgentInvestigationSignal" signal_id: description: ID of the signal, in its V1 form. example: AQAAAaGNHjq4XzqcIQAAAABBWm8xY0wybUFBQmNYSjl1QUFBQUFBQUE type: string state: $ref: "#/components/schemas/SecurityAgentInvestigationState" steps: description: The steps of the investigation, in order. items: $ref: "#/components/schemas/SecurityAgentInvestigationStep" type: array updated_at: description: When the investigation last changed. example: "2026-10-30T14:15:02Z" format: date-time type: string verdict: $ref: "#/components/schemas/SecurityAgentInvestigationVerdict" type: object SecurityAgentInvestigationCount: description: One value of the counted field and how many completed investigations have it. properties: count: description: Number of completed investigations with this value. example: 1250 format: int64 type: integer value: description: A value of the counted field. example: benign type: string required: - value - count type: object SecurityAgentInvestigationCountField: description: Field to count completed investigations by. enum: - verdict - rule_type - signal_source - entity example: verdict type: string x-enum-varnames: - VERDICT - RULE_TYPE - SIGNAL_SOURCE - ENTITY SecurityAgentInvestigationCountsAttributes: description: The counts of each value of the field. properties: counts: description: One bucket per value, sorted by ascending count. items: $ref: "#/components/schemas/SecurityAgentInvestigationCount" type: array required: - counts type: object SecurityAgentInvestigationCountsData: description: Counts of completed investigations. properties: attributes: $ref: "#/components/schemas/SecurityAgentInvestigationCountsAttributes" id: description: The counted field. example: verdict type: string type: $ref: "#/components/schemas/SecurityAgentInvestigationCountsType" required: - id - type - attributes type: object SecurityAgentInvestigationCountsResponse: description: Completed investigations counted by the values of one field. properties: data: $ref: "#/components/schemas/SecurityAgentInvestigationCountsData" required: - data type: object SecurityAgentInvestigationCountsType: default: investigation_counts description: Type of the investigation counts resource. enum: - investigation_counts example: investigation_counts type: string x-enum-varnames: - INVESTIGATION_COUNTS SecurityAgentInvestigationData: description: |- An investigation and its content. `attributes` is absent when `fields[investigations]` is empty or lists only attributes the investigation doesn't have. properties: attributes: $ref: "#/components/schemas/SecurityAgentInvestigationAttributes" id: description: The ID of the investigation. example: 7f3c9a2e-5d14-4e8b-9c61-2a0b4f8d1e53 type: string type: $ref: "#/components/schemas/SecurityAgentInvestigationType" required: - id - type type: object SecurityAgentInvestigationEntity: description: An entity the investigation found. properties: sub_type: description: More specific type of the entity. example: okta_user type: string type: description: Type of the entity, such as a user, a host, or an IP address. example: user type: string value: description: Value that identifies the entity. example: jane.doe@example.com type: string required: - type - value type: object SecurityAgentInvestigationField: description: An attribute of an investigation that `fields[investigations]` can select. enum: - signal_id - rule_id - state - verdict - conclusion - signal - key_entities - key_evidence - steps - response_suggestions - created_at - updated_at example: verdict type: string x-enum-varnames: - SIGNAL_ID - RULE_ID - STATE - VERDICT - CONCLUSION - SIGNAL - KEY_ENTITIES - KEY_EVIDENCE - STEPS - RESPONSE_SUGGESTIONS - CREATED_AT - UPDATED_AT SecurityAgentInvestigationKeyEntities: description: The entities the investigation found, by role. properties: actors: description: Entities that performed the activity. items: $ref: "#/components/schemas/SecurityAgentInvestigationEntity" type: array targets: description: Entities the activity was aimed at. items: $ref: "#/components/schemas/SecurityAgentInvestigationEntity" type: array required: - actors - targets type: object SecurityAgentInvestigationKeyEvidence: description: A piece of evidence the verdict rests on. properties: category: description: Category of the evidence. example: Authentication type: string finding: description: What the investigation found. example: The user logged in from the same country three times in the last 30 days. type: string source_steps: description: Names of the steps the evidence comes from. example: - Has the user logged in from this location before? items: type: string type: array required: - category - finding type: object SecurityAgentInvestigationListItem: description: An investigation in a list. properties: attributes: $ref: "#/components/schemas/SecurityAgentInvestigationListItemAttributes" id: description: The ID of the investigation. example: 7f3c9a2e-5d14-4e8b-9c61-2a0b4f8d1e53 type: string type: $ref: "#/components/schemas/SecurityAgentInvestigationType" required: - id - type - attributes type: object SecurityAgentInvestigationListItemAttributes: description: |- Attributes of an investigation in a list. To get an investigation's full content, use the get investigation endpoint. properties: created_at: description: When the investigation started. example: "2026-10-30T14:02:40Z" format: date-time type: string is_latest: description: |- Whether this is the latest investigation of the signal. Always true when `filter[signal_id]` isn't set. example: true type: boolean rule_id: description: ID of the detection rule that generated the signal. It can be empty while the investigation runs. example: abc-def-ghi type: string signal: $ref: "#/components/schemas/SecurityAgentInvestigationSignal" signal_id: description: ID of the signal, in its V1 form. example: AQAAAaGNHjq4XzqcIQAAAABBWm8xY0wybUFBQmNYSjl1QUFBQUFBQUE type: string state: $ref: "#/components/schemas/SecurityAgentInvestigationState" updated_at: description: When the investigation last changed. example: "2026-10-30T14:15:02Z" format: date-time type: string verdict: $ref: "#/components/schemas/SecurityAgentInvestigationVerdict" required: - signal_id - rule_id - state - is_latest type: object SecurityAgentInvestigationMitigationAction: description: An action that applies a mitigation. properties: applied: description: Whether the action has run. example: false type: boolean applied_at: description: When the action ran. example: "2026-10-30T14:20:00Z" format: date-time type: string applied_by: description: Who ran the action. example: john.smith@example.com type: string fqn: description: ID of the action in the Action Catalog. example: com.datadoghq.okta.suspend_user type: string id: description: ID of the action. example: action-1 type: string name: description: Name of the action in the Action Catalog. example: Suspend user type: string resource: description: The resource the action changes. example: jane.doe@example.com type: string source: description: Integration that runs the action, such as `dd`, `aws`, or `okta`. example: okta type: string source_connected: description: Whether the organization has a connection that can run the action. example: true type: boolean target: description: What the action targets. example: jane.doe@example.com type: string required: - id - source - source_connected - applied type: object SecurityAgentInvestigationMitigationSuggestion: description: A suggested mitigation. properties: actions: description: Actions that apply the mitigation. items: $ref: "#/components/schemas/SecurityAgentInvestigationMitigationAction" type: array id: description: ID of the mitigation. example: mitigation-1 type: string rationale: description: Why the mitigation is suggested. example: Only needed if the user doesn't confirm the login. type: string recommended: description: Whether the mitigation is recommended. example: false type: boolean scope_note: description: What the mitigation applies to. example: jane.doe@example.com type: string step: description: Order in which to apply the mitigation, starting at 1. example: 1 format: int64 type: integer title: description: Title of the mitigation. example: Suspend the user type: string required: - id - title - rationale - step - recommended type: object SecurityAgentInvestigationNoRunReason: description: |- Why `filter[signal_id]` returned no investigation. Set only on the first page of an empty result. The reason is based on the organization's current settings. Poll again only on `investigation_not_started`, after the number of seconds in the `Retry-After` header; treat the others as final for this signal. - `investigation_not_started`: no investigation has started yet, but one may still start. - `not_investigated`: no investigation started within an hour of the signal, so none is expected. The signal was skipped for a reason this API doesn't report, such as its severity or a rate limit. - `rule_not_enabled`: the signal's detection rule doesn't have Bits Security Analyst enabled, so no investigation starts automatically. - `signal_not_found`: the ID isn't a signal ID, or no signal with this ID exists in the organization. - `org_not_activated`: the organization hasn't activated Bits Security Analyst. enum: - investigation_not_started - not_investigated - rule_not_enabled - signal_not_found - org_not_activated example: investigation_not_started type: string x-enum-varnames: - INVESTIGATION_NOT_STARTED - NOT_INVESTIGATED - RULE_NOT_ENABLED - SIGNAL_NOT_FOUND - ORG_NOT_ACTIVATED SecurityAgentInvestigationResponse: description: An investigation. properties: data: $ref: "#/components/schemas/SecurityAgentInvestigationData" required: - data type: object SecurityAgentInvestigationResponseSuggestions: description: Suggested responses to the signal. properties: mitigation_suggestions: description: Suggested mitigations, in the order to apply them. items: $ref: "#/components/schemas/SecurityAgentInvestigationMitigationSuggestion" type: array rule_tuning_suggestions: $ref: "#/components/schemas/SecurityAgentInvestigationRuleTuningSuggestions" type: object SecurityAgentInvestigationRuleTuningCondition: description: A condition of a rule tuning suggestion. properties: field: description: Attribute the condition checks. example: "@usr.device.id" type: string value: description: Value the attribute is compared with. example: 4b8f2c1e-9a7d-4e3b-8c5f-1d2e3f4a5b6c type: string required: - field - value type: object SecurityAgentInvestigationRuleTuningSuggestion: description: A suggestion to tune the detection rule. properties: action_type: description: Kind of change the suggestion makes to the rule. example: create_suppression type: string conditions: description: The conditions the change applies to. items: $ref: "#/components/schemas/SecurityAgentInvestigationRuleTuningCondition" type: array description: description: What the suggestion changes. example: Don't generate signals for logins from devices the user has used before. type: string estimated_silenced_count: description: Estimated number of signals the change would have silenced in the window. example: 85 format: int64 type: integer id: description: ID of the suggestion. example: suggestion-1 type: string match_logic: description: How the conditions combine, such as AND or OR. example: AND type: string recommended: description: Whether the suggestion is recommended. example: true type: boolean rule_id: description: ID of the detection rule. example: abc-def-ghi type: string title: description: Title of the suggestion. example: Suppress logins from known devices type: string warning: description: What the change could hide. It can be empty. example: A stolen known device would no longer trigger this rule. type: string why: description: Why the suggestion is made. example: The user's known devices accounted for most benign signals. type: string required: - id - title - action_type - rule_id - description - match_logic - conditions - why - recommended - warning type: object SecurityAgentInvestigationRuleTuningSuggestions: description: Suggestions to tune the detection rule that generated the signal. properties: occurrence_window_days: description: Length of the window, in days. example: 30 format: int64 type: integer reasoning: description: Why tuning the rule is suggested. example: Most signals from this rule in the last 30 days were benign travel. type: string rule_id: description: ID of the detection rule. example: abc-def-ghi type: string rule_name: description: Name of the detection rule. example: Unusual login location for a user type: string rule_signal_total: description: Number of signals the rule generated in the window. example: 120 format: int64 type: integer suggestions: description: The tuning suggestions. items: $ref: "#/components/schemas/SecurityAgentInvestigationRuleTuningSuggestion" type: array summary: description: Summary of the suggestions. example: The rule fires often for users who travel to known locations. type: string required: - summary - reasoning - rule_id - rule_name - rule_signal_total - occurrence_window_days - suggestions type: object SecurityAgentInvestigationSignal: description: Summary of the signal the investigation is about. properties: severity: description: "Severity of the signal: `info`, `low`, `medium`, `high`, or `critical`." example: medium type: string sources: description: Sources of the signal. example: - okta items: type: string type: array tactic: description: MITRE ATT&CK tactic, from the signal's `tactic` tag. example: TA0001-initial-access type: string tags: description: Tags of the signal, written `key:value`. example: - "source:okta" items: type: string type: array technique: description: MITRE ATT&CK technique, from the signal's `technique` tag. example: T1078-valid-accounts type: string timestamp: description: Time the signal was generated. example: "2026-10-30T14:02:11Z" type: string title: description: Title of the signal. example: Unusual login location for a user type: string type: object SecurityAgentInvestigationState: description: |- State of the investigation: `investigating` while it runs, `completed` after it has a result, or `failed` when it produced no result before its timeout. enum: - investigating - completed - failed example: completed type: string x-enum-varnames: - INVESTIGATING - COMPLETED - FAILED SecurityAgentInvestigationStep: description: A step of the investigation. properties: name: description: Name of the step, usually the question it answers. example: Has the user logged in from this location before? type: string summary: description: Summary of what the step found. It can be empty. example: Three earlier logins from the same country, on the same device. type: string required: - name - summary type: object SecurityAgentInvestigationType: default: investigations description: Type of the investigation resource. enum: - investigations example: investigations type: string x-enum-varnames: - INVESTIGATIONS SecurityAgentInvestigationVerdict: description: Verdict of the investigation. Only completed investigations have one. enum: - benign - suspicious - malicious example: benign type: string x-enum-varnames: - BENIGN - SUSPICIOUS - MALICIOUS SecurityAgentInvestigationsListMeta: description: Metadata of a page of investigations. properties: reason: $ref: "#/components/schemas/SecurityAgentInvestigationNoRunReason" total_count: description: |- Without `filter[signal_id]`, the number of signals that match the filters. With `filter[signal_id]`, the number of investigations of that signal. Pages past the last page return 0. example: 1 format: int64 type: integer required: - total_count type: object SecurityAgentInvestigationsListResponse: description: A page of investigations. properties: data: description: The investigations on this page. items: $ref: "#/components/schemas/SecurityAgentInvestigationListItem" type: array meta: $ref: "#/components/schemas/SecurityAgentInvestigationsListMeta" required: - data - meta type: object SecurityAutomationRulesLinks: description: Pagination links for the list of automation rules. properties: first: description: Link to the first page of results. example: "/api/v2/security/findings/automation/mute_rules?page[size]=10&page[number]=0" type: string last: description: Link to the last page of results. example: "/api/v2/security/findings/automation/mute_rules?page[size]=10&page[number]=5" type: string next: description: Link to the next page of results. example: "/api/v2/security/findings/automation/mute_rules?page[size]=10&page[number]=2" type: string prev: description: Link to the previous page of results. example: "/api/v2/security/findings/automation/mute_rules?page[size]=10&page[number]=0" type: string required: - first - last type: object SecurityAutomationRulesMeta: description: Metadata for the list of automation rules. properties: page: $ref: "#/components/schemas/SecurityAutomationRulesPageInfo" required: - page type: object SecurityAutomationRulesPageInfo: description: Pagination information for the list of automation rules. properties: total_filtered_count: description: The total number of rules matching the current filter. example: 42 format: int64 type: integer required: - total_filtered_count type: object SecurityEntityConfigRisks: description: Configuration risks associated with the entity properties: hasIdentityRisk: description: Whether the entity has identity risks example: false type: boolean hasMisconfiguration: description: Whether the entity has misconfigurations example: true type: boolean hasPrivilegedRole: description: Whether the entity has privileged roles example: true type: boolean isPrivileged: description: Whether the entity has privileged access example: false type: boolean isProduction: description: Whether the entity is in a production environment example: true type: boolean isPubliclyAccessible: description: Whether the entity is publicly accessible example: true type: boolean required: - hasMisconfiguration - hasIdentityRisk - isPubliclyAccessible - isProduction - hasPrivilegedRole - isPrivileged type: object SecurityEntityMetadata: description: Metadata about the entity from cloud providers properties: accountID: description: Cloud account ID (AWS) example: "123456789012" type: string environments: description: Environment tags associated with the entity example: ["production", "us-east-1"] items: description: An environment tag associated with the entity. type: string type: array mitreTactics: description: MITRE ATT&CK tactics detected example: ["Credential Access", "Privilege Escalation"] items: description: Detected MITRE ATT&CK tactic type: string type: array mitreTechniques: description: MITRE ATT&CK techniques detected example: ["T1078", "T1098"] items: description: Detected MITRE ATT&CK technique type: string type: array projectID: description: Cloud project ID (GCP) example: "my-gcp-project" type: string services: description: Services associated with the entity example: ["api-gateway", "lambda"] items: description: A service name associated with the entity. type: string type: array sources: description: Data sources that detected this entity example: ["cloudtrail", "cloud-security-posture-management"] items: description: A data source identifier. type: string type: array subscriptionID: description: Cloud subscription ID (Azure) example: "a1b2c3d4-e5f6-7890-abcd-ef1234567890" type: string required: - sources - environments - services - mitreTactics - mitreTechniques type: object SecurityEntityRiskScore: description: An entity risk score containing security risk assessment information properties: attributes: $ref: "#/components/schemas/SecurityEntityRiskScoreAttributes" id: description: Unique identifier for the entity example: "arn:aws:iam::123456789012:user/john.doe" type: string type: $ref: "#/components/schemas/SecurityEntityRiskScoreType" required: - id - type - attributes type: object SecurityEntityRiskScoreAttributes: description: Attributes of an entity risk score. properties: accountIds: description: Cloud account IDs associated with the entity. example: ["222233334444", "3333333555555"] items: description: A cloud account ID. type: string type: array configRisks: $ref: "#/components/schemas/SecurityEntityConfigRisks" entityMetadata: $ref: "#/components/schemas/SecurityEntityMetadata" entityName: description: Human-readable name of the entity. example: "john.doe" type: string entityProviders: description: Cloud providers associated with the entity. example: ["AWS"] items: description: A cloud provider name. type: string type: array entityRoles: description: Roles associated with the entity. example: [] items: description: A role assigned to the entity. type: string type: array entitySubTypes: description: Sub-types associated with the entity. example: ["Root"] items: description: An entity sub-type label. type: string type: array entityType: description: Type of the entity (for example, aws_iam_user, aws_ec2_instance). example: "aws_iam_user" type: string entityTypes: description: All types associated with the entity. example: ["Root", "User Name"] items: description: An entity type label. type: string type: array firstDetected: description: Timestamp when the entity was first detected (Unix milliseconds). example: 1778876604661 format: int64 type: integer lastActivityTitle: description: Title of the most recent signal detected for this entity. example: "Suspicious API call detected" type: string lastDetected: description: Timestamp when the entity was last detected (Unix milliseconds). example: 1780064607093 format: int64 type: integer riskScore: description: Current risk score for the entity. example: 85 format: int64 type: integer riskScoreEvolution: description: Change in risk score compared to previous period. example: 12 format: int64 type: integer severity: $ref: "#/components/schemas/SecurityEntityRiskScoreAttributesSeverity" signalsDetected: description: Number of risk-contributing security signals detected for this entity. example: 15 format: int64 type: integer required: - entityProviders - entitySubTypes - accountIds - riskScore - riskScoreEvolution - severity - firstDetected - lastDetected - lastActivityTitle - signalsDetected - configRisks - entityMetadata type: object SecurityEntityRiskScoreAttributesSeverity: description: Severity level based on risk score enum: - critical - high - medium - low - info example: "critical" type: string x-enum-varnames: - CRITICAL - HIGH - MEDIUM - LOW - INFO SecurityEntityRiskScoreResponse: description: Response containing a single entity risk score properties: data: $ref: "#/components/schemas/SecurityEntityRiskScore" required: - data type: object SecurityEntityRiskScoreType: description: Resource type. enum: - SecurityEntityRiskScore example: SecurityEntityRiskScore type: string x-enum-varnames: - SECURITY_ENTITY_RISK_SCORE SecurityEntityRiskScoresMeta: description: Metadata for pagination properties: pageNumber: description: Current page number (1-indexed) example: 1 format: int64 type: integer pageSize: description: Number of items per page example: 10 format: int64 type: integer queryId: description: Query ID for pagination consistency example: "abc123def456" type: string totalRowCount: description: Total number of entities matching the query example: 150 format: int64 type: integer required: - queryId - totalRowCount - pageSize - pageNumber type: object SecurityEntityRiskScoresResponse: description: Response containing a list of entity risk scores properties: data: description: Array of entity risk score objects. items: $ref: "#/components/schemas/SecurityEntityRiskScore" type: array meta: $ref: "#/components/schemas/SecurityEntityRiskScoresMeta" required: - data - meta type: object SecurityFilter: description: The security filter's properties. properties: attributes: $ref: "#/components/schemas/SecurityFilterAttributes" id: $ref: "#/components/schemas/SecurityFilterID" type: $ref: "#/components/schemas/SecurityFilterType" type: object SecurityFilterAttributes: description: The object describing a security filter. properties: exclusion_filters: description: The list of exclusion filters applied in this security filter. items: $ref: "#/components/schemas/SecurityFilterExclusionFilterResponse" type: array filtered_data_type: $ref: "#/components/schemas/SecurityFilterFilteredDataType" is_builtin: description: Whether the security filter is the built-in filter. example: false type: boolean is_enabled: description: Whether the security filter is enabled. example: false type: boolean name: description: The security filter name. example: Custom security filter type: string query: description: The security filter query. Logs accepted by this query will be accepted by this filter. example: service:api type: string version: description: The version of the security filter. example: 1 format: int32 maximum: 2147483647 type: integer type: object SecurityFilterCreateAttributes: description: Object containing the attributes of the security filter to be created. properties: exclusion_filters: description: Exclusion filters to exclude some logs from the security filter. example: - name: Exclude staging query: source:staging items: $ref: "#/components/schemas/SecurityFilterExclusionFilter" type: array filtered_data_type: $ref: "#/components/schemas/SecurityFilterFilteredDataType" is_enabled: description: Whether the security filter is enabled. example: true type: boolean name: description: The name of the security filter. example: Custom security filter type: string query: description: The query of the security filter. example: service:api type: string required: - name - query - exclusion_filters - filtered_data_type - is_enabled type: object SecurityFilterCreateData: description: Object for a single security filter. properties: attributes: $ref: "#/components/schemas/SecurityFilterCreateAttributes" type: $ref: "#/components/schemas/SecurityFilterType" required: - type - attributes type: object SecurityFilterCreateRequest: description: Request object that includes the security filter that you would like to create. properties: data: $ref: "#/components/schemas/SecurityFilterCreateData" required: - data type: object SecurityFilterExclusionFilter: description: Exclusion filter for the security filter. example: name: Exclude staging query: source:staging properties: name: description: Exclusion filter name. example: Exclude staging type: string query: description: Exclusion filter query. Logs that match this query are excluded from the security filter. example: source:staging type: string required: - name - query type: object SecurityFilterExclusionFilterResponse: description: A single exclusion filter. properties: name: description: The exclusion filter name. example: Exclude staging type: string query: description: The exclusion filter query. example: source:staging type: string type: object SecurityFilterFilteredDataType: description: The filtered data type. enum: - logs example: logs type: string x-enum-varnames: - LOGS SecurityFilterID: description: The ID of the security filter. example: 3dd-0uc-h1s type: string SecurityFilterMeta: description: Optional metadata associated to the response. properties: warning: description: A warning message. example: All the security filters are disabled. As a result, no logs are being analyzed. type: string type: object SecurityFilterResponse: description: Response object which includes a single security filter. properties: data: $ref: "#/components/schemas/SecurityFilter" meta: $ref: "#/components/schemas/SecurityFilterMeta" type: object SecurityFilterType: default: security_filters description: The type of the resource. The value should always be `security_filters`. enum: - security_filters example: security_filters type: string x-enum-varnames: - SECURITY_FILTERS SecurityFilterUpdateAttributes: description: The security filters properties to be updated. properties: exclusion_filters: description: Exclusion filters to exclude some logs from the security filter. example: [] items: $ref: "#/components/schemas/SecurityFilterExclusionFilter" type: array filtered_data_type: $ref: "#/components/schemas/SecurityFilterFilteredDataType" is_enabled: description: Whether the security filter is enabled. example: true type: boolean name: description: The name of the security filter. example: Custom security filter type: string query: description: The query of the security filter. example: service:api type: string version: description: The version of the security filter to update. example: 1 format: int32 maximum: 2147483647 type: integer type: object SecurityFilterUpdateData: description: The new security filter properties. properties: attributes: $ref: "#/components/schemas/SecurityFilterUpdateAttributes" type: $ref: "#/components/schemas/SecurityFilterType" required: - type - attributes type: object SecurityFilterUpdateRequest: description: The new security filter body. properties: data: $ref: "#/components/schemas/SecurityFilterUpdateData" required: - data type: object SecurityFilterVersion: description: A snapshot of all security filters at a specific configuration version. properties: attributes: $ref: "#/components/schemas/SecurityFilterVersionAttributes" id: description: The identifier of the configuration version. example: "1" type: string type: $ref: "#/components/schemas/SecurityFilterVersionType" required: - id - type - attributes type: object SecurityFilterVersionAttributes: description: The attributes describing a single security filter configuration version. properties: date: description: The Unix timestamp in milliseconds at which this configuration version was applied. example: 1758177253469 format: int64 type: integer filters: description: The set of security filters at this configuration version. items: $ref: "#/components/schemas/SecurityFilterVersionEntry" type: array version: description: The configuration version number. example: 1 format: int32 maximum: 2147483647 type: integer required: - version - date - filters type: object SecurityFilterVersionEntry: description: A single security filter as it existed at a given configuration version. properties: exclusion_filters: description: The list of exclusion filters applied in this security filter. items: $ref: "#/components/schemas/SecurityFilterExclusionFilterResponse" type: array filtered_data_type: $ref: "#/components/schemas/SecurityFilterFilteredDataType" id: description: The ID of the security filter. example: "123" type: string is_builtin: description: Whether the security filter is the built-in filter. example: false type: boolean is_enabled: description: Whether the security filter is enabled. example: true type: boolean name: description: The name of the security filter. example: Test Security Filter type: string query: description: The query of the security filter. example: source:test type: string version: description: The version of this security filter. example: 1 format: int32 maximum: 2147483647 type: integer required: - id - name - version - query - is_enabled - exclusion_filters - filtered_data_type - is_builtin type: object SecurityFilterVersionType: default: security_filters_configuration description: The type of the resource. The value should always be `security_filters_configuration`. enum: - security_filters_configuration example: security_filters_configuration type: string x-enum-varnames: - SECURITY_FILTERS_CONFIGURATION SecurityFilterVersionsResponse: description: Response containing the version history of security filters. properties: data: description: A list of historical security filter configurations, ordered from the most recent to the oldest. items: $ref: "#/components/schemas/SecurityFilterVersion" type: array required: - data type: object SecurityFiltersResponse: description: All the available security filters objects. properties: data: description: A list of security filters objects. items: $ref: "#/components/schemas/SecurityFilter" type: array meta: $ref: "#/components/schemas/SecurityFilterMeta" type: object SecurityFindingType: description: The type of security finding that the automation rule applies to. enum: - api_security - attack_path - host_and_container_vulnerability - iac_misconfiguration - identity_risk - library_vulnerability - misconfiguration - runtime_code_vulnerability - secret - static_code_vulnerability - workload_activity example: misconfiguration type: string x-enum-varnames: - API_SECURITY - ATTACK_PATH - HOST_AND_CONTAINER_VULNERABILITY - IAC_MISCONFIGURATION - IDENTITY_RISK - LIBRARY_VULNERABILITY - MISCONFIGURATION - RUNTIME_CODE_VULNERABILITY - SECRET - STATIC_CODE_VULNERABILITY - WORKLOAD_ACTIVITY SecurityFindingTypes: description: The list of security finding types that the automation rule applies to. example: - misconfiguration items: $ref: "#/components/schemas/SecurityFindingType" minItems: 1 type: array SecurityFindingsAttributes: description: The JSON object containing all attributes of the security finding. properties: attributes: additionalProperties: {} description: The custom attributes of the security finding. example: {"severity": "high", "status": "open"} type: object tags: description: List of tags associated with the security finding. example: - "team:platform" - "env:prod" items: description: A tag associated with the security finding. type: string type: array timestamp: description: The Unix timestamp at which the detection changed for the resource. Same value as @detection_changed_at. example: 1765901760 format: int64 type: integer type: object SecurityFindingsData: description: A single security finding. properties: attributes: $ref: "#/components/schemas/SecurityFindingsAttributes" id: description: The unique ID of the security finding. example: "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==" type: string type: $ref: "#/components/schemas/SecurityFindingsDataType" type: object SecurityFindingsDataType: default: finding description: The type of the security finding resource. enum: - finding example: finding type: string x-enum-varnames: - FINDING SecurityFindingsLinks: description: Links for pagination. properties: next: description: Link for the next page of results. Note that paginated requests can also be made using the POST endpoint. example: "https://app.datadoghq.com/api/v2/security/findings?page[cursor]=eyJhZnRlciI6IkF3QUFBWnPcm1pd0FBQUJbVlBQUKBa1pqRTVdZUzSTBNemN0YWiIsLTE3Mjk0MzYwMjFdfQ==&page[limit]=25" type: string type: object SecurityFindingsMeta: description: Metadata about the response. properties: elapsed: description: The time elapsed in milliseconds. example: 548 format: int64 type: integer page: $ref: "#/components/schemas/SecurityFindingsPage" request_id: description: The identifier of the request. example: "pddv1ChZwVlMxMUdYRFRMQ1lyb3B4MGNYbFlnIi0KHQu35LDbucx" type: string status: $ref: "#/components/schemas/SecurityFindingsStatus" type: object SecurityFindingsPage: description: Pagination information. properties: after: description: The cursor used to get the next page of results. example: "eyJhZnRlciI6IkFRQUFBWWJiaEJXQS1OY1dqUUFBQUFCQldXSmlhRUpYUVVGQlJFSktkbTlDTUdaWFRVbDNRVUUiLCJ2YWx1ZXMiOlsiY3JpdGljYWwiXX0=" type: string type: object SecurityFindingsSearchRequest: description: The request body for searching security findings. properties: data: $ref: "#/components/schemas/SecurityFindingsSearchRequestData" type: object SecurityFindingsSearchRequestData: description: Request data for searching security findings. properties: attributes: $ref: "#/components/schemas/SecurityFindingsSearchRequestDataAttributes" type: object SecurityFindingsSearchRequestDataAttributes: description: Request attributes for searching security findings. properties: filter: default: "*" description: The search query following log search syntax. example: "@severity:(critical OR high) @status:open team:platform" type: string page: $ref: "#/components/schemas/SecurityFindingsSearchRequestPage" sort: $ref: "#/components/schemas/SecurityFindingsSort" type: object SecurityFindingsSearchRequestPage: description: Pagination attributes for the search request. properties: cursor: description: Get the next page of results with a cursor provided in the previous query. example: "eyJhZnRlciI6IkF3QUFBWnPcm1pd0FBQUJbVlBQUKBa1pqRTVdZUzSTBNemN0YWiIsLTE3Mjk0MzYwMjFdfQ==" type: string limit: default: 10 description: The maximum number of security findings in the response. example: 25 format: int64 maximum: 150 minimum: 1 type: integer type: object SecurityFindingsSort: default: "-@detection_changed_at" description: The sort parameters when querying security findings. enum: - "@detection_changed_at" - "-@detection_changed_at" type: string x-enum-varnames: - DETECTION_CHANGED_AT_ASC - DETECTION_CHANGED_AT_DESC SecurityFindingsStatus: description: The status of the response. enum: - done - timeout example: done type: string x-enum-varnames: - DONE - TIMEOUT SecurityMonitoringAzureAppRegistration: description: An Azure App Registration discovered for the organization. properties: client_id: description: The client ID of the App Registration. example: 66666666-7777-8888-9999-000000000000 type: string error_count: description: The number of errors encountered while crawling resources for this App Registration. example: 0 format: int64 type: integer resource_collection_enabled: description: Whether resource collection is enabled for this App Registration. example: true type: boolean subscription_count: description: The number of Azure subscriptions associated with this App Registration. example: 3 format: int64 type: integer tenant_id: description: The Azure tenant ID of the App Registration. example: 11111111-2222-3333-4444-555555555555 type: string required: - tenant_id - client_id - resource_collection_enabled - subscription_count - error_count type: object SecurityMonitoringBatchMigrationAttributes: description: Attributes of a batch migration. properties: createdAt: description: The creation date of the batch migration, in RFC 3339 format. example: "2026-09-21T12:00:00Z" format: date-time type: string createdBy: description: The UUID of the user or service account who created the batch migration. example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string description: description: The description of the batch migration. example: Rules imported from Splunk type: string inputSource: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationInputSource" lastUpdatedAt: description: The last update date of the batch migration, in RFC 3339 format. example: "2026-09-21T12:00:00Z" format: date-time type: string lastUpdatedBy: description: |- The UUID of the user or service account who last updated the batch migration, or the name of a system actor. example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string name: description: The name of the batch migration. example: Splunk migration type: string orgId: description: The ID of the organization that owns the batch migration. example: 123456 format: int64 type: integer resourceStatusCounts: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceStatusCounts" status: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationStatus" tags: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationTags" required: - orgId - name - inputSource - status - createdAt - lastUpdatedAt - tags - resourceStatusCounts type: object SecurityMonitoringBatchMigrationCreateAttributes: description: Attributes of the batch migration to create. properties: description: description: The description of the batch migration. example: Rules imported from Splunk maxLength: 4096 type: string name: description: The name of the batch migration. example: Splunk migration maxLength: 512 type: string resources: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationCreateResources" tags: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationTags" required: - resources type: object SecurityMonitoringBatchMigrationCreateData: description: Data of the batch migration to create. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationCreateAttributes" type: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationType" required: - type - attributes type: object SecurityMonitoringBatchMigrationCreateRequest: description: Request to create a batch migration. properties: data: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationCreateData" required: - data type: object SecurityMonitoringBatchMigrationCreateResources: description: The initial resources of the batch migration. From 1 to 100 resources. items: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceCreateItem" maxItems: 100 minItems: 1 type: array SecurityMonitoringBatchMigrationData: description: A batch migration. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationAttributes" id: description: The UUID of the batch migration. example: 7cdb3a75-64fb-46ce-9445-41969e78fe8e format: uuid type: string type: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationType" required: - id - type - attributes type: object SecurityMonitoringBatchMigrationInputSource: description: |- The origin of a batch migration. Always `batch_migration` for batch migrations created through this API. enum: - batch_migration - threat_hunting - user example: batch_migration type: string x-enum-varnames: - BATCH_MIGRATION - THREAT_HUNTING - USER SecurityMonitoringBatchMigrationListMeta: description: Metadata of a list response. properties: totalCount: description: Total number of items matching the request. example: 1 format: int64 type: integer required: - totalCount type: object SecurityMonitoringBatchMigrationPublishAttributes: description: Attributes of the batch migration publish request. properties: resourceIds: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishResourceIDs" type: object SecurityMonitoringBatchMigrationPublishData: description: Data of the batch migration publish request. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishAttributes" type: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishType" required: - type - attributes type: object SecurityMonitoringBatchMigrationPublishRequest: description: Request to publish the resources of a batch migration. properties: data: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishData" required: - data type: object SecurityMonitoringBatchMigrationPublishResourceIDs: description: |- Unique UUIDs of the resources to publish. Up to 1000 IDs. When omitted or empty, every `completed` resource of the batch migration is published. example: - c968cf83-56c2-4d54-a993-6c86dfb83527 items: format: uuid type: string maxItems: 1000 type: array uniqueItems: true SecurityMonitoringBatchMigrationPublishResponse: description: Response containing the publication outcome of each resource. properties: data: description: The publication outcome of each resource. items: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishedResourceData" type: array required: - data type: object SecurityMonitoringBatchMigrationPublishType: description: The type of resource for a batch migration publish request. enum: - batchMigrationPublish example: batchMigrationPublish type: string x-enum-varnames: - BATCH_MIGRATION_PUBLISH SecurityMonitoringBatchMigrationPublishedResourceAttributes: description: Attributes of the publication outcome of a batch migration resource. properties: error: description: The reason why the resource could not be published. example: failed to create rule type: string ruleId: description: The ID of the created Cloud SIEM detection rule. example: abc-def-ghi type: string status: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishedResourceStatus" required: - status type: object SecurityMonitoringBatchMigrationPublishedResourceData: description: The publication outcome of a batch migration resource. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishedResourceAttributes" id: description: The UUID of the batch migration resource. example: c968cf83-56c2-4d54-a993-6c86dfb83527 format: uuid type: string type: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishedResourceType" required: - id - type - attributes type: object SecurityMonitoringBatchMigrationPublishedResourceStatus: description: The outcome of publishing a batch migration resource. enum: - published - failed example: published type: string x-enum-varnames: - PUBLISHED - FAILED SecurityMonitoringBatchMigrationPublishedResourceType: description: The type of resource for a published batch migration resource. enum: - batchMigrationPublishedResource example: batchMigrationPublishedResource type: string x-enum-varnames: - BATCH_MIGRATION_PUBLISHED_RESOURCE SecurityMonitoringBatchMigrationResourceAttributes: description: Attributes of a batch migration resource. properties: batchId: description: The UUID of the batch migration that contains the resource. example: 7cdb3a75-64fb-46ce-9445-41969e78fe8e format: uuid type: string createdAt: description: The creation date of the resource, in RFC 3339 format. example: "2026-09-21T12:00:00Z" format: date-time type: string createdBy: description: The UUID of the user or service account who created the resource. example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string description: description: The description of the resource. example: Detects repeated failed Windows authentication attempts. type: string input: description: The source query or natural language description to translate. example: index=wineventlog EventCode=4625 type: string inputType: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceInputType" lastUpdatedAt: description: The last update date of the resource, in RFC 3339 format. example: "2026-09-21T12:02:00Z" format: date-time type: string lastUpdatedBy: description: |- The UUID of the user or service account who last updated the resource, or the name of a system actor. example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string name: description: The name of the resource. example: Repeated Windows login failures type: string output: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceOutput" outputType: description: The type of the translation output. Currently always `siem_rule`. example: siem_rule type: string ruleId: description: The ID of the Cloud SIEM detection rule created when the resource was published. example: abc-def-ghi type: string status: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceStatus" required: - batchId - name - inputType - outputType - status - input - output - createdAt - lastUpdatedAt type: object SecurityMonitoringBatchMigrationResourceCreateItem: description: A source rule to translate into a Cloud SIEM detection rule. properties: description: description: The description of the resource. example: Detects repeated failed Windows authentication attempts. maxLength: 4096 type: string input: description: The source query or natural language description to translate. Must not be blank. example: index=wineventlog EventCode=4625 maxLength: 65536 minLength: 1 pattern: '^[\s\S]*\S[\s\S]*$' type: string inputType: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceInputType" name: description: The name of the resource. example: Repeated Windows login failures maxLength: 512 type: string required: - inputType - input type: object SecurityMonitoringBatchMigrationResourceCreateItems: description: The resources to add. From 1 to 1000 resources. items: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceCreateItem" maxItems: 1000 minItems: 1 type: array SecurityMonitoringBatchMigrationResourceData: description: A batch migration resource. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceAttributes" id: description: The UUID of the batch migration resource. example: c968cf83-56c2-4d54-a993-6c86dfb83527 format: uuid type: string type: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceType" required: - id - type - attributes type: object SecurityMonitoringBatchMigrationResourceIDs: description: Unique UUIDs of batch migration resources. From 1 to 1000 IDs. example: - c968cf83-56c2-4d54-a993-6c86dfb83527 items: format: uuid type: string maxItems: 1000 minItems: 1 type: array SecurityMonitoringBatchMigrationResourceInputType: description: |- The type of the source rule: `spl` for a Splunk SPL search or saved search definition, `natural_language` for a plain-English description of the behavior to detect, or `kql` for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded. enum: - natural_language - spl - kql example: spl type: string x-enum-varnames: - NATURAL_LANGUAGE - SPL - KQL SecurityMonitoringBatchMigrationResourceOutput: additionalProperties: {} description: |- The translation output. When the resource is `completed`, a Cloud SIEM detection rule definition in the same format as the create detection rule API. When the resource is `failed`, an object with an `error` describing the failure, with `kind` set to `translation_error` or `internal_error`, and optional `type` and `message`. Otherwise, null. example: name: Repeated Windows login failures type: log_detection nullable: true type: object SecurityMonitoringBatchMigrationResourceResponse: description: Response containing a batch migration resource. properties: data: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceData" required: - data type: object SecurityMonitoringBatchMigrationResourceStatus: description: |- The status of a batch migration resource. `completed` resources have a translation in `output` that is ready to be published. `duplicate` is reserved for future duplicate rule detection. enum: - pending - in_progress - completed - canceled - failed - publishing - published - duplicate example: completed type: string x-enum-varnames: - PENDING - IN_PROGRESS - COMPLETED - CANCELED - FAILED - PUBLISHING - PUBLISHED - DUPLICATE SecurityMonitoringBatchMigrationResourceStatusCounts: description: The number of resources of a batch migration in each status. properties: canceled: description: Number of resources whose translation was canceled. example: 0 format: int64 type: integer completed: description: Number of resources translated and ready to be published. example: 0 format: int64 type: integer duplicate: description: Number of resources identified as duplicates of an existing rule. Reserved for future use. example: 0 format: int64 type: integer failed: description: Number of resources whose translation failed. example: 0 format: int64 type: integer inProgress: description: Number of resources being translated. example: 0 format: int64 type: integer pending: description: Number of resources waiting to be translated. example: 1 format: int64 type: integer published: description: Number of resources published as Cloud SIEM detection rules. example: 0 format: int64 type: integer publishing: description: Number of resources being published. example: 0 format: int64 type: integer required: - pending - inProgress - completed - canceled - failed - publishing - published - duplicate type: object SecurityMonitoringBatchMigrationResourceType: description: The type of resource for a batch migration resource. enum: - batchMigrationResource example: batchMigrationResource type: string x-enum-varnames: - BATCH_MIGRATION_RESOURCE SecurityMonitoringBatchMigrationResourceUpdateAttributes: additionalProperties: false description: Attributes of the batch migration resource to update. At least one attribute is required. minProperties: 1 properties: description: description: The description of the resource. example: Detects repeated failed Windows authentication attempts. maxLength: 4096 type: string input: description: The source query or natural language description to translate. Must not be blank. example: index=wineventlog EventCode=4625 | stats count by user maxLength: 65536 minLength: 1 pattern: '^[\s\S]*\S[\s\S]*$' type: string inputType: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceInputType" name: description: The name of the resource. example: Repeated Windows login failures maxLength: 512 type: string type: object SecurityMonitoringBatchMigrationResourceUpdateData: description: Data of the batch migration resource to update. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceUpdateAttributes" type: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceType" required: - type - attributes type: object SecurityMonitoringBatchMigrationResourceUpdateRequest: description: Request to update a batch migration resource. properties: data: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceUpdateData" required: - data type: object SecurityMonitoringBatchMigrationResourcesCreateAttributes: description: Attributes of the resources to add to a batch migration. properties: resources: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceCreateItems" required: - resources type: object SecurityMonitoringBatchMigrationResourcesCreateData: description: Data of the resources to add to a batch migration. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesCreateAttributes" type: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesType" required: - type - attributes type: object SecurityMonitoringBatchMigrationResourcesCreateRequest: description: Request to add resources to a batch migration. properties: data: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesCreateData" required: - data type: object SecurityMonitoringBatchMigrationResourcesCreateResponse: description: Response containing the batch migration resources that were added. properties: data: description: The added batch migration resources. items: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceData" type: array required: - data type: object SecurityMonitoringBatchMigrationResourcesDeleteAttributes: description: Attributes of the resources to delete from a batch migration. properties: resourceIds: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceIDs" required: - resourceIds type: object SecurityMonitoringBatchMigrationResourcesDeleteData: description: Data of the resources to delete from a batch migration. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesDeleteAttributes" type: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesType" required: - type - attributes type: object SecurityMonitoringBatchMigrationResourcesDeleteRequest: description: Request to delete resources from a batch migration. properties: data: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesDeleteData" required: - data type: object SecurityMonitoringBatchMigrationResourcesListResponse: description: Response containing batch migration resources. properties: data: description: The batch migration resources. items: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceData" type: array meta: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationListMeta" required: - data - meta type: object SecurityMonitoringBatchMigrationResourcesType: description: The type of resource for a request on a set of batch migration resources. enum: - batchMigrationResources example: batchMigrationResources type: string x-enum-varnames: - BATCH_MIGRATION_RESOURCES SecurityMonitoringBatchMigrationResponse: description: Response containing a batch migration. properties: data: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationData" required: - data type: object SecurityMonitoringBatchMigrationStatus: description: |- The status of a batch migration. A batch migration is created as `draft` and moves to `in_progress` when started. It moves to `completed` once no resource is `pending` or `in_progress`, or to `canceled` when canceled. enum: - draft - in_progress - canceled - completed example: draft type: string x-enum-varnames: - DRAFT - IN_PROGRESS - CANCELED - COMPLETED SecurityMonitoringBatchMigrationTags: description: Tags of the batch migration. Up to 50 tags, each up to 256 characters. example: - source:splunk items: maxLength: 256 type: string maxItems: 50 type: array SecurityMonitoringBatchMigrationType: description: The type of resource for a batch migration. enum: - batchMigration example: batchMigration type: string x-enum-varnames: - BATCH_MIGRATION SecurityMonitoringBatchMigrationUpdateAttributes: additionalProperties: false description: Attributes of the batch migration to update. At least one attribute is required. minProperties: 1 properties: description: description: The description of the batch migration. example: Rules imported from Splunk maxLength: 4096 type: string name: description: The name of the batch migration. example: Splunk migration - Windows maxLength: 512 type: string tags: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationTags" type: object SecurityMonitoringBatchMigrationUpdateData: description: Data of the batch migration to update. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationUpdateAttributes" type: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationType" required: - type - attributes type: object SecurityMonitoringBatchMigrationUpdateRequest: description: Request to update a batch migration. properties: data: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationUpdateData" required: - data type: object SecurityMonitoringBatchMigrationsListResponse: description: Response containing a page of batch migrations. properties: data: description: The batch migrations. items: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationData" type: array meta: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationListMeta" required: - data - meta type: object SecurityMonitoringContentPackActivation: description: The activation status of a content pack. enum: - never_activated - activated - deactivated example: activated type: string x-enum-descriptions: - Pack has never been activated for this organization. - Pack is currently activated. - Pack was previously activated but has since been deactivated. x-enum-varnames: - NEVER_ACTIVATED - ACTIVATED - DEACTIVATED SecurityMonitoringContentPackAppSecDetails: description: Details for an Application Security content pack. properties: type: $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetailsType" required: - type type: object SecurityMonitoringContentPackAppSecDetailsType: description: Type for Application Security content pack details. enum: - appsec example: appsec type: string x-enum-varnames: - APPSEC SecurityMonitoringContentPackAuditDetails: description: Details for an audit trail content pack. properties: type: $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetailsType" required: - type type: object SecurityMonitoringContentPackAuditDetailsType: description: Type for audit trail content pack details. enum: - audit example: audit type: string x-enum-varnames: - AUDIT SecurityMonitoringContentPackEntityDetails: description: Details for an entity or identity content pack. properties: cp_activation: $ref: "#/components/schemas/SecurityMonitoringContentPackActivation" type: $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetailsType" required: - type - cp_activation type: object SecurityMonitoringContentPackEntityDetailsType: description: Type for entity content pack details. enum: - entity example: entity type: string x-enum-varnames: - ENTITY SecurityMonitoringContentPackIntegrationStatus: description: The installation status of the related integration. enum: - installed - available - partially_installed - detected - error example: installed type: string x-enum-descriptions: - Integration is fully installed. - Integration exists in the catalog but is not installed. - Integration is only partially configured. - Integration detected (for example, logs are flowing) but not explicitly installed. - Integration is in an error state. x-enum-varnames: - INSTALLED - AVAILABLE - PARTIALLY_INSTALLED - DETECTED - ERROR SecurityMonitoringContentPackLogsDetails: description: Details for a logs-based content pack. properties: cp_activation: $ref: "#/components/schemas/SecurityMonitoringContentPackActivation" data_last_seen: $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket" filters_configured: description: |- Whether filters (Security Filters or Index Query depending on the pricing model) are present and correctly configured to route logs into Cloud SIEM. example: true type: boolean integration_installed_status: $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus" logs_seen_from_any_index: description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours. example: true type: boolean siem_index_incorrect: description: Whether the Cloud SIEM index configuration is incorrect (only applies to certain pricing models). example: false type: boolean type: $ref: "#/components/schemas/SecurityFilterFilteredDataType" required: - type - cp_activation - data_last_seen - integration_installed_status - filters_configured - logs_seen_from_any_index - siem_index_incorrect type: object SecurityMonitoringContentPackOnboardingDetails: description: |- Content pack details returned when Cloud SIEM is inactive for the requesting organization. properties: integration_installed_status: $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus" logs_seen_from_any_index: description: Whether logs for this content pack have been seen in any Datadog index in the last 72 hours. example: true type: boolean type: $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetailsType" required: - type - logs_seen_from_any_index type: object SecurityMonitoringContentPackOnboardingDetailsType: description: Type for onboarding content pack details. enum: - onboarding example: onboarding type: string x-enum-varnames: - ONBOARDING SecurityMonitoringContentPackStateAttributes: description: Attributes of a content pack state. properties: details: $ref: "#/components/schemas/SecurityMonitoringContentPackStateDetails" status: $ref: "#/components/schemas/SecurityMonitoringContentPackStatus" required: - status - details type: object SecurityMonitoringContentPackStateData: description: Content pack state data. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringContentPackStateAttributes" id: description: The content pack identifier. example: aws-cloudtrail type: string type: $ref: "#/components/schemas/SecurityMonitoringContentPackStateType" required: - id - type - attributes type: object SecurityMonitoringContentPackStateDetails: description: |- Type-specific details for a content pack state. The set of fields present depends on the content pack's `type`. When Cloud SIEM is inactive for the requesting organization, `onboarding` is returned instead of the content pack's usual type, such as `logs` or `vulnerability`.` oneOf: - $ref: "#/components/schemas/SecurityMonitoringContentPackLogsDetails" - $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetails" - $ref: "#/components/schemas/SecurityMonitoringContentPackEntityDetails" - $ref: "#/components/schemas/SecurityMonitoringContentPackAuditDetails" - $ref: "#/components/schemas/SecurityMonitoringContentPackAppSecDetails" - $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetails" - $ref: "#/components/schemas/SecurityMonitoringContentPackOnboardingDetails" SecurityMonitoringContentPackStateMeta: description: Metadata for content pack states. properties: cloud_siem_index_incorrect: description: Whether the Cloud SIEM index configuration is incorrect for the organization. example: false type: boolean retention_months: description: |- The number of months that standard logs are retained for organizations on the standalone_indexed` pricing model. This field is omitted for other pricing models. example: 15 format: int32 maximum: 60 type: integer sku: $ref: "#/components/schemas/SecurityMonitoringSKU" required: - cloud_siem_index_incorrect - sku type: object SecurityMonitoringContentPackStateType: description: Type for content pack state object enum: - content_pack_state example: content_pack_state type: string x-enum-varnames: - CONTENT_PACK_STATE SecurityMonitoringContentPackStatesResponse: description: Response containing content pack states. properties: data: description: Array of content pack states. items: $ref: "#/components/schemas/SecurityMonitoringContentPackStateData" type: array meta: $ref: "#/components/schemas/SecurityMonitoringContentPackStateMeta" required: - data - meta type: object SecurityMonitoringContentPackStatus: description: The current operational status of a content pack. enum: - install - activate - initializing - active - warning - broken - not_configured example: active type: string x-enum-descriptions: - Not activated; no logs detected in the last 72 hours. - Not activated; logs are flowing into a Datadog index but not yet routed through Cloud SIEM. - Activated; awaiting first log ingestion. - Activated; logs received within the last 24 hours. - Activated; integration not installed or logs last seen 24 to 72 hours ago. - Activated; no logs for over 72 hours, filter missing, or Cloud SIEM index incorrectly ordered. - Activated, but no credentials are configured (entity content packs only). x-enum-varnames: - INSTALL - ACTIVATE - INITIALIZING - ACTIVE - WARNING - BROKEN - NOT_CONFIGURED SecurityMonitoringContentPackThreatIntelDetails: description: Details for a threat intelligence content pack. properties: cp_activation: $ref: "#/components/schemas/SecurityMonitoringContentPackActivation" data_last_seen: $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket" integration_installed_status: $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus" type: $ref: "#/components/schemas/SecurityMonitoringContentPackThreatIntelDetailsType" required: - type - cp_activation - data_last_seen - integration_installed_status type: object SecurityMonitoringContentPackThreatIntelDetailsType: description: Type for threat intelligence content pack details. enum: - threat_intel example: threat_intel type: string x-enum-varnames: - THREAT_INTEL SecurityMonitoringContentPackTimestampBucket: description: Timestamp bucket indicating when logs were last collected. enum: - not_seen - within_24_hours - within_24_to_72_hours - over_72h_to_30d - over_30d example: within_24_hours type: string x-enum-descriptions: - No logs observed. - Logs received within the last 24 hours. - Logs last seen 24 to 72 hours ago. - Logs last seen 3 to 30 days ago. - Logs last seen more than 30 days ago. x-enum-varnames: - NOT_SEEN - WITHIN_24_HOURS - WITHIN_24_TO_72_HOURS - OVER_72H_TO_30D - OVER_30D SecurityMonitoringContentPackVulnerabilityDetails: description: Details for a vulnerability content pack. properties: cp_activation: $ref: "#/components/schemas/SecurityMonitoringContentPackActivation" data_last_seen: $ref: "#/components/schemas/SecurityMonitoringContentPackTimestampBucket" integration_installed_status: $ref: "#/components/schemas/SecurityMonitoringContentPackIntegrationStatus" type: $ref: "#/components/schemas/SecurityMonitoringContentPackVulnerabilityDetailsType" required: - type - cp_activation - data_last_seen - integration_installed_status type: object SecurityMonitoringContentPackVulnerabilityDetailsType: description: Type for vulnerability content pack details. enum: - vulnerability example: vulnerability type: string x-enum-varnames: - VULNERABILITY SecurityMonitoringCriticalAsset: description: The critical asset's properties. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringCriticalAssetAttributes" id: $ref: "#/components/schemas/SecurityMonitoringCriticalAssetID" type: $ref: "#/components/schemas/SecurityMonitoringCriticalAssetType" type: object SecurityMonitoringCriticalAssetAttributes: description: The attributes of the critical asset. properties: creation_author_id: description: ID of user who created the critical asset. example: 367742 format: int64 type: integer creation_date: description: A Unix millisecond timestamp given the creation date of the critical asset. format: int64 type: integer creator: $ref: "#/components/schemas/SecurityMonitoringUser" description: description: A description of the critical asset. example: Production database servers handling PII type: string editable: description: Whether the critical asset is editable. example: true type: boolean enabled: description: Whether the critical asset is enabled. example: true type: boolean query: description: The query for the critical asset. It uses the same syntax as the queries to search signals in the Signals Explorer. example: security:monitoring type: string rule_query: description: The rule query of the critical asset, with the same syntax as the search bar for detection rules. This determines which rules this critical asset will apply to. example: type:log_detection source:cloudtrail type: string severity: $ref: "#/components/schemas/SecurityMonitoringCriticalAssetSeverity" tags: description: List of tags associated with the critical asset. example: - team:database - source:cloudtrail items: description: A tag string in `key:value` format. type: string type: array update_author_id: description: ID of user who updated the critical asset. example: 367743 format: int64 type: integer update_date: description: A Unix millisecond timestamp given the update date of the critical asset. format: int64 type: integer updater: $ref: "#/components/schemas/SecurityMonitoringUser" version: description: The version of the critical asset; it starts at 1, and is incremented at each update. example: 2 format: int32 maximum: 2147483647 type: integer type: object SecurityMonitoringCriticalAssetCreateAttributes: description: Object containing the attributes of the critical asset to be created. properties: description: description: A description of the critical asset. example: Production database servers handling PII type: string enabled: default: true description: Whether the critical asset is enabled. Defaults to `true` if not specified. example: true type: boolean query: description: The query for the critical asset. It uses the same syntax as the queries to search signals in the Signals Explorer. example: security:monitoring type: string rule_query: description: The rule query of the critical asset, with the same syntax as the search bar for detection rules. This determines which rules this critical asset will apply to. example: type:(log_detection OR signal_correlation OR workload_security OR application_security) source:cloudtrail type: string severity: $ref: "#/components/schemas/SecurityMonitoringCriticalAssetSeverity" tags: description: List of tags associated with the critical asset. example: - team:database - source:cloudtrail items: description: A tag string in `key:value` format. type: string type: array required: - query - severity - rule_query type: object SecurityMonitoringCriticalAssetCreateData: description: Object for a single critical asset. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringCriticalAssetCreateAttributes" type: $ref: "#/components/schemas/SecurityMonitoringCriticalAssetType" required: - type - attributes type: object SecurityMonitoringCriticalAssetCreateRequest: description: Request object that includes the critical asset that you would like to create. properties: data: $ref: "#/components/schemas/SecurityMonitoringCriticalAssetCreateData" required: - data type: object SecurityMonitoringCriticalAssetID: description: The ID of the critical asset. example: 4e2435a5-6670-4b8f-baff-46083cd1c250 type: string SecurityMonitoringCriticalAssetResponse: description: Response object containing a single critical asset. properties: data: $ref: "#/components/schemas/SecurityMonitoringCriticalAsset" type: object SecurityMonitoringCriticalAssetSeverity: description: Severity associated with this critical asset. Either an explicit severity can be set, or the severity can be increased or decreased, or the severity can be left unchanged (no-op). enum: - info - low - medium - high - critical - increase - decrease - no-op example: increase type: string x-enum-varnames: - INFO - LOW - MEDIUM - HIGH - CRITICAL - INCREASE - DECREASE - NO_OP SecurityMonitoringCriticalAssetType: default: critical_assets description: The type of the resource. The value should always be `critical_assets`. enum: - critical_assets example: critical_assets type: string x-enum-varnames: - CRITICAL_ASSETS SecurityMonitoringCriticalAssetUpdateAttributes: description: The critical asset properties to be updated. properties: description: description: A description of the critical asset. example: Production database servers handling PII type: string enabled: description: Whether the critical asset is enabled. example: true type: boolean query: description: The query for the critical asset. It uses the same syntax as the queries to search signals in the Signals Explorer. example: security:monitoring type: string rule_query: description: The rule query of the critical asset, with the same syntax as the search bar for detection rules. This determines which rules this critical asset will apply to. example: type:log_detection source:cloudtrail type: string severity: $ref: "#/components/schemas/SecurityMonitoringCriticalAssetSeverity" tags: description: List of tags associated with the critical asset. example: - technique:T1110-brute-force - source:cloudtrail items: description: A tag string in `key:value` format. type: string type: array version: description: The version of the critical asset being updated. Used for optimistic locking to prevent concurrent modifications. example: 1 format: int32 maximum: 2147483647 type: integer type: object SecurityMonitoringCriticalAssetUpdateData: description: The new critical asset properties; partial updates are supported. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringCriticalAssetUpdateAttributes" type: $ref: "#/components/schemas/SecurityMonitoringCriticalAssetType" required: - type - attributes type: object SecurityMonitoringCriticalAssetUpdateRequest: description: Request object containing the fields to update on the critical asset. properties: data: $ref: "#/components/schemas/SecurityMonitoringCriticalAssetUpdateData" required: - data type: object SecurityMonitoringCriticalAssetsResponse: description: Response object containing the available critical assets. properties: data: description: A list of critical assets objects. items: $ref: "#/components/schemas/SecurityMonitoringCriticalAsset" type: array type: object SecurityMonitoringCrowdStrikeIntegrationConfigCreateAttributes: description: The attributes of a CrowdStrike entity context sync configuration to create. properties: domain: description: The domain associated with the external entity source. example: api.crowdstrike.com type: string integration_type: $ref: "#/components/schemas/SecurityMonitoringIntegrationTypeCrowdStrike" name: description: The display name for the entity context sync configuration. example: My CrowdStrike Integration type: string secrets: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigCrowdStrikeSecrets" settings: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigSettings" required: - integration_type - domain - name - secrets type: object SecurityMonitoringCrowdStrikeIntegrationConfigUpdateAttributes: description: Fields to update on a CrowdStrike entity context sync configuration. properties: domain: description: The new domain associated with the external entity source. example: api.crowdstrike.com type: string enabled: description: Whether the entity context sync should be enabled. example: true type: boolean integration_type: $ref: "#/components/schemas/SecurityMonitoringIntegrationTypeCrowdStrike" name: description: The new display name for the entity context sync configuration. example: My CrowdStrike Integration (renamed) type: string secrets: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigCrowdStrikeSecrets" settings: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigSettings" required: - integration_type type: object SecurityMonitoringCrowdStrikeIntegrationCredentialsValidateAttributes: description: The CrowdStrike credentials to validate against the external entity source. properties: domain: description: The domain associated with the external entity source. example: api.crowdstrike.com type: string integration_type: $ref: "#/components/schemas/SecurityMonitoringIntegrationTypeCrowdStrike" secrets: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigCrowdStrikeSecrets" required: - integration_type - domain - secrets type: object SecurityMonitoringDatasetAttributesRequest: description: The attributes of a dataset create or update request. properties: definition: $ref: "#/components/schemas/SecurityMonitoringDatasetDefinition" description: description: The description of the dataset. Maximum 255 characters. example: A sample dataset used for detection rules. type: string version: description: |- The expected current version of the dataset for optimistic concurrency control on updates. If the dataset's current version does not match, the request is rejected with a 409 Conflict. example: 1 format: int64 type: integer required: - definition type: object SecurityMonitoringDatasetAttributesResponse: description: The attributes of a Cloud SIEM dataset. properties: createdAt: description: The creation timestamp of the dataset, in ISO 8601 format. example: "2025-03-20T10:00:00Z" type: string createdByHandle: description: The Datadog handle of the user who created the dataset. example: bruce.lee type: string createdByName: description: The display name of the user who created the dataset. example: Bruce Lee type: string definition: $ref: "#/components/schemas/SecurityMonitoringDatasetDefinition" description: description: The description of the dataset. example: A sample dataset used for detection rules. type: string id: description: The UUID of the dataset. example: 123e4567-e89b-12d3-a456-426614174000 type: string isDefault: description: Whether the dataset is an out-of-the-box dataset provided by Datadog. example: false type: boolean isDeprecated: description: Whether the dataset is marked as deprecated. example: false type: boolean modifiedAt: description: The timestamp of the last modification of the dataset, in ISO 8601 format. example: "2025-03-20T10:00:00Z" type: string name: description: The unique name of the dataset. example: sample_dataset type: string updatedByHandle: description: The Datadog handle of the user who last updated the dataset. example: bruce.lee nullable: true type: string updatedByName: description: The display name of the user who last updated the dataset. example: Bruce Lee nullable: true type: string version: description: The current version of the dataset. example: 1 format: int64 type: integer required: - id - name - description - version - definition - createdAt - createdByHandle - createdByName - modifiedAt - updatedByHandle - updatedByName - isDefault - isDeprecated type: object SecurityMonitoringDatasetColumn: description: A column exposed by an event platform dataset. properties: column: description: The name of the column. example: message type: string type: description: The type of the column value. example: string type: string required: - column - type type: object SecurityMonitoringDatasetCreateData: description: The data wrapper of a dataset create request. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringDatasetAttributesRequest" type: $ref: "#/components/schemas/SecurityMonitoringDatasetCreateType" required: - type - attributes type: object SecurityMonitoringDatasetCreateRequest: description: Request body for creating a Cloud SIEM dataset. properties: data: $ref: "#/components/schemas/SecurityMonitoringDatasetCreateData" required: - data type: object SecurityMonitoringDatasetCreateResponse: description: Response returned after creating a dataset. properties: data: $ref: "#/components/schemas/SecurityMonitoringDatasetCreateResponseData" required: - data type: object SecurityMonitoringDatasetCreateResponseData: description: The data wrapper of a dataset create response. properties: id: description: The UUID of the newly created dataset. example: 123e4567-e89b-12d3-a456-426614174000 type: string type: $ref: "#/components/schemas/SecurityMonitoringDatasetType" required: - id - type type: object SecurityMonitoringDatasetCreateType: description: The type of resource for a dataset create request. enum: - datasetCreate example: datasetCreate type: string x-enum-varnames: - DATASET_CREATE SecurityMonitoringDatasetData: description: The data wrapper of a dataset response. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringDatasetAttributesResponse" id: description: The UUID of the dataset. example: 123e4567-e89b-12d3-a456-426614174000 type: string type: $ref: "#/components/schemas/SecurityMonitoringDatasetType" required: - id - type - attributes type: object SecurityMonitoringDatasetDefinition: description: |- The definition of the dataset. The shape depends on the value of `data_source`. Use `reference_table` or `managed_resource` for a referential dataset, or one of the event platform sources (for example `logs`, `audit`, `events`, `spans`, `rum`) for an event platform dataset. properties: columns: description: For event platform datasets, the list of columns exposed by the dataset. items: $ref: "#/components/schemas/SecurityMonitoringDatasetColumn" type: array data_source: description: The data source backing this dataset definition. example: logs type: string indexes: description: For event platform datasets, the list of indexes to query. items: type: string type: array name: description: The unique name of the dataset. Must start with a lowercase letter and contain only lowercase letters, digits, and underscores (max 255 characters). example: sample_dataset type: string query_filter: description: For referential datasets, an optional filter expression applied to the table. example: status = 'active' type: string search: $ref: "#/components/schemas/SecurityMonitoringDatasetSearch" storage: description: Storage tier the dataset reads from. Applies to event platform datasets. example: hot type: string table_name: description: For referential datasets, the name of the underlying table. example: my_reference_table type: string time_window: $ref: "#/components/schemas/SecurityMonitoringDatasetTimeWindow" required: - data_source - name type: object SecurityMonitoringDatasetDependenciesRequest: description: Request body for retrieving dependencies of a batch of datasets. properties: data: $ref: "#/components/schemas/SecurityMonitoringDatasetDependenciesRequestData" required: - data type: object SecurityMonitoringDatasetDependenciesRequestAttributes: description: The attributes of a dataset dependencies request. properties: datasetIds: description: The list of dataset UUIDs to query dependencies for. Must contain between 1 and 100 items. example: - 123e4567-e89b-12d3-a456-426614174000 items: type: string type: array required: - datasetIds type: object SecurityMonitoringDatasetDependenciesRequestData: description: The data wrapper of a dataset dependencies request. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringDatasetDependenciesRequestAttributes" required: - attributes type: object SecurityMonitoringDatasetDependenciesResponse: description: Response listing the dependents of each requested dataset. properties: data: $ref: "#/components/schemas/SecurityMonitoringDatasetDependenciesResponseData" required: - data type: object SecurityMonitoringDatasetDependenciesResponseData: description: The list of dataset dependents entries. items: $ref: "#/components/schemas/SecurityMonitoringDatasetDependentsData" type: array SecurityMonitoringDatasetDependentsAttributes: description: The attributes of a dataset dependents entry. properties: count: description: The number of resources that depend on the dataset. example: 0 format: int64 type: integer datasetId: description: The UUID of the dataset whose dependencies are being reported. example: 123e4567-e89b-12d3-a456-426614174000 type: string ids: $ref: "#/components/schemas/SecurityMonitoringDatasetDependentsIds" resource_type: description: The type of resource that depends on the dataset. example: security_detection_rule type: string required: - datasetId - resource_type - ids - count type: object SecurityMonitoringDatasetDependentsData: description: A single entry describing the dependents of one dataset. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringDatasetDependentsAttributes" id: description: The UUID of the dataset. example: 123e4567-e89b-12d3-a456-426614174000 type: string type: $ref: "#/components/schemas/SecurityMonitoringDatasetDependentsType" required: - id - type - attributes type: object SecurityMonitoringDatasetDependentsIds: description: The list of resource IDs that depend on the dataset. example: [] items: type: string type: array SecurityMonitoringDatasetDependentsType: description: The type of resource for a dataset dependents entry. enum: - datasetDependents example: datasetDependents type: string x-enum-varnames: - DATASET_DEPENDENTS SecurityMonitoringDatasetResponse: description: Response containing a single Cloud SIEM dataset. properties: data: $ref: "#/components/schemas/SecurityMonitoringDatasetData" required: - data type: object SecurityMonitoringDatasetSearch: description: The search clause applied to an event platform dataset. properties: query: description: The search query expression. example: "*" type: string required: - query type: object SecurityMonitoringDatasetTimeWindow: description: An optional time window that overrides the default query time range. properties: from: description: Inclusive start of the time window, in milliseconds since the Unix epoch. example: 1700000000000 format: int64 type: integer to: description: Exclusive end of the time window, in milliseconds since the Unix epoch. example: 1700003600000 format: int64 type: integer type: object SecurityMonitoringDatasetType: description: The type of resource for a dataset response. enum: - dataset example: dataset type: string x-enum-varnames: - DATASET SecurityMonitoringDatasetUpdateData: description: The data wrapper of a dataset update request. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringDatasetAttributesRequest" type: $ref: "#/components/schemas/SecurityMonitoringDatasetUpdateType" required: - type - attributes type: object SecurityMonitoringDatasetUpdateRequest: description: Request body for updating a Cloud SIEM dataset. properties: data: $ref: "#/components/schemas/SecurityMonitoringDatasetUpdateData" required: - data type: object SecurityMonitoringDatasetUpdateType: description: The type of resource for a dataset update request. enum: - datasetUpdate example: datasetUpdate type: string x-enum-varnames: - DATASET_UPDATE SecurityMonitoringDatasetVersionChanges: description: The list of field changes between this version of the dataset and the previous one. items: $ref: "#/components/schemas/SecurityMonitoringDatasetVersionFieldChange" type: array SecurityMonitoringDatasetVersionEntry: description: A single entry in the version history of a dataset. properties: changes: $ref: "#/components/schemas/SecurityMonitoringDatasetVersionChanges" dataset: $ref: "#/components/schemas/SecurityMonitoringDatasetAttributesResponse" required: - dataset - changes type: object SecurityMonitoringDatasetVersionFieldChange: description: A single field change between two versions of a dataset. properties: current: description: The current value of the field, serialized as a JSON value. example: New description. field: description: The name of the field that changed. example: description type: string previous: description: The previous value of the field, serialized as a JSON value. example: Old description. required: - field - previous - current type: object SecurityMonitoringDatasetVersionHistoryAttributes: description: The attributes of a dataset version history response. properties: count: description: The total number of versions available for this dataset. example: 1 format: int64 type: integer data: $ref: "#/components/schemas/SecurityMonitoringDatasetVersionHistoryEntries" required: - data - count type: object SecurityMonitoringDatasetVersionHistoryData: description: The data wrapper of a dataset version history response. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringDatasetVersionHistoryAttributes" id: description: The UUID of the dataset. example: 123e4567-e89b-12d3-a456-426614174000 type: string type: $ref: "#/components/schemas/SecurityMonitoringDatasetVersionHistoryType" required: - id - type - attributes type: object SecurityMonitoringDatasetVersionHistoryEntries: additionalProperties: $ref: "#/components/schemas/SecurityMonitoringDatasetVersionEntry" description: A map from version number (as a string) to the dataset state at that version. type: object SecurityMonitoringDatasetVersionHistoryResponse: description: Response containing the version history of a Cloud SIEM dataset. properties: data: $ref: "#/components/schemas/SecurityMonitoringDatasetVersionHistoryData" required: - data type: object SecurityMonitoringDatasetVersionHistoryType: description: The type of resource for a dataset version history response. enum: - dataset_version_history example: dataset_version_history type: string x-enum-varnames: - DATASET_VERSION_HISTORY SecurityMonitoringDatasetsListData: description: A list of dataset data items. items: $ref: "#/components/schemas/SecurityMonitoringDatasetData" type: array SecurityMonitoringDatasetsListMeta: description: Metadata returned with a list of datasets. properties: totalCount: description: The total number of datasets matching the request, across all pages. example: 1 format: int64 type: integer required: - totalCount type: object SecurityMonitoringDatasetsListResponse: description: Response containing a paginated list of Cloud SIEM datasets. properties: data: $ref: "#/components/schemas/SecurityMonitoringDatasetsListData" meta: $ref: "#/components/schemas/SecurityMonitoringDatasetsListMeta" required: - data - meta type: object SecurityMonitoringEntityContextEntityType: default: entity description: |- The type of the entity. Reflects the underlying entity kind from the entity context store (for example, `siem_entity_identity` for identities). Defaults to `entity` when the kind is unknown. example: siem_entity_identity type: string SecurityMonitoringEntraIdAzureAppRegistrationsAttributes: description: The attributes of the Entra ID Azure App Registration prerequisites. properties: azure_app_registrations: description: The Azure App Registrations discovered for the organization. items: $ref: "#/components/schemas/SecurityMonitoringAzureAppRegistration" type: array has_valid_prerequisite: description: Whether at least one Azure App Registration has resource collection enabled. example: true type: boolean integration_id: description: The ID of the Entra ID integration configuration, if one exists. example: 11111111-2222-3333-4444-555555555555 type: string is_enabled: description: Whether the Entra ID integration configuration is enabled, if one exists. example: true type: boolean subscribed_at: description: The time at which the Entra ID integration configuration was created, if one exists. example: "2026-05-01T12:00:00Z" format: date-time type: string required: - azure_app_registrations - has_valid_prerequisite type: object SecurityMonitoringEntraIdAzureAppRegistrationsData: description: The Azure App Registration prerequisites for the Entra ID integration. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringEntraIdAzureAppRegistrationsAttributes" id: description: The ID of the organization the Azure App Registrations belong to. example: "123456" type: string type: $ref: "#/components/schemas/SecurityMonitoringEntraIdAzureAppRegistrationsResourceType" required: - id - type - attributes type: object SecurityMonitoringEntraIdAzureAppRegistrationsResourceType: default: entra_id_azure_app_registrations description: The type of the resource. The value should always be `entra_id_azure_app_registrations`. enum: - entra_id_azure_app_registrations example: entra_id_azure_app_registrations type: string x-enum-varnames: - ENTRA_ID_AZURE_APP_REGISTRATIONS SecurityMonitoringEntraIdAzureAppRegistrationsResponse: description: Response containing the Azure App Registration prerequisites for the Entra ID integration. properties: data: $ref: "#/components/schemas/SecurityMonitoringEntraIdAzureAppRegistrationsData" required: - data type: object SecurityMonitoringEntraIdIntegrationConfigCreateAttributes: description: The attributes of an Entra ID entity context sync configuration to create. properties: domain: description: The domain associated with the external entity source. example: siem-test.com type: string integration_type: $ref: "#/components/schemas/SecurityMonitoringIntegrationTypeEntraId" name: description: The display name for the entity context sync configuration. example: My Entra ID Integration type: string settings: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigSettings" required: - integration_type - domain - name type: object SecurityMonitoringEntraIdIntegrationConfigUpdateAttributes: description: Fields to update on an Entra ID entity context sync configuration. properties: domain: description: The new domain associated with the external entity source. example: siem-test.com type: string enabled: description: Whether the entity context sync should be enabled. example: true type: boolean integration_type: $ref: "#/components/schemas/SecurityMonitoringIntegrationTypeEntraId" name: description: The new display name for the entity context sync configuration. example: My Entra ID Integration (renamed) type: string settings: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigSettings" required: - integration_type type: object SecurityMonitoringEntraIdIntegrationCredentialsValidateAttributes: description: The Entra ID credentials to validate against the external entity source. properties: domain: description: The domain associated with the external entity source. example: siem-test.com type: string integration_type: $ref: "#/components/schemas/SecurityMonitoringIntegrationTypeEntraId" required: - integration_type - domain type: object SecurityMonitoringFilter: description: The rule's suppression filter. properties: action: $ref: "#/components/schemas/SecurityMonitoringFilterAction" query: description: Query for selecting logs to apply the filtering action. type: string type: object SecurityMonitoringFilterAction: description: The type of filtering action. enum: - require - suppress type: string x-enum-varnames: - REQUIRE - SUPPRESS SecurityMonitoringGoogleWorkspaceIntegrationConfigCreateAttributes: description: The attributes of a Google Workspace entity context sync configuration to create. properties: domain: description: The domain associated with the external entity source. example: siem-test.com type: string integration_type: $ref: "#/components/schemas/SecurityMonitoringIntegrationTypeGoogleWorkspace" name: description: The display name for the entity context sync configuration. example: My GWS Integration type: string secrets: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigGoogleWorkspaceSecrets" settings: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigSettings" required: - integration_type - domain - name - secrets type: object SecurityMonitoringGoogleWorkspaceIntegrationConfigUpdateAttributes: description: Fields to update on a Google Workspace entity context sync configuration. properties: domain: description: The new domain associated with the external entity source. example: siem-test.com type: string enabled: description: Whether the entity context sync should be enabled. example: true type: boolean integration_type: $ref: "#/components/schemas/SecurityMonitoringIntegrationTypeGoogleWorkspace" name: description: The new display name for the entity context sync configuration. example: My GWS Integration (renamed) type: string secrets: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigGoogleWorkspaceSecrets" settings: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigSettings" required: - integration_type type: object SecurityMonitoringGoogleWorkspaceIntegrationCredentialsValidateAttributes: description: The Google Workspace credentials to validate against the external entity source. properties: domain: description: The domain associated with the external entity source. example: siem-test.com type: string integration_type: $ref: "#/components/schemas/SecurityMonitoringIntegrationTypeGoogleWorkspace" secrets: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigGoogleWorkspaceSecrets" required: - integration_type - domain - secrets type: object SecurityMonitoringIntegrationActivateAttributes: description: Overrides applied when activating the integration. All fields are optional. properties: domain: description: The domain associated with the external entity source. example: default type: string name: description: The display name for the entity context sync configuration. example: My Entra ID Integration type: string settings: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigSettings" type: object SecurityMonitoringIntegrationActivateData: description: The configuration overrides for the integration to activate. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringIntegrationActivateAttributes" type: $ref: "#/components/schemas/SecurityMonitoringIntegrationActivateResourceType" type: object SecurityMonitoringIntegrationActivateRequest: description: Request body to activate an entity context sync integration for a source type that does not require secrets. properties: data: $ref: "#/components/schemas/SecurityMonitoringIntegrationActivateData" type: object SecurityMonitoringIntegrationActivateResourceType: default: activate_entra_id_request description: The type of the resource. The value should always be `activate_entra_id_request`. enum: - activate_entra_id_request example: activate_entra_id_request type: string x-enum-varnames: - ACTIVATE_ENTRA_ID_REQUEST SecurityMonitoringIntegrationConfigAttributes: description: The attributes of an entity context sync configuration as returned by the API. properties: created_at: description: The time at which the entity context sync configuration was created. example: "2026-05-01T12:00:00Z" format: date-time type: string domain: description: The domain associated with the external entity source (for example, the customer's identity provider domain). example: siem-test.com type: string enabled: description: Whether the sync is enabled and actively ingesting entities into Cloud SIEM. example: true type: boolean integration_type: $ref: "#/components/schemas/SecurityMonitoringIntegrationType" modified_at: description: The time at which the entity context sync configuration was last modified. example: "2026-05-01T12:00:00Z" format: date-time type: string name: description: The display name of the entity context sync configuration. example: My GWS Integration type: string settings: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigSettings" state: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigState" required: - enabled - domain - integration_type type: object SecurityMonitoringIntegrationConfigCreateAttributes: description: The attributes of the entity context sync configuration to create. oneOf: - $ref: "#/components/schemas/SecurityMonitoringGoogleWorkspaceIntegrationConfigCreateAttributes" - $ref: "#/components/schemas/SecurityMonitoringOktaIntegrationConfigCreateAttributes" - $ref: "#/components/schemas/SecurityMonitoringEntraIdIntegrationConfigCreateAttributes" - $ref: "#/components/schemas/SecurityMonitoringCrowdStrikeIntegrationConfigCreateAttributes" - $ref: "#/components/schemas/SecurityMonitoringSentinelOneIntegrationConfigCreateAttributes" SecurityMonitoringIntegrationConfigCreateData: description: The entity context sync configuration to create. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigCreateAttributes" type: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigResourceType" required: - type - attributes type: object SecurityMonitoringIntegrationConfigCreateRequest: description: Request body to create an entity context sync configuration. properties: data: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigCreateData" required: - data type: object SecurityMonitoringIntegrationConfigCrowdStrikeSecrets: description: Credentials for a CrowdStrike entity context sync. properties: client_id: description: The CrowdStrike API client ID. example: abcdef0123456789abcdef0123456789 type: string client_secret: description: The CrowdStrike API client secret. example: aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789ABCDEF type: string required: - client_id - client_secret type: object SecurityMonitoringIntegrationConfigData: description: An entity context sync configuration. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigAttributes" id: description: The unique identifier of the integration configuration. example: 11111111-2222-3333-4444-555555555555 type: string type: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigResourceType" required: - id - type - attributes type: object SecurityMonitoringIntegrationConfigGoogleWorkspaceSecrets: description: Credentials for a Google Workspace entity context sync. properties: admin_email: description: The admin email to impersonate for domain-wide delegation. example: admin@example.com type: string service_account_json: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigGoogleWorkspaceServiceAccount" required: - service_account_json type: object SecurityMonitoringIntegrationConfigGoogleWorkspaceServiceAccount: additionalProperties: {} description: The Google Cloud service account JSON used to authenticate against the Google Workspace Admin SDK. Additional keys beyond those documented are preserved. properties: client_email: description: The service account client email. example: svc@my-project.iam.gserviceaccount.com type: string private_key: description: The service account private key. example: "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----" type: string project_id: description: The Google Cloud project ID that owns the service account. example: my-project type: string type: description: The service account type. Must be `service_account`. example: service_account type: string required: - type - project_id - private_key - client_email type: object SecurityMonitoringIntegrationConfigOktaSecrets: description: Credentials for an Okta entity context sync. properties: api_token: description: The Okta API token used to authenticate against the Okta API. example: 00aBcDeFgHiJkLmNoPqRsTuVwXyZ type: string required: - api_token type: object SecurityMonitoringIntegrationConfigResourceType: default: integration_config description: The type of the resource. The value should always be `integration_config`. enum: - integration_config example: integration_config type: string x-enum-varnames: - INTEGRATION_CONFIG SecurityMonitoringIntegrationConfigResponse: description: Response containing a single entity context sync configuration. properties: data: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigData" required: - data type: object SecurityMonitoringIntegrationConfigSentinelOneSecrets: description: Credentials for a SentinelOne entity context sync. properties: api_token: description: The SentinelOne API token. example: aBcDeFgHiJkLmNoPqRsTuVwXyZ0123456789 type: string required: - api_token type: object SecurityMonitoringIntegrationConfigSettings: additionalProperties: {} description: Free-form, non-sensitive settings for the entity context sync. The accepted keys depend on the source type. example: setting1: value1 type: object SecurityMonitoringIntegrationConfigState: description: The state of the credentials configured on the entity context sync. enum: - valid - invalid - initializing example: valid type: string x-enum-varnames: - VALID - INVALID - INITIALIZING SecurityMonitoringIntegrationConfigUpdateAttributes: description: Fields to update on the entity context sync configuration. All fields other than the integration type are optional. oneOf: - $ref: "#/components/schemas/SecurityMonitoringGoogleWorkspaceIntegrationConfigUpdateAttributes" - $ref: "#/components/schemas/SecurityMonitoringOktaIntegrationConfigUpdateAttributes" - $ref: "#/components/schemas/SecurityMonitoringEntraIdIntegrationConfigUpdateAttributes" - $ref: "#/components/schemas/SecurityMonitoringCrowdStrikeIntegrationConfigUpdateAttributes" - $ref: "#/components/schemas/SecurityMonitoringSentinelOneIntegrationConfigUpdateAttributes" SecurityMonitoringIntegrationConfigUpdateData: description: The entity context sync configuration fields to update. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigUpdateAttributes" type: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigResourceType" required: - type - attributes type: object SecurityMonitoringIntegrationConfigUpdateRequest: description: Request body to update an entity context sync configuration. Supports partial updates. properties: data: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigUpdateData" required: - data type: object SecurityMonitoringIntegrationConfigsResponse: description: Response containing a list of entity context sync configurations. properties: data: description: The list of integration configurations. items: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigData" type: array required: - data type: object SecurityMonitoringIntegrationCredentialsValidateAttributes: description: The credentials to validate against the external entity source. oneOf: - $ref: "#/components/schemas/SecurityMonitoringGoogleWorkspaceIntegrationCredentialsValidateAttributes" - $ref: "#/components/schemas/SecurityMonitoringOktaIntegrationCredentialsValidateAttributes" - $ref: "#/components/schemas/SecurityMonitoringEntraIdIntegrationCredentialsValidateAttributes" - $ref: "#/components/schemas/SecurityMonitoringCrowdStrikeIntegrationCredentialsValidateAttributes" - $ref: "#/components/schemas/SecurityMonitoringSentinelOneIntegrationCredentialsValidateAttributes" SecurityMonitoringIntegrationCredentialsValidateData: description: The credentials to validate. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringIntegrationCredentialsValidateAttributes" type: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigResourceType" required: - type - attributes type: object SecurityMonitoringIntegrationCredentialsValidateRequest: description: Request body to validate credentials against an external entity source before creating a sync configuration. properties: data: $ref: "#/components/schemas/SecurityMonitoringIntegrationCredentialsValidateData" required: - data type: object SecurityMonitoringIntegrationType: description: The type of external source that provides entities to Cloud SIEM. enum: - GOOGLE_WORKSPACE - OKTA - ENTRA_ID - CROWDSTRIKE - SENTINELONE example: GOOGLE_WORKSPACE type: string x-enum-varnames: - GOOGLE_WORKSPACE - OKTA - ENTRA_ID - CROWDSTRIKE - SENTINELONE SecurityMonitoringIntegrationTypeCrowdStrike: description: The source type for a CrowdStrike entity context sync. enum: - CROWDSTRIKE example: CROWDSTRIKE type: string x-enum-varnames: - CROWDSTRIKE SecurityMonitoringIntegrationTypeEntraId: description: The source type for an Entra ID entity context sync. enum: - ENTRA_ID example: ENTRA_ID type: string x-enum-varnames: - ENTRA_ID SecurityMonitoringIntegrationTypeGoogleWorkspace: description: The source type for a Google Workspace entity context sync. enum: - GOOGLE_WORKSPACE example: GOOGLE_WORKSPACE type: string x-enum-varnames: - GOOGLE_WORKSPACE SecurityMonitoringIntegrationTypeOkta: description: The source type for an Okta entity context sync. enum: - OKTA example: OKTA type: string x-enum-varnames: - OKTA SecurityMonitoringIntegrationTypeSentinelOne: description: The source type for a SentinelOne entity context sync. enum: - SENTINELONE example: SENTINELONE type: string x-enum-varnames: - SENTINELONE SecurityMonitoringListRulesResponse: description: List of rules. properties: data: description: Array containing the list of rules. items: $ref: "#/components/schemas/SecurityMonitoringRuleResponse" type: array meta: $ref: "#/components/schemas/ResponseMetaAttributes" type: object SecurityMonitoringOktaIntegrationConfigCreateAttributes: description: The attributes of an Okta entity context sync configuration to create. properties: domain: description: The domain associated with the external entity source. example: siem-test.com type: string integration_type: $ref: "#/components/schemas/SecurityMonitoringIntegrationTypeOkta" name: description: The display name for the entity context sync configuration. example: My Okta Integration type: string secrets: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigOktaSecrets" settings: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigSettings" required: - integration_type - domain - name - secrets type: object SecurityMonitoringOktaIntegrationConfigUpdateAttributes: description: Fields to update on an Okta entity context sync configuration. properties: domain: description: The new domain associated with the external entity source. example: siem-test.com type: string enabled: description: Whether the entity context sync should be enabled. example: true type: boolean integration_type: $ref: "#/components/schemas/SecurityMonitoringIntegrationTypeOkta" name: description: The new display name for the entity context sync configuration. example: My Okta Integration (renamed) type: string secrets: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigOktaSecrets" settings: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigSettings" required: - integration_type type: object SecurityMonitoringOktaIntegrationCredentialsValidateAttributes: description: The Okta credentials to validate against the external entity source. properties: domain: description: The domain associated with the external entity source. example: siem-test.com type: string integration_type: $ref: "#/components/schemas/SecurityMonitoringIntegrationTypeOkta" secrets: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigOktaSecrets" required: - integration_type - domain - secrets type: object SecurityMonitoringPaginatedSuppressionsResponse: description: Response object containing the available suppression rules with pagination metadata. properties: data: description: A list of suppressions objects. items: $ref: "#/components/schemas/SecurityMonitoringSuppression" type: array meta: $ref: "#/components/schemas/SecurityMonitoringSuppressionsMeta" type: object SecurityMonitoringReferenceTable: description: Reference tables used in the queries. properties: checkPresence: description: Whether to include or exclude the matched values. type: boolean columnName: description: The name of the column in the reference table. type: string logFieldPath: description: The field in the log to match against the reference table. type: string ruleQueryName: description: The name of the query to apply the reference table to. type: string tableName: description: The name of the reference table. type: string type: object SecurityMonitoringRuleAnomalyDetectionOptions: additionalProperties: {} description: Options on anomaly detection method. properties: bucketDuration: $ref: "#/components/schemas/SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration" detectionTolerance: $ref: "#/components/schemas/SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance" instantaneousBaseline: $ref: "#/components/schemas/SecurityMonitoringRuleInstantaneousBaseline" learningDuration: $ref: "#/components/schemas/SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration" learningPeriodBaseline: description: An optional override baseline to apply while the rule is in the learning period. Must be greater than or equal to 0. format: int64 minimum: 0 type: integer type: object SecurityMonitoringRuleAnomalyDetectionOptionsBucketDuration: description: "Duration in seconds of the time buckets used to aggregate events matched by the rule.\nMust be greater than or equal to 300." enum: - 300 - 600 - 900 - 1800 - 3600 - 10800 example: 300 format: int32 type: integer x-enum-varnames: - FIVE_MINUTES - TEN_MINUTES - FIFTEEN_MINUTES - THIRTY_MINUTES - ONE_HOUR - THREE_HOURS SecurityMonitoringRuleAnomalyDetectionOptionsDetectionTolerance: description: "An optional parameter that sets how permissive anomaly detection is.\nHigher values require higher deviations before triggering a signal." enum: - 1 - 2 - 3 - 4 - 5 example: 5 format: int32 type: integer x-enum-varnames: - ONE - TWO - THREE - FOUR - FIVE SecurityMonitoringRuleAnomalyDetectionOptionsLearningDuration: description: Learning duration in hours. Anomaly detection waits for at least this amount of historical data before it starts evaluating. enum: - 1 - 6 - 12 - 24 - 48 - 168 - 336 format: int32 type: integer x-enum-varnames: - ONE_HOUR - SIX_HOURS - TWELVE_HOURS - ONE_DAY - TWO_DAYS - ONE_WEEK - TWO_WEEKS SecurityMonitoringRuleBulkDeleteAttributes: description: Attributes for bulk deleting security monitoring rules. properties: ruleIds: description: List of rule IDs to delete. example: - abc-000-u7q - abc-000-7dd items: description: A rule ID to delete. type: string minItems: 1 type: array required: - ruleIds type: object SecurityMonitoringRuleBulkDeleteData: description: Data for bulk deleting security monitoring rules. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringRuleBulkDeleteAttributes" id: description: Request ID. This value is echoed back as the response's resource ID. example: bulk_delete type: string type: $ref: "#/components/schemas/SecurityMonitoringRuleBulkDeleteRequestDataType" required: - attributes - type type: object SecurityMonitoringRuleBulkDeletePayload: description: Payload for bulk deleting security monitoring rules. properties: data: $ref: "#/components/schemas/SecurityMonitoringRuleBulkDeleteData" required: - data type: object SecurityMonitoringRuleBulkDeleteRequestDataType: description: The resource type for a bulk delete request. enum: - bulk_delete_rules example: bulk_delete_rules type: string x-enum-varnames: - BULK_DELETE_RULES SecurityMonitoringRuleBulkDeleteResponse: description: Response for bulk deleting security monitoring rules. properties: data: $ref: "#/components/schemas/SecurityMonitoringRuleBulkDeleteResponseData" type: object SecurityMonitoringRuleBulkDeleteResponseAttributes: description: Attributes for the bulk delete response. properties: deletedRules: description: List of successfully deleted rule IDs. items: type: string type: array failedRules: description: List of rule IDs that could not be deleted. items: type: string type: array type: object SecurityMonitoringRuleBulkDeleteResponseData: description: Data for the bulk delete response. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringRuleBulkDeleteResponseAttributes" id: description: The identifier of the bulk delete response. type: string type: $ref: "#/components/schemas/SecurityMonitoringRuleBulkDeleteResponseDataType" type: object SecurityMonitoringRuleBulkDeleteResponseDataType: description: The resource type for a bulk delete response. enum: - bulk_delete_response example: bulk_delete_response type: string x-enum-varnames: - BULK_DELETE_RESPONSE SecurityMonitoringRuleBulkExportAttributes: description: Attributes for bulk exporting security monitoring rules. properties: ruleIds: description: "List of rule IDs to export. Each rule will be included in the resulting ZIP file\nas a separate JSON file." example: - def-000-u7q - def-000-7dd items: description: A rule ID to include in the bulk export. type: string minItems: 1 type: array required: - ruleIds type: object SecurityMonitoringRuleBulkExportData: description: Data for bulk exporting security monitoring rules. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringRuleBulkExportAttributes" id: description: Request ID. example: bulk_export type: string type: $ref: "#/components/schemas/SecurityMonitoringRuleBulkExportDataType" required: - attributes - type type: object SecurityMonitoringRuleBulkExportDataType: description: The type of the resource. enum: - security_monitoring_rules_bulk_export example: security_monitoring_rules_bulk_export type: string x-enum-varnames: - SECURITY_MONITORING_RULES_BULK_EXPORT SecurityMonitoringRuleBulkExportPayload: description: Payload for bulk exporting security monitoring rules. properties: data: $ref: "#/components/schemas/SecurityMonitoringRuleBulkExportData" required: - data type: object SecurityMonitoringRuleCase: description: Case when signal is generated. properties: actions: description: Action to perform for each rule case. items: $ref: "#/components/schemas/SecurityMonitoringRuleCaseAction" type: array condition: description: "A rule case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated\nbased on the event counts in the previously defined queries." type: string customStatus: $ref: "#/components/schemas/SecurityMonitoringRuleSeverity" name: description: Name of the case. type: string notifications: description: Notification targets for each rule case. items: description: Notification. type: string type: array status: $ref: "#/components/schemas/SecurityMonitoringRuleSeverity" type: object SecurityMonitoringRuleCaseAction: description: Action to perform when a signal is triggered. Only available for Application Security rule type. properties: options: $ref: "#/components/schemas/SecurityMonitoringRuleCaseActionOptions" type: $ref: "#/components/schemas/SecurityMonitoringRuleCaseActionType" type: object SecurityMonitoringRuleCaseActionOptions: additionalProperties: {} description: Options for the rule action properties: duration: description: Duration of the action in seconds. 0 indicates no expiration. example: 0 format: int64 minimum: 0 type: integer flaggedIPType: $ref: "#/components/schemas/SecurityMonitoringRuleCaseActionOptionsFlaggedIPType" userBehaviorName: $ref: "#/components/schemas/SecurityMonitoringRuleCaseActionOptionsUserBehaviorName" type: object SecurityMonitoringRuleCaseActionOptionsFlaggedIPType: description: Used with the case action of type 'flag_ip'. The value specified in this field is applied as a flag to the IP addresses. enum: - SUSPICIOUS - FLAGGED example: FLAGGED type: string x-enum-varnames: - SUSPICIOUS - FLAGGED SecurityMonitoringRuleCaseActionOptionsUserBehaviorName: description: Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule. type: string SecurityMonitoringRuleCaseActionType: description: The action type. enum: - block_ip - block_user - user_behavior - flag_ip type: string x-enum-varnames: - BLOCK_IP - BLOCK_USER - USER_BEHAVIOR - FLAG_IP SecurityMonitoringRuleCaseCreate: description: Case when signal is generated. properties: actions: description: Action to perform for each rule case. items: $ref: "#/components/schemas/SecurityMonitoringRuleCaseAction" type: array condition: description: "A case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated\nbased on the event counts in the previously defined queries." type: string name: description: Name of the case. type: string notifications: description: Notification targets. items: description: Notification. type: string type: array status: $ref: "#/components/schemas/SecurityMonitoringRuleSeverity" required: - status type: object SecurityMonitoringRuleConvertBulkAttributes: description: Attributes for bulk converting security monitoring rules to Terraform. properties: ruleIds: description: "List of rule IDs to convert. Each rule will be included in the resulting ZIP file\nas a separate Terraform file." example: - def-000-u7q - def-000-7dd items: description: A rule ID to include in the bulk convert. type: string minItems: 1 type: array required: - ruleIds type: object SecurityMonitoringRuleConvertBulkData: description: Data for bulk converting security monitoring rules to Terraform. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringRuleConvertBulkAttributes" id: description: Request ID. example: convert_bulk type: string type: $ref: "#/components/schemas/SecurityMonitoringRuleConvertBulkDataType" required: - attributes - type type: object SecurityMonitoringRuleConvertBulkDataType: description: The type of the resource. enum: - security_monitoring_rules_convert_bulk example: security_monitoring_rules_convert_bulk type: string x-enum-varnames: - SECURITY_MONITORING_RULES_CONVERT_BULK SecurityMonitoringRuleConvertBulkPayload: description: Payload for bulk converting security monitoring rules to Terraform. properties: data: $ref: "#/components/schemas/SecurityMonitoringRuleConvertBulkData" required: - data type: object SecurityMonitoringRuleConvertPayload: description: Convert a rule from JSON to Terraform. oneOf: - $ref: "#/components/schemas/SecurityMonitoringStandardRulePayload" - $ref: "#/components/schemas/SecurityMonitoringSignalRulePayload" SecurityMonitoringRuleConvertResponse: description: Result of the convert rule request containing Terraform content. properties: ruleId: description: the ID of the rule. type: string terraformContent: description: Terraform string as a result of converting the rule from JSON. type: string type: object SecurityMonitoringRuleCreatePayload: description: Create a new rule. oneOf: - $ref: "#/components/schemas/SecurityMonitoringStandardRuleCreatePayload" - $ref: "#/components/schemas/SecurityMonitoringSignalRuleCreatePayload" - $ref: "#/components/schemas/CloudConfigurationRuleCreatePayload" SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv: description: "If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise.\nThe severity is decreased by one level: `CRITICAL` in production becomes `HIGH` in non-production, `HIGH` becomes `MEDIUM` and so on. `INFO` remains `INFO`.\nThe decrement is applied when the environment tag of the signal starts with `staging`, `test` or `dev`." example: false type: boolean SecurityMonitoringRuleDetectionMethod: description: The detection method. enum: - threshold - new_value - anomaly_detection - impossible_travel - hardcoded - third_party - anomaly_threshold - sequence_detection type: string x-enum-varnames: - THRESHOLD - NEW_VALUE - ANOMALY_DETECTION - IMPOSSIBLE_TRAVEL - HARDCODED - THIRD_PARTY - ANOMALY_THRESHOLD - SEQUENCE_DETECTION SecurityMonitoringRuleEvaluationWindow: description: "A time window is specified to match when at least one of the cases matches true. This is a sliding window\nand evaluates in real time. For third party detection method, this field is not used." enum: - 0 - 60 - 300 - 600 - 900 - 1800 - 3600 - 7200 - 10800 - 21600 - 43200 - 86400 format: int32 type: integer x-enum-varnames: - ZERO_MINUTES - ONE_MINUTE - FIVE_MINUTES - TEN_MINUTES - FIFTEEN_MINUTES - THIRTY_MINUTES - ONE_HOUR - TWO_HOURS - THREE_HOURS - SIX_HOURS - TWELVE_HOURS - ONE_DAY SecurityMonitoringRuleHardcodedEvaluatorType: description: Hardcoded evaluator type. enum: - log4shell type: string x-enum-varnames: - LOG4SHELL SecurityMonitoringRuleImpossibleTravelOptions: description: Options on impossible travel detection method. properties: baselineUserLocations: $ref: "#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations" baselineUserLocationsDuration: $ref: "#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocationsDuration" type: object SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations: description: "If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user's regular\naccess locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access." example: true type: boolean SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocationsDuration: description: The duration in days during which Datadog learns the user's regular access locations. After this period, signals are generated for accesses from unknown locations. format: int32 maximum: 30 minimum: 1 nullable: true type: integer SecurityMonitoringRuleInstantaneousBaseline: description: When set to true, Datadog uses previous values that fall within the defined learning window to construct the baseline, enabling the system to establish an accurate baseline more rapidly rather than relying solely on gradual learning over time. example: false type: boolean SecurityMonitoringRuleKeepAlive: description: 'Once a signal is generated, the signal will remain "open" if a case is matched at least once within this keep alive window. For third party detection method, this field is not used.' enum: - 0 - 60 - 300 - 600 - 900 - 1800 - 3600 - 7200 - 10800 - 21600 - 43200 - 86400 format: int32 type: integer x-enum-varnames: - ZERO_MINUTES - ONE_MINUTE - FIVE_MINUTES - TEN_MINUTES - FIFTEEN_MINUTES - THIRTY_MINUTES - ONE_HOUR - TWO_HOURS - THREE_HOURS - SIX_HOURS - TWELVE_HOURS - ONE_DAY SecurityMonitoringRuleMaxSignalDuration: description: 'A signal will "close" regardless of the query being matched once the time exceeds the maximum duration. This time is calculated from the first seen timestamp.' enum: - 0 - 60 - 300 - 600 - 900 - 1800 - 3600 - 7200 - 10800 - 21600 - 43200 - 86400 format: int32 type: integer x-enum-varnames: - ZERO_MINUTES - ONE_MINUTE - FIVE_MINUTES - TEN_MINUTES - FIFTEEN_MINUTES - THIRTY_MINUTES - ONE_HOUR - TWO_HOURS - THREE_HOURS - SIX_HOURS - TWELVE_HOURS - ONE_DAY SecurityMonitoringRuleNewValueOptions: description: Options on new value detection method. properties: forgetAfter: $ref: "#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter" instantaneousBaseline: $ref: "#/components/schemas/SecurityMonitoringRuleInstantaneousBaseline" learningDuration: $ref: "#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningDuration" learningMethod: $ref: "#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningMethod" learningThreshold: $ref: "#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningThreshold" type: object SecurityMonitoringRuleNewValueOptionsForgetAfter: description: The duration in days after which a learned value is forgotten. format: int32 maximum: 30 minimum: 1 type: integer SecurityMonitoringRuleNewValueOptionsLearningDuration: default: 0 description: "The duration in days during which values are learned, and after which signals will be generated for values that\nweren't learned. If set to 0, a signal will be generated for all new values after the first value is learned." format: int32 maximum: 30 minimum: 0 type: integer SecurityMonitoringRuleNewValueOptionsLearningMethod: default: duration description: The learning method used to determine when signals should be generated for values that weren't learned. enum: - duration - threshold type: string x-enum-varnames: - DURATION - THRESHOLD SecurityMonitoringRuleNewValueOptionsLearningThreshold: default: 0 description: A number of occurrences after which signals will be generated for values that weren't learned. enum: - 0 - 1 format: int32 type: integer x-enum-varnames: - ZERO_OCCURRENCES - ONE_OCCURRENCE SecurityMonitoringRuleOptions: description: Options. properties: anomalyDetectionOptions: $ref: "#/components/schemas/SecurityMonitoringRuleAnomalyDetectionOptions" complianceRuleOptions: $ref: "#/components/schemas/CloudConfigurationComplianceRuleOptions" decreaseCriticalityBasedOnEnv: $ref: "#/components/schemas/SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv" detectionMethod: $ref: "#/components/schemas/SecurityMonitoringRuleDetectionMethod" evaluationWindow: $ref: "#/components/schemas/SecurityMonitoringRuleEvaluationWindow" hardcodedEvaluatorType: $ref: "#/components/schemas/SecurityMonitoringRuleHardcodedEvaluatorType" impossibleTravelOptions: $ref: "#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptions" keepAlive: $ref: "#/components/schemas/SecurityMonitoringRuleKeepAlive" maxSignalDuration: $ref: "#/components/schemas/SecurityMonitoringRuleMaxSignalDuration" newValueOptions: $ref: "#/components/schemas/SecurityMonitoringRuleNewValueOptions" sequenceDetectionOptions: $ref: "#/components/schemas/SecurityMonitoringRuleSequenceDetectionOptions" thirdPartyRuleOptions: $ref: "#/components/schemas/SecurityMonitoringRuleThirdPartyOptions" type: object SecurityMonitoringRuleProposalError: description: The reason no rule could be generated. Only present when the status is `failed`. properties: kind: description: |- The kind of failure. - `translation_error`: no rule could be generated from the input. Reword the input or add details, then start a new rule proposal. - `internal_error`: the proposal failed because of an internal error. Start a new rule proposal to try again. example: translation_error type: string message: description: A human-readable explanation of why no rule could be generated, when available. example: No log source matches the described activity. type: string type: description: The type of failure within its kind, such as `NoRuleProduced`. example: NoRuleProduced type: string required: - kind type: object SecurityMonitoringRuleProposalInputType: description: |- The type of input to generate the proposed rule from: `natural_language` for a plain-English description of the behavior to detect, `spl` for a Splunk SPL search or saved search definition, or `kql` for a Microsoft KQL query. SPL inputs must be self-contained, with search macros expanded. enum: - natural_language - spl - kql example: natural_language type: string x-enum-varnames: - NATURAL_LANGUAGE - SPL - KQL SecurityMonitoringRuleProposalResponse: description: Response containing a rule proposal. properties: data: $ref: "#/components/schemas/SecurityMonitoringRuleProposalResponseData" required: - data type: object SecurityMonitoringRuleProposalResponseAttributes: description: Attributes of the rule proposal. properties: error: $ref: "#/components/schemas/SecurityMonitoringRuleProposalError" rule: additionalProperties: {} description: |- The proposed Cloud SIEM detection rule in the same format as the create a detection rule endpoint. It is not saved in Cloud SIEM. Only present when the status is `completed`. Review the rule, then create it with the [create a detection rule](https://docs.datadoghq.com/api/latest/security-monitoring/#create-a-detection-rule) endpoint. type: object status: description: |- The status of the rule proposal. `pending` and `in_progress` mean the proposed rule is still being generated. Poll the endpoint again later. `completed` and `failed` are final: `completed` proposals contain the proposed rule in `rule`, and `failed` proposals contain the reason in `error`. example: completed type: string required: - status type: object SecurityMonitoringRuleProposalResponseData: description: Data of the rule proposal. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringRuleProposalResponseAttributes" id: description: The ID of the rule proposal. example: c968cf83-56c2-4d54-a993-6c86dfb83527 format: uuid type: string type: $ref: "#/components/schemas/SecurityMonitoringRuleProposalType" required: - id - type - attributes type: object SecurityMonitoringRuleProposalStartRequest: description: Request to start a rule proposal. properties: data: $ref: "#/components/schemas/SecurityMonitoringRuleProposalStartRequestData" required: - data type: object SecurityMonitoringRuleProposalStartRequestAttributes: description: Attributes of the rule proposal to start. properties: input: description: |- The natural-language description or rule to generate the proposed rule from, in the format given by `inputType`. example: Detect repeated failed Okta logins followed by a successful login from the same IP. maxLength: 65536 type: string inputType: $ref: "#/components/schemas/SecurityMonitoringRuleProposalInputType" required: - inputType - input type: object SecurityMonitoringRuleProposalStartRequestData: description: Data of the rule proposal to start. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringRuleProposalStartRequestAttributes" type: $ref: "#/components/schemas/SecurityMonitoringRuleProposalType" required: - type - attributes type: object SecurityMonitoringRuleProposalStartResponse: description: Response to a started rule proposal. properties: data: $ref: "#/components/schemas/SecurityMonitoringRuleProposalStartResponseData" required: - data type: object SecurityMonitoringRuleProposalStartResponseAttributes: description: Attributes of the started rule proposal. properties: status: description: |- The status of the rule proposal, one of `pending`, `in_progress`, `completed`, or `failed`. For a newly started rule proposal, the status is `pending`. example: pending type: string required: - status type: object SecurityMonitoringRuleProposalStartResponseData: description: Data of the started rule proposal. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringRuleProposalStartResponseAttributes" id: description: |- The ID of the rule proposal. Use it as `proposal_id` to check the proposal status and get the proposed rule. example: c968cf83-56c2-4d54-a993-6c86dfb83527 format: uuid type: string type: $ref: "#/components/schemas/SecurityMonitoringRuleProposalType" required: - id - type - attributes type: object SecurityMonitoringRuleProposalType: default: rule_proposals description: The rule proposal resource type. The value is always `rule_proposals`. enum: - rule_proposals example: rule_proposals type: string x-enum-varnames: - RULE_PROPOSALS SecurityMonitoringRuleQuery: description: Query for matching rule. oneOf: - $ref: "#/components/schemas/SecurityMonitoringStandardRuleQuery" - $ref: "#/components/schemas/SecurityMonitoringSignalRuleQuery" SecurityMonitoringRuleQueryAggregation: description: The aggregation type. enum: - count - cardinality - sum - max - new_value - geo_data - event_count - none type: string x-enum-varnames: - COUNT - CARDINALITY - SUM - MAX - NEW_VALUE - GEO_DATA - EVENT_COUNT - NONE SecurityMonitoringRuleQueryPayload: description: Payload to test a rule query with the expected result. properties: expectedResult: description: Expected result of the test. example: true type: boolean index: description: Index of the query under test. example: 0 format: int64 minimum: 0 type: integer payload: $ref: "#/components/schemas/SecurityMonitoringRuleQueryPayloadData" type: object SecurityMonitoringRuleQueryPayloadData: additionalProperties: {} description: Payload used to test the rule query. properties: ddsource: description: Source of the payload. example: nginx type: string ddtags: description: Tags associated with your data. example: env:staging,version:5.1 type: string hostname: description: The name of the originating host of the log. example: i-012345678 type: string message: description: The message of the payload. example: 2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World type: string service: description: The name of the application or service generating the data. example: payment type: string type: object SecurityMonitoringRuleResponse: description: Create a new rule. oneOf: - $ref: "#/components/schemas/SecurityMonitoringStandardRuleResponse" - $ref: "#/components/schemas/SecurityMonitoringSignalRuleResponse" SecurityMonitoringRuleSequenceDetectionOptions: description: Options on sequence detection method. properties: stepTransitions: description: Transitions defining the allowed order of steps and their evaluation windows. items: $ref: "#/components/schemas/SecurityMonitoringRuleSequenceDetectionStepTransition" type: array steps: description: Steps that define the conditions to be matched in sequence. items: $ref: "#/components/schemas/SecurityMonitoringRuleSequenceDetectionStep" type: array type: object SecurityMonitoringRuleSequenceDetectionStep: description: Step definition for sequence detection containing the step name, condition, and evaluation window. properties: condition: description: Condition referencing rule queries (e.g., `a > 0`). type: string evaluationWindow: $ref: "#/components/schemas/SecurityMonitoringRuleEvaluationWindow" name: description: Unique name identifying the step. type: string type: object SecurityMonitoringRuleSequenceDetectionStepTransition: description: Transition from a parent step to a child step within a sequence detection rule. properties: child: description: Name of the child step. type: string evaluationWindow: $ref: "#/components/schemas/SecurityMonitoringRuleEvaluationWindow" parent: description: Name of the parent step. type: string type: object SecurityMonitoringRuleSeverity: description: Severity of the Security Signal. enum: - info - low - medium - high - critical example: critical type: string x-enum-varnames: - INFO - LOW - MEDIUM - HIGH - CRITICAL SecurityMonitoringRuleSort: description: The sort parameters used for querying security monitoring rules. enum: - name - creation_date - update_date - enabled - type - highest_severity - source - -name - -creation_date - -update_date - -enabled - -type - -highest_severity - -source type: string x-enum-varnames: - NAME - CREATION_DATE - UPDATE_DATE - ENABLED - TYPE - HIGHEST_SEVERITY - SOURCE - NAME_DESCENDING - CREATION_DATE_DESCENDING - UPDATE_DATE_DESCENDING - ENABLED_DESCENDING - TYPE_DESCENDING - HIGHEST_SEVERITY_DESCENDING - SOURCE_DESCENDING SecurityMonitoringRuleTestPayload: description: Test a rule. oneOf: - $ref: "#/components/schemas/SecurityMonitoringStandardRuleTestPayload" SecurityMonitoringRuleTestRequest: description: Test the rule queries of a rule (rule property is ignored when applied to an existing rule) properties: rule: $ref: "#/components/schemas/SecurityMonitoringRuleTestPayload" ruleQueryPayloads: description: Data payloads used to test rules query with the expected result. items: $ref: "#/components/schemas/SecurityMonitoringRuleQueryPayload" type: array type: object SecurityMonitoringRuleTestResponse: description: Result of the test of the rule queries. properties: results: description: "Assert results are returned in the same order as the rule query payloads.\nFor each payload, it returns True if the result matched the expected result,\nFalse otherwise." items: description: Whether the rule query result matched the expected result. type: boolean type: array type: object SecurityMonitoringRuleThirdPartyOptions: description: Options on third party detection method. properties: defaultNotifications: description: Notification targets for the logs that do not correspond to any of the cases. items: description: Notification. type: string type: array defaultStatus: $ref: "#/components/schemas/SecurityMonitoringRuleSeverity" rootQueries: description: Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert. items: $ref: "#/components/schemas/SecurityMonitoringThirdPartyRootQuery" type: array signalTitleTemplate: description: A template for the signal title; if omitted, the title is generated based on the case name. type: string type: object SecurityMonitoringRuleTypeCreate: description: The rule type. enum: - api_security - application_security - log_detection - workload_activity - workload_security type: string x-enum-varnames: - API_SECURITY - APPLICATION_SECURITY - LOG_DETECTION - WORKLOAD_ACTIVITY - WORKLOAD_SECURITY SecurityMonitoringRuleTypeRead: description: The rule type. enum: - log_detection - infrastructure_configuration - workload_security - cloud_configuration - application_security - api_security - workload_activity type: string x-enum-varnames: - LOG_DETECTION - INFRASTRUCTURE_CONFIGURATION - WORKLOAD_SECURITY - CLOUD_CONFIGURATION - APPLICATION_SECURITY - API_SECURITY - WORKLOAD_ACTIVITY SecurityMonitoringRuleTypeTest: description: The rule type. enum: - log_detection type: string x-enum-varnames: - LOG_DETECTION SecurityMonitoringRuleUpdatePayload: description: Update an existing rule. properties: calculatedFields: description: Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined. items: $ref: "#/components/schemas/CalculatedField" type: array cases: description: Cases for generating signals. items: $ref: "#/components/schemas/SecurityMonitoringRuleCase" type: array complianceSignalOptions: $ref: "#/components/schemas/CloudConfigurationRuleComplianceSignalOptions" customMessage: description: Custom/Overridden Message for generated signals (used in case of Default rule update). type: string customName: description: Custom/Overridden name (used in case of Default rule update). type: string filters: description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. items: $ref: "#/components/schemas/SecurityMonitoringFilter" type: array groupSignalsBy: description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. example: - service items: description: Field to group by. type: string type: array hasExtendedTitle: description: Whether the notifications include the triggering group-by values in their title. example: true type: boolean isEnabled: description: Whether the rule is enabled. type: boolean message: description: Message for generated signals. type: string name: description: Name of the rule. type: string options: $ref: "#/components/schemas/SecurityMonitoringRuleOptions" queries: description: Queries for selecting logs which are part of the rule. items: $ref: "#/components/schemas/SecurityMonitoringRuleQuery" type: array referenceTables: description: Reference tables for the rule. items: $ref: "#/components/schemas/SecurityMonitoringReferenceTable" type: array schedulingOptions: $ref: "#/components/schemas/SecurityMonitoringSchedulingOptions" tags: description: Tags for generated signals. items: description: Tag. type: string type: array thirdPartyCases: description: Cases for generating signals from third-party rules. Only available for third-party rules. example: [] items: $ref: "#/components/schemas/SecurityMonitoringThirdPartyRuleCase" type: array version: description: The version of the rule being updated. example: 1 format: int32 maximum: 2147483647 type: integer type: object SecurityMonitoringRuleValidatePayload: description: Validate a rule. oneOf: - $ref: "#/components/schemas/SecurityMonitoringStandardRulePayload" - $ref: "#/components/schemas/SecurityMonitoringSignalRulePayload" - $ref: "#/components/schemas/CloudConfigurationRulePayload" SecurityMonitoringSKU: description: The Cloud SIEM pricing model (SKU) for the organization. enum: - per_gb_analyzed - per_event_in_siem_index_2023 - add_on_2024 - standalone_indexed - unknown example: add_on_2024 type: string x-enum-varnames: - PER_GB_ANALYZED - PER_EVENT_IN_SIEM_INDEX_2023 - ADD_ON_2024 - STANDALONE_INDEXED - UNKNOWN SecurityMonitoringSchedulingOptions: description: Options for scheduled rules. When this field is present, the rule runs based on the schedule. When absent, it runs real-time on ingested logs. nullable: true properties: rrule: description: Schedule for the rule queries, written in RRULE syntax. See [RFC](https://icalendar.org/iCalendar-RFC-5545/3-8-5-3-recurrence-rule.html) for syntax reference. example: FREQ=HOURLY;INTERVAL=1; type: string start: description: Start date for the schedule, in ISO 8601 format without timezone. example: "2025-07-14T12:00:00" type: string timezone: description: Time zone of the start date, in the [tz database](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones) format. example: America/New_York type: string type: object SecurityMonitoringSentinelOneIntegrationConfigCreateAttributes: description: The attributes of a SentinelOne entity context sync configuration to create. properties: domain: description: The domain associated with the external entity source. example: acme.sentinelone.net type: string integration_type: $ref: "#/components/schemas/SecurityMonitoringIntegrationTypeSentinelOne" name: description: The display name for the entity context sync configuration. example: My SentinelOne Integration type: string secrets: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigSentinelOneSecrets" settings: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigSettings" required: - integration_type - domain - name - secrets type: object SecurityMonitoringSentinelOneIntegrationConfigUpdateAttributes: description: Fields to update on a SentinelOne entity context sync configuration. properties: domain: description: The new domain associated with the external entity source. example: acme.sentinelone.net type: string enabled: description: Whether the entity context sync should be enabled. example: true type: boolean integration_type: $ref: "#/components/schemas/SecurityMonitoringIntegrationTypeSentinelOne" name: description: The new display name for the entity context sync configuration. example: My SentinelOne Integration (renamed) type: string secrets: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigSentinelOneSecrets" settings: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigSettings" required: - integration_type type: object SecurityMonitoringSentinelOneIntegrationCredentialsValidateAttributes: description: The SentinelOne credentials to validate against the external entity source. properties: domain: description: The domain associated with the external entity source. example: acme.sentinelone.net type: string integration_type: $ref: "#/components/schemas/SecurityMonitoringIntegrationTypeSentinelOne" secrets: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigSentinelOneSecrets" required: - integration_type - domain - secrets type: object SecurityMonitoringSignal: description: Object description of a security signal. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringSignalAttributes" id: description: The unique ID of the security signal. example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: string type: $ref: "#/components/schemas/SecurityMonitoringSignalType" type: object SecurityMonitoringSignalArchiveComment: description: Optional comment to display on archived signals. type: string SecurityMonitoringSignalArchiveReason: description: Reason a signal is archived. enum: - none - false_positive - testing_or_maintenance - remediated - investigated_case_opened - true_positive_benign - true_positive_malicious - other type: string x-enum-varnames: - NONE - FALSE_POSITIVE - TESTING_OR_MAINTENANCE - REMEDIATED - INVESTIGATED_CASE_OPENED - TRUE_POSITIVE_BENIGN - TRUE_POSITIVE_MALICIOUS - OTHER SecurityMonitoringSignalAssigneeUpdateAttributes: description: Attributes describing the new assignee of a security signal. properties: assignee: $ref: "#/components/schemas/SecurityMonitoringTriageUser" version: $ref: "#/components/schemas/SecurityMonitoringSignalVersion" required: - assignee type: object SecurityMonitoringSignalAssigneeUpdateData: description: Data containing the patch for changing the assignee of a signal. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringSignalAssigneeUpdateAttributes" required: - attributes type: object SecurityMonitoringSignalAssigneeUpdateRequest: description: Request body for changing the assignee of a given security monitoring signal. properties: data: $ref: "#/components/schemas/SecurityMonitoringSignalAssigneeUpdateData" required: - data type: object SecurityMonitoringSignalAttributes: additionalProperties: {} description: "The object containing all signal attributes and their\nassociated values." properties: attributes: additionalProperties: {} description: A JSON object of attributes in the security signal, returned when listing or searching signals. example: workflow: first_seen: "2020-06-23T14:46:01.000Z" last_seen: "2020-06-23T14:46:49.000Z" rule: id: 0f5-e0c-805 name: "Brute Force Attack Grouped By User" version: 12 type: object custom: additionalProperties: {} description: A JSON object of attributes in the security signal, returned when retrieving a single signal. example: workflow: first_seen: "2020-06-23T14:46:01.000Z" last_seen: "2020-06-23T14:46:49.000Z" rule: id: 0f5-e0c-805 name: "Brute Force Attack Grouped By User" version: 12 type: object message: description: The message in the security signal defined by the rule that generated the signal. example: Detect Account Take Over (ATO) through brute force attempts type: string tags: description: An array of tags associated with the security signal. example: - security:attack - technique:T1110-brute-force items: description: The tag associated with the security signal. type: string type: array timestamp: description: The timestamp of the security signal. example: "2019-01-02T09:42:36.320Z" format: date-time type: string type: object SecurityMonitoringSignalIncidentIds: description: Array of incidents that are associated with this signal. example: - 2066 items: description: Public ID attribute of the incident that is associated with the signal. example: 2066 format: int64 type: integer type: array SecurityMonitoringSignalIncidentsUpdateAttributes: description: Attributes describing the new list of related signals for a security signal. properties: incident_ids: $ref: "#/components/schemas/SecurityMonitoringSignalIncidentIds" version: $ref: "#/components/schemas/SecurityMonitoringSignalVersion" required: - incident_ids type: object SecurityMonitoringSignalIncidentsUpdateData: description: Data containing the patch for changing the related incidents of a signal. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringSignalIncidentsUpdateAttributes" required: - attributes type: object SecurityMonitoringSignalIncidentsUpdateRequest: description: Request body for changing the related incidents of a given security monitoring signal. properties: data: $ref: "#/components/schemas/SecurityMonitoringSignalIncidentsUpdateData" required: - data type: object SecurityMonitoringSignalInvestigationQueryTemplateVariables: additionalProperties: items: description: A value for this template variable extracted from the signal. type: string type: array description: Template variables applied to the investigation log query, mapping attribute paths to values extracted from the signal. example: "@userIdentity.arn": - foo type: object SecurityMonitoringSignalListRequest: description: The request for a security signal list. properties: filter: $ref: "#/components/schemas/SecurityMonitoringSignalListRequestFilter" page: $ref: "#/components/schemas/SecurityMonitoringSignalListRequestPage" sort: $ref: "#/components/schemas/SecurityMonitoringSignalsSort" type: object SecurityMonitoringSignalListRequestFilter: description: Search filters for listing security signals. properties: from: description: The minimum timestamp for requested security signals. example: "2019-01-02T09:42:36.320Z" format: date-time type: string query: description: Search query for listing security signals. example: security:attack status:high type: string to: description: The maximum timestamp for requested security signals. example: "2019-01-03T09:42:36.320Z" format: date-time type: string type: object SecurityMonitoringSignalListRequestPage: description: The paging attributes for listing security signals. properties: cursor: description: A list of results using the cursor provided in the previous query. example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== type: string limit: default: 10 description: The maximum number of security signals in the response. example: 25 format: int32 maximum: 1000 type: integer type: object SecurityMonitoringSignalMetadataType: default: signal_metadata description: The type of event. enum: - signal_metadata example: signal_metadata type: string x-enum-varnames: - SIGNAL_METADATA SecurityMonitoringSignalResponse: description: Security Signal response data object. properties: data: $ref: "#/components/schemas/SecurityMonitoringSignal" type: object SecurityMonitoringSignalRuleCreatePayload: description: Create a new signal correlation rule. properties: cases: description: Cases for generating signals. example: [] items: $ref: "#/components/schemas/SecurityMonitoringRuleCaseCreate" type: array filters: description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. items: $ref: "#/components/schemas/SecurityMonitoringFilter" type: array hasExtendedTitle: description: Whether the notifications include the triggering group-by values in their title. example: true type: boolean isEnabled: description: Whether the rule is enabled. example: true type: boolean message: description: Message for generated signals. example: "" type: string name: description: The name of the rule. example: My security monitoring rule. type: string options: $ref: "#/components/schemas/SecurityMonitoringRuleOptions" queries: description: Queries for selecting signals which are part of the rule. example: [] items: $ref: "#/components/schemas/SecurityMonitoringSignalRuleQuery" type: array tags: description: Tags for generated signals. example: - env:prod - team:security items: description: Tag. type: string type: array type: $ref: "#/components/schemas/SecurityMonitoringSignalRuleType" required: - name - isEnabled - queries - options - cases - message type: object SecurityMonitoringSignalRulePayload: description: The payload of a signal correlation rule. properties: cases: description: Cases for generating signals. example: [] items: $ref: "#/components/schemas/SecurityMonitoringRuleCaseCreate" type: array customMessage: description: Custom/Overridden message for generated signals (used in case of Default rule update). type: string customName: description: Custom/Overridden name of the rule (used in case of Default rule update). type: string filters: description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. items: $ref: "#/components/schemas/SecurityMonitoringFilter" type: array hasExtendedTitle: description: Whether the notifications include the triggering group-by values in their title. example: true type: boolean isEnabled: description: Whether the rule is enabled. example: true type: boolean message: description: Message for generated signals. example: "" type: string name: description: The name of the rule. example: My security monitoring rule. type: string options: $ref: "#/components/schemas/SecurityMonitoringRuleOptions" queries: description: Queries for selecting signals which are part of the rule. example: [] items: $ref: "#/components/schemas/SecurityMonitoringSignalRuleQuery" type: array tags: description: Tags for generated signals. example: - env:prod - team:security items: description: Tag. type: string type: array type: $ref: "#/components/schemas/SecurityMonitoringSignalRuleType" required: - name - isEnabled - queries - options - cases - message type: object SecurityMonitoringSignalRuleQuery: description: Query for matching rule on signals. properties: aggregation: $ref: "#/components/schemas/SecurityMonitoringRuleQueryAggregation" correlatedByFields: description: Fields to group by. items: description: Field. type: string type: array correlatedQueryIndex: description: Index of the rule query used to retrieve the correlated field. format: int32 maximum: 9 type: integer metrics: description: Group of target fields to aggregate over. items: description: Field. type: string type: array name: description: Name of the query. type: string ruleId: description: Rule ID to match on signals. example: org-ru1-e1d type: string required: - ruleId type: object SecurityMonitoringSignalRuleResponse: description: Rule. properties: cases: description: Cases for generating signals. items: $ref: "#/components/schemas/SecurityMonitoringRuleCase" type: array compatibleVersion: description: The version of the rule at which its detection logic last changed. Updates that only change the name, message, tags, or notifications do not change this value. example: 1 format: int64 type: integer createdAt: description: When the rule was created, timestamp in milliseconds. format: int64 type: integer creationAuthorId: description: User ID of the user who created the rule. format: int64 type: integer customMessage: description: Custom/Overridden message for generated signals (used in case of Default rule update). type: string customName: description: Custom/Overridden name of the rule (used in case of Default rule update). type: string deprecationDate: description: When the rule will be deprecated, timestamp in milliseconds. format: int64 type: integer filters: description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. items: $ref: "#/components/schemas/SecurityMonitoringFilter" type: array hasExtendedTitle: description: Whether the notifications include the triggering group-by values in their title. type: boolean id: description: The ID of the rule. type: string isDefault: description: Whether the rule is included by default. type: boolean isDeleted: description: Whether the rule has been deleted. type: boolean isEnabled: description: Whether the rule is enabled. type: boolean message: description: Message for generated signals. type: string name: description: The name of the rule. type: string options: $ref: "#/components/schemas/SecurityMonitoringRuleOptions" queries: description: Queries for selecting logs which are part of the rule. items: $ref: "#/components/schemas/SecurityMonitoringSignalRuleResponseQuery" type: array tags: description: Tags for generated signals. items: description: Tag. type: string type: array type: $ref: "#/components/schemas/SecurityMonitoringSignalRuleType" updateAuthorId: description: User ID of the user who updated the rule. format: int64 type: integer version: description: The version of the rule. format: int64 type: integer type: object SecurityMonitoringSignalRuleResponseQuery: description: Query for matching rule on signals. properties: aggregation: $ref: "#/components/schemas/SecurityMonitoringRuleQueryAggregation" correlatedByFields: description: Fields to correlate by. items: description: Field. type: string type: array correlatedQueryIndex: description: Index of the rule query used to retrieve the correlated field. format: int32 maximum: 9 type: integer defaultRuleId: description: Default Rule ID to match on signals. example: d3f-ru1-e1d type: string distinctFields: description: Field for which the cardinality is measured. Sent as an array. items: description: Field. type: string type: array groupByFields: description: Fields to group by. items: description: Field. type: string type: array metrics: description: Group of target fields to aggregate over. items: description: Field. type: string type: array name: description: Name of the query. type: string ruleId: description: Rule ID to match on signals. example: org-ru1-e1d type: string type: object SecurityMonitoringSignalRuleType: description: The rule type. enum: - signal_correlation type: string x-enum-varnames: - SIGNAL_CORRELATION SecurityMonitoringSignalState: description: The new triage state of the signal. enum: - open - archived - under_review example: open type: string x-enum-varnames: - OPEN - ARCHIVED - UNDER_REVIEW SecurityMonitoringSignalStateUpdateAttributes: description: Attributes describing the change of state of a security signal. properties: archive_comment: $ref: "#/components/schemas/SecurityMonitoringSignalArchiveComment" archive_reason: $ref: "#/components/schemas/SecurityMonitoringSignalArchiveReason" state: $ref: "#/components/schemas/SecurityMonitoringSignalState" version: $ref: "#/components/schemas/SecurityMonitoringSignalVersion" required: - state type: object SecurityMonitoringSignalStateUpdateData: description: Data containing the patch for changing the state of a signal. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringSignalStateUpdateAttributes" id: description: The unique ID of the security signal. type: $ref: "#/components/schemas/SecurityMonitoringSignalMetadataType" required: - attributes type: object SecurityMonitoringSignalStateUpdateRequest: description: Request body for changing the state of a given security monitoring signal. properties: data: $ref: "#/components/schemas/SecurityMonitoringSignalStateUpdateData" required: - data type: object SecurityMonitoringSignalSuggestedAction: description: A suggested action for a security signal. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionAttributes" id: description: The unique ID of the suggested action. example: w00-t10-992 type: string type: $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionType" required: - id - type - attributes type: object SecurityMonitoringSignalSuggestedActionAttributes: description: Attributes of a suggested action for a security signal. The available fields depend on the action type. properties: name: description: The name of the investigation log query. example: Cloudtrail events for user ARN type: string query_filter: description: The log query filter for the investigation. example: 'source:cloudtrail @userIdentity.arn:"foo"' type: string template_variables: $ref: "#/components/schemas/SecurityMonitoringSignalInvestigationQueryTemplateVariables" title: description: The title of the recommended blog post. example: Monitor Okta logs to track system access and unusual activity type: string url: description: The URL of the suggested action. example: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22 type: string type: object SecurityMonitoringSignalSuggestedActionList: description: List of suggested actions for a security signal. example: - attributes: name: Cloudtrail events for user ARN query_filter: 'source:cloudtrail @userIdentity.arn:"foo"' template_variables: "@userIdentity.arn": - foo url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22 id: w00-t10-992 type: investigation_log_queries - attributes: title: Monitor Okta logs to track system access and unusual activity url: https://www.datadoghq.com/blog/monitor-activity-with-okta/ id: bxy-o8v-i1a type: recommended_blog_posts items: $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedAction" type: array SecurityMonitoringSignalSuggestedActionType: description: The type of the suggested action resource. enum: - investigation_log_queries - recommended_blog_posts example: investigation_log_queries type: string x-enum-varnames: - INVESTIGATION_LOG_QUERIES - RECOMMENDED_BLOG_POSTS SecurityMonitoringSignalSuggestedActionsResponse: description: Response with suggested actions for a security signal. properties: data: $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionList" required: - data type: object SecurityMonitoringSignalTriageAttributes: description: Attributes describing a triage state update operation over a security signal. properties: archive_comment: $ref: "#/components/schemas/SecurityMonitoringSignalArchiveComment" archive_comment_timestamp: description: Timestamp of the last edit to the comment. format: int64 minimum: 0 type: integer archive_comment_user: $ref: "#/components/schemas/SecurityMonitoringTriageUser" archive_reason: $ref: "#/components/schemas/SecurityMonitoringSignalArchiveReason" assignee: $ref: "#/components/schemas/SecurityMonitoringTriageUser" incident_ids: $ref: "#/components/schemas/SecurityMonitoringSignalIncidentIds" state: $ref: "#/components/schemas/SecurityMonitoringSignalState" state_update_timestamp: description: Timestamp of the last update to the signal state. format: int64 minimum: 0 type: integer state_update_user: $ref: "#/components/schemas/SecurityMonitoringTriageUser" required: - assignee - state - incident_ids type: object SecurityMonitoringSignalTriageUpdateData: description: Data containing the updated triage attributes of the signal. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringSignalTriageAttributes" id: description: The unique ID of the security signal. type: string type: $ref: "#/components/schemas/SecurityMonitoringSignalMetadataType" type: object SecurityMonitoringSignalTriageUpdateResponse: description: The response returned after all triage operations, containing the updated signal triage data. properties: data: $ref: "#/components/schemas/SecurityMonitoringSignalTriageUpdateData" required: - data type: object SecurityMonitoringSignalType: default: signal description: The type of event. enum: - signal example: signal type: string x-enum-varnames: - SIGNAL SecurityMonitoringSignalUpdateAttributes: description: Attributes for updating the triage state or assignee of a security signal. properties: archive_comment: $ref: "#/components/schemas/SecurityMonitoringSignalArchiveComment" archive_reason: $ref: "#/components/schemas/SecurityMonitoringSignalArchiveReason" assignee: $ref: "#/components/schemas/SecurityMonitoringTriageUser" state: $ref: "#/components/schemas/SecurityMonitoringSignalState" version: $ref: "#/components/schemas/SecurityMonitoringSignalVersion" type: object SecurityMonitoringSignalUpdateData: description: Data containing the triage state or assignee update for a security signal. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringSignalUpdateAttributes" type: $ref: "#/components/schemas/SecurityMonitoringSignalMetadataType" required: - attributes type: object SecurityMonitoringSignalUpdateRequest: description: Request body for updating the triage state or assignee of a security signal. properties: data: $ref: "#/components/schemas/SecurityMonitoringSignalUpdateData" required: - data type: object SecurityMonitoringSignalVersion: description: Version of the updated signal. If server side version is higher, update will be rejected. format: int64 type: integer SecurityMonitoringSignalsBulkAssigneeUpdateAttributes: description: Attributes describing the new assignees for a bulk signal update. properties: assignee: description: UUID of the user to assign to the signal. Use an empty string to unassign. example: 773b045d-ccf8-4808-bd3b-955ef6a8c940 type: string version: $ref: "#/components/schemas/SecurityMonitoringSignalVersion" required: - assignee type: object SecurityMonitoringSignalsBulkAssigneeUpdateData: description: Data for updating the assignees for multiple security signals. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringSignalsBulkAssigneeUpdateAttributes" id: description: The unique ID of the security signal. example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: string type: $ref: "#/components/schemas/SecurityMonitoringSignalType" required: - id - attributes type: object SecurityMonitoringSignalsBulkAssigneeUpdateRequest: description: Request body for updating the assignee of multiple security signals. properties: data: description: An array of signal assignee updates. items: $ref: "#/components/schemas/SecurityMonitoringSignalsBulkAssigneeUpdateData" maxItems: 199 type: array required: - data type: object SecurityMonitoringSignalsBulkStateUpdateData: description: Data for updating the state for multiple security signals. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringSignalStateUpdateAttributes" id: description: The unique ID of the security signal. example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: string type: $ref: "#/components/schemas/SecurityMonitoringSignalType" required: - id - attributes type: object SecurityMonitoringSignalsBulkStateUpdateRequest: description: Request body for updating the triage states of multiple security signals. properties: data: description: An array of signal state updates. items: $ref: "#/components/schemas/SecurityMonitoringSignalsBulkStateUpdateData" maxItems: 199 type: array required: - data type: object SecurityMonitoringSignalsBulkTriageEvent: description: A single signal event entry in a bulk triage update response. properties: event: $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageEventAttributes" id: description: The unique ID of the security signal. example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: string required: - id - event type: object SecurityMonitoringSignalsBulkTriageEventAttributes: description: Triage attributes of a security signal returned in a bulk update response. properties: archive_comment: $ref: "#/components/schemas/SecurityMonitoringSignalArchiveComment" archive_comment_timestamp: description: Timestamp of the last edit to the archive comment. format: int64 type: integer archive_comment_user: $ref: "#/components/schemas/SecurityMonitoringTriageUser" archive_reason: $ref: "#/components/schemas/SecurityMonitoringSignalArchiveReason" assignee: $ref: "#/components/schemas/SecurityMonitoringTriageUser" id: description: The unique ID of the security signal. example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: string incident_ids: $ref: "#/components/schemas/SecurityMonitoringSignalIncidentIds" state: $ref: "#/components/schemas/SecurityMonitoringSignalState" state_update_timestamp: description: Timestamp of the last state update. format: int64 type: integer state_update_user: $ref: "#/components/schemas/SecurityMonitoringTriageUser" required: - id - state - assignee - incident_ids type: object SecurityMonitoringSignalsBulkTriageUpdateResponse: description: Response for a bulk triage update of security signals. properties: result: $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageUpdateResult" status: description: The status of the bulk operation. example: done type: string type: description: The type of the response. example: status type: string required: - type - status - result type: object SecurityMonitoringSignalsBulkTriageUpdateResult: description: The result payload of a bulk signal triage update. properties: count: description: The number of signals updated. example: 2 format: int64 type: integer events: description: The list of updated signals. items: $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageEvent" type: array required: - count - events type: object SecurityMonitoringSignalsBulkUpdateData: description: Data for updating a single security signal in a bulk update operation. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringSignalUpdateAttributes" id: description: The unique ID of the security signal. example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: string type: $ref: "#/components/schemas/SecurityMonitoringSignalType" required: - id - attributes type: object SecurityMonitoringSignalsBulkUpdateRequest: description: Request body for updating multiple attributes of multiple security signals. properties: data: description: An array of signal updates. items: $ref: "#/components/schemas/SecurityMonitoringSignalsBulkUpdateData" maxItems: 199 type: array required: - data type: object SecurityMonitoringSignalsListResponse: description: "The response object with all security signals matching the request\nand pagination information." properties: data: description: An array of security signals matching the request. items: $ref: "#/components/schemas/SecurityMonitoringSignal" type: array links: $ref: "#/components/schemas/SecurityMonitoringSignalsListResponseLinks" meta: $ref: "#/components/schemas/SecurityMonitoringSignalsListResponseMeta" type: object SecurityMonitoringSignalsListResponseLinks: description: Links attributes. properties: next: description: "The link for the next set of results. **Note**: The request can also be made using the\nPOST endpoint." example: https://app.datadoghq.com/api/v2/security_monitoring/signals?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== type: string type: object SecurityMonitoringSignalsListResponseMeta: description: Meta attributes. properties: elapsed: description: The time elapsed in milliseconds. example: 132 format: int64 type: integer page: $ref: "#/components/schemas/SecurityMonitoringSignalsListResponseMetaPage" request_id: description: The unique identifier of the request. example: example-request-id type: string status: description: The status of the response. example: done type: string type: object SecurityMonitoringSignalsListResponseMetaPage: description: Paging attributes. properties: after: description: "The cursor used to get the next results, if any. To make the next request, use the same\nparameters with the addition of the `page[cursor]`." example: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== type: string type: object SecurityMonitoringSignalsSort: description: The sort parameters used for querying security signals. enum: - timestamp - -timestamp type: string x-enum-varnames: - TIMESTAMP_ASCENDING - TIMESTAMP_DESCENDING SecurityMonitoringStandardDataSource: default: logs description: Source of events, either logs, audit trail, security signals, or Datadog events. `app_sec_spans` is deprecated in favor of `spans`. enum: - logs - audit - app_sec_spans - spans - security_runtime - network - events - security_signals example: logs type: string x-enum-varnames: - LOGS - AUDIT - APP_SEC_SPANS - SPANS - SECURITY_RUNTIME - NETWORK - EVENTS - SECURITY_SIGNALS SecurityMonitoringStandardRuleCreatePayload: description: Create a new rule. properties: calculatedFields: description: Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined. items: $ref: "#/components/schemas/CalculatedField" type: array cases: description: Cases for generating signals. example: [] items: $ref: "#/components/schemas/SecurityMonitoringRuleCaseCreate" type: array filters: description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. items: $ref: "#/components/schemas/SecurityMonitoringFilter" type: array groupSignalsBy: description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. example: - service items: description: Field to group by. type: string type: array hasExtendedTitle: description: Whether the notifications include the triggering group-by values in their title. example: true type: boolean isEnabled: description: Whether the rule is enabled. example: true type: boolean message: description: Message for generated signals. example: "" type: string name: description: The name of the rule. example: My security monitoring rule. type: string options: $ref: "#/components/schemas/SecurityMonitoringRuleOptions" queries: description: Queries for selecting logs which are part of the rule. example: [] items: $ref: "#/components/schemas/SecurityMonitoringStandardRuleQuery" type: array referenceTables: description: Reference tables for the rule. items: $ref: "#/components/schemas/SecurityMonitoringReferenceTable" type: array schedulingOptions: $ref: "#/components/schemas/SecurityMonitoringSchedulingOptions" tags: description: Tags for generated signals. example: - env:prod - team:security items: description: Tag. type: string type: array thirdPartyCases: description: Cases for generating signals from third-party rules. Only available for third-party rules. example: [] items: $ref: "#/components/schemas/SecurityMonitoringThirdPartyRuleCaseCreate" type: array type: $ref: "#/components/schemas/SecurityMonitoringRuleTypeCreate" required: - name - isEnabled - queries - options - cases - message type: object SecurityMonitoringStandardRulePayload: description: The payload of a rule. properties: calculatedFields: description: Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined. items: $ref: "#/components/schemas/CalculatedField" type: array cases: description: Cases for generating signals. example: [] items: $ref: "#/components/schemas/SecurityMonitoringRuleCaseCreate" type: array customMessage: description: Custom/Overridden message for generated signals (used in case of Default rule update). type: string customName: description: Custom/Overridden name of the rule (used in case of Default rule update). type: string filters: description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. items: $ref: "#/components/schemas/SecurityMonitoringFilter" type: array groupSignalsBy: description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. example: - service items: description: Field to group by. type: string type: array hasExtendedTitle: description: Whether the notifications include the triggering group-by values in their title. example: true type: boolean isEnabled: description: Whether the rule is enabled. example: true type: boolean message: description: Message for generated signals. example: "" type: string name: description: The name of the rule. example: My security monitoring rule. type: string options: $ref: "#/components/schemas/SecurityMonitoringRuleOptions" queries: description: Queries for selecting logs which are part of the rule. example: [] items: $ref: "#/components/schemas/SecurityMonitoringStandardRuleQuery" type: array referenceTables: description: Reference tables for the rule. items: $ref: "#/components/schemas/SecurityMonitoringReferenceTable" type: array schedulingOptions: $ref: "#/components/schemas/SecurityMonitoringSchedulingOptions" tags: description: Tags for generated signals. example: - env:prod - team:security items: description: Tag. type: string type: array thirdPartyCases: description: Cases for generating signals from third-party rules. Only available for third-party rules. example: [] items: $ref: "#/components/schemas/SecurityMonitoringThirdPartyRuleCaseCreate" type: array type: $ref: "#/components/schemas/SecurityMonitoringRuleTypeCreate" required: - name - isEnabled - queries - options - cases - message type: object SecurityMonitoringStandardRuleQuery: description: Query for matching rule. properties: aggregation: $ref: "#/components/schemas/SecurityMonitoringRuleQueryAggregation" customQueryExtension: description: Query extension to append to the logs query. example: a > 3 type: string dataSource: $ref: "#/components/schemas/SecurityMonitoringStandardDataSource" datasetIds: description: IDs of the datasets queried by the rule. Only used when `queryLanguage` is `sql`. items: description: Dataset ID. type: string type: array datasetVersions: additionalProperties: description: Dataset version. format: int64 type: integer description: Version of each dataset used by the rule, keyed by dataset ID. Only used when `queryLanguage` is `sql`. type: object distinctFields: description: Field for which the cardinality is measured. Sent as an array. items: description: Field. type: string type: array groupByFields: description: Fields to group by. items: description: Field. type: string type: array hasOptionalGroupByFields: default: false description: When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with `N/A`, replacing the missing values. example: false type: boolean index: description: "**This field is currently unstable and might be removed in a minor version upgrade.**\nThe index to run the query on, if the `dataSource` is `logs`. Only used for scheduled rules - in other words, when the `schedulingOptions` field is present in the rule payload." type: string indexes: description: List of indexes to query when the `dataSource` is `logs`. Only used for scheduled rules, such as when the `schedulingOptions` field is present in the rule payload. items: description: Index. type: string type: array metric: deprecated: true description: "(Deprecated) The target field to aggregate over when using the sum or max\naggregations. `metrics` field should be used instead." type: string metrics: description: Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values. items: description: Field. type: string type: array name: description: Name of the query. type: string query: description: Query to run on logs. example: a > 3 type: string queryLanguage: description: Language of the query. Use `sql` for SQL-based rules over datasets. Defaults to `event_query`. example: sql type: string type: object SecurityMonitoringStandardRuleResponse: description: Rule. properties: calculatedFields: description: Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined. items: $ref: "#/components/schemas/CalculatedField" type: array cases: description: Cases for generating signals. items: $ref: "#/components/schemas/SecurityMonitoringRuleCase" type: array compatibleVersion: description: The version of the rule at which its detection logic last changed. Updates that only change the name, message, tags, or notifications do not change this value. example: 1 format: int64 type: integer complianceSignalOptions: $ref: "#/components/schemas/CloudConfigurationRuleComplianceSignalOptions" createdAt: description: When the rule was created, timestamp in milliseconds. format: int64 type: integer creationAuthorId: description: User ID of the user who created the rule. format: int64 type: integer customMessage: description: Custom/Overridden message for generated signals (used in case of Default rule update). type: string customName: description: Custom/Overridden name of the rule (used in case of Default rule update). type: string defaultTags: description: Default Tags for default rules (included in tags) example: - security:attacks items: description: Default Tag. type: string type: array deprecationDate: description: When the rule will be deprecated, timestamp in milliseconds. format: int64 type: integer filters: description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. items: $ref: "#/components/schemas/SecurityMonitoringFilter" type: array groupSignalsBy: description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. example: - service items: description: Field to group by. type: string type: array hasExtendedTitle: description: Whether the notifications include the triggering group-by values in their title. type: boolean id: description: The ID of the rule. type: string isDefault: description: Whether the rule is included by default. type: boolean isDeleted: description: Whether the rule has been deleted. type: boolean isEnabled: description: Whether the rule is enabled. type: boolean message: description: Message for generated signals. type: string name: description: The name of the rule. type: string options: $ref: "#/components/schemas/SecurityMonitoringRuleOptions" queries: description: Queries for selecting logs which are part of the rule. items: $ref: "#/components/schemas/SecurityMonitoringStandardRuleQuery" type: array referenceTables: description: Reference tables for the rule. items: $ref: "#/components/schemas/SecurityMonitoringReferenceTable" type: array schedulingOptions: $ref: "#/components/schemas/SecurityMonitoringSchedulingOptions" tags: description: Tags for generated signals. items: description: Tag. type: string type: array thirdPartyCases: description: Cases for generating signals from third-party rules. Only available for third-party rules. example: [] items: $ref: "#/components/schemas/SecurityMonitoringThirdPartyRuleCase" type: array type: $ref: "#/components/schemas/SecurityMonitoringRuleTypeRead" updateAuthorId: description: User ID of the user who updated the rule. format: int64 type: integer updatedAt: description: The date the rule was last updated, in milliseconds. format: int64 type: integer version: description: The version of the rule. format: int64 type: integer type: object SecurityMonitoringStandardRuleTestPayload: description: The payload of a rule to test properties: calculatedFields: description: Calculated fields. Only allowed for scheduled rules - in other words, when schedulingOptions is also defined. items: $ref: "#/components/schemas/CalculatedField" type: array cases: description: Cases for generating signals. example: [] items: $ref: "#/components/schemas/SecurityMonitoringRuleCaseCreate" type: array filters: description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. items: $ref: "#/components/schemas/SecurityMonitoringFilter" type: array groupSignalsBy: description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. example: - service items: description: Field to group by. type: string type: array hasExtendedTitle: description: Whether the notifications include the triggering group-by values in their title. example: true type: boolean isEnabled: description: Whether the rule is enabled. example: true type: boolean message: description: Message for generated signals. example: "" type: string name: description: The name of the rule. example: My security monitoring rule. type: string options: $ref: "#/components/schemas/SecurityMonitoringRuleOptions" queries: description: Queries for selecting logs which are part of the rule. example: [] items: $ref: "#/components/schemas/SecurityMonitoringStandardRuleQuery" type: array referenceTables: description: Reference tables for the rule. items: $ref: "#/components/schemas/SecurityMonitoringReferenceTable" type: array schedulingOptions: $ref: "#/components/schemas/SecurityMonitoringSchedulingOptions" tags: description: Tags for generated signals. example: - env:prod - team:security items: description: Tag. type: string type: array thirdPartyCases: description: Cases for generating signals from third-party rules. Only available for third-party rules. example: [] items: $ref: "#/components/schemas/SecurityMonitoringThirdPartyRuleCaseCreate" type: array type: $ref: "#/components/schemas/SecurityMonitoringRuleTypeTest" required: - name - isEnabled - queries - options - cases - message type: object SecurityMonitoringSuppression: description: The suppression rule's properties. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringSuppressionAttributes" id: $ref: "#/components/schemas/SecurityMonitoringSuppressionID" type: $ref: "#/components/schemas/SecurityMonitoringSuppressionType" type: object SecurityMonitoringSuppressionAttributes: description: The attributes of the suppression rule. properties: creation_date: description: A Unix millisecond timestamp given the creation date of the suppression rule. format: int64 type: integer creator: $ref: "#/components/schemas/SecurityMonitoringUser" data_exclusion_query: description: An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule. example: source:cloudtrail account_id:12345 type: string description: description: A description for the suppression rule. example: This rule suppresses low-severity signals in staging environments. type: string editable: description: Whether the suppression rule is editable. example: true type: boolean enabled: description: Whether the suppression rule is enabled. example: true type: boolean expiration_date: description: A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore. example: 1703187336000 format: int64 type: integer name: description: The name of the suppression rule. example: Custom suppression type: string rule_query: description: The rule query of the suppression rule, with the same syntax as the search bar for detection rules. example: type:log_detection source:cloudtrail type: string start_date: description: A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals. example: 1703187336000 format: int64 type: integer suppression_query: description: The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer. example: env:staging status:low type: string tags: description: List of tags associated with the suppression rule. example: - technique:T1110-brute-force - source:cloudtrail items: description: A tag string in `key:value` format. type: string type: array update_date: description: A Unix millisecond timestamp given the update date of the suppression rule. format: int64 type: integer updater: $ref: "#/components/schemas/SecurityMonitoringUser" version: description: The version of the suppression rule; it starts at 1, and is incremented at each update. example: 42 format: int32 maximum: 2147483647 type: integer type: object SecurityMonitoringSuppressionCreateAttributes: description: Object containing the attributes of the suppression rule to be created. properties: data_exclusion_query: description: An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule. example: source:cloudtrail account_id:12345 type: string description: description: A description for the suppression rule. example: This rule suppresses low-severity signals in staging environments. type: string enabled: description: Whether the suppression rule is enabled. example: true type: boolean expiration_date: description: A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore. example: 1703187336000 format: int64 type: integer name: description: The name of the suppression rule. example: Custom suppression type: string rule_query: description: The rule query of the suppression rule, with the same syntax as the search bar for detection rules. example: type:log_detection source:cloudtrail type: string start_date: description: A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals. example: 1703187336000 format: int64 type: integer suppression_query: description: The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer. example: env:staging status:low type: string tags: description: List of tags associated with the suppression rule. example: - technique:T1110-brute-force - source:cloudtrail items: description: A tag string in `key:value` format. type: string type: array required: - name - enabled - rule_query type: object SecurityMonitoringSuppressionCreateData: description: Object for a single suppression rule. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringSuppressionCreateAttributes" type: $ref: "#/components/schemas/SecurityMonitoringSuppressionType" required: - type - attributes type: object SecurityMonitoringSuppressionCreateRequest: description: Request object that includes the suppression rule that you would like to create. properties: data: $ref: "#/components/schemas/SecurityMonitoringSuppressionCreateData" required: - data type: object SecurityMonitoringSuppressionID: description: The ID of the suppression rule. example: 3dd-0uc-h1s type: string SecurityMonitoringSuppressionResponse: description: Response object containing a single suppression rule. properties: data: $ref: "#/components/schemas/SecurityMonitoringSuppression" type: object SecurityMonitoringSuppressionSort: description: The sort parameters used for querying suppression rules. enum: - name - start_date - expiration_date - update_date - enabled - -name - -start_date - -expiration_date - -update_date - -creation_date - -enabled type: string x-enum-varnames: - NAME - START_DATE - EXPIRATION_DATE - UPDATE_DATE - ENABLED - NAME_DESCENDING - START_DATE_DESCENDING - EXPIRATION_DATE_DESCENDING - UPDATE_DATE_DESCENDING - CREATION_DATE_DESCENDING - ENABLED_DESCENDING SecurityMonitoringSuppressionType: default: suppressions description: The type of the resource. The value should always be `suppressions`. enum: - suppressions example: suppressions type: string x-enum-varnames: - SUPPRESSIONS SecurityMonitoringSuppressionUpdateAttributes: description: The suppression rule properties to be updated. properties: data_exclusion_query: description: An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule. example: source:cloudtrail account_id:12345 type: string description: description: A description for the suppression rule. example: This rule suppresses low-severity signals in staging environments. type: string enabled: description: Whether the suppression rule is enabled. example: true type: boolean expiration_date: description: A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore. If unset, the expiration date of the suppression rule is left untouched. If set to `null`, the expiration date is removed. example: 1703187336000 format: int64 nullable: true type: integer name: description: The name of the suppression rule. example: Custom suppression type: string rule_query: description: The rule query of the suppression rule, with the same syntax as the search bar for detection rules. example: type:log_detection source:cloudtrail type: string start_date: description: A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals. If unset, the start date of the suppression rule is left untouched. If set to `null`, the start date is removed. example: 1703187336000 format: int64 nullable: true type: integer suppression_query: description: The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer. example: env:staging status:low type: string tags: description: List of tags associated with the suppression rule. example: - technique:T1110-brute-force - source:cloudtrail items: description: A tag string in `key:value` format. type: string type: array version: description: The current version of the suppression. This is optional, but it can help prevent concurrent modifications. format: int32 maximum: 2147483647 type: integer type: object SecurityMonitoringSuppressionUpdateData: description: The new suppression properties; partial updates are supported. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringSuppressionUpdateAttributes" type: $ref: "#/components/schemas/SecurityMonitoringSuppressionType" required: - type - attributes type: object SecurityMonitoringSuppressionUpdateRequest: description: Request object containing the fields to update on the suppression rule. properties: data: $ref: "#/components/schemas/SecurityMonitoringSuppressionUpdateData" required: - data type: object SecurityMonitoringSuppressionsMeta: description: Metadata for the suppression list response. properties: page: $ref: "#/components/schemas/SecurityMonitoringSuppressionsPageMeta" type: object SecurityMonitoringSuppressionsPageMeta: description: Pagination metadata. properties: pageNumber: description: Current page number. example: 0 format: int64 type: integer pageSize: description: Current page size. example: 2 format: int64 type: integer totalCount: description: Total count of suppressions. example: 2 format: int64 type: integer type: object SecurityMonitoringSuppressionsResponse: description: Response object containing the available suppression rules. properties: data: description: A list of suppressions objects. items: $ref: "#/components/schemas/SecurityMonitoringSuppression" type: array type: object SecurityMonitoringTerraformBulkExportAttributes: description: Attributes for the bulk export request. properties: resource_ids: description: The list of resource IDs to export. Maximum 1000 items. example: - "" items: description: The ID of the resource to export. type: string maxItems: 1000 type: array required: - resource_ids type: object SecurityMonitoringTerraformBulkExportData: description: The bulk export request data object. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringTerraformBulkExportAttributes" type: description: The JSON:API type. Always `bulk_export_resources`. example: bulk_export_resources type: string required: - type - attributes type: object SecurityMonitoringTerraformBulkExportRequest: description: Request body for bulk exporting security monitoring resources to Terraform. properties: data: $ref: "#/components/schemas/SecurityMonitoringTerraformBulkExportData" required: - data type: object SecurityMonitoringTerraformConvertAttributes: description: Attributes for the convert request. properties: resource_json: additionalProperties: {} description: The resource attributes as a JSON object, matching the structure returned by the corresponding Datadog API (for example, the attributes of a suppression rule). example: enabled: true name: Custom suppression rule_query: type:log_detection source:cloudtrail suppression_query: env:staging status:low type: object required: - resource_json type: object SecurityMonitoringTerraformConvertData: description: The convert request data object. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringTerraformConvertAttributes" id: description: The ID of the resource being converted. example: abc-123 type: string type: description: The JSON:API type. Always `convert_resource`. example: convert_resource type: string required: - type - id - attributes type: object SecurityMonitoringTerraformConvertRequest: description: Request body for converting a security monitoring resource JSON to Terraform. properties: data: $ref: "#/components/schemas/SecurityMonitoringTerraformConvertData" required: - data type: object SecurityMonitoringTerraformExportAttributes: description: Attributes of the Terraform export response. properties: output: description: The Terraform configuration for the resource. type: string resource_id: description: The ID of the exported resource. example: abc-123 type: string type_name: description: The Terraform resource type name. example: datadog_security_monitoring_suppression type: string required: - type_name - resource_id type: object SecurityMonitoringTerraformExportData: description: The Terraform export data object. properties: attributes: $ref: "#/components/schemas/SecurityMonitoringTerraformExportAttributes" id: description: The resource identifier composed of the Terraform type name and the resource ID separated by `|`. example: datadog_security_monitoring_suppression|abc-123 type: string type: description: The JSON:API type. Always `format_resource`. example: format_resource type: string required: - type - id - attributes type: object SecurityMonitoringTerraformExportResponse: description: Response containing the Terraform configuration for a security monitoring resource. properties: data: $ref: "#/components/schemas/SecurityMonitoringTerraformExportData" type: object SecurityMonitoringTerraformResourceType: description: The type of security monitoring resource to export to Terraform. enum: - suppressions - critical_assets - security_filters - rules type: string x-enum-varnames: - SUPPRESSIONS - CRITICAL_ASSETS - SECURITY_FILTERS - RULES SecurityMonitoringThirdPartyRootQuery: description: A query to be combined with the third party case query. properties: groupByFields: description: Fields to group by. items: description: Field. type: string type: array query: description: Query to run on logs. example: source:cloudtrail type: string type: object SecurityMonitoringThirdPartyRuleCase: description: Case when signal is generated by a third party rule. properties: customStatus: $ref: "#/components/schemas/SecurityMonitoringRuleSeverity" name: description: Name of the case. type: string notifications: description: Notification targets for each rule case. items: description: Notification. type: string type: array query: description: A query to map a third party event to this case. type: string status: $ref: "#/components/schemas/SecurityMonitoringRuleSeverity" type: object SecurityMonitoringThirdPartyRuleCaseCreate: description: Case when a signal is generated by a third party rule. properties: name: description: Name of the case. type: string notifications: description: Notification targets for each case. items: description: Notification. type: string type: array query: description: A query to map a third party event to this case. type: string status: $ref: "#/components/schemas/SecurityMonitoringRuleSeverity" required: - status type: object SecurityMonitoringTriageUser: description: Object representing a given user entity. properties: handle: description: The handle for this user account. type: string icon: description: Gravatar icon associated to the user. example: /path/to/matching/gravatar/icon readOnly: true type: string id: description: Numerical ID assigned by Datadog to this user account. format: int64 type: integer name: description: The name for this user account. nullable: true type: string uuid: description: UUID assigned by Datadog to this user account. example: 773b045d-ccf8-4808-bd3b-955ef6a8c940 type: string required: - uuid type: object SecurityMonitoringUser: description: A user. properties: handle: description: The handle of the user. example: john.doe@datadoghq.com type: string name: description: The name of the user. example: John Doe nullable: true type: string type: object SecurityTrigger: description: "Trigger a workflow from a Security Signal or Finding. For automatic triggering a handle must be configured and the workflow must be published." properties: rateLimit: $ref: "#/components/schemas/TriggerRateLimit" type: object SecurityTriggerWrapper: description: "Schema for a Security-based trigger." properties: securityTrigger: $ref: "#/components/schemas/SecurityTrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - securityTrigger type: object Selectors: description: |- Selectors are used to filter security issues for which notifications should be generated. Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source. Only the trigger_source field is required. properties: query: $ref: "#/components/schemas/NotificationRuleQuery" rule_types: $ref: "#/components/schemas/RuleTypes" severities: description: The security rules severities to consider. items: $ref: "#/components/schemas/RuleSeverity" type: array trigger_source: $ref: "#/components/schemas/TriggerSource" required: - trigger_source type: object SelfServiceTriggerWrapper: description: "Schema for a Self Service-based trigger." properties: selfServiceTrigger: description: "Trigger a workflow from Self Service." type: object startStepNames: $ref: "#/components/schemas/StartStepNames" required: - selfServiceTrigger type: object SendSlackMessageAction: description: "Sends a message to a Slack channel." properties: channel: description: "The channel ID." example: CHANNEL type: string type: $ref: "#/components/schemas/SendSlackMessageActionType" workspace: description: "The workspace ID." example: WORKSPACE type: string required: - type - channel - workspace type: object SendSlackMessageActionType: default: send_slack_message description: "Indicates that the action is a send Slack message action." enum: - send_slack_message example: send_slack_message type: string x-enum-varnames: - SEND_SLACK_MESSAGE SendTeamsMessageAction: description: "Sends a message to a Microsoft Teams channel." properties: channel: description: The channel ID. example: CHANNEL type: string team: description: The team ID. example: TEAM type: string tenant: description: The tenant ID. example: TENANT type: string type: $ref: "#/components/schemas/SendTeamsMessageActionType" required: - type - channel - tenant - team type: object SendTeamsMessageActionType: default: send_teams_message description: "Indicates that the action is a send Microsoft Teams message action." enum: - send_teams_message example: send_teams_message type: string x-enum-varnames: - SEND_TEAMS_MESSAGE SensitiveDataScannerConfigRequest: description: Group reorder request. properties: data: $ref: "#/components/schemas/SensitiveDataScannerReorderConfig" meta: $ref: "#/components/schemas/SensitiveDataScannerMetaVersionOnly" required: - data - meta type: object SensitiveDataScannerConfiguration: description: A Sensitive Data Scanner configuration. properties: id: description: ID of the configuration. type: string type: $ref: "#/components/schemas/SensitiveDataScannerConfigurationType" type: object SensitiveDataScannerConfigurationData: description: A Sensitive Data Scanner configuration data. properties: data: $ref: "#/components/schemas/SensitiveDataScannerConfiguration" type: object SensitiveDataScannerConfigurationRelationships: description: Relationships of the configuration. properties: groups: $ref: "#/components/schemas/SensitiveDataScannerGroupList" type: object SensitiveDataScannerConfigurationType: default: sensitive_data_scanner_configuration description: Sensitive Data Scanner configuration type. enum: - sensitive_data_scanner_configuration example: sensitive_data_scanner_configuration type: string x-enum-varnames: - SENSITIVE_DATA_SCANNER_CONFIGURATIONS SensitiveDataScannerCreateGroupResponse: description: Create group response. properties: data: $ref: "#/components/schemas/SensitiveDataScannerGroupResponse" meta: $ref: "#/components/schemas/SensitiveDataScannerMeta" type: object SensitiveDataScannerCreateRuleResponse: description: Create rule response. properties: data: $ref: "#/components/schemas/SensitiveDataScannerRuleResponse" meta: $ref: "#/components/schemas/SensitiveDataScannerMeta" type: object SensitiveDataScannerFilter: description: Filter for the Scanning Group. properties: query: description: Query to filter the events. type: string type: object SensitiveDataScannerGetConfigIncludedArray: description: Included objects from relationships. items: $ref: "#/components/schemas/SensitiveDataScannerGetConfigIncludedItem" type: array SensitiveDataScannerGetConfigIncludedItem: description: An object related to the configuration. oneOf: - $ref: "#/components/schemas/SensitiveDataScannerRuleIncludedItem" - $ref: "#/components/schemas/SensitiveDataScannerGroupIncludedItem" SensitiveDataScannerGetConfigResponse: description: Get all groups response. properties: data: $ref: "#/components/schemas/SensitiveDataScannerGetConfigResponseData" included: $ref: "#/components/schemas/SensitiveDataScannerGetConfigIncludedArray" meta: $ref: "#/components/schemas/SensitiveDataScannerMeta" type: object SensitiveDataScannerGetConfigResponseData: description: Response data related to the scanning groups. properties: attributes: additionalProperties: {} description: Attributes of the Sensitive Data configuration. type: object id: description: ID of the configuration. type: string relationships: $ref: "#/components/schemas/SensitiveDataScannerConfigurationRelationships" type: $ref: "#/components/schemas/SensitiveDataScannerConfigurationType" type: object SensitiveDataScannerGroup: description: A scanning group. properties: id: description: ID of the group. type: string type: $ref: "#/components/schemas/SensitiveDataScannerGroupType" type: object SensitiveDataScannerGroupAttributes: description: Attributes of the Sensitive Data Scanner group. properties: description: description: Description of the group. type: string filter: $ref: "#/components/schemas/SensitiveDataScannerFilter" is_enabled: description: Whether or not the group is enabled. type: boolean name: description: Name of the group. type: string product_list: description: List of products the scanning group applies. items: $ref: "#/components/schemas/SensitiveDataScannerProduct" type: array samplings: description: List of sampling rates per product type. items: $ref: "#/components/schemas/SensitiveDataScannerSamplings" type: array type: object SensitiveDataScannerGroupCreate: description: Data related to the creation of a group. properties: attributes: $ref: "#/components/schemas/SensitiveDataScannerGroupAttributes" relationships: $ref: "#/components/schemas/SensitiveDataScannerGroupRelationships" type: $ref: "#/components/schemas/SensitiveDataScannerGroupType" required: - type - attributes type: object SensitiveDataScannerGroupCreateRequest: description: Create group request. properties: data: $ref: "#/components/schemas/SensitiveDataScannerGroupCreate" meta: $ref: "#/components/schemas/SensitiveDataScannerMetaVersionOnly" type: object SensitiveDataScannerGroupData: description: A scanning group data. properties: data: $ref: "#/components/schemas/SensitiveDataScannerGroup" type: object SensitiveDataScannerGroupDeleteRequest: description: Delete group request. properties: meta: $ref: "#/components/schemas/SensitiveDataScannerMetaVersionOnly" required: - meta type: object SensitiveDataScannerGroupDeleteResponse: description: Delete group response. properties: data: additionalProperties: {} description: Always `null`. nullable: true type: object meta: $ref: "#/components/schemas/SensitiveDataScannerMeta" type: object SensitiveDataScannerGroupIncludedItem: description: A Scanning Group included item. properties: attributes: $ref: "#/components/schemas/SensitiveDataScannerGroupAttributes" id: description: ID of the group. type: string relationships: $ref: "#/components/schemas/SensitiveDataScannerGroupRelationships" type: $ref: "#/components/schemas/SensitiveDataScannerGroupType" type: object SensitiveDataScannerGroupItem: description: Data related to a Sensitive Data Scanner Group. properties: id: description: ID of the group. type: string type: $ref: "#/components/schemas/SensitiveDataScannerGroupType" type: object SensitiveDataScannerGroupList: description: List of groups, ordered. properties: data: description: List of groups. The order is important. items: $ref: "#/components/schemas/SensitiveDataScannerGroupItem" type: array type: object SensitiveDataScannerGroupRelationships: description: Relationships of the group. properties: configuration: $ref: "#/components/schemas/SensitiveDataScannerConfigurationData" rules: $ref: "#/components/schemas/SensitiveDataScannerRuleData" type: object SensitiveDataScannerGroupResponse: description: Response data related to the creation of a group. properties: attributes: $ref: "#/components/schemas/SensitiveDataScannerGroupAttributes" id: description: ID of the group. type: string relationships: $ref: "#/components/schemas/SensitiveDataScannerGroupRelationships" type: $ref: "#/components/schemas/SensitiveDataScannerGroupType" type: object SensitiveDataScannerGroupType: default: sensitive_data_scanner_group description: Sensitive Data Scanner group type. enum: - sensitive_data_scanner_group example: sensitive_data_scanner_group type: string x-enum-varnames: - SENSITIVE_DATA_SCANNER_GROUP SensitiveDataScannerGroupUpdate: description: Data related to the update of a group. properties: attributes: $ref: "#/components/schemas/SensitiveDataScannerGroupAttributes" id: description: ID of the group. type: string relationships: $ref: "#/components/schemas/SensitiveDataScannerGroupRelationships" type: $ref: "#/components/schemas/SensitiveDataScannerGroupType" type: object SensitiveDataScannerGroupUpdateRequest: description: Update group request. properties: data: $ref: "#/components/schemas/SensitiveDataScannerGroupUpdate" meta: $ref: "#/components/schemas/SensitiveDataScannerMetaVersionOnly" required: - data - meta type: object SensitiveDataScannerGroupUpdateResponse: description: Update group response. properties: data: additionalProperties: {} description: Always `null`. nullable: true type: object meta: $ref: "#/components/schemas/SensitiveDataScannerMeta" type: object SensitiveDataScannerIncludedKeywordConfiguration: description: |- Object defining a set of keywords and a number of characters that help reduce noise. You can provide a list of keywords you would like to check within a defined proximity of the matching pattern. If any of the keywords are found within the proximity check, the match is kept. If none are found, the match is discarded. properties: character_count: description: |- The number of characters behind a match detected by Sensitive Data Scanner to look for the keywords defined. `character_count` should be greater than the maximum length of a keyword defined for a rule. example: 30 format: int64 maximum: 50 minimum: 1 type: integer keywords: description: |- Keyword list that will be checked during scanning in order to validate a match. The number of keywords in the list must be less than or equal to 30. example: ["email", "address", "login"] items: description: A keyword to match within the defined proximity of the detected pattern. type: string type: array use_recommended_keywords: description: |- Should the rule use the underlying standard pattern keyword configuration. If set to `true`, the rule must be tied to a standard pattern. If set to `false`, the specified keywords and `character_count` are applied. type: boolean required: - keywords - character_count type: object SensitiveDataScannerMeta: additionalProperties: {} description: Meta response. Always an empty object. type: object SensitiveDataScannerMetaVersionOnly: description: Meta payload containing information about the API. properties: version: description: Version of the API (optional). example: 0 format: int64 minimum: 0 type: integer type: object SensitiveDataScannerProduct: default: logs description: Datadog product onto which Sensitive Data Scanner can be activated. enum: - logs - rum - events - apm type: string x-enum-varnames: - LOGS - RUM - EVENTS - APM SensitiveDataScannerReorderConfig: description: Data related to the reordering of scanning groups. properties: id: description: ID of the configuration. type: string relationships: $ref: "#/components/schemas/SensitiveDataScannerConfigurationRelationships" type: $ref: "#/components/schemas/SensitiveDataScannerConfigurationType" type: object SensitiveDataScannerReorderGroupsResponse: description: Group reorder response. properties: meta: $ref: "#/components/schemas/SensitiveDataScannerMeta" type: object SensitiveDataScannerRule: description: Rule item included in the group. properties: id: description: ID of the rule. type: string type: $ref: "#/components/schemas/SensitiveDataScannerRuleType" type: object SensitiveDataScannerRuleAttributes: description: Attributes of the Sensitive Data Scanner rule. properties: description: description: Description of the rule. type: string excluded_namespaces: description: Attributes excluded from the scan. If namespaces is provided, it has to be a sub-path of the namespaces array. example: ["admin.name"] items: description: An attribute path to exclude from the scan. type: string type: array included_keyword_configuration: $ref: "#/components/schemas/SensitiveDataScannerIncludedKeywordConfiguration" is_enabled: description: Whether or not the rule is enabled. type: boolean name: description: Name of the rule. type: string namespaces: description: |- Attributes included in the scan. If namespaces is empty or missing, all attributes except excluded_namespaces are scanned. If both are missing the whole event is scanned. example: ["admin"] items: description: An attribute path to include in the scan. type: string type: array pattern: description: Not included if there is a relationship to a standard pattern. type: string priority: description: Integer from 1 (high) to 5 (low) indicating rule issue severity. format: int64 maximum: 5 minimum: 1 type: integer suppressions: $ref: "#/components/schemas/SensitiveDataScannerSuppressions" tags: description: List of tags. items: description: A tag associated with the rule. type: string type: array text_replacement: $ref: "#/components/schemas/SensitiveDataScannerTextReplacement" type: object SensitiveDataScannerRuleCreate: description: Data related to the creation of a rule. properties: attributes: $ref: "#/components/schemas/SensitiveDataScannerRuleAttributes" relationships: $ref: "#/components/schemas/SensitiveDataScannerRuleRelationships" type: $ref: "#/components/schemas/SensitiveDataScannerRuleType" required: - type - attributes - relationships type: object SensitiveDataScannerRuleCreateRequest: description: Create rule request. properties: data: $ref: "#/components/schemas/SensitiveDataScannerRuleCreate" meta: $ref: "#/components/schemas/SensitiveDataScannerMetaVersionOnly" required: - data - meta type: object SensitiveDataScannerRuleData: description: Rules included in the group. properties: data: description: Rules included in the group. The order is important. items: $ref: "#/components/schemas/SensitiveDataScannerRule" type: array type: object SensitiveDataScannerRuleDeleteRequest: description: Delete rule request. properties: meta: $ref: "#/components/schemas/SensitiveDataScannerMetaVersionOnly" required: - meta type: object SensitiveDataScannerRuleDeleteResponse: description: Delete rule response. properties: data: additionalProperties: {} description: Always `null`. nullable: true type: object meta: $ref: "#/components/schemas/SensitiveDataScannerMeta" type: object SensitiveDataScannerRuleIncludedItem: description: A Scanning Rule included item. properties: attributes: $ref: "#/components/schemas/SensitiveDataScannerRuleAttributes" id: description: ID of the rule. type: string relationships: $ref: "#/components/schemas/SensitiveDataScannerRuleRelationships" type: $ref: "#/components/schemas/SensitiveDataScannerRuleType" type: object SensitiveDataScannerRuleRelationships: description: Relationships of a scanning rule. properties: group: $ref: "#/components/schemas/SensitiveDataScannerGroupData" standard_pattern: $ref: "#/components/schemas/SensitiveDataScannerStandardPatternData" type: object SensitiveDataScannerRuleResponse: description: Response data related to the creation of a rule. properties: attributes: $ref: "#/components/schemas/SensitiveDataScannerRuleAttributes" id: description: ID of the rule. type: string relationships: $ref: "#/components/schemas/SensitiveDataScannerRuleRelationships" type: $ref: "#/components/schemas/SensitiveDataScannerRuleType" type: object SensitiveDataScannerRuleType: default: sensitive_data_scanner_rule description: Sensitive Data Scanner rule type. enum: - sensitive_data_scanner_rule example: sensitive_data_scanner_rule type: string x-enum-varnames: - SENSITIVE_DATA_SCANNER_RULE SensitiveDataScannerRuleUpdate: description: Data related to the update of a rule. properties: attributes: $ref: "#/components/schemas/SensitiveDataScannerRuleAttributes" id: description: ID of the rule. type: string relationships: $ref: "#/components/schemas/SensitiveDataScannerRuleRelationships" type: $ref: "#/components/schemas/SensitiveDataScannerRuleType" type: object SensitiveDataScannerRuleUpdateRequest: description: Update rule request. properties: data: $ref: "#/components/schemas/SensitiveDataScannerRuleUpdate" meta: $ref: "#/components/schemas/SensitiveDataScannerMetaVersionOnly" required: - data - meta type: object SensitiveDataScannerRuleUpdateResponse: description: Update rule response. properties: data: additionalProperties: {} description: Always `null`. nullable: true type: object meta: $ref: "#/components/schemas/SensitiveDataScannerMeta" type: object SensitiveDataScannerSamplings: description: Sampling configurations for the Scanning Group. properties: product: $ref: "#/components/schemas/SensitiveDataScannerProduct" rate: description: Rate at which data in product type will be scanned, as a percentage. example: 100.0 format: double maximum: 100.0 minimum: 0.0 type: number type: object SensitiveDataScannerStandardPattern: description: Data containing the standard pattern id. properties: id: description: ID of the standard pattern. type: string type: $ref: "#/components/schemas/SensitiveDataScannerStandardPatternType" type: object SensitiveDataScannerStandardPatternAttributes: description: Attributes of the Sensitive Data Scanner standard pattern. properties: description: description: Description of the standard pattern. type: string included_keywords: description: List of included keywords. items: description: A keyword used to increase match precision for the standard pattern. type: string type: array name: description: Name of the standard pattern. type: string pattern: deprecated: true description: (Deprecated) Regex to match, optionally documented for older standard rules. Refer to the `description` field to understand what the rule does. type: string priority: description: Integer from 1 (high) to 5 (low) indicating standard pattern issue severity. format: int64 maximum: 5 minimum: 1 type: integer suppressions: $ref: "#/components/schemas/SensitiveDataScannerSuppressions" tags: description: List of tags. items: description: A tag associated with the standard pattern. type: string type: array type: object SensitiveDataScannerStandardPatternData: description: A standard pattern. properties: data: $ref: "#/components/schemas/SensitiveDataScannerStandardPattern" type: object SensitiveDataScannerStandardPatternType: default: sensitive_data_scanner_standard_pattern description: Sensitive Data Scanner standard pattern type. enum: - sensitive_data_scanner_standard_pattern example: sensitive_data_scanner_standard_pattern type: string x-enum-varnames: - SENSITIVE_DATA_SCANNER_STANDARD_PATTERN SensitiveDataScannerStandardPatternsResponse: description: List Standard patterns response. items: $ref: "#/components/schemas/SensitiveDataScannerStandardPatternsResponseItem" type: array SensitiveDataScannerStandardPatternsResponseData: description: List Standard patterns response data. properties: data: $ref: "#/components/schemas/SensitiveDataScannerStandardPatternsResponse" type: object SensitiveDataScannerStandardPatternsResponseItem: description: Standard pattern item. properties: attributes: $ref: "#/components/schemas/SensitiveDataScannerStandardPatternAttributes" id: description: ID of the standard pattern. type: string type: $ref: "#/components/schemas/SensitiveDataScannerStandardPatternType" type: object SensitiveDataScannerSuppressions: description: |- Object describing suppressions for a rule, or the recommended suppression lists published by a standard pattern. There are three types of suppressions, `starts_with`, `ends_with`, and `exact_match`. Rules based on the Datadog library can use recommended or custom suppressions. Custom rules can only use custom suppressions. Suppressed matches are not obfuscated, counted in metrics, or displayed in the Findings page. properties: ends_with: description: List of strings to use for suppression of matches ending with these strings. example: ["@example.com", "another.example.com"] items: description: A string suffix; matches ending with this value are suppressed. type: string type: array exact_match: description: List of strings to use for suppression of matches exactly matching these strings. example: ["admin@example.com", "user@example.com"] items: description: A string value; matches exactly equal to this value are suppressed. type: string type: array starts_with: description: List of strings to use for suppression of matches starting with these strings. example: ["admin", "user"] items: description: A string prefix; matches starting with this value are suppressed. type: string type: array use_recommended_suppressions: description: |- Should the rule use the underlying standard pattern suppression configuration. If set to `true`, the rule must be tied to a standard pattern. If set to `false`, the specified suppressions are applied. type: boolean type: object SensitiveDataScannerTextReplacement: description: Object describing how the scanned event will be replaced. properties: number_of_chars: description: |- Required if type == 'partial_replacement_from_beginning' or 'partial_replacement_from_end'. It must be > 0. format: int64 minimum: 0 type: integer replacement_string: description: Required if type == 'replacement_string'. type: string should_save_match: description: Only valid when type == `replacement_string`. When enabled, matches can be unmasked in logs by users with ‘Data Scanner Unmask’ permission. As a security best practice, avoid masking for highly-sensitive, long-lived data. type: boolean type: $ref: "#/components/schemas/SensitiveDataScannerTextReplacementType" type: object SensitiveDataScannerTextReplacementType: default: none description: |- Type of the replacement text. None means no replacement. hash means the data will be stubbed. replacement_string means that one can chose a text to replace the data. partial_replacement_from_beginning allows a user to partially replace the data from the beginning, and partial_replacement_from_end on the other hand, allows to replace data from the end. enum: - none - hash - replacement_string - partial_replacement_from_beginning - partial_replacement_from_end type: string x-enum-varnames: - NONE - HASH - REPLACEMENT_STRING - PARTIAL_REPLACEMENT_FROM_BEGINNING - PARTIAL_REPLACEMENT_FROM_END SerialExecution: description: "Whether to execute the workflow serially for an incident." properties: enabled: description: "Whether serial execution is enabled." example: false type: boolean required: - enabled type: object ServiceAccessToken: description: Datadog access token. properties: attributes: $ref: "#/components/schemas/ServiceAccessTokenAttributes" id: description: ID of the access token. type: string relationships: $ref: "#/components/schemas/ServiceAccessTokenRelationships" type: $ref: "#/components/schemas/ServiceAccessTokensType" type: object ServiceAccessTokenAttributes: description: Attributes of an access token. properties: created_at: description: Creation date of the access token. example: "2024-01-01T00:00:00+00:00" format: date-time readOnly: true type: string expires_at: description: Expiration date of the access token. example: "2025-12-31T23:59:59+00:00" format: date-time nullable: true readOnly: true type: string last_used_at: description: Date the access token was last used. example: "2025-06-15T12:30:00+00:00" format: date-time nullable: true readOnly: true type: string modified_at: description: Date of last modification of the access token. example: "2024-06-01T00:00:00+00:00" format: date-time nullable: true readOnly: true type: string name: description: Name of the access token. example: "My Access Token" type: string public_portion: description: The public portion of the access token. example: "ddsat_abc123" readOnly: true type: string scopes: description: Array of scopes granted to the access token. example: - "dashboards_read" - "dashboards_write" items: description: Name of scope. type: string type: array type: object ServiceAccessTokenCreateResponse: description: Response for creating an access token. Includes the token key. properties: data: $ref: "#/components/schemas/FullServiceAccessToken" type: object ServiceAccessTokenRelationships: description: Resources related to the access token. properties: leak_information: $ref: "#/components/schemas/RelationshipToLeakedKey" owned_by: $ref: "#/components/schemas/RelationshipToServiceAccount" type: object ServiceAccessTokenResponse: description: Response for retrieving an access token. properties: data: $ref: "#/components/schemas/ServiceAccessToken" included: $ref: "#/components/schemas/AccessTokenResponseIncludedArray" type: object ServiceAccessTokenResponseMeta: description: Additional information related to the access token response. properties: page: $ref: "#/components/schemas/ServiceAccessTokenResponseMetaPage" type: object ServiceAccessTokenResponseMetaPage: description: Pagination information. properties: total_filtered_count: description: Total filtered access token count. format: int64 type: integer type: object ServiceAccessTokensType: default: service_access_tokens description: Service access tokens resource type. enum: - service_access_tokens example: service_access_tokens type: string x-enum-varnames: - SERVICE_ACCESS_TOKENS ServiceAccountAccessTokenCreateAttributes: description: Attributes used to create a service account access token. properties: expires_at: description: Expiration date of the access token. Optional for service account tokens. example: "2025-12-31T23:59:59+00:00" format: date-time type: string name: description: Name of the access token. example: "Service Account Access Token" type: string scopes: description: Array of scopes to grant the access token. example: - "dashboards_read" - "dashboards_write" items: description: Name of scope. type: string type: array required: - name - scopes type: object ServiceAccountAccessTokenCreateData: description: Object used to create a service account access token. properties: attributes: $ref: "#/components/schemas/ServiceAccountAccessTokenCreateAttributes" type: $ref: "#/components/schemas/ServiceAccessTokensType" required: - attributes - type type: object ServiceAccountAccessTokenCreateRequest: description: Request used to create a service account access token. properties: data: $ref: "#/components/schemas/ServiceAccountAccessTokenCreateData" required: - data type: object ServiceAccountAccessTokenUpdateAttributes: description: Attributes used to update a service account access token. properties: name: description: Name of the access token. example: "Updated Service Access Token" type: string scopes: description: Array of scopes to grant the access token. example: - "dashboards_read" - "dashboards_write" items: description: Name of scope. type: string type: array type: object ServiceAccountAccessTokenUpdateData: description: Object used to update a service account access token. properties: attributes: $ref: "#/components/schemas/ServiceAccountAccessTokenUpdateAttributes" id: description: ID of the access token. example: "00112233-4455-6677-8899-aabbccddeeff" type: string type: $ref: "#/components/schemas/ServiceAccessTokensType" required: - attributes - id - type type: object ServiceAccountAccessTokenUpdateRequest: description: Request used to update a service account access token. properties: data: $ref: "#/components/schemas/ServiceAccountAccessTokenUpdateData" required: - data type: object ServiceAccountCreateAttributes: description: Attributes of the created user. properties: email: description: The email of the user. example: "jane.doe@example.com" type: string name: description: The name of the user. type: string service_account: description: Whether the user is a service account. Must be true. example: true type: boolean title: description: The title of the user. type: string required: - email - service_account type: object ServiceAccountCreateData: description: Object to create a service account User. properties: attributes: $ref: "#/components/schemas/ServiceAccountCreateAttributes" relationships: $ref: "#/components/schemas/UserRelationships" type: $ref: "#/components/schemas/UsersType" required: - attributes - type type: object ServiceAccountCreateRequest: description: Create a service account. properties: data: $ref: "#/components/schemas/ServiceAccountCreateData" required: - data type: object ServiceAccountType: description: Service account resource type. enum: - service_account example: service_account type: string x-enum-varnames: - SERVICE_ACCOUNT ServiceDefinitionCreateResponse: description: Create service definitions response. properties: data: description: Create service definitions response payload. items: $ref: "#/components/schemas/ServiceDefinitionData" type: array type: object ServiceDefinitionData: description: Service definition data. properties: attributes: $ref: "#/components/schemas/ServiceDefinitionDataAttributes" id: description: Service definition id. type: string type: description: Service definition type. type: string type: object ServiceDefinitionDataAttributes: description: Service definition attributes. properties: meta: $ref: "#/components/schemas/ServiceDefinitionMeta" schema: $ref: "#/components/schemas/ServiceDefinitionSchema" type: object ServiceDefinitionGetResponse: description: Get service definition response. properties: data: $ref: "#/components/schemas/ServiceDefinitionData" type: object ServiceDefinitionMeta: description: Metadata about a service definition. properties: github-html-url: description: GitHub HTML URL. type: string ingested-schema-version: description: Ingestion schema version. type: string ingestion-source: description: Ingestion source of the service definition. type: string last-modified-time: description: Last modified time of the service definition. type: string origin: description: User defined origin of the service definition. type: string origin-detail: description: User defined origin's detail of the service definition. type: string warnings: description: A list of schema validation warnings. items: $ref: "#/components/schemas/ServiceDefinitionMetaWarnings" type: array type: object ServiceDefinitionMetaWarnings: description: Schema validation warnings. properties: instance-location: description: The warning instance location. type: string keyword-location: description: The warning keyword location. type: string message: description: The warning message. type: string type: object ServiceDefinitionRaw: description: Service Definition in raw JSON/YAML representation. example: |- --- schema-version: v2 dd-service: my-service type: string ServiceDefinitionSchema: description: Service definition schema. oneOf: - $ref: "#/components/schemas/ServiceDefinitionV1" - $ref: "#/components/schemas/ServiceDefinitionV2" - $ref: "#/components/schemas/ServiceDefinitionV2Dot1" - $ref: "#/components/schemas/ServiceDefinitionV2Dot2" ServiceDefinitionSchemaVersions: description: Schema versions enum: - v1 - v2 - v2.1 - v2.2 type: string x-enum-varnames: - V1 - V2 - V2_1 - V2_2 ServiceDefinitionV1: deprecated: true description: Deprecated - Service definition V1 for providing additional service metadata and integrations. properties: contact: $ref: "#/components/schemas/ServiceDefinitionV1Contact" extensions: additionalProperties: {} description: Extensions to V1 schema. example: {"myorg/extension": "extensionValue"} type: object external-resources: description: A list of external links related to the services. items: $ref: "#/components/schemas/ServiceDefinitionV1Resource" type: array info: $ref: "#/components/schemas/ServiceDefinitionV1Info" integrations: $ref: "#/components/schemas/ServiceDefinitionV1Integrations" org: $ref: "#/components/schemas/ServiceDefinitionV1Org" schema-version: $ref: "#/components/schemas/ServiceDefinitionV1Version" tags: description: A set of custom tags. example: ["my:tag", "service:tag"] items: description: A custom tag string in `key:value` format. type: string type: array required: - schema-version - info type: object ServiceDefinitionV1Contact: description: Contact information about the service. properties: email: description: Service owner’s email. example: contact@datadoghq.com type: string slack: description: Service owner’s Slack channel. example: https://yourcompany.slack.com/archives/channel123 type: string type: object ServiceDefinitionV1Info: description: Basic information about a service. properties: dd-service: description: Unique identifier of the service. Must be unique across all services and is used to match with a service in Datadog. example: myservice type: string description: description: A short description of the service. example: A shopping cart service type: string display-name: description: A friendly name of the service. example: My Service type: string service-tier: description: Service tier. example: Tier 1 type: string required: [dd-service] type: object ServiceDefinitionV1Integrations: description: Third party integrations that Datadog supports. properties: pagerduty: $ref: "#/components/schemas/ServiceDefinitionV1Pagerduty" type: object ServiceDefinitionV1Org: description: Org related information about the service. properties: application: description: App feature this service supports. example: E-Commerce type: string team: description: Team that owns the service. example: my-team type: string type: object ServiceDefinitionV1Pagerduty: description: PagerDuty service URL for the service. example: https://my-org.pagerduty.com/service-directory/PMyService type: string ServiceDefinitionV1Resource: description: Service's external links. properties: name: description: Link name. example: Runbook type: string type: $ref: "#/components/schemas/ServiceDefinitionV1ResourceType" url: description: Link URL. example: https://my-runbook type: string required: - name - type - url type: object ServiceDefinitionV1ResourceType: description: Link type. enum: - doc - wiki - runbook - url - repo - dashboard - oncall - code - link example: runbook type: string x-enum-varnames: - DOC - WIKI - RUNBOOK - URL - REPO - DASHBOARD - ONCALL - CODE - LINK ServiceDefinitionV1Version: default: v1 description: Schema version being used. enum: - v1 example: v1 type: string x-enum-varnames: - V1 ServiceDefinitionV2: description: Service definition V2 for providing service metadata and integrations. properties: contacts: description: A list of contacts related to the services. items: $ref: "#/components/schemas/ServiceDefinitionV2Contact" type: array dd-service: description: Unique identifier of the service. Must be unique across all services and is used to match with a service in Datadog. example: my-service type: string dd-team: description: Experimental feature. A Team handle that matches a Team in the Datadog Teams product. example: my-team type: string docs: description: A list of documentation related to the services. items: $ref: "#/components/schemas/ServiceDefinitionV2Doc" type: array extensions: additionalProperties: {} description: Extensions to V2 schema. example: {"myorg/extension": "extensionValue"} type: object integrations: $ref: "#/components/schemas/ServiceDefinitionV2Integrations" links: description: A list of links related to the services. items: $ref: "#/components/schemas/ServiceDefinitionV2Link" type: array repos: description: A list of code repositories related to the services. items: $ref: "#/components/schemas/ServiceDefinitionV2Repo" type: array schema-version: $ref: "#/components/schemas/ServiceDefinitionV2Version" tags: description: A set of custom tags. example: ["my:tag", "service:tag"] items: description: A custom tag string in `key:value` format. type: string type: array team: description: Team that owns the service. example: my-team type: string required: - schema-version - dd-service type: object ServiceDefinitionV2Contact: description: Service owner's contacts information. oneOf: - $ref: "#/components/schemas/ServiceDefinitionV2Email" - $ref: "#/components/schemas/ServiceDefinitionV2Slack" - $ref: "#/components/schemas/ServiceDefinitionV2MSTeams" ServiceDefinitionV2Doc: description: Service documents. properties: name: description: Document name. example: Architecture type: string provider: description: Document provider. example: google drive type: string url: description: Document URL. example: "https://gdrive/mydoc" type: string required: - name - url type: object ServiceDefinitionV2Dot1: description: Service definition v2.1 for providing service metadata and integrations. properties: application: description: Identifier for a group of related services serving a product feature, which the service is a part of. example: my-app type: string contacts: description: A list of contacts related to the services. items: $ref: "#/components/schemas/ServiceDefinitionV2Dot1Contact" type: array dd-service: description: Unique identifier of the service. Must be unique across all services and is used to match with a service in Datadog. example: my-service type: string description: description: A short description of the service. example: My service description type: string extensions: additionalProperties: {} description: Extensions to v2.1 schema. example: {"myorg/extension": "extensionValue"} type: object integrations: $ref: "#/components/schemas/ServiceDefinitionV2Dot1Integrations" lifecycle: description: The current life cycle phase of the service. example: sandbox type: string links: description: A list of links related to the services. items: $ref: "#/components/schemas/ServiceDefinitionV2Dot1Link" type: array schema-version: $ref: "#/components/schemas/ServiceDefinitionV2Dot1Version" tags: description: A set of custom tags. example: ["my:tag", "service:tag"] items: description: A custom tag string in `key:value` format. type: string type: array team: description: Team that owns the service. It is used to locate a team defined in Datadog Teams if it exists. example: my-team type: string tier: description: Importance of the service. example: High type: string required: - schema-version - dd-service type: object ServiceDefinitionV2Dot1Contact: description: Service owner's contacts information. oneOf: - $ref: "#/components/schemas/ServiceDefinitionV2Dot1Email" - $ref: "#/components/schemas/ServiceDefinitionV2Dot1Slack" - $ref: "#/components/schemas/ServiceDefinitionV2Dot1MSTeams" ServiceDefinitionV2Dot1Email: description: Service owner's email. properties: contact: description: Contact value. example: contact@datadoghq.com type: string name: description: Contact email. example: Team Email type: string type: $ref: "#/components/schemas/ServiceDefinitionV2Dot1EmailType" required: - type - contact type: object ServiceDefinitionV2Dot1EmailType: description: Contact type. enum: - email example: email type: string x-enum-varnames: - EMAIL ServiceDefinitionV2Dot1Integrations: description: Third party integrations that Datadog supports. properties: opsgenie: $ref: "#/components/schemas/ServiceDefinitionV2Dot1Opsgenie" pagerduty: $ref: "#/components/schemas/ServiceDefinitionV2Dot1Pagerduty" type: object ServiceDefinitionV2Dot1Link: description: Service's external links. properties: name: description: Link name. example: Runbook type: string provider: description: Link provider. example: Github type: string type: $ref: "#/components/schemas/ServiceDefinitionV2Dot1LinkType" url: description: Link URL. example: https://my-runbook type: string required: - name - type - url type: object ServiceDefinitionV2Dot1LinkType: description: Link type. enum: - doc - repo - runbook - dashboard - other example: runbook type: string x-enum-varnames: - DOC - REPO - RUNBOOK - DASHBOARD - OTHER ServiceDefinitionV2Dot1MSTeams: description: Service owner's Microsoft Teams. properties: contact: description: Contact value. example: https://teams.microsoft.com/myteam type: string name: description: Contact Microsoft Teams. example: My team channel type: string type: $ref: "#/components/schemas/ServiceDefinitionV2Dot1MSTeamsType" required: - type - contact type: object ServiceDefinitionV2Dot1MSTeamsType: description: Contact type. enum: - microsoft-teams example: microsoft-teams type: string x-enum-varnames: - MICROSOFT_TEAMS ServiceDefinitionV2Dot1Opsgenie: description: Opsgenie integration for the service. properties: region: $ref: "#/components/schemas/ServiceDefinitionV2Dot1OpsgenieRegion" service-url: description: Opsgenie service url. example: "https://my-org.opsgenie.com/service/123e4567-e89b-12d3-a456-426614174000" type: string required: [service-url] type: object ServiceDefinitionV2Dot1OpsgenieRegion: description: Opsgenie instance region. enum: [US, EU] example: US type: string x-enum-varnames: [US, EU] ServiceDefinitionV2Dot1Pagerduty: description: PagerDuty integration for the service. properties: service-url: description: PagerDuty service url. example: "https://my-org.pagerduty.com/service-directory/PMyService" type: string type: object ServiceDefinitionV2Dot1Slack: description: Service owner's Slack channel. properties: contact: description: Slack Channel. example: https://yourcompany.slack.com/archives/channel123 type: string name: description: Contact Slack. example: Team Slack type: string type: $ref: "#/components/schemas/ServiceDefinitionV2Dot1SlackType" required: - type - contact type: object ServiceDefinitionV2Dot1SlackType: description: Contact type. enum: - slack example: slack type: string x-enum-varnames: - SLACK ServiceDefinitionV2Dot1Version: default: v2.1 description: Schema version being used. enum: - v2.1 example: v2.1 type: string x-enum-varnames: - V2_1 ServiceDefinitionV2Dot2: description: Service definition v2.2 for providing service metadata and integrations. properties: application: description: Identifier for a group of related services serving a product feature, which the service is a part of. example: my-app type: string ci-pipeline-fingerprints: description: A set of CI fingerprints. example: ["j88xdEy0J5lc", "eZ7LMljCk8vo"] items: description: A CI pipeline fingerprint string. type: string type: array contacts: description: A list of contacts related to the services. items: $ref: "#/components/schemas/ServiceDefinitionV2Dot2Contact" type: array dd-service: description: Unique identifier of the service. Must be unique across all services and is used to match with a service in Datadog. example: my-service type: string description: description: A short description of the service. example: My service description type: string extensions: additionalProperties: {} description: Extensions to v2.2 schema. example: {"myorg/extension": "extensionValue"} type: object integrations: $ref: "#/components/schemas/ServiceDefinitionV2Dot2Integrations" languages: description: "The service's programming language. Datadog recognizes the following languages: `dotnet`, `go`, `java`, `js`, `php`, `python`, `ruby`, and `c++`." example: ["dotnet", "go", "java", "js", "php", "python", "ruby", "c++"] items: description: A programming language identifier. type: string type: array lifecycle: description: The current life cycle phase of the service. example: sandbox type: string links: description: A list of links related to the services. items: $ref: "#/components/schemas/ServiceDefinitionV2Dot2Link" type: array schema-version: $ref: "#/components/schemas/ServiceDefinitionV2Dot2Version" tags: description: A set of custom tags. example: ["my:tag", "service:tag"] items: description: A custom tag string in `key:value` format. type: string type: array team: description: Team that owns the service. It is used to locate a team defined in Datadog Teams if it exists. example: my-team type: string tier: description: Importance of the service. example: High type: string type: $ref: "#/components/schemas/ServiceDefinitionV2Dot2Type" required: - schema-version - dd-service type: object ServiceDefinitionV2Dot2Contact: description: Service owner's contacts information. properties: contact: description: Contact value. example: https://teams.microsoft.com/myteam type: string name: description: Contact Name. example: My team channel type: string type: description: "Contact type. Datadog recognizes the following types: `email`, `slack`, and `microsoft-teams`." example: slack type: string required: - type - contact type: object ServiceDefinitionV2Dot2Integrations: description: Third party integrations that Datadog supports. properties: opsgenie: $ref: "#/components/schemas/ServiceDefinitionV2Dot2Opsgenie" pagerduty: $ref: "#/components/schemas/ServiceDefinitionV2Dot2Pagerduty" type: object ServiceDefinitionV2Dot2Link: description: Service's external links. properties: name: description: Link name. example: Runbook type: string provider: description: Link provider. example: Github type: string type: description: "Link type. Datadog recognizes the following types: `runbook`, `doc`, `repo`, `dashboard`, and `other`." example: runbook type: string url: description: Link URL. example: https://my-runbook type: string required: - name - type - url type: object ServiceDefinitionV2Dot2Opsgenie: description: Opsgenie integration for the service. properties: region: $ref: "#/components/schemas/ServiceDefinitionV2Dot2OpsgenieRegion" service-url: description: Opsgenie service url. example: "https://my-org.opsgenie.com/service/123e4567-e89b-12d3-a456-426614174000" type: string required: [service-url] type: object ServiceDefinitionV2Dot2OpsgenieRegion: description: Opsgenie instance region. enum: [US, EU] example: US type: string x-enum-varnames: [US, EU] ServiceDefinitionV2Dot2Pagerduty: description: PagerDuty integration for the service. properties: service-url: description: PagerDuty service url. example: "https://my-org.pagerduty.com/service-directory/PMyService" type: string type: object ServiceDefinitionV2Dot2Type: description: "The type of service." example: web type: string ServiceDefinitionV2Dot2Version: default: v2.2 description: Schema version being used. enum: - v2.2 example: v2.2 type: string x-enum-varnames: - V2_2 ServiceDefinitionV2Email: description: Service owner's email. properties: contact: description: Contact value. example: contact@datadoghq.com type: string name: description: Contact email. example: Team Email type: string type: $ref: "#/components/schemas/ServiceDefinitionV2EmailType" required: - type - contact type: object ServiceDefinitionV2EmailType: description: Contact type. enum: - email example: email type: string x-enum-varnames: - EMAIL ServiceDefinitionV2Integrations: description: Third party integrations that Datadog supports. properties: opsgenie: $ref: "#/components/schemas/ServiceDefinitionV2Opsgenie" pagerduty: $ref: "#/components/schemas/ServiceDefinitionV2Pagerduty" type: object ServiceDefinitionV2Link: description: Service's external links. properties: name: description: Link name. example: Runbook type: string type: $ref: "#/components/schemas/ServiceDefinitionV2LinkType" url: description: Link URL. example: https://my-runbook type: string required: - name - type - url type: object ServiceDefinitionV2LinkType: description: Link type. enum: - doc - wiki - runbook - url - repo - dashboard - oncall - code - link example: runbook type: string x-enum-varnames: - DOC - WIKI - RUNBOOK - URL - REPO - DASHBOARD - ONCALL - CODE - LINK ServiceDefinitionV2MSTeams: description: Service owner's Microsoft Teams. properties: contact: description: Contact value. example: https://teams.microsoft.com/myteam type: string name: description: Contact Microsoft Teams. example: My team channel type: string type: $ref: "#/components/schemas/ServiceDefinitionV2MSTeamsType" required: - type - contact type: object ServiceDefinitionV2MSTeamsType: description: Contact type. enum: - microsoft-teams example: microsoft-teams type: string x-enum-varnames: - MICROSOFT_TEAMS ServiceDefinitionV2Opsgenie: description: Opsgenie integration for the service. properties: region: $ref: "#/components/schemas/ServiceDefinitionV2OpsgenieRegion" service-url: description: Opsgenie service url. example: "https://my-org.opsgenie.com/service/123e4567-e89b-12d3-a456-426614174000" type: string required: [service-url] type: object ServiceDefinitionV2OpsgenieRegion: description: Opsgenie instance region. enum: [US, EU] example: US type: string x-enum-varnames: [US, EU] ServiceDefinitionV2Pagerduty: description: PagerDuty service URL for the service. example: https://my-org.pagerduty.com/service-directory/PMyService type: string ServiceDefinitionV2Repo: description: Service code repositories. properties: name: description: Repository name. example: Source Code type: string provider: description: Repository provider. example: GitHub type: string url: description: Repository URL. example: "https://github.com/DataDog/schema" type: string required: - name - url type: object ServiceDefinitionV2Slack: description: Service owner's Slack channel. properties: contact: description: Slack Channel. example: https://yourcompany.slack.com/archives/channel123 type: string name: description: Contact Slack. example: Team Slack type: string type: $ref: "#/components/schemas/ServiceDefinitionV2SlackType" required: - type - contact type: object ServiceDefinitionV2SlackType: description: Contact type. enum: - slack example: slack type: string x-enum-varnames: - SLACK ServiceDefinitionV2Version: default: v2 description: Schema version being used. enum: - v2 example: v2 type: string x-enum-varnames: - V2 ServiceDefinitionsCreateRequest: description: Create service definitions request. oneOf: - $ref: "#/components/schemas/ServiceDefinitionV2Dot2" - $ref: "#/components/schemas/ServiceDefinitionV2Dot1" - $ref: "#/components/schemas/ServiceDefinitionV2" - $ref: "#/components/schemas/ServiceDefinitionRaw" ServiceDefinitionsListResponse: description: Create service definitions response. properties: data: description: Data representing service definitions. items: $ref: "#/components/schemas/ServiceDefinitionData" type: array type: object ServiceList: description: The response body for the service list endpoint. properties: data: $ref: "#/components/schemas/ServiceListData" type: object ServiceListData: description: A single data item in the service list response. properties: attributes: $ref: "#/components/schemas/ServiceListDataAttributes" id: description: The unique identifier of the service. type: string type: $ref: "#/components/schemas/ServiceListDataType" required: - type type: object ServiceListDataAttributes: description: Attributes of a service list entry, containing metadata and a list of service names. properties: metadata: description: A list of metadata items associated with the service. items: $ref: "#/components/schemas/ServiceListDataAttributesMetadataItems" type: array services: description: A list of service names. items: description: A single service name. type: string type: array type: object ServiceListDataAttributesMetadataItems: description: An object containing metadata flags for a service, indicating whether it is traced by APM or monitored through Universal Service Monitoring. properties: isTraced: description: Indicates whether the service is traced by APM. type: boolean isUsm: description: Indicates whether the service uses Universal Service Monitoring. type: boolean type: object ServiceListDataType: default: services_list description: Services list resource type. enum: - services_list example: services_list type: string x-enum-varnames: - SERVICES_LIST ServiceNowAssignmentGroupAttributes: description: Attributes of a ServiceNow assignment group properties: assignment_group_name: description: The name of the assignment group example: "Network Team" type: string assignment_group_sys_id: description: The system ID of the assignment group in ServiceNow example: "abc123def456" type: string instance_id: description: The ID of the ServiceNow instance example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string required: - instance_id - assignment_group_name - assignment_group_sys_id type: object ServiceNowAssignmentGroupData: description: Data object for a ServiceNow assignment group properties: attributes: $ref: "#/components/schemas/ServiceNowAssignmentGroupAttributes" id: description: Unique identifier for the ServiceNow assignment group example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string type: $ref: "#/components/schemas/ServiceNowAssignmentGroupType" required: - id - type - attributes type: object ServiceNowAssignmentGroupType: description: Type identifier for ServiceNow assignment group resources enum: - assignment_groups example: assignment_groups type: string x-enum-varnames: - ASSIGNMENT_GROUPS ServiceNowAssignmentGroupsData: description: Array of ServiceNow assignment group data objects items: $ref: "#/components/schemas/ServiceNowAssignmentGroupData" type: array ServiceNowAssignmentGroupsResponse: description: Response containing ServiceNow assignment groups properties: data: $ref: "#/components/schemas/ServiceNowAssignmentGroupsData" example: - attributes: group_name: "IT Operations" group_sys_id: "abc123def456" instance_id: "65b3341b-0680-47f9-a6d4-134db45c603e" id: "65b3341b-0680-47f9-a6d4-134db45c603e" type: assignment_groups required: - data type: object ServiceNowBasicAuth: description: The definition of the `ServiceNowBasicAuth` object. properties: instance: $ref: "#/components/schemas/ServiceNowBasicAuthInstance" password: $ref: "#/components/schemas/ServiceNowBasicAuthPassword" type: $ref: "#/components/schemas/ServiceNowBasicAuthType" username: $ref: "#/components/schemas/ServiceNowBasicAuthUsername" required: - type - instance - username - password type: object ServiceNowBasicAuthInstance: description: The `ServiceNowBasicAuth` `instance`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" ServiceNowBasicAuthPassword: description: The `ServiceNowBasicAuth` `password`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" ServiceNowBasicAuthType: description: The definition of the `ServiceNowBasicAuth` object. enum: - ServiceNowBasicAuth example: ServiceNowBasicAuth type: string x-enum-varnames: - SERVICENOWBASICAUTH ServiceNowBasicAuthUpdate: description: The definition of the `ServiceNowBasicAuth` object. properties: instance: $ref: "#/components/schemas/ServiceNowBasicAuthUpdateInstance" password: $ref: "#/components/schemas/ServiceNowBasicAuthUpdatePassword" type: $ref: "#/components/schemas/ServiceNowBasicAuthType" username: $ref: "#/components/schemas/ServiceNowBasicAuthUpdateUsername" required: - type type: object ServiceNowBasicAuthUpdateInstance: description: The `ServiceNowBasicAuthUpdate` `instance`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" ServiceNowBasicAuthUpdatePassword: description: The `ServiceNowBasicAuthUpdate` `password`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" ServiceNowBasicAuthUpdateUsername: description: The `ServiceNowBasicAuthUpdate` `username`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" ServiceNowBasicAuthUsername: description: The `ServiceNowBasicAuth` `username`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" ServiceNowBusinessServiceAttributes: description: Attributes of a ServiceNow business service properties: instance_id: description: The ID of the ServiceNow instance example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string service_name: description: The name of the business service example: "IT Support" type: string service_sys_id: description: The system ID of the business service in ServiceNow example: "abc123def456" type: string required: - instance_id - service_name - service_sys_id type: object ServiceNowBusinessServiceData: description: Data object for a ServiceNow business service properties: attributes: $ref: "#/components/schemas/ServiceNowBusinessServiceAttributes" id: description: Unique identifier for the ServiceNow business service example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string type: $ref: "#/components/schemas/ServiceNowBusinessServiceType" required: - id - type - attributes type: object ServiceNowBusinessServiceType: description: Type identifier for ServiceNow business service resources enum: - business_services example: business_services type: string x-enum-varnames: - BUSINESS_SERVICES ServiceNowBusinessServicesData: description: Array of ServiceNow business service data objects items: $ref: "#/components/schemas/ServiceNowBusinessServiceData" type: array ServiceNowBusinessServicesResponse: description: Response containing ServiceNow business services properties: data: $ref: "#/components/schemas/ServiceNowBusinessServicesData" example: - attributes: instance_id: "65b3341b-0680-47f9-a6d4-134db45c603e" service_name: "IT Support" service_sys_id: "abc123def456" id: "65b3341b-0680-47f9-a6d4-134db45c603e" type: business_services required: - data type: object ServiceNowCredentials: description: The definition of the `ServiceNowCredentials` object. oneOf: - $ref: "#/components/schemas/ServiceNowBasicAuth" ServiceNowCredentialsUpdate: description: The definition of the `ServiceNowCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/ServiceNowBasicAuthUpdate" ServiceNowInstanceAttributes: description: Attributes of a ServiceNow instance properties: instance_name: description: The name of the ServiceNow instance example: "my-servicenow-instance" type: string required: - instance_name type: object ServiceNowInstanceData: description: Data object for a ServiceNow instance properties: attributes: $ref: "#/components/schemas/ServiceNowInstanceAttributes" id: description: Unique identifier for the ServiceNow instance example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string type: $ref: "#/components/schemas/ServiceNowInstanceType" required: - id - type - attributes type: object ServiceNowInstanceType: description: Type identifier for ServiceNow instance resources enum: - instance example: instance type: string x-enum-varnames: - INSTANCE ServiceNowInstancesData: description: Array of ServiceNow instance data objects items: $ref: "#/components/schemas/ServiceNowInstanceData" type: array ServiceNowInstancesResponse: description: Response containing ServiceNow instances properties: data: $ref: "#/components/schemas/ServiceNowInstancesData" example: - attributes: instance_name: "my-servicenow-instance" id: "65b3341b-0680-47f9-a6d4-134db45c603e" type: instance required: - data type: object ServiceNowIntegration: description: The definition of the `ServiceNowIntegration` object. properties: credentials: $ref: "#/components/schemas/ServiceNowCredentials" type: $ref: "#/components/schemas/ServiceNowIntegrationType" required: - type - credentials type: object ServiceNowIntegrationType: description: The definition of the `ServiceNowIntegrationType` object. enum: - ServiceNow example: ServiceNow type: string x-enum-varnames: - SERVICENOW ServiceNowIntegrationUpdate: description: The definition of the `ServiceNowIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/ServiceNowCredentialsUpdate" type: $ref: "#/components/schemas/ServiceNowIntegrationType" required: - type type: object ServiceNowTemplateAttributes: description: Attributes of a ServiceNow template properties: assignment_group_id: description: The ID of the assignment group example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string business_service_id: description: The ID of the business service example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string fields_mapping: additionalProperties: type: string description: Custom field mappings for the template example: category: "software" priority: "1" type: object handle_name: description: The handle name of the template example: "incident-template" type: string instance_id: description: The ID of the ServiceNow instance example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string servicenow_tablename: description: The name of the destination ServiceNow table example: "incident" type: string user_id: description: The ID of the user example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string required: - instance_id - handle_name - servicenow_tablename type: object ServiceNowTemplateCreateRequest: description: Request to create a ServiceNow template properties: data: $ref: "#/components/schemas/ServiceNowTemplateCreateRequestData" required: - data type: object ServiceNowTemplateCreateRequestAttributes: description: Attributes for creating a ServiceNow template properties: assignment_group_id: description: The ID of the assignment group example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string business_service_id: description: The ID of the business service example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string fields_mapping: additionalProperties: type: string description: Custom field mappings for the template example: category: "software" priority: "1" type: object handle_name: description: The handle name of the template example: "incident-template" type: string instance_id: description: The ID of the ServiceNow instance example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string servicenow_tablename: description: The name of the destination ServiceNow table example: "incident" type: string user_id: description: The ID of the user example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string required: - instance_id - handle_name - servicenow_tablename type: object ServiceNowTemplateCreateRequestData: description: Data object for creating a ServiceNow template properties: attributes: $ref: "#/components/schemas/ServiceNowTemplateCreateRequestAttributes" type: $ref: "#/components/schemas/ServiceNowTemplateType" required: - type - attributes type: object ServiceNowTemplateData: description: Data object for a ServiceNow template properties: attributes: $ref: "#/components/schemas/ServiceNowTemplateAttributes" id: description: Unique identifier for the ServiceNow template example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string type: $ref: "#/components/schemas/ServiceNowTemplateType" required: - id - type - attributes type: object ServiceNowTemplateResponse: description: Response containing a single ServiceNow template properties: data: $ref: "#/components/schemas/ServiceNowTemplateData" required: - data type: object ServiceNowTemplateType: description: Type identifier for ServiceNow template resources enum: - servicenow_templates example: servicenow_templates type: string x-enum-varnames: - SERVICENOW_TEMPLATES ServiceNowTemplateUpdateRequest: description: Request to update a ServiceNow template properties: data: $ref: "#/components/schemas/ServiceNowTemplateUpdateRequestData" required: - data type: object ServiceNowTemplateUpdateRequestAttributes: description: Attributes for updating a ServiceNow template properties: assignment_group_id: description: The ID of the assignment group example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string business_service_id: description: The ID of the business service example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string fields_mapping: additionalProperties: type: string description: Custom field mappings for the template example: category: "hardware" priority: "2" type: object handle_name: description: The handle name of the template example: "incident-template-updated" type: string instance_id: description: The ID of the ServiceNow instance example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string servicenow_tablename: description: The name of the destination ServiceNow table example: "incident" type: string user_id: description: The ID of the user example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string required: - instance_id - handle_name - servicenow_tablename type: object ServiceNowTemplateUpdateRequestData: description: Data object for updating a ServiceNow template properties: attributes: $ref: "#/components/schemas/ServiceNowTemplateUpdateRequestAttributes" type: $ref: "#/components/schemas/ServiceNowTemplateType" required: - type - attributes type: object ServiceNowTemplatesData: description: Array of ServiceNow template data objects items: $ref: "#/components/schemas/ServiceNowTemplateData" type: array ServiceNowTemplatesResponse: description: Response containing ServiceNow templates properties: data: $ref: "#/components/schemas/ServiceNowTemplatesData" example: - attributes: handle_name: "incident-template" instance_id: "65b3341b-0680-47f9-a6d4-134db45c603e" servicenow_tablename: "incident" id: "65b3341b-0680-47f9-a6d4-134db45c603e" type: servicenow_templates required: - data type: object ServiceNowTicket: description: ServiceNow ticket attached to work item nullable: true properties: result: $ref: "#/components/schemas/ServiceNowTicketResult" status: $ref: "#/components/schemas/Case3rdPartyTicketStatus" readOnly: true type: object ServiceNowTicketCreateAttributes: description: ServiceNow ticket creation attributes properties: assignment_group: description: ServiceNow assignment group example: "IT Support" type: string instance_name: description: ServiceNow instance name example: "my-instance" type: string required: - instance_name type: object ServiceNowTicketCreateData: description: ServiceNow ticket creation data properties: attributes: $ref: "#/components/schemas/ServiceNowTicketCreateAttributes" type: $ref: "#/components/schemas/ServiceNowTicketResourceType" required: - type - attributes type: object ServiceNowTicketCreateRequest: description: ServiceNow ticket creation request properties: data: $ref: "#/components/schemas/ServiceNowTicketCreateData" required: - data type: object ServiceNowTicketResourceType: description: ServiceNow ticket resource type enum: - tickets example: tickets type: string x-enum-varnames: - TICKETS ServiceNowTicketResult: description: ServiceNow ticket information properties: sys_target_link: description: Link to the Incident created on ServiceNow type: string type: object ServiceNowTicketsDataType: default: servicenow_tickets description: ServiceNow tickets resource type. enum: - servicenow_tickets example: servicenow_tickets type: string x-enum-varnames: - SERVICENOW_TICKETS ServiceNowUserAttributes: description: Attributes of a ServiceNow user properties: email: description: The email address of the user example: "john.doe@example.com" type: string full_name: description: The full name of the user example: "John Doe" type: string instance_id: description: The ID of the ServiceNow instance example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string user_name: description: The username of the ServiceNow user example: "john.doe" type: string user_sys_id: description: The system ID of the user in ServiceNow example: "abc123def456" type: string required: - instance_id - user_name - user_sys_id - email type: object ServiceNowUserData: description: Data object for a ServiceNow user properties: attributes: $ref: "#/components/schemas/ServiceNowUserAttributes" id: description: Unique identifier for the ServiceNow user example: "65b3341b-0680-47f9-a6d4-134db45c603e" format: uuid type: string type: $ref: "#/components/schemas/ServiceNowUserType" required: - id - type - attributes type: object ServiceNowUserType: description: Type identifier for ServiceNow user resources enum: - users example: users type: string x-enum-varnames: - USERS ServiceNowUsersData: description: Array of ServiceNow user data objects items: $ref: "#/components/schemas/ServiceNowUserData" type: array ServiceNowUsersResponse: description: Response containing ServiceNow users properties: data: $ref: "#/components/schemas/ServiceNowUsersData" example: - attributes: email: "john.doe@example.com" instance_id: "65b3341b-0680-47f9-a6d4-134db45c603e" user_name: "john.doe" user_sys_id: "abc123def456" id: "65b3341b-0680-47f9-a6d4-134db45c603e" type: users required: - data type: object ServiceRepositoryInfoDataType: description: The resource type for service repository info objects. enum: - service_repository_info example: service_repository_info type: string x-enum-varnames: - SERVICE_REPOSITORY_INFO ServiceRepositoryInfoRequest: description: Request body for retrieving service repository information. properties: data: $ref: "#/components/schemas/ServiceRepositoryInfoRequestData" required: - data type: object ServiceRepositoryInfoRequestAttributes: description: Attributes for the service repository info request. properties: debug_id: description: The debug ID of a JavaScript source map, in UUID format. Alternative to `service` and `version`. example: 00000000-0000-4000-8000-000000000001 format: uuid type: string service: description: The name of the service. Required with `version` when `debug_id` is not set. example: my-web-service type: string version: description: The version of the service. Required with `service` when `debug_id` is not set. example: 1.0.0 type: string type: object ServiceRepositoryInfoRequestData: description: Data object for the service repository info request. properties: attributes: $ref: "#/components/schemas/ServiceRepositoryInfoRequestAttributes" type: $ref: "#/components/schemas/ServiceRepositoryInfoDataType" required: - type - attributes type: object ServiceRepositoryInfoResponse: description: Response containing service repository information. properties: data: $ref: "#/components/schemas/ServiceRepositoryInfoResponseData" required: - data type: object ServiceRepositoryInfoResponseAttributes: description: Attributes of the service repository information. properties: commit_sha: description: The SHA of the commit associated with the service version. example: abc123def456789 type: string repository_url: description: The URL of the source code repository. example: https://github.com/my-org/my-repo type: string status: $ref: "#/components/schemas/ServiceRepositoryInfoStatus" required: - status type: object ServiceRepositoryInfoResponseData: description: Data object for the service repository info response. properties: attributes: $ref: "#/components/schemas/ServiceRepositoryInfoResponseAttributes" id: description: The identifier composed of the service name and version, or the debug ID when the lookup was made by debug ID. example: my-web-service:1.0.0 type: string type: $ref: "#/components/schemas/ServiceRepositoryInfoDataType" required: - id - type - attributes type: object ServiceRepositoryInfoStatus: description: The status of the service repository info lookup. enum: - success - not_found - no_repository - internal_error - unknown example: success type: string x-enum-varnames: - SUCCESS - NOT_FOUND - NO_REPOSITORY - INTERNAL_ERROR - UNKNOWN SessionIdArray: description: A collection of session identifiers used for bulk add or remove operations on a playlist. properties: data: description: Array of session identifier data objects. items: $ref: "#/components/schemas/SessionIdData" type: array required: - data type: object SessionIdData: description: A session identifier data object used for bulk playlist operations. properties: id: description: Unique identifier of the RUM replay session. example: 00000000-0000-0000-0000-000000000001 type: string type: $ref: "#/components/schemas/ViewershipHistorySessionDataType" required: - type type: object SeverityModifierRuleAction: description: |- The action to take when a severity modifier rule matches a finding. This is a discriminated union on `type`: `set` assigns a fixed severity, while `shift` moves the severity up or down by one rank. A severity modifier rule's `rule.query` must not filter on `@severity` or on the `@severity_details.user_adjusted.*` namespace. Use `@severity_details.adjusted.value` instead, which reflects the severity before user-defined adjustments. oneOf: - $ref: "#/components/schemas/SeverityModifierRuleSetAction" - $ref: "#/components/schemas/SeverityModifierRuleShiftAction" SeverityModifierRuleAttributesCreate: description: Attributes for creating or updating a severity modifier rule. properties: action: $ref: "#/components/schemas/SeverityModifierRuleAction" enabled: description: Whether the severity modifier rule is enabled. example: true type: boolean name: description: The name of the severity modifier rule. example: "Downgrade misconfigurations in dev" maxLength: 255 minLength: 1 type: string rule: $ref: "#/components/schemas/AutomationRuleScope" required: - name - rule - action type: object SeverityModifierRuleAttributesResponse: description: Attributes of a severity modifier rule as returned by the API. properties: action: $ref: "#/components/schemas/SeverityModifierRuleAction" created_at: description: The Unix timestamp in milliseconds when the rule was created. example: 1722439510282 format: int64 type: integer created_by: $ref: "#/components/schemas/AutomationRuleCreatedBy" enabled: description: Whether the severity modifier rule is enabled. example: true type: boolean modified_at: description: The Unix timestamp in milliseconds when the rule was last modified. example: 1722439510282 format: int64 type: integer modified_by: $ref: "#/components/schemas/AutomationRuleModifiedBy" name: description: The name of the severity modifier rule. example: "Downgrade misconfigurations in dev" maxLength: 255 minLength: 1 type: string rule: $ref: "#/components/schemas/AutomationRuleScope" required: - name - enabled - rule - action - created_at - created_by - modified_at - modified_by type: object SeverityModifierRuleCreateRequest: description: The body of a severity modifier rule create request. properties: data: $ref: "#/components/schemas/SeverityModifierRuleDataCreate" required: - data type: object SeverityModifierRuleDataCreate: description: The data object for a severity modifier rule create request. properties: attributes: $ref: "#/components/schemas/SeverityModifierRuleAttributesCreate" type: $ref: "#/components/schemas/SeverityModifierRuleType" required: - type - attributes type: object SeverityModifierRuleDataResponse: description: The data object for a severity modifier rule as returned by the API. properties: attributes: $ref: "#/components/schemas/SeverityModifierRuleAttributesResponse" id: description: The ID of the severity modifier rule. example: "00000000-0000-0000-0000-000000000000" format: uuid type: string type: $ref: "#/components/schemas/SeverityModifierRuleType" required: - id - type - attributes type: object SeverityModifierRuleDataUpdate: description: The data object for a severity modifier rule update request. The `id` must match the `rule_id` path parameter. properties: attributes: $ref: "#/components/schemas/SeverityModifierRuleAttributesCreate" id: description: The ID of the severity modifier rule to update. example: "00000000-0000-0000-0000-000000000000" format: uuid type: string type: $ref: "#/components/schemas/SeverityModifierRuleType" required: - id - type - attributes type: object SeverityModifierRuleReorderData: description: The ordered list of all severity modifier rules. Every rule must be included. items: $ref: "#/components/schemas/SeverityModifierRuleReorderItem" type: array SeverityModifierRuleReorderItem: description: A reference to a severity modifier rule used for reordering. properties: id: description: The ID of the severity modifier rule. example: "00000000-0000-0000-0000-000000000000" format: uuid type: string type: $ref: "#/components/schemas/SeverityModifierRuleType" required: - type - id type: object SeverityModifierRuleReorderRequest: description: The body of a severity modifier rule reorder request. properties: data: $ref: "#/components/schemas/SeverityModifierRuleReorderData" required: - data type: object SeverityModifierRuleReorderResponse: description: The response of a severity modifier rule reorder request. properties: data: $ref: "#/components/schemas/SeverityModifierRuleReorderData" required: - data type: object SeverityModifierRuleResponse: description: A single severity modifier rule response. properties: data: $ref: "#/components/schemas/SeverityModifierRuleDataResponse" required: - data type: object SeverityModifierRuleSetAction: description: Sets matched findings to a fixed severity. properties: description: description: An optional free-form explanation for the severity change. example: "Lower severity for dev environment noise" maxLength: 20000 type: string severity: $ref: "#/components/schemas/SeverityModifierSeverity" type: $ref: "#/components/schemas/SeverityModifierRuleSetActionType" required: - type - severity type: object SeverityModifierRuleSetActionType: description: The type of a severity modifier rule action that sets a fixed severity. enum: - set example: set type: string x-enum-varnames: - SET SeverityModifierRuleShiftAction: description: Shifts matched findings up or down by one severity rank. properties: description: description: An optional free-form explanation for the severity change. example: "Lower severity for dev environment noise" maxLength: 20000 type: string severity_delta: $ref: "#/components/schemas/SeverityModifierSeverityDelta" type: $ref: "#/components/schemas/SeverityModifierRuleShiftActionType" required: - type - severity_delta type: object SeverityModifierRuleShiftActionType: description: The type of a severity modifier rule action that shifts the severity by one rank. enum: - shift example: shift type: string x-enum-varnames: - SHIFT SeverityModifierRuleType: description: The JSON:API type for severity modifier rules. enum: - severity_modifier_rules example: severity_modifier_rules type: string x-enum-varnames: - SEVERITY_MODIFIER_RULES SeverityModifierRuleUpdateRequest: description: The body of a severity modifier rule update request. properties: data: $ref: "#/components/schemas/SeverityModifierRuleDataUpdate" required: - data type: object SeverityModifierRulesDataList: description: A list of severity modifier rule data objects. items: $ref: "#/components/schemas/SeverityModifierRuleDataResponse" type: array SeverityModifierRulesResponse: description: A list of severity modifier rules with pagination metadata. properties: data: $ref: "#/components/schemas/SeverityModifierRulesDataList" links: $ref: "#/components/schemas/SecurityAutomationRulesLinks" meta: $ref: "#/components/schemas/SecurityAutomationRulesMeta" required: - data - meta - links type: object SeverityModifierSeverity: description: The severity to assign to matched findings. `info_none` is not supported for the `iac_misconfiguration`, `runtime_code_vulnerability`, `secret`, or `static_code_vulnerability` finding types. enum: - info_none - low - medium - high - critical example: low type: string x-enum-varnames: - INFO_NONE - LOW - MEDIUM - HIGH - CRITICAL SeverityModifierSeverityDelta: description: The direction in which to shift the severity of matched findings by one rank. enum: - up_one - down_one example: up_one type: string x-enum-varnames: - UP_ONE - DOWN_ONE SeverityOverrideAttributes: description: |- Severity override to apply to the findings. Set `action` to `set` to apply a manual severity override with the given `value`. Set `action` to `clear` to remove a manual severity override. oneOf: - $ref: "#/components/schemas/SeverityOverrideSet" - $ref: "#/components/schemas/SeverityOverrideClear" SeverityOverrideClear: description: |- Removes the manual severity override of the findings. This action does not remove a severity set by an automation rule. properties: action: $ref: "#/components/schemas/SeverityOverrideClearActionType" description: description: Additional information about the severity change. This field has a limit of 280 characters. example: "Severity override no longer needed." maxLength: 280 type: string required: - action type: object SeverityOverrideClearActionType: default: clear description: The action that removes a manual severity override. enum: - clear example: clear type: string x-enum-varnames: - CLEAR SeverityOverrideDataType: default: severity_override description: Severity override resource type. enum: - severity_override example: severity_override type: string x-enum-varnames: - SEVERITY_OVERRIDE SeverityOverrideRequest: description: Request to set or clear the manual severity override of security findings. properties: data: $ref: "#/components/schemas/SeverityOverrideRequestData" required: - data type: object SeverityOverrideRequestData: description: Data of the severity override request. properties: attributes: $ref: "#/components/schemas/SeverityOverrideRequestDataAttributes" id: description: Unique identifier of the severity override request. If not provided, an identifier is generated. example: "00000000-0000-0000-0000-000000000001" type: string relationships: $ref: "#/components/schemas/SeverityOverrideRequestDataRelationships" type: $ref: "#/components/schemas/SeverityOverrideDataType" required: - attributes - relationships - type type: object SeverityOverrideRequestDataAttributes: description: Attributes of the severity override request. properties: severity: $ref: "#/components/schemas/SeverityOverrideAttributes" required: - severity type: object SeverityOverrideRequestDataRelationships: description: Relationships of the severity override request. properties: findings: $ref: "#/components/schemas/Findings" description: Security findings to override the severity of. required: - findings type: object SeverityOverrideResponse: description: Response for the severity override request. properties: data: $ref: "#/components/schemas/SeverityOverrideResponseData" meta: $ref: "#/components/schemas/SeverityOverrideResponseMeta" required: - data type: object SeverityOverrideResponseData: description: Data of the severity override response. properties: id: description: Unique identifier of the severity override request. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/SeverityOverrideDataType" required: - id - type type: object SeverityOverrideResponseMeta: description: Security findings skipped while processing the severity override request. properties: warnings: description: Findings skipped because an automation rule set their severity. items: $ref: "#/components/schemas/SeverityOverrideResult" type: array type: object SeverityOverrideResult: description: Per-finding outcome of a severity override operation. properties: detail: description: Human-readable explanation of why the finding was skipped. example: >- cannot set severity on finding because it is overridden by an automation severity modifier rule; disable or update the automation rule first type: string finding_id: description: Unique identifier of the security finding. example: "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==" type: string status: description: HTTP-like status code describing the outcome for this finding. example: 400 format: int32 maximum: 599 type: integer title: description: Short label describing the outcome for this finding. example: "Bad Request" type: string required: - finding_id - status - title - detail type: object SeverityOverrideSet: description: Applies a manual severity override to the findings. properties: action: $ref: "#/components/schemas/SeverityOverrideSetActionType" description: description: Additional information about the severity change. This field has a limit of 280 characters. example: "Database contains sensitive data." maxLength: 280 type: string value: $ref: "#/components/schemas/SeverityOverrideValue" required: - action - value type: object SeverityOverrideSetActionType: default: set description: The action that applies a manual severity override. enum: - set example: set type: string x-enum-varnames: - SET SeverityOverrideValue: description: |- Severity to apply to the findings. `info` sets the lowest severity the finding type allows. enum: - critical - high - medium - low - info example: high type: string x-enum-varnames: - CRITICAL - HIGH - MEDIUM - LOW - INFO SharedDashboardGlobalTime: additionalProperties: {} description: Default time range configuration for the shared dashboard. example: live_span: 1h nullable: true type: object SharedDashboardIncluded: description: Resource included with a shared dashboard. oneOf: - $ref: "#/components/schemas/SharedDashboardIncludedDashboard" - $ref: "#/components/schemas/SharedDashboardIncludedUser" SharedDashboardIncludedDashboard: description: Included dashboard resource. properties: attributes: $ref: "#/components/schemas/SharedDashboardIncludedDashboardAttributes" id: description: ID of the dashboard. example: abc-def-ghi type: string type: $ref: "#/components/schemas/SharedDashboardIncludedDashboardType" required: - id - type - attributes type: object SharedDashboardIncludedDashboardAttributes: description: Attributes of the included dashboard. properties: title: description: Dashboard title. example: Q1 Metrics Dashboard type: string required: - title type: object SharedDashboardIncludedDashboardType: default: dashboard description: Included dashboard resource type. enum: - dashboard example: dashboard type: string x-enum-varnames: - DASHBOARD SharedDashboardIncludedUser: description: Included user resource. properties: attributes: $ref: "#/components/schemas/SharedDashboardIncludedUserAttributes" id: description: ID of the user. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: "#/components/schemas/UserResourceType" required: - id - type - attributes type: object SharedDashboardIncludedUserAttributes: description: Attributes of the included user. properties: handle: description: User handle. example: jane.doe@example.com type: string name: description: User display name. example: Jane Doe type: string required: - handle - name type: object SharedDashboardInvitee: description: Invitee that can access an invite-only shared dashboard. properties: access_expiration: description: Time when the invitee's access expires. example: "2026-01-15T09:30:00.000Z" format: date-time nullable: true type: string created_at: description: Time when the invitee was added. example: "2026-01-01T00:00:00.000Z" format: date-time type: string email: description: Email address of the invitee. example: jane.doe@example.com type: string required: - email - access_expiration - created_at type: object SharedDashboardRelationshipDashboard: description: Dashboard associated with the shared dashboard. properties: data: $ref: "#/components/schemas/SharedDashboardRelationshipDashboardData" required: - data type: object SharedDashboardRelationshipDashboardData: description: Dashboard relationship data. properties: id: description: ID of the dashboard. example: abc-def-ghi type: string type: $ref: "#/components/schemas/SharedDashboardIncludedDashboardType" required: - id - type type: object SharedDashboardRelationshipSharer: description: User who shared the dashboard. properties: data: $ref: "#/components/schemas/UserRelationshipData" required: - data type: object SharedDashboardRelationships: description: Relationships of a shared dashboard. properties: dashboard: $ref: "#/components/schemas/SharedDashboardRelationshipDashboard" sharer: $ref: "#/components/schemas/SharedDashboardRelationshipSharer" required: - dashboard - sharer type: object SharedDashboardResponse: description: A shared dashboard response resource. properties: attributes: $ref: "#/components/schemas/SharedDashboardResponseAttributes" id: description: ID of the shared dashboard. example: "12345" type: string relationships: $ref: "#/components/schemas/SharedDashboardRelationships" type: $ref: "#/components/schemas/SharedDashboardType" required: - id - type - attributes - relationships type: object SharedDashboardResponseAttributes: description: Attributes of a shared dashboard response. properties: created_at: description: Time when the shared dashboard was created. example: "2026-01-01T00:00:00.000Z" format: date-time type: string embeddable_domains: description: Domains where embed-type shared dashboards can be embedded. example: ["https://example.com"] items: description: An embeddable domain. type: string type: array expiration: description: Time when the shared dashboard expires. example: "2026-02-01T00:00:00.000Z" format: date-time nullable: true type: string global_time: $ref: "#/components/schemas/SharedDashboardGlobalTime" global_time_selectable: description: Whether viewers can select a different global time setting. example: false type: boolean invitees: description: Invitees for invite-only shared dashboards. items: $ref: "#/components/schemas/SharedDashboardInvitee" type: array last_accessed: description: Time when the shared dashboard was last accessed. example: "2026-01-15T09:30:00.000Z" format: date-time nullable: true type: string selectable_template_vars: description: Template variables that viewers can modify. items: $ref: "#/components/schemas/SharedDashboardSelectableTemplateVariable" type: array share_type: $ref: "#/components/schemas/SharedDashboardShareType" sharer_disabled: description: Whether the user who shared the dashboard is disabled. example: false type: boolean status: $ref: "#/components/schemas/SharedDashboardStatus" title: description: Display title for the shared dashboard. example: Q1 Metrics Dashboard type: string token: description: Token assigned to the shared dashboard. example: abc-123-token type: string url: description: URL for the shared dashboard. example: https://p.datadoghq.com/sb/abc-123-token type: string viewing_preferences: $ref: "#/components/schemas/SharedDashboardViewingPreferences" required: - token - title - url - viewing_preferences - global_time_selectable - global_time - selectable_template_vars - created_at - last_accessed - status - share_type - invitees - embeddable_domains - expiration - sharer_disabled type: object SharedDashboardSelectableTemplateVariable: description: A template variable that viewers can modify on the shared dashboard. properties: allow_any_value: description: Whether viewers can see all tag values for the template variable and specify any value. example: false type: boolean default_values: description: Default selected values for the variable. example: ["prod"] items: description: A default value for the template variable. type: string type: array name: description: Name of the template variable. example: environment type: string prefix: description: Tag prefix for the variable. example: env type: string type: description: Type of the template variable. example: group type: string visible_tags: description: Restricts which tag values are visible to the viewer. example: ["prod"] items: description: A visible tag value for the template variable. type: string type: array required: - name - prefix - type - allow_any_value - default_values - visible_tags type: object SharedDashboardShareType: description: Type of dashboard sharing. enum: - open - invite - embed - secure-embed example: invite type: string x-enum-varnames: - OPEN - INVITE - EMBED - SECURE_EMBED SharedDashboardStatus: description: Status of the shared dashboard. enum: - active - paused example: active type: string x-enum-varnames: - ACTIVE - PAUSED SharedDashboardType: default: shared_dashboard description: Shared dashboard resource type. enum: - shared_dashboard example: shared_dashboard type: string x-enum-varnames: - SHARED_DASHBOARD SharedDashboardViewingPreferences: description: Display settings for the shared dashboard. properties: high_density: description: Whether widgets are displayed in high-density mode. example: false type: boolean theme: $ref: "#/components/schemas/SharedDashboardViewingPreferencesTheme" required: - high_density - theme type: object SharedDashboardViewingPreferencesTheme: description: The theme of the shared dashboard view. `system` follows the viewer's system default. enum: - system - light - dark example: system type: string x-enum-varnames: - SYSTEM - LIGHT - DARK Shift: description: An on-call shift with its associated data and relationships. example: data: attributes: end: "2025-05-07T03:53:01.206662873Z" start: "2025-05-07T02:53:01.206662814Z" id: 00000000-0000-0000-0000-000000000000 relationships: user: data: id: 00000000-aba1-0000-0000-000000000000 type: users type: shifts included: - attributes: email: foo@bar.com name: User 1 status: "" id: 00000000-aba1-0000-0000-000000000000 type: users properties: data: $ref: "#/components/schemas/ShiftData" nullable: true included: description: The `Shift` `included`. items: $ref: "#/components/schemas/ShiftIncluded" type: array type: object ShiftData: description: Data for an on-call shift. properties: attributes: $ref: "#/components/schemas/ShiftDataAttributes" id: description: The `ShiftData` `id`. type: string relationships: $ref: "#/components/schemas/ShiftDataRelationships" type: $ref: "#/components/schemas/ShiftDataType" required: - type type: object ShiftDataAttributes: description: Attributes for an on-call shift. properties: end: description: The end time of the shift. format: date-time type: string start: description: The start time of the shift. format: date-time type: string type: object ShiftDataRelationships: description: Relationships for an on-call shift. properties: user: $ref: "#/components/schemas/ShiftDataRelationshipsUser" type: object ShiftDataRelationshipsUser: description: "Defines the relationship between a shift and the user who is working that shift." properties: data: $ref: "#/components/schemas/ShiftDataRelationshipsUserData" required: - data type: object ShiftDataRelationshipsUserData: description: "Represents a reference to the user assigned to this shift, containing the user's ID and resource type." properties: id: description: "Specifies the unique identifier of the user." example: "00000000-0000-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/ShiftDataRelationshipsUserDataType" required: - type - id type: object ShiftDataRelationshipsUserDataType: default: users description: "Indicates that the related resource is of type `users`." enum: - users example: users type: string x-enum-varnames: - USERS ShiftDataType: default: shifts description: "Indicates that the resource is of type `shifts`." enum: - shifts example: shifts type: string x-enum-varnames: - SHIFTS ShiftIncluded: description: Included data for shift operations. oneOf: - $ref: "#/components/schemas/ScheduleUser" SignalEntitiesAttributes: description: Attributes containing the entities related to the signal. properties: identities: description: The identity entities related to the signal. Each item is a free-form object describing an identity (for example, a user or principal). example: - display_name: Test User principal_id: user@example.com items: $ref: "#/components/schemas/SignalEntityIdentity" type: array required: - identities type: object SignalEntitiesData: description: Entities related to a security signal. properties: attributes: $ref: "#/components/schemas/SignalEntitiesAttributes" id: description: The signal ID the entities are associated with. example: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: string type: $ref: "#/components/schemas/SignalEntitiesType" required: - id - type - attributes type: object SignalEntitiesResponse: description: Response containing entities related to a security signal. properties: data: $ref: "#/components/schemas/SignalEntitiesData" required: - data type: object SignalEntitiesType: default: entities description: The type of the resource. The value should always be `entities`. enum: - entities example: entities type: string x-enum-varnames: - ENTITIES SignalEntityIdentity: additionalProperties: {} description: An identity entity related to a signal. The set of attributes is dynamic and depends on the source providing the identity. example: display_name: Test User principal_id: user@example.com type: object SimpleMonitorUserTemplate: description: A simplified version of a monitor user template. properties: created: $ref: "#/components/schemas/MonitorUserTemplateCreated" description: $ref: "#/components/schemas/MonitorUserTemplateDescription" id: description: The unique identifier. The initial version will match the template ID. example: "00000000-0000-1234-0000-000000000000" type: string monitor_definition: additionalProperties: {} description: A valid monitor definition in the same format as the [V1 Monitor API](https://docs.datadoghq.com/api/latest/monitors/#create-a-monitor). example: {"message": "You may need to add web hosts if this is consistently high.", "name": "Bytes received on host0", "query": "avg(last_5m):sum:system.net.bytes_rcvd{host:host0} > 100", "type": "query alert"} type: object tags: $ref: "#/components/schemas/MonitorUserTemplateTags" template_variables: $ref: "#/components/schemas/MonitorUserTemplateTemplateVariables" title: $ref: "#/components/schemas/MonitorUserTemplateTitle" version: $ref: "#/components/schemas/MonitorUserTemplateVersion" type: object SingleAggregatedConnectionResponseArray: description: List of aggregated connections. example: data: - attributes: bytes_sent_by_client: 100 bytes_sent_by_server: 200 group_bys: client_team: - networks server_service: - hucklebuck packets_sent_by_client: 10 packets_sent_by_server: 20 rtt_micro_seconds: 800 tcp_closed_connections: 30 tcp_delivered_ce: 12 tcp_established_connections: 40 tcp_probe0_count: 2 tcp_rcv_ooo_pack: 15 tcp_recovery_count: 8 tcp_refusals: 7 tcp_reord_seen: 4 tcp_resets: 5 tcp_retransmits: 30 tcp_rto_count: 3 tcp_timeouts: 6 id: client_team:networks, server_service:hucklebuck type: aggregated_connection properties: data: description: Array of aggregated connection objects. items: $ref: "#/components/schemas/SingleAggregatedConnectionResponseData" type: array type: object SingleAggregatedConnectionResponseData: description: Object describing an aggregated connection. properties: attributes: $ref: "#/components/schemas/SingleAggregatedConnectionResponseDataAttributes" id: description: A unique identifier for the aggregated connection based on the group by values. type: string type: $ref: "#/components/schemas/SingleAggregatedConnectionResponseDataType" type: object SingleAggregatedConnectionResponseDataAttributes: description: Attributes for an aggregated connection. properties: bytes_sent_by_client: description: The total number of bytes sent by the client over the given period. format: int64 type: integer bytes_sent_by_server: description: The total number of bytes sent by the server over the given period. format: int64 type: integer group_bys: additionalProperties: description: The values for each group by. items: description: A group-by value. type: string type: array description: The key, value pairs for each group by. type: object packets_sent_by_client: description: The total number of packets sent by the client over the given period. format: int64 type: integer packets_sent_by_server: description: The total number of packets sent by the server over the given period. format: int64 type: integer rtt_micro_seconds: description: Measured as TCP smoothed round trip time in microseconds (the time between a TCP frame being sent and acknowledged). format: int64 type: integer tcp_closed_connections: description: The number of TCP connections in a closed state. Measured in connections per second from the client. format: int64 type: integer tcp_delivered_ce: description: The number of TCP segments acknowledged with the ECN Congestion Experienced (CE) mark, indicating that an upstream router marked packets as experiencing congestion. format: int64 type: integer tcp_established_connections: description: The number of TCP connections in an established state. Measured in connections per second from the client. format: int64 type: integer tcp_probe0_count: description: The number of TCP zero-window probes sent. These probes are sent when the receiver advertises a zero receive window, indicating it cannot accept more data. format: int64 type: integer tcp_rcv_ooo_pack: description: The number of TCP packets received out of order. This indicates network-level packet reordering, which can degrade TCP performance by triggering spurious retransmissions and reducing throughput. format: int64 type: integer tcp_recovery_count: description: The number of TCP fast recovery events. Fast recovery retransmits lost segments detected through duplicate ACKs or selective acknowledgment (SACK) without waiting for a retransmission timeout. format: int64 type: integer tcp_refusals: description: The number of TCP connections that were refused by the server. Typically this indicates an attempt to connect to an IP/port that is not receiving connections, or a firewall/security misconfiguration. format: int64 type: integer tcp_reord_seen: description: The number of times reordering of sent packets was detected. Reordering detection adjusts the duplicate ACK threshold, preventing spurious retransmissions caused by out-of-order delivery. format: int64 type: integer tcp_resets: description: The number of TCP connections that were reset by the server. format: int64 type: integer tcp_retransmits: description: TCP Retransmits represent detected failures that are retransmitted to ensure delivery. Measured in count of retransmits from the client. format: int64 type: integer tcp_rto_count: description: The number of TCP retransmission timeouts (RTOs). An RTO occurs when an ACK is not received within the estimated round-trip time, forcing the sender to retransmit and halve its congestion window. format: int64 type: integer tcp_timeouts: description: The number of TCP connections that timed out from the perspective of the operating system. This can indicate general connectivity and latency issues. format: int64 type: integer type: object SingleAggregatedConnectionResponseDataType: default: aggregated_connection description: |- Aggregated connection resource type. enum: - aggregated_connection type: string x-enum-varnames: - AGGREGATED_CONNECTION SingleAggregatedDnsResponseArray: description: List of aggregated DNS flows. example: data: - attributes: group_bys: - key: client_service value: example-service - key: network.dns_query value: example.com metrics: - key: dns_total_requests value: 100 - key: dns_failures value: 7 - key: dns_successful_responses value: 93 - key: dns_failed_responses value: 5 - key: dns_timeouts value: 2 - key: dns_responses.nxdomain value: 1 - key: dns_responses.servfail value: 1 - key: dns_responses.other value: 3 - key: dns_success_latency_percentile value: 50 - key: dns_failure_latency_percentile value: 75 id: client_service:example-service,network.dns_query:example.com type: aggregated_dns properties: data: description: Array of aggregated DNS objects. items: $ref: "#/components/schemas/SingleAggregatedDnsResponseData" type: array type: object SingleAggregatedDnsResponseData: description: Object describing an aggregated DNS flow. properties: attributes: $ref: "#/components/schemas/SingleAggregatedDnsResponseDataAttributes" id: description: A unique identifier for the aggregated DNS traffic based on the group by values. type: string type: $ref: "#/components/schemas/SingleAggregatedDnsResponseDataType" type: object SingleAggregatedDnsResponseDataAttributes: description: Attributes for an aggregated DNS flow. properties: group_bys: description: The key, value pairs for each group by. items: $ref: "#/components/schemas/SingleAggregatedDnsResponseDataAttributesGroupByItems" type: array metrics: description: Metrics associated with an aggregated DNS flow. items: $ref: "#/components/schemas/SingleAggregatedDnsResponseDataAttributesMetricsItems" type: array type: object SingleAggregatedDnsResponseDataAttributesGroupByItems: description: Attributes associated with a group by properties: key: description: The group by key. type: string value: description: The group by value. type: string type: object SingleAggregatedDnsResponseDataAttributesMetricsItems: description: Metrics associated with an aggregated DNS flow. properties: key: $ref: "#/components/schemas/DnsMetricKey" value: description: The metric value. format: int64 type: integer type: object SingleAggregatedDnsResponseDataType: default: aggregated_dns description: |- Aggregated DNS resource type. enum: - aggregated_dns type: string x-enum-varnames: - AGGREGATED_DNS SingleEntityContextResponse: description: Response from the single entity context endpoint, containing the matching entity. properties: data: $ref: "#/components/schemas/EntityContextEntity" required: - data type: object SlackIntegrationMetadata: description: Incident integration metadata for the Slack integration. properties: channels: description: Array of Slack channels in this integration metadata. example: [] items: $ref: "#/components/schemas/SlackIntegrationMetadataChannelItem" type: array required: - channels type: object SlackIntegrationMetadataChannelItem: description: Item in the Slack integration metadata channel array. properties: channel_id: description: Slack channel ID. example: C0123456789 type: string channel_name: description: Name of the Slack channel. example: "#example-channel-name" type: string redirect_url: description: URL redirecting to the Slack channel. example: https://slack.com/app_redirect?channel=C0123456789&team=T01234567 type: string team_id: description: Slack team ID. example: T01234567 type: string required: - channel_id - channel_name - redirect_url type: object SlackReactionConfig: description: "Configuration for a Slack emoji reaction trigger." properties: reactionEmoji: description: "The Slack emoji reaction name." example: L minLength: 1 type: string teamId: description: "The Slack workspace ID." example: L minLength: 1 type: string required: - teamId - reactionEmoji type: object SlackTrigger: description: "Trigger a workflow from Slack. The workflow must be published." properties: reactionTriggers: description: "Slack emoji reactions that trigger the workflow." items: $ref: "#/components/schemas/SlackReactionConfig" type: array uniqueItems: true type: object SlackTriggerWrapper: description: "Schema for a Slack-based trigger." properties: slackTrigger: $ref: "#/components/schemas/SlackTrigger" startStepNames: $ref: "#/components/schemas/StartStepNames" required: - slackTrigger type: object SlackUserBindingData: description: Slack team ID data from a response. properties: id: description: The Slack team ID. example: "T01234567" type: string type: $ref: "#/components/schemas/SlackUserBindingType" type: object SlackUserBindingType: default: team_id description: Slack user binding resource type. enum: - team_id example: team_id type: string x-enum-varnames: - TEAM_ID SlackUserBindingsResponse: description: Response with a list of Slack user bindings. properties: data: description: An array of Slack user bindings. example: [{"id": "T01234567", "type": "team_id"}, {"id": "T09876543", "type": "team_id"}] items: $ref: "#/components/schemas/SlackUserBindingData" type: array required: - data type: object SloDataSource: default: slo description: A data source for SLO queries. enum: - slo example: slo type: string x-enum-varnames: - SLO SloQuery: description: A query for SLO status, error budget, and burn rate metrics. example: additional_query_filters: "*" data_source: "slo" group_mode: "overall" measure: "good_events" name: "my_slo" slo_id: "12345678910" slo_query_type: "metric" properties: additional_query_filters: description: Additional filters applied to the SLO query. example: "host:host_a,env:prod" type: string cross_org_uuids: $ref: "#/components/schemas/CrossOrgUuids" data_source: $ref: "#/components/schemas/SloDataSource" group_mode: $ref: "#/components/schemas/SlosGroupMode" measure: $ref: "#/components/schemas/SlosMeasure" name: description: The variable name for use in formulas. example: query1 type: string slo_id: description: The unique identifier of the SLO to query. example: "a]b123c45de6f78g90h" type: string slo_query_type: $ref: "#/components/schemas/SlosQueryType" required: - data_source - slo_id - measure type: object SloReportCreateRequest: description: The SLO report request body. properties: data: $ref: "#/components/schemas/SloReportCreateRequestData" required: - data type: object SloReportCreateRequestAttributes: description: The attributes portion of the SLO report request. properties: from_ts: description: The `from` timestamp for the report in epoch seconds. example: 1690901870 format: int64 type: integer interval: $ref: "#/components/schemas/SLOReportInterval" query: description: The query string used to filter SLO results. Some examples of queries include `service:` and `slo-name`. example: "slo_type:metric" type: string timezone: description: The timezone used to determine the start and end of each interval. For example, weekly intervals start at 12am on Sunday in the specified timezone. example: America/New_York type: string to_ts: description: The `to` timestamp for the report in epoch seconds. example: 1706803070 format: int64 type: integer required: - query - from_ts - to_ts type: object SloReportCreateRequestData: description: The data portion of the SLO report request. properties: attributes: $ref: "#/components/schemas/SloReportCreateRequestAttributes" required: - attributes type: object SloStatusData: description: The data portion of the SLO status response. properties: attributes: $ref: "#/components/schemas/SloStatusDataAttributes" id: description: The ID of the SLO. example: "00000000-0000-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/SloStatusType" required: - id - type - attributes type: object SloStatusDataAttributes: description: The attributes of the SLO status. properties: error_budget_remaining: description: The percentage of error budget remaining. example: 99.5 format: double type: number raw_error_budget_remaining: $ref: "#/components/schemas/RawErrorBudgetRemaining" sli: description: The current Service Level Indicator (SLI) value as a percentage. example: 99.95 format: double type: number span_precision: description: The precision of the time span in seconds. example: 2 format: int64 type: integer state: description: The current state of the SLO (for example, `breached`, `warning`, `ok`). example: ok type: string required: - sli - error_budget_remaining - raw_error_budget_remaining - state - span_precision type: object SloStatusResponse: description: The SLO status response. properties: data: $ref: "#/components/schemas/SloStatusData" required: - data type: object SloStatusType: description: The type of the SLO status resource. enum: - slo_status example: slo_status type: string x-enum-varnames: - SLO_STATUS SlosGroupMode: description: How SLO results are grouped in the response. enum: - overall - components example: overall type: string x-enum-varnames: - OVERALL - COMPONENTS SlosMeasure: description: The SLO measurement to retrieve. enum: - good_events - bad_events - slo_status - error_budget_remaining - error_budget_remaining_history - error_budget_burndown - burn_rate - slo_status_history - good_minutes - bad_minutes example: slo_status type: string x-enum-varnames: - GOOD_EVENTS - BAD_EVENTS - SLO_STATUS - ERROR_BUDGET_REMAINING - ERROR_BUDGET_REMAINING_HISTORY - ERROR_BUDGET_BURNDOWN - BURN_RATE - SLO_STATUS_HISTORY - GOOD_MINUTES - BAD_MINUTES SlosQueryType: description: The type of SLO definition being queried. enum: - metric - time_slice - monitor example: metric type: string x-enum-varnames: - METRIC - TIME_SLICE - MONITOR Snapshot: description: A single heatmap snapshot resource returned by create or update operations. properties: data: $ref: "#/components/schemas/SnapshotData" type: object SnapshotArray: description: A list of heatmap snapshots returned by a list operation. properties: data: description: Array of heatmap snapshot data objects. items: $ref: "#/components/schemas/SnapshotData" type: array required: - data type: object SnapshotCreateRequest: description: Request body for creating a heatmap snapshot. properties: data: $ref: "#/components/schemas/SnapshotCreateRequestData" required: - data type: object SnapshotCreateRequestData: description: Data object for a heatmap snapshot creation request, containing the resource type and attributes. properties: attributes: $ref: "#/components/schemas/SnapshotCreateRequestDataAttributes" type: $ref: "#/components/schemas/SnapshotUpdateRequestDataType" required: - type type: object SnapshotCreateRequestDataAttributes: description: Attributes for creating a heatmap snapshot, including the view, session, event, and device context. properties: application_id: description: Unique identifier of the RUM application. example: aaaaaaaa-1111-2222-3333-bbbbbbbbbbbb type: string device_type: description: Device type used when capturing the snapshot (e.g., desktop, mobile, tablet). example: desktop type: string event_id: description: Unique identifier of the RUM event associated with the snapshot. example: 11111111-2222-3333-4444-555555555555 type: string is_device_type_selected_by_user: description: Indicates whether the device type was explicitly selected by the user rather than auto-detected. example: false type: boolean session_id: description: Unique identifier of the RUM session associated with the snapshot. type: string snapshot_name: description: Human-readable name for the snapshot. example: My Snapshot type: string start: description: Offset in milliseconds from the start of the session at which the snapshot was captured. example: 0 format: int64 type: integer view_id: description: Unique identifier of the RUM view associated with the snapshot. type: string view_name: description: URL path or name of the view where the snapshot was captured. example: /home type: string required: - view_name - device_type - application_id - snapshot_name - event_id - start - is_device_type_selected_by_user type: object SnapshotData: description: Data object representing a heatmap snapshot, including its identifier, type, and attributes. properties: attributes: $ref: "#/components/schemas/SnapshotDataAttributes" id: description: Unique identifier of the heatmap snapshot. readOnly: true type: string type: $ref: "#/components/schemas/SnapshotUpdateRequestDataType" required: - type type: object SnapshotDataAttributes: description: Attributes of a heatmap snapshot, including view context, device information, and audit metadata. properties: application_id: description: Unique identifier of the RUM application. type: string created_at: description: Timestamp when the snapshot was created. format: date-time readOnly: true type: string created_by: description: Display name of the user who created the snapshot. readOnly: true type: string created_by_handle: description: Email handle of the user who created the snapshot. readOnly: true type: string created_by_user_id: description: Numeric identifier of the user who created the snapshot. format: int64 readOnly: true type: integer device_type: description: Device type used when capturing the snapshot (e.g., desktop, mobile, tablet). type: string event_id: description: Unique identifier of the RUM event associated with the snapshot. type: string is_device_type_selected_by_user: description: Indicates whether the device type was explicitly selected by the user rather than auto-detected. type: boolean modified_at: description: Timestamp when the snapshot was last modified. format: date-time readOnly: true type: string org_id: description: Numeric identifier of the organization that owns the snapshot. format: int64 readOnly: true type: integer session_id: description: Unique identifier of the RUM session associated with the snapshot. type: string snapshot_name: description: Human-readable name for the snapshot. type: string start: description: Offset in milliseconds from the start of the session at which the snapshot was captured. format: int64 type: integer view_id: description: Unique identifier of the RUM view associated with the snapshot. type: string view_name: description: URL path or name of the view where the snapshot was captured. type: string type: object SnapshotUpdateRequest: description: Request body for updating a heatmap snapshot. properties: data: $ref: "#/components/schemas/SnapshotUpdateRequestData" required: - data type: object SnapshotUpdateRequestData: description: Data object for a heatmap snapshot update request, containing the resource identifier, type, and attributes. properties: attributes: $ref: "#/components/schemas/SnapshotUpdateRequestDataAttributes" id: description: Unique identifier of the heatmap snapshot to update. example: 00000000-0000-0000-0000-000000000001 type: string type: $ref: "#/components/schemas/SnapshotUpdateRequestDataType" required: - type type: object SnapshotUpdateRequestDataAttributes: description: Attributes for updating a heatmap snapshot, including event, session, and view context. properties: event_id: description: Unique identifier of the RUM event associated with the snapshot. example: 11111111-2222-3333-4444-555555555555 type: string is_device_type_selected_by_user: description: Indicates whether the device type was explicitly selected by the user rather than auto-detected. example: false type: boolean session_id: description: Unique identifier of the RUM session associated with the snapshot. type: string start: description: Offset in milliseconds from the start of the session at which the snapshot was captured. example: 0 format: int64 type: integer view_id: description: Unique identifier of the RUM view associated with the snapshot. type: string required: - event_id - start - is_device_type_selected_by_user type: object SnapshotUpdateRequestDataType: default: snapshots description: Snapshots resource type. enum: - snapshots example: snapshots type: string x-enum-varnames: - SNAPSHOTS SnowflakeAccountUsageMetricsIntegrationDataflowRequest: additionalProperties: false description: >- Account-level usage metrics read from the Snowflake `ACCOUNT_USAGE` schema, covering storage usage, credit consumption, and query activity. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean settings: $ref: "#/components/schemas/SnowflakeAccountUsageMetricsIntegrationDataflowSettingsRequest" type: object SnowflakeAccountUsageMetricsIntegrationDataflowResponse: description: >- Account-level usage metrics read from the Snowflake `ACCOUNT_USAGE` schema, covering storage usage, credit consumption, and query activity. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean settings: $ref: "#/components/schemas/SnowflakeAccountUsageMetricsIntegrationDataflowSettingsResponse" type: object SnowflakeAccountUsageMetricsIntegrationDataflowSettingsRequest: additionalProperties: false description: Settings of the account usage metrics dataflow. Only the fields provided are changed. properties: account_usage_metrics_aggregate_last_24h: description: >- The period each metric aggregates over. Set to `true` to aggregate the past 24 hours on a rolling basis, or `false` to aggregate the current day so far. Defaults to `false`. example: false type: boolean type: object SnowflakeAccountUsageMetricsIntegrationDataflowSettingsResponse: description: Settings of the account usage metrics dataflow. properties: account_usage_metrics_aggregate_last_24h: description: >- The period each metric aggregates over. When `true`, metrics aggregate the past 24 hours on a rolling basis; when `false`, they aggregate the current day so far. example: false type: boolean type: object SnowflakeCloudCostMetricsIntegrationDataflowRequest: additionalProperties: false description: >- Cost data aggregated from the Snowflake `ORGANIZATION_USAGE` schema. [Cloud Cost Management](https://docs.datadoghq.com/cloud_cost_management/) must be enabled for your organization while this dataflow is enabled. Any request that enables this dataflow without Cloud Cost Management is rejected with a `422` response. The Snowflake role also needs the ORGANIZATION_BILLING_VIEWER database role to read the underlying cost views; without that role this dataflow collects no data. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean settings: $ref: "#/components/schemas/SnowflakeCloudCostMetricsIntegrationDataflowSettingsRequest" type: object SnowflakeCloudCostMetricsIntegrationDataflowResponse: description: >- Cost data aggregated from the Snowflake `ORGANIZATION_USAGE` schema. Requires [Cloud Cost Management](https://docs.datadoghq.com/cloud_cost_management/) to be set up for your organization, and the ORGANIZATION_BILLING_VIEWER database role on the Snowflake role; without both this dataflow collects no data. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean settings: $ref: "#/components/schemas/SnowflakeCloudCostMetricsIntegrationDataflowSettingsResponse" type: object SnowflakeCloudCostMetricsIntegrationDataflowSettingsRequest: additionalProperties: false description: Settings of the Cloud Cost Management dataflow. Only the fields provided are changed. properties: query_tags: description: >- Snowflake query tags to ingest, so that cost data can be broken down by them in Cloud Cost Management. Provide the tag names as a comma-separated list without spaces, using only letters, digits, underscores, dots, and hyphens. Datadog does not collect query tags by default. example: env,team,cost_center pattern: "^([a-zA-Z0-9_.-]+(,[a-zA-Z0-9_.-]+)*)?$" type: string type: object SnowflakeCloudCostMetricsIntegrationDataflowSettingsResponse: description: Settings of the Cloud Cost Management dataflow. properties: query_tags: description: >- Snowflake query tags ingested as a comma-separated list of tag names, so that cost data can be broken down by them in Cloud Cost Management. example: env,team,cost_center type: string type: object SnowflakeDataObservabilityQualityMonitoringIntegrationDataflowRequest: additionalProperties: false description: >- Data Observability, which collects lineage and data quality information from your Snowflake databases so you can explore how data flows and detect and resolve quality issues. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean settings: $ref: "#/components/schemas/SnowflakeDataObservabilityQualityMonitoringIntegrationDataflowSettingsRequest" type: object SnowflakeDataObservabilityQualityMonitoringIntegrationDataflowResponse: description: >- Data Observability, which collects lineage and data quality information from your Snowflake databases so you can explore how data flows and detect and resolve quality issues. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean settings: $ref: "#/components/schemas/SnowflakeDataObservabilityQualityMonitoringIntegrationDataflowSettingsResponse" type: object SnowflakeDataObservabilityQualityMonitoringIntegrationDataflowSettingsRequest: additionalProperties: false description: Settings of the Data Observability dataflow. Only the fields provided are changed. properties: do_table_crawler_cron: description: >- Cron expression setting how often Datadog crawls your Snowflake table metadata. It takes the five standard fields, with the restriction that the month must be `*` and that the day of the month and the day of the week cannot both be constrained. Common values are hourly (`0 * * * *`) and daily (`0 0 * * *`). Defaults to hourly (`0 * * * *`). example: "0 */6 * * *" type: string sync_snowflake_system_database: description: >- Whether metadata from the Snowflake `SNOWFLAKE` system database is included in Data Observability alongside your own databases. Defaults to `true`. example: true type: boolean type: object SnowflakeDataObservabilityQualityMonitoringIntegrationDataflowSettingsResponse: description: Settings of the Data Observability dataflow. properties: do_table_crawler_cron: description: Cron expression setting how often Datadog crawls your Snowflake table metadata. example: "0 */6 * * *" type: string sync_snowflake_system_database: description: >- Whether metadata from the Snowflake `SNOWFLAKE` system database is included in Data Observability alongside your own databases. example: true type: boolean type: object SnowflakeEventTableLogsIntegrationDataflowRequest: additionalProperties: false description: >- Records from your Snowflake event tables, used to monitor application behavior and identify issues. `enabled` turns the dataflow on and off as a whole, and the per-record-type toggles in `settings` select which kinds of record it collects while it is on. The Snowflake role needs usage granted on the database, the schema, and the event table itself; without those grants this dataflow collects no data. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean settings: $ref: "#/components/schemas/SnowflakeEventTableLogsIntegrationDataflowSettingsRequest" type: object SnowflakeEventTableLogsIntegrationDataflowResponse: description: >- Records from your Snowflake event tables, used to monitor application behavior and identify issues. `enabled` turns the dataflow on and off as a whole, and the per-record-type toggles in `settings` select which kinds of record it collects while it is on. The Snowflake role needs usage granted on the database, the schema, and the event table itself; without those grants this dataflow collects no data. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean settings: $ref: "#/components/schemas/SnowflakeEventTableLogsIntegrationDataflowSettingsResponse" type: object SnowflakeEventTableLogsIntegrationDataflowSettingsRequest: additionalProperties: false description: >- Settings of the event table dataflow. Each record type is collected independently so that you can control ingestion costs, and every record type is ingested into Datadog as logs tagged with its `record_type`. Only the fields provided are changed. properties: event_table_events_enabled: description: >- Whether records with a `record_type` of `event` are collected. Defaults to `false`. example: true type: boolean event_table_logs_enabled: description: >- Whether records with a `record_type` of `log` are collected. Defaults to `false`. example: true type: boolean event_table_logs_interval_min: description: >- How often event table records are collected, in minutes. One of `5`, `15`, `30`, `60`, or `1440`. Defaults to `5`. example: 15 format: int64 type: integer event_table_span_events_enabled: description: >- Whether records with a `record_type` of `span_event` are collected. Defaults to `false`. example: false type: boolean event_table_spans_enabled: description: >- Whether records with a `record_type` of `span` are collected. Defaults to `false`. example: false type: boolean type: object SnowflakeEventTableLogsIntegrationDataflowSettingsResponse: description: >- Settings of the event table dataflow. Each record type is collected independently so that you can control ingestion costs, and every record type is ingested into Datadog as logs tagged with its `record_type`. properties: event_table_events_enabled: description: Whether records with a `record_type` of `event` are collected. example: true type: boolean event_table_logs_enabled: description: Whether records with a `record_type` of `log` are collected. example: true type: boolean event_table_logs_interval_min: description: How often event table records are collected, in minutes. example: 15 format: int64 type: integer event_table_span_events_enabled: description: Whether records with a `record_type` of `span_event` are collected. example: false type: boolean event_table_spans_enabled: description: Whether records with a `record_type` of `span` are collected. example: false type: boolean type: object SnowflakeIntegrationAccountAuthenticationRequest: description: Authentication for creating the Snowflake integration account. Exactly one method is set. oneOf: - $ref: "#/components/schemas/SnowflakeIntegrationAccountPrivateKeyAuthRequest" SnowflakeIntegrationAccountAuthenticationResponse: description: Authentication configured on the Snowflake integration account. oneOf: - $ref: "#/components/schemas/SnowflakeIntegrationAccountPrivateKeyAuthResponse" SnowflakeIntegrationAccountAuthenticationUpdate: description: Authentication for updating the Snowflake integration account. Exactly one method is set. oneOf: - $ref: "#/components/schemas/SnowflakeIntegrationAccountPrivateKeyAuthUpdate" SnowflakeIntegrationAccountCreateAttributes: description: Writable attributes used to create a Snowflake integration account. properties: authentication: $ref: "#/components/schemas/SnowflakeIntegrationAccountAuthenticationRequest" dataflows: $ref: "#/components/schemas/SnowflakeIntegrationDataflowsRequest" name: description: |- Human-readable name of the Snowflake integration account. Must be unique within your Datadog organization. example: prod-snowflake type: string settings: $ref: "#/components/schemas/SnowflakeIntegrationAccountSettingsRequest" required: - name - authentication - settings type: object SnowflakeIntegrationAccountCreateData: description: Data envelope for creating a Snowflake integration account. properties: attributes: $ref: "#/components/schemas/SnowflakeIntegrationAccountCreateAttributes" type: $ref: "#/components/schemas/IntegrationAccountType" required: - type - attributes type: object SnowflakeIntegrationAccountCreateRequest: description: Request payload to create a Snowflake integration account. properties: data: $ref: "#/components/schemas/SnowflakeIntegrationAccountCreateData" required: - data type: object SnowflakeIntegrationAccountPrivateKeyAuthRequest: additionalProperties: false description: >- RSA key pair authentication, the only method Snowflake integration accounts support. Generate an RSA key pair and assign the public key to the Snowflake user named in `settings.username`. properties: auth_type: $ref: "#/components/schemas/SnowflakeIntegrationAccountPrivateKeyAuthType" private_key: description: The private key, in PEM format. example: "-----BEGIN PRIVATE KEY-----\nMIIE...\n-----END PRIVATE KEY-----" type: string writeOnly: true private_key_name: description: Name that distinguishes this private key from other keys in Datadog. example: my-rsa-key type: string private_key_passphrase: description: >- Passphrase that decrypts the private key. Provide it only when the key is encrypted. example: your-private-key-passphrase type: string writeOnly: true required: - auth_type - private_key_name - private_key type: object SnowflakeIntegrationAccountPrivateKeyAuthResponse: description: The RSA key pair authentication method configured on the account. properties: auth_type: $ref: "#/components/schemas/SnowflakeIntegrationAccountPrivateKeyAuthType" private_key_name: description: Name that distinguishes this private key from other keys in Datadog. example: my-rsa-key type: string required: - auth_type - private_key_name type: object SnowflakeIntegrationAccountPrivateKeyAuthType: default: snowflake_private_key description: The authentication method type. enum: - snowflake_private_key example: snowflake_private_key type: string x-enum-varnames: - SNOWFLAKE_PRIVATE_KEY SnowflakeIntegrationAccountPrivateKeyAuthUpdate: additionalProperties: false description: >- RSA key pair authentication, the only method Snowflake integration accounts support. Only the fields provided are changed; omit `private_key` to keep the stored one. properties: auth_type: $ref: "#/components/schemas/SnowflakeIntegrationAccountPrivateKeyAuthType" private_key: description: The private key, in PEM format. example: "-----BEGIN PRIVATE KEY-----\nMIIE...\n-----END PRIVATE KEY-----" type: string writeOnly: true private_key_name: description: Name that distinguishes this private key from other keys in Datadog. example: my-rsa-key type: string private_key_passphrase: description: >- Passphrase that decrypts the private key. Provide it only when the key is encrypted. Omit it to keep the stored passphrase, send `null` or an empty string to remove it, or send a value to replace it. example: your-private-key-passphrase nullable: true type: string writeOnly: true required: - auth_type type: object SnowflakeIntegrationAccountResponse: description: Response payload for a single Snowflake integration account. properties: data: $ref: "#/components/schemas/SnowflakeIntegrationAccountResponseData" required: - data type: object SnowflakeIntegrationAccountResponseAttributes: description: Attributes of a Snowflake integration account returned in responses. properties: authentication: $ref: "#/components/schemas/SnowflakeIntegrationAccountAuthenticationResponse" dataflows: $ref: "#/components/schemas/SnowflakeIntegrationDataflowsResponse" name: description: Human-readable name of the Snowflake integration account. example: prod-snowflake type: string settings: $ref: "#/components/schemas/SnowflakeIntegrationAccountSettingsResponse" required: - name - settings type: object SnowflakeIntegrationAccountResponseData: description: Data envelope of a Snowflake integration account, including server-assigned identity. properties: attributes: $ref: "#/components/schemas/SnowflakeIntegrationAccountResponseAttributes" id: description: Server-generated unique identifier of the Snowflake integration account. example: a1b2c3d4-e5f6-7890-abcd-ef1234567890 readOnly: true type: string type: $ref: "#/components/schemas/IntegrationAccountType" required: - id - attributes - type type: object SnowflakeIntegrationAccountSettingsRequest: additionalProperties: false description: Settings for creating the Snowflake integration account. properties: snowflake_account_identifier: description: >- Identifier of the Snowflake account to monitor, either as `organization-account` or as the legacy `account_name.region_id.cloud_provider` account locator. An account identifier can be configured once per Datadog organization; reusing one is rejected with a `422` response. Accounts reached through AWS PrivateLink are not supported. example: myorg-myaccount type: string username: description: >- Snowflake user Datadog authenticates as. Create a dedicated user for Datadog and grant it a role with access to the data you want to collect. example: datadog_user type: string required: - snowflake_account_identifier - username type: object SnowflakeIntegrationAccountSettingsResponse: description: Settings configured on the Snowflake integration account. properties: snowflake_account_identifier: description: Identifier of the Snowflake account being monitored. example: myorg-myaccount type: string username: description: Snowflake user Datadog authenticates as. example: datadog_user type: string required: - snowflake_account_identifier - username type: object SnowflakeIntegrationAccountSettingsUpdate: additionalProperties: false description: Settings for updating the Snowflake integration account. Only the fields provided are changed. properties: snowflake_account_identifier: description: >- Identifier of the Snowflake account to monitor, either as `organization-account` or as the legacy `account_name.region_id.cloud_provider` account locator. An account identifier can be configured once per Datadog organization; reusing one is rejected with a `422` response. Accounts reached through AWS PrivateLink are not supported. example: myorg-myaccount type: string username: description: >- Snowflake user Datadog authenticates as. Create a dedicated user for Datadog and grant it a role with access to the data you want to collect. example: datadog_user type: string type: object SnowflakeIntegrationAccountUpdateAttributes: description: >- Writable attributes used to update a Snowflake integration account. Every field is optional; only the fields provided are changed. When `dataflows` is provided, only the dataflow ids included in the request are modified; dataflows omitted from the map keep their current configuration, as do the settings of an included dataflow that provides only `enabled`. properties: authentication: $ref: "#/components/schemas/SnowflakeIntegrationAccountAuthenticationUpdate" dataflows: $ref: "#/components/schemas/SnowflakeIntegrationDataflowsRequest" name: description: |- Human-readable name of the Snowflake integration account. Must be unique within your Datadog organization. example: prod-snowflake type: string settings: $ref: "#/components/schemas/SnowflakeIntegrationAccountSettingsUpdate" type: object SnowflakeIntegrationAccountUpdateData: description: Data envelope for updating a Snowflake integration account. properties: attributes: $ref: "#/components/schemas/SnowflakeIntegrationAccountUpdateAttributes" id: description: Unique identifier of the Snowflake integration account to update. example: a1b2c3d4-e5f6-7890-abcd-ef1234567890 type: string type: $ref: "#/components/schemas/IntegrationAccountType" required: - id - type - attributes type: object SnowflakeIntegrationAccountUpdateRequest: description: Request payload to update a Snowflake integration account. properties: data: $ref: "#/components/schemas/SnowflakeIntegrationAccountUpdateData" required: - data type: object SnowflakeIntegrationAccountsResponse: description: Response payload for a list of Snowflake integration accounts. properties: data: description: List of Snowflake integration accounts. items: $ref: "#/components/schemas/SnowflakeIntegrationAccountResponseData" type: array required: - data type: object SnowflakeIntegrationDataflowsRequest: additionalProperties: false description: >- Data Datadog collects from Snowflake, keyed by dataflow id. Each dataflow turns on a distinct kind of collection: set `enabled` to start or stop it, and use `settings` to configure what it collects. Defaults listed on each dataflow apply when the account is created; on update, omitted fields keep their current values. Every dataflow reads from Snowflake as the user in `settings.username`, so that user's role must be granted access to the underlying views; a dataflow enabled without those grants is stored but collects no data. properties: snowflake-account-usage-metrics: $ref: "#/components/schemas/SnowflakeAccountUsageMetricsIntegrationDataflowRequest" snowflake-cloud-cost-metrics: $ref: "#/components/schemas/SnowflakeCloudCostMetricsIntegrationDataflowRequest" snowflake-data-observability-quality-monitoring: $ref: "#/components/schemas/SnowflakeDataObservabilityQualityMonitoringIntegrationDataflowRequest" snowflake-event-table-logs: $ref: "#/components/schemas/SnowflakeEventTableLogsIntegrationDataflowRequest" snowflake-organization-usage-metrics: $ref: "#/components/schemas/SnowflakeOrganizationUsageMetricsIntegrationDataflowRequest" snowflake-query-history-logs: $ref: "#/components/schemas/SnowflakeQueryHistoryLogsIntegrationDataflowRequest" snowflake-security-logs: $ref: "#/components/schemas/SnowflakeSecurityLogsIntegrationDataflowRequest" snowflake-task-history-logs: $ref: "#/components/schemas/SnowflakeTaskHistoryLogsIntegrationDataflowRequest" type: object SnowflakeIntegrationDataflowsResponse: description: Data Datadog collects from Snowflake, keyed by dataflow id. properties: snowflake-account-usage-metrics: $ref: "#/components/schemas/SnowflakeAccountUsageMetricsIntegrationDataflowResponse" snowflake-cloud-cost-metrics: $ref: "#/components/schemas/SnowflakeCloudCostMetricsIntegrationDataflowResponse" snowflake-data-observability-quality-monitoring: $ref: "#/components/schemas/SnowflakeDataObservabilityQualityMonitoringIntegrationDataflowResponse" snowflake-event-table-logs: $ref: "#/components/schemas/SnowflakeEventTableLogsIntegrationDataflowResponse" snowflake-organization-usage-metrics: $ref: "#/components/schemas/SnowflakeOrganizationUsageMetricsIntegrationDataflowResponse" snowflake-query-history-logs: $ref: "#/components/schemas/SnowflakeQueryHistoryLogsIntegrationDataflowResponse" snowflake-security-logs: $ref: "#/components/schemas/SnowflakeSecurityLogsIntegrationDataflowResponse" snowflake-task-history-logs: $ref: "#/components/schemas/SnowflakeTaskHistoryLogsIntegrationDataflowResponse" type: object SnowflakeOrganizationUsageMetricsIntegrationDataflowRequest: additionalProperties: false description: >- Organization-level usage metrics read from the Snowflake `ORGANIZATION_USAGE` schema, covering the credit consumption of every account in the organization and the history of data transferred out of Snowflake. Reading that schema requires the ORGADMIN role; without it this dataflow collects no data. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean settings: $ref: "#/components/schemas/SnowflakeOrganizationUsageMetricsIntegrationDataflowSettingsRequest" type: object SnowflakeOrganizationUsageMetricsIntegrationDataflowResponse: description: >- Organization-level usage metrics read from the Snowflake `ORGANIZATION_USAGE` schema, covering the credit consumption of every account in the organization and the history of data transferred out of Snowflake. Reading that schema requires the ORGADMIN role; without it this dataflow collects no data. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean settings: $ref: "#/components/schemas/SnowflakeOrganizationUsageMetricsIntegrationDataflowSettingsResponse" type: object SnowflakeOrganizationUsageMetricsIntegrationDataflowSettingsRequest: additionalProperties: false description: Settings of the organization usage metrics dataflow. Only the fields provided are changed. properties: organization_usage_metrics_aggregate_last_24h: description: >- The period each metric aggregates over. Set to `true` to aggregate the past 24 hours on a rolling basis, or `false` to aggregate the current day so far. Defaults to `false`. example: false type: boolean type: object SnowflakeOrganizationUsageMetricsIntegrationDataflowSettingsResponse: description: Settings of the organization usage metrics dataflow. properties: organization_usage_metrics_aggregate_last_24h: description: >- The period each metric aggregates over. When `true`, metrics aggregate the past 24 hours on a rolling basis; when `false`, they aggregate the current day so far. example: false type: boolean type: object SnowflakeQueryHistoryLogsIntegrationDataflowRequest: additionalProperties: false description: >- Per-query logs that let you identify long-running, poorly performing, and expensive queries. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean settings: $ref: "#/components/schemas/SnowflakeQueryHistoryLogsIntegrationDataflowSettingsRequest" type: object SnowflakeQueryHistoryLogsIntegrationDataflowResponse: description: >- Per-query logs that let you identify long-running, poorly performing, and expensive queries. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean settings: $ref: "#/components/schemas/SnowflakeQueryHistoryLogsIntegrationDataflowSettingsResponse" type: object SnowflakeQueryHistoryLogsIntegrationDataflowSettingsRequest: additionalProperties: false description: Settings of the query history logs dataflow. Only the fields provided are changed. properties: join_query_history_with_access_history_enabled: description: >- Whether query logs are joined with Snowflake access history, which adds the objects each query read and wrote so you can follow how data is used and where it came from. Defaults to `false`. example: true type: boolean query_history_logs_interval_min: description: >- How often query history logs are collected, in minutes. One of `5`, `15`, `30`, `60`, `720`, or `1440`. Defaults to `5`. example: 15 format: int64 type: integer type: object SnowflakeQueryHistoryLogsIntegrationDataflowSettingsResponse: description: Settings of the query history logs dataflow. properties: join_query_history_with_access_history_enabled: description: >- Whether query logs are joined with Snowflake access history, which adds the objects each query read and wrote so you can follow how data is used and where it came from. example: true type: boolean query_history_logs_interval_min: description: How often query history logs are collected, in minutes. example: 15 format: int64 type: integer type: object SnowflakeSecurityLogsIntegrationDataflowRequest: additionalProperties: false description: >- Security logs from the Snowflake `ACCOUNT_USAGE` schema, for analyzing the security of your Snowflake account and running threat detection with [Cloud SIEM](https://docs.datadoghq.com/security/cloud_siem/). properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean settings: $ref: "#/components/schemas/SnowflakeSecurityLogsIntegrationDataflowSettingsRequest" type: object SnowflakeSecurityLogsIntegrationDataflowResponse: description: >- Security logs from the Snowflake `ACCOUNT_USAGE` schema, for analyzing the security of your Snowflake account and running threat detection with [Cloud SIEM](https://docs.datadoghq.com/security/cloud_siem/). properties: enabled: description: Whether Datadog collects this data. example: true type: boolean settings: $ref: "#/components/schemas/SnowflakeSecurityLogsIntegrationDataflowSettingsResponse" type: object SnowflakeSecurityLogsIntegrationDataflowSettingsRequest: additionalProperties: false description: Settings of the security logs dataflow. Only the fields provided are changed. properties: security_logs_interval_min: description: >- How often security logs are collected, in minutes. One of `5`, `15`, `30`, `60`, `360`, `720`, or `1440`. Defaults to `5`. example: 60 format: int64 type: integer type: object SnowflakeSecurityLogsIntegrationDataflowSettingsResponse: description: Settings of the security logs dataflow. properties: security_logs_interval_min: description: How often security logs are collected, in minutes. example: 60 format: int64 type: integer type: object SnowflakeTaskHistoryLogsIntegrationDataflowRequest: additionalProperties: false description: >- Execution logs for your scheduled Snowflake tasks, covering start time, end time, status, and any error message. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean settings: $ref: "#/components/schemas/SnowflakeTaskHistoryLogsIntegrationDataflowSettingsRequest" type: object SnowflakeTaskHistoryLogsIntegrationDataflowResponse: description: >- Execution logs for your scheduled Snowflake tasks, covering start time, end time, status, and any error message. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean settings: $ref: "#/components/schemas/SnowflakeTaskHistoryLogsIntegrationDataflowSettingsResponse" type: object SnowflakeTaskHistoryLogsIntegrationDataflowSettingsRequest: additionalProperties: false description: Settings of the task history logs dataflow. Only the fields provided are changed. properties: task_history_logs_interval_min: description: >- How often task history logs are collected, in minutes. One of `5`, `15`, `30`, `60`, or `1440`. Defaults to `5`. example: 30 format: int64 type: integer type: object SnowflakeTaskHistoryLogsIntegrationDataflowSettingsResponse: description: Settings of the task history logs dataflow. properties: task_history_logs_interval_min: description: How often task history logs are collected, in minutes. example: 30 format: int64 type: integer type: object SoftwareCatalogTriggerWrapper: description: "Schema for a Software Catalog-based trigger." properties: softwareCatalogTrigger: description: "Trigger a workflow from Software Catalog." type: object startStepNames: $ref: "#/components/schemas/StartStepNames" required: - softwareCatalogTrigger type: object SortDirection: default: desc description: The direction to sort by. enum: - desc - asc type: string x-enum-varnames: - DESC - ASC SourcemapDataType: description: The resource type for source map objects. enum: - sourcemaps example: sourcemaps type: string x-enum-varnames: - SOURCEMAPS SourcemapFileAttributes: description: Attributes of a JavaScript source map file. properties: file: description: The name of the minified JavaScript file. example: bundle.js type: string mappings: description: |- The Base64 VLQ encoded string that maps positions in the minified file to positions in the original source files. example: AAAA,OAAO,CAAC,GAAG type: string minifiedLineLengths: description: List of character counts for each line in the minified file. example: - 50 - 30 items: format: int64 type: integer type: array names: description: List of symbol names referenced in the mappings. example: - console - log items: {} type: array sourceRoot: description: The root path prepended to source file paths. example: / type: string sources: description: List of original source file paths. example: - src/index.js - src/utils.js items: type: string type: array sourcesContent: description: List of original source file contents corresponding to the paths in `sources`. example: - "console.log('index');" - "export function util() {}" items: type: string type: array version: description: The version of the source map format (typically 3). example: 3 format: int64 type: integer required: - file - version - sourceRoot - sources - sourcesContent - names - mappings - minifiedLineLengths type: object SourcemapFileData: description: JavaScript source map file data object. properties: attributes: $ref: "#/components/schemas/SourcemapFileAttributes" id: description: The unique identifier of the source map file, typically the path to the file. example: path/to/sourcemap.js.map type: string type: $ref: "#/components/schemas/SourcemapFileDataType" required: - id - type - attributes type: object SourcemapFileDataType: description: The resource type for source map file objects. enum: - sourcemap_files example: sourcemap_files type: string x-enum-varnames: - SOURCEMAP_FILES SourcemapFileResponse: description: Response containing a JavaScript source map file. properties: data: $ref: "#/components/schemas/SourcemapFileData" required: - data type: object SourcemapItem: description: A source map data object representing one of the supported map kinds. oneOf: - $ref: "#/components/schemas/JSSourcemapData" - $ref: "#/components/schemas/ReactNativeSourcemapData" - $ref: "#/components/schemas/IOSSourcemapData" - $ref: "#/components/schemas/JVMSourcemapData" - $ref: "#/components/schemas/FlutterSourcemapData" - $ref: "#/components/schemas/ELFSourcemapData" - $ref: "#/components/schemas/NDKSourcemapData" - $ref: "#/components/schemas/IL2CPPSourcemapData" - $ref: "#/components/schemas/WASMSourcemapData" - $ref: "#/components/schemas/PortablePdbSourcemapData" SourcemapMapKind: description: The type of source map. enum: - js - jvm - ios - react - flutter - elf - ndk - il2cpp - wasm - portable_pdb example: js type: string x-enum-varnames: - JS - JVM - IOS - REACT - FLUTTER - ELF - NDK - IL2CPP - WASM - PORTABLE_PDB SourcemapSearchBy: description: The search mode for listing JavaScript source maps. enum: - debug_id example: debug_id type: string x-enum-varnames: - DEBUG_ID SourcemapSymbolType: description: The WASM symbol representation. enum: - dwarf - sourcemap example: dwarf type: string x-enum-varnames: - DWARF - SOURCEMAP SourcemapsData: description: List of source map data objects. items: $ref: "#/components/schemas/SourcemapItem" type: array SourcemapsListMeta: description: Pagination metadata for the source maps list response. properties: page: $ref: "#/components/schemas/SourcemapsListMetaPage" required: - page type: object SourcemapsListMetaPage: description: Page information for the source maps list response. properties: has_more_results: description: Whether there are more results available beyond the current page. example: false type: boolean next_cursor: description: |- Cursor for the next page of a JavaScript cursor-based listing. Pass this value as `page[after]` with the same search mode and filters. Only returned when another page is available. type: string total_filtered_count: description: |- Total number of matching source maps for legacy page-number pagination. Cursor-based listings do not compute a total; this field may be zero even when records are returned. Use `has_more_results` to continue. example: 100 format: int64 type: integer required: - total_filtered_count - has_more_results type: object SourcemapsResponse: description: Response containing a list of affected source maps. properties: data: $ref: "#/components/schemas/SourcemapsData" required: - data type: object Span: description: Object description of a spans after being processed and stored by Datadog. properties: attributes: $ref: "#/components/schemas/SpansAttributes" id: description: Unique ID of the Span. example: "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA" type: string type: $ref: "#/components/schemas/SpansType" type: object SpansAggregateBucket: description: Spans aggregate. properties: attributes: $ref: "#/components/schemas/SpansAggregateBucketAttributes" id: description: ID of the spans aggregate. type: string type: $ref: "#/components/schemas/SpansAggregateBucketType" type: object SpansAggregateBucketAttributes: description: A bucket values. properties: by: additionalProperties: description: The values for each group by. description: The key, value pairs for each group by. example: {"@state": "success", "@version": "abc"} type: object compute: description: The compute data. type: object computes: additionalProperties: $ref: "#/components/schemas/SpansAggregateBucketValue" description: A map of the metric name -> value for regular compute or list of values for a timeseries. type: object type: object SpansAggregateBucketType: description: The spans aggregate bucket type. enum: ["bucket"] example: "bucket" type: string x-enum-varnames: ["BUCKET"] SpansAggregateBucketValue: description: A bucket value, can be either a timeseries or a single value. oneOf: - $ref: "#/components/schemas/SpansAggregateBucketValueSingleString" - $ref: "#/components/schemas/SpansAggregateBucketValueSingleNumber" - $ref: "#/components/schemas/SpansAggregateBucketValueTimeseries" SpansAggregateBucketValueSingleNumber: description: A single number value. format: double type: number SpansAggregateBucketValueSingleString: description: A single string value. type: string SpansAggregateBucketValueTimeseries: description: A timeseries array. items: $ref: "#/components/schemas/SpansAggregateBucketValueTimeseriesPoint" type: array x-generate-alias-as-model: true SpansAggregateBucketValueTimeseriesPoint: description: A timeseries point. properties: time: description: The time value for this point. example: "2023-06-08T11:55:00Z" type: string value: description: The value for this point. example: 19 format: double type: number type: object SpansAggregateData: description: The object containing the query content. properties: attributes: $ref: "#/components/schemas/SpansAggregateRequestAttributes" type: $ref: "#/components/schemas/SpansAggregateRequestType" type: object SpansAggregateRequest: description: The object sent with the request to retrieve a list of aggregated spans from your organization. properties: data: $ref: "#/components/schemas/SpansAggregateData" type: object SpansAggregateRequestAttributes: description: The object containing all the query parameters. properties: compute: description: The list of metrics or timeseries to compute for the retrieved buckets. items: $ref: "#/components/schemas/SpansCompute" type: array filter: $ref: "#/components/schemas/SpansQueryFilter" group_by: description: The rules for the group by. items: $ref: "#/components/schemas/SpansGroupBy" type: array options: $ref: "#/components/schemas/SpansQueryOptions" type: object SpansAggregateRequestType: default: aggregate_request description: The type of resource. The value should always be aggregate_request. enum: - aggregate_request example: aggregate_request type: string x-enum-varnames: ["AGGREGATE_REQUEST"] SpansAggregateResponse: description: The response object for the spans aggregate API endpoint. properties: data: description: The list of matching buckets, one item per bucket. items: $ref: "#/components/schemas/SpansAggregateBucket" type: array meta: $ref: "#/components/schemas/SpansAggregateResponseMetadata" type: object SpansAggregateResponseMetadata: description: The metadata associated with a request. properties: elapsed: description: The time elapsed in milliseconds. example: 132 format: int64 type: integer request_id: description: The identifier of the request. example: "MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR" type: string status: $ref: "#/components/schemas/SpansAggregateResponseStatus" warnings: description: |- A list of warnings (non fatal errors) encountered, partial results might be returned if warnings are present in the response. items: $ref: "#/components/schemas/SpansWarning" type: array type: object SpansAggregateResponseStatus: description: The status of the response. enum: ["done", "timeout"] example: "done" type: string x-enum-varnames: ["DONE", "TIMEOUT"] SpansAggregateSort: description: |- A sort rule. With `type: alphabetical` (the default), buckets are sorted by facet value and only `order` is allowed. With `type: measure`, buckets are sorted by a computed value: set `aggregation`, and set `metric` unless the aggregation is `count`. example: {"aggregation": "pc90", "metric": "@duration", "order": "desc", "type": "measure"} properties: aggregation: $ref: "#/components/schemas/SpansAggregationFunction" metric: description: The metric to sort by (only used for `type=measure`). example: "@duration" type: string order: $ref: "#/components/schemas/SpansSortOrder" type: $ref: "#/components/schemas/SpansAggregateSortType" type: object SpansAggregateSortType: default: "alphabetical" description: The type of sorting algorithm. enum: ["alphabetical", "measure"] type: string x-enum-varnames: ["ALPHABETICAL", "MEASURE"] SpansAggregationFunction: description: An aggregation function. enum: ["count", "cardinality", "pc75", "pc90", "pc95", "pc98", "pc99", "sum", "min", "max", "avg", "median"] example: "pc90" type: string x-enum-varnames: ["COUNT", "CARDINALITY", "PERCENTILE_75", "PERCENTILE_90", "PERCENTILE_95", "PERCENTILE_98", "PERCENTILE_99", "SUM", "MIN", "MAX", "AVG", "MEDIAN"] SpansAttributes: description: JSON object containing all span attributes and their associated values. properties: attributes: additionalProperties: {} description: JSON object of attributes from your span. example: {"customAttribute": 123, "duration": 2345} type: object custom: additionalProperties: {} description: JSON object of custom spans data. type: object end_timestamp: description: End timestamp of your span. example: "2023-01-02T09:42:36.420Z" format: date-time type: string env: description: |- Name of the environment from where the spans are being sent. example: "prod" type: string host: description: |- Name of the machine from where the spans are being sent. example: "i-0123" type: string ingestion_reason: description: The reason why the span was ingested. example: "rule" type: string parent_id: description: Id of the span that's parent of this span. example: "0" type: string resource_hash: description: Unique identifier of the resource. example: "a12345678b91c23d" type: string resource_name: description: The name of the resource. example: "agent" type: string retained_by: description: The reason why the span was indexed. example: "retention_filter" type: string service: description: |- The name of the application or service generating the span events. It is used to switch from APM to Logs, so make sure you define the same value when you use both products. example: "agent" type: string single_span: description: |- Whether or not the span was collected as a stand-alone span. Always associated to "single_span" ingestion_reason if true. example: true type: boolean span_id: description: Id of the span. example: "1234567890987654321" type: string start_timestamp: description: Start timestamp of your span. example: "2023-01-02T09:42:36.320Z" format: date-time type: string tags: description: Array of tags associated with your span. example: ["team:A"] items: description: Tag associated with your span. type: string type: array trace_id: description: Id of the trace to which the span belongs. example: "1234567890987654321" type: string type: description: The type of the span. example: "web" type: string type: object SpansCompute: description: |- A compute rule to compute metrics or timeseries. All computes in a request must have the same `type`, and `timeseries` computes must use the same `interval`. To get both totals and timeseries, send separate requests. properties: aggregation: $ref: "#/components/schemas/SpansAggregationFunction" interval: description: |- The time buckets' size (only used for type=timeseries) Defaults to a resolution of 150 points. example: "5m" type: string metric: description: The metric to use. example: "@duration" type: string type: $ref: "#/components/schemas/SpansComputeType" required: - aggregation type: object SpansComputeType: default: "total" description: The type of compute. enum: ["timeseries", "total"] type: string x-enum-varnames: ["TIMESERIES", "TOTAL"] SpansFilter: description: The spans filter used to index spans. properties: query: description: The search query - following the [span search syntax](https://docs.datadoghq.com/tracing/trace_explorer/query_syntax/). example: "@http.status_code:200 service:my-service" type: string type: object SpansFilterCreate: description: The spans filter. Spans matching this filter will be indexed and stored. properties: query: description: The search query - following the [span search syntax](https://docs.datadoghq.com/tracing/trace_explorer/query_syntax/). example: "@http.status_code:200 service:my-service" type: string required: - query type: object SpansGroupBy: description: A group by rule. properties: facet: description: The name of the facet to use (required). example: "host" type: string histogram: $ref: "#/components/schemas/SpansGroupByHistogram" limit: default: 10 description: |- The maximum buckets to return for this group by. A request can generate at most 10,000 groups. Nested `group_by` entries multiply, so the product of their limits must stay within that bound. For example, two entries with a limit of 100 each produce up to 10,000 groups. With a `timeseries` compute, the number of groups multiplied by the number of time buckets must not exceed 400,000. format: int64 type: integer missing: $ref: "#/components/schemas/SpansGroupByMissing" sort: $ref: "#/components/schemas/SpansAggregateSort" total: $ref: "#/components/schemas/SpansGroupByTotal" required: - facet type: object SpansGroupByHistogram: description: |- Used to perform a histogram computation (only for measure facets). Note: At most 100 buckets are allowed, the number of buckets is (max - min)/interval. properties: interval: description: The bin size of the histogram buckets. example: 10 format: double type: number max: description: |- The maximum value for the measure used in the histogram (values greater than this one are filtered out). example: 100 format: double type: number min: description: |- The minimum value for the measure used in the histogram (values smaller than this one are filtered out). example: 50 format: double type: number required: - interval - min - max type: object SpansGroupByMissing: description: The value to use for spans that don't have the facet used to group by. oneOf: - $ref: "#/components/schemas/SpansGroupByMissingString" - $ref: "#/components/schemas/SpansGroupByMissingNumber" SpansGroupByMissingNumber: description: The missing value to use if there is a number valued facet. format: double type: number SpansGroupByMissingString: description: The missing value to use if there is string valued facet. type: string SpansGroupByTotal: default: false description: |- A resulting object to put the given computes in over all the matching records. oneOf: - $ref: "#/components/schemas/SpansGroupByTotalBoolean" - $ref: "#/components/schemas/SpansGroupByTotalString" - $ref: "#/components/schemas/SpansGroupByTotalNumber" SpansGroupByTotalBoolean: description: If set to true, creates an additional bucket labeled "$facet_total". type: boolean SpansGroupByTotalNumber: description: A number to use as the key value for the total bucket. format: double type: number SpansGroupByTotalString: description: A string to use as the key value for the total bucket. type: string SpansListRequest: description: The request for a spans list. properties: data: $ref: "#/components/schemas/SpansListRequestData" type: object SpansListRequestAttributes: description: The object containing all the query parameters. properties: filter: $ref: "#/components/schemas/SpansQueryFilter" options: $ref: "#/components/schemas/SpansQueryOptions" page: $ref: "#/components/schemas/SpansListRequestPage" sort: $ref: "#/components/schemas/SpansSort" type: object SpansListRequestData: description: The object containing the query content. properties: attributes: $ref: "#/components/schemas/SpansListRequestAttributes" type: $ref: "#/components/schemas/SpansListRequestType" type: object SpansListRequestPage: description: Paging attributes for listing spans. properties: cursor: description: |- List following results with a cursor provided in the previous query. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string limit: default: 10 description: Maximum number of spans in the response. example: 25 format: int32 maximum: 1000 type: integer type: object SpansListRequestType: default: search_request description: The type of resource. The value should always be search_request. enum: - search_request example: search_request type: string x-enum-varnames: ["SEARCH_REQUEST"] SpansListResponse: description: Response object with all spans matching the request and pagination information. properties: data: description: Array of spans matching the request. items: $ref: "#/components/schemas/Span" type: array links: $ref: "#/components/schemas/SpansListResponseLinks" meta: $ref: "#/components/schemas/SpansListResponseMetadata" type: object SpansListResponseLinks: description: Links attributes. properties: next: description: |- Link for the next set of results. Note that the request can also be made using the POST endpoint. example: "https://app.datadoghq.com/api/v2/spans/event?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string type: object SpansListResponseMetadata: description: The metadata associated with a request. properties: elapsed: description: The time elapsed in milliseconds. example: 132 format: int64 type: integer page: $ref: "#/components/schemas/SpansResponseMetadataPage" request_id: description: The identifier of the request. example: "MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR" type: string status: $ref: "#/components/schemas/SpansAggregateResponseStatus" warnings: description: |- A list of warnings (non fatal errors) encountered, partial results might be returned if warnings are present in the response. items: $ref: "#/components/schemas/SpansWarning" type: array type: object SpansMetricCompute: description: The compute rule to compute the span-based metric. properties: aggregation_type: $ref: "#/components/schemas/SpansMetricComputeAggregationType" include_percentiles: $ref: "#/components/schemas/SpansMetricComputeIncludePercentiles" path: description: The path to the value the span-based metric will aggregate on (only used if the aggregation type is a "distribution"). example: "@duration" type: string required: - aggregation_type type: object SpansMetricComputeAggregationType: description: The type of aggregation to use. enum: ["count", "distribution"] example: "distribution" type: string x-enum-varnames: ["COUNT", "DISTRIBUTION"] SpansMetricComputeIncludePercentiles: description: |- Toggle to include or exclude percentile aggregations for distribution metrics. Only present when the `aggregation_type` is `distribution`. example: false type: boolean SpansMetricCreateAttributes: description: The object describing the Datadog span-based metric to create. properties: compute: $ref: "#/components/schemas/SpansMetricCompute" filter: $ref: "#/components/schemas/SpansMetricFilter" group_by: description: The rules for the group by. items: $ref: "#/components/schemas/SpansMetricGroupBy" type: array required: - compute type: object SpansMetricCreateData: description: The new span-based metric properties. properties: attributes: $ref: "#/components/schemas/SpansMetricCreateAttributes" id: $ref: "#/components/schemas/SpansMetricID" type: $ref: "#/components/schemas/SpansMetricType" required: - id - type - attributes type: object SpansMetricCreateRequest: description: The new span-based metric body. properties: data: $ref: "#/components/schemas/SpansMetricCreateData" required: - data type: object SpansMetricFilter: description: The span-based metric filter. Spans matching this filter will be aggregated in this metric. properties: query: default: "*" description: The search query - following the span search syntax. example: "@http.status_code:200 service:my-service" type: string type: object SpansMetricGroupBy: description: A group by rule. properties: path: description: The path to the value the span-based metric will be aggregated over. example: "resource_name" type: string tag_name: description: Eventual name of the tag that gets created. By default, the path attribute is used as the tag name. example: "resource_name" type: string required: - path type: object SpansMetricID: description: The name of the span-based metric. example: "my.metric" type: string SpansMetricResponse: description: The span-based metric object. properties: data: $ref: "#/components/schemas/SpansMetricResponseData" type: object SpansMetricResponseAttributes: description: The object describing a Datadog span-based metric. properties: compute: $ref: "#/components/schemas/SpansMetricResponseCompute" filter: $ref: "#/components/schemas/SpansMetricResponseFilter" group_by: description: The rules for the group by. items: $ref: "#/components/schemas/SpansMetricResponseGroupBy" type: array type: object SpansMetricResponseCompute: description: The compute rule to compute the span-based metric. properties: aggregation_type: $ref: "#/components/schemas/SpansMetricComputeAggregationType" include_percentiles: $ref: "#/components/schemas/SpansMetricComputeIncludePercentiles" path: description: The path to the value the span-based metric will aggregate on (only used if the aggregation type is a "distribution"). example: "@duration" type: string type: object SpansMetricResponseData: description: The span-based metric properties. properties: attributes: $ref: "#/components/schemas/SpansMetricResponseAttributes" id: $ref: "#/components/schemas/SpansMetricID" type: $ref: "#/components/schemas/SpansMetricType" type: object SpansMetricResponseFilter: description: The span-based metric filter. Spans matching this filter will be aggregated in this metric. properties: query: description: The search query - following the span search syntax. example: "@http.status_code:200 service:my-service" type: string type: object SpansMetricResponseGroupBy: description: A group by rule. properties: path: description: The path to the value the span-based metric will be aggregated over. example: "resource_name" type: string tag_name: description: Eventual name of the tag that gets created. By default, the path attribute is used as the tag name. example: "resource_name" type: string type: object SpansMetricType: default: spans_metrics description: The type of resource. The value should always be spans_metrics. enum: - spans_metrics example: spans_metrics type: string x-enum-varnames: ["SPANS_METRICS"] SpansMetricUpdateAttributes: description: The span-based metric properties that will be updated. properties: compute: $ref: "#/components/schemas/SpansMetricUpdateCompute" filter: $ref: "#/components/schemas/SpansMetricFilter" group_by: description: The rules for the group by. items: $ref: "#/components/schemas/SpansMetricGroupBy" type: array type: object SpansMetricUpdateCompute: description: The compute rule to compute the span-based metric. properties: include_percentiles: $ref: "#/components/schemas/SpansMetricComputeIncludePercentiles" type: object SpansMetricUpdateData: description: The new span-based metric properties. properties: attributes: $ref: "#/components/schemas/SpansMetricUpdateAttributes" type: $ref: "#/components/schemas/SpansMetricType" required: - type - attributes type: object SpansMetricUpdateRequest: description: The new span-based metric body. properties: data: $ref: "#/components/schemas/SpansMetricUpdateData" required: - data type: object SpansMetricsResponse: description: All the available span-based metric objects. properties: data: description: A list of span-based metric objects. items: $ref: "#/components/schemas/SpansMetricResponseData" type: array type: object SpansQueryFilter: description: The search and filter query settings. properties: from: default: "now-15m" description: The minimum time for the requested spans, supports date-time ISO8601, date math, and regular timestamps (milliseconds). example: "now-15m" type: string query: default: "*" description: The search query - following the span search syntax. example: "service:web* AND @http.status_code:[200 TO 299]" type: string to: default: "now" description: The maximum time for the requested spans, supports date-time ISO8601, date math, and regular timestamps (milliseconds). example: "now" type: string type: object SpansQueryOptions: description: |- Global query options that are used during the query. Note: You should only supply timezone or time offset but not both otherwise the query will fail. properties: timeOffset: description: The time offset (in seconds) to apply to the query. format: int64 type: integer timezone: default: "UTC" description: |- The timezone can be specified as GMT, UTC, an offset from UTC (like UTC+1), or as a Timezone Database identifier (like America/New_York). example: "GMT" type: string type: object SpansResponseMetadataPage: description: Paging attributes. properties: after: description: |- The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of the `page[cursor]`. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" type: string type: object SpansSort: description: Sort parameters when querying spans. enum: - timestamp - -timestamp type: string x-enum-varnames: - TIMESTAMP_ASCENDING - TIMESTAMP_DESCENDING SpansSortOrder: description: The order to use, ascending or descending. enum: - "asc" - "desc" example: "asc" type: string x-enum-varnames: - "ASCENDING" - "DESCENDING" SpansType: default: spans description: Type of the span. enum: - spans example: "spans" type: string x-enum-varnames: - SPANS SpansWarning: description: A warning message indicating something that went wrong with the query. properties: code: description: A unique code for this type of warning. example: "unknown_index" type: string detail: description: A detailed explanation of this specific warning. example: "indexes: foo, bar" type: string title: description: A short human-readable summary of the warning. example: "One or several indexes are missing or invalid, results hold data from the other indexes" type: string type: object Spec: description: A complete Workflow Automation definition, including its triggers, steps, and connections. properties: annotations: description: Up to 100 text annotations displayed on the workflow canvas. items: $ref: "#/components/schemas/Annotation" maxItems: 100 type: array connectionEnvs: description: A list of connections or connection groups used in the workflow. items: $ref: "#/components/schemas/ConnectionEnv" type: array handle: description: Unique identifier used to trigger workflows automatically in Datadog. type: string inputSchema: $ref: "#/components/schemas/InputSchema" outputSchema: $ref: "#/components/schemas/OutputSchema" steps: description: A `Step` is a sub-component of a workflow. Each `Step` performs an action. items: $ref: "#/components/schemas/Step" type: array triggers: description: The list of triggers that activate this workflow. At least one trigger is required, and each trigger type may appear at most once. items: $ref: "#/components/schemas/Trigger" type: array type: object SpecVersion: description: The version of the CycloneDX specification a BOM conforms to. enum: - "1.0" - "1.1" - "1.2" - "1.3" - "1.4" - "1.5" - "1.6" example: "1.6" type: string x-enum-varnames: - ONE_ZERO - ONE_ONE - ONE_TWO - ONE_THREE - ONE_FOUR - ONE_FIVE - ONE_SIX SplitAPIKey: description: The definition of the `SplitAPIKey` object. properties: api_key: $ref: "#/components/schemas/SplitAPIKeyApiKey" type: $ref: "#/components/schemas/SplitAPIKeyType" required: - type - api_key type: object SplitAPIKeyApiKey: description: The `SplitAPIKey` `api_key`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" SplitAPIKeyType: description: The definition of the `SplitAPIKey` object. enum: - SplitAPIKey example: SplitAPIKey type: string x-enum-varnames: - SPLITAPIKEY SplitAPIKeyUpdate: description: The definition of the `SplitAPIKey` object. properties: api_key: $ref: "#/components/schemas/SplitAPIKeyUpdateApiKey" type: $ref: "#/components/schemas/SplitAPIKeyType" required: - type type: object SplitAPIKeyUpdateApiKey: description: The `SplitAPIKeyUpdate` `api_key`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" SplitCredentials: description: The definition of the `SplitCredentials` object. oneOf: - $ref: "#/components/schemas/SplitAPIKey" SplitCredentialsUpdate: description: The definition of the `SplitCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/SplitAPIKeyUpdate" SplitIntegration: description: The definition of the `SplitIntegration` object. properties: credentials: $ref: "#/components/schemas/SplitCredentials" type: $ref: "#/components/schemas/SplitIntegrationType" required: - type - credentials type: object SplitIntegrationType: description: The definition of the `SplitIntegrationType` object. enum: - Split example: Split type: string x-enum-varnames: - SPLIT SplitIntegrationUpdate: description: The definition of the `SplitIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/SplitCredentialsUpdate" type: $ref: "#/components/schemas/SplitIntegrationType" required: - type type: object StartStepNames: description: "Names of existing workflow steps that run first after a trigger fires." example: - "" items: description: The `StartStepNames` `items`. minLength: 1 type: string type: array State: description: The state of the rule evaluation. enum: [pass, fail, skip] example: pass type: string x-enum-varnames: [PASS, FAIL, SKIP] StateVariable: description: A variable, which can be set and read by other components in the app. properties: id: description: The ID of the state variable. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string name: description: A unique identifier for this state variable. This name is also used to access the variable's value throughout the app. example: "ordersToSubmit" type: string properties: $ref: "#/components/schemas/StateVariableProperties" type: $ref: "#/components/schemas/StateVariableType" required: - id - name - type - properties type: object StateVariableProperties: description: The properties of the state variable. properties: defaultValue: description: The default value of the state variable. example: "${['order_3145', 'order_4920']}" type: object StateVariableType: default: stateVariable description: The state variable type. enum: - stateVariable example: stateVariable type: string x-enum-varnames: - STATEVARIABLE StatsigAPIKey: description: The definition of the `StatsigAPIKey` object. properties: api_key: $ref: "#/components/schemas/StatsigAPIKeyApiKey" type: $ref: "#/components/schemas/StatsigAPIKeyType" required: - type - api_key type: object StatsigAPIKeyApiKey: description: The `StatsigAPIKey` `api_key`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" StatsigAPIKeyType: description: The definition of the `StatsigAPIKey` object. enum: - StatsigAPIKey example: StatsigAPIKey type: string x-enum-varnames: - STATSIGAPIKEY StatsigAPIKeyUpdate: description: The definition of the `StatsigAPIKey` object. properties: api_key: $ref: "#/components/schemas/StatsigAPIKeyUpdateApiKey" type: $ref: "#/components/schemas/StatsigAPIKeyType" required: - type type: object StatsigAPIKeyUpdateApiKey: description: The `StatsigAPIKeyUpdate` `api_key`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" StatsigCredentials: description: The definition of the `StatsigCredentials` object. oneOf: - $ref: "#/components/schemas/StatsigAPIKey" StatsigCredentialsUpdate: description: The definition of the `StatsigCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/StatsigAPIKeyUpdate" StatsigIntegration: description: The definition of the `StatsigIntegration` object. properties: credentials: $ref: "#/components/schemas/StatsigCredentials" type: $ref: "#/components/schemas/StatsigIntegrationType" required: - type - credentials type: object StatsigIntegrationType: description: The definition of the `StatsigIntegrationType` object. enum: - Statsig example: Statsig type: string x-enum-varnames: - STATSIG StatsigIntegrationUpdate: description: The definition of the `StatsigIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/StatsigCredentialsUpdate" type: $ref: "#/components/schemas/StatsigIntegrationType" required: - type type: object StatusPage: description: Response object for a single status page. properties: data: $ref: "#/components/schemas/StatusPageData" included: description: The included related resources of a status page. Client must explicitly request these resources by name in the `include` query parameter. items: $ref: "#/components/schemas/StatusPageArrayIncluded" type: array type: object StatusPageArray: description: Response object for a list of status pages. properties: data: description: A list of status page data objects. items: $ref: "#/components/schemas/StatusPageData" type: array included: description: The included related resources of a status page. Client must explicitly request these resources by name in the `include` query parameter. items: $ref: "#/components/schemas/StatusPageArrayIncluded" type: array meta: $ref: "#/components/schemas/PaginationMeta" required: - data type: object StatusPageArrayIncluded: description: An included resource related to a status page. oneOf: - $ref: "#/components/schemas/StatusPagesUser" StatusPageAsIncluded: description: The included status page resource. properties: attributes: $ref: "#/components/schemas/StatusPageAsIncludedAttributes" id: description: The ID of the status page. format: uuid type: string relationships: $ref: "#/components/schemas/StatusPageAsIncludedRelationships" type: $ref: "#/components/schemas/StatusPageDataType" required: - type type: object StatusPageAsIncludedAttributes: description: The attributes of a status page. properties: company_logo: description: The base64-encoded image data displayed in the company logo. type: string components: description: Components displayed on the status page. items: $ref: "#/components/schemas/StatusPageAsIncludedAttributesComponentsItems" type: array created_at: description: Timestamp of when the status page was created. format: date-time type: string custom_domain: description: If configured, the url that the status page is accessible at. type: string custom_domain_enabled: description: Whether the custom domain is configured. type: boolean domain_prefix: description: The subdomain of the status page's url taking the form `https://{domain_prefix}.statuspage.datadoghq.com`. Globally unique across Datadog Status Pages. type: string email_header_image: description: Base64-encoded image data included in email notifications sent to status page subscribers. type: string enabled: description: Whether the status page is enabled. type: boolean favicon: description: Base64-encoded image data displayed in the browser tab. type: string modified_at: description: Timestamp of when the status page was last modified. format: date-time type: string name: description: The name of the status page. type: string page_url: description: The url that the status page is accessible at. type: string rss_feed_enabled: description: Whether the RSS feed is enabled for the status page. type: boolean slack_app_icon: description: The Slack app icon URL for the status page. type: string slack_subscriptions_enabled: description: Whether Slack subscriptions are enabled for the status page. type: boolean subscriptions_enabled: description: Whether users can subscribe to the status page. type: boolean type: $ref: "#/components/schemas/CreateStatusPageRequestDataAttributesType" visualization_layout: $ref: "#/components/schemas/CreateStatusPageRequestDataAttributesVisualizationLayout" visualization_type: $ref: "#/components/schemas/CreateStatusPageRequestDataAttributesVisualizationType" type: object StatusPageAsIncludedAttributesComponentsItems: description: A component displayed on an included status page. properties: components: description: If the component is of type `group`, the components within the group. items: $ref: "#/components/schemas/StatusPageAsIncludedAttributesComponentsItemsComponentsItems" type: array id: description: The ID of the component. format: uuid readOnly: true type: string name: description: The name of the component. type: string position: description: The zero-indexed position of the component. format: int64 type: integer status: $ref: "#/components/schemas/StatusPagesComponentGroupAttributesComponentsItemsStatus" type: $ref: "#/components/schemas/CreateComponentRequestDataAttributesType" type: object StatusPageAsIncludedAttributesComponentsItemsComponentsItems: description: A grouped component within a status page component group. properties: id: description: The ID of the grouped component. format: uuid readOnly: true type: string name: description: The name of the grouped component. type: string position: description: The zero-indexed position of the grouped component. Relative to the other components in the group. format: int64 type: integer status: $ref: "#/components/schemas/StatusPagesComponentGroupAttributesComponentsItemsStatus" type: $ref: "#/components/schemas/StatusPagesComponentGroupAttributesComponentsItemsType" type: object StatusPageAsIncludedRelationships: description: The relationships of a status page. properties: created_by_user: $ref: "#/components/schemas/StatusPageAsIncludedRelationshipsCreatedByUser" description: The Datadog user who created the status page. last_modified_by_user: $ref: "#/components/schemas/StatusPageAsIncludedRelationshipsLastModifiedByUser" description: The Datadog user who last modified the status page. type: object StatusPageAsIncludedRelationshipsCreatedByUser: description: The Datadog user who created the status page. properties: data: $ref: "#/components/schemas/StatusPageAsIncludedRelationshipsCreatedByUserData" required: - data type: object StatusPageAsIncludedRelationshipsCreatedByUserData: description: The data object identifying the Datadog user who created the status page. properties: id: description: The ID of the Datadog user who created the status page. example: "" type: string type: $ref: "#/components/schemas/StatusPagesUserType" required: - type - id type: object StatusPageAsIncludedRelationshipsLastModifiedByUser: description: The Datadog user who last modified the status page. properties: data: $ref: "#/components/schemas/StatusPageAsIncludedRelationshipsLastModifiedByUserData" required: - data type: object StatusPageAsIncludedRelationshipsLastModifiedByUserData: description: The data object identifying the Datadog user who last modified the status page. properties: id: description: The ID of the Datadog user who last modified the status page. example: "" type: string type: $ref: "#/components/schemas/StatusPagesUserType" required: - type - id type: object StatusPageData: description: The data object for a status page. properties: attributes: $ref: "#/components/schemas/StatusPageDataAttributes" id: description: The ID of the status page. format: uuid type: string relationships: $ref: "#/components/schemas/StatusPageDataRelationships" type: $ref: "#/components/schemas/StatusPageDataType" required: - type type: object StatusPageDataAttributes: description: The attributes of a status page. properties: company_logo: description: Base64-encoded image data displayed on the status page. nullable: true type: string components: description: Components displayed on the status page. items: $ref: "#/components/schemas/StatusPageDataAttributesComponentsItems" type: array created_at: description: Timestamp of when the status page was created. format: date-time type: string custom_domain: description: If configured, the url that the status page is accessible at. nullable: true type: string custom_domain_enabled: description: Whether the custom domain is configured. type: boolean domain_prefix: description: The subdomain of the status page's url taking the form `https://{domain_prefix}.statuspage.datadoghq.com`. Globally unique across Datadog Status Pages. type: string email_header_image: description: Base64-encoded image data included in email notifications sent to status page subscribers. nullable: true type: string enabled: description: Whether the status page is enabled. type: boolean favicon: description: Base64-encoded image data displayed in the browser tab. nullable: true type: string modified_at: description: Timestamp of when the status page was last modified. format: date-time type: string name: description: The name of the status page. type: string page_url: description: The url that the status page is accessible at. type: string rss_feed_enabled: description: Whether the RSS feed is enabled for the status page. type: boolean slack_app_icon: description: The Slack app icon URL for the status page. type: string slack_subscriptions_enabled: description: Whether Slack subscriptions are enabled for the status page. type: boolean subscriptions_enabled: description: Whether users can subscribe to the status page. type: boolean type: $ref: "#/components/schemas/CreateStatusPageRequestDataAttributesType" visualization_layout: $ref: "#/components/schemas/CreateStatusPageRequestDataAttributesVisualizationLayout" visualization_type: $ref: "#/components/schemas/CreateStatusPageRequestDataAttributesVisualizationType" type: object StatusPageDataAttributesComponentsItems: description: A component displayed on a status page. properties: components: description: If the component is of type `group`, the components within the group. items: $ref: "#/components/schemas/StatusPageDataAttributesComponentsItemsComponentsItems" type: array id: description: The ID of the component. format: uuid type: string name: description: The name of the component. type: string position: description: The zero-indexed position of the component. format: int64 type: integer status: $ref: "#/components/schemas/StatusPagesComponentGroupAttributesComponentsItemsStatus" type: $ref: "#/components/schemas/CreateComponentRequestDataAttributesType" type: object StatusPageDataAttributesComponentsItemsComponentsItems: description: A grouped component within a status page component group. properties: id: description: The ID of the component. format: uuid type: string name: description: The name of the component. type: string position: description: The zero-indexed position of the component. Relative to the other components in the group. format: int64 type: integer status: $ref: "#/components/schemas/StatusPagesComponentGroupAttributesComponentsItemsStatus" type: $ref: "#/components/schemas/StatusPagesComponentGroupAttributesComponentsItemsType" type: object StatusPageDataRelationships: description: The relationships of a status page. properties: created_by_user: $ref: "#/components/schemas/StatusPageDataRelationshipsCreatedByUser" description: The Datadog user who created the status page. last_modified_by_user: $ref: "#/components/schemas/StatusPageDataRelationshipsLastModifiedByUser" description: The Datadog user who last modified the status page. type: object StatusPageDataRelationshipsCreatedByUser: description: The Datadog user who created the status page. properties: data: $ref: "#/components/schemas/StatusPageDataRelationshipsCreatedByUserData" required: - data type: object StatusPageDataRelationshipsCreatedByUserData: description: The data object identifying the Datadog user who created the status page. properties: id: description: The ID of the Datadog user who created the status page. example: "" type: string type: $ref: "#/components/schemas/StatusPagesUserType" required: - type - id type: object StatusPageDataRelationshipsLastModifiedByUser: description: The Datadog user who last modified the status page. properties: data: $ref: "#/components/schemas/StatusPageDataRelationshipsLastModifiedByUserData" required: - data type: object StatusPageDataRelationshipsLastModifiedByUserData: description: The data object identifying the Datadog user who last modified the status page. properties: id: description: The ID of the Datadog user who last modified the status page. example: "" type: string type: $ref: "#/components/schemas/StatusPagesUserType" required: - type - id type: object StatusPageDataType: default: status_pages description: Status pages resource type. enum: - status_pages example: status_pages type: string x-enum-varnames: - STATUS_PAGES StatusPagesComponent: description: Response object for a single component. properties: data: $ref: "#/components/schemas/StatusPagesComponentData" included: description: The included related resources of a component. Client must explicitly request these resources by name in the `include` query parameter. items: $ref: "#/components/schemas/StatusPagesComponentArrayIncluded" type: array type: object StatusPagesComponentArray: description: Response object for a list of components. properties: data: description: A list of component data objects. items: $ref: "#/components/schemas/StatusPagesComponentData" type: array included: description: The included related resources of a component. Client must explicitly request these resources by name in the `include` query parameter. items: $ref: "#/components/schemas/StatusPagesComponentArrayIncluded" type: array required: - data type: object StatusPagesComponentArrayIncluded: description: An included resource related to a component. oneOf: - $ref: "#/components/schemas/StatusPagesUser" - $ref: "#/components/schemas/StatusPageAsIncluded" - $ref: "#/components/schemas/StatusPagesComponentGroup" StatusPagesComponentData: description: The data object for a component. properties: attributes: $ref: "#/components/schemas/StatusPagesComponentDataAttributes" id: description: The ID of the component. format: uuid type: string relationships: $ref: "#/components/schemas/StatusPagesComponentDataRelationships" type: $ref: "#/components/schemas/StatusPagesComponentGroupType" required: - type type: object StatusPagesComponentDataAttributes: description: The attributes of a component. properties: components: description: If the component is of type `group`, the components within the group. items: $ref: "#/components/schemas/StatusPagesComponentDataAttributesComponentsItems" type: array created_at: description: Timestamp of when the component was created. format: date-time type: string modified_at: description: Timestamp of when the component was last modified. format: date-time type: string name: description: The name of the component. type: string position: description: The zero-indexed position of the component. format: int64 type: integer status: $ref: "#/components/schemas/StatusPagesComponentDataAttributesStatus" type: $ref: "#/components/schemas/CreateComponentRequestDataAttributesType" required: - type type: object StatusPagesComponentDataAttributesComponentsItems: description: A component within a component group. properties: id: description: The ID of the component within the group. format: uuid readOnly: true type: string name: description: The name of the component within the group. type: string position: description: The zero-indexed position of the component within the group. format: int64 type: integer status: $ref: "#/components/schemas/StatusPagesComponentGroupAttributesComponentsItemsStatus" type: $ref: "#/components/schemas/StatusPagesComponentGroupAttributesComponentsItemsType" type: object StatusPagesComponentDataAttributesStatus: description: The status of the component. enum: - operational - degraded - partial_outage - major_outage - maintenance example: operational type: string x-enum-varnames: - OPERATIONAL - DEGRADED - PARTIAL_OUTAGE - MAJOR_OUTAGE - MAINTENANCE StatusPagesComponentDataRelationships: description: The relationships of a component. properties: created_by_user: $ref: "#/components/schemas/StatusPagesComponentDataRelationshipsCreatedByUser" description: The Datadog user who created the component. group: $ref: "#/components/schemas/StatusPagesComponentDataRelationshipsGroup" description: The group the component belongs to. last_modified_by_user: $ref: "#/components/schemas/StatusPagesComponentDataRelationshipsLastModifiedByUser" description: The Datadog user who last modified the component. status_page: $ref: "#/components/schemas/StatusPagesComponentDataRelationshipsStatusPage" description: The status page the component belongs to. type: object StatusPagesComponentDataRelationshipsCreatedByUser: description: The Datadog user who created the component. properties: data: $ref: "#/components/schemas/StatusPagesComponentDataRelationshipsCreatedByUserData" required: - data type: object StatusPagesComponentDataRelationshipsCreatedByUserData: description: The data object identifying the Datadog user who created the component. properties: id: description: The ID of the Datadog user who created the component. example: "" type: string type: $ref: "#/components/schemas/StatusPagesUserType" required: - type - id type: object StatusPagesComponentDataRelationshipsGroup: description: The group the component belongs to. properties: data: $ref: "#/components/schemas/StatusPagesComponentDataRelationshipsGroupData" required: - data type: object StatusPagesComponentDataRelationshipsGroupData: description: The data object identifying the group the component belongs to. nullable: true properties: id: description: The ID of the group the component belongs to. example: "1234abcd-12ab-34cd-56ef-123456abcdef" format: uuid type: string type: $ref: "#/components/schemas/StatusPagesComponentGroupType" required: - type - id type: object StatusPagesComponentDataRelationshipsLastModifiedByUser: description: The Datadog user who last modified the component. properties: data: $ref: "#/components/schemas/StatusPagesComponentDataRelationshipsLastModifiedByUserData" required: - data type: object StatusPagesComponentDataRelationshipsLastModifiedByUserData: description: The data object identifying the Datadog user who last modified the component. properties: id: description: The ID of the Datadog user who last modified the component. example: "" type: string type: $ref: "#/components/schemas/StatusPagesUserType" required: - type - id type: object StatusPagesComponentDataRelationshipsStatusPage: description: The status page the component belongs to. properties: data: $ref: "#/components/schemas/StatusPagesComponentDataRelationshipsStatusPageData" required: - data type: object StatusPagesComponentDataRelationshipsStatusPageData: description: The data object identifying the status page the component belongs to. properties: id: description: The ID of the status page the component belongs to. example: "1234abcd-12ab-34cd-56ef-123456abcdef" format: uuid type: string type: $ref: "#/components/schemas/StatusPageDataType" required: - type - id type: object StatusPagesComponentGroup: description: The included component group resource. properties: attributes: $ref: "#/components/schemas/StatusPagesComponentGroupAttributes" id: description: The ID of the component. format: uuid type: string relationships: $ref: "#/components/schemas/StatusPagesComponentGroupRelationships" type: $ref: "#/components/schemas/StatusPagesComponentGroupType" required: - type type: object StatusPagesComponentGroupAttributes: description: The attributes of a component group. properties: components: description: If the component is of type `group`, the components within the group. items: $ref: "#/components/schemas/StatusPagesComponentGroupAttributesComponentsItems" type: array created_at: description: Timestamp of when the component was created. format: date-time type: string modified_at: description: Timestamp of when the component was last modified. format: date-time type: string name: description: The name of the component. type: string position: description: The zero-indexed position of the component. format: int64 type: integer status: $ref: "#/components/schemas/StatusPagesComponentDataAttributesStatus" type: $ref: "#/components/schemas/CreateComponentRequestDataAttributesType" required: - type type: object StatusPagesComponentGroupAttributesComponentsItems: description: A component within a component group. properties: id: description: The ID of the grouped component. format: uuid readOnly: true type: string name: description: The name of the grouped component. type: string position: description: The zero-indexed position of the grouped component. Relative to the other components in the group. format: int64 type: integer status: $ref: "#/components/schemas/StatusPagesComponentGroupAttributesComponentsItemsStatus" type: $ref: "#/components/schemas/StatusPagesComponentGroupAttributesComponentsItemsType" type: object StatusPagesComponentGroupAttributesComponentsItemsStatus: description: The status of the component. enum: - operational - degraded - partial_outage - major_outage - maintenance readOnly: true type: string x-enum-varnames: - OPERATIONAL - DEGRADED - PARTIAL_OUTAGE - MAJOR_OUTAGE - MAINTENANCE StatusPagesComponentGroupAttributesComponentsItemsType: description: The type of the component. enum: - component example: component type: string x-enum-varnames: - COMPONENT StatusPagesComponentGroupRelationships: description: The relationships of a component group. properties: created_by_user: $ref: "#/components/schemas/StatusPagesComponentGroupRelationshipsCreatedByUser" group: $ref: "#/components/schemas/StatusPagesComponentGroupRelationshipsGroup" last_modified_by_user: $ref: "#/components/schemas/StatusPagesComponentGroupRelationshipsLastModifiedByUser" status_page: $ref: "#/components/schemas/StatusPagesComponentGroupRelationshipsStatusPage" type: object StatusPagesComponentGroupRelationshipsCreatedByUser: description: The Datadog user who created the component group. properties: data: $ref: "#/components/schemas/StatusPagesComponentGroupRelationshipsCreatedByUserData" required: - data type: object StatusPagesComponentGroupRelationshipsCreatedByUserData: description: The data object identifying the Datadog user who created the component group. properties: id: description: The ID of the Datadog user who created the component group. example: "" type: string type: $ref: "#/components/schemas/StatusPagesUserType" required: - type - id type: object StatusPagesComponentGroupRelationshipsGroup: description: The group the component group belongs to. properties: data: $ref: "#/components/schemas/StatusPagesComponentGroupRelationshipsGroupData" required: - data type: object StatusPagesComponentGroupRelationshipsGroupData: description: The data object identifying the parent group of a component group. nullable: true properties: id: description: The ID of the parent group. example: "1234abcd-12ab-34cd-56ef-123456abcdef" format: uuid type: string type: $ref: "#/components/schemas/StatusPagesComponentGroupType" required: - type - id type: object StatusPagesComponentGroupRelationshipsLastModifiedByUser: description: The Datadog user who last modified the component group. properties: data: $ref: "#/components/schemas/StatusPagesComponentGroupRelationshipsLastModifiedByUserData" required: - data type: object StatusPagesComponentGroupRelationshipsLastModifiedByUserData: description: The data object identifying the Datadog user who last modified the component group. properties: id: description: The ID of the Datadog user who last modified the component group. example: "" type: string type: $ref: "#/components/schemas/StatusPagesUserType" required: - type - id type: object StatusPagesComponentGroupRelationshipsStatusPage: description: The status page the component group belongs to. properties: data: $ref: "#/components/schemas/StatusPagesComponentGroupRelationshipsStatusPageData" required: - data type: object StatusPagesComponentGroupRelationshipsStatusPageData: description: The data object identifying the status page the component group belongs to. properties: id: description: The ID of the status page. example: "1234abcd-12ab-34cd-56ef-123456abcdef" format: uuid type: string type: $ref: "#/components/schemas/StatusPageDataType" required: - type - id type: object StatusPagesComponentGroupType: default: components description: Components resource type. enum: - components example: components type: string x-enum-varnames: - COMPONENTS StatusPagesUser: description: The included Datadog user resource. properties: attributes: $ref: "#/components/schemas/StatusPagesUserAttributes" id: description: The ID of the Datadog user. format: uuid type: string type: $ref: "#/components/schemas/StatusPagesUserType" required: - type type: object StatusPagesUserAttributes: description: Attributes of the Datadog user. properties: email: description: The email of the Datadog user. type: string handle: description: The handle of the Datadog user. type: string icon: description: The icon of the Datadog user. type: string name: description: The name of the Datadog user. type: string uuid: description: The UUID of the Datadog user. type: string type: object StatusPagesUserType: default: users description: Users resource type. enum: - users example: users type: string x-enum-varnames: - USERS StatuspageAccountCreateAttributes: description: The Statuspage account attributes for a create request. properties: api_key: description: The Statuspage API key for your Statuspage account. example: "00000000-0000-0000-0000-000000000000" minLength: 1 type: string required: - api_key type: object StatuspageAccountCreateData: description: Statuspage account data for a create request. properties: attributes: $ref: "#/components/schemas/StatuspageAccountCreateAttributes" type: $ref: "#/components/schemas/StatuspageAccountType" required: - type - attributes type: object StatuspageAccountCreateRequest: description: Create request for a Statuspage account. properties: data: $ref: "#/components/schemas/StatuspageAccountCreateData" required: - data type: object StatuspageAccountResponse: description: Response containing a Statuspage account. properties: data: $ref: "#/components/schemas/StatuspageAccountResponseData" required: - data type: object StatuspageAccountResponseAttributes: description: The attributes from a Statuspage account response. properties: api_key: description: The Statuspage API key for your Statuspage account. The value is always returned masked. example: "*****" type: string type: object StatuspageAccountResponseData: description: Statuspage account data from a response. properties: attributes: $ref: "#/components/schemas/StatuspageAccountResponseAttributes" type: $ref: "#/components/schemas/StatuspageAccountType" required: - type - attributes type: object StatuspageAccountType: default: statuspage-account description: Statuspage account resource type. enum: - statuspage-account example: statuspage-account type: string x-enum-varnames: - STATUSPAGE_ACCOUNT StatuspageAccountUpdateAttributes: description: The Statuspage account attributes for an update request. properties: api_key: description: The Statuspage API key for your Statuspage account. example: "00000000-0000-0000-0000-000000000000" minLength: 1 type: string type: object StatuspageAccountUpdateData: description: Statuspage account data for an update request. properties: attributes: $ref: "#/components/schemas/StatuspageAccountUpdateAttributes" type: $ref: "#/components/schemas/StatuspageAccountType" required: - type - attributes type: object StatuspageAccountUpdateRequest: description: Update request for a Statuspage account. properties: data: $ref: "#/components/schemas/StatuspageAccountUpdateData" required: - data type: object StatuspageUrlSettingCreateAttributes: description: The Statuspage URL setting attributes for a create request. properties: custom_tags: description: Comma-separated list of custom tags to apply to events generated from this Statuspage URL. example: "team:collaboration-integrations,env:prod" minLength: 1 type: string url: description: The Statuspage URL to monitor. Must be a `status.io` or `statuspage.com` URL. example: "https://example.statuspage.io" minLength: 1 type: string required: - url - custom_tags type: object StatuspageUrlSettingCreateData: description: Statuspage URL setting data for a create request. properties: attributes: $ref: "#/components/schemas/StatuspageUrlSettingCreateAttributes" type: $ref: "#/components/schemas/StatuspageUrlSettingType" required: - type - attributes type: object StatuspageUrlSettingCreateRequest: description: Create request for a Statuspage URL setting. properties: data: $ref: "#/components/schemas/StatuspageUrlSettingCreateData" required: - data type: object StatuspageUrlSettingResponse: description: Response containing a Statuspage URL setting. properties: data: $ref: "#/components/schemas/StatuspageUrlSettingResponseData" required: - data type: object StatuspageUrlSettingResponseAttributes: description: The attributes from a Statuspage URL setting response. properties: custom_tags: description: Comma-separated list of custom tags applied to events generated from this Statuspage URL. example: "team:collaboration-integrations,env:prod" type: string url: description: The Statuspage URL being monitored. example: "https://example.statuspage.io" type: string type: object StatuspageUrlSettingResponseData: description: Statuspage URL setting data from a response. properties: attributes: $ref: "#/components/schemas/StatuspageUrlSettingResponseAttributes" id: description: The ID of the Statuspage URL setting. example: "596da4af-0563-4097-90ff-07230c3f9db3" maxLength: 100 minLength: 1 type: string type: $ref: "#/components/schemas/StatuspageUrlSettingType" required: - id - type - attributes type: object StatuspageUrlSettingType: default: statuspage-url-setting description: Statuspage URL setting resource type. enum: - statuspage-url-setting example: statuspage-url-setting type: string x-enum-varnames: - STATUSPAGE_URL_SETTING StatuspageUrlSettingUpdateAttributes: description: The Statuspage URL setting attributes for an update request. properties: custom_tags: description: Comma-separated list of custom tags to apply to events generated from this Statuspage URL. example: "team:collaboration-integrations,env:prod" minLength: 1 type: string url: description: The Statuspage URL to monitor. example: "https://example.statuspage.io" minLength: 1 type: string type: object StatuspageUrlSettingUpdateData: description: Statuspage URL setting data for an update request. properties: attributes: $ref: "#/components/schemas/StatuspageUrlSettingUpdateAttributes" id: description: The ID of the Statuspage URL setting. example: "596da4af-0563-4097-90ff-07230c3f9db3" maxLength: 100 minLength: 1 type: string type: $ref: "#/components/schemas/StatuspageUrlSettingType" required: - id - type - attributes type: object StatuspageUrlSettingUpdateRequest: description: Update request for a Statuspage URL setting. properties: data: $ref: "#/components/schemas/StatuspageUrlSettingUpdateData" required: - data type: object StatuspageUrlSettingsResponse: description: Response with a list of Statuspage URL settings. properties: data: description: An array of Statuspage URL settings. example: [{"attributes": {"custom_tags": "team:collaboration-integrations", "url": "https://example.statuspage.io"}, "id": "596da4af-0563-4097-90ff-07230c3f9db3", "type": "statuspage-url-setting"}] items: $ref: "#/components/schemas/StatuspageUrlSettingResponseData" type: array required: - data type: object StegadographyGetWidgetsRequest: description: Multipart form data containing the PNG image to scan for watermarks. properties: image: description: PNG image file to scan for embedded watermarks. example: "screenshot.png" format: binary type: string required: - image type: object StegadographyGetWidgetsResponse: description: Response containing watermarked widgets recovered from an image. properties: data: $ref: "#/components/schemas/StegadographyWidgetItems" required: - data type: object StegadographyWidget: description: A single watermarked widget resource recovered from an image. properties: attributes: $ref: "#/components/schemas/StegadographyWidgetAttributes" id: description: Composite identifier formed from the organization ID and watermark, separated by a colon. example: "abc123:0123456789abcdef" type: string type: $ref: "#/components/schemas/StegadographyWidgetType" required: - id - type - attributes type: object StegadographyWidgetAttributes: description: Attributes of a watermarked widget recovered from an image. properties: locationx: description: Horizontal pixel coordinate where the watermark was found in the image. example: 100 format: int64 type: integer locationy: description: Vertical pixel coordinate where the watermark was found in the image. example: 200 format: int64 type: integer rawData: description: JSON-encoded string representing the widget state. example: '{"widgetType":"timeseries","requests":[]}' type: string watermark: description: Hex-encoded watermark string identifying the widget. example: "0123456789abcdef" type: string required: - rawData - watermark - locationx - locationy type: object StegadographyWidgetItems: description: List of watermarked widget resources recovered from an image. example: - attributes: locationx: 100 locationy: 200 rawData: '{"widgetType":"timeseries","requests":[]}' watermark: "0123456789abcdef" id: "abc123:0123456789abcdef" type: widget items: $ref: "#/components/schemas/StegadographyWidget" type: array StegadographyWidgetType: description: Stegadography widget resource type. enum: - widget example: widget type: string x-enum-varnames: - WIDGET Step: description: A Step is a sub-component of a workflow. Each Step performs an action. properties: actionId: description: The unique identifier of an action. example: "" minLength: 1 type: string completionGate: $ref: "#/components/schemas/CompletionGate" connectionLabel: description: The unique identifier of a connection defined in the spec. type: string display: $ref: "#/components/schemas/StepDisplay" errorHandlers: description: The `Step` `errorHandlers`. items: $ref: "#/components/schemas/ErrorHandler" type: array name: description: Name of the step. example: "" minLength: 1 type: string outboundEdges: description: A list of subsequent actions to run. This list is empty for a terminal step. items: $ref: "#/components/schemas/OutboundEdge" type: array parameters: description: A list of inputs for an action. items: $ref: "#/components/schemas/Parameter" type: array readinessGate: $ref: "#/components/schemas/ReadinessGate" required: - name - actionId type: object StepDisplay: description: |- The position of a step on the workflow canvas. Omit `display` from every step to use automatic layout, or provide it for every step to preserve a manual layout. properties: bounds: $ref: "#/components/schemas/StepDisplayBounds" type: object StepDisplayBounds: description: The definition of `StepDisplayBounds` object. properties: x: description: The `bounds` `x`. format: double type: number y: description: The `bounds` `y`. format: double type: number type: object SuiteCreateEdit: description: Data object for creating or editing a Synthetic test suite. properties: attributes: $ref: "#/components/schemas/SyntheticsSuite" type: $ref: "#/components/schemas/SyntheticsSuiteTypes" required: - attributes - type type: object SuiteCreateEditRequest: description: Request body for creating or editing a Synthetic test suite. properties: data: $ref: "#/components/schemas/SuiteCreateEdit" required: - data type: object SuiteJsonPatchRequest: description: JSON Patch request for a Synthetic test suite. properties: data: $ref: "#/components/schemas/SuiteJsonPatchRequestData" required: - data type: object SuiteJsonPatchRequestData: description: Data object for a JSON Patch request on a Synthetic test suite. properties: attributes: $ref: "#/components/schemas/SuiteJsonPatchRequestDataAttributes" type: $ref: "#/components/schemas/SuiteJsonPatchType" type: object SuiteJsonPatchRequestDataAttributes: description: Attributes for a JSON Patch request on a Synthetic test suite. properties: json_patch: description: JSON Patch operations following RFC 6902. items: $ref: "#/components/schemas/JsonPatchOperation" type: array type: object SuiteJsonPatchType: default: suites_json_patch description: Type for a JSON Patch request on a Synthetic test suite, `suites_json_patch`. enum: - suites_json_patch example: suites_json_patch type: string x-enum-varnames: - SUITES_JSON_PATCH SuiteSearchResponseType: default: suites_search description: Type for the Synthetics suites search response, `suites_search`. enum: - suites_search example: suites_search type: string x-enum-varnames: - SUITES_SEARCH SummarizedSpan: description: A node in the pruned trace tree. properties: children: description: The child spans of this node in the pruned tree. example: [] items: $ref: "#/components/schemas/SummarizedSpan" type: array durationSeconds: description: The duration of the span, in seconds. example: 0.5 format: double type: number endTime: description: The end time of the span, in RFC3339 format. example: "2026-05-27T12:00:00.5Z" format: date-time type: string error: $ref: "#/components/schemas/APMSpanErrorFlag" hidden_child_spans_count: description: The number of child spans that were pruned from this node when summarizing the trace. example: 0 format: int32 maximum: 2147483647 type: integer meta: additionalProperties: type: string description: String-valued tags attached to the span. example: env: production type: object metrics: additionalProperties: format: double type: number description: Numeric metrics attached to the span. example: http.status_code: 200 type: object name: description: The operation name of the span. example: web.request type: string parentID: description: The ID of the parent span, or `0` when the span is the trace root. example: 0 format: int64 type: integer resource: description: The resource that the span describes. example: GET /products type: string service: description: The name of the service that emitted the span. example: web-store type: string spanID: description: The span ID, as an unsigned 64-bit integer. example: 9876543210987654321 format: int64 type: integer span_kind: description: |- The OpenTelemetry span kind, for example `INTERNAL`, `SERVER`, `CLIENT`, `PRODUCER`, or `CONSUMER`. example: SERVER type: string startTime: description: The start time of the span, in RFC3339 format. example: "2026-05-27T12:00:00Z" format: date-time type: string required: - service - name - resource - parentID - spanID - startTime - endTime - durationSeconds - error - meta - metrics - span_kind - hidden_child_spans_count - children type: object SummarizedTrace: description: A summarized, hierarchical view of a trace. properties: root: $ref: "#/components/schemas/SummarizedSpan" traceId: description: The full 128-bit trace ID, encoded as a 32-character hexadecimal string. example: "0000000000000000abc1230000000000" type: string required: - traceId - root type: object SuppressionVersionHistory: description: Response object containing the version history of a suppression. properties: count: description: The number of suppression versions. format: int32 maximum: 2147483647 type: integer data: additionalProperties: $ref: "#/components/schemas/SuppressionVersions" description: A suppression version with a list of updates. description: The version history of a suppression. type: object type: object SuppressionVersions: description: A suppression version with a list of updates. properties: changes: description: A list of changes. items: $ref: "#/components/schemas/VersionHistoryUpdate" type: array suppression: $ref: "#/components/schemas/SecurityMonitoringSuppressionAttributes" type: object SyncProperty: description: Sync property configuration. properties: sync_type: description: The direction and type of synchronization for this property. type: string type: object SyncPropertyWithMapping: description: Sync property with mapping configuration. properties: mapping: additionalProperties: type: string description: Map of source values to destination values for synchronization. type: object name_mapping: additionalProperties: type: string description: Map of source names to display names used during synchronization. type: object sync_type: description: The direction and type of synchronization for this property. type: string type: object SyntheticsApiMultistepParentTestAttributes: description: Attributes of a parent API multistep test. properties: child_name: description: The name of the child subtest. example: My API Subtest type: string child_public_id: description: The public ID of the child subtest. example: xyz-uvw-789 type: string monitor_id: description: The associated monitor ID. example: 12345678 format: int64 type: integer name: description: Name of the parent test. example: My Multistep Test type: string overall_state: description: The overall state of the parent test. example: 0 format: int64 type: integer overall_state_modified: description: Timestamp of when the overall state was last modified. example: "2024-01-01T00:00:00+00:00" type: string public_id: description: The public ID of the parent test. example: abc-def-123 type: string type: object SyntheticsApiMultistepParentTestData: description: Data object for a parent API multistep test. properties: attributes: $ref: "#/components/schemas/SyntheticsApiMultistepParentTestAttributes" id: description: The public ID of the parent test. example: abc-def-123 type: string type: $ref: "#/components/schemas/SyntheticsApiMultistepParentTestType" type: object SyntheticsApiMultistepParentTestType: default: parent_test description: Type of the parent test resource. enum: - parent_test example: parent_test type: string x-enum-varnames: - PARENT_TEST SyntheticsApiMultistepParentTestsResponse: description: |- Response containing the list of parent tests for an API multistep subtest. properties: data: description: List of parent tests that include this subtest. items: $ref: "#/components/schemas/SyntheticsApiMultistepParentTestData" type: array type: object SyntheticsApiMultistepSubtestAttributes: description: Attributes of a Synthetic API multistep subtest. properties: name: description: Name of the subtest. example: My API Test type: string public_id: description: The public ID of the subtest. example: abc-def-123 type: string type: object SyntheticsApiMultistepSubtestData: description: Data object for a Synthetic API multistep subtest. properties: attributes: $ref: "#/components/schemas/SyntheticsApiMultistepSubtestAttributes" id: description: The public ID of the subtest. example: abc-def-123 type: string type: $ref: "#/components/schemas/SyntheticsApiMultistepSubtestType" type: object SyntheticsApiMultistepSubtestType: default: subtest description: Type of the subtest resource. enum: - subtest example: subtest type: string x-enum-varnames: - SUBTEST SyntheticsApiMultistepSubtestsResponse: description: |- Response containing the list of available subtests for an API multistep test. properties: data: description: List of API tests that can be added as subtests. items: $ref: "#/components/schemas/SyntheticsApiMultistepSubtestData" type: array type: object SyntheticsDowntimeData: description: A Synthetics downtime object. properties: attributes: $ref: "#/components/schemas/SyntheticsDowntimeDataAttributesResponse" id: description: The unique identifier of the downtime. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/SyntheticsDowntimeResourceType" required: - id - type - attributes type: object SyntheticsDowntimeDataAttributesRequest: description: Attributes for creating or updating a Synthetics downtime. properties: description: description: An optional description of the downtime. example: Scheduled weekly maintenance window. type: string isEnabled: description: Whether the downtime is enabled. example: true type: boolean name: description: The name of the downtime. example: Weekly maintenance type: string tags: $ref: "#/components/schemas/SyntheticsDowntimeTags" testIds: $ref: "#/components/schemas/SyntheticsDowntimeTestIds" timeSlots: $ref: "#/components/schemas/SyntheticsDowntimeTimeSlotRequests" required: - name - isEnabled - timeSlots - testIds type: object SyntheticsDowntimeDataAttributesResponse: description: Attributes of a Synthetics downtime response object. properties: createdAt: description: The timestamp when the downtime was created. example: "2024-01-15T10:30:00Z" format: date-time type: string createdBy: description: The UUID of the user who created the downtime. example: "00000000-0000-0000-0000-000000000003" type: string createdByName: description: The display name of the user who created the downtime. example: Jane Doe type: string description: description: The description of the downtime. example: Scheduled weekly maintenance window. type: string isEnabled: description: Whether the downtime is enabled. example: true type: boolean name: description: The name of the downtime. example: Weekly maintenance type: string tags: $ref: "#/components/schemas/SyntheticsDowntimeTags" testIds: $ref: "#/components/schemas/SyntheticsDowntimeTestIds" timeSlots: $ref: "#/components/schemas/SyntheticsDowntimeTimeSlotResponses" updatedAt: description: The timestamp when the downtime was last updated. example: "2024-01-15T10:30:00Z" format: date-time type: string updatedBy: description: The UUID of the user who last updated the downtime. example: "00000000-0000-0000-0000-000000000003" type: string updatedByName: description: The display name of the user who last updated the downtime. example: Jane Doe type: string required: - name - description - isEnabled - createdBy - createdByName - createdAt - updatedBy - updatedByName - updatedAt - timeSlots - testIds - tags type: object SyntheticsDowntimeDataList: description: List of Synthetics downtime objects. example: - attributes: createdAt: "2024-01-15T10:30:00Z" createdBy: "00000000-0000-0000-0000-000000000003" createdByName: Jane Doe description: Scheduled weekly maintenance window. isEnabled: true name: Weekly maintenance tags: [] testIds: - abc-def-123 timeSlots: - duration: 3600 id: "00000000-0000-0000-0000-000000000002" start: day: 15 hour: 10 minute: 30 month: 1 year: 2024 timezone: Europe/Paris updatedAt: "2024-01-15T10:30:00Z" updatedBy: "00000000-0000-0000-0000-000000000003" updatedByName: Jane Doe id: "00000000-0000-0000-0000-000000000001" type: downtime items: $ref: "#/components/schemas/SyntheticsDowntimeData" type: array SyntheticsDowntimeDataRequest: description: The data object for a Synthetics downtime create or update request. example: attributes: isEnabled: true name: Weekly maintenance testIds: - abc-def-123 timeSlots: - duration: 3600 start: day: 15 hour: 10 minute: 30 month: 1 year: 2024 timezone: Europe/Paris type: downtime properties: attributes: $ref: "#/components/schemas/SyntheticsDowntimeDataAttributesRequest" type: $ref: "#/components/schemas/SyntheticsDowntimeResourceType" required: - type - attributes type: object SyntheticsDowntimeFrequency: description: The recurrence frequency of a Synthetics downtime time slot. enum: - DAILY - WEEKLY - MONTHLY - YEARLY example: WEEKLY type: string x-enum-varnames: - DAILY - WEEKLY - MONTHLY - YEARLY SyntheticsDowntimeRequest: description: Request body for creating or updating a Synthetics downtime. properties: data: $ref: "#/components/schemas/SyntheticsDowntimeDataRequest" required: - data type: object SyntheticsDowntimeResourceType: description: The resource type for a Synthetics downtime. enum: - downtime example: downtime type: string x-enum-varnames: - DOWNTIME SyntheticsDowntimeResponse: description: Response containing a single Synthetics downtime. properties: data: $ref: "#/components/schemas/SyntheticsDowntimeData" required: - data type: object SyntheticsDowntimeTags: description: List of tags associated with a Synthetics downtime. example: - "team:backend" - "env:prod" items: description: A tag. type: string type: array SyntheticsDowntimeTestIds: description: List of Synthetics test public IDs associated with a downtime. example: - abc-def-123 - xyz-uvw-456 items: description: A Synthetics test public ID. type: string type: array SyntheticsDowntimeTimeSlotDate: description: A specific date and time used to define the start or end of a Synthetics downtime time slot. properties: day: description: The day component of the date (1-31). example: 15 format: int64 type: integer hour: description: The hour component of the time (0-23). example: 10 format: int64 type: integer minute: description: The minute component of the time (0-59). example: 30 format: int64 type: integer month: description: The month component of the date (1-12). example: 1 format: int64 type: integer year: description: The year component of the date. example: 2024 format: int64 type: integer required: - year - month - day - hour - minute type: object SyntheticsDowntimeTimeSlotRecurrenceRequest: description: Recurrence settings for a Synthetics downtime time slot. properties: end: $ref: "#/components/schemas/SyntheticsDowntimeTimeSlotDate" frequency: $ref: "#/components/schemas/SyntheticsDowntimeFrequency" interval: description: The interval between recurrences, relative to the frequency. example: 1 format: int64 type: integer weekdayPositions: $ref: "#/components/schemas/SyntheticsDowntimeWeekdayPositions" weekdays: $ref: "#/components/schemas/SyntheticsDowntimeWeekdays" required: - frequency type: object SyntheticsDowntimeTimeSlotRecurrenceResponse: description: Recurrence settings returned in a Synthetics downtime time slot response. properties: frequency: $ref: "#/components/schemas/SyntheticsDowntimeFrequency" interval: description: The interval between recurrences, relative to the frequency. example: 1 format: int64 type: integer until: $ref: "#/components/schemas/SyntheticsDowntimeTimeSlotDate" weekdayPositions: $ref: "#/components/schemas/SyntheticsDowntimeWeekdayPositions" weekdays: $ref: "#/components/schemas/SyntheticsDowntimeWeekdays" required: - frequency - interval - weekdays type: object SyntheticsDowntimeTimeSlotRequest: description: A time slot for a Synthetics downtime create or update request. properties: duration: description: The duration of the time slot in seconds, between 60 and 604800. example: 3600 format: int64 type: integer name: description: An optional label for the time slot. example: Weekly maintenance window type: string recurrence: $ref: "#/components/schemas/SyntheticsDowntimeTimeSlotRecurrenceRequest" start: $ref: "#/components/schemas/SyntheticsDowntimeTimeSlotDate" timezone: description: The IANA timezone name for the time slot. example: Europe/Paris type: string required: - start - timezone - duration type: object SyntheticsDowntimeTimeSlotRequests: description: List of time slots for a Synthetics downtime create or update request. example: - duration: 3600 start: day: 15 hour: 10 minute: 30 month: 1 year: 2024 timezone: Europe/Paris items: $ref: "#/components/schemas/SyntheticsDowntimeTimeSlotRequest" type: array SyntheticsDowntimeTimeSlotResponse: description: A time slot returned in a Synthetics downtime response. properties: duration: description: The duration of the time slot in seconds. example: 3600 format: int64 type: integer id: description: The unique identifier of the time slot. example: "00000000-0000-0000-0000-000000000002" type: string name: description: The label for the time slot. example: Weekly maintenance window type: string recurrence: $ref: "#/components/schemas/SyntheticsDowntimeTimeSlotRecurrenceResponse" start: $ref: "#/components/schemas/SyntheticsDowntimeTimeSlotDate" timezone: description: The IANA timezone name for the time slot. example: Europe/Paris type: string required: - id - start - timezone - duration type: object SyntheticsDowntimeTimeSlotResponses: description: List of time slots in a Synthetics downtime response. example: - duration: 3600 id: "00000000-0000-0000-0000-000000000002" start: day: 15 hour: 10 minute: 30 month: 1 year: 2024 timezone: Europe/Paris items: $ref: "#/components/schemas/SyntheticsDowntimeTimeSlotResponse" type: array SyntheticsDowntimeWeekday: description: A day of the week for a Synthetics downtime recurrence. enum: - MO - TU - WE - TH - FR - SA - SU example: MO type: string x-enum-varnames: - MONDAY - TUESDAY - WEDNESDAY - THURSDAY - FRIDAY - SATURDAY - SUNDAY SyntheticsDowntimeWeekdayPosition: description: >- The position of a weekday within a month for a monthly Synthetics downtime recurrence. `1` through `4` select the first through fourth occurrence of the weekday in the month, and `-1` selects the last occurrence. enum: - 1 - 2 - 3 - 4 - -1 example: 1 format: int64 type: integer x-enum-varnames: - FIRST - SECOND - THIRD - FOURTH - LAST SyntheticsDowntimeWeekdayPositions: description: >- Positions of the weekdays within a month for a monthly Synthetics downtime recurrence. Used in combination with `weekdays` to schedule occurrences such as "the first Monday of the month". example: - 1 items: $ref: "#/components/schemas/SyntheticsDowntimeWeekdayPosition" type: array SyntheticsDowntimeWeekdays: description: Days of the week for a Synthetics downtime recurrence schedule. example: - MO - WE - FR items: $ref: "#/components/schemas/SyntheticsDowntimeWeekday" type: array SyntheticsDowntimesResponse: description: Response containing a list of Synthetics downtimes. properties: data: $ref: "#/components/schemas/SyntheticsDowntimeDataList" required: - data type: object SyntheticsFastTestResult: description: |- Fast test result response. Returns `null` if the result is not yet available (the test is still running or timed out before completing). nullable: true properties: data: $ref: "#/components/schemas/SyntheticsFastTestResultData" type: object SyntheticsFastTestResultAttributes: description: Attributes of the fast test result. properties: device: $ref: "#/components/schemas/SyntheticsTestResultDevice" location: $ref: "#/components/schemas/SyntheticsTestResultLocation" result: $ref: "#/components/schemas/SyntheticsFastTestResultDetail" test_sub_type: $ref: "#/components/schemas/SyntheticsFastTestSubType" test_type: $ref: "#/components/schemas/SyntheticsFastTestType" test_version: description: Version of the test at the time the fast test was triggered. example: 1 format: int64 type: integer type: object SyntheticsFastTestResultData: description: Fast test result data object (JSON:API format). properties: attributes: $ref: "#/components/schemas/SyntheticsFastTestResultAttributes" id: description: The UUID of the fast test, used as the result identifier. example: abc12345-1234-1234-1234-abc123456789 type: string type: $ref: "#/components/schemas/SyntheticsFastTestResultType" type: object SyntheticsFastTestResultDetail: description: |- Detailed result data for the fast test run. The exact shape of nested fields (`request`, `response`, `assertions`, etc.) depends on the test subtype. properties: assertions: description: Results of each assertion evaluated during the test. items: $ref: "#/components/schemas/SyntheticsTestResultAssertionResult" type: array call_type: description: gRPC call type (for example, `unary`, `healthCheck`, or `reflection`). example: unary type: string cert: $ref: "#/components/schemas/SyntheticsTestResultCertificate" duration: description: Total duration of the test in milliseconds. example: 150.5 format: double type: number failure: $ref: "#/components/schemas/SyntheticsTestResultFailure" finished_at: description: Unix timestamp (ms) of when the test finished. example: 1679328001000 format: int64 type: integer id: description: The result ID. Set to the fast test UUID because no persistent result ID exists for fast tests. example: abc12345-1234-1234-1234-abc123456789 type: string is_fast_retry: description: Whether this result is from an automatic fast retry. example: false type: boolean request: $ref: "#/components/schemas/SyntheticsTestResultRequestInfo" resolved_ip: description: IP address resolved for the target host. example: "1.2.3.4" type: string response: $ref: "#/components/schemas/SyntheticsTestResultResponseInfo" run_type: $ref: "#/components/schemas/SyntheticsTestResultRunType" started_at: description: Unix timestamp (ms) of when the test started. example: 1679328000000 format: int64 type: integer status: description: Status of the test result (`passed` or `failed`). example: passed type: string steps: description: Step results for multistep API tests. items: $ref: "#/components/schemas/SyntheticsTestResultStep" type: array timings: additionalProperties: {} description: Timing breakdown of the test request phases (for example, DNS, TCP, TLS, first byte). example: dns: 2.9 download: 2.1 firstByte: 95.2 ssl: 187.9 tcp: 92.6 total: 380.7 type: object traceroute: description: Traceroute hop results, present for ICMP and TCP tests. items: $ref: "#/components/schemas/SyntheticsTestResultTracerouteHop" type: array triggered_at: description: Unix timestamp (ms) of when the test was triggered. example: 1679327999000 format: int64 type: integer tunnel: description: Whether the test was run through a Synthetics tunnel. example: false type: boolean type: object SyntheticsFastTestResultType: default: result description: JSON:API type for a fast test result. enum: - result example: result type: string x-enum-varnames: - RESULT SyntheticsFastTestSubType: description: Subtype of the Synthetic test that produced this result. enum: - dns - grpc - http - icmp - mcp - multi - ssl - tcp - udp - websocket example: http type: string x-enum-varnames: - DNS - GRPC - HTTP - ICMP - MCP - MULTI - SSL - TCP - UDP - WEBSOCKET SyntheticsFastTestType: description: Type of the Synthetic fast test that produced this result. enum: - fast-api - fast-browser example: fast-api type: string x-enum-varnames: - FAST_API - FAST_BROWSER SyntheticsGlobalVariable: description: Synthetic global variable. properties: attributes: $ref: "#/components/schemas/SyntheticsGlobalVariableAttributes" description: description: Description of the global variable. example: "Example description" type: string id: description: Unique identifier of the global variable. readOnly: true type: string is_fido: description: Determines if the global variable is a FIDO variable. type: boolean is_totp: description: Determines if the global variable is a TOTP/MFA variable. type: boolean name: description: Name of the global variable. Unique across Synthetic global variables. example: "MY_VARIABLE" type: string parse_test_options: $ref: "#/components/schemas/SyntheticsGlobalVariableParseTestOptions" parse_test_public_id: description: A Synthetic test ID to use as a test to generate the variable value. example: "abc-def-123" type: string tags: description: Tags of the global variable. example: ["team:front", "test:workflow-1"] items: description: Tag name. type: string type: array value: $ref: "#/components/schemas/SyntheticsGlobalVariableValue" required: - description - name - tags - value type: object SyntheticsGlobalVariableAttributes: description: Attributes of the global variable. properties: restricted_roles: $ref: "#/components/schemas/SyntheticsRestrictedRoles" type: object SyntheticsGlobalVariableOptions: description: Options for the Global Variable for MFA. properties: totp_parameters: $ref: "#/components/schemas/SyntheticsGlobalVariableTOTPParameters" type: object SyntheticsGlobalVariableParseTestOptions: description: Parser options to use for retrieving a Synthetic global variable from a Synthetic test. Used in conjunction with `parse_test_public_id`. properties: field: description: When type is `http_header`, name of the header to use to extract the value. example: "content-type" type: string localVariableName: description: When type is `local_variable`, name of the local variable to use to extract the value. example: "LOCAL_VARIABLE" type: string parser: $ref: "#/components/schemas/SyntheticsVariableParser" type: $ref: "#/components/schemas/SyntheticsGlobalVariableParseTestOptionsType" required: - type type: object SyntheticsGlobalVariableParseTestOptionsType: description: Type of value to extract from a test for a Synthetic global variable. enum: - http_body - http_header - http_status_code - local_variable example: http_body type: string x-enum-varnames: - HTTP_BODY - HTTP_HEADER - HTTP_STATUS_CODE - LOCAL_VARIABLE SyntheticsGlobalVariableParserType: description: Type of parser for a Synthetic global variable from a synthetics test. enum: - raw - json_path - regex - x_path example: raw type: string x-enum-varnames: - RAW - JSON_PATH - REGEX - X_PATH SyntheticsGlobalVariableTOTPParameters: description: "Parameters for the TOTP/MFA variable" properties: digits: description: Number of digits for the OTP code. example: 6 format: int32 maximum: 10 minimum: 4 type: integer refresh_interval: description: Interval for which to refresh the token (in seconds). example: 30 format: int32 maximum: 999 minimum: 0 type: integer type: object SyntheticsGlobalVariableValue: description: Value of the global variable. example: secure: true value: value properties: options: $ref: "#/components/schemas/SyntheticsGlobalVariableOptions" secure: description: Determines if the value of the variable is hidden. type: boolean value: description: |- Value of the global variable. When reading a global variable, the value will not be present if the variable is hidden with the `secure` property. example: "example-value" type: string type: object SyntheticsNetworkAssertion: description: Object describing an assertion for a Network Path test. oneOf: - $ref: "#/components/schemas/SyntheticsNetworkAssertionLatency" - $ref: "#/components/schemas/SyntheticsNetworkAssertionMultiNetworkHop" - $ref: "#/components/schemas/SyntheticsNetworkAssertionPacketLossPercentage" - $ref: "#/components/schemas/SyntheticsNetworkAssertionJitter" SyntheticsNetworkAssertionJitter: description: Jitter assertion for a Network Path test. properties: operator: $ref: "#/components/schemas/SyntheticsNetworkAssertionOperator" target: description: Target value in milliseconds. example: 5 format: double type: number type: $ref: "#/components/schemas/SyntheticsNetworkAssertionJitterType" required: - operator - target - type type: object SyntheticsNetworkAssertionJitterType: default: jitter description: Type of the jitter assertion. enum: - jitter example: jitter type: string x-enum-varnames: - JITTER SyntheticsNetworkAssertionLatency: description: Network latency assertion for a Network Path test. properties: operator: $ref: "#/components/schemas/SyntheticsNetworkAssertionOperator" property: $ref: "#/components/schemas/SyntheticsNetworkAssertionProperty" target: description: Target value in milliseconds. example: 500 format: double type: number type: $ref: "#/components/schemas/SyntheticsNetworkAssertionLatencyType" required: - operator - property - target - type type: object SyntheticsNetworkAssertionLatencyType: default: latency description: Type of the latency assertion. enum: - latency example: latency type: string x-enum-varnames: - LATENCY SyntheticsNetworkAssertionMultiNetworkHop: description: Multi-network hop assertion for a Network Path test. properties: operator: $ref: "#/components/schemas/SyntheticsNetworkAssertionOperator" property: $ref: "#/components/schemas/SyntheticsNetworkAssertionProperty" target: description: Target value in number of hops. example: 3 format: double type: number type: $ref: "#/components/schemas/SyntheticsNetworkAssertionMultiNetworkHopType" required: - operator - property - target - type type: object SyntheticsNetworkAssertionMultiNetworkHopType: default: multiNetworkHop description: Type of the multi-network hop assertion. enum: - multiNetworkHop example: multiNetworkHop type: string x-enum-varnames: - MULTI_NETWORK_HOP SyntheticsNetworkAssertionOperator: description: Assertion operator to apply. enum: - is - isNot - lessThan - lessThanOrEqual - moreThan - moreThanOrEqual example: lessThan type: string x-enum-varnames: - IS - IS_NOT - LESS_THAN - LESS_THAN_OR_EQUAL - MORE_THAN - MORE_THAN_OR_EQUAL SyntheticsNetworkAssertionPacketLossPercentage: description: Packet loss percentage assertion for a Network Path test. properties: operator: $ref: "#/components/schemas/SyntheticsNetworkAssertionOperator" target: description: Target value as a percentage (0 to 1). example: 0.05 format: double maximum: 1 minimum: 0 type: number type: $ref: "#/components/schemas/SyntheticsNetworkAssertionPacketLossPercentageType" required: - operator - target - type type: object SyntheticsNetworkAssertionPacketLossPercentageType: default: packetLossPercentage description: Type of the packet loss percentage assertion. enum: - packetLossPercentage example: packetLossPercentage type: string x-enum-varnames: - PACKET_LOSS_PERCENTAGE SyntheticsNetworkAssertionProperty: description: The associated assertion property. enum: - avg - max - min example: avg type: string x-enum-varnames: - AVG - MAX - MIN SyntheticsNetworkTest: description: Object containing details about a Network Path test. properties: config: $ref: "#/components/schemas/SyntheticsNetworkTestConfig" locations: description: |- Array of locations used to run the test. Network Path tests can be run from managed locations to test public endpoints, or from a [Datadog Agent](https://docs.datadoghq.com/synthetics/network_path_tests/#agent-configuration) to test private environments. example: ["aws:us-east-1", "agent:my-agent-name"] items: description: A location to run the test from. type: string type: array message: description: Notification message associated with the test. example: "Network Path test notification" type: string monitor_id: description: The associated monitor ID. example: 12345678 format: int64 readOnly: true type: integer name: description: Name of the test. example: "Example Network Path test" type: string options: $ref: "#/components/schemas/SyntheticsTestOptions" public_id: description: The public ID for the test. example: abc-def-123 readOnly: true type: string status: $ref: "#/components/schemas/SyntheticsTestPauseStatus" subtype: $ref: "#/components/schemas/SyntheticsNetworkTestSubType" tags: description: Array of tags attached to the test. example: ["env:production"] items: description: A tag attached to the test. type: string type: array type: $ref: "#/components/schemas/SyntheticsNetworkTestType" required: - name - config - locations - options - type - message type: object SyntheticsNetworkTestConfig: description: Configuration object for a Network Path test. properties: assertions: default: [] description: Array of assertions used for the test. example: [{"operator": "lessThan", "property": "avg", "target": 500, "type": "latency"}] items: $ref: "#/components/schemas/SyntheticsNetworkAssertion" type: array request: $ref: "#/components/schemas/SyntheticsNetworkTestRequest" type: object SyntheticsNetworkTestEdit: description: Data object for creating or editing a Network Path test. properties: attributes: $ref: "#/components/schemas/SyntheticsNetworkTest" type: $ref: "#/components/schemas/SyntheticsNetworkTestType" required: - attributes - type type: object SyntheticsNetworkTestEditRequest: description: Network Path test request. properties: data: $ref: "#/components/schemas/SyntheticsNetworkTestEdit" required: - data type: object SyntheticsNetworkTestRequest: description: Object describing the request for a Network Path test. properties: destination_service: description: An optional label displayed for the destination host in the Network Path visualization. type: string e2e_queries: description: The number of packets sent to probe the destination to measure packet loss, latency and jitter. example: 50 format: int64 type: integer host: description: Host name to query. example: "" type: string max_ttl: description: The maximum time-to-live (max number of hops) used in outgoing probe packets. example: 30 format: int64 type: integer port: description: |- For TCP or UDP tests, the port to use when performing the test. If not set on a UDP test, a random port is assigned, which may affect the results. example: 443 format: int64 type: integer source_service: description: An optional label displayed for the source host in the Network Path visualization. type: string tcp_method: $ref: "#/components/schemas/SyntheticsNetworkTestRequestTCPMethod" timeout: description: Timeout in seconds. format: int64 type: integer traceroute_queries: description: The number of traceroute path tracings. example: 3 format: int64 type: integer required: - host - max_ttl - e2e_queries - traceroute_queries type: object SyntheticsNetworkTestRequestTCPMethod: description: For TCP tests, the TCP traceroute strategy. enum: - prefer_sack - syn - sack example: prefer_sack type: string x-enum-varnames: - PREFER_SACK - SYN - SACK SyntheticsNetworkTestResponse: description: Network Path test response. properties: data: $ref: "#/components/schemas/SyntheticsNetworkTestResponseData" type: object SyntheticsNetworkTestResponseData: description: Network Path test response data. properties: attributes: $ref: "#/components/schemas/SyntheticsNetworkTest" id: description: The public ID of the Network Path test. example: abc-def-123 readOnly: true type: string type: $ref: "#/components/schemas/SyntheticsNetworkTestResponseType" type: object SyntheticsNetworkTestResponseType: default: "network_test" description: Type of response, `network_test`. enum: - network_test example: network_test type: string x-enum-varnames: - NETWORK_TEST SyntheticsNetworkTestSubType: description: |- Subtype of the Synthetic Network Path test: `tcp`, `udp`, or `icmp`. enum: - tcp - udp - icmp example: tcp type: string x-enum-varnames: - TCP - UDP - ICMP SyntheticsNetworkTestType: default: "network" description: Type of the Synthetic test, `network`. enum: - network example: network type: string x-enum-varnames: - NETWORK SyntheticsPollTestResultsResponse: description: Response object for polling Synthetic test results. properties: data: description: Array of Synthetic test results. items: $ref: "#/components/schemas/SyntheticsTestResultData" type: array included: description: Array of included related resources, such as the test definition. items: $ref: "#/components/schemas/SyntheticsTestResultIncludedItem" type: array type: object SyntheticsRestrictedRoles: deprecated: true description: A list of role identifiers that can be pulled from the Roles API, for restricting read and write access. This field is deprecated. Use the restriction policies API to manage permissions. example: ["xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"] items: description: UUID for a role. example: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx type: string type: array SyntheticsSuite: description: Object containing details about a Synthetic suite. properties: message: description: Notification message associated with the suite. example: Notification message type: string monitor_id: description: The associated monitor ID. example: 12345678 format: int64 readOnly: true type: integer name: description: Name of the suite. example: "Example suite name" type: string options: $ref: "#/components/schemas/SyntheticsSuiteOptions" public_id: description: The public ID for the test. example: 123-abc-456 readOnly: true type: string tags: description: Array of tags attached to the suite. example: ["env:production"] items: description: A tag attached to the suite. type: string type: array tests: description: Array of Synthetic tests included in the suite. items: $ref: "#/components/schemas/SyntheticsSuiteTest" type: array type: $ref: "#/components/schemas/SyntheticsSuiteType" required: - name - type - tests - options type: object SyntheticsSuiteOptions: description: Object describing the extra options for a Synthetic suite. properties: alerting_threshold: description: Percentage of critical tests failure needed for a suite to fail. format: double maximum: 1 minimum: 0 type: number type: object SyntheticsSuiteResponse: description: Synthetics suite response properties: data: $ref: "#/components/schemas/SyntheticsSuiteResponseData" type: object SyntheticsSuiteResponseData: description: Synthetics suite response data properties: attributes: $ref: "#/components/schemas/SyntheticsSuite" id: description: The public ID for the suite. example: 123-abc-456 readOnly: true type: string type: $ref: "#/components/schemas/SyntheticsSuiteTypes" type: object SyntheticsSuiteSearchResponse: description: Synthetics suite search response properties: data: $ref: "#/components/schemas/SyntheticsSuiteSearchResponseData" type: object SyntheticsSuiteSearchResponseData: description: Synthetics suite search response data properties: attributes: $ref: "#/components/schemas/SyntheticsSuiteSearchResponseDataAttributes" id: description: The unique identifier of the suite search response data. format: uuid type: string type: $ref: "#/components/schemas/SuiteSearchResponseType" type: object SyntheticsSuiteSearchResponseDataAttributes: description: Synthetics suite search response data attributes properties: suites: description: List of Synthetic suites matching the search query. items: $ref: "#/components/schemas/SyntheticsSuite" type: array total: description: Total number of Synthetic suites matching the search query. format: int32 maximum: 2147483647 type: integer type: object SyntheticsSuiteTest: description: Object containing details about a Synthetic test included in a Synthetic suite. properties: alerting_criticality: $ref: "#/components/schemas/SyntheticsSuiteTestAlertingCriticality" public_id: description: The public ID of the Synthetic test included in the suite. example: "" type: string required: - public_id type: object SyntheticsSuiteTestAlertingCriticality: description: Alerting criticality for each the test. enum: - ignore - critical example: critical type: string x-enum-varnames: - IGNORE - CRITICAL SyntheticsSuiteType: default: "suite" description: Type of the Synthetic suite, `suite`. enum: - suite example: suite type: string x-enum-varnames: - SUITE SyntheticsSuiteTypes: default: "suites" description: Type for the Synthetics suites responses, `suites`. enum: - suites example: suites type: string x-enum-varnames: - SUITES SyntheticsTestFileAbortMultipartUploadRequest: description: Request body for aborting a multipart file upload. properties: key: description: The full storage path of the file whose upload should be aborted. example: "org-123/api-upload-file/abc-def-123/2024-01-01T00:00:00_uuid.json" type: string uploadId: description: The upload ID of the multipart upload to abort. example: "upload-id-abc123" type: string required: - uploadId - key type: object SyntheticsTestFileCompleteMultipartUploadPart: description: A completed part of a multipart upload. properties: ETag: description: The ETag returned by the storage provider after uploading the part. example: '"d41d8cd98f00b204e9800998ecf8427e"' type: string PartNumber: description: The 1-indexed part number for the multipart upload. example: 1 format: int64 type: integer required: - ETag - PartNumber type: object SyntheticsTestFileCompleteMultipartUploadRequest: description: Request body for completing a multipart file upload. properties: key: description: The full storage path for the uploaded file. example: "org-123/api-upload-file/abc-def-123/2024-01-01T00:00:00_uuid.json" type: string parts: description: Array of completed parts with their ETags. items: $ref: "#/components/schemas/SyntheticsTestFileCompleteMultipartUploadPart" type: array uploadId: description: The upload ID returned when the multipart upload was initiated. example: "upload-id-abc123" type: string required: - uploadId - key - parts type: object SyntheticsTestFileDownloadRequest: description: Request body for getting a presigned download URL for a test file. properties: bucketKey: description: The bucket key referencing the file to download. example: "api-upload-file/abc-def-123/2024-01-01T00:00:00_uuid.json" minLength: 1 type: string required: - bucketKey type: object SyntheticsTestFileDownloadResponse: description: Response containing a presigned URL for downloading a test file. properties: url: description: A presigned URL to download the file. The URL expires after a short period. example: "https://storage.example.com/presigned-download-url" type: string type: object SyntheticsTestFileMultipartPresignedUrlsParams: description: Presigned URL parameters returned for a multipart upload. properties: key: description: The full storage path for the file being uploaded. example: "org-123/api-upload-file/abc-def-123/2024-01-01T00:00:00_uuid.json" type: string upload_id: description: The upload ID assigned by the storage provider for this multipart upload. example: "upload-id-abc123" type: string urls: additionalProperties: type: string description: A map of part numbers to presigned upload URLs. example: "1": "https://storage.example.com/presigned-upload-url-part-1" "2": "https://storage.example.com/presigned-upload-url-part-2" type: object type: object SyntheticsTestFileMultipartPresignedUrlsPart: description: A part descriptor for initiating a multipart upload. properties: md5: description: Base64-encoded MD5 digest of the part content. example: "1B2M2Y8AsgTpgAmY7PhCfg==" maxLength: 24 minLength: 22 type: string partNumber: description: The 1-indexed part number for the multipart upload. example: 1 format: int64 type: integer required: - md5 - partNumber type: object SyntheticsTestFileMultipartPresignedUrlsRequest: description: Request body for getting presigned URLs for a multipart file upload. properties: bucketKeyPrefix: $ref: "#/components/schemas/SyntheticsTestFileMultipartPresignedUrlsRequestBucketKeyPrefix" parts: description: Array of part descriptors for the multipart upload. items: $ref: "#/components/schemas/SyntheticsTestFileMultipartPresignedUrlsPart" type: array required: - bucketKeyPrefix - parts type: object SyntheticsTestFileMultipartPresignedUrlsRequestBucketKeyPrefix: description: The bucket key prefix indicating the type of file upload. enum: - api-upload-file - browser-upload-file-step example: "api-upload-file" type: string x-enum-varnames: - API_UPLOAD_FILE - BROWSER_UPLOAD_FILE_STEP SyntheticsTestFileMultipartPresignedUrlsResponse: description: Response containing presigned URLs for multipart file upload and the bucket key. properties: bucketKey: description: The bucket key that references the uploaded file after completion. example: "api-upload-file/abc-def-123/2024-01-01T00:00:00_uuid.json" type: string multipart_presigned_urls_params: $ref: "#/components/schemas/SyntheticsTestFileMultipartPresignedUrlsParams" type: object SyntheticsTestLatestResultsResponse: description: Response object for a Synthetic test's latest result summaries. properties: data: description: Array of Synthetic test result summaries. items: $ref: "#/components/schemas/SyntheticsTestResultSummaryData" type: array included: description: Array of included related resources, such as the test definition. items: $ref: "#/components/schemas/SyntheticsTestResultIncludedItem" type: array type: object SyntheticsTestOptions: description: Object describing the extra options for a Synthetic test. properties: min_failure_duration: description: Minimum amount of time in failure required to trigger an alert. format: int64 type: integer min_location_failed: description: |- Minimum number of locations in failure required to trigger an alert. format: int64 type: integer monitor_name: description: The monitor name is used for the alert title as well as for all monitor dashboard widgets and SLOs. type: string monitor_options: $ref: "#/components/schemas/SyntheticsTestOptionsMonitorOptions" monitor_priority: description: Integer from 1 (high) to 5 (low) indicating alert severity. format: int32 maximum: 5 minimum: 1 type: integer restricted_roles: $ref: "#/components/schemas/SyntheticsRestrictedRoles" retry: $ref: "#/components/schemas/SyntheticsTestOptionsRetry" scheduling: $ref: "#/components/schemas/SyntheticsTestOptionsScheduling" tick_every: description: The frequency at which to run the Synthetic test (in seconds). format: int64 maximum: 604800 minimum: 30 type: integer type: object SyntheticsTestOptionsMonitorOptions: description: |- Object containing the options for a Synthetic test as a monitor (for example, renotification). properties: escalation_message: description: Message to include in the escalation notification. type: string notification_preset_name: $ref: "#/components/schemas/SyntheticsTestOptionsMonitorOptionsNotificationPresetName" renotify_interval: description: |- Time interval before renotifying if the test is still failing (in minutes). format: int64 minimum: 0 type: integer renotify_occurrences: description: The number of times to renotify if the test is still failing. format: int64 type: integer type: object SyntheticsTestOptionsMonitorOptionsNotificationPresetName: description: The name of the preset for the notification for the monitor. enum: - show_all - hide_all - hide_query - hide_handles - hide_query_and_handles - show_only_snapshot - hide_handles_and_footer type: string x-enum-varnames: - SHOW_ALL - HIDE_ALL - HIDE_QUERY - HIDE_HANDLES - HIDE_QUERY_AND_HANDLES - SHOW_ONLY_SNAPSHOT - HIDE_HANDLES_AND_FOOTER SyntheticsTestOptionsRetry: description: Object describing the retry strategy to apply to a Synthetic test. properties: count: description: |- Number of times a test needs to be retried before marking a location as failed. Defaults to 0. format: int64 type: integer interval: description: |- Time interval between retries (in milliseconds). Defaults to 300ms. format: double type: number type: object SyntheticsTestOptionsScheduling: description: Object containing timeframes and timezone used for advanced scheduling. properties: timeframes: description: Array containing objects describing the scheduling pattern to apply to each day. example: [{"day": 1, "from": "07:00", "to": "16:00"}, {"day": 3, "from": "07:00", "to": "16:00"}] items: $ref: "#/components/schemas/SyntheticsTestOptionsSchedulingTimeframe" type: array timezone: description: Timezone in which the timeframe is based. example: "America/New_York" type: string required: - timeframes - timezone type: object SyntheticsTestOptionsSchedulingTimeframe: description: Object describing a timeframe. properties: day: description: Number representing the day of the week. example: 1 format: int32 maximum: 7 minimum: 1 type: integer from: description: The hour of the day on which scheduling starts. example: "07:00" type: string to: description: The hour of the day on which scheduling ends. example: "16:00" type: string required: - day - from - to type: object SyntheticsTestParentSuiteAttributes: description: Object containing details about a parent suite of a Synthetic test. properties: child_name: description: The name of the child test within the suite. example: My API Test type: string child_public_id: description: The public ID of the child test within the suite. example: xyz-uvw-789 type: string monitor_id: description: The associated monitor ID. example: 12345678 format: int64 type: integer name: description: Name of the parent suite. example: My Suite type: string overall_state: description: The overall state of the parent suite. example: 0 format: int64 type: integer overall_state_modified: description: Timestamp of when the overall state was last modified. example: "2024-01-01T00:00:00+00:00" type: string public_id: description: The public ID of the parent suite. example: abc-def-123 type: string type: object SyntheticsTestParentSuiteData: description: Data object for a parent suite. properties: attributes: $ref: "#/components/schemas/SyntheticsTestParentSuiteAttributes" id: description: The public ID of the parent suite. example: abc-def-123 type: string type: $ref: "#/components/schemas/SyntheticsTestParentSuiteType" type: object SyntheticsTestParentSuiteType: default: parent_suite description: Type of the parent suite resource. enum: - parent_suite example: parent_suite type: string x-enum-varnames: - PARENT_SUITE SyntheticsTestParentSuitesResponse: description: Response containing the list of parent suites for a Synthetic test. properties: data: description: List of parent suites for the given test. items: $ref: "#/components/schemas/SyntheticsTestParentSuiteData" type: array type: object SyntheticsTestPauseStatus: description: |- Define whether you want to start (`live`) or pause (`paused`) a Synthetic test. enum: - live - paused example: live type: string x-enum-varnames: - LIVE - PAUSED SyntheticsTestResultAssertionResult: description: An individual assertion result from a Synthetic test. properties: actual: description: Actual value observed during the test. Its type depends on the assertion type. example: 200 error_message: description: Error message if the assertion failed. example: "Assertion failed: expected 200 but got 500" type: string expected: description: Expected value for the assertion. Its type depends on the assertion type. example: "200" operator: description: Operator used for the assertion (for example, `is`, `contains`). example: is type: string property: description: Property targeted by the assertion, when applicable. example: content-type type: string target: description: Target value for the assertion. Its type depends on the assertion type. example: 200 target_path: description: JSON path or XPath evaluated for the assertion. example: $.url type: string target_path_operator: description: Operator used for the target path assertion. example: contains type: string type: description: Type of the assertion (for example, `responseTime`, `statusCode`, `body`). example: statusCode type: string valid: description: Whether the assertion passed. example: true type: boolean type: object SyntheticsTestResultAttributes: description: Attributes of a Synthetic test result. properties: batch: $ref: "#/components/schemas/SyntheticsTestResultBatch" ci: $ref: "#/components/schemas/SyntheticsTestResultCI" device: $ref: "#/components/schemas/SyntheticsTestResultDevice" git: $ref: "#/components/schemas/SyntheticsTestResultGit" location: $ref: "#/components/schemas/SyntheticsTestResultLocation" result: $ref: "#/components/schemas/SyntheticsTestResultDetail" test_sub_type: $ref: "#/components/schemas/SyntheticsTestSubType" test_type: $ref: "#/components/schemas/SyntheticsTestType" type: object SyntheticsTestResultBatch: description: Batch information for the test result. properties: id: description: Batch identifier. example: batch-abc-123 type: string type: object SyntheticsTestResultBounds: description: Bounding box of an element on the page. properties: height: description: Height in pixels. example: 37 format: int64 type: integer width: description: Width in pixels. example: 343 format: int64 type: integer x: description: Horizontal position in pixels. example: 16 format: int64 type: integer y: description: Vertical position in pixels. example: 140 format: int64 type: integer type: object SyntheticsTestResultBrowserError: description: A browser error captured during a browser test step. properties: description: description: Error description. example: Failed to fetch resource type: string method: description: HTTP method associated with the error (for network errors). example: GET type: string name: description: Error name. example: NetworkError type: string status: description: HTTP status code associated with the error (for network errors). example: 500 format: int64 type: integer type: description: Type of the browser error. example: network type: string url: additionalProperties: {} description: URL associated with the error. type: object type: object SyntheticsTestResultBucketKeys: description: Storage bucket keys for artifacts produced during a step or test. properties: after_step_screenshot: description: Key for the screenshot captured after the step (goal-based tests). example: screenshots/after-step-1-1.png type: string after_turn_screenshot: description: Key for the screenshot captured after the turn (goal-based tests). example: screenshots/after-turn-1.png type: string artifacts: description: Key for miscellaneous artifacts. example: 2/e2e-tests/equ-jku-twc/results/6989498452827932222/edge.laptop_large/artifacts__1724521416257.json type: string before_step_screenshot: description: Key for the screenshot captured before the step (goal-based tests). example: screenshots/before-step-1-1.png type: string before_turn_screenshot: description: Key for the screenshot captured before the turn (goal-based tests). example: screenshots/before-turn-1.png type: string crash_report: description: Key for a captured crash report. example: 2/e2e-tests/d2z-32s-iax/results/1340718101990858549/synthetics:mobile:device:iphone_se_2020_ios_14/crash_report.log type: string device_logs: description: Key for captured device logs. example: 2/e2e-tests/d2z-32s-iax/results/1340718101990858549/synthetics:mobile:device:iphone_se_2020_ios_14/d2z-32s-iax_1340718101990858549_device_logs.log type: string email_messages: description: Keys for email message payloads captured by the step. items: description: Storage bucket key for a captured email message. type: string type: array screenshot: description: Key for the captured screenshot. example: 2/e2e-tests/equ-jku-twc/results/6989498452827932222/edge.laptop_large/step-0__1724521416269.jpeg type: string snapshot: description: Key for the captured DOM snapshot. example: 2/e2e-tests/equ-jku-twc/results/6989498452827932222/edge.laptop_large/snapshot.html type: string source: description: Key for the page source or element source. example: 2/e2e-tests/d2z-32s-iax/results/1340718101990858549/synthetics:mobile:device:iphone_se_2020_ios_14/step-0__1724445301832.xml type: string type: object SyntheticsTestResultCI: description: CI information associated with the test result. properties: pipeline: $ref: "#/components/schemas/SyntheticsTestResultCIPipeline" provider: $ref: "#/components/schemas/SyntheticsTestResultCIProvider" stage: $ref: "#/components/schemas/SyntheticsTestResultCIStage" workspace_path: description: Path of the workspace that ran the CI job. example: /home/runner/work/example type: string type: object SyntheticsTestResultCIPipeline: description: Details of the CI pipeline. properties: id: description: Pipeline identifier. example: pipeline-abc-123 type: string name: description: Pipeline name. example: build-and-test type: string number: description: Pipeline number. example: 42 format: int64 type: integer url: description: Pipeline URL. example: https://github.com/DataDog/example/actions/runs/42 type: string type: object SyntheticsTestResultCIProvider: description: Details of the CI provider. properties: name: description: Provider name. example: github type: string type: object SyntheticsTestResultCIStage: description: Details of the CI stage. properties: name: description: Stage name. example: test type: string type: object SyntheticsTestResultCdnCacheStatus: description: Cache status reported by the CDN for the response. properties: cached: description: Whether the response was served from the CDN cache. example: true type: boolean status: description: Raw cache status string reported by the CDN. example: HIT type: string type: object SyntheticsTestResultCdnProviderInfo: description: CDN provider details inferred from response headers. properties: cache: $ref: "#/components/schemas/SyntheticsTestResultCdnCacheStatus" provider: description: Name of the CDN provider. example: google_cloud type: string type: object SyntheticsTestResultCdnResource: description: A CDN resource encountered while executing a browser step. properties: cdn: $ref: "#/components/schemas/SyntheticsTestResultCdnProviderInfo" resolved_ip: description: Resolved IP address for the CDN resource. example: 34.95.79.70 type: string timestamp: description: Unix timestamp (ms) of when the resource was fetched. example: 1724521406576 format: int64 type: integer timings: additionalProperties: {} description: Timing breakdown for fetching the CDN resource. example: firstByte: 99.7 tcp: 0.9 type: object type: object SyntheticsTestResultCertificate: description: SSL/TLS certificate information returned from an SSL test. properties: cipher: description: Cipher used for the TLS connection. example: TLS_AES_256_GCM_SHA384 type: string exponent: description: RSA exponent of the certificate. example: 65537 format: int64 type: integer ext_key_usage: description: Extended key usage extensions for the certificate. example: - 1.3.6.1.5.5.7.3.1 items: description: Extended key usage value. type: string type: array fingerprint: description: SHA-1 fingerprint of the certificate. example: D6:03:5A:9F:93:E1:B7:28:EC:90:C5:9F:72:30:55:7C:74:5F:53:92 type: string fingerprint256: description: SHA-256 fingerprint of the certificate. example: 04:45:93:A9:4C:14:70:47:DB:3C:FC:05:F9:5A:50:4E:DA:DB:A1:C6:37:3D:15:C0:B2:7E:5D:93:5F:A2:02:C7 type: string issuer: additionalProperties: type: string description: Certificate issuer details. example: C: US CN: WE2 O: Google Trust Services type: object modulus: description: RSA modulus of the certificate. example: C0FCE9F9... type: string protocol: description: TLS protocol used (for example, `TLSv1.2`). example: TLSv1.3 type: string serial_number: description: Serial number of the certificate. example: 7B584A1A6670A1EB0941A9A121569D60 type: string subject: additionalProperties: type: string description: Certificate subject details. example: CN: "*.google.fr" altName: "DNS:*.google.fr, DNS:google.fr" type: object tls_version: description: TLS protocol version. example: 1.3 format: double type: number valid: $ref: "#/components/schemas/SyntheticsTestResultCertificateValidity" type: object SyntheticsTestResultCertificateValidity: description: Validity window of a certificate. properties: from: description: Unix timestamp (ms) of when the certificate became valid. example: 1742469686000 format: int64 type: integer to: description: Unix timestamp (ms) of when the certificate expires. example: 1749727285000 format: int64 type: integer type: object SyntheticsTestResultData: description: Wrapper object for a Synthetic test result. properties: attributes: $ref: "#/components/schemas/SyntheticsTestResultAttributes" id: description: The result ID. example: "5158904793181869365" type: string relationships: $ref: "#/components/schemas/SyntheticsTestResultRelationships" type: $ref: "#/components/schemas/SyntheticsTestResultType" type: object SyntheticsTestResultDetail: description: Full result details for a Synthetic test execution. properties: assertions: description: Assertion results produced by the test. items: $ref: "#/components/schemas/SyntheticsTestResultAssertionResult" type: array bucket_keys: $ref: "#/components/schemas/SyntheticsTestResultBucketKeys" call_type: description: gRPC call type (for example, `unary`, `healthCheck`, or `reflection`). example: unary type: string cert: $ref: "#/components/schemas/SyntheticsTestResultCertificate" compressed_json_descriptor: description: Compressed JSON descriptor for the test (internal format). example: compressedJsonDescriptorValue type: string compressed_steps: description: Compressed representation of the test steps (internal format). example: eJzLSM3JyQcABiwCFQ== type: string connection_outcome: description: Outcome of the connection attempt (for example, `established`, `refused`). example: established type: string dns_resolution: $ref: "#/components/schemas/SyntheticsTestResultDnsResolution" duration: description: Duration of the test execution (in milliseconds). example: 380.7 format: double type: number exited_on_step_success: description: Whether the test exited early because a step marked with `exitIfSucceed` passed. example: false type: boolean failure: $ref: "#/components/schemas/SyntheticsTestResultFailure" finished_at: description: Timestamp of when the test finished (in milliseconds). example: 1723782422760 format: int64 type: integer handshake: $ref: "#/components/schemas/SyntheticsTestResultHandshake" id: description: The unique identifier for this result. example: "5158904793181869365" type: string initial_id: description: The initial result ID before any retries. example: "5158904793181869365" type: string is_fast_retry: description: Whether this result is from a fast retry. example: true type: boolean is_last_retry: description: Whether this result is from the last retry. example: true type: boolean netpath: $ref: "#/components/schemas/SyntheticsTestResultNetpath" netstats: $ref: "#/components/schemas/SyntheticsTestResultNetstats" ocsp: $ref: "#/components/schemas/SyntheticsTestResultOCSPResponse" ping: $ref: "#/components/schemas/SyntheticsTestResultTracerouteHop" received_email_count: description: Number of emails received during the test (email tests). example: 1 format: int64 type: integer received_message: description: Message received from the target (for WebSocket/TCP/UDP tests). example: "UDP echo: b'Test message'" type: string request: $ref: "#/components/schemas/SyntheticsTestResultRequestInfo" resolved_ip: description: IP address resolved for the target host. example: "54.243.255.141" type: string response: $ref: "#/components/schemas/SyntheticsTestResultResponseInfo" run_type: $ref: "#/components/schemas/SyntheticsTestResultRunType" sent_message: description: Message sent to the target (for WebSocket/TCP/UDP tests). example: udp mess type: string start_url: description: Start URL for the test (browser tests). example: http://34.95.79.70/prototype type: string started_at: description: Timestamp of when the test started (in milliseconds). example: 1723782422750 format: int64 type: integer status: $ref: "#/components/schemas/SyntheticsTestResultStatus" steps: description: Step results (for browser, mobile, and multistep API tests). items: $ref: "#/components/schemas/SyntheticsTestResultStep" type: array time_to_interactive: description: Time to interactive in milliseconds (browser tests). example: 183 format: int64 type: integer timings: additionalProperties: {} description: Timing breakdown of the test request phases (for example, DNS, TCP, TLS, first byte). example: dns: 2.9 download: 2.1 firstByte: 95.2 ssl: 187.9 tcp: 92.6 total: 380.7 type: object trace: $ref: "#/components/schemas/SyntheticsTestResultTrace" traceroute: description: Traceroute hop results (for network tests). items: $ref: "#/components/schemas/SyntheticsTestResultTracerouteHop" type: array triggered_at: description: Timestamp of when the test was triggered (in milliseconds). example: 1723782422715 format: int64 type: integer tunnel: description: Whether the test was executed through a tunnel. example: false type: boolean turns: description: Turns executed by a goal-based browser test. items: $ref: "#/components/schemas/SyntheticsTestResultTurn" type: array unhealthy: description: Whether the test runner was unhealthy at the time of execution. example: false type: boolean variables: $ref: "#/components/schemas/SyntheticsTestResultVariables" type: object SyntheticsTestResultDevice: description: Device information for the test result (browser and mobile tests). properties: browser: $ref: "#/components/schemas/SyntheticsTestResultDeviceBrowser" id: description: Device identifier. example: chrome.laptop_large type: string name: description: Device name. example: "Chrome - Laptop Large" type: string platform: $ref: "#/components/schemas/SyntheticsTestResultDevicePlatform" resolution: $ref: "#/components/schemas/SyntheticsTestResultDeviceResolution" type: description: Device type. example: browser type: string type: object SyntheticsTestResultDeviceBrowser: description: Browser information for the device used to run the test. properties: type: description: Browser type (for example, `chrome`, `firefox`). example: edge type: string user_agent: description: User agent string reported by the browser. example: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36 Edg/127.0.2651.105 DatadogSynthetics type: string version: description: Browser version. example: 127.0.2651.105 type: string type: object SyntheticsTestResultDevicePlatform: description: Platform information for the device used to run the test. properties: name: description: Platform name (for example, `linux`, `macos`). example: ios type: string version: description: Platform version. example: "14.8" type: string type: object SyntheticsTestResultDeviceResolution: description: Screen resolution of the device used to run the test. properties: height: description: Viewport height in pixels. example: 1100 format: int64 type: integer pixel_ratio: description: Device pixel ratio. example: 2 format: double type: number width: description: Viewport width in pixels. example: 1440 format: int64 type: integer type: object SyntheticsTestResultDnsRecord: description: A DNS record returned in a DNS test response. properties: type: description: DNS record type (for example, `A`, `AAAA`, `CNAME`). example: A type: string values: description: Values associated with the DNS record. example: - 213.186.33.19 items: description: DNS record value. type: string type: array type: object SyntheticsTestResultDnsResolution: description: DNS resolution details recorded during the test execution. properties: attempts: description: DNS resolution attempts made during the test. items: $ref: "#/components/schemas/SyntheticsTestResultDnsResolutionAttempt" type: array resolved_ip: description: Resolved IP address for the target host. example: 54.243.255.141 type: string resolved_port: description: Resolved port for the target service. example: "443" type: string server: description: DNS server used for the resolution. example: 8.8.4.4 type: string type: object SyntheticsTestResultDnsResolutionAttempt: additionalProperties: type: string description: A single DNS resolution attempt. Keys are provider-specific attempt fields. type: object SyntheticsTestResultDuration: description: Total duration of a Synthetic test execution. properties: has_duration: description: Whether a duration was recorded for this execution. example: true type: boolean value: description: Duration value in milliseconds. example: 380 format: int64 type: integer type: object SyntheticsTestResultExecutionInfo: description: Execution details for a Synthetic test result. properties: duration: $ref: "#/components/schemas/SyntheticsTestResultDuration" error_message: description: Error message if the execution encountered an issue. example: Connection timed out type: string is_fast_retry: description: Whether this result is from a fast retry. example: true type: boolean timings: additionalProperties: {} description: Timing breakdown of the test execution in milliseconds. example: dns: 2.9 download: 2.1 firstByte: 95.2 ssl: 187.9 tcp: 92.6 total: 380.7 type: object tunnel: description: Whether the test was executed through a tunnel. example: false type: boolean unhealthy: description: Whether the location was unhealthy during execution. example: false type: boolean type: object SyntheticsTestResultFailure: description: Details about the failure of a Synthetic test. properties: code: description: Error code for the failure. example: TIMEOUT type: string internal_code: description: Internal error code used for debugging. example: INCORRECT_ASSERTION type: string internal_message: description: Internal error message used for debugging. example: Assertion failed on step 2 type: string message: description: Error message for the failure. example: Connection timed out type: string type: object SyntheticsTestResultFileRef: description: Reference to a file attached to a Synthetic test request. properties: bucket_key: description: Storage bucket key where the file is stored. example: api-upload-file/s3v-msw-tp3/2024-08-20T12:18:27.628081_f433c953-a58a-4296-834b-0669e32ba55f.json type: string encoding: description: Encoding of the file contents. example: base64 type: string name: description: File name. example: dd_logo_h_rgb.jpg type: string size: description: File size in bytes. example: 30294 format: int64 type: integer type: description: File MIME type. example: image/jpeg type: string type: object SyntheticsTestResultGit: description: Git information associated with the test result. properties: branch: description: Git branch name. example: main type: string commit: $ref: "#/components/schemas/SyntheticsTestResultGitCommit" repository_url: description: Git repository URL. example: https://github.com/DataDog/example type: string type: object SyntheticsTestResultGitCommit: description: Details of the Git commit associated with the test result. properties: author: $ref: "#/components/schemas/SyntheticsTestResultGitUser" committer: $ref: "#/components/schemas/SyntheticsTestResultGitUser" message: description: Commit message. example: Fix bug in login flow type: string sha: description: Commit SHA. example: 9e107d9d372bb6826bd81d3542a419d6f0e1de56 type: string url: description: URL of the commit. example: https://github.com/DataDog/example/commit/9e107d9d372bb6826bd81d3542a419d6f0e1de56 type: string type: object SyntheticsTestResultGitUser: description: A Git user (author or committer). properties: date: description: Timestamp of the commit action for this user. example: "2024-08-15T14:23:00Z" type: string email: description: Email address of the Git user. example: jane.doe@example.com type: string name: description: Name of the Git user. example: Jane Doe type: string type: object SyntheticsTestResultHandshake: description: Handshake request and response for protocol-level tests. properties: request: $ref: "#/components/schemas/SyntheticsTestResultRequestInfo" response: $ref: "#/components/schemas/SyntheticsTestResultResponseInfo" type: object SyntheticsTestResultHealthCheck: description: Health check information returned from a gRPC health check call. properties: message: additionalProperties: type: string description: Raw health check message payload. type: object status: description: Health check status code. example: 1 format: int64 type: integer type: object SyntheticsTestResultIncludedItem: description: An included related resource. properties: attributes: additionalProperties: {} description: Attributes of the included resource. type: object id: description: ID of the included resource. example: abc-def-123 type: string type: description: Type of the included resource. example: test type: string type: object SyntheticsTestResultLocation: description: Location information for a Synthetic test result. properties: id: description: Identifier of the location. example: aws:us-east-1 type: string name: description: Human-readable name of the location. example: "N. Virginia (AWS)" type: string version: description: Version of the worker that ran the test. example: 1.0.0 type: string worker_id: description: Identifier of the specific worker that ran the test. example: worker-abc-123 type: string type: object SyntheticsTestResultNetpath: description: Network Path test result capturing the path between source and destination. properties: destination: $ref: "#/components/schemas/SyntheticsTestResultNetpathDestination" hops: description: Hops along the network path. items: $ref: "#/components/schemas/SyntheticsTestResultNetpathHop" type: array origin: description: Origin of the network path (for example, probe source). example: synthetics type: string pathtrace_id: description: Identifier of the path trace. example: 5d3cb978-533b-41ce-85a4-3661c8dd6a0b type: string protocol: description: Protocol used for the path trace (for example, `tcp`, `udp`, `icmp`). example: TCP type: string source: $ref: "#/components/schemas/SyntheticsTestResultNetpathEndpoint" tags: description: Tags associated with the network path measurement. example: - synthetics.test_id:nja-epx-mg8 items: description: Tag associated with the network path measurement. type: string type: array timestamp: description: Unix timestamp (ms) of the network path measurement. example: 1744117822266 format: int64 type: integer type: object SyntheticsTestResultNetpathDestination: description: Destination endpoint of a network path measurement. properties: hostname: description: Hostname of the destination. example: 34.95.79.70 type: string ip_address: description: IP address of the destination. example: 34.95.79.70 type: string port: description: Port of the destination service. example: 80 format: int64 type: integer type: object SyntheticsTestResultNetpathEndpoint: description: Source endpoint of a network path measurement. properties: hostname: description: Hostname of the endpoint. example: edge-eu1.staging.dog type: string type: object SyntheticsTestResultNetpathHop: description: A single hop along a network path. properties: hostname: description: Resolved hostname of the hop. example: 70.79.95.34.bc.googleusercontent.com type: string ip_address: description: IP address of the hop. example: 10.240.134.15 type: string reachable: description: Whether this hop was reachable. example: true type: boolean rtt: description: Round-trip time to this hop in milliseconds. example: 0.000346599 format: double type: number ttl: description: Time-to-live value of the probe packet at this hop. example: 2 format: int64 type: integer type: object SyntheticsTestResultNetstats: description: Aggregated network statistics from the test execution. properties: hops: $ref: "#/components/schemas/SyntheticsTestResultNetstatsHops" jitter: description: Network jitter in milliseconds. example: 0.08 format: double type: number latency: $ref: "#/components/schemas/SyntheticsTestResultNetworkLatency" packet_loss_percentage: description: Percentage of probe packets lost. example: 0.0 format: double type: number packets_received: description: Number of probe packets received. example: 4 format: int64 type: integer packets_sent: description: Number of probe packets sent. example: 4 format: int64 type: integer type: object SyntheticsTestResultNetstatsHops: description: Statistics about the number of hops for a network test. properties: avg: description: Average number of hops. example: 11.0 format: double type: number max: description: Maximum number of hops. example: 11 format: int64 type: integer min: description: Minimum number of hops. example: 11 format: int64 type: integer type: object SyntheticsTestResultNetworkLatency: description: Latency statistics for a network probe. properties: avg: description: Average latency in milliseconds. example: 1.8805 format: double type: number max: description: Maximum latency in milliseconds. example: 1.97 format: double type: number min: description: Minimum latency in milliseconds. example: 1.76 format: double type: number type: object SyntheticsTestResultOCSPCertificate: description: Certificate details returned in an OCSP response. properties: revocation_reason: description: Reason code for the revocation, when applicable. example: unspecified type: string revocation_time: description: Unix timestamp (ms) of the revocation. example: 1749727285000 format: int64 type: integer serial_number: description: Serial number of the certificate. example: 7B584A1A6670A1EB0941A9A121569D60 type: string type: object SyntheticsTestResultOCSPResponse: description: OCSP response received while validating a certificate. properties: certificate: $ref: "#/components/schemas/SyntheticsTestResultOCSPCertificate" status: description: OCSP response status (for example, `good`, `revoked`, `unknown`). example: good type: string updates: $ref: "#/components/schemas/SyntheticsTestResultOCSPUpdates" type: object SyntheticsTestResultOCSPUpdates: description: OCSP response update timestamps. properties: next_update: description: Unix timestamp (ms) of the next expected OCSP update. example: 1743074486000 format: int64 type: integer produced_at: description: Unix timestamp (ms) of when the OCSP response was produced. example: 1742469686000 format: int64 type: integer this_update: description: Unix timestamp (ms) of this OCSP update. example: 1742469686000 format: int64 type: integer type: object SyntheticsTestResultParentStep: description: Reference to the parent step of a sub-step. properties: id: description: Identifier of the parent step. example: fkk-j2a-gmw type: string type: object SyntheticsTestResultParentTest: description: Reference to the parent test of a sub-step. properties: id: description: Identifier of the parent test. example: abc-def-123 type: string type: object SyntheticsTestResultRedirect: description: A redirect hop encountered while performing the request. properties: location: description: Target location of the redirect. example: https://example.com/new-location type: string status_code: description: HTTP status code of the redirect response. example: 301 format: int64 type: integer type: object SyntheticsTestResultRelationshipTest: description: Relationship to the Synthetic test. properties: data: $ref: "#/components/schemas/SyntheticsTestResultRelationshipTestData" type: object SyntheticsTestResultRelationshipTestData: description: Data for the test relationship. properties: id: description: The public ID of the test. example: abc-def-123 type: string type: description: Type of the related resource. example: test type: string type: object SyntheticsTestResultRelationships: description: Relationships for a Synthetic test result. properties: test: $ref: "#/components/schemas/SyntheticsTestResultRelationshipTest" type: object SyntheticsTestResultRequestInfo: description: Details of the outgoing request made during the test execution. properties: allow_insecure: description: Whether insecure certificates are allowed for this request. example: false type: boolean body: description: Body sent with the request. example: '{"key":"value"}' type: string call_type: description: gRPC call type (for example, `unary`, `healthCheck`, or `reflection`). example: unary type: string destination_service: description: Destination service for a Network Path test. example: my-service type: string dns_server: description: DNS server used to resolve the target host. example: 8.8.8.8 type: string dns_server_port: description: Port of the DNS server used for resolution. example: 53 format: int64 type: integer e2e_queries: description: Number of end-to-end probe queries issued. example: 4 format: int64 type: integer files: description: Files attached to the request. items: $ref: "#/components/schemas/SyntheticsTestResultFileRef" type: array headers: additionalProperties: {} description: Headers sent with the request. example: content-type: application/json type: object host: description: Host targeted by the request. example: grpcbin.test.k6.io type: string max_ttl: description: Maximum TTL for network probe packets. example: 64 format: int64 type: integer message: description: Message sent with the request (for WebSocket/TCP/UDP tests). example: My message type: string method: description: HTTP method used for the request. example: GET type: string no_saving_response_body: description: Whether the response body was not saved. example: true type: boolean port: description: Port targeted by the request. Can be a number or a string variable reference. example: 9000 service: description: Service name targeted by the request (for gRPC tests). example: addsvc.Add type: string source_service: description: Source service for a Network Path test. example: synthetics type: string timeout: description: Request timeout in milliseconds. example: 60 format: int64 type: integer tool_name: description: Name of the MCP tool called (MCP tests only). example: search type: string traceroute_queries: description: Number of traceroute probe queries issued. example: 2 format: int64 type: integer url: description: URL targeted by the request. example: https://httpbin.org/anything/lol valuehugo type: string type: object SyntheticsTestResultResponse: description: Response object for a Synthetic test result. properties: data: $ref: "#/components/schemas/SyntheticsTestResultData" included: description: Array of included related resources, such as the test definition. items: $ref: "#/components/schemas/SyntheticsTestResultIncludedItem" type: array type: object SyntheticsTestResultResponseInfo: description: Details of the response received during the test execution. properties: body: description: Body of the response. example: '{"status":"ok"}' type: string body_compressed: description: Compressed representation of the response body. example: eJzLSM3JyQcABiwCFQ== type: string body_hashes: description: Hashes computed over the response body. example: 9e107d9d372bb6826bd81d3542a419d6 type: string body_size: description: Size of the response body in bytes. example: 793 format: int64 type: integer cache_headers: additionalProperties: type: string description: Cache-related response headers. example: server: gunicorn/19.9.0 type: object cdn: $ref: "#/components/schemas/SyntheticsTestResultCdnProviderInfo" close: $ref: "#/components/schemas/SyntheticsTestResultWebSocketClose" compressed_message: description: Compressed representation of the response message. example: eJzLSM3JyQcABiwCFQ== type: string headers: additionalProperties: {} description: Response headers. example: content-type: application/json type: object healthcheck: $ref: "#/components/schemas/SyntheticsTestResultHealthCheck" http_version: description: HTTP version of the response. example: "2.0" type: string is_body_truncated: description: Whether the response body was truncated. example: false type: boolean is_message_truncated: description: Whether the response message was truncated. example: false type: boolean message: description: Message received in the response (for WebSocket/TCP/UDP tests). example: '{"f_string":"concat-STATIC_HIDDEN_VALUE"}' type: string metadata: additionalProperties: type: string description: Additional metadata returned with the response. type: object records: description: DNS records returned in the response (DNS tests only). items: $ref: "#/components/schemas/SyntheticsTestResultDnsRecord" type: array redirects: description: Redirect hops encountered while performing the request. items: $ref: "#/components/schemas/SyntheticsTestResultRedirect" type: array status_code: description: HTTP status code of the response. example: 200 format: int64 type: integer type: object SyntheticsTestResultRouter: description: A router along the traceroute path. properties: ip: description: IP address of the router. example: 34.95.79.70 type: string resolved_host: description: Resolved hostname of the router. example: 70.79.95.34.bc.googleusercontent.com type: string type: object SyntheticsTestResultRumContext: description: RUM application context associated with a step or sub-test. properties: application_id: description: RUM application identifier. example: 00000000-0000-0000-0000-000000000000 type: string session_id: description: RUM session identifier. example: 11111111-1111-1111-1111-111111111111 type: string view_id: description: RUM view identifier. example: 22222222-2222-2222-2222-222222222222 type: string type: object SyntheticsTestResultRunType: description: The type of run for a Synthetic test result. enum: - scheduled - fast - ci - triggered example: scheduled type: string x-enum-varnames: - SCHEDULED - FAST - CI - TRIGGERED SyntheticsTestResultStatus: description: Status of a Synthetic test result. enum: - passed - failed - no_data example: passed type: string x-enum-varnames: - PASSED - FAILED - NO_DATA SyntheticsTestResultStep: description: A step result from a browser, mobile, or multistep API test. properties: allow_failure: description: Whether the test continues when this step fails. example: false type: boolean api_test: additionalProperties: {} description: Inner API test definition for browser `runApiTest` steps. type: object assertion_result: $ref: "#/components/schemas/SyntheticsTestResultStepAssertionResult" assertions: description: Assertion results produced by the step. items: $ref: "#/components/schemas/SyntheticsTestResultAssertionResult" type: array blocked_requests_urls: description: URLs of requests blocked during the step. items: description: Blocked request URL. type: string type: array bounds: $ref: "#/components/schemas/SyntheticsTestResultBounds" browser_errors: description: Browser errors captured during the step. items: $ref: "#/components/schemas/SyntheticsTestResultBrowserError" type: array bucket_keys: $ref: "#/components/schemas/SyntheticsTestResultBucketKeys" cdn_resources: description: CDN resources encountered during the step. items: $ref: "#/components/schemas/SyntheticsTestResultCdnResource" type: array click_type: description: Click type performed in a browser step. example: primary type: string compressed_json_descriptor: description: Compressed JSON descriptor for the step (internal format). example: compressedJsonDescriptorValue type: string config: additionalProperties: {} description: Request configuration executed by this step (API test steps). type: object description: description: Human-readable description of the step. example: Navigate to start URL type: string duration: description: Duration of the step in milliseconds. example: 1015.0 format: double type: number element_description: description: Description of the element interacted with by the step. example: '' type: string element_updates: $ref: "#/components/schemas/SyntheticsTestResultStepElementUpdates" extracted_value: $ref: "#/components/schemas/SyntheticsTestResultVariable" failure: $ref: "#/components/schemas/SyntheticsTestResultFailure" http_results: description: HTTP results produced by an MCP step. items: $ref: "#/components/schemas/SyntheticsTestResultAssertionResult" type: array id: description: Identifier of the step. example: fkk-j2a-gmw type: string is_critical: description: Whether this step is critical for the test outcome. example: true type: boolean javascript_custom_assertion_code: description: Whether the step uses a custom JavaScript assertion. example: false type: boolean locate_element_duration: description: Time taken to locate the element in milliseconds. example: 845.0 format: double type: number name: description: Name of the step. example: Extract variable from body type: string request: $ref: "#/components/schemas/SyntheticsTestResultRequestInfo" response: $ref: "#/components/schemas/SyntheticsTestResultResponseInfo" retries: description: Retry results for the step. items: $ref: "#/components/schemas/SyntheticsTestResultStep" type: array retry_count: description: Number of times this step was retried. example: 0 format: int64 type: integer rum_context: $ref: "#/components/schemas/SyntheticsTestResultRumContext" started_at: description: Unix timestamp (ms) of when the step started. example: 1724445283308 format: int64 type: integer status: description: Status of the step (for example, `passed`, `failed`). example: passed type: string sub_step: $ref: "#/components/schemas/SyntheticsTestResultSubStep" sub_test: $ref: "#/components/schemas/SyntheticsTestResultSubTest" subtype: description: Subtype of the step. example: http type: string tabs: description: Browser tabs involved in the step. items: $ref: "#/components/schemas/SyntheticsTestResultTab" type: array timings: additionalProperties: {} description: Timing breakdown of the step execution. type: object tunnel: description: Whether the step was executed through a Synthetics tunnel. example: false type: boolean type: description: Type of the step (for example, `click`, `assertElementContent`, `runApiTest`). example: click type: string url: description: URL associated with the step (for navigation steps). example: http://34.95.79.70/prototype type: string value: description: Step value. Its type depends on the step type. example: http://34.95.79.70/prototype variables: $ref: "#/components/schemas/SyntheticsTestResultVariables" vitals_metrics: description: Web vitals metrics captured during the step. items: $ref: "#/components/schemas/SyntheticsTestResultVitalsMetrics" type: array warnings: description: Warnings emitted during the step. items: $ref: "#/components/schemas/SyntheticsTestResultWarning" type: array type: object SyntheticsTestResultStepAssertionResult: description: Assertion result for a browser or mobile step. properties: actual: description: Actual value observed during the step assertion. Its type depends on the check type. example: "True\ngood\ngood\ngood\ngood\nTrue" check_type: description: Type of the step assertion check. example: contains type: string expected: description: Expected value for the step assertion. Its type depends on the check type. example: True good good good good True has_secure_variables: description: Whether the assertion involves secure variables. example: false type: boolean type: object SyntheticsTestResultStepElementUpdates: description: Element locator updates produced during a step. properties: multi_locator: additionalProperties: type: string description: Updated multi-locator definition. type: object target_outer_html: description: Updated outer HTML of the targeted element. example:

My website - v4

type: string version: description: Version of the element locator definition. example: 3 format: int64 type: integer type: object SyntheticsTestResultStepsInfo: description: Step execution summary for a Synthetic test result. properties: completed: description: Number of completed steps. example: 6 format: int64 type: integer errors: description: Number of steps with errors. example: 0 format: int64 type: integer total: description: Total number of steps. example: 6 format: int64 type: integer type: object SyntheticsTestResultSubStep: description: Information about a sub-step in a nested test execution. properties: level: description: Depth of the sub-step in the execution tree. example: 1 format: int64 type: integer parent_step: $ref: "#/components/schemas/SyntheticsTestResultParentStep" parent_test: $ref: "#/components/schemas/SyntheticsTestResultParentTest" type: object SyntheticsTestResultSubTest: description: Information about a sub-test played from a parent browser test. properties: id: description: Identifier of the sub-test. example: abc-def-123 type: string playing_tab: description: Index of the browser tab playing the sub-test. example: 0 format: int64 type: integer rum_context: $ref: "#/components/schemas/SyntheticsTestResultRumContext" type: object SyntheticsTestResultSummaryAttributes: description: Attributes of a Synthetic test result summary. properties: device: $ref: "#/components/schemas/SyntheticsTestResultDevice" execution_info: $ref: "#/components/schemas/SyntheticsTestResultExecutionInfo" finished_at: description: Timestamp of when the test finished (in milliseconds). format: int64 type: integer location: $ref: "#/components/schemas/SyntheticsTestResultLocation" run_type: $ref: "#/components/schemas/SyntheticsTestResultRunType" started_at: description: Timestamp of when the test started (in milliseconds). format: int64 type: integer status: $ref: "#/components/schemas/SyntheticsTestResultStatus" steps_info: $ref: "#/components/schemas/SyntheticsTestResultStepsInfo" test_sub_type: $ref: "#/components/schemas/SyntheticsTestSubType" test_type: $ref: "#/components/schemas/SyntheticsTestType" type: object SyntheticsTestResultSummaryData: description: Wrapper object for a Synthetic test result summary. properties: attributes: $ref: "#/components/schemas/SyntheticsTestResultSummaryAttributes" id: description: The result ID. example: "5158904793181869365" type: string relationships: $ref: "#/components/schemas/SyntheticsTestResultRelationships" type: $ref: "#/components/schemas/SyntheticsTestResultSummaryType" type: object SyntheticsTestResultSummaryType: default: "result_summary" description: Type of the Synthetic test result summary resource, `result_summary`. enum: - result_summary example: result_summary type: string x-enum-varnames: - RESULT_SUMMARY SyntheticsTestResultTab: description: Information about a browser tab involved in a step. properties: focused: description: Whether the tab was focused during the step. example: true type: boolean title: description: Title of the tab. example: Team Browser mini-websites type: string url: description: URL loaded in the tab. example: http://34.95.79.70/prototype type: string type: object SyntheticsTestResultTrace: description: Trace identifiers associated with a Synthetic test result. properties: id: description: Datadog APM trace identifier. example: "5513046492231128177" type: string otel_id: description: OpenTelemetry trace identifier. example: d8ba00eb1507bdba8643ba8e7a1c022c type: string type: object SyntheticsTestResultTracerouteHop: description: A network probe result, used for traceroute hops and ping summaries. properties: host: description: Target hostname. example: 34.95.79.70 type: string latency: $ref: "#/components/schemas/SyntheticsTestResultNetworkLatency" packet_loss_percentage: description: Percentage of probe packets lost. example: 0.0 format: double type: number packet_size: description: Size of each probe packet in bytes. example: 56 format: int64 type: integer packets_received: description: Number of probe packets received. example: 4 format: int64 type: integer packets_sent: description: Number of probe packets sent. example: 4 format: int64 type: integer resolved_ip: description: Resolved IP address for the target. example: 34.95.79.70 type: string routers: description: List of intermediate routers for the traceroute. items: $ref: "#/components/schemas/SyntheticsTestResultRouter" type: array type: object SyntheticsTestResultTurn: description: A turn in a goal-based browser test, grouping steps and reasoning. properties: bucket_keys: $ref: "#/components/schemas/SyntheticsTestResultBucketKeys" name: description: Name of the turn. example: Turn 1 type: string reasoning: description: Agent reasoning produced for this turn. example: I need to navigate to the chairs section type: string status: description: Status of the turn (for example, `passed`, `failed`). example: passed type: string steps: description: Steps executed during the turn. items: $ref: "#/components/schemas/SyntheticsTestResultTurnStep" type: array turn_finished_at: description: Unix timestamp (ms) of when the turn finished. example: 1724521438800 format: int64 type: integer turn_started_at: description: Unix timestamp (ms) of when the turn started. example: 1724521436800 format: int64 type: integer type: object SyntheticsTestResultTurnStep: description: A step executed during a goal-based browser test turn. properties: bucket_keys: $ref: "#/components/schemas/SyntheticsTestResultBucketKeys" config: additionalProperties: {} description: Browser step configuration for this turn step. example: id: step-1 name: Click on div "Chairs" type: click type: object type: object SyntheticsTestResultType: default: "result" description: Type of the Synthetic test result resource, `result`. enum: - result example: result type: string x-enum-varnames: - RESULT SyntheticsTestResultVariable: description: A variable used or extracted during a test. properties: err: description: Error encountered when evaluating the variable. example: LOCAL_VARIABLE_UNKNOWN type: string error_message: description: Human-readable error message for variable evaluation. example: Unknown variable name undefined. type: string example: description: Example value for the variable. example: lol value type: string id: description: Variable identifier. example: c896702c-1e34-4e62-a67b-432e8092d062 type: string name: description: Variable name. example: HEADER_VALUE type: string pattern: description: Pattern used to extract the variable. example: lol value type: string secure: description: Whether the variable holds a secure value. example: false type: boolean type: description: Variable type. example: text type: string val: description: Evaluated value of the variable. example: value-to-extract type: string value: description: Current value of the variable. example: lol value type: string type: object SyntheticsTestResultVariables: description: Variables captured during a test step. properties: config: description: Variables defined in the test configuration. items: $ref: "#/components/schemas/SyntheticsTestResultVariable" type: array extracted: description: Variables extracted during the test execution. items: $ref: "#/components/schemas/SyntheticsTestResultVariable" type: array type: object SyntheticsTestResultVitalsMetrics: description: Web vitals metrics captured during a browser test step. properties: cls: description: Cumulative Layout Shift score. example: 0.0 format: double type: number fcp: description: First Contentful Paint in milliseconds. example: 120.3 format: double type: number inp: description: Interaction to Next Paint in milliseconds. example: 85.0 format: double type: number lcp: description: Largest Contentful Paint in milliseconds. example: 210.5 format: double type: number ttfb: description: Time To First Byte in milliseconds. example: 95.2 format: double type: number url: description: URL that produced the metrics. example: http://34.95.79.70/prototype type: string type: object SyntheticsTestResultWarning: description: A warning captured during a browser test step. properties: element_bounds: description: Bounds of elements related to the warning. items: $ref: "#/components/schemas/SyntheticsTestResultBounds" type: array message: description: Warning message. example: Element is not visible in the viewport type: string type: description: Type of the warning. example: visibility type: string type: object SyntheticsTestResultWebSocketClose: description: WebSocket close frame information for WebSocket test responses. properties: reason: description: Reason string received in the close frame. example: Normal closure type: string status_code: description: Status code received in the close frame. example: 1000 format: int64 type: integer type: object SyntheticsTestSubType: description: Subtype of the Synthetic test that produced this result. enum: - dns - grpc - http - icmp - mcp - multi - ssl - tcp - udp - websocket example: http type: string x-enum-varnames: - DNS - GRPC - HTTP - ICMP - MCP - MULTI - SSL - TCP - UDP - WEBSOCKET SyntheticsTestType: description: Type of the Synthetic test that produced this result. enum: - api - browser - mobile - network example: api type: string x-enum-varnames: - API - BROWSER - MOBILE - NETWORK SyntheticsTestVersionActionMetadata: description: Object containing metadata about a change action. properties: after_value: description: The value of the property after the change. before_value: description: The value of the property before the change. diff_patches: description: List of diff patches for text changes. items: $ref: "#/components/schemas/SyntheticsTestVersionDiffPatches" nullable: true type: array property_path: description: The dot-separated path of the property that was changed. type: string type: object SyntheticsTestVersionAttributes: description: Attributes of a specific Synthetic test version. properties: author: $ref: "#/components/schemas/SyntheticsTestVersionAuthor" change_metadata: description: |- List of metadata describing individual changes in this version. Only returned when the `include_change_metadata` query parameter is `true`. items: $ref: "#/components/schemas/SyntheticsTestVersionChangeMetadataItem" type: array payload: additionalProperties: {} description: The full test configuration at this version. type: object version_payload_created_at: description: Timestamp of when this version was created. example: "2024-01-01T00:00:00+00:00" format: date-time type: string type: object SyntheticsTestVersionAuthor: description: Object describing the author of a test version. properties: email: description: Email address of the author. example: john.doe@example.com type: string handle: description: The author's Datadog handle (login username). example: john.doe type: string id: description: UUID of the author. example: "00000000-0000-0000-0000-000000000000" type: string name: description: Display name of the author. example: John Doe type: string type: object SyntheticsTestVersionChangeAttributes: description: Attributes of a version change record. properties: author_uuid: description: UUID of the user who created this version. example: "00000000-0000-0000-0000-000000000000" type: string change_metadata: description: List of metadata describing individual changes in this version. items: $ref: "#/components/schemas/SyntheticsTestVersionChangeMetadataItem" type: array version_number: description: The sequential version number. example: 5 format: int64 type: integer version_payload_created_at: description: Timestamp of when this version was created. example: "2024-01-01T00:00:00+00:00" format: date-time type: string type: object SyntheticsTestVersionChangeData: description: Data object for a version change record. properties: attributes: $ref: "#/components/schemas/SyntheticsTestVersionChangeAttributes" id: description: UUID of the version change record. example: "00000000-0000-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/SyntheticsTestVersionChangeType" type: object SyntheticsTestVersionChangeMetadataItem: description: Object describing a single change within a version. properties: action: description: The action that was performed (for example, `updated` or `created`). type: string action_metadata: $ref: "#/components/schemas/SyntheticsTestVersionActionMetadata" type: object SyntheticsTestVersionChangeType: default: version_metadata description: Type of the version metadata resource. enum: - version_metadata example: version_metadata type: string x-enum-varnames: - VERSION_METADATA SyntheticsTestVersionData: description: Data object for a specific Synthetic test version. properties: attributes: $ref: "#/components/schemas/SyntheticsTestVersionAttributes" id: description: UUID of the version record. example: "00000000-0000-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/SyntheticsTestVersionType" type: object SyntheticsTestVersionDiffPatchDiff: description: Object describing a single text diff operation. properties: change_text: description: The text that was changed. type: string operation: description: The diff operation applied. type: string type: object SyntheticsTestVersionDiffPatches: description: Object describing a patch in the diff. properties: diffs: description: List of individual diff operations. items: $ref: "#/components/schemas/SyntheticsTestVersionDiffPatchDiff" type: array length1: description: Length of the original text segment. format: int64 type: integer length2: description: Length of the modified text segment. format: int64 type: integer start1: description: Start position in the original text. format: int64 type: integer start2: description: Start position in the modified text. format: int64 type: integer type: object SyntheticsTestVersionHistoryMeta: description: Pagination metadata for a version history response. properties: next_last_version_number: description: |- The version number to use as the `last_version_number` query parameter to fetch the next page. `null` indicates there are no more pages. example: 3 format: int64 nullable: true type: integer retention_period_in_days: description: The number of days that version history is retained. example: 30 format: int64 type: integer type: object SyntheticsTestVersionHistoryResponse: description: Response containing the paginated version history for a Synthetic test. properties: data: description: List of version change records. items: $ref: "#/components/schemas/SyntheticsTestVersionChangeData" type: array meta: $ref: "#/components/schemas/SyntheticsTestVersionHistoryMeta" type: object SyntheticsTestVersionResponse: description: Response containing a specific version of a Synthetic test. properties: data: $ref: "#/components/schemas/SyntheticsTestVersionData" type: object SyntheticsTestVersionType: default: version description: Type of the version resource. enum: - version example: version type: string x-enum-varnames: - VERSION SyntheticsVariableParser: description: Details of the parser to use for the global variable. example: type: regex value: .* properties: type: $ref: "#/components/schemas/SyntheticsGlobalVariableParserType" value: description: Regex or JSON path used for the parser. Not used with type `raw`. type: string required: - type type: object TableResultV2: description: A reference table resource containing its full configuration and state. example: data: attributes: created_by: 00000000-0000-0000-0000-000000000000 description: example description file_metadata: access_details: aws_detail: aws_account_id: "123456789000" aws_bucket_name: "my-bucket" file_path: "path/to/file.csv" sync_enabled: true last_updated_by: 00000000-0000-0000-0000-000000000000 row_count: 5 schema: fields: - name: id type: INT32 - name: name type: STRING primary_keys: - id source: S3 status: DONE table_name: test_reference_table tags: - tag1 - tag2 updated_at: "2000-01-01T01:00:00+00:00" id: 00000000-0000-0000-0000-000000000000 type: reference_table properties: data: $ref: "#/components/schemas/TableResultV2Data" type: object TableResultV2Array: description: List of reference tables. example: data: - attributes: created_by: 00000000-0000-0000-0000-000000000000 description: example description file_metadata: access_details: {} error_message: "" error_row_count: 0 upload_id: 00000000-0000-0000-0000-000000000000 last_updated_by: "" row_count: 5 schema: fields: - name: id type: INT32 - name: name type: STRING primary_keys: - id source: LOCAL_FILE status: DONE table_name: test_reference_table tags: - tag1 - tag2 updated_at: "2000-01-01T01:00:00+00:00" id: 00000000-0000-0000-0000-000000000000 type: reference_table - attributes: created_by: 00000000-0000-0000-0000-000000000000 description: example description file_metadata: access_details: aws_detail: aws_account_id: test-account-id aws_bucket_name: test-bucket file_path: test_rt.csv error_message: "" error_row_count: 0 sync_enabled: true last_updated_by: 00000000-0000-0000-0000-000000000000 row_count: 5 schema: fields: - name: location type: STRING - name: file_name type: STRING primary_keys: - location source: S3 status: DONE table_name: test_reference_table_2 tags: - test_tag1 - tag2 - "3" updated_at: "2000-01-01T01:00:00+00:00" id: 00000000-0000-0000-0000-000000000000 type: reference_table properties: data: description: The reference tables. items: $ref: "#/components/schemas/TableResultV2Data" type: array required: - data type: object TableResultV2Data: additionalProperties: false description: The data object containing the reference table configuration and state. properties: attributes: $ref: "#/components/schemas/TableResultV2DataAttributes" id: description: Unique identifier for the reference table. type: string type: $ref: "#/components/schemas/TableResultV2DataType" required: - type type: object TableResultV2DataAttributes: description: Attributes that define the reference table's configuration and properties. properties: created_by: description: UUID of the user who created the reference table. example: "00000000-0000-0000-0000-000000000000" type: string description: description: Optional text describing the purpose or contents of this reference table. example: "example description" type: string file_metadata: $ref: "#/components/schemas/TableResultV2DataAttributesFileMetadata" last_updated_by: description: UUID of the user who last updated the reference table. example: "00000000-0000-0000-0000-000000000000" type: string row_count: description: The number of successfully processed rows in the reference table. example: 5 format: int64 type: integer schema: $ref: "#/components/schemas/TableResultV2DataAttributesSchema" source: $ref: "#/components/schemas/ReferenceTableSourceType" status: description: The processing status of the table. example: "DONE" type: string table_name: description: Unique name to identify this reference table. Used in enrichment processors and API calls. example: "table_1" type: string tags: description: Tags for organizing and filtering reference tables. example: - "tag_1" - "tag_2" items: description: A tag associated with the reference table. type: string type: array updated_at: description: When the reference table was last updated, in ISO 8601 format. example: "2000-01-01T01:00:00+00:00" type: string type: object TableResultV2DataAttributesFileMetadata: additionalProperties: false description: |- Metadata specifying where and how to access the reference table's data file. For cloud storage tables (S3/GCS/Azure): - sync_enabled and access_details will always be present - error fields (error_message, error_row_count, error_type) are present only when errors occur For local file tables: - error fields (error_message, error_row_count) are present only when errors occur - sync_enabled, access_details are never present properties: access_details: $ref: "#/components/schemas/TableResultV2DataAttributesFileMetadataOneOfAccessDetails" description: Cloud storage access configuration. Only present for cloud storage sources (S3, GCS, Azure). error_message: description: >- The error message returned from the last operation (sync for cloud storage, upload for local file). type: string error_row_count: description: The number of rows that failed to process. format: int64 type: integer error_type: $ref: "#/components/schemas/TableResultV2DataAttributesFileMetadataCloudStorageErrorType" description: >- The type of error that occurred during file processing. Only applicable for cloud storage sources. sync_enabled: description: >- Whether this table is synced automatically from cloud storage. Only applicable for cloud storage sources. type: boolean title: FileMetadataV2 type: object TableResultV2DataAttributesFileMetadataCloudStorageErrorType: description: >- The type of error that occurred during file processing. This field provides high-level error categories for easier troubleshooting and is only present when there are errors. enum: - TABLE_SCHEMA_ERROR - FILE_FORMAT_ERROR - CONFIGURATION_ERROR - QUOTA_EXCEEDED - CONFLICT_ERROR - VALIDATION_ERROR - STATE_ERROR - OPERATION_ERROR - SYSTEM_ERROR type: string x-enum-varnames: - TABLE_SCHEMA_ERROR - FILE_FORMAT_ERROR - CONFIGURATION_ERROR - QUOTA_EXCEEDED - CONFLICT_ERROR - VALIDATION_ERROR - STATE_ERROR - OPERATION_ERROR - SYSTEM_ERROR TableResultV2DataAttributesFileMetadataOneOfAccessDetails: description: Cloud storage access configuration for the reference table data file. properties: aws_detail: $ref: "#/components/schemas/TableResultV2DataAttributesFileMetadataOneOfAccessDetailsAwsDetail" azure_detail: $ref: "#/components/schemas/TableResultV2DataAttributesFileMetadataOneOfAccessDetailsAzureDetail" gcp_detail: $ref: "#/components/schemas/TableResultV2DataAttributesFileMetadataOneOfAccessDetailsGcpDetail" type: object TableResultV2DataAttributesFileMetadataOneOfAccessDetailsAwsDetail: description: Amazon Web Services S3 storage access configuration. properties: aws_account_id: description: AWS account ID where the S3 bucket is located. example: "123456789000" type: string aws_bucket_name: description: S3 bucket containing the CSV file. example: "example-data-bucket" type: string file_path: description: The relative file path from the S3 bucket root to the CSV file. example: "reference-tables/users.csv" type: string type: object x-oneOf-parent: - AwsDetail TableResultV2DataAttributesFileMetadataOneOfAccessDetailsAzureDetail: description: Azure Blob Storage access configuration. properties: azure_client_id: description: Azure service principal (application) client ID with permissions to read from the container. example: "aaaaaaaa-1111-2222-3333-bbbbbbbbbbbb" type: string azure_container_name: description: Azure Blob Storage container containing the CSV file. example: "reference-data" type: string azure_storage_account_name: description: Azure storage account where the container is located. example: "examplestorageaccount" type: string azure_tenant_id: description: Azure Active Directory tenant ID. example: "cccccccc-4444-5555-6666-dddddddddddd" type: string file_path: description: The relative file path from the Azure container root to the CSV file. example: "tables/users.csv" type: string type: object x-oneOf-parent: - AzureDetail TableResultV2DataAttributesFileMetadataOneOfAccessDetailsGcpDetail: description: Google Cloud Platform storage access configuration. properties: file_path: description: The relative file path from the GCS bucket root to the CSV file. example: "data/reference_tables/users.csv" type: string gcp_bucket_name: description: GCP bucket containing the CSV file. example: "example-data-bucket" type: string gcp_project_id: description: GCP project ID where the bucket is located. example: "example-gcp-project-12345" type: string gcp_service_account_email: description: Service account email with read permissions for the GCS bucket. example: "example-service@example-gcp-project-12345.iam.gserviceaccount.com" type: string type: object x-oneOf-parent: - GcpDetail TableResultV2DataAttributesSchema: description: Schema defining the structure and columns of the reference table. properties: fields: description: The schema fields. Maximum of 200 columns. items: $ref: "#/components/schemas/TableResultV2DataAttributesSchemaFieldsItems" maxItems: 200 minItems: 1 type: array primary_keys: description: >- List of field names that serve as primary keys for the table. Only one primary key is supported, and it is used as an ID to retrieve rows. example: - "field_1" items: description: A field name used as a primary key. type: string type: array required: - fields - primary_keys type: object TableResultV2DataAttributesSchemaFieldsItems: description: A single field (column) in the reference table schema to be returned. properties: name: description: The field name. example: "field_1" type: string type: $ref: "#/components/schemas/ReferenceTableSchemaFieldType" required: - name - type type: object TableResultV2DataType: default: reference_table description: Reference table resource type. enum: - reference_table example: reference_table type: string x-enum-varnames: - REFERENCE_TABLE TableRowResourceArray: description: List of rows from a reference table query, along with metadata about rows that were requested but not found. properties: data: description: The rows. items: $ref: "#/components/schemas/TableRowResourceData" type: array meta: $ref: "#/components/schemas/TableRowResourceArrayMeta" required: - data type: object TableRowResourceArrayMeta: description: Metadata about the rows requested, including which ones were not found. properties: found_count: description: Number of requested rows that were found and returned in `data`. example: 1 format: int64 type: integer not_found: description: Row IDs from the request that do not exist in the reference table. Empty when every requested row was found. example: - row_id_2 items: description: Row identifier, corresponding to the primary key value. type: string type: array requested_count: description: Number of row IDs supplied in the `row_id` query parameter. example: 2 format: int64 type: integer required: - requested_count - found_count - not_found type: object TableRowResourceData: additionalProperties: false description: The data object containing the row column names and values. properties: attributes: $ref: "#/components/schemas/TableRowResourceDataAttributes" id: description: Row identifier, corresponding to the primary key value. type: string type: $ref: "#/components/schemas/TableRowResourceDataType" required: - type type: object TableRowResourceDataAttributes: additionalProperties: false description: Column values for this row in the reference table. properties: values: description: Key-value pairs representing the row data, where keys are field names from the schema. type: object type: object TableRowResourceDataType: default: row description: Row resource type. enum: - row example: row type: string x-enum-varnames: - ROW TableRowResourceIdentifier: description: Row resource containing a single row identifier. properties: id: description: The primary key value that uniquely identifies the row to delete. example: "primary_key_value" type: string type: $ref: "#/components/schemas/TableRowResourceDataType" required: - type - id type: object TagData: description: A tag resource associated with an app. properties: id: description: The name of the tag. example: production type: string type: $ref: "#/components/schemas/TagDataType" required: - id - type type: object TagDataType: description: The resource type for a tag. enum: - tag example: tag minLength: 3 type: string x-enum-varnames: - TAG TagIndexingRuleAttributes: description: Attributes of a tag indexing rule. properties: created_at: description: Timestamp when the rule was created. example: "2024-01-15T12:00:00.000Z" format: date-time readOnly: true type: string created_by_handle: description: Handle of the user who created the rule. example: user@datadoghq.com readOnly: true type: string exclude_tags_mode: description: >- When true, the rule excludes the listed tags and indexes all others. When false (default), the rule includes only the listed tags. example: false type: boolean ignored_metric_name_matches: description: Metric name prefixes excluded from the rule's scope. example: - "dd.test.excluded.*" items: type: string type: array metric_name_matches: description: Metric name prefixes (glob patterns) this rule applies to. example: - "dd.test.*" items: type: string type: array modified_at: description: Timestamp when the rule was last modified. example: "2024-01-15T12:00:00.000Z" format: date-time readOnly: true type: string modified_by_handle: description: Handle of the user who last modified the rule. example: user@datadoghq.com readOnly: true type: string name: description: Human-readable name for the rule. example: my-indexing-rule type: string options: $ref: "#/components/schemas/TagIndexingRuleOptions" rule_order: description: >- Evaluation order within the org. Lower values are evaluated first. Assigned server-side on create (max+1); pass on update to change the rule's position. example: 1 format: int64 readOnly: true type: integer tags: description: Tag keys managed by this rule. example: - env - service items: type: string type: array type: object TagIndexingRuleCreateAttributes: description: Attributes for creating a tag indexing rule. properties: exclude_tags_mode: description: >- When true, the rule excludes the listed tags and indexes all others. When false (default), the rule includes only the listed tags. example: false type: boolean ignored_metric_name_matches: description: Metric name prefixes excluded from the rule's scope. items: type: string type: array metric_name_matches: description: Metric name prefixes (glob patterns) this rule applies to. example: - "dd.test.*" items: type: string type: array name: description: Human-readable name for the rule. example: my-indexing-rule type: string options: $ref: "#/components/schemas/TagIndexingRuleOptions" tags: description: Tag keys managed by this rule. example: - env - service items: type: string type: array required: - name - metric_name_matches type: object TagIndexingRuleCreateData: description: Data object for creating a tag indexing rule. properties: attributes: $ref: "#/components/schemas/TagIndexingRuleCreateAttributes" type: $ref: "#/components/schemas/TagIndexingRuleType" required: - type - attributes type: object TagIndexingRuleCreateRequest: description: Request body for creating a tag indexing rule. properties: data: $ref: "#/components/schemas/TagIndexingRuleCreateData" required: - data type: object TagIndexingRuleData: description: A tag indexing rule resource object. properties: attributes: $ref: "#/components/schemas/TagIndexingRuleAttributes" id: description: The unique identifier (UUID) of the tag indexing rule. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/TagIndexingRuleType" type: object TagIndexingRuleDynamicTags: description: |- Options for dynamic tag indexing applied per metric, such as tags filtered by query usage. Before a tag key is dropped by this rule, two grace period conditions must be met: 1. The metric must be submitted for at least as long as the selected window. 2. A tag key must have been submitted for at least 15 days. Any metric or tag key that does not meet these conditions are excluded from this indexing rule. The `exclude_not_*` fields require `exclude_tags_mode` to be set to `true`. properties: exclude_not_queried_window_seconds: description: >- Tags that have not been queried within this window are excluded from indexing. Maximum of `7776000` (90 days). example: 3600 format: int64 maximum: 7776000 type: integer exclude_not_used_in_assets: description: >- Tags not used in any dashboards, monitors, notebooks, or SLOs are excluded from indexing. example: false type: boolean type: object TagIndexingRuleExemptionAttributes: description: Attributes of a tag indexing rule exemption. properties: created_at: description: Timestamp when the exemption was created. example: "2024-01-15T12:00:00.000Z" format: date-time readOnly: true type: string created_by_handle: description: Handle of the user who created the exemption. example: user@datadoghq.com readOnly: true type: string estimated_change_in_volume: description: |- Estimated change in indexed cardinality or points if the exemption is removed and the matching tag indexing rule applies to the metric. A negative value indicates a reduction in indexed volume, a positive value indicates an increase, and zero indicates no change. A `null` value indicates that the estimate is unavailable. example: 45 format: int64 nullable: true readOnly: true type: integer kind: description: >- Discriminates between an explicit exemption (`exemption`) and a pre-existing legacy tag configuration acting as an implicit exclusion (`legacy_tag_configuration`). example: exemption type: string missing_indexed_tags: description: |- Tag keys used to query this metric in monitors, dashboards, notebooks, and SLOs that the matching rule would remove or not include if the exemption is removed. example: - service items: type: string readOnly: true type: array reason: description: The reason the metric is exempt from tag indexing rules. example: This metric has a pre-existing tag configuration. type: string volume_status: $ref: "#/components/schemas/TagIndexingRuleExemptionVolumeStatus" type: object TagIndexingRuleExemptionCreateAttributes: description: Attributes for creating a tag indexing rule exemption. properties: reason: description: The reason the metric is exempt from tag indexing rules. example: This metric has a pre-existing tag configuration. type: string required: - reason type: object TagIndexingRuleExemptionCreateData: description: Data object for creating a tag indexing rule exemption. properties: attributes: $ref: "#/components/schemas/TagIndexingRuleExemptionCreateAttributes" type: $ref: "#/components/schemas/TagIndexingRuleExemptionType" required: - type - attributes type: object TagIndexingRuleExemptionCreateRequest: description: Request body for creating a tag indexing rule exemption. properties: data: $ref: "#/components/schemas/TagIndexingRuleExemptionCreateData" required: - data type: object TagIndexingRuleExemptionData: description: A tag indexing rule exemption resource object. properties: attributes: $ref: "#/components/schemas/TagIndexingRuleExemptionAttributes" id: description: The metric name, used as the resource ID. example: dd.test.metric type: string type: $ref: "#/components/schemas/TagIndexingRuleExemptionType" type: object TagIndexingRuleExemptionResponse: description: Response containing a tag indexing rule exemption. properties: data: $ref: "#/components/schemas/TagIndexingRuleExemptionData" readOnly: true type: object TagIndexingRuleExemptionSort: default: estimated_change_in_volume description: Sort field for tag indexing rule exemptions. enum: - name - -name - estimated_change_in_volume - -estimated_change_in_volume example: estimated_change_in_volume type: string x-enum-varnames: - NAME - NAME_DESCENDING - ESTIMATED_CHANGE_IN_VOLUME - ESTIMATED_CHANGE_IN_VOLUME_DESCENDING TagIndexingRuleExemptionType: default: tag_indexing_rule_exemptions description: The tag indexing rule exemption resource type. enum: - tag_indexing_rule_exemptions example: tag_indexing_rule_exemptions type: string x-enum-varnames: - TAG_INDEXING_RULE_EXEMPTIONS TagIndexingRuleExemptionUpdateAttributes: description: Attributes for updating a tag indexing rule exemption. properties: reason: description: The updated reason the metric is exempt from tag indexing rules. example: This metric must remain exempt because of its query requirements. type: string required: - reason type: object TagIndexingRuleExemptionUpdateData: description: Data object for updating a tag indexing rule exemption. properties: attributes: $ref: "#/components/schemas/TagIndexingRuleExemptionUpdateAttributes" type: $ref: "#/components/schemas/TagIndexingRuleExemptionType" required: - type - attributes type: object TagIndexingRuleExemptionUpdateRequest: description: Request body for updating a tag indexing rule exemption. properties: data: $ref: "#/components/schemas/TagIndexingRuleExemptionUpdateData" required: - data type: object TagIndexingRuleExemptionVolumeStatus: description: |- Indicates whether `estimated_change_in_volume` is available and, if not, why. `ok` indicates a fresh estimate. `unindexed_tags` indicates that the matching rule uses tags that are not indexed for the metric. `unavailable` indicates that the estimate is stale, was not computed, or could not be retrieved. enum: - ok - unindexed_tags - unavailable example: unavailable readOnly: true type: string x-enum-varnames: - OK - UNINDEXED_TAGS - UNAVAILABLE TagIndexingRuleExemptionsResponse: description: Response containing a page of tag indexing rule exemptions. properties: data: description: Array of tag indexing rule exemption objects. items: $ref: "#/components/schemas/TagIndexingRuleExemptionData" type: array links: $ref: "#/components/schemas/MetricsListResponseLinks" meta: $ref: "#/components/schemas/MetricPaginationMeta" readOnly: true type: object TagIndexingRuleMetricMatch: description: Criteria for matching metrics based on query state. properties: is_queried: description: Match metrics that are being queried. type: boolean not_queried: description: Match metrics that are not being queried. type: boolean not_used_in_assets: description: Match metrics not used in any dashboards or monitors. type: boolean queried_window_seconds: description: Window in seconds for evaluating query state. example: 3600 format: int64 type: integer used_in_assets: description: Match metrics used in dashboards or monitors. type: boolean type: object TagIndexingRuleOptions: description: Versioned configuration options for a tag indexing rule. properties: data: $ref: "#/components/schemas/TagIndexingRuleOptionsData" version: description: Options schema version. Only `1` is supported. example: 1 format: int64 type: integer type: object TagIndexingRuleOptionsData: description: Data payload for tag indexing rule options. properties: dynamic_tags: $ref: "#/components/schemas/TagIndexingRuleDynamicTags" manage_preexisting_metrics: description: >- When true, the rule applies to metrics that were ingested before the rule was created. example: true type: boolean metric_match: $ref: "#/components/schemas/TagIndexingRuleMetricMatch" override_previous_rules: description: >- When true, this rule's tag list overrides tags configured by earlier rules for the same metric. When false (default), tags from all matching rules are combined. example: false type: boolean type: object TagIndexingRuleOrderAttributes: description: Attributes for the reorder operation. properties: rule_ids: description: >- Ordered list of tag indexing rule UUIDs. The server assigns rule_order 1, 2, … matching position in this list. example: - "00000000-0000-0000-0000-000000000001" - "00000000-0000-0000-0000-000000000002" items: type: string type: array type: object TagIndexingRuleOrderData: description: Data object for the reorder operation. properties: attributes: $ref: "#/components/schemas/TagIndexingRuleOrderAttributes" type: $ref: "#/components/schemas/TagIndexingRuleType" required: - type - attributes type: object TagIndexingRuleOrderRequest: description: Request body for reordering tag indexing rules. properties: data: $ref: "#/components/schemas/TagIndexingRuleOrderData" required: - data type: object TagIndexingRuleResponse: description: Response containing a single tag indexing rule. properties: data: $ref: "#/components/schemas/TagIndexingRuleData" readOnly: true type: object TagIndexingRuleType: default: tag_indexing_rules description: The tag indexing rule resource type. enum: - tag_indexing_rules example: tag_indexing_rules type: string x-enum-varnames: - TAG_INDEXING_RULES TagIndexingRuleUpdateAttributes: description: Attributes for updating a tag indexing rule. All fields are optional; omitted fields are unchanged. properties: exclude_tags_mode: description: >- When true, the rule excludes the listed tags and indexes all others. type: boolean ignored_metric_name_matches: description: Metric name prefixes excluded from the rule's scope. items: type: string type: array metric_name_matches: description: Metric name prefixes (glob patterns) this rule applies to. example: - "dd.test.*" items: type: string type: array name: description: Human-readable name for the rule. example: my-indexing-rule type: string options: $ref: "#/components/schemas/TagIndexingRuleOptions" rule_order: description: >- Desired evaluation order. Returns 409 if the value conflicts with another rule; use POST /api/v2/metrics/tag-indexing-rules/order for atomic re-sequencing. example: 2 format: int64 type: integer tags: description: Tag keys managed by this rule. example: - env - service items: type: string type: array type: object TagIndexingRuleUpdateData: description: Data object for updating a tag indexing rule. properties: attributes: $ref: "#/components/schemas/TagIndexingRuleUpdateAttributes" type: $ref: "#/components/schemas/TagIndexingRuleType" required: - type type: object TagIndexingRuleUpdateRequest: description: Request body for updating a tag indexing rule. properties: data: $ref: "#/components/schemas/TagIndexingRuleUpdateData" required: - data type: object TagIndexingRulesResponse: description: Response containing a page of tag indexing rules. properties: data: description: Array of tag indexing rule objects. items: $ref: "#/components/schemas/TagIndexingRuleData" type: array links: $ref: "#/components/schemas/MetricsListResponseLinks" meta: $ref: "#/components/schemas/TagIndexingRulesResponseMeta" readOnly: true type: object TagIndexingRulesResponseMeta: description: Pagination metadata for a list of tag indexing rules. properties: total: description: Total number of tag indexing rules in the org. example: 5 format: int64 type: integer type: object TagRuleAttributes: description: The attributes of a tag rule resource. properties: created_at: description: The RFC 3339 timestamp at which the rule was created. example: "2026-05-21T22:11:06.108696Z" format: date-time type: string created_by: description: The identifier of the user who created the rule. example: "test-user" type: string deleted_at: description: The RFC 3339 timestamp at which the rule was soft-deleted. `null` if the rule has not been deleted. Only present when `include_deleted=true` is requested. format: date-time nullable: true type: string deleted_by: description: The identifier of the user who soft-deleted the rule. `null` if the rule has not been deleted. nullable: true type: string enabled: description: Whether the rule is currently enforced. example: true type: boolean modified_at: description: The RFC 3339 timestamp at which the rule was last modified. example: "2026-05-21T22:11:06.108696Z" format: date-time type: string modified_by: description: The identifier of the user who last modified the rule. example: "test-user" type: string name: description: Human-readable name for the tag rule. example: "Service tag must be one of api or web" type: string negated: description: When `true`, the rule matches tag values that do NOT match any of the supplied patterns. example: false type: boolean required: description: When `true`, telemetry without this tag is treated as a violation. example: true type: boolean rule_type: $ref: "#/components/schemas/TagRuleType" scope: description: The scope the rule applies within. example: "env" type: string source: $ref: "#/components/schemas/TagRuleSource" tag_key: description: The tag key that the rule governs. example: "service" type: string tag_value_patterns: description: The patterns that valid values for the tag key must match. example: - "api" - "web" items: description: A pattern that valid tag values must match. type: string type: array version: description: A monotonically increasing version counter that is incremented on each update. example: 1 format: int64 type: integer required: - name - source - scope - tag_key - tag_value_patterns - negated - required - enabled - rule_type - version - created_at - created_by - modified_at - modified_by type: object TagRuleCreateAttributes: description: Attributes that can be supplied when creating a tag rule. properties: enabled: description: Whether the rule is currently enforced. Defaults to `true` for newly created rules. example: true type: boolean name: description: Human-readable name for the tag rule. example: "Service tag must be one of api or web" type: string negated: description: When `true`, the rule matches tag values that do NOT match any of the supplied patterns. Defaults to `false`. example: false type: boolean required: description: When `true`, telemetry without this tag is treated as a violation. Defaults to `false`. example: true type: boolean rule_type: $ref: "#/components/schemas/TagRuleCreateType" scope: description: |- The scope the rule applies within. Typically an environment, team, or organization-level identifier used to limit where the rule is enforced. example: "env" type: string source: $ref: "#/components/schemas/TagRuleSource" tag_key: description: The tag key that the rule governs (for example, `service`). example: "service" type: string tag_value_patterns: description: |- One or more patterns that valid values for the tag key must match. At least one pattern is required. example: - "api" - "web" items: description: A pattern that valid tag values must match. type: string minItems: 1 type: array required: - name - source - scope - tag_key - tag_value_patterns - rule_type type: object TagRuleCreateData: description: Data object for creating a tag rule. properties: attributes: $ref: "#/components/schemas/TagRuleCreateAttributes" type: $ref: "#/components/schemas/TagRuleResourceType" required: - type - attributes type: object TagRuleCreateRequest: description: Payload for creating a new tag rule. properties: data: $ref: "#/components/schemas/TagRuleCreateData" required: - data type: object TagRuleCreateType: description: |- The rule type allowed when creating a tag rule. Only `surfacing` is accepted at creation time. enum: - surfacing example: "surfacing" type: string x-enum-varnames: - SURFACING TagRuleData: description: A tag rule resource. properties: attributes: $ref: "#/components/schemas/TagRuleAttributes" id: description: The unique identifier of the tag rule. example: "123" type: string relationships: $ref: "#/components/schemas/TagRuleRelationships" type: $ref: "#/components/schemas/TagRuleResourceType" required: - type - id - attributes type: object TagRuleDataArray: description: An array of tag rule data objects. items: $ref: "#/components/schemas/TagRuleData" type: array TagRuleInclude: description: A related resource to include alongside a tag rule in the response. Currently the only supported value is `score`. enum: - score example: "score" type: string x-enum-varnames: - SCORE TagRuleIncludedResources: description: Related resources fetched alongside the primary tag rules. Populated when an `include` query parameter is supplied. items: $ref: "#/components/schemas/TagRuleScoreData" type: array TagRuleRelationships: description: Related resources for a tag rule. Only present when the corresponding `include` query parameter is supplied. properties: score: $ref: "#/components/schemas/TagRuleScoreRelationship" type: object TagRuleResourceType: description: JSON:API resource type for a tag rule. enum: - tag_rule example: "tag_rule" type: string x-enum-varnames: - TAG_RULE TagRuleResponse: description: A single tag rule. properties: data: $ref: "#/components/schemas/TagRuleData" included: $ref: "#/components/schemas/TagRuleIncludedResources" required: - data type: object TagRuleScoreAttributes: description: Attributes of a tag rule compliance score. properties: score: description: |- The compliance score for the rule over the requested time window, as a percentage between 0 and 100. `null` indicates that no relevant telemetry was found. example: 80 format: double nullable: true type: number ts_end: description: End of the time window the score was computed over, as a Unix timestamp in milliseconds. example: 1779401466097 format: int64 type: integer ts_start: description: Start of the time window the score was computed over, as a Unix timestamp in milliseconds. example: 1779315066097 format: int64 type: integer version: description: The version of the tag rule that the score was computed against. example: 1 format: int64 type: integer required: - score - ts_start - ts_end - version type: object TagRuleScoreData: description: A compliance score resource for a tag rule. properties: attributes: $ref: "#/components/schemas/TagRuleScoreAttributes" id: description: The unique identifier of the compliance score resource. example: "123-v1-1779315066097-1779401466097" type: string type: $ref: "#/components/schemas/TagRuleScoreResourceType" required: - type - id - attributes type: object TagRuleScoreRelationship: description: A relationship to the compliance score resource for this rule. properties: data: $ref: "#/components/schemas/TagRuleScoreRelationshipData" required: - data type: object TagRuleScoreRelationshipData: description: Identifier of the related compliance score resource. properties: id: description: The unique identifier of the related compliance score resource. example: "123-v1-1779315066097-1779401466097" type: string type: $ref: "#/components/schemas/TagRuleScoreResourceType" required: - type - id type: object TagRuleScoreResourceType: description: JSON:API resource type for a tag rule compliance score. enum: - tag_rule_score example: "tag_rule_score" type: string x-enum-varnames: - TAG_RULE_SCORE TagRuleScoreResponse: description: A tag rule compliance score. properties: data: $ref: "#/components/schemas/TagRuleScoreData" required: - data type: object TagRuleSource: description: The telemetry source that a tag rule applies to. enum: - logs - spans - metrics - rum - feed example: "logs" type: string x-enum-varnames: - LOGS - SPANS - METRICS - RUM - FEED TagRuleType: description: |- How the rule is enforced. `blocking` rejects telemetry that violates the rule. `surfacing` only highlights non-compliant telemetry without blocking it. enum: - blocking - surfacing example: "surfacing" type: string x-enum-varnames: - BLOCKING - SURFACING TagRuleUpdateAttributes: description: |- Mutable attributes of a tag rule. Each field is optional; omitting a field leaves its current value unchanged. The `source` of a rule cannot be changed. properties: enabled: description: Whether the rule is currently enforced. type: boolean name: description: Human-readable name for the tag rule. type: string negated: description: When `true`, the rule matches tag values that do NOT match any of the supplied patterns. type: boolean required: description: When `true`, telemetry without this tag is treated as a violation. type: boolean rule_type: $ref: "#/components/schemas/TagRuleType" scope: description: The scope the rule applies within. type: string tag_key: description: The tag key that the rule governs. type: string tag_value_patterns: description: One or more patterns that valid values for the tag key must match. items: description: A pattern that valid tag values must match. type: string type: array type: object TagRuleUpdateData: description: Data object for updating a tag rule. properties: attributes: $ref: "#/components/schemas/TagRuleUpdateAttributes" id: description: The unique identifier of the tag rule being updated. example: "123" type: string type: $ref: "#/components/schemas/TagRuleResourceType" required: - type - id type: object TagRuleUpdateRequest: description: Payload for updating an existing tag rule. Only the supplied fields are modified. properties: data: $ref: "#/components/schemas/TagRuleUpdateData" required: - data type: object TagRulesListResponse: description: A page of tag rules. properties: data: $ref: "#/components/schemas/TagRuleDataArray" included: $ref: "#/components/schemas/TagRuleIncludedResources" required: - data type: object TagsEventAttribute: description: Array of tags associated with your event. example: ["team:A"] items: description: Tag associated with your event. type: string type: array TargetingRule: description: Targeting rule details. properties: conditions: description: Conditions evaluated by this targeting rule. items: $ref: "#/components/schemas/Condition" type: array created_at: description: The timestamp when the targeting rule was created. example: "2024-01-01T12:00:00Z" format: date-time type: string id: description: The unique identifier of the targeting rule. example: "550e8400-e29b-41d4-a716-446655440060" format: uuid type: string updated_at: description: The timestamp when the targeting rule was last updated. example: "2024-01-01T12:00:00Z" format: date-time type: string required: - id - conditions - created_at - updated_at type: object TargetingRuleRequest: description: Targeting rule request payload. properties: conditions: description: Conditions that must match for this rule. items: $ref: "#/components/schemas/ConditionRequest" minItems: 1 type: array required: - conditions type: object Targets: description: |- List of recipients to notify when a notification rule is triggered. Many different target types are supported, such as email addresses, Slack channels, and PagerDuty services. The appropriate integrations need to be properly configured to send notifications to the specified targets. example: ["@john.doe@email.com"] items: description: Recipients to notify. type: string type: array Team: description: A team properties: attributes: $ref: "#/components/schemas/TeamAttributes" id: description: The team's identifier example: aeadc05e-98a8-11ec-ac2c-da7ad0900001 type: string relationships: $ref: "#/components/schemas/TeamRelationships" type: $ref: "#/components/schemas/TeamType" required: - attributes - id - type type: object TeamAttributes: description: Team attributes properties: avatar: description: Unicode representation of the avatar for the team, limited to a single grapheme example: "🥑" nullable: true type: string banner: description: Banner selection for the team format: int64 nullable: true type: integer created_at: description: Creation date of the team format: date-time type: string description: description: Free-form markdown description/content for the team's homepage nullable: true type: string handle: description: The team's identifier example: example-team maxLength: 195 type: string handles: description: Collection of handles associated with the team. items: description: A team handle. type: string nullable: true readOnly: true type: array hidden_modules: description: Collection of hidden modules for the team items: description: String identifier of the module type: string nullable: true type: array is_managed: description: Whether the team is managed from an external source type: boolean is_open_membership: description: Whether any user can join the team without an invitation. readOnly: true type: boolean link_count: description: The number of links belonging to the team format: int32 maximum: 2147483647 readOnly: true type: integer modified_at: description: Modification date of the team format: date-time type: string name: description: The name of the team example: Example Team maxLength: 200 type: string provisioned_by: description: |- The mechanism that created the team, such as `teams_api`, `teams_terraform`, or `teams_ui`. Omitted when unknown. example: teams_api readOnly: true type: string summary: description: A brief summary of the team, derived from the `description` maxLength: 120 nullable: true type: string user_count: description: The number of users belonging to the team format: int32 maximum: 2147483647 readOnly: true type: integer visible_modules: description: Collection of visible modules for the team items: description: String identifier of the module type: string nullable: true type: array required: - handle - name type: object TeamConnection: description: A relationship between a Datadog team and a team from another external system. properties: attributes: $ref: "#/components/schemas/TeamConnectionAttributes" id: description: The unique identifier of the team connection. example: "12345678-1234-5678-9abc-123456789012" type: string relationships: $ref: "#/components/schemas/TeamConnectionRelationships" type: $ref: "#/components/schemas/TeamConnectionType" required: - id - type type: object TeamConnectionAttributes: description: Attributes of the team connection. properties: managed_by: description: The entity that manages this team connection. example: "github_sync" type: string source: description: The name of the external source, such as `github` or `servicenow`. example: "github" type: string type: object TeamConnectionCreateData: description: Data for creating a team connection. properties: attributes: $ref: "#/components/schemas/TeamConnectionAttributes" relationships: $ref: "#/components/schemas/TeamConnectionRelationships" type: $ref: "#/components/schemas/TeamConnectionType" required: - type type: object TeamConnectionCreateRequest: description: Request for creating team connections. properties: data: description: Array of team connections to create. items: $ref: "#/components/schemas/TeamConnectionCreateData" type: array required: - data type: object TeamConnectionDeleteRequest: description: Request for deleting team connections. properties: data: description: Array of team connection IDs to delete. items: $ref: "#/components/schemas/TeamConnectionDeleteRequestDataItem" type: array required: - data type: object TeamConnectionDeleteRequestDataItem: description: A collection of connection ids to delete. properties: id: description: The unique identifier of the team connection to delete. example: "12345678-1234-5678-9abc-123456789012" type: string type: $ref: "#/components/schemas/TeamConnectionType" required: - id - type type: object TeamConnectionRelationships: description: Relationships of the team connection. properties: connected_team: $ref: "#/components/schemas/ConnectedTeamRef" team: $ref: "#/components/schemas/TeamRef" type: object TeamConnectionType: default: "team_connection" description: Team connection resource type. enum: - team_connection example: "team_connection" type: string x-enum-varnames: - TEAM_CONNECTION TeamConnectionsResponse: description: Response containing information about multiple team connections. properties: data: description: Array of team connections. items: $ref: "#/components/schemas/TeamConnection" type: array meta: $ref: "#/components/schemas/ConnectionsResponseMeta" type: object TeamCreate: description: Team create properties: attributes: $ref: "#/components/schemas/TeamCreateAttributes" relationships: $ref: "#/components/schemas/TeamCreateRelationships" type: $ref: "#/components/schemas/TeamType" required: - attributes - type type: object TeamCreateAttributes: description: Team creation attributes properties: avatar: description: Unicode representation of the avatar for the team, limited to a single grapheme example: "🥑" nullable: true type: string banner: description: Banner selection for the team format: int64 nullable: true type: integer description: description: Free-form markdown description/content for the team's homepage type: string handle: description: The team's identifier example: example-team maxLength: 195 type: string hidden_modules: description: Collection of hidden modules for the team items: description: String identifier of the module type: string type: array name: description: The name of the team example: Example Team maxLength: 200 type: string visible_modules: description: Collection of visible modules for the team items: description: String identifier of the module type: string type: array required: - handle - name type: object TeamCreateRelationships: description: Relationships formed with the team on creation properties: users: $ref: "#/components/schemas/RelationshipToUsers" type: object TeamCreateRequest: description: Request to create a team properties: data: $ref: "#/components/schemas/TeamCreate" required: - data type: object TeamHierarchyLink: description: Team hierarchy link properties: attributes: $ref: "#/components/schemas/TeamHierarchyLinkAttributes" id: description: The team hierarchy link's identifier example: b8626d7e-cedd-11eb-abf5-da7ad0900001 type: string relationships: $ref: "#/components/schemas/TeamHierarchyLinkRelationships" type: $ref: "#/components/schemas/TeamHierarchyLinkType" required: - attributes - id - type type: object TeamHierarchyLinkAttributes: description: Team hierarchy link attributes properties: created_at: description: Timestamp when the team hierarchy link was created example: "" format: date-time type: string provisioned_by: description: The provisioner of the team hierarchy link example: "system" type: string required: - provisioned_by - created_at type: object TeamHierarchyLinkCreate: description: Data provided when creating a team hierarchy link properties: relationships: $ref: "#/components/schemas/TeamHierarchyLinkCreateRelationships" type: $ref: "#/components/schemas/TeamHierarchyLinkType" required: - relationships - type type: object TeamHierarchyLinkCreateRelationships: description: The related teams that will be connected by the team hierarchy link properties: parent_team: $ref: "#/components/schemas/TeamHierarchyLinkCreateTeamRelationship" sub_team: $ref: "#/components/schemas/TeamHierarchyLinkCreateTeamRelationship" required: - parent_team - sub_team type: object TeamHierarchyLinkCreateRequest: description: Request to create a team hierarchy link properties: data: $ref: "#/components/schemas/TeamHierarchyLinkCreate" required: - data type: object TeamHierarchyLinkCreateTeam: description: This schema defines the attributes about each team that has to be provided when creating a team hierarchy link properties: id: description: The team's identifier example: 692e8073-12c4-4c71-8408-5090bd44c9c8 type: string type: $ref: "#/components/schemas/TeamType" required: - id - type type: object TeamHierarchyLinkCreateTeamRelationship: description: Data about each team that will be connected by the team hierarchy link properties: data: $ref: "#/components/schemas/TeamHierarchyLinkCreateTeam" required: - data type: object TeamHierarchyLinkRelationships: description: Team hierarchy link relationships properties: parent_team: $ref: "#/components/schemas/TeamHierarchyLinkTeamRelationship" sub_team: $ref: "#/components/schemas/TeamHierarchyLinkTeamRelationship" required: - parent_team - sub_team type: object TeamHierarchyLinkResponse: description: Team hierarchy link response properties: data: $ref: "#/components/schemas/TeamHierarchyLink" included: description: Included teams items: $ref: "#/components/schemas/TeamHierarchyLinkTeam" type: array links: $ref: "#/components/schemas/TeamsHierarchyLinksResponseLinks" type: object TeamHierarchyLinkTeam: description: Team hierarchy links connect different teams. This represents team objects that are connected by the team hierarchy link. properties: attributes: $ref: "#/components/schemas/TeamHierarchyLinkTeamAttributes" id: description: The team's identifier example: 692e8073-12c4-4c71-8408-5090bd44c9c8 type: string type: $ref: "#/components/schemas/TeamType" required: - id - type type: object TeamHierarchyLinkTeamAttributes: description: Team hierarchy links connect different teams. This represents attributes from teams that are connected by the team hierarchy link. properties: avatar: description: The team's avatar nullable: true type: string banner: description: The team's banner format: int64 type: integer handle: description: The team's handle example: team-handle type: string is_managed: description: Whether the team is managed type: boolean is_open_membership: description: Whether the team has open membership type: boolean link_count: description: The number of links for the team format: int64 type: integer name: description: The team's name example: Team Name type: string summary: description: The team's summary nullable: true type: string user_count: description: The number of users in the team format: int64 type: integer required: - handle - name type: object TeamHierarchyLinkTeamRelationship: description: Team hierarchy link team relationship properties: data: $ref: "#/components/schemas/TeamHierarchyLinkTeam" required: - data type: object TeamHierarchyLinkType: default: team_hierarchy_links description: Team hierarchy link type enum: - team_hierarchy_links example: team_hierarchy_links type: string x-enum-varnames: - TEAM_HIERARCHY_LINKS TeamHierarchyLinksResponse: description: Team hierarchy links response properties: data: description: Team hierarchy links response data items: $ref: "#/components/schemas/TeamHierarchyLink" type: array included: description: Included teams items: $ref: "#/components/schemas/TeamHierarchyLinkTeam" type: array links: $ref: "#/components/schemas/TeamsHierarchyLinksResponseLinks" meta: $ref: "#/components/schemas/TeamsHierarchyLinksResponseMeta" type: object TeamHierarchyMember: description: A user relationship to the requested team. properties: attributes: $ref: "#/components/schemas/TeamHierarchyMemberAttributes" id: description: Relationship identifier containing the team UUID and user UUID. example: UserTeamRelationship:692e8073-12c4-4c71-8408-5090bd44c9c8:00000000-0000-0000-0000-000000000001 type: string relationships: $ref: "#/components/schemas/TeamHierarchyMemberRelationships" type: $ref: "#/components/schemas/TeamHierarchyMemberType" required: - id - type - attributes - relationships type: object TeamHierarchyMemberAttributes: description: Membership attributes relative to the requested team. properties: direct_role: description: "Role on the requested team: admin or member. Null for inherited members." example: member nullable: true type: string is_direct: description: Whether the user belongs directly to the requested team. example: true type: boolean provisioned_by: description: Membership provisioner. Null for inherited members. example: manual nullable: true type: string provisioned_by_id: description: Identifier supplied by the membership provisioner. Null when unavailable or for inherited members. example: 00000000-0000-0000-0000-000000000003 nullable: true type: string required: - is_direct - direct_role - provisioned_by - provisioned_by_id type: object TeamHierarchyMemberIncluded: description: An included user or the requested team, distinguished by resource type. oneOf: - $ref: "#/components/schemas/TeamHierarchyMemberUser" - $ref: "#/components/schemas/TeamHierarchyMemberTeam" TeamHierarchyMemberRelationships: description: User and requested team linkage. properties: team: $ref: "#/components/schemas/TeamHierarchyMemberTeamRelationship" user: $ref: "#/components/schemas/TeamHierarchyMemberUserRelationship" required: - user - team type: object TeamHierarchyMemberTeam: description: The requested team, included at most once. Descendant teams are not included. properties: attributes: $ref: "#/components/schemas/TeamHierarchyMemberTeamAttributes" id: description: UUID of the requested team. example: 692e8073-12c4-4c71-8408-5090bd44c9c8 format: uuid type: string type: $ref: "#/components/schemas/TeamHierarchyMemberTeamType" required: - id - type type: object TeamHierarchyMemberTeamAttributes: description: Available attributes of the requested team. properties: handle: description: Handle of the team. example: platform type: string name: description: Name of the team. example: Platform type: string type: object TeamHierarchyMemberTeamData: description: Team resource identifier. properties: id: description: UUID of the team. example: 692e8073-12c4-4c71-8408-5090bd44c9c8 format: uuid type: string type: $ref: "#/components/schemas/TeamHierarchyMemberTeamType" required: - id - type type: object TeamHierarchyMemberTeamRelationship: description: Linkage to the requested team. properties: data: $ref: "#/components/schemas/TeamHierarchyMemberTeamData" required: - data type: object TeamHierarchyMemberTeamType: default: teams description: Requested team resource type. enum: - teams example: teams type: string x-enum-varnames: - TEAMS TeamHierarchyMemberType: default: user_team_relationship description: Team hierarchy membership resource type. enum: - user_team_relationship example: user_team_relationship type: string x-enum-varnames: - USER_TEAM_RELATIONSHIP TeamHierarchyMemberUser: description: A user included in the hierarchy members response. properties: attributes: $ref: "#/components/schemas/UserAttributes" id: description: UUID of the user. example: 00000000-0000-0000-0000-000000000001 format: uuid type: string type: $ref: "#/components/schemas/UsersType" required: - id - type - attributes type: object TeamHierarchyMemberUserData: description: User resource identifier. properties: id: description: UUID of the user. example: 00000000-0000-0000-0000-000000000001 format: uuid type: string type: $ref: "#/components/schemas/UsersType" required: - id - type type: object TeamHierarchyMemberUserRelationship: description: Linkage to the user. properties: data: $ref: "#/components/schemas/TeamHierarchyMemberUserData" required: - data type: object TeamHierarchyMembersNumberPage: description: Pagination metadata using number and size. properties: first_number: description: First page number. example: 0 format: int64 type: integer last_number: description: Last page number. Null when unavailable. example: 0 format: int64 nullable: true type: integer next_number: description: Next page number. Null when unavailable. example: format: int64 nullable: true type: integer number: description: Current zero-based page number. example: 0 format: int64 type: integer prev_number: description: Previous page number. Null when unavailable. example: format: int64 nullable: true type: integer size: description: Maximum number of members per page. example: 100 format: int64 type: integer total: description: Total number of members matching the filters. example: 2 format: int64 type: integer type: $ref: "#/components/schemas/TeamHierarchyMembersNumberPageType" required: - type - number - size - total - first_number - prev_number - next_number - last_number type: object TeamHierarchyMembersNumberPageType: default: number_size description: Pagination mode. enum: - number_size example: number_size type: string x-enum-varnames: - NUMBER_SIZE TeamHierarchyMembersOffsetPage: description: Pagination metadata using offset and limit. properties: first_offset: description: First offset. example: 0 format: int64 type: integer last_offset: description: Last offset. Null when unavailable. example: 0 format: int64 nullable: true type: integer limit: description: Maximum number of members per page. example: 100 format: int64 type: integer next_offset: description: Next offset. Null when unavailable. example: format: int64 nullable: true type: integer offset: description: Current offset. example: 0 format: int64 type: integer prev_offset: description: Previous offset. Null when unavailable. example: format: int64 nullable: true type: integer total: description: Total number of members matching the filters. example: 2 format: int64 type: integer type: $ref: "#/components/schemas/TeamHierarchyMembersOffsetPageType" required: - type - offset - limit - total - first_offset - prev_offset - next_offset - last_offset type: object TeamHierarchyMembersOffsetPageType: default: offset_limit description: Pagination mode. enum: - offset_limit example: offset_limit type: string x-enum-varnames: - OFFSET_LIMIT TeamHierarchyMembersPage: description: Pagination metadata for the selected pagination mode. oneOf: - $ref: "#/components/schemas/TeamHierarchyMembersOffsetPage" - $ref: "#/components/schemas/TeamHierarchyMembersNumberPage" TeamHierarchyMembersResponse: description: Direct and inherited members of the requested team. properties: data: description: >- Membership relationships for users who belong to the requested team or inherit membership through its descendant teams. Each user appears once, even if they belong to multiple teams in the hierarchy. Each relationship identifies the user and requested team, and indicates whether the user is a direct member of the requested team. items: $ref: "#/components/schemas/TeamHierarchyMember" type: array included: description: Requested users and the team. May be absent when the result is empty, even if requested. items: $ref: "#/components/schemas/TeamHierarchyMemberIncluded" type: array links: $ref: "#/components/schemas/TeamHierarchyMembersResponseLinks" meta: $ref: "#/components/schemas/TeamHierarchyMembersResponseMeta" required: - data - meta - links type: object TeamHierarchyMembersResponseLinks: description: Page navigation links. Unavailable links are omitted. properties: first: description: First page URL. example: https://api.datadoghq.com/api/v2/team/692e8073-12c4-4c71-8408-5090bd44c9c8/members?page%5Bnumber%5D=0&page%5Bsize%5D=100 type: string last: description: Last page URL. example: https://api.datadoghq.com/api/v2/team/692e8073-12c4-4c71-8408-5090bd44c9c8/members?page%5Bnumber%5D=0&page%5Bsize%5D=100 type: string next: description: Next page URL. example: https://api.datadoghq.com/api/v2/team/692e8073-12c4-4c71-8408-5090bd44c9c8/members?page%5Bnumber%5D=0&page%5Bsize%5D=100 type: string prev: description: Previous page URL. example: https://api.datadoghq.com/api/v2/team/692e8073-12c4-4c71-8408-5090bd44c9c8/members?page%5Bnumber%5D=0&page%5Bsize%5D=100 type: string self: description: Current page URL. example: https://api.datadoghq.com/api/v2/team/692e8073-12c4-4c71-8408-5090bd44c9c8/members?page%5Bnumber%5D=0&page%5Bsize%5D=100 type: string type: object TeamHierarchyMembersResponseMeta: description: Pagination metadata for the filtered members. properties: page: $ref: "#/components/schemas/TeamHierarchyMembersPage" required: - page type: object TeamIncluded: description: Included resources related to the team oneOf: - $ref: "#/components/schemas/User" - $ref: "#/components/schemas/TeamLink" - $ref: "#/components/schemas/UserTeamPermission" TeamLink: description: Team link properties: attributes: $ref: "#/components/schemas/TeamLinkAttributes" id: description: The team link's identifier example: b8626d7e-cedd-11eb-abf5-da7ad0900001 type: string type: $ref: "#/components/schemas/TeamLinkType" required: - attributes - id - type type: object TeamLinkAttributes: description: Team link attributes properties: label: description: The link's label example: Link label maxLength: 256 type: string position: description: The link's position, used to sort links for the team format: int32 maximum: 2147483647 type: integer team_id: description: ID of the team the link is associated with readOnly: true type: string url: description: The URL for the link example: "https://example.com" type: string required: - label - url type: object TeamLinkCreate: description: Team link create properties: attributes: $ref: "#/components/schemas/TeamLinkAttributes" type: $ref: "#/components/schemas/TeamLinkType" required: - attributes - type type: object TeamLinkCreateRequest: description: Team link create request properties: data: $ref: "#/components/schemas/TeamLinkCreate" required: - data type: object TeamLinkResponse: description: Team link response properties: data: $ref: "#/components/schemas/TeamLink" type: object TeamLinkType: default: team_links description: Team link type enum: - team_links example: team_links type: string x-enum-varnames: - TEAM_LINKS TeamLinksResponse: description: Team links response properties: data: description: Team links response data items: $ref: "#/components/schemas/TeamLink" type: array type: object TeamNotificationRule: description: Team notification rule properties: attributes: $ref: "#/components/schemas/TeamNotificationRuleAttributes" id: description: The identifier of the team notification rule example: b8626d7e-cedd-11eb-abf5-da7ad0900001 type: string type: $ref: "#/components/schemas/TeamNotificationRuleType" required: - attributes - type type: object TeamNotificationRuleAttributes: description: Team notification rule attributes properties: email: $ref: "#/components/schemas/TeamNotificationRuleAttributesEmail" ms_teams: $ref: "#/components/schemas/TeamNotificationRuleAttributesMsTeams" pagerduty: $ref: "#/components/schemas/TeamNotificationRuleAttributesPagerduty" servicenow: $ref: "#/components/schemas/TeamNotificationRuleAttributesServiceNow" slack: $ref: "#/components/schemas/TeamNotificationRuleAttributesSlack" type: object TeamNotificationRuleAttributesEmail: description: Email notification settings for the team properties: enabled: description: Flag indicating email notification type: boolean recipient_email: description: >- Email address to notify. When omitted and email notifications are enabled, notifications are sent to all team members. type: string type: object TeamNotificationRuleAttributesMsTeams: description: MS Teams notification settings for the team properties: connector_name: description: Handle for MS Teams type: string type: object TeamNotificationRuleAttributesPagerduty: description: PagerDuty notification settings for the team properties: service_name: description: Service name for PagerDuty type: string type: object TeamNotificationRuleAttributesServiceNow: description: ServiceNow notification settings for the team. properties: templates: description: ServiceNow template handle names to use for notifications. items: type: string type: array type: object TeamNotificationRuleAttributesSlack: description: Slack notification settings for the team properties: channel: description: Channel for Slack notification type: string workspace: description: Workspace for Slack notification type: string type: object TeamNotificationRuleRequest: description: Request to create or update a team notification rule properties: data: $ref: "#/components/schemas/TeamNotificationRule" required: - data type: object TeamNotificationRuleResponse: description: Team notification rule response properties: data: $ref: "#/components/schemas/TeamNotificationRule" type: object TeamNotificationRuleType: default: team_notification_rules description: Team notification rule type enum: - team_notification_rules example: team_notification_rules type: string x-enum-varnames: - TEAM_NOTIFICATION_RULES TeamNotificationRulesResponse: description: Team notification rules response properties: data: description: Team notification rules response data items: $ref: "#/components/schemas/TeamNotificationRule" type: array meta: $ref: "#/components/schemas/TeamNotificationRulesResponseMeta" type: object TeamNotificationRulesResponseMeta: description: Metadata that is included in the response when querying the team notification rules properties: page: $ref: "#/components/schemas/TeamNotificationRulesResponseMetaPage" type: object TeamNotificationRulesResponseMetaPage: description: |- Metadata related to paging information that is included in the response when querying the team notification rules properties: first_offset: description: The first offset. format: int64 type: integer last_offset: description: The last offset. format: int64 type: integer limit: description: Pagination limit. format: int64 type: integer next_offset: description: The next offset. format: int64 nullable: true type: integer offset: description: The offset. format: int64 type: integer prev_offset: description: The previous offset. format: int64 nullable: true type: integer total: description: Total results. format: int64 type: integer type: description: Offset type. type: string type: object TeamOnCallResponders: description: Root object representing a team's on-call responder configuration. example: data: id: "111ee23r-aaaaa-aaaa-aaww-1234wertsd23" relationships: escalations: data: - id: "111ee23r-aaaaa-aaaa-aaww-1234wertsd23" type: escalation_policy_steps responders: data: - id: "111ee23r-aaaaa-aaaa-aaww-1234wertsd23" type: users type: team_oncall_responders included: - attributes: email: test@test.com name: Test User status: active id: "111ee23r-aaaaa-aaaa-aaww-1234wertsd23" type: users - id: "111ee23r-aaaaa-aaaa-aaww-1234wertsd23" relationships: responders: data: - id: "111ee23r-aaaaa-aaaa-aaww-1234wertsd23" type: users type: escalation_policy_steps properties: data: $ref: "#/components/schemas/TeamOnCallRespondersData" included: description: The `TeamOnCallResponders` `included`. items: $ref: "#/components/schemas/TeamOnCallRespondersIncluded" type: array type: object TeamOnCallRespondersData: description: Defines the main on-call responder object for a team, including relationships and metadata. properties: id: description: Unique identifier of the on-call responder configuration. type: string relationships: $ref: "#/components/schemas/TeamOnCallRespondersDataRelationships" type: $ref: "#/components/schemas/TeamOnCallRespondersDataType" required: - type type: object TeamOnCallRespondersDataRelationships: description: Relationship objects linked to a team's on-call responder configuration, including escalations and responders. properties: escalations: $ref: "#/components/schemas/TeamOnCallRespondersDataRelationshipsEscalations" responders: $ref: "#/components/schemas/TeamOnCallRespondersDataRelationshipsResponders" type: object TeamOnCallRespondersDataRelationshipsEscalations: description: Defines the escalation policy steps linked to the team's on-call configuration. properties: data: description: Array of escalation step references. items: $ref: "#/components/schemas/TeamOnCallRespondersDataRelationshipsEscalationsDataItems" type: array type: object TeamOnCallRespondersDataRelationshipsEscalationsDataItems: description: Represents a link to a specific escalation policy step associated with the on-call team. properties: id: description: Unique identifier of the escalation step. example: "" type: string type: $ref: "#/components/schemas/TeamOnCallRespondersDataRelationshipsEscalationsDataItemsType" required: - type - id type: object TeamOnCallRespondersDataRelationshipsEscalationsDataItemsType: default: escalation_policy_steps description: Identifies the resource type for escalation policy steps linked to a team's on-call configuration. enum: - escalation_policy_steps example: escalation_policy_steps type: string x-enum-varnames: - ESCALATION_POLICY_STEPS TeamOnCallRespondersDataRelationshipsResponders: description: Defines the list of users assigned as on-call responders for the team. properties: data: description: Array of user references associated as responders. items: $ref: "#/components/schemas/TeamOnCallRespondersDataRelationshipsRespondersDataItems" type: array type: object TeamOnCallRespondersDataRelationshipsRespondersDataItems: description: Represents a user responder associated with the on-call team. properties: id: description: Unique identifier of the responder. example: "" type: string type: $ref: "#/components/schemas/TeamOnCallRespondersDataRelationshipsRespondersDataItemsType" required: - type - id type: object TeamOnCallRespondersDataRelationshipsRespondersDataItemsType: default: users description: Identifies the resource type for individual user entities associated with on-call response. enum: - users example: users type: string x-enum-varnames: - USERS TeamOnCallRespondersDataType: default: team_oncall_responders description: Represents the resource type for a group of users assigned to handle on-call duties within a team. enum: - team_oncall_responders example: team_oncall_responders type: string x-enum-varnames: - TEAM_ONCALL_RESPONDERS TeamOnCallRespondersIncluded: description: Represents an union of related resources included in the response, such as users and escalation steps. oneOf: - $ref: "#/components/schemas/User" - $ref: "#/components/schemas/Escalation" TeamPermissionSetting: description: Team permission setting properties: attributes: $ref: "#/components/schemas/TeamPermissionSettingAttributes" id: description: The team permission setting's identifier example: TeamPermission-aeadc05e-98a8-11ec-ac2c-da7ad0900001-edit type: string type: $ref: "#/components/schemas/TeamPermissionSettingType" required: - id - type type: object TeamPermissionSettingAttributes: description: Team permission setting attributes properties: action: $ref: "#/components/schemas/TeamPermissionSettingSerializerAction" editable: description: Whether or not the permission setting is editable by the current user readOnly: true type: boolean options: $ref: "#/components/schemas/TeamPermissionSettingValues" title: description: The team permission name readOnly: true type: string value: $ref: "#/components/schemas/TeamPermissionSettingValue" type: object TeamPermissionSettingResponse: description: Team permission setting response properties: data: $ref: "#/components/schemas/TeamPermissionSetting" type: object TeamPermissionSettingSerializerAction: description: The identifier for the action enum: - manage_membership - edit readOnly: true type: string x-enum-varnames: - MANAGE_MEMBERSHIP - EDIT TeamPermissionSettingType: default: team_permission_settings description: Team permission setting type enum: - team_permission_settings example: team_permission_settings type: string x-enum-varnames: - TEAM_PERMISSION_SETTINGS TeamPermissionSettingUpdate: description: Team permission setting update properties: attributes: $ref: "#/components/schemas/TeamPermissionSettingUpdateAttributes" type: $ref: "#/components/schemas/TeamPermissionSettingType" required: - type type: object TeamPermissionSettingUpdateAttributes: description: Team permission setting update attributes properties: value: $ref: "#/components/schemas/TeamPermissionSettingValue" type: object TeamPermissionSettingUpdateRequest: description: Team permission setting update request properties: data: $ref: "#/components/schemas/TeamPermissionSettingUpdate" required: - data type: object TeamPermissionSettingValue: description: What type of user is allowed to perform the specified action enum: - admins - members - organization - user_access_manage - teams_manage type: string x-enum-varnames: - ADMINS - MEMBERS - ORGANIZATION - USER_ACCESS_MANAGE - TEAMS_MANAGE TeamPermissionSettingValues: description: Possible values for action items: $ref: "#/components/schemas/TeamPermissionSettingValue" readOnly: true type: array TeamPermissionSettingsResponse: description: Team permission settings response properties: data: description: Team permission settings response data items: $ref: "#/components/schemas/TeamPermissionSetting" type: array type: object TeamRef: description: Reference to a Datadog team. properties: data: $ref: "#/components/schemas/TeamRefData" type: object TeamRefData: description: Reference to a Datadog team. properties: id: description: The Datadog team ID. example: "87654321-4321-8765-dcba-210987654321" type: string type: $ref: "#/components/schemas/TeamRefDataType" required: - id - type type: object TeamRefDataType: default: "team" description: Datadog team resource type. enum: - team example: "team" type: string x-enum-varnames: - TEAM TeamReference: description: Provides a reference to a team, including ID, type, and basic attributes/relationships. properties: attributes: $ref: "#/components/schemas/TeamReferenceAttributes" id: description: The team's unique identifier. type: string type: $ref: "#/components/schemas/TeamReferenceType" required: - type type: object TeamReferenceAttributes: description: Encapsulates the basic attributes of a Team reference, such as name, handle, and an optional avatar or description. properties: avatar: description: URL or reference for the team's avatar (if available). type: string description: description: A short text describing the team. type: string handle: description: A unique handle/slug for the team. type: string name: description: The full, human-readable name of the team. type: string type: object TeamReferenceType: default: teams description: |- Teams resource type. enum: - teams example: teams type: string x-enum-varnames: - TEAMS TeamRelationships: description: Resources related to a team properties: team_links: $ref: "#/components/schemas/RelationshipToTeamLinks" user_team_permissions: $ref: "#/components/schemas/RelationshipToUserTeamPermission" type: object TeamRelationshipsLinks: description: Links attributes. properties: related: description: Related link. example: "/api/v2/team/c75a4a8e-20c7-11ee-a3a5-da7ad0900002/links" type: string type: object TeamResponse: description: Response with a team properties: data: $ref: "#/components/schemas/Team" included: description: Resources related to the team. items: $ref: "#/components/schemas/TeamIncluded" type: array type: object TeamRoutingRules: description: Represents a complete set of team routing rules, including data and optionally included related resources. example: data: id: 27590dae-47be-4a7d-9abf-8f4e45124020 relationships: rules: data: - id: 03aff2d6-6cbf-496c-997f-a857bbe9a94a type: team_routing_rules - id: 03aff2d6-6cbf-496c-997f-a857bbe9a94a type: team_routing_rules type: team_routing_rules included: - attributes: actions: query: tags.service:test time_restriction: restrictions: - end_day: monday end_time: "17:00:00" start_day: monday start_time: "09:00:00" - end_day: tuesday end_time: "17:00:00" start_day: tuesday start_time: "09:00:00" time_zone: "" urgency: high id: 03aff2d6-6cbf-496c-997f-a857bbe9a94a relationships: policy: data: type: team_routing_rules properties: data: $ref: "#/components/schemas/TeamRoutingRulesData" included: description: Provides related routing rules or other included resources. items: $ref: "#/components/schemas/TeamRoutingRulesIncluded" type: array type: object TeamRoutingRulesData: description: Represents the top-level data object for team routing rules, containing the ID, relationships, and resource type. properties: id: description: Specifies the unique identifier of this team routing rules record. type: string relationships: $ref: "#/components/schemas/TeamRoutingRulesDataRelationships" type: $ref: "#/components/schemas/TeamRoutingRulesDataType" required: - type type: object TeamRoutingRulesDataRelationships: description: Specifies relationships for team routing rules, including rule references. properties: rules: $ref: "#/components/schemas/TeamRoutingRulesDataRelationshipsRules" type: object TeamRoutingRulesDataRelationshipsRules: description: Holds references to a set of routing rules in a relationship. properties: data: description: An array of references to the routing rules associated with this team. items: $ref: "#/components/schemas/TeamRoutingRulesDataRelationshipsRulesDataItems" type: array type: object TeamRoutingRulesDataRelationshipsRulesDataItems: description: "Defines a relationship item to link a routing rule by its ID and type." properties: id: description: Specifies the unique identifier for the related routing rule. example: "" type: string type: $ref: "#/components/schemas/TeamRoutingRulesDataRelationshipsRulesDataItemsType" required: - type - id type: object TeamRoutingRulesDataRelationshipsRulesDataItemsType: default: team_routing_rules description: "Indicates that the resource is of type `team_routing_rules`." enum: - team_routing_rules example: team_routing_rules type: string x-enum-varnames: - TEAM_ROUTING_RULES TeamRoutingRulesDataType: default: team_routing_rules description: Team routing rules resource type. enum: - team_routing_rules example: team_routing_rules type: string x-enum-varnames: - TEAM_ROUTING_RULES TeamRoutingRulesIncluded: description: Represents additional included resources for team routing rules, such as associated routing rules. oneOf: - $ref: "#/components/schemas/RoutingRule" TeamRoutingRulesRequest: description: Represents a request to create or update team routing rules, including the data payload. example: data: attributes: rules: - actions: policy_id: "" query: tags.service:test time_restriction: restrictions: - end_day: monday end_time: "17:00:00" start_day: monday start_time: "09:00:00" - end_day: tuesday end_time: "17:00:00" start_day: tuesday start_time: "09:00:00" time_zone: "" urgency: high - actions: - channel: channel type: send_slack_message workspace: workspace policy_id: fad4eee1-13f5-40d8-886b-4e56d8d5d1c6 query: "" time_restriction: urgency: low id: 27590dae-47be-4a7d-9abf-8f4e45124020 type: team_routing_rules properties: data: $ref: "#/components/schemas/TeamRoutingRulesRequestData" type: object TeamRoutingRulesRequestData: description: Holds the data necessary to create or update team routing rules, including attributes, ID, and resource type. properties: attributes: $ref: "#/components/schemas/TeamRoutingRulesRequestDataAttributes" id: description: Specifies the unique identifier for this set of team routing rules. type: string type: $ref: "#/components/schemas/TeamRoutingRulesRequestDataType" required: - type type: object TeamRoutingRulesRequestDataAttributes: description: Represents the attributes of a request to update or create team routing rules. properties: rules: description: A list of routing rule items that define how incoming Pages should be handled. items: $ref: "#/components/schemas/TeamRoutingRulesRequestRule" type: array type: object TeamRoutingRulesRequestDataType: default: team_routing_rules description: Team routing rules resource type. enum: - team_routing_rules example: team_routing_rules type: string x-enum-varnames: - TEAM_ROUTING_RULES TeamRoutingRulesRequestRule: description: Defines an individual routing rule item that contains the rule data for the request. properties: actions: description: Specifies the list of actions to perform when the routing rule is matched. items: $ref: "#/components/schemas/RoutingRuleAction" type: array id: description: |- Specifies the unique identifier of an existing routing rule to update. If omitted, a new routing rule is created. type: string policy_id: description: Identifies the policy to be applied when this routing rule matches. type: string query: description: Defines the query or condition that triggers this routing rule. type: string time_restriction: $ref: "#/components/schemas/TimeRestrictions" urgency: $ref: "#/components/schemas/Urgency" type: object TeamSyncAttributes: description: Team sync attributes. properties: frequency: $ref: "#/components/schemas/TeamSyncAttributesFrequency" selection_state: $ref: "#/components/schemas/TeamSyncAttributesSelectionState" source: $ref: "#/components/schemas/TeamSyncAttributesSource" sync_membership: $ref: "#/components/schemas/TeamSyncAttributesSyncMembership" type: $ref: "#/components/schemas/TeamSyncAttributesType" required: - source - type type: object TeamSyncAttributesFrequency: description: How often the sync process should be run. Defaults to `once` when not provided. enum: - once - continuously - paused example: once type: string x-enum-varnames: - ONCE - CONTINUOUSLY - PAUSED TeamSyncAttributesSelectionState: description: |- Specifies which teams or organizations to sync. When provided, synchronization is limited to the specified items and their subtrees. items: $ref: "#/components/schemas/TeamSyncSelectionStateItem" type: array TeamSyncAttributesSource: description: The external source platform for team synchronization. enum: - github - servicenow example: github type: string x-enum-varnames: - GITHUB - SERVICENOW TeamSyncAttributesSyncMembership: default: false description: Whether to sync members from the external team to the Datadog team. Defaults to `false` when not provided. example: true type: boolean TeamSyncAttributesType: description: The type of synchronization operation. "link" connects teams by matching names. "provision" creates new teams when no match is found. enum: - link - provision example: link type: string x-enum-varnames: - LINK - PROVISION TeamSyncBulkType: description: Team sync bulk type. enum: - team_sync_bulk example: team_sync_bulk type: string x-enum-varnames: - TEAM_SYNC_BULK TeamSyncData: description: A configuration governing syncing between Datadog teams and teams from an external system. properties: attributes: $ref: "#/components/schemas/TeamSyncAttributes" id: description: The sync's identifier example: aeadc05e-98a8-11ec-ac2c-da7ad0900001 type: string type: $ref: "#/components/schemas/TeamSyncBulkType" required: - attributes - type type: object TeamSyncRequest: description: Team sync request. example: data: attributes: source: github type: link type: team_sync_bulk properties: data: $ref: "#/components/schemas/TeamSyncData" required: - data type: object TeamSyncResponse: description: Team sync configurations response. properties: data: description: List of team sync configurations items: $ref: "#/components/schemas/TeamSyncData" type: array type: object TeamSyncSelectionStateExternalId: description: The external identifier for a team or organization in the source platform. properties: type: $ref: "#/components/schemas/TeamSyncSelectionStateExternalIdType" value: $ref: "#/components/schemas/TeamSyncSelectionStateExternalIdValue" required: - type - value type: object TeamSyncSelectionStateExternalIdType: description: |- The type of external identifier for the selection state item. For GitHub synchronization, `team` refers to a GitHub team and `organization` refers to a GitHub organization. For ServiceNow synchronization, `team` refers to a ServiceNow group and `organization` refers to a ServiceNow instance. enum: - team - organization example: team type: string x-enum-varnames: - TEAM - ORGANIZATION TeamSyncSelectionStateExternalIdValue: description: |- The external identifier value from the source platform. For GitHub, this is the string representation of a GitHub organization ID or team ID. For ServiceNow, this is the instance name for `organization`, or `/` of the group for `team`. example: "1" type: string TeamSyncSelectionStateItem: description: Identifies a team or organization hierarchy to include in synchronization. properties: external_id: $ref: "#/components/schemas/TeamSyncSelectionStateExternalId" operation: $ref: "#/components/schemas/TeamSyncSelectionStateOperation" scope: $ref: "#/components/schemas/TeamSyncSelectionStateScope" required: - external_id type: object TeamSyncSelectionStateOperation: description: |- The operation to perform on the selected hierarchy. When set to `include`, synchronization covers the referenced teams or organizations. enum: - include example: include type: string x-enum-varnames: - INCLUDE TeamSyncSelectionStateScope: description: |- The scope of the selection. When set to `subtree`, synchronization includes the referenced team or organization and everything nested under it. enum: - subtree example: subtree type: string x-enum-varnames: - SUBTREE TeamTarget: description: "Represents a team target for an escalation policy step, including the team's ID and resource type." properties: id: description: "Specifies the unique identifier of the team resource." example: "00000000-aba1-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/TeamTargetType" required: - type - id type: object TeamTargetType: default: teams description: "Indicates that the resource is of type `teams`." enum: - teams example: teams type: string x-enum-varnames: - TEAMS TeamType: default: team description: Team type enum: - team example: team type: string x-enum-varnames: - TEAM TeamUpdate: description: Team update request properties: attributes: $ref: "#/components/schemas/TeamUpdateAttributes" relationships: $ref: "#/components/schemas/TeamUpdateRelationships" type: $ref: "#/components/schemas/TeamType" required: - attributes - type type: object TeamUpdateAttributes: description: Team update attributes properties: avatar: description: Unicode representation of the avatar for the team, limited to a single grapheme example: "🥑" nullable: true type: string banner: description: Banner selection for the team format: int64 nullable: true type: integer description: description: Free-form markdown description/content for the team's homepage type: string handle: description: The team's identifier example: example-team maxLength: 195 type: string hidden_modules: description: Collection of hidden modules for the team items: description: String identifier of the module type: string type: array name: description: The name of the team example: Example Team maxLength: 200 type: string visible_modules: description: Collection of visible modules for the team items: description: String identifier of the module type: string type: array required: - handle - name type: object TeamUpdateRelationships: description: Team update relationships properties: team_links: $ref: "#/components/schemas/RelationshipToTeamLinks" type: object TeamUpdateRequest: description: Team update request properties: data: $ref: "#/components/schemas/TeamUpdate" required: - data type: object TeamsField: description: Supported teams field. enum: - id - name - handle - summary - description - avatar - banner - visible_modules - hidden_modules - created_at - modified_at - user_count - link_count - team_links - user_team_permissions - is_managed - provisioned_by type: string x-enum-varnames: - ID - NAME - HANDLE - SUMMARY - DESCRIPTION - AVATAR - BANNER - VISIBLE_MODULES - HIDDEN_MODULES - CREATED_AT - MODIFIED_AT - USER_COUNT - LINK_COUNT - TEAM_LINKS - USER_TEAM_PERMISSIONS - IS_MANAGED - PROVISIONED_BY TeamsHierarchyLinksResponseLinks: description: When querying team hierarchy links, a set of links for navigation between different pages is included properties: first: description: Link to the first page. nullable: true type: string last: description: Link to the last page. nullable: true type: string next: description: Link to the next page. nullable: true type: string prev: description: Link to the previous page. nullable: true type: string self: description: Link to the current object. type: string type: object TeamsHierarchyLinksResponseMeta: description: Metadata that is included in the response when querying the team hierarchy links properties: page: $ref: "#/components/schemas/TeamsHierarchyLinksResponseMetaPage" type: object TeamsHierarchyLinksResponseMetaPage: description: Metadata related to paging information that is included in the response when querying the team hierarchy links properties: first_number: description: First page number. format: int64 type: integer first_offset: description: First offset. format: int64 type: integer last_number: description: Last page number. format: int64 type: integer last_offset: description: Last offset. format: int64 nullable: true type: integer limit: description: Page limit, when offset pagination is used. format: int64 type: integer next_number: description: Next page number. format: int64 nullable: true type: integer next_offset: description: Next offset. format: int64 nullable: true type: integer number: description: Page number. format: int64 type: integer offset: description: Current offset, when offset pagination is used. format: int64 type: integer prev_number: description: Previous page number. format: int64 nullable: true type: integer prev_offset: description: Previous offset. format: int64 nullable: true type: integer size: description: Page size. format: int64 type: integer total: description: Total number of results. format: int64 type: integer type: description: Pagination type. example: "number_size" type: string type: object TeamsOwnershipMappingBatchError: description: An error encountered while validating or applying an operation. properties: detail: description: A human-readable explanation specific to this error. example: "prefix match_type is not enabled for this org" type: string status: description: The HTTP status code applicable to this error. example: "400" type: string title: description: A short, human-readable summary of the error. example: "Bad Request" type: string required: - status - title type: object TeamsOwnershipMappingBatchOperation: description: A single add or remove operation, applied atomically with every other operation in the request. properties: data: $ref: "#/components/schemas/TeamsOwnershipMappingBatchOperationData" op: $ref: "#/components/schemas/TeamsOwnershipMappingBatchOperationOp" ref: $ref: "#/components/schemas/TeamsOwnershipMappingBatchOperationRef" required: - op type: object TeamsOwnershipMappingBatchOperationData: description: The mapping to add. Required when `op` is `add`. properties: attributes: $ref: "#/components/schemas/TeamsOwnershipMappingBatchOperationDataAttributes" type: $ref: "#/components/schemas/TeamsOwnershipMappingType" required: - type - attributes type: object TeamsOwnershipMappingBatchOperationDataAttributes: description: |- The attributes of the mapping to add. `team_handle` and `view_name` are required when `op` is `add`. At least one of `service` or `application_id` must be provided. properties: application_id: description: |- The ID of the RUM application this mapping applies to. For browser applications, provide the real application UUID — the team is applied to the view regardless of service. For mobile applications, omit this field (or set it to the nil UUID `00000000-0000-0000-0000-000000000000`) — the team is applied to the view and service combination across all applications. example: "11111111-2222-3333-4444-555555555555" format: uuid type: string match_type: $ref: "#/components/schemas/TeamsOwnershipMatchType" service: description: The RUM application's service name. For browser applications, this is optional. For mobile applications, this is required and scopes the ownership to a specific service. example: "web-checkout" type: string team_handle: description: The handle of the team that owns the matched RUM views. example: "team-rum" type: string view_name: description: The RUM view name to match, or its prefix when `match_type` is `prefix`. example: "/checkout" type: string type: object TeamsOwnershipMappingBatchOperationOp: description: Whether this operation adds a new mapping or removes an existing one. enum: - add - remove example: add type: string x-enum-varnames: ["ADD", "REMOVE"] TeamsOwnershipMappingBatchOperationRef: description: Identifies an existing mapping to remove. Required when `op` is `remove`. properties: id: description: The ID of the mapping to remove. example: "456" type: string type: $ref: "#/components/schemas/TeamsOwnershipMappingType" required: - type - id type: object TeamsOwnershipMappingBatchRequest: description: The request body for bulk-creating and bulk-removing teams ownership mappings. properties: atomic:operations: description: The list of add and remove operations to apply atomically. items: $ref: "#/components/schemas/TeamsOwnershipMappingBatchOperation" type: array required: - atomic:operations type: object TeamsOwnershipMappingBatchResponse: description: |- The response body for the bulk create and remove operation. On success, `atomic:results` contains one entry per operation. Add results appear before remove results and may not match request order. Correlate add results by their `type` and `id` rather than by array position. On failure, no operations were applied and `errors` describes what went wrong. properties: atomic:results: description: |- The result of each operation. Add operations are processed first, then remove operations, so results may not appear in the same order as the request. Present only on success. items: $ref: "#/components/schemas/TeamsOwnershipMappingBatchResult" type: array errors: description: The validation or processing errors encountered. Present only when the request could not be completed. items: $ref: "#/components/schemas/TeamsOwnershipMappingBatchError" type: array type: object TeamsOwnershipMappingBatchResult: description: |- The result of a single operation. Add operations are processed first, then remove operations, so results may not appear in the same order as the request. Empty for `remove` operations. properties: data: $ref: "#/components/schemas/TeamsOwnershipMappingBatchResultData" type: object TeamsOwnershipMappingBatchResultData: description: The mapping created by an `add` operation. properties: attributes: $ref: "#/components/schemas/TeamsOwnershipMappingBatchResultDataAttributes" id: description: The unique identifier of the teams ownership mapping. example: "123" type: string type: $ref: "#/components/schemas/TeamsOwnershipMappingType" required: - type - id - attributes type: object TeamsOwnershipMappingBatchResultDataAttributes: description: The attributes of a mapping created by an `add` operation. properties: application_id: description: The ID of the RUM application, when one was provided. example: "11111111-2222-3333-4444-555555555555" format: uuid type: string created_at: description: Timestamp when the mapping was created. example: "2026-01-15T09:30:00.000Z" format: date-time type: string created_by: description: The UUID of the user who created the mapping. example: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" type: string match_type: $ref: "#/components/schemas/TeamsOwnershipMatchType" org_id: description: The ID of the organization that owns this mapping. example: 123456 format: int64 type: integer service: description: The RUM application's service name, when one was provided. example: "web-checkout" type: string team_handle: description: The handle of the team that owns the matched RUM views. example: "team-rum" type: string view_name: description: The RUM view name to match, or its prefix when `match_type` is `prefix`. example: "/checkout" type: string required: - team_handle - view_name - org_id - created_at - created_by - match_type type: object TeamsOwnershipMappingCreateData: description: The JSON:API data envelope for a teams ownership mapping create request. properties: attributes: $ref: "#/components/schemas/TeamsOwnershipMappingCreateDataAttributes" type: $ref: "#/components/schemas/TeamsOwnershipMappingType" required: - type - attributes type: object TeamsOwnershipMappingCreateDataAttributes: description: The attributes of the teams ownership mapping to create. properties: application_id: description: |- The ID of the RUM application this mapping applies to. For browser applications, provide the real application UUID — the team is applied to the view regardless of service. For mobile applications, omit this field (or set it to the nil UUID `00000000-0000-0000-0000-000000000000`) — the team is applied to the view and service combination across all applications. example: "11111111-2222-3333-4444-555555555555" format: uuid type: string match_type: $ref: "#/components/schemas/TeamsOwnershipMatchType" service: description: The RUM application's service name. For browser applications, this is optional. For mobile applications, this is required and scopes the ownership to a specific service. example: "web-checkout" type: string team_handle: description: The handle of the team that owns the matched RUM views. example: "team-rum" type: string view_name: description: The RUM view name to match, or its prefix when `match_type` is `prefix`. example: "/checkout" type: string required: - team_handle - view_name type: object TeamsOwnershipMappingCreateRequest: description: The request body for creating a teams ownership mapping. properties: data: $ref: "#/components/schemas/TeamsOwnershipMappingCreateData" required: - data type: object TeamsOwnershipMappingResponse: description: The response body for a single teams ownership mapping. properties: data: $ref: "#/components/schemas/TeamsOwnershipMappingResponseData" required: - data type: object TeamsOwnershipMappingResponseAttributes: description: The attributes of a teams ownership mapping. properties: application_id: description: |- The ID of the RUM application this mapping applies to. For browser applications, this is the real application UUID. For mobile applications, this is the nil UUID `00000000-0000-0000-0000-000000000000` (wildcard), meaning the ownership applies across all applications. example: "11111111-2222-3333-4444-555555555555" type: string created_at: description: Timestamp when the mapping was created. example: "2026-01-15T09:30:00.000Z" format: date-time type: string created_by: description: The UUID of the user who created the mapping. example: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" type: string match_type: $ref: "#/components/schemas/TeamsOwnershipMatchType" org_id: description: The ID of the organization that owns this mapping. example: 123456 format: int64 type: integer service: description: The RUM application's service name. For browser applications, may be empty. For mobile applications, this is the service that scopes the ownership. example: "web-checkout" type: string team_handle: description: The handle of the team that owns the matched RUM views. example: "team-rum" type: string view_name: description: The RUM view name to match, or its prefix when `match_type` is `prefix`. example: "/checkout" type: string required: - team_handle - view_name - service - application_id - org_id - created_at - created_by - match_type type: object TeamsOwnershipMappingResponseData: description: The JSON:API data envelope for a teams ownership mapping. properties: attributes: $ref: "#/components/schemas/TeamsOwnershipMappingResponseAttributes" id: description: The unique identifier of the teams ownership mapping. example: "123" type: string type: $ref: "#/components/schemas/TeamsOwnershipMappingType" required: - id - type - attributes type: object TeamsOwnershipMappingType: default: teams_ownership_mappings description: The type of the resource. The value should always be teams_ownership_mappings. enum: - teams_ownership_mappings example: teams_ownership_mappings type: string x-enum-varnames: ["TEAMS_OWNERSHIP_MAPPINGS"] TeamsOwnershipMappingsResponse: description: The response body for a list of teams ownership mappings. properties: data: description: A list of teams ownership mappings. items: $ref: "#/components/schemas/TeamsOwnershipMappingResponseData" type: array required: - data type: object TeamsOwnershipMatchType: default: exact description: How the `view_name` is matched against RUM view names. enum: - exact - prefix example: exact type: string x-enum-varnames: ["EXACT", "PREFIX"] TeamsOwnershipRuleResponseAttributes: description: The attributes of a teams ownership rule. properties: application_id: description: |- The ID of the RUM application this mapping applies to. For browser applications, this is the real application UUID. For mobile applications, this is the nil UUID `00000000-0000-0000-0000-000000000000` (wildcard), meaning the ownership applies across all applications. example: "11111111-2222-3333-4444-555555555555" type: string match_type: $ref: "#/components/schemas/TeamsOwnershipMatchType" service: description: The RUM application's service name. For browser applications, may be empty. For mobile applications, this is the service that scopes the ownership. example: "web-checkout" type: string teams: description: The teams that own the matched views, each paired with the ID of its underlying mapping. items: $ref: "#/components/schemas/TeamsOwnershipRuleTeamMapping" type: array view_name: description: The RUM view name to match, or its prefix when `match_type` is `prefix`. example: "/checkout" type: string required: - teams - view_name - service - application_id - match_type type: object TeamsOwnershipRuleResponseData: description: The JSON:API data envelope for a teams ownership rule. properties: attributes: $ref: "#/components/schemas/TeamsOwnershipRuleResponseAttributes" id: description: |- A deterministic identifier derived from the rule's grouping key. This ID cannot be used to delete the rule directly; delete individual mappings using the `mapping_id` under `teams` instead. example: "3b1e2f7a9c4d6e8f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f" type: string type: $ref: "#/components/schemas/TeamsOwnershipRuleType" required: - id - type - attributes type: object TeamsOwnershipRuleTeamMapping: description: An individual team's ownership entry within a teams ownership rule. properties: mapping_id: description: The ID of the underlying mapping, used to delete this team's ownership individually. example: "123" type: string team_handle: description: The handle of the owning team. example: "team-rum" type: string required: - team_handle - mapping_id type: object TeamsOwnershipRuleType: default: teams_ownership_grouped_mappings description: The type of the resource. The value should always be teams_ownership_grouped_mappings. enum: - teams_ownership_grouped_mappings example: teams_ownership_grouped_mappings type: string x-enum-varnames: ["TEAMS_OWNERSHIP_GROUPED_MAPPINGS"] TeamsOwnershipRulesResponse: description: The response body for a list of teams ownership rules. properties: data: description: A list of teams ownership rules. items: $ref: "#/components/schemas/TeamsOwnershipRuleResponseData" type: array required: - data type: object TeamsResponse: description: Response with multiple teams properties: data: description: Teams response data items: $ref: "#/components/schemas/Team" type: array included: description: Resources related to the team items: $ref: "#/components/schemas/TeamIncluded" type: array links: $ref: "#/components/schemas/TeamsResponseLinks" meta: $ref: "#/components/schemas/TeamsResponseMeta" type: object TeamsResponseLinks: description: Teams response links. properties: first: description: First link. type: string last: description: Last link. nullable: true type: string next: description: Next link. type: string prev: description: Previous link. nullable: true type: string self: description: Current link. type: string type: object TeamsResponseMeta: description: Teams response metadata. properties: pagination: $ref: "#/components/schemas/TeamsResponseMetaPagination" type: object TeamsResponseMetaPagination: description: Teams response metadata. properties: first_number: description: The first page number. format: int64 type: integer first_offset: description: The first offset. format: int64 type: integer last_number: description: The last page number. format: int64 nullable: true type: integer last_offset: description: The last offset. format: int64 type: integer limit: description: Pagination limit. format: int64 type: integer next_number: description: The next page number. format: int64 nullable: true type: integer next_offset: description: The next offset. format: int64 type: integer number: description: The current page number, when page-number pagination is used. format: int64 type: integer offset: description: The offset. format: int64 type: integer prev_number: description: The previous page number. format: int64 nullable: true type: integer prev_offset: description: The previous offset. format: int64 type: integer size: description: The page size, when page-number pagination is used. format: int64 type: integer total: description: Total results. format: int64 type: integer type: description: Pagination type. One of `offset_limit` or `number_size`. type: string type: object TemporalCloudOpenMetricsIntegrationAccountAuthenticationRequest: description: Authentication for creating the Temporal Cloud OpenMetrics integration account. Exactly one method is set. oneOf: - $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountBearerTokenAuthRequest" TemporalCloudOpenMetricsIntegrationAccountAuthenticationResponse: description: Authentication configured on the Temporal Cloud OpenMetrics integration account. oneOf: - $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountBearerTokenAuthResponse" TemporalCloudOpenMetricsIntegrationAccountAuthenticationUpdate: description: Authentication for updating the Temporal Cloud OpenMetrics integration account. Exactly one method is set. oneOf: - $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountBearerTokenAuthUpdate" TemporalCloudOpenMetricsIntegrationAccountBearerTokenAuthRequest: additionalProperties: false description: >- Bearer token authentication. Use the API key of a Temporal Cloud service account with the Metrics Read-Only account-level role. properties: auth_type: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountBearerTokenAuthType" token: description: Secret token used to authenticate with Temporal Cloud. example: your-token type: string writeOnly: true required: - auth_type - token type: object TemporalCloudOpenMetricsIntegrationAccountBearerTokenAuthResponse: description: The bearer token authentication method configured on the account. properties: auth_type: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountBearerTokenAuthType" required: - auth_type type: object TemporalCloudOpenMetricsIntegrationAccountBearerTokenAuthType: default: bearer_token description: The authentication method type. enum: - bearer_token example: bearer_token type: string x-enum-varnames: - BEARER_TOKEN TemporalCloudOpenMetricsIntegrationAccountBearerTokenAuthUpdate: additionalProperties: false description: >- Bearer token authentication. Use the API key of a Temporal Cloud service account with the Metrics Read-Only account-level role. Only the fields provided are changed. Omit `token` to keep the stored one. properties: auth_type: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountBearerTokenAuthType" token: description: Secret token used to authenticate with Temporal Cloud. example: your-token type: string writeOnly: true required: - auth_type type: object TemporalCloudOpenMetricsIntegrationAccountCreateAttributes: description: Writable attributes used to create a Temporal Cloud OpenMetrics integration account. properties: authentication: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountAuthenticationRequest" name: description: Human-readable name of the Temporal Cloud OpenMetrics integration account. example: temporal-cloud-prod type: string settings: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountSettingsRequest" required: - name - authentication - settings type: object TemporalCloudOpenMetricsIntegrationAccountCreateData: description: Data envelope for creating a Temporal Cloud OpenMetrics integration account. properties: attributes: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountCreateAttributes" type: $ref: "#/components/schemas/IntegrationAccountType" required: - type - attributes type: object TemporalCloudOpenMetricsIntegrationAccountCreateRequest: description: Request payload to create a Temporal Cloud OpenMetrics integration account. properties: data: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountCreateData" required: - data type: object TemporalCloudOpenMetricsIntegrationAccountResponse: description: Response payload for a single Temporal Cloud OpenMetrics integration account. properties: data: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountResponseData" required: - data type: object TemporalCloudOpenMetricsIntegrationAccountResponseAttributes: description: Attributes of a Temporal Cloud OpenMetrics integration account returned in responses. properties: authentication: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountAuthenticationResponse" dataflows: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationDataflowsResponse" name: description: Human-readable name of the Temporal Cloud OpenMetrics integration account. example: temporal-cloud-prod type: string settings: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountSettingsResponse" required: - name - settings type: object TemporalCloudOpenMetricsIntegrationAccountResponseData: description: Data envelope of a Temporal Cloud OpenMetrics integration account, including server-assigned identity. properties: attributes: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountResponseAttributes" id: description: Server-generated unique identifier of the Temporal Cloud OpenMetrics integration account. example: 7c2d4e91-5a3b-4f68-b0e2-9d1f6a8c3e57 readOnly: true type: string type: $ref: "#/components/schemas/IntegrationAccountType" required: - id - attributes - type type: object TemporalCloudOpenMetricsIntegrationAccountSettingsRequest: additionalProperties: false description: Settings for creating the Temporal Cloud OpenMetrics integration account. properties: include_opt_in_labels: description: >- When enabled, Datadog collects Temporal Cloud's [opt-in labels](https://docs.temporal.io/cloud/metrics/openmetrics/metrics-reference#opt-in-labels) (activity type, worker deployment name, and worker build ID) for more granularity on your existing metrics. Enabling them may increase metric collection latency. Defaults to `false`. example: false type: boolean namespaces_to_include: description: >- Comma-separated list of Temporal Cloud namespaces to collect metrics for. An entry can use `*` as a wildcard. For example, `prod-*` matches every namespace starting with `prod-`. Entries may contain only lowercase letters, digits, hyphens, periods, and `*`. Any other value is rejected with a `422` response. Omit this field or leave it empty to collect metrics for all namespaces. example: prod-*,billing.a1b2c type: string type: object TemporalCloudOpenMetricsIntegrationAccountSettingsResponse: description: Settings configured on the Temporal Cloud OpenMetrics integration account. properties: include_opt_in_labels: description: >- When enabled, Datadog collects Temporal Cloud's [opt-in labels](https://docs.temporal.io/cloud/metrics/openmetrics/metrics-reference#opt-in-labels) (activity type, worker deployment name, and worker build ID) for more granularity on your existing metrics. Enabling them may increase metric collection latency. example: false type: boolean namespaces_to_include: description: >- Comma-separated list of Temporal Cloud namespaces to collect metrics for. An entry can use `*` as a wildcard. For example, `prod-*` matches every namespace starting with `prod-`. Empty or absent when metrics are collected for all namespaces. example: prod-*,billing.a1b2c type: string type: object TemporalCloudOpenMetricsIntegrationAccountSettingsUpdate: additionalProperties: false description: Settings for updating the Temporal Cloud OpenMetrics integration account. Only the fields provided are changed. properties: include_opt_in_labels: description: >- When enabled, Datadog collects Temporal Cloud's [opt-in labels](https://docs.temporal.io/cloud/metrics/openmetrics/metrics-reference#opt-in-labels) (activity type, worker deployment name, and worker build ID) for more granularity on your existing metrics. Enabling them may increase metric collection latency. example: false type: boolean namespaces_to_include: description: >- Comma-separated list of Temporal Cloud namespaces to collect metrics for. An entry can use `*` as a wildcard. For example, `prod-*` matches every namespace starting with `prod-`. Entries may contain only lowercase letters, digits, hyphens, periods, and `*`. Any other value is rejected with a `422` response. Omit this field or leave it empty to collect metrics for all namespaces. example: prod-*,billing.a1b2c type: string type: object TemporalCloudOpenMetricsIntegrationAccountUpdateAttributes: description: >- Writable attributes used to update a Temporal Cloud OpenMetrics integration account. Every field is optional. Only the fields provided are changed. properties: authentication: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountAuthenticationUpdate" name: description: Human-readable name of the Temporal Cloud OpenMetrics integration account. example: temporal-cloud-prod type: string settings: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountSettingsUpdate" type: object TemporalCloudOpenMetricsIntegrationAccountUpdateData: description: Data envelope for updating a Temporal Cloud OpenMetrics integration account. properties: attributes: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountUpdateAttributes" id: description: Unique identifier of the Temporal Cloud OpenMetrics integration account to update. example: 7c2d4e91-5a3b-4f68-b0e2-9d1f6a8c3e57 type: string type: $ref: "#/components/schemas/IntegrationAccountType" required: - id - type - attributes type: object TemporalCloudOpenMetricsIntegrationAccountUpdateRequest: description: Request payload to update a Temporal Cloud OpenMetrics integration account. properties: data: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountUpdateData" required: - data type: object TemporalCloudOpenMetricsIntegrationAccountsResponse: description: Response payload for a list of Temporal Cloud OpenMetrics integration accounts. properties: data: description: List of Temporal Cloud OpenMetrics integration accounts. items: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountResponseData" type: array required: - data type: object TemporalCloudOpenMetricsIntegrationDataflowsResponse: description: Data Datadog collects from Temporal Cloud OpenMetrics, keyed by dataflow ID. properties: temporal-cloud-openmetrics-metrics: $ref: "#/components/schemas/TemporalCloudOpenMetricsMetricsIntegrationDataflowResponse" type: object TemporalCloudOpenMetricsMetricsIntegrationDataflowResponse: description: >- Temporal Cloud operational metrics for your namespaces, workflows, and task queues, such as workflow and activity rates, task polling, and service request latency, collected from Temporal Cloud's OpenMetrics endpoint. This is the integration's only collection: it is always on and cannot be turned off, which is why it appears only in responses. properties: enabled: description: Whether Datadog collects this data. Always `true`, because this collection cannot be turned off. example: true readOnly: true type: boolean status: $ref: "#/components/schemas/IntegrationAccountDataflowStatus" type: object TemporaryGrantRequestAttributes: description: Request history and the linked grant state. List and detail reads include grant_state for approved requests. Decision responses record the decision. Read the request for current grant state. properties: created_at: description: When the request was submitted. example: "2028-02-16T00:00:00Z" format: date-time type: string decided_at: description: When the decision or cancellation was recorded. example: "2028-02-16T00:00:00Z" format: date-time type: string decided_by_user_id: description: UUID of the reviewer, or of the requester if the request was canceled. example: 12345678-1234-1234-1234-123456789012 format: uuid type: string entity_key: description: The requester identity resolved by the server. example: user_handle:jane@example.com type: string expires_at: description: Immutable exclusive expiry, normalized to UTC microsecond precision. example: "2028-02-16T00:00:00Z" format: date-time type: string grant_state: $ref: "#/components/schemas/TemporaryGrantRequestGrantState" justification: description: Reason for requesting temporary credits. Trimmed and limited to 4096 UTF-8 bytes. example: Credits needed to finish the incident investigation. maxLength: 4096 minLength: 1 type: string quota_namespace: description: The quota namespace. Only AI credits are supported. example: ai_credits type: string requested_by_user_id: description: UUID of the authenticated requester. example: 12345678-1234-1234-1234-123456789012 format: uuid type: string status: $ref: "#/components/schemas/TemporaryGrantRequestStatus" total: description: Target monthly AI credit limit in positive whole credits, not additional credits. Fractional credits are not accepted. example: 200 format: int64 maximum: 9223372036854 minimum: 1 type: integer required: - quota_namespace - entity_key - requested_by_user_id - total - justification - expires_at - status - created_at type: object TemporaryGrantRequestCreateAttributes: additionalProperties: false description: Immutable terms and justification for a temporary grant request. properties: expires_at: description: Exclusive expiry. Must be a future timestamp with a timezone. Date-only values are rejected. If omitted or null, defaults to the next UTC month boundary. Approval accepts this deadline unchanged. example: "2028-02-16T00:00:00Z" format: date-time nullable: true type: string justification: description: Reason for requesting temporary credits. Trimmed and limited to 4096 UTF-8 bytes. example: Credits needed to finish the incident investigation. maxLength: 4096 minLength: 1 type: string total: description: Target monthly AI credit limit in positive whole credits, not additional credits. Fractional credits are not accepted. example: 200 format: int64 maximum: 9223372036854 minimum: 1 type: integer required: - total - justification type: object TemporaryGrantRequestCreateData: description: The request resource to create. The server generates its ID. properties: attributes: $ref: "#/components/schemas/TemporaryGrantRequestCreateAttributes" type: $ref: "#/components/schemas/TemporaryGrantRequestType" required: - type - attributes type: object TemporaryGrantRequestCreateRequest: description: Create a request for the authenticated human user. properties: data: $ref: "#/components/schemas/TemporaryGrantRequestCreateData" required: - data type: object TemporaryGrantRequestData: description: A temporary grant request resource. properties: attributes: $ref: "#/components/schemas/TemporaryGrantRequestAttributes" id: description: Server-generated request UUID. example: 12345678-1234-1234-1234-123456789012 format: uuid type: string type: $ref: "#/components/schemas/TemporaryGrantRequestType" required: - id - type - attributes type: object TemporaryGrantRequestDecision: description: Approve the exact submitted total and expiry, or deny the request. enum: - approved - denied example: approved type: string x-enum-varnames: - APPROVED - DENIED TemporaryGrantRequestDecisionAttributes: additionalProperties: false description: Binary decision. Overrides, reason fields, and unknown attributes are rejected, including null values. properties: decision: $ref: "#/components/schemas/TemporaryGrantRequestDecision" required: - decision type: object TemporaryGrantRequestDecisionData: description: A decision on a pending request. properties: attributes: $ref: "#/components/schemas/TemporaryGrantRequestDecisionAttributes" id: description: Request UUID. Must match request_id in the path. Missing or mismatched IDs return 400 Bad Request. example: 12345678-1234-1234-1234-123456789012 format: uuid type: string type: $ref: "#/components/schemas/TemporaryGrantRequestType" required: - id - type - attributes type: object TemporaryGrantRequestDecisionRequest: description: Approve or deny a pending request. properties: data: $ref: "#/components/schemas/TemporaryGrantRequestDecisionData" required: - data type: object TemporaryGrantRequestGrantState: description: Current state of the grant associated with an approved request. Replaced means a newer grant superseded this grant. The newer grant might no longer be active. This field is absent for requests that weren't approved. enum: - active - expired - revoked - replaced example: active type: string x-enum-varnames: - ACTIVE - EXPIRED - REVOKED - REPLACED TemporaryGrantRequestListMeta: description: Pagination metadata. properties: page: $ref: "#/components/schemas/TemporaryGrantRequestPage" required: - page type: object TemporaryGrantRequestListResponse: description: A page of temporary grant requests, ordered by UUID rather than creation time. properties: data: description: Requests visible to the authenticated caller. items: $ref: "#/components/schemas/TemporaryGrantRequestData" type: array meta: $ref: "#/components/schemas/TemporaryGrantRequestListMeta" required: - data - meta type: object TemporaryGrantRequestPage: description: UUID cursor pagination. A full final page can return a cursor followed by an empty page. properties: next_cursor: description: Use this UUID as page[cursor] to retrieve the next page. Omitted when the page is not full. example: 12345678-1234-1234-1234-123456789012 format: uuid type: string type: object TemporaryGrantRequestResponse: description: A single temporary grant request. properties: data: $ref: "#/components/schemas/TemporaryGrantRequestData" required: - data type: object TemporaryGrantRequestStatus: description: The durable request decision, independent of whether its grant is still active. enum: - pending - approved - denied - cancelled example: pending type: string x-enum-varnames: - PENDING - APPROVED - DENIED - CANCELLED TemporaryGrantRequestType: default: temporary_grant_requests description: The temporary grant request resource type. enum: - temporary_grant_requests example: temporary_grant_requests type: string x-enum-varnames: - TEMPORARY_GRANT_REQUESTS TenancyConfig: description: Response containing a single OCI tenancy integration configuration. example: data: attributes: config_version: 2 cost_collection_enabled: true dd_compartment_id: ocid.compartment.test dd_stack_id: ocid.stack.test home_region: us-ashburn-1 logs_config: compartment_tag_filters: - compartment.test enabled: true enabled_services: - compute metrics_config: compartment_tag_filters: - compartment.test enabled: true excluded_services: - compute regions_config: available: - us-ashburn-1 - us-phoenix-1 disabled: - us-phoenix-1 enabled: - us-ashburn-1 resource_collection_enabled: true user_ocid: ocid.user.test id: ocid.tenancy.test type: oci_tenancy properties: data: $ref: "#/components/schemas/TenancyConfigData" type: object TenancyConfigData: description: A single OCI tenancy integration configuration resource object containing the tenancy ID, type, and configuration attributes. properties: attributes: $ref: "#/components/schemas/TenancyConfigDataAttributes" id: description: The OCID of the OCI tenancy. type: string type: $ref: "#/components/schemas/UpdateTenancyConfigDataType" required: - type type: object TenancyConfigDataAttributes: description: Attributes of an OCI tenancy integration configuration, including authentication details, region settings, and collection options. properties: billing_plan_id: description: The identifier of the billing plan associated with the OCI tenancy. format: int32 maximum: 2147483647 type: integer config_version: description: Version number of the integration the tenancy is integrated with format: int64 type: integer cost_collection_enabled: description: Whether cost data collection from OCI is enabled for the tenancy. type: boolean dd_compartment_id: description: The OCID of the OCI compartment used by the Datadog integration stack. type: string dd_stack_id: description: The OCID of the OCI Resource Manager stack used by the Datadog integration. type: string home_region: description: The home region of the OCI tenancy (for example, us-ashburn-1). type: string logs_config: $ref: "#/components/schemas/TenancyConfigDataAttributesLogsConfig" metrics_config: $ref: "#/components/schemas/TenancyConfigDataAttributesMetricsConfig" parent_tenancy_name: description: The name of the parent OCI tenancy, if applicable. type: string regions_config: $ref: "#/components/schemas/TenancyConfigDataAttributesRegionsConfig" resource_collection_enabled: description: Whether resource collection from OCI is enabled for the tenancy. type: boolean tenancy_name: description: The human-readable name of the OCI tenancy. type: string user_ocid: description: The OCID of the OCI user used by the Datadog integration for authentication. type: string type: object TenancyConfigDataAttributesLogsConfig: description: Log collection configuration for an OCI tenancy, indicating which compartments and services have log collection enabled. properties: compartment_tag_filters: description: List of compartment tag filters scoping log collection to specific compartments. items: description: A compartment tag filter in key:value format (for example, datadog:true). type: string type: array enabled: description: Whether log collection is enabled for the tenancy. type: boolean enabled_services: description: List of OCI service names for which log collection is enabled. items: description: An OCI service name for which log collection is enabled (for example, compute). type: string type: array type: object TenancyConfigDataAttributesMetricsConfig: description: Metrics collection configuration for an OCI tenancy, indicating which compartments and services are included or excluded. properties: compartment_tag_filters: description: List of compartment tag filters scoping metrics collection to specific compartments. items: description: A compartment tag filter in key:value format (for example, datadog:true). type: string type: array enabled: description: Whether metrics collection is enabled for the tenancy. type: boolean excluded_services: description: List of OCI service names excluded from metrics collection. items: description: An OCI service name excluded from metrics collection (for example, compute). type: string type: array type: object TenancyConfigDataAttributesRegionsConfig: description: Region configuration for an OCI tenancy, indicating which regions are available, enabled, or disabled for data collection. properties: available: description: List of OCI regions available for data collection in the tenancy. items: description: An OCI region identifier (for example, us-ashburn-1). type: string type: array disabled: description: List of OCI regions explicitly disabled for data collection. items: description: An OCI region identifier (for example, us-phoenix-1). type: string type: array enabled: description: List of OCI regions enabled for data collection. items: description: An OCI region identifier (for example, us-ashburn-1). type: string type: array type: object TenancyConfigList: description: Response containing a list of OCI tenancy integration configurations. example: data: - attributes: config_version: 2 cost_collection_enabled: true dd_compartment_id: ocid.compartment.test dd_stack_id: ocid.stack.test home_region: us-ashburn-1 logs_config: compartment_tag_filters: - compartment.test enabled: true enabled_services: - compute metrics_config: compartment_tag_filters: - compartment.test enabled: true excluded_services: - compute regions_config: available: - us-ashburn-1 - us-phoenix-1 disabled: - us-phoenix-1 enabled: - us-ashburn-1 resource_collection_enabled: true user_ocid: ocid.user.test id: ocid.tenancy.test type: oci_tenancy properties: data: description: List of OCI tenancy integration configuration objects. items: $ref: "#/components/schemas/TenancyConfigData" type: array required: - data type: object TenancyProductsData: description: A single OCI tenancy product resource object containing the tenancy ID, type, and product attributes. properties: attributes: $ref: "#/components/schemas/TenancyProductsDataAttributes" id: description: The OCID of the OCI tenancy. type: string type: $ref: "#/components/schemas/TenancyProductsDataType" required: - type type: object TenancyProductsDataAttributes: description: Attributes of an OCI tenancy product resource, containing the list of available products and their enablement status. properties: products: description: List of Datadog products and their enablement status for the tenancy. items: $ref: "#/components/schemas/TenancyProductsDataAttributesProductsItems" type: array type: object TenancyProductsDataAttributesProductsItems: description: An individual Datadog product with its enablement status for a tenancy. properties: enabled: description: Indicates whether the product is enabled for the tenancy. type: boolean product_key: description: The unique key identifying the Datadog product (for example, CLOUD_SECURITY_POSTURE_MANAGEMENT). type: string type: object TenancyProductsDataType: default: oci_tenancy_product description: OCI tenancy product resource type. enum: - oci_tenancy_product example: oci_tenancy_product type: string x-enum-varnames: - OCI_TENANCY_PRODUCT TenancyProductsList: description: Response containing a list of OCI tenancy product resources with their product enablement status. example: data: - attributes: products: - enabled: true product_key: CLOUD_SECURITY_POSTURE_MANAGEMENT id: ocid.tenancy.test type: oci_tenancy_product properties: data: description: List of OCI tenancy product resource objects. items: $ref: "#/components/schemas/TenancyProductsData" type: array required: - data type: object TestOptimizationDeleteServiceSettingsRequest: description: Request object for deleting Test Optimization service settings. properties: data: $ref: "#/components/schemas/TestOptimizationDeleteServiceSettingsRequestData" required: - data type: object TestOptimizationDeleteServiceSettingsRequestAttributes: description: Attributes for deleting Test Optimization service settings. properties: env: description: The environment name. If omitted, defaults to `none`. example: prod type: string repository_id: description: The repository identifier. example: github.com/datadog/shopist minLength: 1 type: string service_name: description: The service name. example: shopist minLength: 1 type: string required: - repository_id - service_name type: object TestOptimizationDeleteServiceSettingsRequestData: description: Data object for delete service settings request. properties: attributes: $ref: "#/components/schemas/TestOptimizationDeleteServiceSettingsRequestAttributes" type: $ref: "#/components/schemas/TestOptimizationDeleteServiceSettingsRequestDataType" required: - type - attributes type: object TestOptimizationDeleteServiceSettingsRequestDataType: description: |- JSON:API type for delete service settings request. The value must always be `test_optimization_delete_service_settings_request`. enum: - test_optimization_delete_service_settings_request example: test_optimization_delete_service_settings_request type: string x-enum-varnames: - TEST_OPTIMIZATION_DELETE_SERVICE_SETTINGS_REQUEST TestOptimizationFlakyTestsManagementPoliciesAttemptToFix: description: Configuration for the attempt-to-fix Flaky Tests Management policy. properties: retries: description: Number of retries when attempting to fix a flaky test. Must be greater than 0. example: 3 format: int64 type: integer type: object TestOptimizationFlakyTestsManagementPoliciesAttributes: description: Attributes of the Flaky Tests Management policies for a repository. properties: attempt_to_fix: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesAttemptToFix" disabled: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesDisabled" quarantined: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesQuarantined" repository_id: description: The repository identifier. example: github.com/datadog/shopist type: string type: object TestOptimizationFlakyTestsManagementPoliciesAutoDisableRule: description: Automatic disable triggering rule based on a time window and test status. properties: enabled: description: Whether this auto-disable rule is enabled. example: false type: boolean status: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesDisabledStatus" window_seconds: description: Time window in seconds over which flakiness is evaluated. Must be greater than 0. example: 3600 format: int64 type: integer type: object TestOptimizationFlakyTestsManagementPoliciesAutoQuarantineRule: description: Automatic quarantine triggering rule based on a time window. properties: enabled: description: Whether this auto-quarantine rule is enabled. example: true type: boolean window_seconds: description: Time window in seconds over which flakiness is evaluated. Must be greater than 0. example: 3600 format: int64 type: integer type: object TestOptimizationFlakyTestsManagementPoliciesBranchRule: description: Branch filtering rule for a Flaky Tests Management policy. properties: branches: description: List of branches to which the policy applies. example: - main items: description: A branch name. type: string type: array enabled: description: Whether this branch rule is enabled. example: true type: boolean excluded_branches: description: List of branches excluded from the policy. example: [] items: description: A branch name. type: string type: array excluded_test_services: description: List of test services excluded from the policy. example: [] items: description: A test service name. type: string type: array type: object TestOptimizationFlakyTestsManagementPoliciesData: description: Data object for Flaky Tests Management policies response. properties: attributes: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesAttributes" id: description: The repository identifier used as the resource ID. example: github.com/datadog/shopist type: string type: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesType" type: object TestOptimizationFlakyTestsManagementPoliciesDisabled: description: Configuration for the disabled Flaky Tests Management policy. properties: auto_disable_rule: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesAutoDisableRule" branch_rule: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesBranchRule" enabled: description: Whether the disabled policy is enabled. example: false type: boolean failure_rate_rule: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesDisabledFailureRateRule" type: object TestOptimizationFlakyTestsManagementPoliciesDisabledFailureRateRule: description: Failure-rate-based rule for the disabled policy. properties: branches: description: List of branches to which this rule applies. example: [] items: description: A branch name. type: string type: array enabled: description: Whether this failure rate rule is enabled. example: false type: boolean min_runs: description: Minimum number of runs required before the rule is evaluated. Must be greater than or equal to 0. example: 10 format: int64 type: integer status: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesDisabledStatus" threshold: description: Failure rate threshold (0.0–1.0) above which the rule triggers. example: 0.5 format: double type: number type: object TestOptimizationFlakyTestsManagementPoliciesDisabledStatus: description: |- Test status that the disable policy applies to. Must be either `active` or `quarantined`. enum: - active - quarantined example: active type: string x-enum-varnames: - ACTIVE - QUARANTINED TestOptimizationFlakyTestsManagementPoliciesGetRequest: description: Request object for getting Flaky Tests Management policies. properties: data: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesGetRequestData" required: - data type: object TestOptimizationFlakyTestsManagementPoliciesGetRequestAttributes: description: Attributes for requesting Flaky Tests Management policies. properties: repository_id: description: The repository identifier. example: github.com/datadog/shopist minLength: 1 type: string required: - repository_id type: object TestOptimizationFlakyTestsManagementPoliciesGetRequestData: description: Data object for get Flaky Tests Management policies request. properties: attributes: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesGetRequestAttributes" type: $ref: "#/components/schemas/TestOptimizationGetFlakyTestsManagementPoliciesRequestDataType" required: - type - attributes type: object TestOptimizationFlakyTestsManagementPoliciesQuarantined: description: Configuration for the quarantined Flaky Tests Management policy. properties: auto_quarantine_rule: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesAutoQuarantineRule" branch_rule: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesBranchRule" enabled: description: Whether the quarantined policy is enabled. example: true type: boolean failure_rate_rule: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesQuarantinedFailureRateRule" type: object TestOptimizationFlakyTestsManagementPoliciesQuarantinedFailureRateRule: description: Failure-rate-based rule for the quarantined policy. properties: branches: description: List of branches to which this rule applies. example: - main items: description: A branch name. type: string type: array enabled: description: Whether this failure rate rule is enabled. example: true type: boolean min_runs: description: Minimum number of runs required before the rule is evaluated. Must be greater than or equal to 0. example: 10 format: int64 type: integer threshold: description: Failure rate threshold (0.0–1.0) above which the rule triggers. example: 0.5 format: double type: number type: object TestOptimizationFlakyTestsManagementPoliciesResponse: description: Response object containing Flaky Tests Management policies for a repository. properties: data: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesData" type: object TestOptimizationFlakyTestsManagementPoliciesType: description: |- JSON:API type for Flaky Tests Management policies response. The value must always be `test_optimization_flaky_tests_management_policies`. enum: - test_optimization_flaky_tests_management_policies example: test_optimization_flaky_tests_management_policies type: string x-enum-varnames: - TEST_OPTIMIZATION_FLAKY_TESTS_MANAGEMENT_POLICIES TestOptimizationFlakyTestsManagementPoliciesUpdateRequest: description: Request object for updating Flaky Tests Management policies. properties: data: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesUpdateRequestData" required: - data type: object TestOptimizationFlakyTestsManagementPoliciesUpdateRequestAttributes: description: |- Attributes for updating Flaky Tests Management policies. Only provided policy blocks are updated; omitted blocks are left unchanged. properties: attempt_to_fix: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesAttemptToFix" disabled: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesDisabled" quarantined: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesQuarantined" repository_id: description: The repository identifier. example: github.com/datadog/shopist minLength: 1 type: string required: - repository_id type: object TestOptimizationFlakyTestsManagementPoliciesUpdateRequestData: description: Data object for update Flaky Tests Management policies request. properties: attributes: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesUpdateRequestAttributes" type: $ref: "#/components/schemas/TestOptimizationUpdateFlakyTestsManagementPoliciesRequestDataType" required: - type - attributes type: object TestOptimizationGetFlakyTestsManagementPoliciesRequestDataType: description: |- JSON:API type for get Flaky Tests Management policies request. The value must always be `test_optimization_get_flaky_tests_management_policies_request`. enum: - test_optimization_get_flaky_tests_management_policies_request example: test_optimization_get_flaky_tests_management_policies_request type: string x-enum-varnames: - TEST_OPTIMIZATION_GET_FLAKY_TESTS_MANAGEMENT_POLICIES_REQUEST TestOptimizationGetServiceSettingsRequest: description: Request object for getting Test Optimization service settings. properties: data: $ref: "#/components/schemas/TestOptimizationGetServiceSettingsRequestData" required: - data type: object TestOptimizationGetServiceSettingsRequestAttributes: description: Attributes for requesting Test Optimization service settings. properties: env: description: The environment name. If omitted, defaults to `none`. example: prod type: string repository_id: description: The repository identifier. example: github.com/datadog/shopist minLength: 1 type: string service_name: description: The service name. example: shopist minLength: 1 type: string required: - repository_id - service_name type: object TestOptimizationGetServiceSettingsRequestData: description: Data object for get service settings request. properties: attributes: $ref: "#/components/schemas/TestOptimizationGetServiceSettingsRequestAttributes" type: $ref: "#/components/schemas/TestOptimizationGetServiceSettingsRequestDataType" required: - type - attributes type: object TestOptimizationGetServiceSettingsRequestDataType: description: |- JSON:API type for get service settings request. The value must always be `test_optimization_get_service_settings_request`. enum: - test_optimization_get_service_settings_request example: test_optimization_get_service_settings_request type: string x-enum-varnames: - TEST_OPTIMIZATION_GET_SERVICE_SETTINGS_REQUEST TestOptimizationServiceSettingsAttributes: description: Attributes for Test Optimization service settings. properties: auto_test_retries_enabled: description: Whether Auto Test Retries are enabled for this service. example: false type: boolean auto_test_retries_enabled_is_overridden: description: Whether the Auto Test Retries setting is overridden at the service level. example: false type: boolean code_coverage_enabled: description: Whether Code Coverage is enabled for this service. example: false type: boolean code_coverage_enabled_is_overridden: description: Whether the Code Coverage setting is overridden at the service level. example: false type: boolean early_flake_detection_enabled: description: Whether Early Flake Detection is enabled for this service. example: false type: boolean early_flake_detection_enabled_is_overridden: description: Whether the Early Flake Detection setting is overridden at the service level. example: false type: boolean env: description: The environment name. example: prod type: string failed_test_replay_enabled: description: Whether Failed Test Replay is enabled for this service. example: false type: boolean failed_test_replay_enabled_is_overridden: description: Whether the Failed Test Replay setting is overridden at the service level. example: false type: boolean pr_comments_enabled: description: Whether PR Comments are enabled. This value reflects the repository-level setting and cannot be overridden at the service level. example: false type: boolean repository_id: description: The repository identifier. example: github.com/datadog/shopist type: string service_name: description: The service name. example: shopist type: string test_impact_analysis_enabled: description: Whether Test Impact Analysis is enabled for this service. example: true type: boolean test_impact_analysis_enabled_is_overridden: description: Whether the Test Impact Analysis setting is overridden at the service level. example: true type: boolean type: object TestOptimizationServiceSettingsData: description: Data object for Test Optimization service settings response. properties: attributes: $ref: "#/components/schemas/TestOptimizationServiceSettingsAttributes" id: description: Unique identifier for the service settings. example: 9b8a7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d type: string type: $ref: "#/components/schemas/TestOptimizationServiceSettingsType" type: object TestOptimizationServiceSettingsResponse: description: Response object containing Test Optimization service settings. properties: data: $ref: "#/components/schemas/TestOptimizationServiceSettingsData" type: object TestOptimizationServiceSettingsType: description: |- JSON:API type for service settings response. The value must always be `test_optimization_service_settings`. enum: - test_optimization_service_settings example: test_optimization_service_settings type: string x-enum-varnames: - TEST_OPTIMIZATION_SERVICE_SETTINGS TestOptimizationUpdateFlakyTestsManagementPoliciesRequestDataType: description: |- JSON:API type for update Flaky Tests Management policies request. The value must always be `test_optimization_update_flaky_tests_management_policies_request`. enum: - test_optimization_update_flaky_tests_management_policies_request example: test_optimization_update_flaky_tests_management_policies_request type: string x-enum-varnames: - TEST_OPTIMIZATION_UPDATE_FLAKY_TESTS_MANAGEMENT_POLICIES_REQUEST TestOptimizationUpdateServiceSettingsRequest: description: Request object for updating Test Optimization service settings. properties: data: $ref: "#/components/schemas/TestOptimizationUpdateServiceSettingsRequestData" required: - data type: object TestOptimizationUpdateServiceSettingsRequestAttributes: description: |- Attributes for updating Test Optimization service settings. All non-required fields are optional; only provided fields will be updated. Setting a field to `null` is a no-op. To reset a setting to inherit from the repository level, use the corresponding `_inherit` field. properties: auto_test_retries_enabled: description: Whether Auto Test Retries are enabled for this service. Setting to `null` is a no-op; use `auto_test_retries_enabled_inherit` to reset to repository-level inheritance. example: false type: boolean auto_test_retries_enabled_inherit: description: When `true`, resets the Auto Test Retries setting to inherit from the repository level. example: false type: boolean code_coverage_enabled: description: Whether Code Coverage is enabled for this service. Setting to `null` is a no-op; use `code_coverage_enabled_inherit` to reset to repository-level inheritance. example: false type: boolean code_coverage_enabled_inherit: description: When `true`, resets the Code Coverage setting to inherit from the repository level. example: false type: boolean early_flake_detection_enabled: description: Whether Early Flake Detection is enabled for this service. Setting to `null` is a no-op; use `early_flake_detection_enabled_inherit` to reset to repository-level inheritance. example: false type: boolean early_flake_detection_enabled_inherit: description: When `true`, resets the Early Flake Detection setting to inherit from the repository level. example: false type: boolean env: description: The environment name. If omitted, defaults to `none`. example: prod type: string failed_test_replay_enabled: description: Whether Failed Test Replay is enabled for this service. Setting to `null` is a no-op; use `failed_test_replay_enabled_inherit` to reset to repository-level inheritance. example: false type: boolean failed_test_replay_enabled_inherit: description: When `true`, resets the Failed Test Replay setting to inherit from the repository level. example: false type: boolean pr_comments_enabled: description: This field is ignored. PR Comments cannot be overridden at the service level. example: false type: boolean repository_id: description: The repository identifier. example: github.com/datadog/shopist minLength: 1 type: string service_name: description: The service name. example: shopist minLength: 1 type: string test_impact_analysis_enabled: description: Whether Test Impact Analysis is enabled for this service. Setting to `null` is a no-op; use `test_impact_analysis_enabled_inherit` to reset to repository-level inheritance. example: true type: boolean test_impact_analysis_enabled_inherit: description: When `true`, resets the Test Impact Analysis setting to inherit from the repository level. example: true type: boolean required: - repository_id - service_name type: object TestOptimizationUpdateServiceSettingsRequestData: description: Data object for update service settings request. properties: attributes: $ref: "#/components/schemas/TestOptimizationUpdateServiceSettingsRequestAttributes" type: $ref: "#/components/schemas/TestOptimizationUpdateServiceSettingsRequestDataType" required: - type - attributes type: object TestOptimizationUpdateServiceSettingsRequestDataType: description: |- JSON:API type for update service settings request. The value must always be `test_optimization_update_service_settings_request`. enum: - test_optimization_update_service_settings_request example: test_optimization_update_service_settings_request type: string x-enum-varnames: - TEST_OPTIMIZATION_UPDATE_SERVICE_SETTINGS_REQUEST TicketCreationRuleAction: description: The action to take when the ticket creation rule matches a finding. properties: assignee_id: description: The UUID of the default assignee for created tickets. example: "22222222-2222-2222-2222-222222222222" format: uuid type: string fields: description: |- Target-specific fields of the ticket to create. For `target: jira`, the custom fields of the Jira issue. For the list of available fields, see [Jira documentation](https://developer.atlassian.com/cloud/jira/platform/rest/v2/api-group-issues/#api-rest-api-2-issue-createmeta-projectidorkey-issuetypes-issuetypeid-get). For `target: linear`, the optional keys `linear_project_id` (string, the identifier of the Linear project the issue is created in) and `linear_label_ids` (array of strings, the identifiers of the Linear labels applied to the issue). example: labels: - security type: object max_tickets_per_day: description: The maximum number of tickets the rule may create per day. If exceeded, one final ticket will be created, explaining the limit was hit and link back to the responsible rule. example: 100 format: int64 maximum: 500 minimum: 1 type: integer project_id: description: The UUID of the case management project. example: "11111111-1111-1111-1111-111111111111" format: uuid type: string target: $ref: "#/components/schemas/TicketCreationTarget" required: - project_id - target - max_tickets_per_day type: object TicketCreationRuleActionResponse: description: The action to take when the ticket creation rule matches a finding. properties: assignee_id: description: The UUID of the default assignee for created tickets. example: "22222222-2222-2222-2222-222222222222" format: uuid type: string auto_disabled_reason: description: The reason the rule was automatically disabled by the system due to a ticketing integration error. example: "Daily ticket creation limit exceeded" type: string fields: description: |- Target-specific fields of the ticket to create. For `target: jira`, the custom fields of the Jira issue. For the list of available fields, see [Jira documentation](https://developer.atlassian.com/cloud/jira/platform/rest/v2/api-group-issues/#api-rest-api-2-issue-createmeta-projectidorkey-issuetypes-issuetypeid-get). For `target: linear`, the optional keys `linear_project_id` (string, the identifier of the Linear project the issue is created in) and `linear_label_ids` (array of strings, the identifiers of the Linear labels applied to the issue). example: labels: - security type: object max_tickets_per_day: description: The maximum number of tickets the rule may create per day. If exceeded, one final ticket will be created, explaining the limit was hit and link back to the responsible rule. example: 100 format: int64 maximum: 500 minimum: 1 type: integer project_id: description: The UUID of the case management project. example: "11111111-1111-1111-1111-111111111111" format: uuid type: string target: $ref: "#/components/schemas/TicketCreationTarget" required: - project_id - target - max_tickets_per_day type: object TicketCreationRuleAttributesCreate: description: Attributes for creating or updating a ticket creation rule. properties: action: $ref: "#/components/schemas/TicketCreationRuleAction" enabled: description: Whether the ticket creation rule is enabled. example: true type: boolean name: description: The name of the ticket creation rule. example: "Auto-create Jira tickets for critical findings" maxLength: 255 minLength: 1 type: string rule: $ref: "#/components/schemas/AutomationRuleScope" required: - name - rule - action type: object TicketCreationRuleAttributesResponse: description: Attributes of a ticket creation rule returned by the API. properties: action: $ref: "#/components/schemas/TicketCreationRuleActionResponse" created_at: description: The Unix timestamp in milliseconds when the rule was created. example: 1722439510282 format: int64 type: integer created_by: $ref: "#/components/schemas/AutomationRuleCreatedBy" enabled: description: Whether the ticket creation rule is enabled. example: true type: boolean modified_at: description: The Unix timestamp in milliseconds when the rule was last modified. example: 1722439510282 format: int64 type: integer modified_by: $ref: "#/components/schemas/AutomationRuleModifiedBy" name: description: The name of the ticket creation rule. example: "Auto-create Jira tickets for critical findings" maxLength: 255 minLength: 1 type: string rule: $ref: "#/components/schemas/AutomationRuleScope" required: - name - enabled - rule - action - created_at - created_by - modified_at - modified_by type: object TicketCreationRuleCreateRequest: description: The body of a ticket creation rule create request. properties: data: $ref: "#/components/schemas/TicketCreationRuleDataCreate" required: - data type: object TicketCreationRuleDataCreate: description: The data object for a ticket creation rule create request. properties: attributes: $ref: "#/components/schemas/TicketCreationRuleAttributesCreate" type: $ref: "#/components/schemas/TicketCreationRuleType" required: - type - attributes type: object TicketCreationRuleDataResponse: description: The data object for a ticket creation rule returned by the API. properties: attributes: $ref: "#/components/schemas/TicketCreationRuleAttributesResponse" id: description: The ID of the ticket creation rule. example: "00000000-0000-0000-0000-000000000000" format: uuid type: string type: $ref: "#/components/schemas/TicketCreationRuleType" required: - id - type - attributes type: object TicketCreationRuleDataUpdate: description: The data object for a ticket creation rule update request. The `id` must match the `rule_id` path parameter. properties: attributes: $ref: "#/components/schemas/TicketCreationRuleAttributesCreate" id: description: The ID of the ticket creation rule to update. example: "00000000-0000-0000-0000-000000000000" format: uuid type: string type: $ref: "#/components/schemas/TicketCreationRuleType" required: - id - type - attributes type: object TicketCreationRuleReorderData: description: The ordered list of all ticket creation rules. Every rule must be included. items: $ref: "#/components/schemas/TicketCreationRuleReorderItem" type: array TicketCreationRuleReorderItem: description: A reference to a ticket creation rule used for reordering. properties: id: description: The ID of the ticket creation rule. example: "00000000-0000-0000-0000-000000000000" format: uuid type: string type: $ref: "#/components/schemas/TicketCreationRuleType" required: - type - id type: object TicketCreationRuleReorderRequest: description: The body of a ticket creation rule reorder request. properties: data: $ref: "#/components/schemas/TicketCreationRuleReorderData" required: - data type: object TicketCreationRuleReorderResponse: description: The response of a ticket creation rule reorder request. properties: data: $ref: "#/components/schemas/TicketCreationRuleReorderData" required: - data type: object TicketCreationRuleResponse: description: A single ticket creation rule response. properties: data: $ref: "#/components/schemas/TicketCreationRuleDataResponse" required: - data type: object TicketCreationRuleType: description: The JSON:API type for ticket creation rules. enum: - ticket_creation_rules example: ticket_creation_rules type: string x-enum-varnames: - TICKET_CREATION_RULES TicketCreationRuleUpdateRequest: description: The body of a ticket creation rule update request. properties: data: $ref: "#/components/schemas/TicketCreationRuleDataUpdate" required: - data type: object TicketCreationRulesDataList: description: A list of ticket creation rule data objects. items: $ref: "#/components/schemas/TicketCreationRuleDataResponse" type: array TicketCreationRulesResponse: description: A list of ticket creation rules with pagination metadata. properties: data: $ref: "#/components/schemas/TicketCreationRulesDataList" links: $ref: "#/components/schemas/SecurityAutomationRulesLinks" meta: $ref: "#/components/schemas/SecurityAutomationRulesMeta" required: - data - meta - links type: object TicketCreationTarget: description: The ticketing system to create tickets in. enum: - jira - case_management - linear example: jira type: string x-enum-varnames: - JIRA - CASE_MANAGEMENT - LINEAR TimeAggregation: description: |- Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation. Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation. Notifications are only sent for new issues discovered during the window. Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation is done. example: 86400 format: int64 type: integer TimeRestriction: description: Defines a single time restriction rule with start and end times and the applicable weekdays. properties: end_day: $ref: "#/components/schemas/Weekday" end_time: description: Specifies the ending time for this restriction. type: string start_day: $ref: "#/components/schemas/Weekday" start_time: description: Specifies the starting time for this restriction. type: string type: object TimeRestrictions: description: Time restrictions during which the routing rule is active. Outside of these hours, the rule does not match and routing continues to subsequent rules. This is mutually exclusive with the action-level `support_hours` field. properties: restrictions: description: Defines the list of time-based restrictions. items: $ref: "#/components/schemas/TimeRestriction" type: array time_zone: description: Specifies the time zone applicable to the restrictions. example: "" type: string required: - time_zone - restrictions type: object TimelineCell: description: "Attributes of a timeline cell, representing a single event in a work item's chronological activity log (for example, a comment, status change, or assignment update)." properties: author: $ref: "#/components/schemas/TimelineCellAuthor" cell_content: $ref: "#/components/schemas/TimelineCellContent" created_at: description: Timestamp of when the cell was created format: date-time readOnly: true type: string deleted_at: description: Timestamp of when the cell was deleted format: date-time readOnly: true type: string modified_at: description: Timestamp of when the cell was last modified format: date-time readOnly: true type: string type: $ref: "#/components/schemas/TimelineCellType" type: object TimelineCellAuthor: description: The author of the timeline cell. Currently only user authors are supported. oneOf: - $ref: "#/components/schemas/TimelineCellAuthorUser" TimelineCellAuthorUser: description: A user who authored a timeline cell. properties: content: $ref: "#/components/schemas/TimelineCellAuthorUserContent" type: $ref: "#/components/schemas/TimelineCellAuthorUserType" type: object TimelineCellAuthorUserContent: description: Profile information for the user who authored the timeline cell. properties: email: description: The email address of the user. type: string handle: description: The Datadog handle of the user. type: string id: description: The UUID of the user. type: string name: description: The display name of the user. type: string type: object TimelineCellAuthorUserType: description: The type of timeline cell author. Currently only `USER` is supported. enum: - USER example: USER type: string x-enum-varnames: - USER TimelineCellContent: description: The content payload of a timeline cell, varying by cell type. oneOf: - $ref: "#/components/schemas/TimelineCellContentComment" TimelineCellContentComment: description: The content of a comment timeline cell. properties: message: description: The text content of the comment. Supports Markdown formatting. type: string type: object TimelineCellResource: description: A timeline cell resource representing a single entry in a work item's activity timeline. properties: attributes: $ref: "#/components/schemas/TimelineCell" id: description: Timeline cell's identifier example: aeadc05e-98a8-11ec-ac2c-da7ad0900001 type: string type: $ref: "#/components/schemas/TimelineCellResourceType" required: - id - type - attributes type: object TimelineCellResourceType: default: timeline_cell description: JSON:API resource type for timeline cells. enum: - timeline_cell example: timeline_cell type: string x-enum-varnames: - TIMELINE_CELL TimelineCellType: description: The type of content in the timeline cell. Currently only `COMMENT` is supported in this endpoint. enum: - COMMENT example: COMMENT type: string x-enum-varnames: - COMMENT TimelineResponse: description: Response containing the chronological list of timeline cells for a work item. properties: data: description: The `TimelineResponse` `data`. items: $ref: "#/components/schemas/TimelineCellResource" type: array type: object TimeseriesAnomalyInvestigationAnomaly: description: One of the most significant anomalies detected in the request. properties: anomaly_detection: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationDetection" detected_interval: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationInterval" display_interval: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationInterval" findings: description: Deterministic explanations for the anomaly, ordered by importance. example: [] items: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationFinding" maxItems: 3 type: array maximum_deviation: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationMaximumDeviation" series: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationSeries" tag_analysis: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationTagAnalysis" type: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationAnomalyType" required: - series - anomaly_detection - detected_interval - display_interval - type - maximum_deviation - tag_analysis - findings type: object TimeseriesAnomalyInvestigationAnomalyFinding: description: Finding that describes the anomaly when completed analysis produces no displayable influential tags. properties: description: description: Deterministic explanation of the finding. example: "The service:api series rose outside its expected range." type: string headline: description: Concise, deterministic finding title. example: "An anomaly was detected on service:api" type: string type: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationAnomalyFindingType" required: - type - headline - description type: object TimeseriesAnomalyInvestigationAnomalyFindingType: description: Finding category for an anomaly without a displayable influential tag. enum: - anomaly example: anomaly type: string x-enum-varnames: - ANOMALY TimeseriesAnomalyInvestigationAnomalyType: description: Direction of an anomaly relative to its expected range. enum: - spike - dip example: spike type: string x-enum-varnames: - SPIKE - DIP TimeseriesAnomalyInvestigationCompleteStatus: description: Status value indicating successful completion. enum: - complete example: complete type: string x-enum-varnames: - COMPLETE TimeseriesAnomalyInvestigationConfigurationSource: description: Source of the anomaly detection configuration. enum: - request_formula - watchdog_explains_default example: request_formula type: string x-enum-varnames: - REQUEST_FORMULA - WATCHDOG_EXPLAINS_DEFAULT TimeseriesAnomalyInvestigationDataSource: description: Data source for an anomaly investigation query. enum: - metrics example: metrics type: string x-enum-varnames: - METRICS TimeseriesAnomalyInvestigationDetection: description: Anomaly detection configuration used for the result. properties: configuration_source: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationConfigurationSource" profile: description: Applied Watchdog Explains profile, or null when the request supplied an explicit `anomalies()` formula. The current Watchdog profile is `watchdog_explains_v1`. example: nullable: true type: string required: - configuration_source - profile type: object TimeseriesAnomalyInvestigationFinding: description: Deterministic explanation for a detected anomaly. oneOf: - $ref: "#/components/schemas/TimeseriesAnomalyInvestigationInfluentialTagFinding" - $ref: "#/components/schemas/TimeseriesAnomalyInvestigationAnomalyFinding" TimeseriesAnomalyInvestigationFindingSynonym: description: Tag grouped under an influential tag by synonym analysis. properties: key: description: Synonymous tag key. example: app type: string values: description: Values associated with the synonymous tag. example: - api items: description: Synonymous tag value. example: api type: string type: array required: - key - values type: object TimeseriesAnomalyInvestigationFindingTag: description: Structured tag evidence for an influential-tag finding. properties: influence_type: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationInfluenceType" key: description: Influential tag key. example: service type: string rating: description: Influence rating from 1 through 5. example: 5.0 format: double maximum: 5 minimum: 1 type: number synonyms: description: Tags grouped with this tag by Variation of Influence synonym analysis. example: [] items: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationFindingSynonym" type: array values: description: Influential values for the tag key. example: - api items: description: Influential tag value. example: api type: string type: array required: - key - values - influence_type - rating - synonyms type: object TimeseriesAnomalyInvestigationFormula: description: Formula evaluated by the timeseries request. properties: formula: description: |- Formula expression referencing one or more named queries. When the expression does not contain an explicit `anomalies()` call, the endpoint applies the default Watchdog Explains anomaly detection configuration. example: query1 minLength: 1 type: string limit: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationFormulaLimit" required: - formula type: object TimeseriesAnomalyInvestigationFormulaLimit: description: Optional formula limit accepted for compatibility with Timeseries API requests. Formula limits have no effect on timeseries queries. properties: count: description: Requested result limit. This field has no effect on a timeseries anomaly investigation. example: 10 format: int64 minimum: 0 type: integer order: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationFormulaLimitOrder" type: object TimeseriesAnomalyInvestigationFormulaLimitOrder: description: Sort order used when applying a formula series limit. enum: - asc - desc example: desc type: string x-enum-varnames: - ASC - DESC TimeseriesAnomalyInvestigationInfluenceType: description: Kind of influence a tag has on a series. enum: - shape - value example: shape type: string x-enum-varnames: - SHAPE - VALUE TimeseriesAnomalyInvestigationInfluentialTagFinding: description: Finding that attributes an anomaly to an influential tag. properties: description: description: Deterministic explanation of the finding. example: "Filtering out service:api flattens the spike." type: string headline: description: Concise, deterministic finding title. example: "service:api is the likely cause" type: string tag: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationFindingTag" type: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationInfluentialTagFindingType" required: - type - headline - description - tag type: object TimeseriesAnomalyInvestigationInfluentialTagFindingType: description: Finding category for an influential tag. enum: - influential_tag example: influential_tag type: string x-enum-varnames: - INFLUENTIAL_TAG TimeseriesAnomalyInvestigationInterval: description: Inclusive time interval in milliseconds since the Unix epoch. properties: end: description: Timestamp of the final point in the interval. example: 1754406120000 format: int64 type: integer start: description: Inclusive start of the interval. example: 1754406060000 format: int64 type: integer required: - start - end type: object TimeseriesAnomalyInvestigationMaximumDeviation: description: Most anomalous point within the detected interval. properties: delta_from_boundary: description: Absolute distance between the observed value and the nearest anomaly boundary. example: 7.0 format: double minimum: 0 type: number timestamp: description: Point timestamp in milliseconds since the Unix epoch. example: 1754406090000 format: int64 type: integer value: description: Observed value at the point. example: 42.0 format: double type: number required: - timestamp - value - delta_from_boundary type: object TimeseriesAnomalyInvestigationMetaType: description: Response metadata type for a timeseries anomaly investigation. enum: - timeseries_anomaly_investigation example: timeseries_anomaly_investigation type: string x-enum-varnames: - TIMESERIES_ANOMALY_INVESTIGATION TimeseriesAnomalyInvestigationMetricQuery: description: Metrics query referenced by a formula. properties: aggregator: description: Optional scalar aggregator accepted for request compatibility. This field is ignored for timeseries queries. example: avg type: string cross_org_uuids: description: Optional organization UUID used for a cross-organization query. Each query accepts at most one UUID; use separate queries for separate organizations. Influential-tag analysis is currently unsupported for cross-organization queries, but anomaly detection still runs. example: - "00000000-0000-0000-0000-000000000000" items: description: Organization UUID to query. example: "00000000-0000-0000-0000-000000000000" minLength: 1 type: string maxItems: 1 type: array data_source: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationDataSource" name: description: Name used to reference this query from formulas. example: query1 minLength: 1 type: string query: description: Datadog metrics query expression. example: "avg:system.cpu.user{env:prod} by {service}" minLength: 1 type: string required: - data_source - name - query type: object TimeseriesAnomalyInvestigationQueryExecutionStatus: description: Current execution status for a named query. enum: - running - done example: done type: string x-enum-varnames: - RUNNING - DONE TimeseriesAnomalyInvestigationQueryStatus: description: Execution status for one named query. properties: name: description: Query name from the request. example: query1 type: string status: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationQueryExecutionStatus" required: - name - status type: object TimeseriesAnomalyInvestigationRequest: description: Request to investigate a metrics timeseries for anomalies. properties: data: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationRequestData" required: - data type: object TimeseriesAnomalyInvestigationRequestAttributes: description: Attributes of an anomaly investigation request. properties: requests: description: Timeseries requests to investigate. This API version accepts exactly one request. example: - formulas: - formula: query1 from: 1754406000000 queries: - data_source: metrics name: query1 query: "avg:system.cpu.user{env:prod} by {service}" to: 1754423940000 items: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationTimeseriesRequest" maxItems: 1 minItems: 1 type: array required: - requests type: object TimeseriesAnomalyInvestigationRequestData: description: JSON:API resource containing an anomaly investigation request. properties: attributes: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationRequestAttributes" type: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationType" required: - type - attributes type: object TimeseriesAnomalyInvestigationResponse: description: Response containing the anomaly investigation results and timeseries metadata. properties: data: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationResponseData" meta: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationResponseMeta" required: - data - meta type: object TimeseriesAnomalyInvestigationResponseAttributes: description: Attributes of an anomaly investigation response. properties: results: description: Results returned in the same order as the submitted requests. This API version returns exactly one result. example: - anomalies: [] status: complete items: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationResult" maxItems: 1 minItems: 1 type: array required: - results type: object TimeseriesAnomalyInvestigationResponseData: description: JSON:API resource containing anomaly investigation results. properties: attributes: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationResponseAttributes" id: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationResponseID" type: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationType" required: - id - type - attributes type: object TimeseriesAnomalyInvestigationResponseID: description: Stable identifier for an anomaly investigation response resource. enum: - "0" example: "0" type: string x-enum-varnames: - ZERO TimeseriesAnomalyInvestigationResponseMeta: description: Timeseries execution metadata for the single request accepted by this API version. properties: from_date: description: Effective start of the timeseries query in milliseconds since the Unix epoch. example: 1754406000000 format: int64 type: integer interval: description: Effective timeseries interval in milliseconds. example: 60000 format: int64 minimum: 1 type: integer queries: description: Execution status for the request's queries. example: - name: query1 status: done items: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationQueryStatus" type: array res_type: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationMetaType" results_warnings: description: Non-fatal warnings produced while executing the investigation. example: [] items: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationResultsWarning" type: array to_date: description: Effective end of the timeseries query in milliseconds since the Unix epoch. example: 1754423940000 format: int64 type: integer required: - from_date - to_date - interval - queries - results_warnings - res_type type: object TimeseriesAnomalyInvestigationResult: description: Completed result for one timeseries request. The anomalies array is empty when no qualifying anomaly is found. properties: anomalies: description: |- Detected anomalies, ordered by significance. This API version returns at most three anomalies across the submitted request. example: [] items: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationAnomaly" maxItems: 3 type: array status: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationCompleteStatus" required: - status - anomalies type: object TimeseriesAnomalyInvestigationResultsWarning: description: Non-fatal warning produced while executing the investigation. properties: message: description: Human-readable warning message. example: "Influential tag analysis failed for at least one detected anomaly." type: string name: description: Machine-readable warning name. example: tag_analysis_failed type: string required: - name - message type: object TimeseriesAnomalyInvestigationSeries: description: Logical series on which the anomaly was detected. properties: group_tags: description: Tags identifying the selected group. Empty for a query without grouping. example: - "service:api" items: description: Tag in `key:value` form. example: "service:api" type: string type: array label: description: Display label for the selected series. example: api type: string query_index: description: Zero-based index of the caller's formula that produced the series. example: 0 format: int64 minimum: 0 type: integer required: - query_index - group_tags - label type: object TimeseriesAnomalyInvestigationTagAnalysis: description: Summary of optional influential-tag enrichment. Count and key fields are present only when analysis completes; enrichment availability does not affect completion of the investigation result. properties: analyzed_tag_keys: description: Tag keys analyzed. Present only when analysis completes. example: - service - env items: description: Analyzed tag key. example: service type: string type: array status: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationTagAnalysisStatus" tag_keys_analyzed: description: Number of tag keys analyzed. Present only when analysis completes. example: 2 format: int64 minimum: 0 type: integer tag_values_analyzed: description: Number of tag values analyzed. Present only when analysis completes. example: 4 format: int64 minimum: 0 type: integer required: - status type: object TimeseriesAnomalyInvestigationTagAnalysisStatus: description: Outcome of optional influential-tag enrichment. enum: - complete - unsupported - failed example: complete type: string x-enum-varnames: - COMPLETE - UNSUPPORTED - FAILED TimeseriesAnomalyInvestigationTimeseriesRequest: description: Metrics timeseries request to investigate. properties: formulas: description: Formulas to evaluate. Each formula may contain an explicit `anomalies()` call or a supported metrics expression. example: - formula: query1 items: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationFormula" minItems: 1 type: array from: description: Start of the investigation time window in milliseconds since the Unix epoch. example: 1754406000000 format: int64 minimum: 1 type: integer interval: description: Optional requested aggregation interval in milliseconds. example: 60000 format: int64 minimum: 1 type: integer queries: description: Metrics queries referenced by the formulas. example: - data_source: metrics name: query1 query: "avg:system.cpu.user{env:prod} by {service}" items: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationMetricQuery" minItems: 1 type: array to: description: End of the investigation time window in milliseconds since the Unix epoch. Must be later than `from`. example: 1754423940000 format: int64 minimum: 1 type: integer required: - formulas - from - to - queries type: object TimeseriesAnomalyInvestigationType: description: Resource type for a timeseries anomaly investigation. enum: - timeseries_anomaly_investigation example: timeseries_anomaly_investigation type: string x-enum-varnames: - TIMESERIES_ANOMALY_INVESTIGATION TimeseriesFormulaQueryRequest: description: A request wrapper around a single timeseries query to be executed. properties: data: $ref: "#/components/schemas/TimeseriesFormulaRequest" required: - data type: object TimeseriesFormulaQueryResponse: description: A message containing one response to a timeseries query made with timeseries formula query request. properties: data: $ref: "#/components/schemas/TimeseriesResponse" errors: description: The error generated by the request. type: string type: object TimeseriesFormulaRequest: description: A single timeseries query to be executed. properties: attributes: $ref: "#/components/schemas/TimeseriesFormulaRequestAttributes" type: $ref: "#/components/schemas/TimeseriesFormulaRequestType" required: - type - attributes type: object TimeseriesFormulaRequestAttributes: description: The object describing a timeseries formula request. properties: formulas: description: List of formulas to be calculated and returned as responses. items: $ref: "#/components/schemas/QueryFormula" type: array from: description: Start date (inclusive) of the query in milliseconds since the Unix epoch. example: 1568899800000 format: int64 type: integer interval: description: |- A time interval in milliseconds. May be overridden by a larger interval if the query would result in too many points for the specified timeframe. Defaults to a reasonable interval for the given timeframe. example: 5000 format: int64 type: integer queries: $ref: "#/components/schemas/TimeseriesFormulaRequestQueries" to: description: End date (exclusive) of the query in milliseconds since the Unix epoch. example: 1568923200000 format: int64 type: integer required: - to - from - queries type: object TimeseriesFormulaRequestQueries: description: List of queries to be run and used as inputs to the formulas. example: - data_source: metrics query: "avg:system.cpu.user{*} by {env}" items: $ref: "#/components/schemas/TimeseriesQuery" type: array TimeseriesFormulaRequestType: default: "timeseries_request" description: The type of the resource. The value should always be timeseries_request. enum: ["timeseries_request"] example: "timeseries_request" type: string x-enum-varnames: ["TIMESERIES_REQUEST"] TimeseriesFormulaResponseType: default: "timeseries_response" description: The type of the resource. The value should always be timeseries_response. enum: ["timeseries_response"] example: "timeseries_response" type: string x-enum-varnames: ["TIMESERIES_RESPONSE"] TimeseriesQuery: description: An individual timeseries query to one of the basic Datadog data sources. example: data_source: metrics query: "avg:system.cpu.user{*} by {env}" oneOf: - $ref: "#/components/schemas/MetricsTimeseriesQuery" - $ref: "#/components/schemas/EventsTimeseriesQuery" - $ref: "#/components/schemas/ApmResourceStatsQuery" - $ref: "#/components/schemas/ApmMetricsQuery" - $ref: "#/components/schemas/ApmDependencyStatsQuery" - $ref: "#/components/schemas/SloQuery" - $ref: "#/components/schemas/ProcessTimeseriesQuery" - $ref: "#/components/schemas/ContainerTimeseriesQuery" TimeseriesResponse: description: A message containing the response to a timeseries query. properties: attributes: $ref: "#/components/schemas/TimeseriesResponseAttributes" type: $ref: "#/components/schemas/TimeseriesFormulaResponseType" type: object TimeseriesResponseAttributes: description: The object describing a timeseries response. properties: series: $ref: "#/components/schemas/TimeseriesResponseSeriesList" times: $ref: "#/components/schemas/TimeseriesResponseTimes" values: $ref: "#/components/schemas/TimeseriesResponseValuesList" type: object TimeseriesResponseSeries: description: A single series in a timeseries query response, containing the query index, unit information, and group tags. properties: group_tags: $ref: "#/components/schemas/GroupTags" query_index: description: The index of the query in the "formulas" array (or "queries" array if no "formulas" was specified). example: 0 format: int32 maximum: 2147483647 type: integer unit: description: |- Detailed information about the unit. The first element describes the "primary unit" (for example, `bytes` in `bytes per second`). The second element describes the "per unit" (for example, `second` in `bytes per second`). If the second element is not present, the API returns null. items: $ref: "#/components/schemas/Unit" nullable: true type: array type: object TimeseriesResponseSeriesList: description: Array of response series. The index here corresponds to the index in the `formulas` or `queries` array from the request. items: $ref: "#/components/schemas/TimeseriesResponseSeries" type: array TimeseriesResponseTimes: description: Array of times, 1-1 match with individual values arrays. items: description: Start date (inclusive) of the query in seconds since the Unix epoch. example: 1568899800000 format: int64 type: integer type: array TimeseriesResponseValues: description: Array of values for an individual formula or query. example: [1575317847.0, 0.5] items: description: An individual value for a given time. format: double nullable: true type: number type: array TimeseriesResponseValuesList: description: Array of value-arrays. The index here corresponds to the index in the `formulas` or `queries` array from the request. items: $ref: "#/components/schemas/TimeseriesResponseValues" type: array TokenName: description: Name for tokens. example: MyTokenName pattern: ^[A-Za-z][A-Za-z\\d]*$ type: string TokenType: description: The definition of `TokenType` object. enum: - SECRET example: SECRET type: string x-enum-varnames: - SECRET TopLongTaskInvoker: description: A top long task invoker within an invoker type. properties: criteria_view_occurrences: description: Number of sampled views where this invoker had long tasks contributing to the criteria metric. example: 40 format: int32 maximum: 2147483647 type: integer file: description: Cleaned source file path for the invoker script. example: src/pages/Gallery.tsx nullable: true type: string impact_score: description: Rank-product impact score combining view frequency and blocking time severity. example: 0.67 format: double type: number invoker: description: Name of the invoker function or script. example: Response.json.then type: string stats_per_view: $ref: "#/components/schemas/LongTaskStatsPerView" view_occurrences: description: Number of sampled views where this invoker had any long tasks. example: 68 format: int32 maximum: 2147483647 type: integer required: - invoker - view_occurrences - stats_per_view type: object TraceAttributes: description: The attributes of a trace returned by the Get trace by ID endpoint. properties: is_truncated: description: Indicates whether the trace was truncated because its size exceeded the maximum response payload. example: false type: boolean spans: $ref: "#/components/schemas/APMTraceSpans" required: - is_truncated - spans type: object TraceData: description: A trace resource document. properties: attributes: $ref: "#/components/schemas/TraceAttributes" id: description: The full 128-bit trace ID, encoded as a 32-character hexadecimal string. example: "0000000000000000abc1230000000000" type: string type: $ref: "#/components/schemas/TraceType" required: - id - type - attributes type: object TraceResponse: description: Response containing a single trace. properties: data: $ref: "#/components/schemas/TraceData" required: - data type: object TraceType: description: The type of the trace resource. The value is always `trace`. enum: - trace example: trace type: string x-enum-varnames: - TRACE Trigger: description: "One of the triggers that can start the execution of a workflow." oneOf: - $ref: "#/components/schemas/AgentTriggerWrapper" - $ref: "#/components/schemas/APITriggerWrapper" - $ref: "#/components/schemas/AppTriggerWrapper" - $ref: "#/components/schemas/CaseTriggerWrapper" - $ref: "#/components/schemas/ChangeEventTriggerWrapper" - $ref: "#/components/schemas/DatabaseMonitoringTriggerWrapper" - $ref: "#/components/schemas/DatastoreTriggerWrapper" - $ref: "#/components/schemas/DashboardTriggerWrapper" - $ref: "#/components/schemas/FormTriggerWrapper" - $ref: "#/components/schemas/GithubWebhookTriggerWrapper" - $ref: "#/components/schemas/IncidentCreatedTriggerWrapper" - $ref: "#/components/schemas/IncidentImpactCreatedTriggerWrapper" - $ref: "#/components/schemas/IncidentImpactUpdatedTriggerWrapper" - $ref: "#/components/schemas/IncidentPostmortemUpdatedTriggerWrapper" - $ref: "#/components/schemas/IncidentResponderCreatedTriggerWrapper" - $ref: "#/components/schemas/IncidentSavedTriggerWrapper" - $ref: "#/components/schemas/IncidentScheduleTriggerWrapper" - $ref: "#/components/schemas/IncidentTriggerWrapper" - $ref: "#/components/schemas/MonitorTriggerWrapper" - $ref: "#/components/schemas/NotebookTriggerWrapper" - $ref: "#/components/schemas/OnCallShiftChangeTriggerWrapper" - $ref: "#/components/schemas/OnCallTriggerWrapper" - $ref: "#/components/schemas/ScheduleTriggerWrapper" - $ref: "#/components/schemas/SecurityTriggerWrapper" - $ref: "#/components/schemas/SelfServiceTriggerWrapper" - $ref: "#/components/schemas/SlackTriggerWrapper" - $ref: "#/components/schemas/SoftwareCatalogTriggerWrapper" - $ref: "#/components/schemas/WorkflowTriggerWrapper" TriggerAttributes: description: The trigger definition for starting an investigation. example: monitor_alert_trigger: event_id: "1234567890123456789" event_ts: 1700000000000 monitor_id: 12345678 type: monitor_alert_trigger oneOf: - $ref: "#/components/schemas/MonitorAlertTrigger" - $ref: "#/components/schemas/GeneralInvestigationTrigger" TriggerInvestigationRequest: description: Request to trigger a new investigation. properties: data: $ref: "#/components/schemas/TriggerInvestigationRequestData" required: - data type: object TriggerInvestigationRequestData: description: Data for the trigger investigation request. properties: attributes: $ref: "#/components/schemas/TriggerInvestigationRequestDataAttributes" type: $ref: "#/components/schemas/TriggerInvestigationRequestType" required: - type - attributes type: object TriggerInvestigationRequestDataAttributes: description: Attributes for the trigger investigation request. properties: trigger: $ref: "#/components/schemas/TriggerAttributes" required: - trigger type: object TriggerInvestigationRequestType: description: The resource type for trigger investigation requests. enum: - trigger_investigation_request example: trigger_investigation_request type: string x-enum-varnames: - TRIGGER_INVESTIGATION_REQUEST TriggerInvestigationResponse: description: Response after triggering an investigation. properties: data: $ref: "#/components/schemas/TriggerInvestigationResponseData" required: - data type: object TriggerInvestigationResponseData: description: Data for the trigger investigation response. properties: attributes: $ref: "#/components/schemas/TriggerInvestigationResponseDataAttributes" id: description: Unique identifier for the trigger response. example: "f5e6a7b8-c9d0-1e2f-3a4b-5c6d7e8f9a0b" type: string type: $ref: "#/components/schemas/TriggerInvestigationResponseType" required: - id - type - attributes type: object TriggerInvestigationResponseDataAttributes: description: Attributes for the trigger investigation response. properties: investigation_id: description: The ID of the investigation that was created. example: "a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d" type: string required: - investigation_id type: object TriggerInvestigationResponseType: description: The resource type for trigger investigation responses. enum: - trigger_investigation_response example: trigger_investigation_response type: string x-enum-varnames: - TRIGGER_INVESTIGATION_RESPONSE TriggerRateLimit: description: Defines a rate limit for a trigger. properties: count: description: The `TriggerRateLimit` `count`. format: int64 type: integer interval: description: The `TriggerRateLimit` `interval`. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s type: string type: object TriggerSource: description: |- The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals", while notification rules based on security vulnerabilities need to use the trigger source "security_findings". enum: - security_findings - security_signals example: security_findings type: string x-enum-varnames: - SECURITY_FINDINGS - SECURITY_SIGNALS TriggerWorkflowAutomationAction: description: "Triggers a Workflow Automation." properties: handle: description: "The handle of the Workflow Automation to trigger." example: my-workflow-handle type: string type: $ref: "#/components/schemas/TriggerWorkflowAutomationActionType" required: - type - handle type: object TriggerWorkflowAutomationActionType: default: workflow description: "Indicates that the action triggers a Workflow Automation." enum: - workflow example: workflow type: string x-enum-varnames: - TRIGGER_WORKFLOW_AUTOMATION TwilioAlertsLogsIntegrationDataflowRequest: additionalProperties: false description: >- Twilio Alert resource logs, which detail the errors and warnings raised when Twilio makes a webhook request to your server or when your application calls the Twilio REST API. This is the one kind of data the integration collects by default. properties: enabled: description: Whether Datadog collects this data. Defaults to `true`; set to `false` to stop collection. example: true type: boolean type: object TwilioAlertsLogsIntegrationDataflowResponse: description: >- Twilio Alert resource logs, which detail the errors and warnings raised when Twilio makes a webhook request to your server or when your application calls the Twilio REST API. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean status: $ref: "#/components/schemas/IntegrationAccountDataflowStatus" type: object TwilioCallSummariesLogsIntegrationDataflowRequest: additionalProperties: false description: >- Twilio Call Summary resource logs, covering the metadata and performance of the calls made from your Twilio account. Requires Voice Insights Advanced Features to be enabled on the Twilio account; without it this dataflow collects no data. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean type: object TwilioCallSummariesLogsIntegrationDataflowResponse: description: >- Twilio Call Summary resource logs, covering the metadata and performance of the calls made from your Twilio account. Requires Voice Insights Advanced Features to be enabled on the Twilio account; without it this dataflow collects no data. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean status: $ref: "#/components/schemas/IntegrationAccountDataflowStatus" type: object TwilioCloudCostMetricsIntegrationDataflowRequest: additionalProperties: false description: >- Your Twilio cost data, so that Twilio spend can be broken down and attributed in [Cloud Cost Management](https://docs.datadoghq.com/cloud_cost_management/). Cost data appears in Cloud Cost Management within 24 hours of enabling this dataflow. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean type: object TwilioCloudCostMetricsIntegrationDataflowResponse: description: >- Your Twilio cost data, so that Twilio spend can be broken down and attributed in [Cloud Cost Management](https://docs.datadoghq.com/cloud_cost_management/). properties: enabled: description: Whether Datadog collects this data. example: true type: boolean status: $ref: "#/components/schemas/IntegrationAccountDataflowStatus" type: object TwilioEventsLogsIntegrationDataflowRequest: additionalProperties: false description: >- Twilio Event resource logs, which record virtually every action taken in your Twilio account, such as provisioning a phone number, changing account security settings, or deleting a recording. Actions are recorded whether they came from the REST API, a user in the Twilio Console, or Twilio itself. [Cloud SIEM](https://docs.datadoghq.com/security/cloud_siem/) analyzes and correlates these logs to detect threats in real time. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean type: object TwilioEventsLogsIntegrationDataflowResponse: description: >- Twilio Event resource logs, which record virtually every action taken in your Twilio account, such as provisioning a phone number, changing account security settings, or deleting a recording. Actions are recorded whether they came from the REST API, a user in the Twilio Console, or Twilio itself. [Cloud SIEM](https://docs.datadoghq.com/security/cloud_siem/) analyzes and correlates these logs to detect threats in real time. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean status: $ref: "#/components/schemas/IntegrationAccountDataflowStatus" type: object TwilioIntegrationAccountAuthenticationRequest: description: Authentication for creating the Twilio integration account. Exactly one method is set. oneOf: - $ref: "#/components/schemas/TwilioIntegrationAccountBasicAuthRequest" TwilioIntegrationAccountAuthenticationResponse: description: Authentication configured on the Twilio integration account. oneOf: - $ref: "#/components/schemas/TwilioIntegrationAccountBasicAuthResponse" TwilioIntegrationAccountAuthenticationUpdate: description: Authentication for updating the Twilio integration account. Exactly one method is set. oneOf: - $ref: "#/components/schemas/TwilioIntegrationAccountBasicAuthUpdate" TwilioIntegrationAccountBasicAuthRequest: additionalProperties: false description: Username and password authentication. properties: auth_type: $ref: "#/components/schemas/TwilioIntegrationAccountBasicAuthType" password: description: Secret password or private key. example: your-password type: string writeOnly: true username: description: Non-secret username or public identifier for the credential pair. example: datadog type: string required: - auth_type - username - password type: object TwilioIntegrationAccountBasicAuthResponse: description: The basic authentication method and username configured on the account. properties: auth_type: $ref: "#/components/schemas/TwilioIntegrationAccountBasicAuthType" username: description: Non-secret username or public identifier for the credential pair. example: datadog type: string required: - auth_type - username type: object TwilioIntegrationAccountBasicAuthType: default: basic description: The authentication method type. enum: - basic example: basic type: string x-enum-varnames: - BASIC TwilioIntegrationAccountBasicAuthUpdate: additionalProperties: false description: Username and password authentication. Only the fields provided are changed; omit `password` to keep the stored one. properties: auth_type: $ref: "#/components/schemas/TwilioIntegrationAccountBasicAuthType" password: description: Secret password or private key. example: your-password type: string writeOnly: true username: description: Non-secret username or public identifier for the credential pair. example: datadog type: string required: - auth_type type: object TwilioIntegrationAccountCreateAttributes: description: Writable attributes used to create a Twilio integration account. properties: authentication: $ref: "#/components/schemas/TwilioIntegrationAccountAuthenticationRequest" dataflows: $ref: "#/components/schemas/TwilioIntegrationDataflowsRequest" name: description: Human-readable name of the Twilio integration account. example: twilio-prod type: string settings: $ref: "#/components/schemas/TwilioIntegrationAccountSettingsRequest" required: - name - authentication - settings type: object TwilioIntegrationAccountCreateData: description: Data envelope for creating a Twilio integration account. properties: attributes: $ref: "#/components/schemas/TwilioIntegrationAccountCreateAttributes" type: $ref: "#/components/schemas/IntegrationAccountType" required: - type - attributes type: object TwilioIntegrationAccountCreateRequest: description: Request payload to create a Twilio integration account. properties: data: $ref: "#/components/schemas/TwilioIntegrationAccountCreateData" required: - data type: object TwilioIntegrationAccountResponse: description: Response payload for a single Twilio integration account. properties: data: $ref: "#/components/schemas/TwilioIntegrationAccountResponseData" required: - data type: object TwilioIntegrationAccountResponseAttributes: description: Attributes of a Twilio integration account returned in responses. properties: authentication: $ref: "#/components/schemas/TwilioIntegrationAccountAuthenticationResponse" dataflows: $ref: "#/components/schemas/TwilioIntegrationDataflowsResponse" name: description: Human-readable name of the Twilio integration account. example: twilio-prod type: string settings: $ref: "#/components/schemas/TwilioIntegrationAccountSettingsResponse" required: - name - settings type: object TwilioIntegrationAccountResponseData: description: Data envelope of a Twilio integration account, including server-assigned identity. properties: attributes: $ref: "#/components/schemas/TwilioIntegrationAccountResponseAttributes" id: description: Server-generated unique identifier of the Twilio integration account. example: 953a0060-81ec-4221-aed4-d4733b59cd96 readOnly: true type: string type: $ref: "#/components/schemas/IntegrationAccountType" required: - id - attributes - type type: object TwilioIntegrationAccountSettingsRequest: additionalProperties: false description: Settings for creating the Twilio integration account. properties: account_sid: description: Twilio Account SID that uniquely identifies your Twilio account. example: ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx type: string censor_logs: description: When enabled, Twilio phone numbers in the `to` field and SMS message bodies are censored for privacy. example: true type: boolean required: - account_sid type: object TwilioIntegrationAccountSettingsResponse: description: Settings configured on the Twilio integration account. properties: account_sid: description: Twilio Account SID that uniquely identifies your Twilio account. example: ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx type: string censor_logs: description: When enabled, Twilio phone numbers in the `to` field and SMS message bodies are censored for privacy. example: true type: boolean required: - account_sid type: object TwilioIntegrationAccountSettingsUpdate: additionalProperties: false description: Settings for updating the Twilio integration account. Only the fields provided are changed. properties: account_sid: description: Twilio Account SID that uniquely identifies your Twilio account. example: ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx type: string censor_logs: description: When enabled, Twilio phone numbers in the `to` field and SMS message bodies are censored for privacy. example: true type: boolean type: object TwilioIntegrationAccountUpdateAttributes: description: >- Writable attributes used to update a Twilio integration account. Every field is optional; only the fields provided are changed. When `dataflows` is provided, only the dataflow ids included in the request are modified; dataflows omitted from the map keep their current configuration. properties: authentication: $ref: "#/components/schemas/TwilioIntegrationAccountAuthenticationUpdate" dataflows: $ref: "#/components/schemas/TwilioIntegrationDataflowsRequest" name: description: Human-readable name of the Twilio integration account. example: twilio-prod type: string settings: $ref: "#/components/schemas/TwilioIntegrationAccountSettingsUpdate" type: object TwilioIntegrationAccountUpdateData: description: Data envelope for updating a Twilio integration account. properties: attributes: $ref: "#/components/schemas/TwilioIntegrationAccountUpdateAttributes" id: description: Unique identifier of the Twilio integration account to update. example: 953a0060-81ec-4221-aed4-d4733b59cd96 type: string type: $ref: "#/components/schemas/IntegrationAccountType" required: - id - type - attributes type: object TwilioIntegrationAccountUpdateRequest: description: Request payload to update a Twilio integration account. properties: data: $ref: "#/components/schemas/TwilioIntegrationAccountUpdateData" required: - data type: object TwilioIntegrationAccountsResponse: description: Response payload for a list of Twilio integration accounts. properties: data: description: List of Twilio integration accounts. items: $ref: "#/components/schemas/TwilioIntegrationAccountResponseData" type: array required: - data type: object TwilioIntegrationDataflowsRequest: additionalProperties: false description: >- Data Datadog collects from Twilio, keyed by dataflow id. Each dataflow turns on a distinct kind of collection: set `enabled` to start or stop it. Defaults listed on each dataflow apply when the account is created; on update, omitted fields keep their current values. Where a dataflow depends on a Twilio feature being enabled, that prerequisite is noted on the dataflow; a dataflow enabled without it is stored but collects no data. properties: twilio-alerts-logs: $ref: "#/components/schemas/TwilioAlertsLogsIntegrationDataflowRequest" twilio-call-summaries-logs: $ref: "#/components/schemas/TwilioCallSummariesLogsIntegrationDataflowRequest" twilio-cloud-cost-metrics: $ref: "#/components/schemas/TwilioCloudCostMetricsIntegrationDataflowRequest" twilio-events-logs: $ref: "#/components/schemas/TwilioEventsLogsIntegrationDataflowRequest" twilio-messages-logs: $ref: "#/components/schemas/TwilioMessagesLogsIntegrationDataflowRequest" type: object TwilioIntegrationDataflowsResponse: description: Data Datadog collects from Twilio, keyed by dataflow id. properties: twilio-alerts-logs: $ref: "#/components/schemas/TwilioAlertsLogsIntegrationDataflowResponse" twilio-call-summaries-logs: $ref: "#/components/schemas/TwilioCallSummariesLogsIntegrationDataflowResponse" twilio-cloud-cost-metrics: $ref: "#/components/schemas/TwilioCloudCostMetricsIntegrationDataflowResponse" twilio-events-logs: $ref: "#/components/schemas/TwilioEventsLogsIntegrationDataflowResponse" twilio-messages-logs: $ref: "#/components/schemas/TwilioMessagesLogsIntegrationDataflowResponse" type: object TwilioMessagesLogsIntegrationDataflowRequest: additionalProperties: false description: >- Twilio Message resource logs for inbound and outbound messages, used to track delivery and troubleshoot message errors. A log is produced when you send a message through the REST API, when Twilio executes a TwiML instruction, and when someone messages one of your Twilio numbers or channel addresses. Message bodies are never collected. properties: enabled: description: Whether Datadog collects this data. Defaults to `false`; set to `true` to start collection. example: true type: boolean type: object TwilioMessagesLogsIntegrationDataflowResponse: description: >- Twilio Message resource logs for inbound and outbound messages, used to track delivery and troubleshoot message errors. A log is produced when you send a message through the REST API, when Twilio executes a TwiML instruction, and when someone messages one of your Twilio numbers or channel addresses. Message bodies are never collected. properties: enabled: description: Whether Datadog collects this data. example: true type: boolean status: $ref: "#/components/schemas/IntegrationAccountDataflowStatus" type: object UCConfigPair: description: The definition of `UCConfigPair` object. example: data: attributes: configs: - account_id: 1234abcd-1234-abcd-1234-1234abcd1234 client_id: 1234abcd-1234-abcd-1234-1234abcd1234 created_at: "2023-01-01T12:00:00.000000" dataset_type: actual error_messages: [] export_name: dd-actual-export export_path: dd-export-path id: "123456789123" months: 36 scope: /subscriptions/1234abcd-1234-abcd-1234-1234abcd1234 status: active status_updated_at: "2023-01-01T12:00:00.000000" storage_account: dd-storage-account storage_container: dd-storage-container updated_at: "2023-01-01T12:00:00.000000" id: "123456789123" type: azure_uc_configs properties: data: $ref: "#/components/schemas/UCConfigPairData" type: object UCConfigPairData: description: The definition of `UCConfigPairData` object. properties: attributes: $ref: "#/components/schemas/UCConfigPairDataAttributes" id: description: The `UCConfigPairData` `id`. type: string type: $ref: "#/components/schemas/UCConfigPairDataType" required: - type type: object UCConfigPairDataAttributes: description: The definition of `UCConfigPairDataAttributes` object. properties: configs: description: The `attributes` `configs`. items: $ref: "#/components/schemas/UCConfigPairDataAttributesConfigsItems" type: array type: object UCConfigPairDataAttributesConfigsItems: description: The definition of `UCConfigPairDataAttributesConfigsItems` object. properties: account_id: description: The `items` `account_id`. type: string client_id: description: The `items` `client_id`. type: string created_at: description: The `items` `created_at`. type: string dataset_type: description: The `items` `dataset_type`. type: string error_messages: description: The `items` `error_messages`. items: description: An error message string. type: string nullable: true type: array export_name: description: The `items` `export_name`. type: string export_path: description: The `items` `export_path`. type: string id: description: The `items` `id`. type: string months: description: The `items` `months`. format: int64 type: integer scope: description: The `items` `scope`. type: string status: description: The `items` `status`. type: string status_updated_at: description: The `items` `status_updated_at`. type: string storage_account: description: The `items` `storage_account`. type: string storage_container: description: The `items` `storage_container`. type: string updated_at: description: The `items` `updated_at`. type: string type: object UCConfigPairDataType: default: azure_uc_configs description: Azure UC configs resource type. enum: - azure_uc_configs example: azure_uc_configs type: string x-enum-varnames: - AZURE_UC_CONFIGS UnassignSeatsUserRequest: description: The request body for unassigning seats from users for a product code. properties: data: $ref: "#/components/schemas/UnassignSeatsUserRequestData" description: The data for the unassign seats user request. type: object UnassignSeatsUserRequestData: description: The request data object containing attributes for unassigning seats from users. properties: attributes: $ref: "#/components/schemas/UnassignSeatsUserRequestDataAttributes" description: The attributes of the unassign seats user request. id: description: The ID of the unassign seats user request. type: string type: $ref: "#/components/schemas/SeatAssignmentsDataType" description: The type of the unassign seats user request. required: - type - attributes type: object UnassignSeatsUserRequestDataAttributes: description: Attributes specifying the product and users from whom seats will be unassigned. properties: product_code: description: The product code for which to unassign seats. example: "" type: string user_uuids: description: The list of user IDs to unassign seats from. example: - "" items: description: A user UUID identifying a user to unassign seats from. type: string type: array required: - product_code - user_uuids type: object Unit: description: Object containing the metric unit family, scale factor, name, and short name. nullable: true properties: family: description: Unit family, allows for conversion between units of the same family, for scaling. example: time type: string name: description: Unit name example: minute type: string plural: description: Plural form of the unit name. example: minutes type: string scale_factor: description: Factor for scaling between units of the same family. example: 60.0 format: double type: number short_name: description: Abbreviation of the unit. example: min type: string type: object UnitCostCreateRequest: description: A request to create a unit cost. properties: data: $ref: "#/components/schemas/UnitCostCreateRequestData" required: - data type: object UnitCostCreateRequestData: description: The data object of a unit cost create request. properties: attributes: $ref: "#/components/schemas/UnitCostRequestAttributes" type: $ref: "#/components/schemas/UnitCostType" required: - type - attributes type: object UnitCostDataAttributesResponse: description: The attributes of a unit cost. properties: created_at: description: The time the unit cost was created. example: "2026-09-01T18:46:15.933716Z" format: date-time type: string created_by: description: The UUID of the user who created the unit cost. example: 36ea1610-8866-4bd3-bb6d-9bb9fc87cad2 format: uuid type: string denominator_query: $ref: "#/components/schemas/UnitCostQueryDefinition" denominator_type: description: |- The data source of the denominator queries, or `multisource` when the denominator queries span more than one data source. example: metrics type: string description: description: The description of the unit cost. Omitted when the unit cost has no description. example: Amortized cloud spend divided by the number of active users. nullable: true type: string name: description: The name of the unit cost. example: Cloud cost per active user type: string numerator_query: $ref: "#/components/schemas/UnitCostQueryDefinition" org_id: description: The ID of the organization the unit cost belongs to. example: 321813 format: int64 type: integer unit_label: description: The label describing the denominator unit. example: user type: string updated_at: description: The time the unit cost was last updated. example: "2026-09-01T19:52:08.820536Z" format: date-time type: string updated_by: description: The UUID of the user who last updated the unit cost. example: 13cc0adf-2595-479e-b448-5051c180dddb format: uuid type: string required: - org_id - name - numerator_query - denominator_query - denominator_type - unit_label - created_by - updated_by - created_at - updated_at type: object UnitCostDataResponse: description: The data object of a unit cost response. properties: attributes: $ref: "#/components/schemas/UnitCostDataAttributesResponse" id: description: The UUID of the unit cost. example: 64aecd58-e355-4f07-9c3a-56ff6bda6cd8 format: uuid type: string type: $ref: "#/components/schemas/UnitCostType" required: - id - type - attributes type: object UnitCostDataResponseArray: description: The list of unit costs. items: $ref: "#/components/schemas/UnitCostDataResponse" type: array UnitCostFormula: additionalProperties: {} description: |- A formula combining the named queries into a single result, passed through to the query engine unchanged. example: formula: numerator type: object UnitCostFormulaArray: description: The list of formulas applied to the queries for this side of the ratio. example: - formula: numerator items: $ref: "#/components/schemas/UnitCostFormula" type: array UnitCostQuery: additionalProperties: {} description: |- A single query contributing to a unit cost numerator or denominator. The accepted fields depend on the data source the query targets, for example `cloud_cost`, `metrics`, `dora`, or `ci_pipelines`, and are passed through to the query engine unchanged. example: data_source: cloud_cost name: numerator query: "sum:aws.cost.net.amortized.shared.resources.allocated{*}.rollup(sum, daily)" type: object UnitCostQueryArray: description: The list of queries evaluated for this side of the ratio. example: - data_source: cloud_cost name: numerator query: "sum:aws.cost.net.amortized.shared.resources.allocated{*}.rollup(sum, daily)" items: $ref: "#/components/schemas/UnitCostQuery" type: array UnitCostQueryDefinition: additionalProperties: {} description: A timeseries object containing `queries` and `formulas` arrays. properties: formulas: $ref: "#/components/schemas/UnitCostFormulaArray" queries: $ref: "#/components/schemas/UnitCostQueryArray" required: - queries - formulas type: object UnitCostRequestAttributes: description: The attributes of a unit cost create or replace request. properties: denominator_query: $ref: "#/components/schemas/UnitCostQueryDefinition" description: description: An optional description of the unit cost. At most 2000 characters. example: Amortized cloud spend divided by the number of active users. maxLength: 2000 nullable: true type: string name: description: The name of the unit cost. At most 200 characters. example: Cloud cost per active user maxLength: 200 type: string numerator_query: $ref: "#/components/schemas/UnitCostQueryDefinition" unit_label: description: The label describing the denominator unit, for example `user`. At most 100 characters. example: user maxLength: 100 type: string required: - name - numerator_query - denominator_query - unit_label type: object UnitCostResponse: description: A response containing a single unit cost. properties: data: $ref: "#/components/schemas/UnitCostDataResponse" required: - data type: object UnitCostType: default: unit_cost description: The JSON:API resource type for a unit cost. enum: - unit_cost example: unit_cost type: string x-enum-varnames: - UNIT_COST UnitCostUpdateRequest: description: A request to replace a unit cost. properties: data: $ref: "#/components/schemas/UnitCostUpdateRequestData" required: - data type: object UnitCostUpdateRequestData: description: The data object of a unit cost replace request. properties: attributes: $ref: "#/components/schemas/UnitCostRequestAttributes" id: description: The UUID of the unit cost being replaced. Must match the `unit_cost_id` path parameter. example: 64aecd58-e355-4f07-9c3a-56ff6bda6cd8 format: uuid type: string type: $ref: "#/components/schemas/UnitCostType" required: - id - type - attributes type: object UnitCostsResponse: description: A response containing a list of unit costs. properties: data: $ref: "#/components/schemas/UnitCostDataResponseArray" required: - data type: object UnpublishAppResponse: description: The response object after an app is successfully unpublished. properties: data: $ref: "#/components/schemas/Deployment" type: object UpdateActionConnectionRequest: description: Request used to update an action connection. properties: data: $ref: "#/components/schemas/ActionConnectionDataUpdate" required: - data type: object UpdateActionConnectionResponse: description: The response for an updated connection. properties: data: $ref: "#/components/schemas/ActionConnectionData" type: object UpdateAppFavoriteRequest: description: A request to add or remove an app from the current user's favorites. example: data: attributes: favorite: true type: favorites properties: data: $ref: "#/components/schemas/UpdateAppFavoriteRequestData" type: object UpdateAppFavoriteRequestData: description: Data for updating an app's favorite status. properties: attributes: $ref: "#/components/schemas/UpdateAppFavoriteRequestDataAttributes" type: $ref: "#/components/schemas/AppFavoriteType" type: object UpdateAppFavoriteRequestDataAttributes: description: Attributes for updating an app's favorite status. properties: favorite: description: Whether the app should be marked as a favorite for the current user. example: true type: boolean required: - favorite type: object UpdateAppProtectionLevelRequest: description: A request to update an app's publication protection level. example: data: attributes: protectionLevel: approval_required type: protectionLevel properties: data: $ref: "#/components/schemas/UpdateAppProtectionLevelRequestData" type: object UpdateAppProtectionLevelRequestData: description: Data for updating an app's publication protection level. properties: attributes: $ref: "#/components/schemas/UpdateAppProtectionLevelRequestDataAttributes" type: $ref: "#/components/schemas/AppProtectionLevelType" type: object UpdateAppProtectionLevelRequestDataAttributes: description: Attributes for updating an app's publication protection level. properties: protectionLevel: $ref: "#/components/schemas/AppProtectionLevel" required: - protectionLevel type: object UpdateAppRequest: description: A request object for updating an existing app. example: data: attributes: components: - events: [] name: grid0 properties: children: - events: [] name: gridCell0 properties: children: - events: [] name: calloutValue0 properties: isDisabled: false isLoading: false isVisible: true label: CPU Usage size: sm style: vivid_yellow unit: kB value: "42" type: calloutValue isVisible: "true" layout: default: height: 8 width: 2 x: 0 "y": 0 type: gridCell type: grid description: "This is a simple example app" name: "Example App" queries: [] rootInstanceName: grid0 id: "9e20cbaf-68da-45a6-9ccf-54193ac29fa5" type: appDefinitions properties: data: $ref: "#/components/schemas/UpdateAppRequestData" type: object UpdateAppRequestData: description: The data object containing the new app definition. Any fields not included in the request remain unchanged. properties: attributes: $ref: "#/components/schemas/UpdateAppRequestDataAttributes" id: description: The ID of the app to update. The app ID must match the ID in the URL path. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string type: $ref: "#/components/schemas/AppDefinitionType" required: - type type: object UpdateAppRequestDataAttributes: description: App definition attributes to be updated, such as name, description, and components. properties: components: description: The new UI components that make up the app. If this field is set, all existing components are replaced with the new components under this field. items: $ref: "#/components/schemas/ComponentGrid" type: array description: description: The new human-readable description for the app. type: string name: description: The new name of the app. type: string queries: description: The new array of queries, such as external actions and state variables, that the app uses. If this field is set, all existing queries are replaced with the new queries under this field. items: $ref: "#/components/schemas/Query" type: array rootInstanceName: description: The new name of the root component of the app. This must be a `grid` component that contains all other components. type: string tags: description: The new list of tags for the app, which can be used to filter apps. If this field is set, any existing tags not included in the request are removed. example: - "service:webshop-backend" - "team:webshop" items: description: An individual tag for the app. type: string type: array type: object UpdateAppResponse: description: The response object after an app is successfully updated. properties: data: $ref: "#/components/schemas/UpdateAppResponseData" included: description: Data on the version of the app that was published. items: $ref: "#/components/schemas/Deployment" type: array meta: $ref: "#/components/schemas/AppMeta" relationship: $ref: "#/components/schemas/AppRelationship" type: object UpdateAppResponseData: description: The data object containing the updated app definition. properties: attributes: $ref: "#/components/schemas/UpdateAppResponseDataAttributes" id: description: The ID of the updated app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string type: $ref: "#/components/schemas/AppDefinitionType" required: - id - type - attributes type: object UpdateAppResponseDataAttributes: description: The updated app definition attributes, such as name, description, and components. properties: components: description: The UI components that make up the app. items: $ref: "#/components/schemas/ComponentGrid" type: array description: description: The human-readable description for the app. type: string favorite: description: Whether the app is marked as a favorite by the current user. type: boolean name: description: The name of the app. type: string queries: description: An array of queries, such as external actions and state variables, that the app uses. items: $ref: "#/components/schemas/Query" type: array rootInstanceName: description: The name of the root component of the app. This must be a `grid` component that contains all other components. type: string tags: description: A list of tags for the app, which can be used to filter apps. example: - "service:webshop-backend" - "team:webshop" items: description: An individual tag for the app. type: string type: array type: object UpdateAppSelfServiceRequest: description: A request to enable or disable self-service for an app. example: data: attributes: selfService: true type: selfService properties: data: $ref: "#/components/schemas/UpdateAppSelfServiceRequestData" type: object UpdateAppSelfServiceRequestData: description: Data for updating an app's self-service status. properties: attributes: $ref: "#/components/schemas/UpdateAppSelfServiceRequestDataAttributes" type: $ref: "#/components/schemas/AppSelfServiceType" type: object UpdateAppSelfServiceRequestDataAttributes: description: Attributes for updating an app's self-service status. properties: selfService: description: Whether the app is enabled for self-service. example: true type: boolean required: - selfService type: object UpdateAppTagsRequest: description: A request to replace the tags on an app. example: data: attributes: tags: - team:platform - service:ops type: tags properties: data: $ref: "#/components/schemas/UpdateAppTagsRequestData" type: object UpdateAppTagsRequestData: description: Data for replacing an app's tags. properties: attributes: $ref: "#/components/schemas/UpdateAppTagsRequestDataAttributes" type: $ref: "#/components/schemas/AppTagsType" type: object UpdateAppTagsRequestDataAttributes: description: Attributes for replacing an app's tags. properties: tags: description: The full list of tags that should be set on the app. Existing tags not present in this list are removed. example: - team:platform - service:ops items: type: string type: array required: - tags type: object UpdateAppVersionNameRequest: description: A request to assign a human-readable name to a specific app version. example: data: attributes: name: v1.2.0 - bug fix release type: versionNames properties: data: $ref: "#/components/schemas/UpdateAppVersionNameRequestData" type: object UpdateAppVersionNameRequestData: description: Data for naming a specific app version. properties: attributes: $ref: "#/components/schemas/UpdateAppVersionNameRequestDataAttributes" type: $ref: "#/components/schemas/AppVersionNameType" type: object UpdateAppVersionNameRequestDataAttributes: description: Attributes for naming a specific app version. properties: name: description: The name to assign to the app version. example: v1.2.0 - bug fix release type: string required: - name type: object UpdateAppsDatastoreItemRequest: description: Request to update specific fields on an existing datastore item. properties: data: $ref: "#/components/schemas/UpdateAppsDatastoreItemRequestData" type: object UpdateAppsDatastoreItemRequestData: description: Data wrapper containing the item identifier and the changes to apply during the update operation. properties: attributes: $ref: "#/components/schemas/UpdateAppsDatastoreItemRequestDataAttributes" id: description: The unique identifier of the datastore item. type: string type: $ref: "#/components/schemas/UpdateAppsDatastoreItemRequestDataType" required: - type type: object UpdateAppsDatastoreItemRequestDataAttributes: description: Attributes for updating a datastore item, including the item key and changes to apply. properties: id: description: The unique identifier of the item being updated. type: string item_changes: $ref: "#/components/schemas/UpdateAppsDatastoreItemRequestDataAttributesItemChanges" item_key: description: The primary key that identifies the item to update. Cannot exceed 256 characters. example: "" maxLength: 256 type: string required: - item_changes - item_key type: object UpdateAppsDatastoreItemRequestDataAttributesItemChanges: description: Changes to apply to a datastore item using set operations. properties: ops_set: additionalProperties: {} description: Set operation that contains key-value pairs to set on the datastore item. type: object type: object UpdateAppsDatastoreItemRequestDataType: default: items description: The resource type for datastore items. enum: - items example: items type: string x-enum-varnames: - ITEMS UpdateAppsDatastoreRequest: description: Request to update a datastore's configuration such as its name or description. properties: data: $ref: "#/components/schemas/UpdateAppsDatastoreRequestData" type: object UpdateAppsDatastoreRequestData: description: Data wrapper containing the datastore identifier and the attributes to update. properties: attributes: $ref: "#/components/schemas/UpdateAppsDatastoreRequestDataAttributes" id: description: The unique identifier of the datastore to update. type: string type: $ref: "#/components/schemas/DatastoreDataType" required: - type type: object UpdateAppsDatastoreRequestDataAttributes: description: Attributes that can be updated on a datastore. properties: description: description: A human-readable description about the datastore. type: string name: description: The display name of the datastore. type: string type: object UpdateCampaignRequest: description: Request to update a campaign. properties: data: $ref: "#/components/schemas/UpdateCampaignRequestData" required: - data type: object UpdateCampaignRequestAttributes: description: Attributes for updating a campaign. properties: description: description: The description of the campaign. example: Campaign to improve security posture for Q1 2024. type: string due_date: description: The due date of the campaign. example: "2024-03-31T23:59:59Z" format: date-time type: string entity_scope: description: Entity scope query to filter entities for this campaign. example: kind:service AND team:platform type: string guidance: description: Guidance for the campaign. example: Please ensure all services pass the security requirements. type: string key: description: The unique key for the campaign. example: q1-security-2024 type: string name: description: The name of the campaign. example: Q1 Security Campaign type: string owner_id: description: The UUID of the campaign owner. example: 550e8400-e29b-41d4-a716-446655440000 type: string rule_ids: description: Array of rule IDs associated with this campaign. example: ["q8MQxk8TCqrHnWkx", "r9NRyl9UDrsIoXly"] items: description: The unique ID of a scorecard rule. type: string type: array start_date: description: The start date of the campaign. example: "2024-01-01T00:00:00Z" format: date-time type: string status: description: The status of the campaign. example: in_progress type: string required: - name - owner_id - status - start_date - rule_ids type: object UpdateCampaignRequestData: description: Data for updating a campaign. properties: attributes: $ref: "#/components/schemas/UpdateCampaignRequestAttributes" type: $ref: "#/components/schemas/CampaignType" required: - type - attributes type: object UpdateConnectionRequest: description: Request body for updating an existing data source connection by adding, modifying, or removing fields. example: data: attributes: fields_to_add: - description: Net Promoter Score from customer surveys display_name: NPS Score groups: - Satisfaction - Metrics id: nps_score source_name: net_promoter_score type: number fields_to_delete: - old_revenue_field fields_to_update: - field_id: lifetime_value updated_display_name: Customer Lifetime Value (`USD`) updated_groups: - Financial - Metrics id: crm-integration type: connection_id properties: data: $ref: "#/components/schemas/UpdateConnectionRequestData" type: object UpdateConnectionRequestData: description: The data object containing the resource identifier and attributes for updating an existing connection. properties: attributes: $ref: "#/components/schemas/UpdateConnectionRequestDataAttributes" id: description: The unique identifier of the connection to update. example: "" type: string type: $ref: "#/components/schemas/UpdateConnectionRequestDataType" required: - type - id type: object UpdateConnectionRequestDataAttributes: description: Attributes specifying the field modifications to apply to an existing connection. properties: fields_to_add: description: New fields to add to the connection from the data source. items: $ref: "#/components/schemas/CreateConnectionRequestDataAttributesFieldsItems" type: array fields_to_delete: description: Identifiers of existing fields to remove from the connection. items: description: The identifier of a field to delete from the connection. type: string type: array fields_to_update: description: Existing fields with updated metadata to apply to the connection. items: $ref: "#/components/schemas/UpdateConnectionRequestDataAttributesFieldsToUpdateItems" type: array name: description: New display name for the connection. maxLength: 255 type: string type: object UpdateConnectionRequestDataAttributesFieldsToUpdateItems: description: Specification for updating an existing field in a connection, including which field to modify and the new values. properties: field_id: description: The identifier of the existing field to update. example: "" type: string updated_description: description: The new description to set for the field. type: string updated_display_name: description: The new human-readable display name to set for the field. type: string updated_field_id: description: The new identifier to assign to the field, if renaming it. type: string updated_groups: description: The updated list of group labels to associate with the field. items: description: A group label name for categorizing the field. type: string type: array required: - field_id type: object UpdateConnectionRequestDataType: default: connection_id description: Connection id resource type. enum: - connection_id example: connection_id type: string x-enum-varnames: - CONNECTION_ID UpdateCustomFrameworkRequest: description: Request object to update a custom framework. properties: data: $ref: "#/components/schemas/CustomFrameworkData" required: - data type: object UpdateCustomFrameworkResponse: description: Response object to update a custom framework. properties: data: $ref: "#/components/schemas/FrameworkHandleAndVersionResponseData" required: - data type: object UpdateDeploymentGateParams: description: Parameters for updating a deployment gate. properties: data: $ref: "#/components/schemas/UpdateDeploymentGateParamsData" required: - data type: object UpdateDeploymentGateParamsData: description: Parameters for updating a deployment gate. properties: attributes: $ref: "#/components/schemas/UpdateDeploymentGateParamsDataAttributes" id: description: Unique identifier of the deployment gate. example: "12345678-1234-1234-1234-123456789012" type: string type: $ref: "#/components/schemas/DeploymentGateDataType" required: - type - id - attributes type: object UpdateDeploymentGateParamsDataAttributes: description: Attributes for updating a deployment gate. properties: dry_run: description: Whether to run in dry-run mode. example: false type: boolean required: - dry_run type: object UpdateDeploymentRuleParams: description: Parameters for updating a deployment rule. properties: data: $ref: "#/components/schemas/UpdateDeploymentRuleParamsData" required: - data type: object UpdateDeploymentRuleParamsData: description: Parameters for updating a deployment rule. properties: attributes: $ref: "#/components/schemas/UpdateDeploymentRuleParamsDataAttributes" type: $ref: "#/components/schemas/DeploymentRuleDataType" required: - type - attributes type: object UpdateDeploymentRuleParamsDataAttributes: description: Parameters for updating a deployment rule. properties: dry_run: description: Whether to run this rule in dry-run mode. example: false type: boolean name: description: The name of the deployment rule. example: "Updated deployment rule" type: string options: $ref: "#/components/schemas/DeploymentRulesOptions" required: - dry_run - name - options type: object UpdateEnvironmentAttributes: description: Attributes for updating an environment. properties: is_production: description: Indicates whether this is a production environment. example: false type: boolean name: description: The name of the environment. example: "Environment XYZ789" type: string queries: description: List of queries to define the environment scope. example: ["staging", "test"] items: description: A query string used to match the environment scope. type: string minItems: 1 type: array require_feature_flag_approval: description: Indicates whether feature flag changes require approval in this environment. example: true type: boolean type: object UpdateEnvironmentData: description: Data for updating an environment. properties: attributes: $ref: "#/components/schemas/UpdateEnvironmentAttributes" type: $ref: "#/components/schemas/UpdateEnvironmentDataType" required: - type - attributes type: object UpdateEnvironmentDataType: description: The resource type. enum: - "environments" example: "environments" type: string x-enum-varnames: - ENVIRONMENTS UpdateEnvironmentRequest: description: Request to update an environment. properties: data: $ref: "#/components/schemas/UpdateEnvironmentData" required: - data type: object UpdateFeatureFlagAttributes: description: Attributes for updating a feature flag. properties: description: description: The description of the feature flag. example: "Updated description for feature flag XYZ789" type: string json_schema: description: JSON schema for validation when value_type is JSON. example: '{"type": "object", "properties": {"enabled": {"type": "boolean"}}}' nullable: true type: string name: description: The name of the feature flag. example: "Updated Feature Flag XYZ789" type: string tags: description: |- Tags associated with the feature flag. This field replaces the full set of existing tags; omit it to leave tags unchanged, or pass an empty array to clear all tags. The owning team is set by including a tag of the form `team:` in this array. example: ["team:feature-flagging"] items: description: A tag associated with the feature flag. maxLength: 200 type: string maxItems: 100 type: array type: object UpdateFeatureFlagData: description: Data for updating a feature flag. properties: attributes: $ref: "#/components/schemas/UpdateFeatureFlagAttributes" type: $ref: "#/components/schemas/UpdateFeatureFlagDataType" required: - type - attributes type: object UpdateFeatureFlagDataType: description: The resource type. enum: - "feature-flags" example: "feature-flags" type: string x-enum-varnames: - FEATURE_FLAGS UpdateFeatureFlagRequest: description: Request to update a feature flag. properties: data: $ref: "#/components/schemas/UpdateFeatureFlagData" required: - data type: object UpdateFlakyTestsRequest: description: Request to update the state of multiple flaky tests. properties: data: $ref: "#/components/schemas/UpdateFlakyTestsRequestData" required: - data type: object UpdateFlakyTestsRequestAttributes: description: Attributes for updating flaky test states. properties: tests: description: List of flaky tests to update. items: $ref: "#/components/schemas/UpdateFlakyTestsRequestTest" type: array required: - tests type: object UpdateFlakyTestsRequestData: description: The JSON:API data for updating flaky test states. properties: attributes: $ref: "#/components/schemas/UpdateFlakyTestsRequestAttributes" type: $ref: "#/components/schemas/UpdateFlakyTestsRequestDataType" required: - type - attributes type: object UpdateFlakyTestsRequestDataType: description: The definition of `UpdateFlakyTestsRequestDataType` object. enum: - update_flaky_test_state_request example: update_flaky_test_state_request type: string x-enum-varnames: - UPDATE_FLAKY_TEST_STATE_REQUEST UpdateFlakyTestsRequestTest: description: Details of what tests to update and their new attributes. properties: id: description: |- The ID of the flaky test. This is the same ID returned by the Search flaky tests endpoint and is the value of the `@test.fingerprint_fqn` facet on test events. You can find it by searching on `@test.fingerprint_fqn` in the Test Optimization Explorer, or by filtering the Search flaky tests endpoint with the `fingerprint_fqn` key. example: 4eb1887a8adb1847 type: string new_state: $ref: "#/components/schemas/UpdateFlakyTestsRequestTestNewState" required: - id - new_state type: object UpdateFlakyTestsRequestTestNewState: description: The new state to set for the flaky test. enum: - active - quarantined - disabled - fixed example: active type: string x-enum-varnames: - ACTIVE - QUARANTINED - DISABLED - FIXED UpdateFlakyTestsResponse: description: Response object for updating flaky test states. properties: data: $ref: "#/components/schemas/UpdateFlakyTestsResponseData" type: object UpdateFlakyTestsResponseAttributes: description: Attributes for the update flaky test state response. properties: has_errors: description: "`True` if any errors occurred during the update operations. `False` if all tests succeeded to be updated." example: true type: boolean results: description: Results of the update operation for each test. items: $ref: "#/components/schemas/UpdateFlakyTestsResponseResult" type: array required: - has_errors - results type: object UpdateFlakyTestsResponseData: description: Summary of the update operations. Tells whether a test succeeded or failed to be updated. properties: attributes: $ref: "#/components/schemas/UpdateFlakyTestsResponseAttributes" id: description: The ID of the response. type: string type: $ref: "#/components/schemas/UpdateFlakyTestsResponseDataType" type: object UpdateFlakyTestsResponseDataType: description: The definition of `UpdateFlakyTestsResponseDataType` object. enum: - update_flaky_test_state_response type: string x-enum-varnames: - UPDATE_FLAKY_TEST_STATE_RESPONSE UpdateFlakyTestsResponseResult: description: Result of updating a single flaky test state. properties: error: description: Error message if the update failed. type: string id: description: |- The ID of the flaky test from the request. This is the value of the `@test.fingerprint_fqn` facet on test events, the same ID accepted by the update request and returned by the Search flaky tests endpoint. example: 4eb1887a8adb1847 type: string success: description: "`True` if the update was successful, `False` if there were any errors." example: false type: boolean required: - id - success type: object UpdateFormData: description: The data for updating a form. properties: attributes: $ref: "#/components/schemas/UpdateFormDataAttributes" id: description: The ID of the form. example: 22f6006a-2302-4926-9396-d2dfcf7b0b34 format: uuid type: string type: $ref: "#/components/schemas/FormType" required: - type - attributes type: object UpdateFormDataAttributes: description: The attributes for updating a form. properties: form_update: $ref: "#/components/schemas/FormUpdateAttributes" required: - form_update type: object UpdateFormRequest: description: A request to update a form. properties: data: $ref: "#/components/schemas/UpdateFormData" required: - data type: object UpdateOnCallNotificationRuleRequest: description: A top-level wrapper for updating a notification rule for a user example: data: attributes: "category": "high_urgency" channel_settings: method: "sms" type: "phone" "delay_minutes": 1 id: 2462ace1-49e2-aab1-xc4f-29cc4ae1105n7 relationships: channel: data: id: 1562fab3-a8c2-49e2-8f3a-28dcda2405e2 type: notification_channels type: notification_rules properties: data: $ref: "#/components/schemas/UpdateOnCallNotificationRuleRequestData" required: - data type: object UpdateOnCallNotificationRuleRequestAttributes: description: Attributes for creating or modifying an on-call notification rule. properties: category: $ref: "#/components/schemas/OnCallNotificationRuleCategory" channel_settings: $ref: "#/components/schemas/OnCallNotificationRuleChannelSettings" description: Configuration for the associated channel, if necessary nullable: true delay_minutes: description: The number of minutes that will elapse before this rule is evaluated. 0 indicates immediate evaluation format: int64 type: integer type: object UpdateOnCallNotificationRuleRequestData: description: Data for updating an on-call notification rule properties: attributes: $ref: "#/components/schemas/UpdateOnCallNotificationRuleRequestAttributes" id: description: Unique identifier for the rule type: string relationships: $ref: "#/components/schemas/OnCallNotificationRuleRelationships" type: $ref: "#/components/schemas/OnCallNotificationRuleType" required: - type type: object UpdateOpenAPIResponse: description: Response for `UpdateOpenAPI`. properties: data: $ref: "#/components/schemas/UpdateOpenAPIResponseData" type: object UpdateOpenAPIResponseAttributes: description: Attributes for `UpdateOpenAPI`. properties: failed_endpoints: description: List of endpoints which couldn't be parsed. items: $ref: "#/components/schemas/OpenAPIEndpoint" type: array type: object UpdateOpenAPIResponseData: description: Data envelope for `UpdateOpenAPIResponse`. properties: attributes: $ref: "#/components/schemas/UpdateOpenAPIResponseAttributes" id: $ref: "#/components/schemas/ApiID" type: object UpdateOutcomesAsyncAttributes: description: The JSON:API attributes for a batched set of scorecard outcomes. properties: results: description: Set of scorecard outcomes to update asynchronously. items: $ref: "#/components/schemas/UpdateOutcomesAsyncRequestItem" type: array type: object UpdateOutcomesAsyncRequest: description: Scorecard outcomes batch request. properties: data: $ref: "#/components/schemas/UpdateOutcomesAsyncRequestData" type: object UpdateOutcomesAsyncRequestData: description: Scorecard outcomes batch request data. properties: attributes: $ref: "#/components/schemas/UpdateOutcomesAsyncAttributes" type: $ref: "#/components/schemas/UpdateOutcomesAsyncType" type: object UpdateOutcomesAsyncRequestItem: description: Scorecard outcome for a single entity and rule. properties: entity_reference: $ref: "#/components/schemas/EntityReference" remarks: description: >- Any remarks regarding the scorecard rule's evaluation. Supports HTML hyperlinks. example: 'See: Services' type: string rule_id: $ref: "#/components/schemas/RuleId" state: $ref: "#/components/schemas/State" required: - rule_id - entity_reference - state type: object UpdateOutcomesAsyncType: default: batched-outcome description: The JSON:API type for scorecard outcomes. enum: [batched-outcome] example: batched-outcome type: string x-enum-varnames: [BATCHED_OUTCOME] UpdateResourceEvaluationFiltersRequest: description: Request object to update a resource filter. properties: data: $ref: "#/components/schemas/UpdateResourceEvaluationFiltersRequestData" required: - data type: object UpdateResourceEvaluationFiltersRequestData: description: The definition of `UpdateResourceFilterRequestData` object. properties: attributes: $ref: "#/components/schemas/ResourceFilterAttributes" id: description: The `UpdateResourceEvaluationFiltersRequestData` `id`. example: csm_resource_filter type: string type: $ref: "#/components/schemas/ResourceFilterRequestType" required: - attributes - type type: object UpdateResourceEvaluationFiltersResponse: description: The definition of `UpdateResourceEvaluationFiltersResponse` object. properties: data: $ref: "#/components/schemas/UpdateResourceEvaluationFiltersResponseData" required: - data type: object UpdateResourceEvaluationFiltersResponseData: description: The definition of `UpdateResourceFilterResponseData` object. properties: attributes: $ref: "#/components/schemas/ResourceFilterAttributes" id: description: The `data` `id`. example: csm_resource_filter type: string type: $ref: "#/components/schemas/ResourceFilterRequestType" required: - attributes - type type: object UpdateRuleRequest: description: Request to update a scorecard rule. properties: data: $ref: "#/components/schemas/UpdateRuleRequestData" type: object UpdateRuleRequestData: description: Data for the request to update a scorecard rule. properties: attributes: $ref: "#/components/schemas/RuleAttributesRequest" type: $ref: "#/components/schemas/RuleType" type: object UpdateRuleResponse: description: The response from a rule update request. properties: data: $ref: "#/components/schemas/UpdateRuleResponseData" type: object UpdateRuleResponseData: description: The data for a rule update response. properties: attributes: $ref: "#/components/schemas/RuleAttributes" id: $ref: "#/components/schemas/RuleId" relationships: $ref: "#/components/schemas/RelationshipToRule" type: $ref: "#/components/schemas/RuleType" type: object UpdateRulesetRequest: description: The definition of `UpdateRulesetRequest` object. example: data: attributes: enabled: true last_version: 1 name: Updated Ruleset rules: - enabled: true mapping: metadata: name: Add Cost Center Tag query: addition: key: cost_center value: engineering case_insensitivity: false if_tag_exists: do_not_apply query: account_id:"123456789" AND service:"web-api" reference_table: - enabled: true mapping: destination_key: team_owner if_tag_exists: do_not_apply source_keys: - account_name - account_id metadata: name: Account Name Mapping query: reference_table: - enabled: true mapping: metadata: name: New table rule with new UI query: reference_table: case_insensitivity: true field_pairs: - input_column: status_type output_key: status - input_column: status_description output_key: dess if_tag_exists: append source_keys: - http_status - status_description table_name: http_status_codes type: update_ruleset properties: data: $ref: "#/components/schemas/UpdateRulesetRequestData" type: object UpdateRulesetRequestData: description: The definition of `UpdateRulesetRequestData` object. properties: attributes: $ref: "#/components/schemas/UpdateRulesetRequestDataAttributes" id: description: The `UpdateRulesetRequestData` `id`. type: string type: $ref: "#/components/schemas/UpdateRulesetRequestDataType" required: - type type: object UpdateRulesetRequestDataAttributes: description: The definition of `UpdateRulesetRequestDataAttributes` object. properties: enabled: description: The `attributes` `enabled`. example: false type: boolean last_version: description: The `attributes` `last_version`. format: int64 type: integer rules: description: The `attributes` `rules`. items: $ref: "#/components/schemas/UpdateRulesetRequestDataAttributesRulesItems" type: array required: - enabled - rules type: object UpdateRulesetRequestDataAttributesRulesItems: description: The definition of `UpdateRulesetRequestDataAttributesRulesItems` object. properties: enabled: description: The `items` `enabled`. example: false type: boolean mapping: $ref: "#/components/schemas/DataAttributesRulesItemsMapping" metadata: $ref: "#/components/schemas/RulesetItemMetadata" name: description: The `items` `name`. example: "" type: string query: $ref: "#/components/schemas/UpdateRulesetRequestDataAttributesRulesItemsQuery" reference_table: $ref: "#/components/schemas/UpdateRulesetRequestDataAttributesRulesItemsReferenceTable" required: - enabled - name type: object UpdateRulesetRequestDataAttributesRulesItemsQuery: description: The definition of `UpdateRulesetRequestDataAttributesRulesItemsQuery` object. nullable: true properties: addition: $ref: "#/components/schemas/UpdateRulesetRequestDataAttributesRulesItemsQueryAddition" case_insensitivity: description: The `query` `case_insensitivity`. type: boolean if_not_exists: deprecated: true description: Deprecated. Use `if_tag_exists` instead. The `query` `if_not_exists`. type: boolean if_tag_exists: $ref: "#/components/schemas/DataAttributesRulesItemsIfTagExists" query: description: The `query` `query`. example: "" type: string required: - addition - query type: object UpdateRulesetRequestDataAttributesRulesItemsQueryAddition: description: The definition of `UpdateRulesetRequestDataAttributesRulesItemsQueryAddition` object. nullable: true properties: key: description: The `addition` `key`. example: "" type: string value: description: The `addition` `value`. example: "" type: string required: - key - value type: object UpdateRulesetRequestDataAttributesRulesItemsReferenceTable: description: The definition of `UpdateRulesetRequestDataAttributesRulesItemsReferenceTable` object. nullable: true properties: case_insensitivity: description: The `reference_table` `case_insensitivity`. type: boolean field_pairs: description: The `reference_table` `field_pairs`. items: $ref: "#/components/schemas/UpdateRulesetRequestDataAttributesRulesItemsReferenceTableFieldPairsItems" type: array if_not_exists: deprecated: true description: Deprecated. Use `if_tag_exists` instead. The `reference_table` `if_not_exists`. type: boolean if_tag_exists: $ref: "#/components/schemas/DataAttributesRulesItemsIfTagExists" source_keys: description: The `reference_table` `source_keys`. example: - "" items: description: A source key for the reference table lookup. type: string type: array table_name: description: The `reference_table` `table_name`. example: "" type: string required: - field_pairs - source_keys - table_name type: object UpdateRulesetRequestDataAttributesRulesItemsReferenceTableFieldPairsItems: description: The definition of `UpdateRulesetRequestDataAttributesRulesItemsReferenceTableFieldPairsItems` object. properties: input_column: description: The `items` `input_column`. example: "" type: string output_key: description: The `items` `output_key`. example: "" type: string required: - input_column - output_key type: object UpdateRulesetRequestDataType: default: update_ruleset description: Update ruleset resource type. enum: - update_ruleset example: update_ruleset type: string x-enum-varnames: - UPDATE_RULESET UpdateTenancyConfigData: description: The data object for updating an existing OCI tenancy integration configuration, including the tenancy ID, type, and updated attributes. properties: attributes: $ref: "#/components/schemas/UpdateTenancyConfigDataAttributes" id: description: The OCID of the OCI tenancy to update. example: "" type: string type: $ref: "#/components/schemas/UpdateTenancyConfigDataType" required: - type - id type: object UpdateTenancyConfigDataAttributes: description: Attributes for updating an existing OCI tenancy integration configuration, including optional credentials, region settings, and collection options. properties: auth_credentials: $ref: "#/components/schemas/UpdateTenancyConfigDataAttributesAuthCredentials" cost_collection_enabled: description: Whether cost data collection from OCI is enabled for the tenancy. type: boolean home_region: description: The home region of the OCI tenancy (for example, us-ashburn-1). type: string logs_config: $ref: "#/components/schemas/UpdateTenancyConfigDataAttributesLogsConfig" metrics_config: $ref: "#/components/schemas/UpdateTenancyConfigDataAttributesMetricsConfig" regions_config: $ref: "#/components/schemas/UpdateTenancyConfigDataAttributesRegionsConfig" resource_collection_enabled: description: Whether resource collection from OCI is enabled for the tenancy. type: boolean user_ocid: description: The OCID of the OCI user used by the Datadog integration for authentication. type: string type: object UpdateTenancyConfigDataAttributesAuthCredentials: description: OCI API signing key credentials used to update the Datadog integration's authentication with the OCI tenancy. properties: fingerprint: description: The fingerprint of the OCI API signing key used for authentication. type: string private_key: description: The PEM-encoded private key corresponding to the OCI API signing key fingerprint. example: "" type: string required: - private_key type: object UpdateTenancyConfigDataAttributesLogsConfig: description: Log collection configuration for updating an OCI tenancy, controlling which compartments and services have log collection enabled. properties: compartment_tag_filters: description: List of compartment tag filters to scope log collection to specific compartments. items: description: A compartment tag filter in key:value format (for example, datadog:true). type: string type: array enabled: description: Whether log collection is enabled for the tenancy. type: boolean enabled_services: description: List of OCI service names for which log collection is enabled. items: description: An OCI service name for which log collection is enabled (for example, compute). type: string type: array type: object UpdateTenancyConfigDataAttributesMetricsConfig: description: Metrics collection configuration for updating an OCI tenancy, controlling which compartments and services are included or excluded. properties: compartment_tag_filters: description: List of compartment tag filters to scope metrics collection to specific compartments. items: description: A compartment tag filter in key:value format (for example, datadog:true). type: string type: array enabled: description: Whether metrics collection is enabled for the tenancy. type: boolean excluded_services: description: List of OCI service names to exclude from metrics collection. items: description: An OCI service name to exclude from metrics collection (for example, compute). type: string type: array type: object UpdateTenancyConfigDataAttributesRegionsConfig: description: Region configuration for updating an OCI tenancy, specifying which regions are available, enabled, or disabled for data collection. properties: available: description: List of OCI regions available for data collection in the tenancy. items: description: An OCI region identifier (for example, us-ashburn-1). type: string type: array disabled: description: List of OCI regions explicitly disabled for data collection. items: description: An OCI region identifier (for example, us-phoenix-1). type: string type: array enabled: description: List of OCI regions enabled for data collection. items: description: An OCI region identifier (for example, us-ashburn-1). type: string type: array type: object UpdateTenancyConfigDataType: default: oci_tenancy description: OCI tenancy resource type. enum: - oci_tenancy example: oci_tenancy type: string x-enum-varnames: - OCI_TENANCY UpdateTenancyConfigRequest: description: Request body for updating an existing OCI tenancy integration configuration. example: data: attributes: auth_credentials: fingerprint: "" private_key: |- ----BEGIN PRIVATE KEY----- MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCdvSMmlfLyeD4M QsA3WlrWBqKdWa5eVV3/uODyqT3wWMEMIJHcG3/quNs8nh9xrK1/JkQT2qoKEHqR C5k59jN6Vp8em8ARJthMgam9K37ELt+IQ/G8ySTSuqZG8T4cHp/cs3fAclNqttOl YnGr4RbVAgMBAAECggEAGZNLGbyCUbIRTW6Kh4d8ZVC+eZtJMqGmGJ3KfVaW8Pjn QGWfSuJCEe2o2Y8G3phlidFauICnZ44enXA17Rhi+I/whnr7FIyQk2bR7rv+1Uhc mOJygWX5eFFMsledgVAdIAl9Luk2nykx7Un3g6rtbl/Vs+5k4m7ITLFMpCHzsJLU nm8kBzDOqY2JUkMd08nL88KL6QywWtal05UESzQpNFXd0e5kxYfexeMCsLsWP0mc quMLRbn7NuBjCbe9VU2kmIvcfDDaWjurT7d5m1OXx1cc8p6P4PFZTVyCjdhiWOr3 LQXZ4/vdZNR3zgEHypRoM6D9Yq99LWUOUEMrdiSLQQKBgQDQkh7C1OtAXnpy7F6R W+/I3zBHici2p7A57UT7VECQ1IVGg37/uus83DkuOtdZ33JmHLAVrwLFJvUlbyjx l6dc/1ms40L5HFdLgaVtd4k0rSPFeOSDr6evz0lX4yBuzlP0fEh+o3XHW7mwe2G+ rWCULF/Uqza66fjbCSKMNgLIXQKBgQDBm9nZg/s4S0THWCFNWcB1tXBG0p/sH5eY PC1H/VmTEINIixStrS4ufczf31X8rcoSjSbO7+vZDTTATdk7OLn1I2uGFVYl8M59 86BYT2Hi7cwp7YVzOc/cJigVeBAqSRW/iYYyWBEUTiW1gbkV0sRWwhPp67m+c0sP XpY/iEZA2QKBgB1w8tynt4l/jKNaUEMOijt9ndALWATIiOy0XG9pxi9rgGCiwTOS DBCsOXoYHjv2eayGUijNaoOv6xzcoxfvQ1WySdNIxTRq1ru20kYwgHKqGgmO9hrM mcwMY5r/WZ2qjFlPjeAqbL62aPDLidGjoaVo2iIoBPK/gjxQ/5f0MS4N/YQ0zWoYBueSQ0DGs -----END PRIVATE KEY----- cost_collection_enabled: true home_region: us-ashburn-1 logs_config: compartment_tag_filters: - datadog:true - env:prod enabled: true enabled_services: - service_1 - service_2 metrics_config: compartment_tag_filters: - datadog:true - env:prod enabled: true excluded_services: - service_1 - service_2 regions_config: available: - us-ashburn-1 - us-phoenix-1 disabled: - us-phoenix-1 enabled: - us-ashburn-1 resource_collection_enabled: true user_ocid: ocid.user.test id: ocid.tenancy.test type: oci_tenancy properties: data: $ref: "#/components/schemas/UpdateTenancyConfigData" required: - data type: object UpdateUserIdentityProvidersRequest: description: Request body for setting identity provider overrides for a user. properties: data: $ref: "#/components/schemas/UserRelationshipIdentityProviderDataList" required: - data type: object UpdateVariantAttributes: description: Attributes for updating a variant. properties: name: description: The display name of the variant. example: "Variant ABC123 Updated" type: string value: description: The value of the variant as a string. example: "new_value" type: string type: object UpdateVariantData: description: Data for updating a variant. properties: attributes: $ref: "#/components/schemas/UpdateVariantAttributes" id: description: The ID of the variant. If you include it, use the same value as the `variant_id` path parameter. example: "550e8400-e29b-41d4-a716-446655440002" format: uuid type: string type: $ref: "#/components/schemas/VariantDataType" required: - type - attributes type: object UpdateVariantRequest: description: Request to update an existing variant's name and value. properties: data: $ref: "#/components/schemas/UpdateVariantData" required: - data type: object UpdateWorkflowRequest: description: A request object for updating an existing workflow. example: data: attributes: description: "A sample workflow." name: "Example Workflow" published: true runAs: type: owner spec: annotations: - display: bounds: height: 150 width: 300 x: -375 y: -0.5 id: 99999999-9999-9999-9999-999999999999 markdownTextAnnotation: text: "Example annotation." connectionEnvs: - connections: - connectionId: "e1e64943-c7c5-4487-aece-25aaec7d3aad" label: "INTEGRATION_DATADOG" env: "default" handle: "my-handle" inputSchema: parameters: - defaultValue: "default" name: "input" type: "STRING" outputSchema: parameters: - name: "output" type: "ARRAY_OBJECT" value: "{{ Steps.Step1 }}" steps: - actionId: "com.datadoghq.dd.monitor.listMonitors" connectionLabel: "INTEGRATION_DATADOG" name: "Step1" outboundEdges: - branchName: "main" nextStepName: "Step2" parameters: - name: "tags" value: "service:monitoring" - actionId: "com.datadoghq.core.noop" name: "Step2" triggers: - monitorTrigger: rateLimit: count: 1 interval: "3600s" startStepNames: ["Step1"] - githubWebhookTrigger: {} startStepNames: ["Step1"] tags: - "team:infra" - "service:monitoring" - "foo:bar" id: "22222222-2222-2222-2222-222222222222" type: "workflows" properties: data: $ref: "#/components/schemas/WorkflowDataUpdate" required: - data type: object UpdateWorkflowResponse: description: The response object after updating a workflow. properties: data: $ref: "#/components/schemas/WorkflowDataUpdate" type: object UpdatedPersonalAccessToken: description: Datadog access token returned by the update endpoint. properties: attributes: $ref: "#/components/schemas/PersonalAccessTokenAttributes" id: description: ID of the access token. example: "00000000-0000-1234-0000-000000000000" type: string relationships: $ref: "#/components/schemas/UpdatedPersonalAccessTokenRelationships" type: $ref: "#/components/schemas/PersonalAccessTokensType" required: - id - type type: object UpdatedPersonalAccessTokenRelationships: description: Resources related to the access token. properties: owned_by: $ref: "#/components/schemas/RelationshipToUser" type: object UpdatedPersonalAccessTokenResponse: description: Response for updating an access token. properties: data: $ref: "#/components/schemas/UpdatedPersonalAccessToken" required: - data type: object UpdatedServiceAccessToken: description: Datadog access token returned by the update endpoint. properties: attributes: $ref: "#/components/schemas/ServiceAccessTokenAttributes" id: description: ID of the access token. example: "00000000-0000-1234-0000-000000000000" type: string relationships: $ref: "#/components/schemas/UpdatedServiceAccessTokenRelationships" type: $ref: "#/components/schemas/ServiceAccessTokensType" required: - id - type type: object UpdatedServiceAccessTokenRelationships: description: Resources related to the access token. properties: owned_by: $ref: "#/components/schemas/RelationshipToServiceAccount" type: object UpdatedServiceAccessTokenResponse: description: Response for updating an access token. properties: data: $ref: "#/components/schemas/UpdatedServiceAccessToken" required: - data type: object UpsertAllocationRequest: description: Request to create or update a targeting rule (allocation) for a feature flag environment. properties: experiment_id: description: The experiment ID for experiment-linked allocations. example: "550e8400-e29b-41d4-a716-446655440030" nullable: true type: string exposure_schedule: $ref: "#/components/schemas/ExposureScheduleRequest" guardrail_metrics: description: Guardrail metrics used to monitor and auto-pause or abort. items: $ref: "#/components/schemas/GuardrailMetricRequest" type: array id: description: "The unique identifier of the targeting rule allocation. Use this ID with the allocation management endpoints, such as `/api/v2/allocations/{allocation_id}`. It is not included in SDK evaluation results or exposure events." example: "550e8400-e29b-41d4-a716-446655440020" format: uuid type: string key: description: "The unique key of the targeting rule allocation. SDKs report this key in flag evaluation results and exposure events to indicate which targeting rule assigned the variant. Use it to match evaluation or experiment data to this rule." example: "prod-rollout" type: string name: description: The display name of the targeting rule. example: "Production Rollout" type: string targeting_rules: description: Targeting rules that determine audience eligibility. items: $ref: "#/components/schemas/TargetingRuleRequest" type: array type: $ref: "#/components/schemas/AllocationType" variant_weights: description: Variant distribution weights. items: $ref: "#/components/schemas/VariantWeightRequest" type: array required: - name - key - type type: object UpsertAndPublishFormVersionData: description: The data for upserting and publishing a form version. properties: attributes: $ref: "#/components/schemas/UpsertAndPublishFormVersionDataAttributes" type: $ref: "#/components/schemas/FormVersionType" required: - type - attributes type: object UpsertAndPublishFormVersionDataAttributes: description: The attributes for upserting and publishing a form version. properties: data_definition: $ref: "#/components/schemas/FormDataDefinition" ui_definition: $ref: "#/components/schemas/FormUiDefinition" upsert_params: $ref: "#/components/schemas/UpsertAndPublishFormVersionUpsertParams" required: - data_definition - ui_definition - upsert_params type: object UpsertAndPublishFormVersionRequest: description: A request to upsert and publish a form version in a single transaction. properties: data: $ref: "#/components/schemas/UpsertAndPublishFormVersionData" required: - data type: object UpsertAndPublishFormVersionUpsertParams: description: Concurrency control parameters for the upsert and publish operation. properties: etag: description: The ETag of the latest version used for optimistic concurrency control. example: b51f08b698d88d8027a935d9db649774949f5fb41a0c559bfee6a9a13225c72d type: string required: - etag type: object UpsertCatalogEntityRequest: description: Create or update entity request. oneOf: - $ref: "#/components/schemas/EntityV3" - $ref: "#/components/schemas/EntityRaw" UpsertCatalogEntityResponse: description: Upsert entity response. properties: data: $ref: "#/components/schemas/EntityResponseData" included: $ref: "#/components/schemas/UpsertCatalogEntityResponseIncluded" meta: $ref: "#/components/schemas/EntityResponseMeta" type: object UpsertCatalogEntityResponseIncluded: description: Upsert entity response included. items: $ref: "#/components/schemas/UpsertCatalogEntityResponseIncludedItem" type: array UpsertCatalogEntityResponseIncludedItem: description: Upsert entity response included item. oneOf: - $ref: "#/components/schemas/EntityResponseIncludedSchema" UpsertCatalogKindRequest: description: Create or update kind request. oneOf: - $ref: "#/components/schemas/KindObj" - $ref: "#/components/schemas/KindRaw" UpsertCatalogKindResponse: description: Upsert kind response. properties: data: $ref: "#/components/schemas/KindResponseData" meta: $ref: "#/components/schemas/KindResponseMeta" type: object UpsertCloudInventorySyncConfigRequest: description: Request body for creating or updating a cloud inventory sync configuration. properties: data: $ref: "#/components/schemas/UpsertCloudInventorySyncConfigRequestData" required: - data type: object UpsertCloudInventorySyncConfigRequestAttributes: description: |- Settings for the cloud provider specified in `data.id`. Include only the matching provider object (`aws`, `gcp`, or `azure`). properties: aws: $ref: "#/components/schemas/CloudInventorySyncConfigAWSRequestAttributes" azure: $ref: "#/components/schemas/CloudInventorySyncConfigAzureRequestAttributes" gcp: $ref: "#/components/schemas/CloudInventorySyncConfigGCPRequestAttributes" type: object UpsertCloudInventorySyncConfigRequestData: description: Storage Management configuration data for the create or update request. properties: attributes: $ref: "#/components/schemas/UpsertCloudInventorySyncConfigRequestAttributes" id: $ref: "#/components/schemas/CloudInventoryCloudProviderId" type: $ref: "#/components/schemas/CloudInventoryCloudProviderRequestType" required: - type - id - attributes type: object UpsertFormVersionData: description: The data for creating or updating a form version. properties: attributes: $ref: "#/components/schemas/UpsertFormVersionDataAttributes" type: $ref: "#/components/schemas/FormVersionType" required: - type - attributes type: object UpsertFormVersionDataAttributes: description: The attributes for creating or updating a form version. properties: data_definition: $ref: "#/components/schemas/FormDataDefinition" state: $ref: "#/components/schemas/FormVersionState" ui_definition: $ref: "#/components/schemas/FormUiDefinition" upsert_params: $ref: "#/components/schemas/UpsertFormVersionUpsertParams" required: - state - data_definition - ui_definition - upsert_params type: object UpsertFormVersionRequest: description: A request to create or update a form version. properties: data: $ref: "#/components/schemas/UpsertFormVersionData" required: - data type: object UpsertFormVersionUpsertParams: description: Concurrency control parameters for the form version upsert operation. properties: etag: description: The ETag of the latest version. Required when `match_policy` is `if_etag_match`. example: b51f08b698d88d8027a935d9db649774949f5fb41a0c559bfee6a9a13225c72d nullable: true type: string insert_only: description: If true, only a new version may be inserted; updating the current draft is not allowed. example: false type: boolean match_policy: $ref: "#/components/schemas/LatestVersionMatchPolicy" required: - match_policy type: object UpsertOAuthScopesRestrictionData: description: Data object of an upsert OAuth2 scopes restriction request. properties: attributes: $ref: "#/components/schemas/UpsertOAuthScopesRestrictionDataAttributes" type: $ref: "#/components/schemas/UpsertOAuthScopesRestrictionType" required: - type type: object UpsertOAuthScopesRestrictionDataAttributes: description: Attributes of an upsert OAuth2 scopes restriction request. properties: oidc_scopes: description: OIDC scopes the client is allowed to request. example: - openid - email items: $ref: "#/components/schemas/OAuthOidcScope" type: array permission_scopes: description: |- Datadog permission scopes the client is allowed to request. Each value must be a valid permission name. example: - dashboards_read - metrics_read items: description: Datadog permission scope name. example: dashboards_read type: string type: array type: object UpsertOAuthScopesRestrictionRequest: description: Request payload for creating or updating the scopes restriction of an OAuth2 client. properties: data: $ref: "#/components/schemas/UpsertOAuthScopesRestrictionData" required: - data type: object UpsertOAuthScopesRestrictionType: default: upsert_scopes_restriction description: JSON:API resource type for an upsert OAuth2 client scopes restriction request. enum: - upsert_scopes_restriction example: upsert_scopes_restriction type: string x-enum-varnames: - UPSERT_SCOPES_RESTRICTION Urgency: description: Specifies the level of urgency for a routing rule (low, high, or dynamic). enum: - low - high - dynamic example: low type: string x-enum-varnames: - LOW - HIGH - DYNAMIC UrlParam: description: The definition of `UrlParam` object. properties: name: $ref: "#/components/schemas/TokenName" example: MyUrlParameter value: description: The `UrlParam` `value`. example: Some Url Parameter value type: string required: - name - value type: object UrlParamUpdate: description: The definition of `UrlParamUpdate` object. properties: deleted: description: Should the header be deleted. type: boolean name: $ref: "#/components/schemas/TokenName" example: MyUrlParameter value: description: The `UrlParamUpdate` `value`. example: Some Url Parameter value type: string required: - name type: object UsageApplicationSecurityMonitoringResponse: description: Application Security Monitoring usage response. properties: data: description: Response containing Application Security Monitoring usage. items: $ref: "#/components/schemas/UsageDataObject" type: array type: object UsageAttributesObject: description: Usage attributes data. properties: org_name: description: The organization name. type: string product_family: description: The product for which usage is being reported. type: string public_id: description: The organization public ID. type: string region: description: The region of the Datadog instance that the organization belongs to. type: string timeseries: description: List of usage data reported for each requested hour. items: $ref: "#/components/schemas/UsageTimeSeriesObject" type: array usage_type: $ref: "#/components/schemas/HourlyUsageType" type: object UsageAttributionTypesAttributes: description: List of usage attribution types. properties: values: description: "List of usage attribution types." items: description: A given usage type in a list. example: "infra_host" type: string type: array type: object UsageAttributionTypesBody: description: Usage attribution types data. properties: attributes: $ref: "#/components/schemas/UsageAttributionTypesAttributes" id: description: Unique ID of the response. type: string type: $ref: "#/components/schemas/UsageAttributionTypesType" type: object UsageAttributionTypesResponse: description: Usage attribution types response. properties: data: $ref: "#/components/schemas/UsageAttributionTypesBody" type: object UsageAttributionTypesType: default: usage_attribution_types description: Type of usage attribution types data. enum: - usage_attribution_types type: string x-enum-varnames: - USAGE_ATTRIBUTION_TYPES UsageDataObject: description: Usage data. properties: attributes: $ref: "#/components/schemas/UsageAttributesObject" id: description: Unique ID of the response. type: string type: $ref: "#/components/schemas/UsageTimeSeriesType" type: object UsageLambdaTracedInvocationsResponse: description: Lambda Traced Invocations usage response. properties: data: description: Response containing Lambda Traced Invocations usage. items: $ref: "#/components/schemas/UsageDataObject" type: array type: object UsageObservabilityPipelinesResponse: description: Observability Pipelines usage response. properties: data: description: Response containing Observability Pipelines usage. items: $ref: "#/components/schemas/UsageDataObject" type: array type: object UsageQuotaBulkResultAttributes: description: Attributes of a usage quota bulk write result. On success, quota fields are present as applicable, and pending fields are present only when a change is scheduled. On failure, only `error` is present and the other fields are omitted. properties: enforced: description: Whether usage above the limit is actively blocked instead of only tracked or alerted on. Omitted if this item failed to write. example: true type: boolean error: description: An error message describing why this item failed to write. Omitted if this item was written successfully. example: usage_limit is out of range type: string org_public_id: description: The public ID of the organization that owns the quota. Omitted if this item failed to write. example: abcdef12345 type: string pending_effective_from: description: The future UTC month when the scheduled limit takes effect, formatted as `YYYY-MM`, starting at 00:00 UTC on its first day. Present only together with `pending_usage_limit` and omitted when no change is scheduled or this item failed to write. example: "2026-11" pattern: '^\d{4}-\d{2}$' type: string pending_usage_limit: description: The usage limit scheduled for the organization-wide quota in the usage units defined by the quota namespace. A value of `0` is valid. At the start of the effective month, this value becomes `usage_limit` and both pending fields are omitted. Omitted when no change is scheduled or this item failed to write. example: 50000 format: double type: number scope: $ref: "#/components/schemas/UsageQuotaResponseScope" usage_limit: description: The quota limit in the usage units defined by the quota namespace. May be fractional for quotas configured before public writes required whole units. Omitted if this item failed to write. example: 100000 format: double type: number type: object UsageQuotaBulkResultData: description: The result of writing one usage quota in a bulk create-or-update request. properties: attributes: $ref: "#/components/schemas/UsageQuotaBulkResultAttributes" id: description: An opaque usage quota identifier. Clients must pass this value back verbatim in update and delete requests and must not infer any structure from it. example: "MTIzNB9haV9jcmVkaXRzH3VzZXJfaGFuZGxlOl9fQUxMX18" type: string type: $ref: "#/components/schemas/UsageQuotaType" required: - id - type - attributes type: object UsageQuotaBulkResultDataList: description: The results of writing each usage quota in a bulk create-or-update request, in the same order as the request. items: $ref: "#/components/schemas/UsageQuotaBulkResultData" type: array UsageQuotaCreateAttributes: description: Attributes for creating or updating a usage quota by scope. Each item must provide `usage_limit`, `pending_usage_limit`, or both. Providing only `pending_usage_limit` updates an existing organization-wide quota, never creates one, requires `enforced` to be omitted, and fails if the quota does not exist. example: enforced: true pending_usage_limit: 100000 usage_limit: 600000 properties: enforced: description: Whether to actively block usage above `usage_limit` instead of only tracking or alerting on it. Required when `usage_limit` is provided and must be omitted when only `pending_usage_limit` is provided. example: true type: boolean pending_usage_limit: description: The non-negative, whole-number limit to schedule for the organization-wide quota in the usage units defined by the quota namespace. It is not checked against current usage. Each write schedules the value for 00:00 UTC on the first day of the next calendar month and replaces any previously scheduled change; the server computes `pending_effective_from`. Omit this field to leave any scheduled change unchanged, including when raising `usage_limit`. Cancel a scheduled change only by deleting the quota's `/pending` sub-resource. example: 50000 format: int64 minimum: 0 type: integer scope: $ref: "#/components/schemas/UsageQuotaRequestScope" usage_limit: description: The non-negative, whole-number quota limit to set in the usage units defined by the quota namespace. For an organization-wide quota (scope omitted), the limit must be greater than usage already recorded in the current period. When this field is provided, `enforced` is required. example: 100000 format: int64 minimum: 0 type: integer type: object UsageQuotaCreateData: description: A usage quota resource to create or update by scope. properties: attributes: $ref: "#/components/schemas/UsageQuotaCreateAttributes" type: $ref: "#/components/schemas/UsageQuotaType" required: - type - attributes type: object UsageQuotaCreateDataList: description: A bulk list of usage quota resources to create or update by scope. items: $ref: "#/components/schemas/UsageQuotaCreateData" minItems: 1 type: array UsageQuotaRequestScope: additionalProperties: example: jane@example.com type: string description: A namespace-specific key and value identifying what the quota applies to within an organization. See the endpoint description for the supported scope keys, values, and validation rules. example: user_handle: jane@example.com maxProperties: 1 minProperties: 1 type: object UsageQuotaResponse: description: Response containing a usage quota. properties: data: $ref: "#/components/schemas/UsageQuotaResponseData" required: - data type: object UsageQuotaResponseAttributes: description: Attributes of a usage quota. properties: enforced: description: Whether usage above the limit is actively blocked instead of only tracked or alerted on. example: true type: boolean org_public_id: description: The public ID of the organization that owns the quota. example: abcdef12345 type: string pending_effective_from: description: The future UTC month when the scheduled limit takes effect, formatted as `YYYY-MM`, starting at 00:00 UTC on its first day. Present only together with `pending_usage_limit` and omitted when no change is scheduled. example: "2026-11" pattern: '^\d{4}-\d{2}$' type: string pending_usage_limit: description: |- The usage limit scheduled for the organization-wide quota in the usage units defined by the quota namespace. A value of `0` is valid. At the start of the effective month, this value becomes `usage_limit` and both pending fields are omitted. Omitted when no change is scheduled. example: 50000 format: double type: number scope: $ref: "#/components/schemas/UsageQuotaResponseScope" usage_limit: description: The quota limit in the usage units defined by the quota namespace. May be fractional for quotas configured before public writes required whole units. example: 100000 format: double type: number required: - org_public_id - usage_limit - enforced type: object UsageQuotaResponseData: description: A usage quota resource. properties: attributes: $ref: "#/components/schemas/UsageQuotaResponseAttributes" id: description: An opaque usage quota identifier. Clients must pass this value back verbatim in update and delete requests and must not infer any structure from it. example: "MTIzNB9haV9jcmVkaXRzH3VzZXJfaGFuZGxlOl9fQUxMX18" type: string type: $ref: "#/components/schemas/UsageQuotaType" required: - id - type - attributes type: object UsageQuotaResponseDataList: description: A list of usage quota resources. items: $ref: "#/components/schemas/UsageQuotaResponseData" type: array UsageQuotaResponseScope: additionalProperties: example: jane@example.com type: string description: A namespace-specific key and value identifying what the quota applies to within an organization. The object contains exactly one entry. A `user_handle` value of `"*"` identifies the default quota applied to users without a specific quota. This field is omitted for an organization-wide quota. example: user_handle: jane@example.com maxProperties: 1 minProperties: 1 type: object UsageQuotaType: description: The JSON:API resource type for a usage quota. enum: - quotas example: quotas type: string x-enum-varnames: - QUOTAS UsageQuotaUpdateAttributes: description: Attributes to update on a usage quota. At least one of `usage_limit`, `enforced`, or `pending_usage_limit` must be provided. Omitting a property leaves its current value unchanged. properties: enforced: description: Whether to actively block usage above the limit. Omit this field to leave the current enforcement setting unchanged. example: false nullable: true type: boolean pending_usage_limit: description: The non-negative, whole-number limit to schedule for the organization-wide quota in the usage units defined by the quota namespace. It is not checked against current usage. Each write schedules the value for 00:00 UTC on the first day of the next calendar month and replaces any previously scheduled change; the server computes `pending_effective_from`. Omit this field to leave any scheduled change unchanged, including when raising `usage_limit`; use `DELETE /api/v2/usage/quotas/{quota_namespace}/{id}/pending` to cancel one. example: 50000 format: int64 minimum: 0 nullable: true type: integer usage_limit: description: The new quota limit in the usage units defined by the quota namespace. For an organization-wide quota (empty scope), the limit must be greater than the usage already recorded in the current period. Omit this field to leave the current limit unchanged. example: 120000 format: int64 minimum: 0 nullable: true type: integer type: object UsageQuotaUpdateData: description: A usage quota resource to update. properties: attributes: $ref: "#/components/schemas/UsageQuotaUpdateAttributes" id: description: The opaque usage quota identifier, which must match the identifier in the request path. example: "MTIzNB9haV9jcmVkaXRzH3VzZXJfaGFuZGxlOl9fQUxMX18" type: string type: $ref: "#/components/schemas/UsageQuotaType" required: - id - type - attributes type: object UsageQuotaUpdateRequest: description: Request containing the usage quota resource to update. properties: data: $ref: "#/components/schemas/UsageQuotaUpdateData" required: - data type: object UsageQuotasBulkResponse: description: Response containing the result of a bulk usage quota create-or-update request. Returned with a `200` status regardless of whether individual items succeeded or failed; check each item's `error` attribute to determine its outcome. properties: data: $ref: "#/components/schemas/UsageQuotaBulkResultDataList" required: - data type: object UsageQuotasCreateRequest: description: A JSON:API bulk request containing an array of usage quota resources rather than a single resource. properties: data: $ref: "#/components/schemas/UsageQuotaCreateDataList" required: - data type: object UsageQuotasListResponse: description: Response containing a paginated list of usage quotas. properties: data: $ref: "#/components/schemas/UsageQuotaResponseDataList" meta: $ref: "#/components/schemas/UsageQuotasResponseMeta" required: - data - meta type: object UsageQuotasResponseMeta: description: Pagination metadata for a usage quota list response. properties: page: $ref: "#/components/schemas/UsageQuotasResponseMetaPage" required: - page type: object UsageQuotasResponseMetaPage: description: Cursor pagination fields for a usage quota list response. properties: next_cursor: description: An opaque cursor for retrieving the next page. Omitted when there are no more results. example: eyJvZmZzZXQiOjEwMH0= type: string type: object UsageSummaryAvailableFieldsAttributes: description: |- The lists of field names returned by `GET /api/v1/usage/summary` at each of its three response levels. Each list contains every key the data endpoint emits—both typed fields declared in the OpenAPI spec and untyped keys exposed through `additionalProperties`. properties: date_fields: description: |- Sorted list of every key returned inside each `UsageSummaryDate` entry of `usage[]` (typed fields and `additionalProperties` keys combined). items: type: string type: array date_org_fields: description: |- Sorted list of every key returned inside each `UsageSummaryDateOrg` entry of `usage[].orgs[]` (typed fields and `additionalProperties` keys combined). items: type: string type: array response_fields: description: |- Sorted list of every key returned as a direct property of `UsageSummaryResponse` (typed fields and `additionalProperties` keys combined). items: type: string type: array type: object UsageSummaryAvailableFieldsBody: description: Available-fields data. properties: attributes: $ref: "#/components/schemas/UsageSummaryAvailableFieldsAttributes" id: description: The identifier for the discovery scope. Always `"all"`. example: all type: string type: $ref: "#/components/schemas/UsageSummaryAvailableFieldsType" type: object UsageSummaryAvailableFieldsResponse: description: |- Response listing every field name returned by `GET /api/v1/usage/summary` at each of its three response levels. Includes both typed fields and untyped `additionalProperties` keys. properties: data: $ref: "#/components/schemas/UsageSummaryAvailableFieldsBody" type: object UsageSummaryAvailableFieldsType: default: usage_summary_available_fields description: Type of available-fields data. enum: - usage_summary_available_fields type: string x-enum-varnames: - USAGE_SUMMARY_AVAILABLE_FIELDS UsageTimeSeriesObject: description: Usage timeseries data. properties: timestamp: description: Datetime in ISO-8601 format, UTC. The hour for the usage. format: date-time type: string value: description: Contains the number measured for the given usage_type during the hour. format: int64 nullable: true type: integer type: object UsageTimeSeriesType: default: usage_timeseries description: Type of usage data. enum: - usage_timeseries example: usage_timeseries type: string x-enum-varnames: - USAGE_TIMESERIES User: description: User object returned by the API. properties: attributes: $ref: "#/components/schemas/UserAttributes" id: description: ID of the user. type: string relationships: $ref: "#/components/schemas/UserResponseRelationships" type: $ref: "#/components/schemas/UsersType" type: object UserAttributes: description: Attributes of user object returned by the API. properties: created_at: description: The ISO 8601 timestamp of when the user account was created. format: date-time type: string disabled: description: Whether the user account is deactivated. Disabled users cannot log in. type: boolean email: description: The email address of the user, used for login and notifications. type: string handle: description: The unique handle (username) of the user, typically matching their email prefix. type: string icon: description: URL of the user's profile icon, typically a Gravatar URL derived from the email address. type: string last_login_time: description: The ISO 8601 timestamp of the user's most recent login, or null if the user has never logged in. format: date-time nullable: true readOnly: true type: string mfa_enabled: description: Whether multi-factor authentication (MFA) is enabled for the user's account. readOnly: true type: boolean modified_at: description: The ISO 8601 timestamp of when the user account was last modified. format: date-time type: string name: description: The full display name of the user as shown in the Datadog UI. nullable: true type: string service_account: description: |- Whether this is a service account rather than a human user. Service accounts are used for programmatic API access. type: boolean status: description: The current status of the user account (for example, `Active`, `Pending`, or `Disabled`). type: string title: description: The job title of the user (for example, "Senior Engineer" or "Product Manager"). nullable: true type: string uuid: description: The globally unique identifier (UUID) of the user. readOnly: true type: string verified: description: Whether the user's email address has been verified. type: boolean type: object UserAttributesStatus: description: The user's status. enum: - active - deactivated - pending type: string x-enum-varnames: - ACTIVE - DEACTIVATED - PENDING UserAuthorizedClientAttributes: description: Attributes of a user authorized client. properties: created_at: description: The date and time this authorization was created. example: "2024-01-10T08:00:00+00:00" format: date-time type: string disabled: description: Whether the user has disabled this authorization. example: false type: boolean last_exercised: description: The date and time this authorization was last exercised. example: "2024-01-15T10:30:00+00:00" format: date-time nullable: true type: string modified_at: description: The date and time this authorization was last modified. example: "2024-01-10T08:00:00+00:00" format: date-time type: string org_disabled: description: Whether the organization has disabled this authorization. example: false type: boolean required: - created_at - modified_at - last_exercised - disabled - org_disabled type: object UserAuthorizedClientData: description: Data object representing a user authorized client. properties: attributes: $ref: "#/components/schemas/UserAuthorizedClientAttributes" id: description: The unique identifier of the user authorized client. example: "00000000-0000-0000-0000-000000000001" type: string relationships: $ref: "#/components/schemas/UserAuthorizedClientRelationships" type: $ref: "#/components/schemas/UserAuthorizedClientType" required: - id - type - attributes - relationships type: object UserAuthorizedClientDataList: description: List of user authorized client data objects. items: $ref: "#/components/schemas/UserAuthorizedClientData" type: array UserAuthorizedClientRelationshipOAuth2Client: description: Relationship to the OAuth2 client that was authorized. properties: data: $ref: "#/components/schemas/UserAuthorizedClientRelationshipOAuth2ClientData" required: - data type: object UserAuthorizedClientRelationshipOAuth2ClientData: description: Data identifying the OAuth2 client that was authorized. properties: id: description: The ID of the OAuth2 client. example: "00000000-0000-0000-0000-000000000010" type: string type: $ref: "#/components/schemas/UserAuthorizedClientRelationshipOAuth2ClientDataType" required: - type - id type: object UserAuthorizedClientRelationshipOAuth2ClientDataType: description: OAuth2 client resource type. enum: - oauth2_clients example: oauth2_clients type: string x-enum-varnames: - OAUTH2_CLIENTS UserAuthorizedClientRelationshipScopeData: description: Data identifying a scope granted to the OAuth2 client. properties: id: description: The identifier of the scope. example: "example_scope" type: string type: $ref: "#/components/schemas/UserAuthorizedClientRelationshipScopeDataType" required: - type - id type: object UserAuthorizedClientRelationshipScopeDataList: description: List of scope relationship data objects. items: $ref: "#/components/schemas/UserAuthorizedClientRelationshipScopeData" type: array UserAuthorizedClientRelationshipScopeDataType: description: Scope resource type. enum: - scopes example: scopes type: string x-enum-varnames: - SCOPES UserAuthorizedClientRelationshipScopes: description: Relationship to the scopes granted to the OAuth2 client. properties: data: $ref: "#/components/schemas/UserAuthorizedClientRelationshipScopeDataList" required: - data type: object UserAuthorizedClientRelationshipUser: description: Relationship to the user who granted this authorization. properties: data: $ref: "#/components/schemas/UserAuthorizedClientRelationshipUserData" required: - data type: object UserAuthorizedClientRelationshipUserData: description: Data identifying the user who granted this authorization. properties: id: description: The ID of the user. example: "00000000-0000-9999-0000-000000000001" type: string type: $ref: "#/components/schemas/UserAuthorizedClientRelationshipUserDataType" required: - type - id type: object UserAuthorizedClientRelationshipUserDataType: description: User resource type. enum: - users example: users type: string x-enum-varnames: - USERS UserAuthorizedClientRelationships: description: Relationships for a user authorized client. properties: oauth2_client: $ref: "#/components/schemas/UserAuthorizedClientRelationshipOAuth2Client" scopes: $ref: "#/components/schemas/UserAuthorizedClientRelationshipScopes" user: $ref: "#/components/schemas/UserAuthorizedClientRelationshipUser" required: - user - oauth2_client - scopes type: object UserAuthorizedClientResponse: description: Response containing a single user authorized client. properties: data: $ref: "#/components/schemas/UserAuthorizedClientData" required: - data type: object UserAuthorizedClientType: description: The resource type for user authorized clients. enum: - user_authorized_clients example: user_authorized_clients type: string x-enum-varnames: - USER_AUTHORIZED_CLIENTS UserAuthorizedClientsResponse: description: Response containing a list of user authorized clients. properties: data: $ref: "#/components/schemas/UserAuthorizedClientDataList" meta: $ref: "#/components/schemas/ResponseMetaAttributes" required: - data - meta type: object UserCreateAttributes: description: Attributes of the created user. properties: email: description: The email of the user. example: "jane.doe@example.com" type: string name: description: The name of the user. type: string title: description: The title of the user. type: string required: - email type: object UserCreateData: description: Object to create a user. properties: attributes: $ref: "#/components/schemas/UserCreateAttributes" relationships: $ref: "#/components/schemas/UserRelationships" type: $ref: "#/components/schemas/UsersType" required: - attributes - type type: object UserCreateRequest: description: Create a user. properties: data: $ref: "#/components/schemas/UserCreateData" required: - data type: object UserInvitationData: description: Object to create a user invitation. properties: relationships: $ref: "#/components/schemas/UserInvitationRelationships" type: $ref: "#/components/schemas/UserInvitationsType" required: - type - relationships type: object UserInvitationDataAttributes: description: Attributes of a user invitation. properties: created_at: description: Creation time of the user invitation. format: date-time type: string expires_at: description: Time of invitation expiration. format: date-time type: string invite_type: description: Type of invitation. type: string uuid: description: UUID of the user invitation. type: string type: object UserInvitationRelationships: description: Relationships data for user invitation. properties: user: $ref: "#/components/schemas/RelationshipToUser" required: - user type: object UserInvitationResponse: description: User invitation as returned by the API. properties: data: $ref: "#/components/schemas/UserInvitationResponseData" type: object UserInvitationResponseData: description: Object of a user invitation returned by the API. properties: attributes: $ref: "#/components/schemas/UserInvitationDataAttributes" id: description: ID of the user invitation. type: string relationships: $ref: "#/components/schemas/UserInvitationRelationships" type: $ref: "#/components/schemas/UserInvitationsType" type: object UserInvitationsRequest: description: Object to invite users to join the organization. properties: data: description: "List of user invitations." example: [] items: $ref: "#/components/schemas/UserInvitationData" type: array required: - data type: object UserInvitationsResponse: description: User invitations as returned by the API. properties: data: description: Array of user invitations. items: $ref: "#/components/schemas/UserInvitationResponseData" type: array type: object UserInvitationsType: default: user_invitations description: User invitations type. enum: - user_invitations example: user_invitations type: string x-enum-varnames: - USER_INVITATIONS UserOverrideIdentityProviderAttributes: description: Attributes of an identity provider override for a user. properties: authentication_method: description: The authentication method used by this identity provider. example: "SAML" type: string required: - authentication_method type: object UserOverrideIdentityProviderData: description: Data object representing a user identity provider override. properties: attributes: $ref: "#/components/schemas/UserOverrideIdentityProviderAttributes" id: description: The unique identifier of the identity provider. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/UserOverrideIdentityProviderDataType" required: - id - type - attributes type: object UserOverrideIdentityProviderDataList: description: List of user identity provider override data objects. items: $ref: "#/components/schemas/UserOverrideIdentityProviderData" type: array UserOverrideIdentityProviderDataType: description: The resource type for identity providers. enum: - identity_providers example: identity_providers type: string x-enum-varnames: - IDENTITY_PROVIDERS UserOverrideIdentityProvidersResponse: description: Response containing a user's identity provider overrides. properties: data: $ref: "#/components/schemas/UserOverrideIdentityProviderDataList" required: - data type: object UserRelationshipData: description: Relationship to user object. properties: id: description: A unique identifier that represents the user. example: "00000000-0000-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/UserResourceType" required: - id - type type: object UserRelationshipIdentityProviderData: description: Resource identifier for an identity provider in a relationship update. properties: id: description: The unique identifier of the identity provider. example: "00000000-0000-0000-0000-000000000001" type: string type: $ref: "#/components/schemas/UserRelationshipIdentityProviderDataType" required: - id - type type: object UserRelationshipIdentityProviderDataList: description: List of identity provider resource identifiers for a relationship update. items: $ref: "#/components/schemas/UserRelationshipIdentityProviderData" type: array UserRelationshipIdentityProviderDataType: description: The resource type for identity providers. enum: - identity_providers example: identity_providers type: string x-enum-varnames: - IDENTITY_PROVIDERS UserRelationships: description: Relationships of the user object. properties: roles: $ref: "#/components/schemas/RelationshipToRoles" type: object UserResourceType: default: user description: User resource type. enum: - user example: user type: string x-enum-varnames: - USER UserResponse: description: Response containing information about a single user. properties: data: $ref: "#/components/schemas/User" included: description: Array of objects related to the user. items: $ref: "#/components/schemas/UserResponseIncludedItem" type: array type: object UserResponseIncludedItem: description: An object related to a user. oneOf: - $ref: "#/components/schemas/Organization" - $ref: "#/components/schemas/Permission" - $ref: "#/components/schemas/Role" UserResponseRelationships: description: Relationships of the user object returned by the API. properties: org: $ref: "#/components/schemas/RelationshipToOrganization" other_orgs: $ref: "#/components/schemas/RelationshipToOrganizations" other_users: $ref: "#/components/schemas/RelationshipToUsers" roles: $ref: "#/components/schemas/RelationshipToRoles" type: object UserTarget: description: "Represents a user target for an escalation policy step, including the user's ID and resource type." properties: id: description: "Specifies the unique identifier of the user resource." example: "00000000-aba1-0000-0000-000000000000" type: string type: $ref: "#/components/schemas/UserTargetType" required: - type - id type: object UserTargetType: default: users description: "Indicates that the resource is of type `users`." enum: - users example: users type: string x-enum-varnames: - USERS UserTeam: description: A user's relationship with a team properties: attributes: $ref: "#/components/schemas/UserTeamAttributes" id: description: The ID of a user's relationship with a team example: TeamMembership-aeadc05e-98a8-11ec-ac2c-da7ad0900001-38835 type: string relationships: $ref: "#/components/schemas/UserTeamRelationships" type: $ref: "#/components/schemas/UserTeamType" required: - id - type type: object UserTeamAttributes: description: Team membership attributes properties: provisioned_by: description: |- The mechanism responsible for provisioning the team relationship. Possible values: null for added by a user, "service_account" if added by a service account, and "saml_mapping" if provisioned via SAML mapping. nullable: true readOnly: true type: string provisioned_by_id: description: UUID of the User or Service Account who provisioned this team membership, or null if provisioned via SAML mapping. nullable: true readOnly: true type: string role: $ref: "#/components/schemas/UserTeamRole" type: object UserTeamCreate: description: A user's relationship with a team properties: attributes: $ref: "#/components/schemas/UserTeamAttributes" relationships: $ref: "#/components/schemas/UserTeamRelationships" type: $ref: "#/components/schemas/UserTeamType" required: - type type: object UserTeamIncluded: description: Included resources related to the team membership oneOf: - $ref: "#/components/schemas/User" - $ref: "#/components/schemas/Team" UserTeamPermission: description: A user's permissions for a given team properties: attributes: $ref: "#/components/schemas/UserTeamPermissionAttributes" id: description: The user team permission's identifier example: UserTeamPermissions-aeadc05e-98a8-11ec-ac2c-da7ad0900001-416595 type: string type: $ref: "#/components/schemas/UserTeamPermissionType" required: - id - type type: object UserTeamPermissionAttributes: description: User team permission attributes properties: permissions: description: Object of team permission actions and boolean values that a logged in user can perform on this team. readOnly: true type: object type: object UserTeamPermissionType: default: user_team_permissions description: User team permission type enum: - user_team_permissions example: user_team_permissions type: string x-enum-varnames: - USER_TEAM_PERMISSIONS UserTeamRelationships: description: Relationship between membership and a user properties: team: $ref: "#/components/schemas/RelationshipToUserTeamTeam" user: $ref: "#/components/schemas/RelationshipToUserTeamUser" type: object UserTeamRequest: description: Team membership request properties: data: $ref: "#/components/schemas/UserTeamCreate" required: - data type: object UserTeamResponse: description: Team membership response properties: data: $ref: "#/components/schemas/UserTeam" included: description: Resources related to the team memberships items: $ref: "#/components/schemas/UserTeamIncluded" type: array type: object UserTeamRole: description: The user's role within the team. A value of `null` represents a regular member. enum: - admin nullable: true type: string x-enum-varnames: - ADMIN UserTeamTeamType: default: team description: User team team type enum: - team example: team type: string x-enum-varnames: - TEAM UserTeamType: default: team_memberships description: Team membership type enum: - team_memberships example: team_memberships type: string x-enum-varnames: - TEAM_MEMBERSHIPS UserTeamUpdate: description: A user's relationship with a team properties: attributes: $ref: "#/components/schemas/UserTeamAttributes" type: $ref: "#/components/schemas/UserTeamType" required: - type type: object UserTeamUpdateRequest: description: Team membership request properties: data: $ref: "#/components/schemas/UserTeamUpdate" required: - data type: object UserTeamUserType: default: users description: User team user type enum: - users example: users type: string x-enum-varnames: - USERS UserTeamsResponse: description: Team memberships response properties: data: description: Team memberships response data items: $ref: "#/components/schemas/UserTeam" type: array included: description: Resources related to the team memberships items: $ref: "#/components/schemas/UserTeamIncluded" type: array links: $ref: "#/components/schemas/TeamsResponseLinks" meta: $ref: "#/components/schemas/TeamsResponseMeta" type: object UserUpdateAttributes: description: Attributes of the edited user. properties: disabled: description: |- When set to `true`, the user is deactivated and can no longer log in. When `false`, the user is active. type: boolean email: description: |- The email address of the user, used for login and notifications. Must be a valid email format. type: string name: description: |- The full display name of the user as shown in the Datadog UI. Maximum 55 characters, cannot contain `<` or `>`. type: string title: description: The job title of the user (for example, "Senior Engineer" or "Product Manager"). nullable: true type: string type: object UserUpdateData: description: Object to update a user. properties: attributes: $ref: "#/components/schemas/UserUpdateAttributes" id: description: ID of the user. example: "00000000-0000-feed-0000-000000000000" type: string type: $ref: "#/components/schemas/UsersType" required: - attributes - type - id type: object UserUpdateRequest: description: Update a user. properties: data: $ref: "#/components/schemas/UserUpdateData" required: - data type: object UsersRelationship: description: Relationship to users. properties: data: description: Relationships to user objects. example: [] items: $ref: "#/components/schemas/UserRelationshipData" type: array required: - data type: object UsersResponse: description: Response containing information about multiple users. properties: data: description: Array of returned users. items: $ref: "#/components/schemas/User" type: array included: description: Array of objects related to the users. items: $ref: "#/components/schemas/UserResponseIncludedItem" type: array meta: $ref: "#/components/schemas/ResponseMetaAttributes" readOnly: true type: object UsersType: default: users description: Users resource type. enum: - users example: users type: string x-enum-varnames: - USERS V2Event: description: An event object. properties: attributes: $ref: "#/components/schemas/V2EventAttributes" id: description: The event's ID. example: "" type: string type: description: Entity type. example: "event" type: string type: object V2EventAggregationKey: description: Aggregation key of the event. example: "aggregation-key" type: string V2EventAttributes: description: Event attributes. properties: attributes: $ref: "#/components/schemas/V2EventAttributesAttributes" message: description: Free-form text associated with the event. example: "The event message" type: string tags: description: A list of tags associated with the event. example: ["env:api_client_test"] items: description: A tag. type: string type: array timestamp: description: Timestamp when the event occurred. example: "2017-01-15T01:30:15.010000Z" type: string type: object V2EventAttributesAttributes: description: JSON object for category-specific attributes. oneOf: - $ref: "#/components/schemas/ChangeEventAttributes" - $ref: "#/components/schemas/AlertEventAttributes" V2EventResponse: description: Get an event response. properties: data: $ref: "#/components/schemas/V2Event" type: object V2EventService: description: Service that triggered the event. example: "service-name" type: string V2EventTimestamp: description: POSIX timestamp of the event. example: 175019386627 format: int64 type: integer V2EventTitle: description: The title of the event. example: "The event title" type: string ValidateAPIKeyResponse: description: Response object for the API and application key validation status check. properties: status: $ref: "#/components/schemas/ValidateAPIKeyStatus" required: - status type: object ValidateAPIKeyStatus: description: Status of the validation. Always `ok` when both the API key and the application key are valid. enum: - ok example: ok type: string x-enum-varnames: - OK ValidateV2Attributes: description: Attributes of the API key validation response. properties: api_key_id: description: The UUID of the API key. example: "a1b2c3d4-e5f6-47a8-b9c0-d1e2f3a4b5c6" type: string api_key_scopes: description: List of scope names associated with the API key. example: - "remote_config_read" items: type: string type: array valid: description: Whether the API key is valid. example: true type: boolean required: - valid - api_key_scopes - api_key_id type: object ValidateV2Data: description: Data object containing the API key validation result. properties: attributes: $ref: "#/components/schemas/ValidateV2Attributes" id: description: The UUID of the organization associated with the API key. example: "550e8400-e29b-41d4-a716-446655440000" type: string type: $ref: "#/components/schemas/ValidateV2Type" required: - id - type - attributes type: object ValidateV2Response: description: Response for the API key validation endpoint. properties: data: $ref: "#/components/schemas/ValidateV2Data" required: - data type: object ValidateV2Type: description: Resource type for the API key validation response. enum: - validate_v2 example: validate_v2 type: string x-enum-varnames: - ValidateV2 ValidationError: description: Represents a single validation error, including a human-readable title and metadata. properties: meta: $ref: "#/components/schemas/ValidationErrorMeta" title: description: A short, human-readable summary of the error. example: Field 'region' is required type: string required: - title - meta type: object ValidationErrorMeta: description: Describes additional metadata for validation errors, including field names and error messages. properties: field: description: The field name that caused the error. example: region type: string id: description: The ID of the component in which the error occurred. example: datadog-agent-source type: string message: description: The detailed error message. example: Field 'region' is required type: string required: - message type: object ValidationResponse: description: Response containing validation errors. example: errors: - meta: field: "region" id: "datadog-agent-source" message: "Field 'region' is required" title: "Field 'region' is required" properties: errors: description: The `ValidationResponse` `errors`. items: $ref: "#/components/schemas/ValidationError" type: array type: object ValueType: description: The type of values for the feature flag variants. enum: - BOOLEAN - INTEGER - NUMERIC - STRING - JSON example: "BOOLEAN" type: string x-enum-varnames: - BOOLEAN - INTEGER - NUMERIC - STRING - JSON Variant: description: A variant of a feature flag. properties: created_at: description: The timestamp when the variant was created. example: "2023-01-01T00:00:00Z" format: date-time type: string id: description: The unique identifier of the variant. example: "550e8400-e29b-41d4-a716-446655440002" format: uuid type: string key: description: The unique key of the variant. example: "variant-abc123" type: string name: description: The name of the variant. example: "Variant ABC123" type: string updated_at: description: The timestamp when the variant was last updated. example: "2023-01-01T00:00:00Z" format: date-time type: string value: description: The value of the variant as a string. example: "true" type: string required: - id - key - name - value type: object VariantDataType: description: The resource type for variants. enum: - "variants" example: "variants" type: string x-enum-varnames: - VARIANTS VariantResponse: description: Response containing a variant. properties: data: $ref: "#/components/schemas/VariantResponseData" required: - data type: object VariantResponseAttributes: description: Attributes of a variant. properties: created_at: description: The timestamp when the variant was created. example: "2023-01-01T00:00:00Z" format: date-time type: string key: description: The unique key of the variant. example: "variant-abc123" type: string name: description: The name of the variant. example: "Variant ABC123" type: string updated_at: description: The timestamp when the variant was last updated. example: "2023-01-01T00:00:00Z" format: date-time type: string value: description: The value of the variant as a string. example: "true" type: string required: - key - name - value type: object VariantResponseData: description: A variant resource. properties: attributes: $ref: "#/components/schemas/VariantResponseAttributes" id: description: The unique identifier of the variant. example: "550e8400-e29b-41d4-a716-446655440002" format: uuid type: string type: $ref: "#/components/schemas/VariantDataType" required: - id - type - attributes type: object VariantWeight: description: Variant weight details. properties: created_at: description: The timestamp when the variant weight was created. example: "2024-01-01T12:00:00Z" format: date-time type: string id: description: Unique identifier of the variant weight assignment. example: "59061199-e2ff-46e9-8b40-2193e3b21687" format: uuid type: string updated_at: description: The timestamp when the variant weight was last updated. example: "2024-01-01T12:00:00Z" format: date-time type: string value: description: The percentage weight for the variant. example: 50 format: double type: number variant: $ref: "#/components/schemas/Variant" variant_id: description: The variant ID. example: "550e8400-e29b-41d4-a716-446655440001" format: uuid type: string required: - variant_id - value type: object VariantWeightRequest: description: Variant weight request payload. properties: value: description: The percentage weight for this variant. example: 50 format: double type: number variant_id: description: The variant ID to assign weight to. example: "550e8400-e29b-41d4-a716-446655440001" format: uuid type: string variant_key: description: The variant key to assign weight to. example: "control" type: string required: - value type: object Version: description: Version of the notification rule. It is updated when the rule is modified. example: 1 format: int64 type: integer VersionHistoryUpdate: description: A change in a rule version. properties: change: description: The new value of the field. example: cloud_provider:aws type: string field: description: The field that was changed. example: Tags type: string type: $ref: "#/components/schemas/VersionHistoryUpdateType" type: object VersionHistoryUpdateType: description: The type of change. enum: - create - update - delete type: string x-enum-varnames: - CREATE - UPDATE - DELETE ViewershipHistorySessionArray: description: A list of RUM replay sessions from a user's viewership history. properties: data: description: Array of viewership history session data objects. items: $ref: "#/components/schemas/ViewershipHistorySessionData" type: array required: - data type: object ViewershipHistorySessionData: description: Data object representing a session in the viewership history, including its identifier, type, and attributes. properties: attributes: $ref: "#/components/schemas/ViewershipHistorySessionDataAttributes" id: description: Unique identifier of the RUM replay session. type: string type: $ref: "#/components/schemas/ViewershipHistorySessionDataType" required: - type type: object ViewershipHistorySessionDataAttributes: description: Attributes of a viewership history session entry, capturing when it was last watched and the associated event data. properties: event_id: description: Unique identifier of the RUM event associated with the watched session. type: string last_watched_at: description: Timestamp when the session was last watched by the user. example: "2026-01-13T17:15:53.208340Z" format: date-time type: string session_event: additionalProperties: {} description: Raw event data associated with the replay session. type: object track: description: Replay track identifier indicating which recording track the session belongs to. type: string required: - last_watched_at type: object ViewershipHistorySessionDataType: default: rum_replay_session description: Rum replay session resource type. enum: - rum_replay_session example: rum_replay_session type: string x-enum-varnames: - RUM_REPLAY_SESSION VirusTotalAPIKey: description: The definition of the `VirusTotalAPIKey` object. properties: api_key: $ref: "#/components/schemas/VirusTotalAPIKeyApiKey" type: $ref: "#/components/schemas/VirusTotalAPIKeyType" required: - type - api_key type: object VirusTotalAPIKeyApiKey: description: The `VirusTotalAPIKey` `api_key`. example: "" oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" VirusTotalAPIKeyType: description: The definition of the `VirusTotalAPIKey` object. enum: - VirusTotalAPIKey example: VirusTotalAPIKey type: string x-enum-varnames: - VIRUSTOTALAPIKEY VirusTotalAPIKeyUpdate: description: The definition of the `VirusTotalAPIKey` object. properties: api_key: $ref: "#/components/schemas/VirusTotalAPIKeyUpdateApiKey" type: $ref: "#/components/schemas/VirusTotalAPIKeyType" required: - type type: object VirusTotalAPIKeyUpdateApiKey: description: The `VirusTotalAPIKeyUpdate` `api_key`. oneOf: - $ref: "#/components/schemas/ActionConnectionLiteralValue" - $ref: "#/components/schemas/ActionConnectionAWSSecretsManagerReference" VirusTotalCredentials: description: The definition of the `VirusTotalCredentials` object. oneOf: - $ref: "#/components/schemas/VirusTotalAPIKey" VirusTotalCredentialsUpdate: description: The definition of the `VirusTotalCredentialsUpdate` object. oneOf: - $ref: "#/components/schemas/VirusTotalAPIKeyUpdate" VirusTotalIntegration: description: The definition of the `VirusTotalIntegration` object. properties: credentials: $ref: "#/components/schemas/VirusTotalCredentials" type: $ref: "#/components/schemas/VirusTotalIntegrationType" required: - type - credentials type: object VirusTotalIntegrationType: description: The definition of the `VirusTotalIntegrationType` object. enum: - VirusTotal example: VirusTotal type: string x-enum-varnames: - VIRUSTOTAL VirusTotalIntegrationUpdate: description: The definition of the `VirusTotalIntegrationUpdate` object. properties: credentials: $ref: "#/components/schemas/VirusTotalCredentialsUpdate" type: $ref: "#/components/schemas/VirusTotalIntegrationType" required: - type type: object VulnerabilitiesType: description: The JSON:API type. enum: - vulnerabilities example: vulnerabilities type: string x-enum-varnames: - VULNERABILITIES Vulnerability: description: A single vulnerability properties: attributes: $ref: "#/components/schemas/VulnerabilityAttributes" id: description: The unique ID for this vulnerability. example: 3ecdfea798f2ce8f6e964805a344945f type: string relationships: $ref: "#/components/schemas/VulnerabilityRelationships" type: $ref: "#/components/schemas/VulnerabilitiesType" required: - id - type - attributes - relationships type: object VulnerabilityAdvisory: description: Advisory associated with the vulnerability. properties: id: description: Vulnerability advisory ID. example: TRIVY-CVE-2023-0615 type: string last_modification_date: description: Vulnerability advisory last modification date. example: 2024-09-19 21:23:08+00:00 type: string publish_date: description: Vulnerability advisory publish date. example: 2024-09-19 21:23:08+00:00 type: string required: - id type: object VulnerabilityAttributes: description: The JSON:API attributes of the vulnerability. properties: advisory: $ref: "#/components/schemas/VulnerabilityAdvisory" advisory_id: description: Vulnerability advisory ID. example: TRIVY-CVE-2023-0615 type: string code_location: $ref: "#/components/schemas/CodeLocation" cve_list: description: Vulnerability CVE list. example: - CVE-2023-0615 items: description: A CVE identifier associated with the vulnerability. example: CVE-2023-0615 type: string type: array cvss: $ref: "#/components/schemas/VulnerabilityCvss" dependency_locations: $ref: "#/components/schemas/VulnerabilityDependencyLocations" description: description: Vulnerability description. example: "LDAP Injection is a security vulnerability that occurs when untrusted user input is improperly handled and directly incorporated into LDAP queries without appropriate sanitization or validation. This vulnerability enables attackers to manipulate LDAP queries and potentially gain unauthorized access, modify data, or extract sensitive information from the directory server. By exploiting the LDAP injection vulnerability, attackers can execute malicious commands, bypass authentication mechanisms, and perform unauthorized actions within the directory service." type: string ecosystem: $ref: "#/components/schemas/VulnerabilityEcosystem" exposure_time: description: Vulnerability exposure time in seconds. example: 5618604 format: int64 type: integer first_detection: description: "First detection of the vulnerability in [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339) format" example: 2024-09-19 21:23:08+00:00 type: string fix_available: description: Whether the vulnerability has a remediation or not. example: false type: boolean language: description: Vulnerability language. example: ubuntu type: string last_detection: description: "Last detection of the vulnerability in [RFC 3339](https://datatracker.ietf.org/doc/html/rfc3339) format" example: 2024-09-01 21:23:08+00:00 type: string library: $ref: "#/components/schemas/Library" origin: description: Vulnerability origin. example: - agentless-scanner items: description: The detection origin of the vulnerability (for example, the scanner type). example: agentless-scanner type: string type: array remediations: description: List of remediations. items: $ref: "#/components/schemas/Remediation" type: array repo_digests: description: Vulnerability `repo_digest` list (when the vulnerability is related to `Image` asset). items: description: A container image repository digest identifying the affected image. example: sha256:0ae7da091191787229d321e3638e39c319a97d6e20f927d465b519d699215bf7 type: string type: array risks: $ref: "#/components/schemas/VulnerabilityRisks" running_kernel: description: True if the vulnerability affects a package in the host’s running kernel, false if it affects a non-running kernel, and omit if it is not kernel-related. example: true type: boolean status: $ref: "#/components/schemas/VulnerabilityStatus" title: description: Vulnerability title. example: "LDAP Injection" type: string tool: $ref: "#/components/schemas/VulnerabilityTool" type: $ref: "#/components/schemas/VulnerabilityType" required: - type - cvss - status - tool - title - description - cve_list - risks - language - first_detection - last_detection - exposure_time - remediations - fix_available - origin type: object VulnerabilityCvss: description: Vulnerability severities. properties: base: $ref: "#/components/schemas/CVSS" datadog: $ref: "#/components/schemas/CVSS" required: - base - datadog type: object VulnerabilityDependencyLocations: description: Static library vulnerability location. properties: block: $ref: "#/components/schemas/DependencyLocation" name: $ref: "#/components/schemas/DependencyLocation" version: $ref: "#/components/schemas/DependencyLocation" required: - block type: object VulnerabilityEcosystem: description: The related vulnerability asset ecosystem. enum: - PyPI - Maven - NuGet - Npm - RubyGems - Go - Packagist - Deb - Rpm - Apk - Windows - Generic - MacOs - Oci - BottleRocket - None type: string x-enum-varnames: - PYPI - MAVEN - NUGET - NPM - RUBY_GEMS - GO - PACKAGIST - DEB - RPM - APK - WINDOWS - GENERIC - MAC_OS - OCI - BOTTLE_ROCKET - NONE VulnerabilityRelationships: description: Related entities object. properties: affects: $ref: "#/components/schemas/VulnerabilityRelationshipsAffects" required: - affects type: object VulnerabilityRelationshipsAffects: description: Relationship type. properties: data: $ref: "#/components/schemas/VulnerabilityRelationshipsAffectsData" required: - data type: object VulnerabilityRelationshipsAffectsData: description: Asset affected by this vulnerability. properties: id: description: The unique ID for this related asset. example: Repository|github.com/DataDog/datadog-agent.git type: string type: $ref: "#/components/schemas/AssetEntityType" required: - id - type type: object VulnerabilityRisks: description: Vulnerability risks. properties: epss: $ref: "#/components/schemas/EPSS" exploit_available: description: Vulnerability public exploit availability. example: false type: boolean exploit_sources: description: Vulnerability exploit sources. example: - NIST items: description: An exploit source reporting this vulnerability. example: NIST type: string type: array exploitation_probability: description: Vulnerability exploitation probability. example: false type: boolean poc_exploit_available: description: Vulnerability POC exploit availability. example: false type: boolean required: - exploitation_probability - poc_exploit_available - exploit_available - exploit_sources type: object VulnerabilitySeverity: description: The vulnerability severity. enum: - Unknown - None - Low - Medium - High - Critical example: Medium type: string x-enum-varnames: - UNKNOWN - NONE - LOW - MEDIUM - HIGH - CRITICAL VulnerabilityStatus: description: The vulnerability status. enum: - Open - Muted - Remediated - InProgress - AutoClosed example: Open type: string x-enum-varnames: - OPEN - MUTED - REMEDIATED - INPROGRESS - AUTOCLOSED VulnerabilityTool: description: The vulnerability tool. enum: - IAST - SCA - Infra - SAST example: SCA type: string x-enum-varnames: - IAST - SCA - INFRA - SAST VulnerabilityType: description: The vulnerability type. enum: - AdminConsoleActive - CodeInjection - CommandInjection - ComponentWithKnownVulnerability - DangerousWorkflows - DefaultAppDeployed - DefaultHtmlEscapeInvalid - DirectoryListingLeak - EmailHtmlInjection - EndOfLife - HardcodedPassword - HardcodedSecret - HeaderInjection - HstsHeaderMissing - InsecureAuthProtocol - InsecureCookie - InsecureJspLayout - LdapInjection - MaliciousPackage - MandatoryRemediation - NoHttpOnlyCookie - NoSameSiteCookie - NoSqlMongoDbInjection - PathTraversal - ReflectionInjection - RiskyLicense - SessionRewriting - SessionRewritting - SessionTimeout - SqlInjection - Ssrf - StackTraceLeak - TemplateInjection - TrustBoundaryViolation - Unmaintained - UntrustedDeserialization - UnvalidatedRedirect - VerbTampering - WeakCipher - WeakHash - WeakRandomness - XContentTypeHeaderMissing - XPathInjection - Xss example: WeakCipher type: string x-enum-varnames: - ADMIN_CONSOLE_ACTIVE - CODE_INJECTION - COMMAND_INJECTION - COMPONENT_WITH_KNOWN_VULNERABILITY - DANGEROUS_WORKFLOWS - DEFAULT_APP_DEPLOYED - DEFAULT_HTML_ESCAPE_INVALID - DIRECTORY_LISTING_LEAK - EMAIL_HTML_INJECTION - END_OF_LIFE - HARDCODED_PASSWORD - HARDCODED_SECRET - HEADER_INJECTION - HSTS_HEADER_MISSING - INSECURE_AUTH_PROTOCOL - INSECURE_COOKIE - INSECURE_JSP_LAYOUT - LDAP_INJECTION - MALICIOUS_PACKAGE - MANDATORY_REMEDIATION - NO_HTTP_ONLY_COOKIE - NO_SAME_SITE_COOKIE - NO_SQL_MONGO_DB_INJECTION - PATH_TRAVERSAL - REFLECTION_INJECTION - RISKY_LICENSE - SESSION_REWRITING - SESSION_REWRITTING - SESSION_TIMEOUT - SQL_INJECTION - SSRF - STACK_TRACE_LEAK - TEMPLATE_INJECTION - TRUST_BOUNDARY_VIOLATION - UNMAINTAINED - UNTRUSTED_DESERIALIZATION - UNVALIDATED_REDIRECT - VERB_TAMPERING - WEAK_CIPHER - WEAK_HASH - WEAK_RANDOMNESS - X_CONTENT_TYPE_HEADER_MISSING - X_PATH_INJECTION - XSS WASMSourcemapAttributes: description: Attributes of a WebAssembly symbol file. properties: build_id: description: The build identifier. example: wasm-build-123 type: string created_at: description: The timestamp when the symbol file was created. example: "2024-01-01T00:00:00Z" format: date-time type: string file_name: description: The file name of the symbol file. example: module.wasm type: string mapkind: $ref: "#/components/schemas/WASMSourcemapMapKind" size: description: The size of the symbol file in bytes. example: 4096 format: int64 type: integer required: - mapkind type: object WASMSourcemapData: description: WebAssembly symbol file data object. properties: attributes: $ref: "#/components/schemas/WASMSourcemapAttributes" id: description: The unique identifier of the source map. example: "9" type: string type: $ref: "#/components/schemas/SourcemapDataType" required: - id - type - attributes type: object WASMSourcemapMapKind: description: The type of source map. Always `wasm` for WebAssembly symbol files. enum: - wasm example: wasm type: string x-enum-varnames: - WASM Watch: description: A single RUM replay session watch resource returned by create operations. properties: data: $ref: "#/components/schemas/WatchData" required: - data type: object WatchData: description: Data object representing a session watch record, including its identifier, type, and attributes. properties: attributes: $ref: "#/components/schemas/WatchDataAttributes" id: description: Unique identifier of the watch record. type: string type: $ref: "#/components/schemas/WatchDataType" required: - type type: object WatchDataAttributes: description: Attributes for recording a session watch event, including the application, event reference, and timestamp. properties: application_id: description: Unique identifier of the RUM application containing the session. example: aaaaaaaa-1111-2222-3333-bbbbbbbbbbbb type: string data_source: description: Data source type indicating the origin of the session data (e.g., rum or product_analytics). type: string event_id: description: Unique identifier of the RUM event that was watched. example: 11111111-2222-3333-4444-555555555555 type: string timestamp: description: Timestamp when the session was watched. example: "2026-01-13T17:15:53.208340Z" format: date-time type: string required: - application_id - event_id - timestamp type: object WatchDataType: default: rum_replay_watch description: Rum replay watch resource type. enum: - rum_replay_watch example: rum_replay_watch type: string x-enum-varnames: - RUM_REPLAY_WATCH WatcherArray: description: A list of users who have watched a RUM replay session. properties: data: description: Array of watcher data objects. items: $ref: "#/components/schemas/WatcherData" type: array required: - data type: object WatcherData: description: Data object representing a session watcher, including their identifier, type, and attributes. properties: attributes: $ref: "#/components/schemas/WatcherDataAttributes" id: description: Unique identifier of the watcher user. type: string type: $ref: "#/components/schemas/WatcherDataType" required: - type type: object WatcherDataAttributes: description: Attributes of a user who has watched a RUM replay session, including contact information and watch statistics. properties: handle: description: Email handle of the user who watched the session. example: john.doe@example.com type: string icon: description: URL or identifier of the watcher's avatar icon. type: string last_watched_at: description: Timestamp when the watcher last viewed the session. example: "2026-01-13T17:15:53.208340Z" format: date-time type: string name: description: Display name of the user who watched the session. type: string watch_count: description: Total number of times the user has watched the session. example: 0 format: int32 maximum: 2147483647 type: integer required: - handle - last_watched_at - watch_count type: object WatcherDataType: default: rum_replay_watcher description: Rum replay watcher resource type. enum: - rum_replay_watcher example: rum_replay_watcher type: string x-enum-varnames: - RUM_REPLAY_WATCHER WebIntegrationAccountCreateRequest: description: Payload schema when adding a web integration account. properties: data: $ref: "#/components/schemas/WebIntegrationAccountCreateRequestData" required: - data type: object WebIntegrationAccountCreateRequestAttributes: description: Attributes object for creating a web integration account. properties: name: description: A human-readable name for the account. Must be unique among accounts of the same integration. example: my-databricks-account type: string secrets: $ref: "#/components/schemas/WebIntegrationAccountSecrets" settings: $ref: "#/components/schemas/WebIntegrationAccountSettings" required: - name - settings - secrets type: object WebIntegrationAccountCreateRequestData: description: Data object for creating a web integration account. properties: attributes: $ref: "#/components/schemas/WebIntegrationAccountCreateRequestAttributes" type: $ref: "#/components/schemas/WebIntegrationAccountType" required: - attributes - type type: object WebIntegrationAccountResponse: description: The expected response schema when getting a single web integration account. properties: data: $ref: "#/components/schemas/WebIntegrationAccountResponseData" type: object WebIntegrationAccountResponseAttributes: description: Attributes object of a web integration account. Secrets are never returned. properties: name: description: A human-readable name for the account. example: my-databricks-account type: string settings: $ref: "#/components/schemas/WebIntegrationAccountSettings" required: - name type: object WebIntegrationAccountResponseData: description: Data object of a web integration account. properties: attributes: $ref: "#/components/schemas/WebIntegrationAccountResponseAttributes" id: description: The unique identifier of the web integration account. example: "abc123def456" type: string type: $ref: "#/components/schemas/WebIntegrationAccountType" required: - attributes - id - type type: object WebIntegrationAccountSecrets: additionalProperties: {} description: |- Integration-specific secrets. The shape of this object varies by integration. Secrets are write-only and never returned by the API. example: client_secret: my-client-secret type: object WebIntegrationAccountSettings: additionalProperties: {} description: |- Integration-specific settings. The shape of this object varies by integration. example: workspace_url: https://example.azuredatabricks.net type: object WebIntegrationAccountType: default: Account description: Account resource type. enum: - Account example: Account type: string x-enum-varnames: - ACCOUNT WebIntegrationAccountUpdateRequest: description: Payload schema when updating a web integration account. properties: data: $ref: "#/components/schemas/WebIntegrationAccountUpdateRequestData" required: - data type: object WebIntegrationAccountUpdateRequestAttributes: description: Attributes object for updating a web integration account. properties: name: description: A human-readable name for the account. example: my-databricks-account type: string secrets: $ref: "#/components/schemas/WebIntegrationAccountSecrets" settings: $ref: "#/components/schemas/WebIntegrationAccountSettings" type: object WebIntegrationAccountUpdateRequestData: description: Data object for updating a web integration account. properties: attributes: $ref: "#/components/schemas/WebIntegrationAccountUpdateRequestAttributes" type: $ref: "#/components/schemas/WebIntegrationAccountType" required: - attributes - type type: object WebIntegrationAccountsResponse: description: The expected response schema when listing web integration accounts. properties: data: description: The JSON:API data array. items: $ref: "#/components/schemas/WebIntegrationAccountResponseData" type: array type: object WebhooksAuthMethodAttributes: description: Attributes of a webhooks auth method. properties: protocol: $ref: "#/components/schemas/WebhooksAuthMethodProtocol" type: object WebhooksAuthMethodProtocol: description: Authentication protocol used by the auth method. enum: - oauth2-client-credentials example: oauth2-client-credentials type: string x-enum-varnames: - OAUTH2_CLIENT_CREDENTIALS WebhooksAuthMethodRelationships: description: Relationships of a webhooks auth method to its protocol-specific resource. properties: oauth2-client-credentials: $ref: "#/components/schemas/WebhooksOAuth2ClientCredentialsRelationship" type: object WebhooksAuthMethodResponseData: description: Webhooks auth method data from a response. properties: attributes: $ref: "#/components/schemas/WebhooksAuthMethodAttributes" id: description: The ID of the auth method. example: "596da4af-0563-4097-90ff-07230c3f9db3" type: string relationships: $ref: "#/components/schemas/WebhooksAuthMethodRelationships" type: $ref: "#/components/schemas/WebhooksAuthMethodType" required: - id - type - attributes type: object WebhooksAuthMethodType: default: webhooks-auth-method description: Webhooks auth method resource type. enum: - webhooks-auth-method example: webhooks-auth-method type: string x-enum-varnames: - WEBHOOKS_AUTH_METHOD WebhooksAuthMethodsResponse: description: Response containing a list of webhooks auth methods. properties: data: description: An array of webhooks auth methods. items: $ref: "#/components/schemas/WebhooksAuthMethodResponseData" type: array included: description: Resources related to the auth methods, included when requested via the `include` query parameter. items: $ref: "#/components/schemas/WebhooksOAuth2ClientCredentialsResponseData" type: array required: - data type: object WebhooksOAuth2ClientCredentialsCreateAttributes: description: OAuth2 client credentials attributes for a create request. properties: access_token_url: description: URL of the OAuth2 access token endpoint. example: "https://example.com/oauth/token" maxLength: 2048 minLength: 1 type: string audience: description: The intended audience for the OAuth2 access token. example: "https://api.example.com" maxLength: 2048 minLength: 1 nullable: true type: string client_id: description: The OAuth2 client ID issued by the authorization server. example: "my-client-id" maxLength: 2048 minLength: 1 type: string client_secret: description: |- The OAuth2 client secret issued by the authorization server. Write-only; never returned by the API. example: "my-client-secret" maxLength: 2048 minLength: 1 type: string name: description: Human-readable name for this auth method. Must be unique within your organization. example: "my-oauth2-auth" maxLength: 100 minLength: 1 type: string scope: description: Space-separated list of OAuth2 scopes to request. example: "read:webhooks write:webhooks" maxLength: 2048 minLength: 1 nullable: true type: string required: - name - access_token_url - client_id - client_secret type: object WebhooksOAuth2ClientCredentialsCreateData: description: OAuth2 client credentials data for a create request. properties: attributes: $ref: "#/components/schemas/WebhooksOAuth2ClientCredentialsCreateAttributes" type: $ref: "#/components/schemas/WebhooksOAuth2ClientCredentialsType" required: - type - attributes type: object WebhooksOAuth2ClientCredentialsCreateRequest: description: Create request for an OAuth2 client credentials auth method. properties: data: $ref: "#/components/schemas/WebhooksOAuth2ClientCredentialsCreateData" required: - data type: object WebhooksOAuth2ClientCredentialsRelationship: description: Relationship pointing to the OAuth2 client credentials resource for this auth method. properties: data: $ref: "#/components/schemas/WebhooksOAuth2ClientCredentialsRelationshipData" type: object WebhooksOAuth2ClientCredentialsRelationshipData: description: Relationship data referencing an OAuth2 client credentials resource. properties: id: description: The ID of the OAuth2 client credentials resource. example: "596da4af-0563-4097-90ff-07230c3f9db3" type: string type: $ref: "#/components/schemas/WebhooksOAuth2ClientCredentialsType" type: object WebhooksOAuth2ClientCredentialsResponse: description: Response containing an OAuth2 client credentials auth method. properties: data: $ref: "#/components/schemas/WebhooksOAuth2ClientCredentialsResponseData" required: - data type: object WebhooksOAuth2ClientCredentialsResponseAttributes: description: OAuth2 client credentials attributes returned by the API. The `client_secret` is never echoed. properties: access_token_url: description: URL of the OAuth2 access token endpoint. example: "https://example.com/oauth/token" type: string audience: description: The intended audience for the OAuth2 access token. example: "https://api.example.com" nullable: true type: string client_id: description: The OAuth2 client ID issued by the authorization server. example: "my-client-id" type: string name: description: Human-readable name for this auth method. example: "my-oauth2-auth" type: string protocol: $ref: "#/components/schemas/WebhooksAuthMethodProtocol" scope: description: Space-separated list of OAuth2 scopes to request. example: "read:webhooks write:webhooks" nullable: true type: string type: object WebhooksOAuth2ClientCredentialsResponseData: description: OAuth2 client credentials data from a response. properties: attributes: $ref: "#/components/schemas/WebhooksOAuth2ClientCredentialsResponseAttributes" id: description: The ID of the OAuth2 client credentials auth method. example: "596da4af-0563-4097-90ff-07230c3f9db3" type: string type: $ref: "#/components/schemas/WebhooksOAuth2ClientCredentialsType" required: - id - type - attributes type: object WebhooksOAuth2ClientCredentialsType: default: webhooks-auth-method-oauth2-client-credentials description: OAuth2 client credentials resource type. enum: - webhooks-auth-method-oauth2-client-credentials example: webhooks-auth-method-oauth2-client-credentials type: string x-enum-varnames: - WEBHOOKS_AUTH_METHOD_OAUTH2_CLIENT_CREDENTIALS WebhooksOAuth2ClientCredentialsUpdateAttributes: description: OAuth2 client credentials attributes for an update request. properties: access_token_url: description: URL of the OAuth2 access token endpoint. example: "https://example.com/oauth/token" maxLength: 2048 minLength: 1 type: string audience: description: The intended audience for the OAuth2 access token. example: "https://api.example.com" maxLength: 2048 minLength: 1 nullable: true type: string client_id: description: The OAuth2 client ID issued by the authorization server. example: "my-client-id" maxLength: 2048 minLength: 1 type: string client_secret: description: |- The OAuth2 client secret issued by the authorization server. Write-only; never returned by the API. example: "my-client-secret" maxLength: 2048 minLength: 1 type: string name: description: Human-readable name for this auth method. example: "my-oauth2-auth" maxLength: 100 minLength: 1 type: string scope: description: Space-separated list of OAuth2 scopes to request. example: "read:webhooks write:webhooks" maxLength: 2048 minLength: 1 nullable: true type: string type: object WebhooksOAuth2ClientCredentialsUpdateData: description: OAuth2 client credentials data for an update request. properties: attributes: $ref: "#/components/schemas/WebhooksOAuth2ClientCredentialsUpdateAttributes" type: $ref: "#/components/schemas/WebhooksOAuth2ClientCredentialsType" required: - type - attributes type: object WebhooksOAuth2ClientCredentialsUpdateRequest: description: Update request for an OAuth2 client credentials auth method. properties: data: $ref: "#/components/schemas/WebhooksOAuth2ClientCredentialsUpdateData" required: - data type: object Weekday: description: A day of the week. enum: - monday - tuesday - wednesday - thursday - friday - saturday - sunday type: string x-enum-varnames: - MONDAY - TUESDAY - WEDNESDAY - THURSDAY - FRIDAY - SATURDAY - SUNDAY WidgetAnnotationIds: description: List of annotation IDs displayed on a widget. example: - "00000000-0000-0000-0000-000000000000" items: description: Annotation ID. format: uuid type: string type: array WidgetAnnotationsMap: additionalProperties: $ref: "#/components/schemas/WidgetAnnotationIds" description: Map from widget ID to the list of annotation IDs displayed on that widget. example: "1234567890": - "00000000-0000-0000-0000-000000000000" type: object WidgetAttributes: description: Attributes of a widget resource. properties: created_at: description: ISO 8601 timestamp of when the widget was created. example: "2024-01-15T00:00:00.000Z" type: string definition: $ref: "#/components/schemas/WidgetDefinition" is_favorited: description: |- Whether the current user has favorited this widget. Populated on get, batch_get, update, and search responses; create responses always return `false` because a widget can only be favorited after it exists. Favoriting itself is performed through the shared favorites API, not this service. example: false type: boolean modified_at: description: ISO 8601 timestamp of when the widget was last modified. example: "2024-01-15T00:00:00.000Z" type: string tags: description: User-defined tags for organizing widgets. example: - "team:my-team" items: description: A single user-defined tag. type: string nullable: true type: array required: - definition - tags - is_favorited - created_at - modified_at type: object WidgetData: description: A widget resource object. properties: attributes: $ref: "#/components/schemas/WidgetAttributes" id: description: The unique identifier of the widget. example: "a1b2c3d4-e5f6-7890-abcd-ef1234567890" type: string relationships: $ref: "#/components/schemas/WidgetRelationships" type: description: Widgets resource type. example: widgets type: string required: - id - type - attributes type: object WidgetDefinition: additionalProperties: {} description: The definition of a widget, including its type and configuration. properties: title: description: The display title of the widget. example: My Widget maxLength: 100 minLength: 1 type: string type: $ref: "#/components/schemas/WidgetType" required: - type - title type: object WidgetExperienceType: description: Widget experience types that differentiate between the products using the specific widget. enum: - ccm_reports - logs_reports - csv_reports - product_analytics example: ccm_reports type: string x-enum-varnames: - CCM_REPORTS - LOGS_REPORTS - CSV_REPORTS - PRODUCT_ANALYTICS WidgetIncludedUser: description: A user resource included in the response. properties: attributes: $ref: "#/components/schemas/WidgetIncludedUserAttributes" id: description: The unique identifier of the user. example: "a1b2c3d4-e5f6-7890-abcd-ef1234567890" type: string type: description: Users resource type. example: users type: string required: - id - type type: object WidgetIncludedUserAttributes: description: Attributes of an included user resource. properties: handle: description: The email handle of the user. example: "john.doe@example.com" type: string name: description: The display name of the user. example: "John Doe" nullable: true type: string type: object WidgetListResponse: description: Response containing a list of widgets. properties: data: description: List of widget resources. items: $ref: "#/components/schemas/WidgetData" type: array included: description: Array of user resources related to the widgets. items: $ref: "#/components/schemas/WidgetIncludedUser" type: array meta: $ref: "#/components/schemas/WidgetSearchMeta" required: - data type: object WidgetLiveSpan: description: The available timeframes depend on the widget you are using. enum: - 1m - 5m - 10m - 15m - 30m - 1h - 4h - 1d - 2d - 1w - 1mo - 3mo - 6mo - 1y - alert example: 5m type: string x-enum-varnames: - PAST_ONE_MINUTE - PAST_FIVE_MINUTES - PAST_TEN_MINUTES - PAST_FIFTEEN_MINUTES - PAST_THIRTY_MINUTES - PAST_ONE_HOUR - PAST_FOUR_HOURS - PAST_ONE_DAY - PAST_TWO_DAYS - PAST_ONE_WEEK - PAST_ONE_MONTH - PAST_THREE_MONTHS - PAST_SIX_MONTHS - PAST_ONE_YEAR - ALERT WidgetRelationshipData: description: Relationship data referencing a user resource. properties: id: description: The unique identifier of the user. example: "a1b2c3d4-e5f6-7890-abcd-ef1234567890" type: string type: description: Users resource type. example: users type: string required: - id - type type: object WidgetRelationshipItem: description: A JSON:API relationship to a user. properties: data: $ref: "#/components/schemas/WidgetRelationshipData" type: object WidgetRelationships: description: Relationships of the widget resource. properties: created_by: $ref: "#/components/schemas/WidgetRelationshipItem" description: The user who created the widget. modified_by: $ref: "#/components/schemas/WidgetRelationshipItem" description: The user who last modified the widget. type: object WidgetResponse: description: Response containing a single widget. properties: data: $ref: "#/components/schemas/WidgetData" included: description: Array of user resources related to the widget. items: $ref: "#/components/schemas/WidgetIncludedUser" type: array required: - data type: object WidgetSearchMeta: description: Metadata about the search results. properties: created_by_anyone_total: description: Total number of widgets created by anyone. format: int64 type: integer created_by_you_total: description: Total number of widgets created by the current user. format: int64 type: integer favorited_by_you_total: description: Total number of widgets favorited by the current user. format: int64 type: integer filtered_total: description: Total number of widgets matching the current filter criteria. format: int64 type: integer type: object WidgetType: description: |- Widget types that are allowed to be stored as individual records. This is not a complete list of dashboard and notebook widget types. enum: - bar_chart - change - cloud_cost_summary - cohort - funnel - geomap - list_stream - query_table - query_value - retention_curve - sankey - sunburst - timeseries - toplist - treemap example: bar_chart type: string x-enum-varnames: - BAR_CHART - CHANGE - CLOUD_COST_SUMMARY - COHORT - FUNNEL - GEOMAP - LIST_STREAM - QUERY_TABLE - QUERY_VALUE - RETENTION_CURVE - SANKEY - SUNBURST - TIMESERIES - TOPLIST - TREEMAP WorkflowData: description: Data related to the workflow. properties: attributes: $ref: "#/components/schemas/WorkflowDataAttributes" id: description: The workflow identifier readOnly: true type: string relationships: $ref: "#/components/schemas/WorkflowDataRelationships" type: $ref: "#/components/schemas/WorkflowDataType" required: - type - attributes type: object WorkflowDataAttributes: description: The definition of `WorkflowDataAttributes` object. properties: createdAt: description: When the workflow was created. format: date-time readOnly: true type: string description: description: Description of the workflow. type: string name: description: Name of the workflow. example: "" type: string published: description: Set the workflow to published or unpublished. Workflows in an unpublished state will only be executable via manual runs. Automatic triggers such as Schedule will not execute the workflow until it is published. type: boolean runAs: $ref: "#/components/schemas/WorkflowRunAs" writeOnly: true runAsUserMode: $ref: "#/components/schemas/WorkflowRunAsUserMode" readOnly: true sensitivePrivileges: description: Whether the workflow requires sensitive privileges to run. Only the workflow owner can update this field. This allows it to run actions that use [Execution Policies](https://docs.datadoghq.com/actions/private_actions/execution_policies/). type: boolean spec: $ref: "#/components/schemas/Spec" tags: description: Tags of the workflow. items: description: A tag string in `key:value` format. type: string type: array updatedAt: description: When the workflow was last updated. format: date-time readOnly: true type: string webhookSecret: description: If a Webhook trigger is defined on this workflow, a webhookSecret is required and should be provided here. type: string writeOnly: true required: - name - spec type: object WorkflowDataRelationships: description: The definition of `WorkflowDataRelationships` object. properties: creator: $ref: "#/components/schemas/WorkflowUserRelationship" owner: $ref: "#/components/schemas/WorkflowUserRelationship" runAs: $ref: "#/components/schemas/WorkflowUserRelationship" description: The service account used to run the workflow. Present when `runAsUserMode` is `service_account`. readOnly: true type: object WorkflowDataType: description: The definition of `WorkflowDataType` object. enum: - workflows example: workflows type: string x-enum-varnames: - WORKFLOWS WorkflowDataUpdate: description: Data related to the workflow being updated. properties: attributes: $ref: "#/components/schemas/WorkflowDataUpdateAttributes" id: description: The workflow identifier type: string relationships: $ref: "#/components/schemas/WorkflowDataRelationships" type: $ref: "#/components/schemas/WorkflowDataType" required: - type - attributes type: object WorkflowDataUpdateAttributes: description: The definition of `WorkflowDataUpdateAttributes` object. properties: createdAt: description: When the workflow was created. format: date-time readOnly: true type: string description: description: Description of the workflow. type: string name: description: Name of the workflow. type: string published: description: Set the workflow to published or unpublished. Workflows in an unpublished state will only be executable via manual runs. Automatic triggers such as Schedule will not execute the workflow until it is published. type: boolean runAs: $ref: "#/components/schemas/WorkflowRunAs" writeOnly: true runAsUserMode: $ref: "#/components/schemas/WorkflowRunAsUserMode" readOnly: true sensitivePrivileges: description: Whether the workflow requires sensitive privileges to run. Only the workflow owner can update this field. This allows it to run actions that use [Execution Policies](https://docs.datadoghq.com/actions/private_actions/execution_policies/). type: boolean spec: $ref: "#/components/schemas/Spec" tags: description: Tags of the workflow. items: description: A tag string in `key:value` format. type: string type: array updatedAt: description: When the workflow was last updated. format: date-time readOnly: true type: string webhookSecret: description: If a Webhook trigger is defined on this workflow, a webhookSecret is required and should be provided here. type: string writeOnly: true type: object WorkflowInstanceCreateMeta: description: Additional information for creating a workflow instance. properties: payload: additionalProperties: {} description: The input parameters to the workflow. type: object type: object WorkflowInstanceCreateRequest: description: Request used to create a workflow instance. properties: meta: $ref: "#/components/schemas/WorkflowInstanceCreateMeta" type: object WorkflowInstanceCreateResponse: additionalProperties: {} description: Response returned upon successful workflow instance creation. properties: data: $ref: "#/components/schemas/WorkflowInstanceCreateResponseData" type: object WorkflowInstanceCreateResponseData: additionalProperties: {} description: Data about the created workflow instance. properties: id: description: The ID of the workflow execution. It can be used to fetch the execution status. type: string type: object WorkflowInstanceListItem: additionalProperties: {} description: An item in the workflow instances list. properties: id: description: The ID of the workflow instance type: string type: object WorkflowListInstancesResponse: additionalProperties: {} description: Response returned when listing workflow instances. properties: data: description: A list of workflow instances. items: $ref: "#/components/schemas/WorkflowInstanceListItem" type: array meta: $ref: "#/components/schemas/WorkflowListInstancesResponseMeta" type: object WorkflowListInstancesResponseMeta: additionalProperties: {} description: Metadata about the instances list properties: page: $ref: "#/components/schemas/WorkflowListInstancesResponseMetaPage" type: object WorkflowListInstancesResponseMetaPage: additionalProperties: {} description: Page information for the list instances response. properties: totalCount: description: The total count of items. format: int64 type: integer type: object WorkflowListItem: description: A workflow returned by the list workflows endpoint. properties: attributes: $ref: "#/components/schemas/WorkflowListItemAttributes" id: description: The workflow identifier. readOnly: true type: string relationships: $ref: "#/components/schemas/WorkflowDataRelationships" type: $ref: "#/components/schemas/WorkflowDataType" required: - type - attributes type: object WorkflowListItemAttributes: description: Attributes of a workflow returned in a list response. properties: createdAt: description: When the workflow was created. format: date-time readOnly: true type: string description: description: Description of the workflow. type: string name: description: Name of the workflow. example: "My Workflow" type: string published: description: Whether the workflow is published. Unpublished workflows can only be run manually. Automatic triggers such as Schedule do not fire until the workflow is published. type: boolean runAsUserMode: $ref: "#/components/schemas/WorkflowRunAsUserMode" readOnly: true sensitivePrivileges: description: Whether the workflow requires sensitive privileges to run. Only the workflow owner can update this field. This allows it to run actions that use [Execution Policies](https://docs.datadoghq.com/actions/private_actions/execution_policies/). type: boolean spec: $ref: "#/components/schemas/Spec" nullable: true tags: description: Tags of the workflow. items: description: A tag string in `key:value` format. type: string type: array updatedAt: description: When the workflow was last updated. format: date-time readOnly: true type: string required: - name type: object WorkflowRunAs: description: Identity used to run the workflow. example: type: owner oneOf: - $ref: "#/components/schemas/WorkflowRunAsOwner" - $ref: "#/components/schemas/WorkflowRunAsServiceAccount" - $ref: "#/components/schemas/WorkflowRunAsInitiator" WorkflowRunAsInitiator: additionalProperties: false description: Run the workflow as the user who initiates the execution. properties: type: $ref: "#/components/schemas/WorkflowRunAsInitiatorType" required: - type type: object WorkflowRunAsInitiatorType: description: The initiator run-as type. enum: - initiator example: initiator type: string x-enum-varnames: - INITIATOR WorkflowRunAsOwner: additionalProperties: false description: Run the workflow as its owner. properties: type: $ref: "#/components/schemas/WorkflowRunAsOwnerType" required: - type type: object WorkflowRunAsOwnerType: description: The owner run-as type. enum: - owner example: owner type: string x-enum-varnames: - OWNER WorkflowRunAsServiceAccount: additionalProperties: false description: Run the workflow as a service account. properties: id: description: The service account identifier. example: 00000000-0000-0000-0000-000000000007 type: string type: $ref: "#/components/schemas/WorkflowRunAsServiceAccountType" required: - type - id type: object WorkflowRunAsServiceAccountType: description: The service account run-as type. enum: - service_account example: service_account type: string x-enum-varnames: - SERVICE_ACCOUNT WorkflowRunAsUserMode: description: The effective type of identity used to run the workflow. enum: - owner - service_account - initiator example: owner type: string x-enum-varnames: - OWNER - SERVICE_ACCOUNT - INITIATOR WorkflowTriggerWrapper: description: "Schema for a Workflow-based trigger." properties: startStepNames: $ref: "#/components/schemas/StartStepNames" workflowTrigger: description: "Trigger a workflow from the Datadog UI. When present, this must be the workflow's only trigger." type: object required: - workflowTrigger type: object WorkflowUserRelationship: description: The definition of `WorkflowUserRelationship` object. properties: data: $ref: "#/components/schemas/WorkflowUserRelationshipData" type: object WorkflowUserRelationshipData: description: The definition of `WorkflowUserRelationshipData` object. properties: id: description: The user identifier example: "" type: string type: $ref: "#/components/schemas/WorkflowUserRelationshipType" required: - type - id type: object WorkflowUserRelationshipType: description: The definition of `WorkflowUserRelationshipType` object. enum: - users example: users type: string x-enum-varnames: - USERS WorklflowCancelInstanceResponse: description: Information about the canceled instance. properties: data: $ref: "#/components/schemas/WorklflowCancelInstanceResponseData" type: object WorklflowCancelInstanceResponseData: description: Data about the canceled instance. properties: id: description: The id of the canceled instance type: string type: object WorklflowGetInstanceResponse: additionalProperties: {} description: The state of the given workflow instance. properties: data: $ref: "#/components/schemas/WorklflowGetInstanceResponseData" type: object WorklflowGetInstanceResponseData: additionalProperties: {} description: The data of the instance response. properties: attributes: $ref: "#/components/schemas/WorklflowGetInstanceResponseDataAttributes" type: object WorklflowGetInstanceResponseDataAttributes: additionalProperties: {} description: The attributes of the instance response data. properties: id: description: The id of the instance. type: string type: object XRayServicesIncludeAll: description: Include all services. properties: include_all: description: Include all services. example: false type: boolean required: - include_all type: object XRayServicesIncludeOnly: description: Include only these services. Defaults to `[]`. nullable: true properties: include_only: description: Include only these services. example: - "AWS/AppSync" items: description: An AWS X-Ray service name to include in traces collection. example: "AWS/AppSync" type: string type: array required: - include_only type: object XRayServicesList: description: AWS X-Ray services to collect traces from. Defaults to `include_only`. oneOf: - $ref: "#/components/schemas/XRayServicesIncludeAll" - $ref: "#/components/schemas/XRayServicesIncludeOnly" ZoomConfigurationReference: description: A reference to a Zoom configuration resource. nullable: true properties: data: $ref: "#/components/schemas/ZoomConfigurationReferenceData" required: - data type: object ZoomConfigurationReferenceData: description: The Zoom configuration relationship data object. nullable: true properties: id: description: The unique identifier of the Zoom configuration. example: "00000000-0000-0000-0000-000000000000" type: string type: description: The type of the Zoom configuration. example: "zoom_configurations" type: string required: - id - type type: object securitySchemes: AuthZ: description: This API uses OAuth 2 with the implicit grant flow. flows: authorizationCode: authorizationUrl: /oauth2/v1/authorize scopes: agent_builder_run: Run agents created with Agent Builder. ai_gateway_config_read: View AI Gateway configuration. ai_gateway_config_write: Create, update, and delete AI Gateway configuration. ai_gateway_usage: Use AI Gateway and view configuration applicable to the authenticated user. ai_guard_evaluate: Evaluate conversations for security threats with AI Guard. apm_api_catalog_read: View API catalog and API definitions. apm_api_catalog_write: Add, modify, and delete API catalog definitions. apm_read: Read and query APM and Trace Analytics. apm_service_catalog_read: View service catalog and service definitions. apm_service_catalog_write: >- Add, modify, and delete service catalog definitions when those definitions are maintained by Datadog. appsec_vm_read: View infrastructure, application code, and library vulnerability findings. assistant_access: Access Bits Chat. aws_configurations_manage: Manage AWS integration account configurations and related integration settings. billing_edit: Edit your organization's billing information. billing_read: View your organization's billing information. bits_dev_write: Create and interact with Bits Code sessions. bits_investigations_read: View Bits AI investigations. bits_investigations_write: Create and manage Bits AI investigations. bits_security_analyst_write: Create and manage Bits AI Security Analyst investigations. cases_read: View Cases. cases_shared_settings_write: Update shared case management settings. cases_write: Create and update cases. ci_visibility_pipelines_write: Create CI Visibility pipeline spans using the API. ci_visibility_read: View CI Visibility. cloud_cost_management_read: >- View Cloud Cost pages and the cloud cost data source in dashboards and notebooks. For more details, see the Cloud Cost Management docs. cloud_cost_management_write: >- Configure cloud cost accounts and global customizations. For more details, see the Cloud Cost Management docs. code_analysis_read: View Code Analysis. code_coverage_read: View Code Coverage. continuous_profiler_pgo_read: Read and query Continuous Profiler data for Profile-Guided Optimization (PGO). coterm_read: Read terminal recordings. coterm_write: Write terminal recordings. create_webhooks: Create webhooks integrations. dashboards_embed_share: Create, modify, and delete shared dashboards with share type 'embed'. dashboards_invite_share: Create, modify, and delete shared dashboards with share type 'invite'. dashboards_public_share: >- Generate public and authenticated links to share dashboards or embeddable graphs externally. dashboards_read: View dashboards. dashboards_write: Create and change dashboards. data_scanner_read: View Data Scanner configurations. data_scanner_write: Edit Data Scanner configurations. embeddable_graphs_share: Generate public links to share embeddable graphs externally. error_tracking_read: Read Error Tracking data. error_tracking_write: Edit Error Tracking issues. event_correlation_config_read: View event correlation configurations. event_correlation_config_write: Create and update event correlation configurations. events_read: Read Events data. feature_flag_approvals_override: Override Feature Flag Approvals. feature_flag_config_read: View Feature Flag Configurations. feature_flag_config_write: Edit Feature Flag Configurations. feature_flag_environment_config_read: View Feature Flag Environment settings. feature_flag_environment_config_write: Modify Feature Flag Environment settings. hosts_read: List hosts and their attributes. incident_notification_settings_read: View Incident Notification Rule Settings. incident_notification_settings_write: Configure Incidents Notification Rule settings. incident_read: View incidents in Datadog. incident_settings_read: View Incident Settings. incident_settings_write: Configure Incident Settings. incident_write: Create, view, and manage incidents in Datadog. integrations_read: View configured integrations and their settings. logs_modify_indexes: Modify log indexes, filters, exclusion filters, and configurations. logs_read_data: Read log data. logs_read_index_data: Read indexed log data. manage_integrations: Install, uninstall, and configure integrations. metrics_read: View custom metrics. monitors_downtime: >- Set downtimes to suppress alerts from any monitor in an organization. Mute and unmute monitors. The ability to write monitors is not required to set downtimes. monitors_read: View monitors. monitors_write: Edit, delete, and resolve individual monitors. network_connections_read: Read cloud network connections. org_connections_read: Read cross organization connections. org_connections_write: Create, edit, and delete cross organization connections. org_management: >- Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization. product_analytics_experiments_read: View Product Analytics Experiments. product_analytics_experiments_write: Create, edit, and delete Product Analytics Experiments. product_analytics_metrics_read: View Product Analytics Metrics. product_analytics_metrics_write: Create, edit, and delete Product Analytics Metrics. product_analytics_settings_read: View Product Analytics Settings. product_analytics_settings_write: Edit Product Analytics Settings. product_analytics_warehouse_model_write: Create, edit, and delete Product Analytics Warehouse Models. repo_info_read: View data from Git repositories. security_comments_read: Read comments of vulnerabilities. security_monitoring_critical_assets_read: Read Critical Assets. security_monitoring_critical_assets_write: Write Critical Assets. security_monitoring_filters_read: Read Security Filters. security_monitoring_filters_write: Create, edit, and delete Security Filters. security_monitoring_findings_read: >- View a list of findings that include both misconfigurations and identity risks. security_monitoring_rules_read: Read Detection Rules. security_monitoring_rules_write: Create and edit Detection Rules. security_monitoring_signals_read: View Security Signals. security_monitoring_suppressions_read: Read Rule Suppressions. security_monitoring_suppressions_write: Write Rule Suppressions. security_pipelines_read: View Security Pipelines. security_pipelines_write: Create, edit, and delete CSM Security Pipelines. siem_entities_read: View Cloud SIEM entities. slos_corrections: >- Apply, edit, and delete SLO status corrections. A user with this permission can make status corrections, even if they do not have permission to edit those SLOs. slos_read: View SLOs and status corrections. slos_write: Create, edit, and delete SLOs. synthetics_global_variable_read: View, search, and use Synthetics global variables. synthetics_global_variable_write: Create, edit, and delete global variables for Synthetics. synthetics_private_location_read: View, search, and use Synthetics private locations. synthetics_private_location_write: >- Create and delete private locations in addition to having access to the associated installation guidelines. synthetics_read: List and view configured Synthetic tests and test results. synthetics_write: Create, edit, and delete Synthetic tests. teams_manage: >- Manage Teams. Create, delete, rename, and edit metadata of all Teams. To control Team membership across all Teams, use the User Access Manage permission. teams_read: >- Read Teams data. A User with this permission can view Team names, metadata, and which Users are on each Team. test_optimization_read: View Test Optimization. test_optimization_settings_write: Update service settings in Test Optimization. test_optimization_write: Update flaky tests from Flaky Tests Management of Test Optimization. timeseries_query: Query Timeseries data. usage_read: View your organization's usage and usage attribution. user_access_invite: Invite other users to your organization. user_access_manage: >- Disable users, manage user roles, manage SAML-to-role mappings, and configure logs restriction queries. user_access_read: View users and their roles and settings. workflows_read: View workflows. workflows_run: Run workflows. workflows_write: Create, edit, and delete workflows. workload_identity_federation_read: View workload identity federation providers and mappings. workload_identity_federation_write: Create, update, and delete workload identity federation providers and mappings. tokenUrl: /oauth2/v1/token type: oauth2 x-env-name: DD_BEARER_TOKEN apiKeyAuth: description: Your Datadog API Key. in: header name: DD-API-KEY type: apiKey x-env-name: DD_API_KEY appKeyAuth: description: Your Datadog APP Key. in: header name: DD-APPLICATION-KEY type: apiKey x-env-name: DD_APP_KEY bearerAuth: scheme: bearer type: http x-env-name: DD_BEARER_TOKEN info: contact: email: support@datadoghq.com name: Datadog Support url: https://www.datadoghq.com/support/ description: Collection of all Datadog Public endpoints. title: Datadog API V2 Collection version: "1.0" openapi: 3.0.0 paths: /api/unstable/fleet/agents/{agent_key}/tracers: get: description: |- Retrieve a paginated list of tracers for a specific agent. This endpoint returns tracers associated with a given agent key, identified by the agent's hostname. Use this to discover telemetry-derived service names for a particular host. operationId: ListFleetAgentTracers parameters: - description: The unique identifier (agent key) for the Datadog Agent. in: path name: agent_key required: true schema: type: string - description: Page number for pagination (starts at 0). in: query name: page_number required: false schema: default: 0 format: int64 minimum: 0 type: integer - description: Number of results per page (must be greater than 0 and less than or equal to 100). in: query name: page_size required: false schema: default: 10 format: int64 maximum: 100 minimum: 1 type: integer - description: Attribute to sort by. in: query name: sort_attribute required: false schema: type: string - description: Sort order (true for descending, false for ascending). in: query name: sort_descending required: false schema: default: true type: boolean responses: "200": content: application/json: examples: default: value: data: attributes: tracers: - env: production hostname: my-hostname language: java service: test-service tracer_version: "1.32.0" id: done type: status meta: total_filtered_count: 1 schema: $ref: "#/components/schemas/FleetTracersResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List tracers for a specific agent tags: - Fleet Automation "x-permission": operator: AND permissions: - hosts_read x-unstable: |- This endpoint is in Preview and may introduce breaking changes. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/unstable/fleet/schedules: post: description: |- Create a new schedule for automated package upgrades. Schedules define when and how often to automatically deploy package upgrades to a fleet of hosts. Each schedule includes: - A filter query to select target hosts - A recurrence rule defining maintenance windows - A version strategy (e.g., always latest, or N versions behind latest) When the schedule triggers during a maintenance window, it automatically creates a deployment that upgrades the Datadog Agent to the specified version on all matching hosts. operationId: CreateFleetSchedule requestBody: content: application/json: examples: conservative_staging: summary: Conservative staging updates (N-1 version) value: data: attributes: name: "Staging Environment - Conservative Updates" query: "env:staging" rule: days_of_week: ["Fri"] maintenance_window_duration: 240 start_maintenance_window: "22:00" timezone: "UTC" status: "active" version_to_latest: 1 type: schedule default: value: data: attributes: name: Weekly Production Agent Updates query: env:prod rule: days_of_week: - Mon - Wed maintenance_window_duration: 180 start_maintenance_window: 02:00 timezone: America/New_York status: active version_to_latest: 0 type: schedule weekly_production_update: summary: Weekly production agent updates value: data: attributes: name: "Weekly Production Agent Updates" query: "env:prod" rule: days_of_week: ["Mon", "Wed"] maintenance_window_duration: 180 start_maintenance_window: "02:00" timezone: "America/New_York" status: "active" version_to_latest: 0 type: schedule schema: $ref: "#/components/schemas/FleetScheduleCreateRequest" description: Request payload containing the schedule details. required: true responses: "201": content: application/json: examples: default: value: data: attributes: name: Weekly Production Agent Updates query: env:prod rule: days_of_week: - Mon - Wed maintenance_window_duration: 180 start_maintenance_window: "02:00" timezone: America/New_York status: active version_to_latest: 0 id: abc-123 type: schedule schema: $ref: "#/components/schemas/FleetScheduleResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create a schedule tags: - Fleet Automation "x-permission": operator: AND permissions: - agent_upgrade_write x-unstable: |- This endpoint is in Preview and may introduce breaking changes. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/unstable/fleet/schedules/{id}: delete: description: |- Delete a schedule permanently. When you delete a schedule: - The schedule is permanently removed and will no longer create deployments - Any deployments already created by this schedule are not affected - This action cannot be undone If you want to temporarily stop a schedule from creating deployments, consider updating its status to "inactive" instead of deleting it. operationId: DeleteFleetSchedule parameters: - description: The unique identifier of the schedule to delete. example: "abc-def-ghi-123" in: path name: id required: true schema: type: string responses: "204": description: Schedule successfully deleted. "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete a schedule tags: - Fleet Automation "x-permission": operator: AND permissions: - agent_upgrade_write x-unstable: |- This endpoint is in Preview and may introduce breaking changes. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: |- Partially update a schedule by providing only the fields you want to change. This endpoint allows you to modify specific attributes of a schedule without affecting other fields. Common use cases include: - Changing the schedule status between active and inactive - Updating the maintenance window times - Modifying the filter query to target different hosts - Adjusting the version strategy Only include the fields you want to update in the request body. All fields are optional in a PATCH request. operationId: UpdateFleetSchedule parameters: - description: The unique identifier of the schedule to update. example: "abc-def-ghi-123" in: path name: id required: true schema: type: string requestBody: content: application/json: examples: change_maintenance_window: summary: Change maintenance window time value: data: attributes: rule: days_of_week: ["Mon", "Wed", "Fri"] maintenance_window_duration: 240 start_maintenance_window: "03:00" timezone: "America/New_York" type: schedule default: value: data: attributes: status: inactive type: schedule pause_schedule: summary: Pause a schedule value: data: attributes: status: "inactive" type: schedule update_query: summary: Update target hosts query value: data: attributes: query: "env:prod AND service:api" type: schedule schema: $ref: "#/components/schemas/FleetSchedulePatchRequest" description: Request payload containing the fields to update. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at_unix: 1699999999 created_by: test@example.com name: Weekly Production Agent Updates query: env:prod AND service:web rule: days_of_week: - Mon - Wed maintenance_window_duration: 120 start_maintenance_window: "02:00" timezone: America/New_York status: inactive updated_at_unix: 1699999999 updated_by: test@example.com version_to_latest: 0 id: abc-def-ghi-123 type: schedule schema: $ref: "#/components/schemas/FleetScheduleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update a schedule tags: - Fleet Automation "x-permission": operator: AND permissions: - agent_upgrade_write x-unstable: |- This endpoint is in Preview and may introduce breaking changes. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/unstable/fleet/schedules/{id}/trigger: post: description: |- Manually trigger a schedule to immediately create and start a deployment. This endpoint allows you to manually initiate a deployment using the schedule's configuration, without waiting for the next scheduled maintenance window. This is useful for: - Testing a schedule before it runs automatically - Performing an emergency update outside the regular maintenance window - Creating an ad-hoc deployment with the same settings as a schedule The deployment is created immediately with: - The same filter query as the schedule - The package version determined by the schedule's version strategy - All matching hosts as targets The manually triggered deployment is independent of the schedule and does not affect the schedule's normal recurrence pattern. operationId: TriggerFleetSchedule parameters: - description: The unique identifier of the schedule to trigger. example: "abc-def-ghi-123" in: path name: id required: true schema: type: string responses: "201": content: application/json: examples: default: value: data: attributes: filter_query: env:prod AND service:web high_level_status: pending packages: - name: datadog-agent version: 7.52.0 total_hosts: 10 id: abc-123 type: deployment schema: $ref: "#/components/schemas/FleetDeploymentResponse" description: CREATED - Deployment successfully created and started. "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Trigger a schedule deployment tags: - Fleet Automation "x-permission": operator: AND permissions: - agent_upgrade_write x-unstable: |- This endpoint is in Preview and may introduce breaking changes. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/unstable/fleet/tracers: get: description: |- Retrieve a paginated list of all fleet tracers. This endpoint returns telemetry-derived service names from the SDK telemetry pipeline. These names may differ from span-derived names in APM and are useful for querying service library configurations. Use the `page_number` and `page_size` query parameters to paginate through results. operationId: ListFleetTracers parameters: - description: Page number for pagination (starts at 0). in: query name: page_number required: false schema: default: 0 format: int64 minimum: 0 type: integer - description: Number of results per page (must be greater than 0 and less than or equal to 100). in: query name: page_size required: false schema: default: 10 format: int64 maximum: 100 minimum: 1 type: integer - description: Attribute to sort by. in: query name: sort_attribute required: false schema: type: string - description: Sort order (true for descending, false for ascending). in: query name: sort_descending required: false schema: default: true type: boolean - description: Filter string for narrowing down tracer results. example: "hostname:my-host OR env:prod" in: query name: filter required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: tracers: - env: production hostname: my-hostname language: java service: test-service tracer_version: "1.32.0" id: done type: status meta: total_filtered_count: 1 schema: $ref: "#/components/schemas/FleetTracersResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List all fleet tracers tags: - Fleet Automation "x-permission": operator: AND permissions: - hosts_read x-unstable: |- This endpoint is in Preview and may introduce breaking changes. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/unstable/llm-obs/config/evaluators/custom: get: description: List all custom Agent Observability evaluator configurations for the organization. operationId: ListLLMObsCustomEvalConfigs responses: "200": content: application/json: examples: default: value: data: - attributes: category: "Custom" created_at: "2024-01-15T10:30:00Z" created_by: email: "user@example.com" eval_name: "my-custom-evaluator" last_updated_by: email: "user@example.com" llm_judge_config: inference_params: max_tokens: 1024 temperature: 0.7 parsing_type: "structured_output" llm_provider: integration_provider: "openai" model_name: "gpt-4o" target: application_name: "my-llm-app" enabled: true sampling_percentage: 50.0 updated_at: "2024-01-15T10:30:00Z" id: "my-custom-evaluator" type: "evaluator_config" schema: $ref: "#/components/schemas/LLMObsCustomEvalConfigListResponse" description: OK "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List custom evaluator configurations tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/unstable/llm-obs/config/evaluators/custom/{eval_name}: delete: description: Delete a custom Agent Observability evaluator configuration by its name. operationId: DeleteLLMObsCustomEvalConfig parameters: - $ref: "#/components/parameters/LLMObsEvalNamePathParameter" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete a custom evaluator configuration tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Retrieve a custom Agent Observability evaluator configuration by its name. operationId: GetLLMObsCustomEvalConfig parameters: - $ref: "#/components/parameters/LLMObsEvalNamePathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: category: "Custom" created_at: "2024-01-15T10:30:00Z" created_by: email: "user@example.com" eval_name: "my-custom-evaluator" last_updated_by: email: "user@example.com" llm_judge_config: inference_params: max_tokens: 1024 temperature: 0.7 parsing_type: "structured_output" llm_provider: integration_provider: "openai" model_name: "gpt-4o" target: application_name: "my-llm-app" enabled: true sampling_percentage: 50.0 updated_at: "2024-01-15T10:30:00Z" id: "my-custom-evaluator" type: "evaluator_config" schema: $ref: "#/components/schemas/LLMObsCustomEvalConfigResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a custom evaluator configuration tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: Create or update a custom Agent Observability evaluator configuration by its name. operationId: UpdateLLMObsCustomEvalConfig parameters: - $ref: "#/components/parameters/LLMObsEvalNamePathParameter" requestBody: content: application/json: examples: default: value: data: attributes: llm_judge_config: inference_params: max_tokens: 1024 temperature: 0.7 parsing_type: "structured_output" llm_provider: integration_provider: "openai" model_name: "gpt-4o" target: application_name: "my-llm-app" enabled: true sampling_percentage: 50.0 id: "my-custom-evaluator" type: "evaluator_config" full: summary: Full example with prompt template, output schema, and assessment criteria value: data: attributes: category: "Custom" eval_name: "my-custom-evaluator" llm_judge_config: assessment_criteria: pass_when: false inference_params: frequency_penalty: 0 max_tokens: 4096 presence_penalty: 0 temperature: 1 top_p: 1 output_schema: name: "boolean_eval" strict: true parsing_type: "structured_output" prompt_template: - content: "You are a judge LLM." role: "system" - content: "{{span_output}}" role: "user" llm_provider: integration_account_id: "your-account-uuid" integration_provider: "openai" model_name: "gpt-4o" target: application_name: "my-llm-app" enabled: true eval_scope: "span" filter: "@meta.span.kind:llm" root_spans_only: false sampling_percentage: 100 id: "my-custom-evaluator" type: "evaluator_config" schema: $ref: "#/components/schemas/LLMObsCustomEvalConfigUpdateRequest" description: Custom evaluator configuration payload. required: true responses: "200": description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create or update a custom evaluator configuration tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/actions-datastores: get: description: Lists all datastores for the organization. operationId: ListDatastores responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" description: A sample datastore modified_at: "2024-01-01T00:00:00+00:00" name: Example Datastore org_id: 123 primary_column_name: id primary_key_generation_strategy: none id: 00000000-0000-0000-0000-000000000001 type: datastores schema: $ref: "#/components/schemas/DatastoreArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List datastores tags: - Actions Datastores x-permission: operator: OR permissions: - apps_datastore_read post: description: Creates a new datastore. operationId: CreateDatastore requestBody: content: application/json: examples: default: value: data: attributes: name: datastore-name org_access: contributor primary_column_name: primaryKey primary_key_generation_strategy: none type: datastores schema: $ref: "#/components/schemas/CreateAppsDatastoreRequest" required: true responses: "200": content: application/json: examples: default: value: data: id: 00000000-0000-0000-0000-000000000002 type: datastores schema: $ref: "#/components/schemas/CreateAppsDatastoreResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create datastore tags: - Actions Datastores x-permission: operator: OR permissions: - apps_datastore_manage /api/v2/actions-datastores/{datastore_id}: delete: description: Deletes a datastore by its unique identifier. operationId: DeleteDatastore parameters: - description: The unique identifier of the datastore to retrieve. in: path name: datastore_id required: true schema: type: string responses: "200": description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete datastore tags: - Actions Datastores x-permission: operator: OR permissions: - apps_datastore_manage get: description: Retrieves a specific datastore by its ID. operationId: GetDatastore parameters: - description: The unique identifier of the datastore to retrieve. in: path name: datastore_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" description: A sample datastore modified_at: "2024-01-01T00:00:00+00:00" name: Example Datastore org_id: 123 primary_column_name: id primary_key_generation_strategy: none id: 00000000-0000-0000-0000-000000000003 type: datastores schema: $ref: "#/components/schemas/Datastore" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get datastore tags: - Actions Datastores x-permission: operator: OR permissions: - apps_datastore_read patch: description: Updates an existing datastore's attributes. operationId: UpdateDatastore parameters: - description: The unique identifier of the datastore to retrieve. in: path name: datastore_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: type: datastores schema: $ref: "#/components/schemas/UpdateAppsDatastoreRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" description: An updated datastore modified_at: "2024-01-01T00:00:00+00:00" name: Updated Datastore org_id: 123 primary_column_name: id primary_key_generation_strategy: none id: 00000000-0000-0000-0000-000000000004 type: datastores schema: $ref: "#/components/schemas/Datastore" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update datastore tags: - Actions Datastores x-permission: operator: OR permissions: - apps_datastore_manage /api/v2/actions-datastores/{datastore_id}/items: delete: description: Deletes an item from a datastore by its key. operationId: DeleteDatastoreItem parameters: - description: The unique identifier of the datastore to retrieve. in: path name: datastore_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: id: a7656bcc-51d4-4884-adf7-4d0d9a3e0633 item_key: primaryKey type: items schema: $ref: "#/components/schemas/DeleteAppsDatastoreItemRequest" required: true responses: "200": content: application/json: examples: default: value: data: id: 00000000-0000-0000-0000-000000000007 type: items schema: $ref: "#/components/schemas/DeleteAppsDatastoreItemResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete datastore item tags: - Actions Datastores x-permission: operator: OR permissions: - apps_datastore_write get: description: >- Lists items from a datastore. You can filter the results by specifying either an item key or a filter query parameter, but not both at the same time. Supports server-side pagination for large datasets. operationId: ListDatastoreItems parameters: - description: The unique identifier of the datastore to retrieve. in: path name: datastore_id required: true schema: type: string - description: Optional query filter to search items using the [logs search syntax](https://docs.datadoghq.com/logs/explorer/search_syntax/). in: query name: filter schema: type: string - description: Optional primary key value to retrieve a specific item. Cannot be used together with the filter parameter. in: query name: item_key schema: maxLength: 256 type: string - description: Optional field to limit the number of items to return per page for pagination. Up to 100 items can be returned per page. in: query name: "page[limit]" schema: format: int64 maximum: 100 minimum: 1 type: integer - description: Optional field to offset the number of items to skip from the beginning of the result set for pagination. in: query name: "page[offset]" schema: format: int64 type: integer - description: Optional field to sort results by. Prefix with '-' for descending order (e.g., '-created_at'). in: query name: sort schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" modified_at: "2024-01-01T00:00:00+00:00" org_id: 123 primary_column_name: id store_id: 00000000-0000-0000-0000-000000000006 value: key: example-value id: 00000000-0000-0000-0000-000000000005 type: items schema: $ref: "#/components/schemas/ItemApiPayloadArray" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List datastore items tags: - Actions Datastores x-permission: operator: OR permissions: - apps_datastore_read patch: description: Partially updates an item in a datastore by its key. operationId: UpdateDatastoreItem parameters: - description: The unique identifier of the datastore to retrieve. in: path name: datastore_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: item_changes: ops_set: count: 42 status: active item_key: my-item-key type: items schema: $ref: "#/components/schemas/UpdateAppsDatastoreItemRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" modified_at: "2024-01-01T00:00:00+00:00" org_id: 123 primary_column_name: id store_id: 00000000-0000-0000-0000-000000000009 value: count: 42 status: active id: 00000000-0000-0000-0000-000000000008 type: items schema: $ref: "#/components/schemas/ItemApiPayload" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update datastore item tags: - Actions Datastores x-permission: operator: OR permissions: - apps_datastore_write /api/v2/actions-datastores/{datastore_id}/items/bulk: delete: description: >- Deletes multiple items from a datastore by their keys in a single operation. operationId: BulkDeleteDatastoreItems parameters: - description: The ID of the datastore. in: path name: datastore_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: type: items schema: $ref: "#/components/schemas/BulkDeleteAppsDatastoreItemsRequest" required: true responses: "200": content: application/json: examples: default: value: data: - id: 00000000-0000-0000-0000-000000000010 type: items schema: $ref: "#/components/schemas/DeleteAppsDatastoreItemResponseArray" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Bulk delete datastore items tags: - Actions Datastores x-permission: operator: OR permissions: - apps_datastore_write post: description: >- Creates or replaces multiple items in a datastore by their keys in a single operation. operationId: BulkWriteDatastoreItems parameters: - description: The unique identifier of the datastore to retrieve. in: path name: datastore_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: conflict_mode: overwrite_on_conflict values: - data: example data key: value - data: example data2 key: value2 type: items schema: $ref: "#/components/schemas/BulkPutAppsDatastoreItemsRequest" required: true responses: "200": content: application/json: examples: default: value: data: - id: 00000000-0000-0000-0000-000000000011 type: items schema: $ref: "#/components/schemas/PutAppsDatastoreItemResponseArray" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Bulk write datastore items tags: - Actions Datastores x-permission: operator: OR permissions: - apps_datastore_write /api/v2/actions/app_key_registrations: get: description: List App Key Registrations operationId: ListAppKeyRegistrations parameters: - description: The number of App Key Registrations to return per page. in: query name: page[size] required: false schema: format: int64 type: integer - description: The page number to return. in: query name: page[number] required: false schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - id: 00000000-0000-0000-0000-000000000001 type: app_key_registration meta: total: 1 total_filtered: 1 schema: $ref: "#/components/schemas/ListAppKeyRegistrationsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too many requests summary: List App Key Registrations tags: - Action Connection x-permission: operator: OR permissions: - org_app_keys_read /api/v2/actions/app_key_registrations/{app_key_id}: delete: description: Unregister an App Key operationId: UnregisterAppKey parameters: - $ref: "#/components/parameters/ApplicationKeyId" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not found "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too many requests summary: Unregister an App Key tags: - Action Connection x-permission: operator: OR permissions: - user_access_manage - user_app_keys - service_account_write get: description: Get an existing App Key Registration operationId: GetAppKeyRegistration parameters: - $ref: "#/components/parameters/ApplicationKeyId" responses: "200": content: application/json: examples: default: value: data: id: 00000000-0000-0000-0000-000000000001 type: app_key_registration schema: $ref: "#/components/schemas/GetAppKeyRegistrationResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not found "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too many requests summary: Get an existing App Key Registration tags: - Action Connection x-permission: operator: OR permissions: - org_app_keys_read put: description: Register a new App Key operationId: RegisterAppKey parameters: - $ref: "#/components/parameters/ApplicationKeyId" responses: "201": content: application/json: examples: default: value: data: id: 00000000-0000-0000-0000-000000000001 type: app_key_registration schema: $ref: "#/components/schemas/RegisterAppKeyResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too many requests summary: Register a new App Key tags: - Action Connection x-permission: operator: OR permissions: - user_access_manage - user_app_keys - service_account_write /api/v2/actions/connections: post: description: Create a new Action Connection. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). operationId: CreateActionConnection requestBody: content: application/json: examples: default: value: data: attributes: integration: credentials: account_id: "123456789123" role: MyRoleUpdated type: AWSAssumeRole type: AWS name: My AWS Connection tags: - env:prod - team:action-platform type: action_connection schema: $ref: "#/components/schemas/CreateActionConnectionRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: integration: type: AWS name: My AWS Connection tags: - env:prod - team:action-platform id: 00000000-0000-0000-0000-000000000001 type: action_connection schema: $ref: "#/components/schemas/CreateActionConnectionResponse" description: Successfully created Action Connection "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too Many Request summary: Create a new Action Connection tags: - Action Connection /api/v2/actions/connections/{connection_id}: delete: description: Delete an existing Action Connection. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). Alternatively, you can configure these permissions [in the UI](https://docs.datadoghq.com/account_management/api-app-keys/#actions-api-access). operationId: DeleteActionConnection parameters: - $ref: "#/components/parameters/ConnectionId" responses: "204": description: The resource was deleted successfully. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too Many Request summary: Delete an existing Action Connection tags: - Action Connection x-permission: operator: OR permissions: - connection_write get: description: Get an existing Action Connection. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). operationId: GetActionConnection parameters: - $ref: "#/components/parameters/ConnectionId" responses: "200": content: application/json: examples: default: value: data: attributes: integration: type: AWS name: My AWS Connection tags: - env:prod - team:action-platform id: 00000000-0000-0000-0000-000000000002 type: action_connection schema: $ref: "#/components/schemas/GetActionConnectionResponse" description: Successfully get Action Connection "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too Many Request summary: Get an existing Action Connection tags: - Action Connection patch: description: Update an existing Action Connection. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). operationId: UpdateActionConnection parameters: - $ref: "#/components/parameters/ConnectionId" requestBody: content: application/json: examples: default: value: data: attributes: integration: type: AWS name: My AWS Connection tags: - env:prod - team:action-platform type: action_connection schema: $ref: "#/components/schemas/UpdateActionConnectionRequest" description: Update an existing Action Connection request body required: true responses: "200": content: application/json: examples: default: value: data: attributes: integration: type: AWS name: My AWS Connection tags: - env:prod - team:action-platform id: 00000000-0000-0000-0000-000000000003 type: action_connection schema: $ref: "#/components/schemas/UpdateActionConnectionResponse" description: Successfully updated Action Connection "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too Many Request summary: Update an existing Action Connection tags: - Action Connection /api/v2/actions/execution-policies: get: description: Retrieve a list of execution policies for the current organization. operationId: ListExecutionPolicies parameters: - description: The number of execution policies to return per page. example: 100 in: query name: page[size] required: false schema: default: 100 format: int32 maximum: 100 type: integer - description: The page number to return. example: 0 in: query name: page[number] required: false schema: default: 0 format: int32 maximum: 1000 minimum: 0 type: integer - description: Filter execution policies by name. example: "Block prod restarts" in: query name: filter[name] required: false schema: type: string - description: Filter execution policies by a list of IDs. example: - "3fa85f64-5717-4562-b3fc-2c963f66afa6" explode: true in: query name: filter[ids] required: false schema: items: type: string type: array style: form - description: Filter execution policies by a list of integrations. example: - INTEGRATION_SCRIPT explode: true in: query name: filter[integration] required: false schema: items: $ref: "#/components/schemas/ExecutionPolicyIntegration" type: array style: form - description: Filter execution policies by a list of effects. example: - allow explode: true in: query name: filter[effects] required: false schema: items: $ref: "#/components/schemas/ExecutionPolicyEffect" type: array style: form - description: Filter execution policies by a list of creator IDs. example: - "3fa85f64-5717-4562-b3fc-2c963f66afa6" explode: true in: query name: filter[creator_ids] required: false schema: items: type: string type: array style: form - description: |- The sort order for the results. Prefix a field with `-` to sort in descending order. Valid fields are `name`, `effect`, `integration`, `created_at`, and `updated_at`. example: - "-created_at" explode: true in: query name: sort required: false schema: items: type: string type: array style: form responses: "200": content: application/json: examples: default: value: data: - attributes: action_pattern: action_fqns: - "com.datadoghq.script.*" integration: INTEGRATION_SCRIPT created_at: "2026-01-15T10:00:00.000Z" created_by: "3fa85f64-5717-4562-b3fc-2c963f66afa6" effect: allow name: "Block prod restarts" targets: [] updated_at: "2026-01-15T10:00:00.000Z" updated_by: "3fa85f64-5717-4562-b3fc-2c963f66afa6" version: 1 id: "3fa85f64-5717-4562-b3fc-2c963f66afa6" type: execution_policy meta: page: total: 1 schema: $ref: "#/components/schemas/ExecutionPolicyListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List execution policies tags: - Execution Policy x-permission: operator: OR permissions: - execution_groups_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a new execution policy. operationId: CreateExecutionPolicy requestBody: content: application/json: examples: default: value: data: attributes: action_pattern: action_fqns: - "com.datadoghq.script.*" integration: INTEGRATION_SCRIPT effect: allow name: "Block prod restarts" type: execution_policy schema: $ref: "#/components/schemas/ExecutionPolicyCreateRequest" description: The execution policy to create. required: true responses: "201": content: application/json: examples: default: value: data: attributes: action_pattern: action_fqns: - "com.datadoghq.script.*" integration: INTEGRATION_SCRIPT created_at: "2026-01-15T10:00:00.000Z" created_by: "3fa85f64-5717-4562-b3fc-2c963f66afa6" effect: allow name: "Block prod restarts" targets: [] updated_at: "2026-01-15T10:00:00.000Z" updated_by: "3fa85f64-5717-4562-b3fc-2c963f66afa6" version: 1 id: "3fa85f64-5717-4562-b3fc-2c963f66afa6" type: execution_policy schema: $ref: "#/components/schemas/ExecutionPolicyResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create an execution policy tags: - Execution Policy x-codegen-request-body-name: body x-permission: operator: OR permissions: - execution_groups_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/actions/execution-policies/{policy_id}: delete: description: Delete a specific execution policy. operationId: DeleteExecutionPolicy parameters: - $ref: "#/components/parameters/ExecutionPolicyId" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an execution policy tags: - Execution Policy x-permission: operator: OR permissions: - execution_groups_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Retrieve an existing execution policy by ID. operationId: GetExecutionPolicy parameters: - $ref: "#/components/parameters/ExecutionPolicyId" responses: "200": content: application/json: examples: default: value: data: attributes: action_pattern: action_fqns: - "com.datadoghq.script.*" integration: INTEGRATION_SCRIPT created_at: "2026-01-15T10:00:00.000Z" created_by: "3fa85f64-5717-4562-b3fc-2c963f66afa6" effect: allow name: "Block prod restarts" targets: [] updated_at: "2026-01-15T10:00:00.000Z" updated_by: "3fa85f64-5717-4562-b3fc-2c963f66afa6" version: 1 id: "3fa85f64-5717-4562-b3fc-2c963f66afa6" type: execution_policy schema: $ref: "#/components/schemas/ExecutionPolicyResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get an execution policy tags: - Execution Policy x-permission: operator: OR permissions: - execution_groups_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: |- Update an existing execution policy. Returns the execution policy object when the request is successful. operationId: UpdateExecutionPolicy parameters: - $ref: "#/components/parameters/ExecutionPolicyId" requestBody: content: application/json: examples: default: value: data: attributes: action_pattern: action_fqns: - "com.datadoghq.script.*" integration: INTEGRATION_SCRIPT effect: allow name: "Block prod restarts" id: "3fa85f64-5717-4562-b3fc-2c963f66afa6" type: execution_policy schema: $ref: "#/components/schemas/ExecutionPolicyUpdateRequest" description: The new execution policy. required: true responses: "200": content: application/json: examples: default: value: data: attributes: action_pattern: action_fqns: - "com.datadoghq.script.*" integration: INTEGRATION_SCRIPT created_at: "2026-01-15T10:00:00.000Z" created_by: "3fa85f64-5717-4562-b3fc-2c963f66afa6" effect: allow name: "Block prod restarts" targets: [] updated_at: "2026-01-15T10:00:00.000Z" updated_by: "3fa85f64-5717-4562-b3fc-2c963f66afa6" version: 2 id: "3fa85f64-5717-4562-b3fc-2c963f66afa6" type: execution_policy schema: $ref: "#/components/schemas/ExecutionPolicyResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update an execution policy tags: - Execution Policy x-codegen-request-body-name: body x-permission: operator: OR permissions: - execution_groups_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/agenthealth/hosts/{resource_id}/issues: get: description: Returns the active Agent Health issues for a node Agent or Cluster Agent resource. operationId: ListAgentHealthHostIssues parameters: - description: >- Resource identifier whose active Agent Health issues should be returned: a DaemonSet UID for a node Agent or a cluster UUID for a Cluster Agent. example: 123e4567-e89b-12d3-a456-426614174000 in: path name: resource_id required: true schema: type: string - description: Agent type associated with the resource. Defaults to `node` when omitted. example: node in: query name: agent_type required: false schema: $ref: "#/components/schemas/AgentHealthAgentType" responses: "200": content: application/json: examples: default: value: data: attributes: issues: - category: configuration issue_id: invalid-config:4828e7d6c704c4a3 issue_name: Invalid Config issue_type: invalid_config id: 123e4567-e89b-12d3-a456-426614174000 type: agent_health_issues schema: $ref: "#/components/schemas/AgentHealthHostIssuesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] summary: List active Agent Health issues tags: - Agent Health /api/v2/agentless_scanning/accounts/aws: get: description: Fetches the scan options configured for AWS accounts. operationId: ListAwsScanOptions responses: "200": content: application/json: examples: default: value: data: - attributes: lambda: true sensitive_data: false vuln_containers_os: true vuln_host_os: true id: "123456789012" type: aws_scan_options schema: $ref: "#/components/schemas/AwsScanOptionsListResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_findings_read summary: List AWS scan options tags: ["Agentless Scanning"] post: description: Activate Agentless scan options for an AWS account. operationId: CreateAwsScanOptions requestBody: content: application/json: examples: default: value: data: attributes: compliance_host: false lambda: true sensitive_data: false vuln_containers_os: true vuln_host_os: true id: "123456789012" type: aws_scan_options schema: $ref: "#/components/schemas/AwsScanOptionsCreateRequest" description: The definition of the new scan options. required: true responses: "201": content: "application/json": examples: default: value: data: attributes: lambda: true sensitive_data: false vuln_containers_os: true vuln_host_os: true id: "123456789012" type: aws_scan_options schema: $ref: "#/components/schemas/AwsScanOptionsResponse" description: Agentless scan options enabled successfully. "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management summary: Create AWS scan options tags: ["Agentless Scanning"] x-codegen-request-body-name: body /api/v2/agentless_scanning/accounts/aws/{account_id}: delete: description: Delete Agentless scan options for an AWS account. operationId: DeleteAwsScanOptions parameters: - $ref: "#/components/parameters/AwsAccountId" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management summary: Delete AWS scan options tags: ["Agentless Scanning"] get: description: Fetches the Agentless scan options for an activated account. operationId: GetAwsScanOptions parameters: - $ref: "#/components/parameters/AwsAccountId" responses: "200": content: application/json: examples: default: value: data: attributes: lambda: true sensitive_data: false vuln_containers_os: true vuln_host_os: true id: "123456789012" type: aws_scan_options schema: $ref: "#/components/schemas/AwsScanOptionsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_findings_read summary: Get AWS scan options tags: ["Agentless Scanning"] patch: description: Update the Agentless scan options for an activated account. operationId: UpdateAwsScanOptions parameters: - $ref: "#/components/parameters/AwsAccountId" requestBody: content: application/json: examples: default: value: data: attributes: compliance_host: false lambda: true sensitive_data: false vuln_containers_os: true vuln_host_os: true id: "123456789012" type: aws_scan_options schema: $ref: "#/components/schemas/AwsScanOptionsUpdateRequest" description: New definition of the scan options. required: true responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management summary: Update AWS scan options tags: ["Agentless Scanning"] x-codegen-request-body-name: body /api/v2/agentless_scanning/accounts/azure: get: description: Fetches the scan options configured for Azure accounts. operationId: ListAzureScanOptions responses: "200": content: application/json: examples: default: value: data: - attributes: vuln_containers_os: true vuln_host_os: true id: 00000000-0000-0000-0000-000000000001 type: azure_scan_options schema: $ref: "#/components/schemas/AzureScanOptionsArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_findings_read summary: List Azure scan options tags: - Agentless Scanning post: description: Activate Agentless scan options for an Azure subscription. operationId: CreateAzureScanOptions requestBody: content: application/json: examples: default: value: data: attributes: compliance_host: false vuln_containers_os: true vuln_host_os: true id: 12345678-90ab-cdef-1234-567890abcdef type: azure_scan_options schema: $ref: "#/components/schemas/AzureScanOptions" required: true responses: "201": content: application/json: examples: default: value: data: attributes: vuln_containers_os: true vuln_host_os: true id: 00000000-0000-0000-0000-000000000001 type: azure_scan_options schema: $ref: "#/components/schemas/AzureScanOptions" description: Created "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management summary: Create Azure scan options tags: - Agentless Scanning /api/v2/agentless_scanning/accounts/azure/{subscription_id}: delete: description: Delete Agentless scan options for an Azure subscription. operationId: DeleteAzureScanOptions parameters: - description: The Azure subscription ID. in: path name: subscription_id required: true schema: example: 12345678-90ab-cdef-1234-567890abcdef type: string responses: "204": description: No Content "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management summary: Delete Azure scan options tags: - Agentless Scanning get: description: Fetches the Agentless scan options for an activated subscription. operationId: GetAzureScanOptions parameters: - description: The Azure subscription ID. in: path name: subscription_id required: true schema: example: 12345678-90ab-cdef-1234-567890abcdef type: string responses: "200": content: application/json: examples: default: value: data: attributes: vuln_containers_os: true vuln_host_os: true id: 00000000-0000-0000-0000-000000000001 type: azure_scan_options schema: $ref: "#/components/schemas/AzureScanOptions" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_findings_read summary: Get Azure scan options tags: ["Agentless Scanning"] patch: description: Update the Agentless scan options for an activated subscription. operationId: UpdateAzureScanOptions parameters: - description: The Azure subscription ID. in: path name: subscription_id required: true schema: example: 12345678-90ab-cdef-1234-567890abcdef type: string requestBody: content: application/json: examples: default: value: data: attributes: vuln_containers_os: false id: 12345678-90ab-cdef-1234-567890abcdef type: azure_scan_options schema: $ref: "#/components/schemas/AzureScanOptionsInputUpdate" required: true responses: "200": content: application/json: examples: default: value: data: attributes: vuln_containers_os: false vuln_host_os: true id: 00000000-0000-0000-0000-000000000001 type: azure_scan_options schema: $ref: "#/components/schemas/AzureScanOptions" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management summary: Update Azure scan options tags: - Agentless Scanning /api/v2/agentless_scanning/accounts/gcp: get: description: Fetches the scan options configured for all GCP projects. operationId: ListGcpScanOptions responses: "200": content: application/json: examples: default: value: data: - attributes: vuln_containers_os: true vuln_host_os: true id: abc-123 type: gcp_scan_options schema: $ref: "#/components/schemas/GcpScanOptionsArray" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_findings_read summary: List GCP scan options tags: - Agentless Scanning post: description: Activate Agentless scan options for a GCP project. operationId: CreateGcpScanOptions requestBody: content: application/json: examples: default: value: data: attributes: compliance_host: false vuln_containers_os: true vuln_host_os: true id: company-project-id type: gcp_scan_options schema: $ref: "#/components/schemas/GcpScanOptions" description: The definition of the new scan options. required: true responses: "201": content: application/json: examples: default: value: data: attributes: vuln_containers_os: true vuln_host_os: true id: abc-123 type: gcp_scan_options schema: $ref: "#/components/schemas/GcpScanOptions" description: Agentless scan options enabled successfully. "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management summary: Create GCP scan options tags: - Agentless Scanning x-codegen-request-body-name: body /api/v2/agentless_scanning/accounts/gcp/{project_id}: delete: description: Delete Agentless scan options for a GCP project. operationId: DeleteGcpScanOptions parameters: - description: The GCP project ID. in: path name: project_id required: true schema: example: company-project-id type: string responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management summary: Delete GCP scan options tags: - Agentless Scanning get: description: Fetches the Agentless scan options for an activated GCP project. operationId: GetGcpScanOptions parameters: - description: The GCP project ID. in: path name: project_id required: true schema: example: company-project-id type: string responses: "200": content: application/json: examples: default: value: data: attributes: vuln_containers_os: true vuln_host_os: true id: abc-123 type: gcp_scan_options schema: $ref: "#/components/schemas/GcpScanOptions" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_findings_read summary: Get GCP scan options tags: - Agentless Scanning patch: description: Update the Agentless scan options for an activated GCP project. operationId: UpdateGcpScanOptions parameters: - description: The GCP project ID. in: path name: project_id required: true schema: example: company-project-id type: string requestBody: content: application/json: examples: default: value: data: attributes: vuln_containers_os: false id: company-project-id type: gcp_scan_options schema: $ref: "#/components/schemas/GcpScanOptionsInputUpdate" description: New definition of the scan options. required: true responses: "200": content: application/json: examples: default: value: data: attributes: vuln_containers_os: true vuln_host_os: true id: abc-123 type: gcp_scan_options schema: $ref: "#/components/schemas/GcpScanOptions" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management summary: Update GCP scan options tags: - Agentless Scanning x-codegen-request-body-name: body /api/v2/agentless_scanning/ondemand/aws: get: description: Fetches the most recent 1000 AWS on demand tasks. operationId: ListAwsOnDemandTasks responses: "200": content: application/json: examples: default: value: data: - attributes: arn: "arn:aws:ec2:us-east-1:123456789012:instance/i-0eabb50529b67a1ba" assigned_at: "2024-01-01T00:00:00+00:00" created_at: "2024-01-01T00:00:00+00:00" status: QUEUED id: abc-123 type: aws_resource schema: $ref: "#/components/schemas/AwsOnDemandListResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_findings_read summary: List AWS on demand tasks tags: ["Agentless Scanning"] "x-permission": operator: OR permissions: - security_monitoring_findings_read post: description: Trigger the scan of an AWS resource with a high priority. Agentless scanning must be activated for the AWS account containing the resource to scan. operationId: CreateAwsOnDemandTask requestBody: content: application/json: examples: default: value: data: attributes: arn: arn:aws:ec2:us-east-1:727000456123:instance/i-0eabb50529b67a1ba type: aws_resource schema: $ref: "#/components/schemas/AwsOnDemandCreateRequest" description: The definition of the on demand task. required: true responses: "201": content: "application/json": examples: default: value: data: attributes: arn: "arn:aws:ec2:us-east-1:123456789012:instance/i-0eabb50529b67a1ba" created_at: "2024-01-01T00:00:00+00:00" status: QUEUED id: abc-123 type: aws_resource schema: $ref: "#/components/schemas/AwsOnDemandResponse" description: AWS on demand task created successfully. "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management summary: Create AWS on demand task tags: ["Agentless Scanning"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_findings_write /api/v2/agentless_scanning/ondemand/aws/{task_id}: get: description: Fetch the data of a specific on demand task. operationId: GetAwsOnDemandTask parameters: - $ref: "#/components/parameters/OnDemandTaskId" responses: "200": content: "application/json": examples: default: value: data: attributes: arn: "arn:aws:ec2:us-east-1:123456789012:instance/i-0eabb50529b67a1ba" assigned_at: "2024-01-01T00:00:00+00:00" created_at: "2024-01-01T00:00:00+00:00" status: ASSIGNED id: abc-123 type: aws_resource schema: $ref: "#/components/schemas/AwsOnDemandResponse" description: OK. "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_findings_read summary: Get AWS on demand task tags: ["Agentless Scanning"] "x-permission": operator: OR permissions: - security_monitoring_findings_read /api/v2/ai-guard/evaluate: post: description: |- Analyzes a conversation for security threats such as prompt injection, jailbreak attempts, and other AI-specific attacks. Returns an action recommendation (`ALLOW`, `DENY`, or `ABORT`) along with the detected threat tags and their confidence scores. AI Guard must be activated for the organization, and the calling user or application key requires the `ai_guard_evaluate` permission. The action is a recommendation for the caller to enforce: ALLOW permits the interaction, DENY blocks the interaction, and ABORT terminates the workflow. This endpoint is rate limited to `700` requests per minute per organization. Organization token limits can also result in a 429 response. Malformed messages return a 400 response. Requests exceeding the raw-input limit of 1,000,000 tokens return a 413 response; this limit applies to the input context, not only the size of the HTTP request body. operationId: EvaluateAIGuardRequest requestBody: content: application/json: examples: default: summary: Evaluate a user message value: data: attributes: messages: - content: Hello world! role: user meta: confidence_threshold: 0.8 type: evaluations per_category_threshold: summary: Evaluate with per-category confidence thresholds value: data: attributes: messages: - content: Hello world! role: user meta: confidence_threshold: flagging_global: 0.6 indirect-prompt-injection: 0.4 policy-evasion: 0.9 type: evaluations schema: $ref: "#/components/schemas/AIGuardEvaluateRequest" description: The conversation to evaluate for security threats. required: true responses: "200": content: application/json: examples: default: summary: Evaluation of a benign user message value: data: attributes: action: ALLOW global_prob: 0.005218505859375 is_blocking_enabled: false reason: No rule match. tag_probs: tags: [] id: a76a703c-324f-42ed-af33-9b17d65e28af type: evaluations schema: $ref: "#/components/schemas/AIGuardEvaluateResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "408": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Request Timeout "413": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Payload Too Large "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_guard_evaluate summary: Evaluate an AI Guard request tags: - AI Guard x-codegen-request-body-name: body x-permission: operator: AND permissions: - ai_guard_evaluate x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/ai_impact/user_activity: post: description: |- Send daily AI coding tool activity for one or more users. Each entry records whether a user was active on a given day, along with the AI tools and models they used. An entry is stored once per tool, and sending the same user, day, and tool again overwrites the previous value. operationId: CreateAIImpactUserActivity requestBody: content: application/json: examples: default: value: data: - attributes: day: "2026-05-26" is_active: true models: - claude-sonnet-4.5 - gpt-5 tools: - Claude Code - Cursor user_email: user@example.com type: ai_impact_user_activity schema: $ref: "#/components/schemas/AIImpactUserActivityRequest" required: true responses: "200": description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: |- Bad Request: the batch is empty, has more than 1,000 entries, or contains an invalid entry. An entry is invalid when `user_email`, `is_active`, or `day` is missing, `tools` is missing or an empty array, `user_email` is not a valid email address, `day` is not in `YYYY-MM-DD` format, or a tool name is empty. The error message identifies the index of the first invalid entry. Fix the payload and send the request again. "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] summary: Send AI tool user activity tags: - Delivery Performance x-codegen-request-body-name: body /api/v2/annotation: get: description: Returns a flat list of annotations matching the given page, time window, and optional widget filter. operationId: ListAnnotations parameters: - description: |- ID of the page to list annotations for, prefixed with the page type and joined by a colon (for example, `dashboard:abc-def-xyz` or `notebook:1234567890`). example: "dashboard:abc-def-xyz" in: query name: page_id required: true schema: type: string - $ref: "#/components/parameters/AnnotationStartTimeQueryParameter" - $ref: "#/components/parameters/AnnotationEndTimeQueryParameter" - description: Optional widget ID to restrict results to annotations on a specific widget. in: query name: widget_id required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: author_id: "00000000-0000-0000-0000-000000000001" color: blue created_at: 1704067200000 description: "Deployed v2.3.1 to production." end_time: modified_at: 1704067200000 page_id: "dashboard:abc-def-xyz" start_time: 1704067200000 type: pointInTime widget_ids: - "1234567890" id: "00000000-0000-0000-0000-000000000000" type: annotation schema: $ref: "#/components/schemas/AnnotationsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List annotations tags: - Annotations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Creates a new annotation on a dashboard or notebook page. Valid `color` values: `gray`, `blue`, `purple`, `green`, `yellow`, `red`. Valid `type` values: `pointInTime` (marks a single moment) or `timeRegion` (spans a range and requires `end_time`). operationId: CreateAnnotation requestBody: content: application/json: examples: default: value: data: attributes: color: blue description: "Deployed v2.3.1 to production." page_id: "dashboard:abc-def-xyz" start_time: 1704067200000 type: pointInTime widget_ids: - "1234567890" type: annotation schema: $ref: "#/components/schemas/AnnotationCreateRequest" description: Annotation to create. required: true responses: "200": content: application/json: examples: default: value: data: attributes: author_id: "00000000-0000-0000-0000-000000000001" color: blue created_at: 1704067200000 description: "Deployed v2.3.1 to production." end_time: modified_at: 1704067200000 page_id: "dashboard:abc-def-xyz" start_time: 1704067200000 type: pointInTime widget_ids: - "1234567890" id: "00000000-0000-0000-0000-000000000000" type: annotation schema: $ref: "#/components/schemas/AnnotationResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create an annotation tags: - Annotations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/annotation/page/{page_id}: get: description: |- Returns all annotations on a specific page for a given time window, grouped by widget. Unlike `ListAnnotations`, this endpoint returns a single structured object with annotations indexed by their ID and a widget-to-annotation mapping for easy UI rendering. operationId: GetPageAnnotations parameters: - $ref: "#/components/parameters/AnnotationPageIDPathParameter" - $ref: "#/components/parameters/AnnotationStartTimeQueryParameter" - $ref: "#/components/parameters/AnnotationEndTimeQueryParameter" responses: "200": content: application/json: examples: default: value: data: attributes: annotations: "00000000-0000-0000-0000-000000000000": author_id: "00000000-0000-0000-0000-000000000001" color: blue created_at: 1704067200000 description: "Deployed v2.3.1 to production." end_time: id: "00000000-0000-0000-0000-000000000000" modified_at: 1704067200000 page_id: "dashboard:abc-def-xyz" start_time: 1704067200000 type: pointInTime widget_ids: - "1234567890" global_annotations: - "00000000-0000-0000-0000-000000000002" widget_mapping: "1234567890": - "00000000-0000-0000-0000-000000000000" id: "dashboard:abc-def-xyz" type: page_annotations schema: $ref: "#/components/schemas/PageAnnotationsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get annotations for a page tags: - Annotations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/annotation/{annotation_id}: delete: description: |- Deletes an existing annotation by ID. Returns `204 No Content` if the annotation does not exist (idempotent). operationId: DeleteAnnotation parameters: - $ref: "#/components/parameters/AnnotationIDPathParameter" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete an annotation tags: - Annotations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: |- Updates an existing annotation. Valid `color` values: `gray`, `blue`, `purple`, `green`, `yellow`, `red`. Valid `type` values: `pointInTime` (marks a single moment) or `timeRegion` (spans a range and requires `end_time`). operationId: UpdateAnnotation parameters: - $ref: "#/components/parameters/AnnotationIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: color: green description: "Deployed v2.3.1 to production (updated)." page_id: "dashboard:abc-def-xyz" start_time: 1704067200000 type: pointInTime widget_ids: - "1234567890" type: annotation schema: $ref: "#/components/schemas/AnnotationUpdateRequest" description: Updated annotation payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: author_id: "00000000-0000-0000-0000-000000000001" color: green created_at: 1704067200000 description: "Deployed v2.3.1 to production (updated)." end_time: modified_at: 1704070800000 page_id: "dashboard:abc-def-xyz" start_time: 1704067200000 type: pointInTime widget_ids: - "1234567890" id: "00000000-0000-0000-0000-000000000000" type: annotation schema: $ref: "#/components/schemas/AnnotationResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update an annotation tags: - Annotations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/anonymize_users: put: description: |- Anonymize a list of users, removing their personal data. This operation is irreversible. Requires the `user_access_manage` permission. operationId: AnonymizeUsers requestBody: content: application/json: examples: default: value: data: attributes: user_ids: - "00000000-0000-0000-0000-000000000000" type: anonymize_users_request schema: $ref: "#/components/schemas/AnonymizeUsersRequest" required: true responses: "200": content: application/json: examples: default: value: data: id: abc-123 type: anonymize_users_response schema: $ref: "#/components/schemas/AnonymizeUsersResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_manage summary: Anonymize users tags: - Users x-codegen-request-body-name: body x-permission: operator: OR permissions: - user_access_manage x-unstable: "**Note**: This endpoint is in Preview and may be subject to changes." /api/v2/api_keys: get: description: List all API keys available for your account. operationId: ListAPIKeys parameters: - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - $ref: "#/components/parameters/APIKeysSortParameter" - $ref: "#/components/parameters/APIKeyFilterParameter" - $ref: "#/components/parameters/APIKeyFilterCreatedAtStartParameter" - $ref: "#/components/parameters/APIKeyFilterCreatedAtEndParameter" - $ref: "#/components/parameters/APIKeyFilterModifiedAtStartParameter" - $ref: "#/components/parameters/APIKeyFilterModifiedAtEndParameter" - $ref: "#/components/parameters/APIKeyIncludeParameter" - $ref: "#/components/parameters/APIKeyReadConfigReadEnabledParameter" - $ref: "#/components/parameters/APIKeyCategoryParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" last4: abcd modified_at: "2024-01-01T00:00:00+00:00" name: API Key for submitting metrics id: 00000000-0000-0000-0000-000000000001 type: api_keys schema: $ref: "#/components/schemas/APIKeysResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all API keys tags: - Key Management "x-permission": operator: OR permissions: - api_keys_read post: description: Create an API key. operationId: CreateAPIKey requestBody: content: application/json: examples: default: value: data: attributes: name: API Key for submitting metrics type: api_keys schema: $ref: "#/components/schemas/APIKeyCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" last4: abcd modified_at: "2024-01-01T00:00:00+00:00" name: API Key for submitting metrics id: 00000000-0000-0000-0000-000000000002 type: api_keys schema: $ref: "#/components/schemas/APIKeyResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create an API key tags: - Key Management x-codegen-request-body-name: body "x-permission": operator: OR permissions: - api_keys_write /api/v2/api_keys/{api_key_id}: delete: description: Delete an API key. operationId: DeleteAPIKey parameters: - $ref: "#/components/parameters/APIKeyId" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an API key tags: - Key Management "x-permission": operator: OR permissions: - api_keys_delete get: description: Get an API key. operationId: GetAPIKey parameters: - $ref: "#/components/parameters/APIKeyId" - $ref: "#/components/parameters/APIKeyIncludeParameter" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" last4: abcd modified_at: "2024-01-01T00:00:00+00:00" name: API Key for submitting metrics id: 00000000-0000-0000-0000-000000000003 type: api_keys schema: $ref: "#/components/schemas/APIKeyResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get API key tags: - Key Management "x-permission": operator: OR permissions: - api_keys_read patch: description: Update an API key. operationId: UpdateAPIKey parameters: - $ref: "#/components/parameters/APIKeyId" requestBody: content: application/json: examples: default: value: data: attributes: name: API Key for submitting metrics id: 00112233-4455-6677-8899-aabbccddeeff type: api_keys schema: $ref: "#/components/schemas/APIKeyUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" last4: abcd modified_at: "2024-01-01T00:00:00+00:00" name: API Key for submitting metrics id: 00000000-0000-0000-0000-000000000004 type: api_keys schema: $ref: "#/components/schemas/APIKeyResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Edit an API key tags: - Key Management x-codegen-request-body-name: body "x-permission": operator: OR permissions: - api_keys_write /api/v2/apicatalog/api: get: deprecated: true description: List APIs and their IDs. operationId: ListAPIs parameters: - description: Filter APIs by name in: query name: query required: false schema: example: "payments" type: string - description: Number of items per page. in: query name: page[limit] required: false schema: default: 20 format: int64 minimum: 1 type: integer - description: Offset for pagination. in: query name: page[offset] required: false schema: default: 0 format: int64 minimum: 0 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: name: Payments API id: abc-123 meta: pagination: limit: 20 offset: 0 total_count: 1 schema: $ref: "#/components/schemas/ListAPIsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_api_catalog_read summary: List APIs tags: ["API Management"] "x-permission": operator: OR permissions: - apm_api_catalog_read x-unstable: |- **Note**: This endpoint is deprecated. /api/v2/apicatalog/api/{id}: delete: deprecated: true description: Delete a specific API by ID. operationId: DeleteOpenAPI parameters: - description: ID of the API to delete in: path name: id required: true schema: $ref: "#/components/schemas/ApiID" responses: "204": description: API deleted successfully "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: API not found error "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_api_catalog_write summary: Delete an API tags: ["API Management"] "x-permission": operator: OR permissions: - apm_api_catalog_write x-unstable: |- **Note**: This endpoint is deprecated. /api/v2/apicatalog/api/{id}/openapi: get: deprecated: true description: Retrieve information about a specific API in [OpenAPI](https://spec.openapis.org/oas/latest.html) format file. operationId: GetOpenAPI parameters: - description: ID of the API to retrieve in: path name: id required: true schema: $ref: "#/components/schemas/ApiID" responses: "200": content: multipart/form-data: examples: default: value: openapi-spec.yaml schema: format: binary type: string description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: API not found error "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_api_catalog_read summary: Get an API tags: ["API Management"] "x-permission": operator: OR permissions: - apm_api_catalog_read x-unstable: |- **Note**: This endpoint is deprecated. put: deprecated: true description: |- Update information about a specific API. The given content will replace all API content of the given ID. The ID is returned by the create API, or can be found in the URL in the API catalog UI. operationId: UpdateOpenAPI parameters: - description: ID of the API to modify in: path name: id required: true schema: $ref: "#/components/schemas/ApiID" requestBody: content: multipart/form-data: examples: default: value: openapi_spec_file: openapi-spec.yaml schema: $ref: "#/components/schemas/OpenAPIFile" required: true responses: "200": content: application/json: examples: default: value: data: attributes: failed_endpoints: [] id: abc-123 schema: $ref: "#/components/schemas/UpdateOpenAPIResponse" description: API updated successfully "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: API not found error "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_api_catalog_write summary: Update an API tags: ["API Management"] "x-permission": operator: OR permissions: - apm_api_catalog_write x-unstable: |- **Note**: This endpoint is deprecated. /api/v2/apicatalog/openapi: post: deprecated: true description: |- Create a new API from the [OpenAPI](https://spec.openapis.org/oas/latest.html) specification given. See the [API Catalog documentation](https://docs.datadoghq.com/api_catalog/add_metadata/) for additional information about the possible metadata. It returns the created API ID. operationId: CreateOpenAPI requestBody: content: multipart/form-data: examples: default: value: openapi_spec_file: openapi-spec.yaml schema: $ref: "#/components/schemas/OpenAPIFile" required: true responses: "201": content: application/json: examples: default: value: data: attributes: failed_endpoints: [] id: abc-123 schema: $ref: "#/components/schemas/CreateOpenAPIResponse" description: API created successfully "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_api_catalog_write summary: Create a new API tags: ["API Management"] "x-permission": operator: OR permissions: - apm_api_catalog_write x-unstable: |- **Note**: This endpoint is deprecated. /api/v2/apm/config/metrics: get: description: Get the list of configured span-based metrics with their definitions. operationId: ListSpansMetrics responses: "200": content: application/json: examples: default: value: data: - attributes: compute: aggregation_type: distribution include_percentiles: false path: "@duration" filter: query: "@http.status_code:200 service:my-service" group_by: - path: resource_name tag_name: resource_name id: my.metric type: spans_metrics schema: $ref: "#/components/schemas/SpansMetricsResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all span-based metrics tags: - Spans Metrics "x-permission": operator: OR permissions: - apm_read post: description: |- Create a metric based on your ingested spans in your organization. Returns the span-based metric object from the request body when the request is successful. operationId: CreateSpansMetric requestBody: content: application/json: examples: default: value: data: attributes: compute: aggregation_type: distribution include_percentiles: false path: "@duration" filter: query: "@http.status_code:200 service:my-service" group_by: - path: resource_name tag_name: resource_name id: my.metric type: spans_metrics schema: $ref: "#/components/schemas/SpansMetricCreateRequest" description: The definition of the new span-based metric. required: true responses: "200": content: application/json: examples: default: value: data: attributes: compute: aggregation_type: distribution include_percentiles: false path: "@duration" filter: query: "@http.status_code:200 service:my-service" group_by: - path: resource_name tag_name: resource_name id: my.metric type: spans_metrics schema: $ref: "#/components/schemas/SpansMetricResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a span-based metric tags: - Spans Metrics x-codegen-request-body-name: body "x-permission": operator: OR permissions: - apm_generate_metrics /api/v2/apm/config/metrics/{metric_id}: delete: description: Delete a specific span-based metric from your organization. operationId: DeleteSpansMetric parameters: - $ref: "#/components/parameters/SpansMetricIDParameter" responses: "204": description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a span-based metric tags: - Spans Metrics "x-permission": operator: OR permissions: - apm_generate_metrics get: description: Get a specific span-based metric from your organization. operationId: GetSpansMetric parameters: - $ref: "#/components/parameters/SpansMetricIDParameter" responses: "200": content: application/json: examples: default: value: data: attributes: compute: aggregation_type: distribution include_percentiles: false path: "@duration" filter: query: "@http.status_code:200 service:my-service" group_by: - path: resource_name tag_name: resource_name id: my.metric type: spans_metrics schema: $ref: "#/components/schemas/SpansMetricResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a span-based metric tags: - Spans Metrics "x-permission": operator: OR permissions: - apm_read patch: description: |- Update a specific span-based metric from your organization. Returns the span-based metric object from the request body when the request is successful. operationId: UpdateSpansMetric parameters: - $ref: "#/components/parameters/SpansMetricIDParameter" requestBody: content: application/json: examples: default: value: data: attributes: compute: include_percentiles: false filter: query: "@http.status_code:200 service:my-service" group_by: - path: resource_name tag_name: resource_name type: spans_metrics schema: $ref: "#/components/schemas/SpansMetricUpdateRequest" description: New definition of the span-based metric. required: true responses: "200": content: application/json: examples: default: value: data: attributes: compute: aggregation_type: distribution include_percentiles: false path: "@duration" filter: query: "@http.status_code:200 service:my-service" group_by: - path: resource_name tag_name: resource_name id: my.metric type: spans_metrics schema: $ref: "#/components/schemas/SpansMetricResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a span-based metric tags: - Spans Metrics x-codegen-request-body-name: body "x-permission": operator: OR permissions: - apm_generate_metrics /api/v2/apm/config/retention-filters: get: description: Get the list of APM retention filters. operationId: ListApmRetentionFilters responses: "200": content: application/json: examples: default: value: data: - attributes: enabled: true filter: query: "@http.status_code:200 service:my-service" filter_type: spans-sampling-processor name: my retention filter rate: 1.0 id: abc-123 type: apm_retention_filter schema: $ref: "#/components/schemas/RetentionFiltersResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List all APM retention filters tags: - APM Retention Filters "x-permission": operator: OR permissions: - apm_retention_filter_read post: description: |- Create a retention filter to index spans in your organization. Returns the retention filter definition when the request is successful. Default filters with types spans-errors-sampling-processor and spans-appsec-sampling-processor cannot be created. operationId: CreateApmRetentionFilter requestBody: content: application/json: examples: default: value: data: attributes: enabled: true filter: query: "@http.status_code:200 service:my-service" filter_type: spans-sampling-processor name: my retention filter rate: 1.0 trace_rate: 1.0 type: apm_retention_filter schema: $ref: "#/components/schemas/RetentionFilterCreateRequest" description: The definition of the new retention filter. required: true responses: "200": content: application/json: examples: default: value: data: attributes: enabled: true filter: query: "@http.status_code:200 service:my-service" filter_type: spans-sampling-processor name: my retention filter rate: 1.0 id: abc-123 type: apm_retention_filter schema: $ref: "#/components/schemas/RetentionFilterCreateResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a retention filter tags: - APM Retention Filters x-codegen-request-body-name: body "x-permission": operator: OR permissions: - apm_retention_filter_write /api/v2/apm/config/retention-filters-execution-order: put: description: Re-order the execution order of retention filters. operationId: ReorderApmRetentionFilters requestBody: content: application/json: examples: default: value: data: - id: 7RBOb7dLSYWI01yc3pIH8w type: apm_retention_filter schema: $ref: "#/components/schemas/ReorderRetentionFiltersRequest" description: The list of retention filters in the new order. required: true responses: "200": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Re-order retention filters tags: - APM Retention Filters x-codegen-request-body-name: body "x-permission": operator: OR permissions: - apm_retention_filter_write /api/v2/apm/config/retention-filters/{filter_id}: delete: description: |- Delete a specific retention filter from your organization. Default filters with types spans-errors-sampling-processor and spans-appsec-sampling-processor cannot be deleted. operationId: DeleteApmRetentionFilter parameters: - $ref: "#/components/parameters/RetentionFilterIdParam" responses: "200": description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a retention filter tags: - APM Retention Filters "x-permission": operator: OR permissions: - apm_retention_filter_write get: description: Get an APM retention filter. operationId: GetApmRetentionFilter parameters: - $ref: "#/components/parameters/RetentionFilterIdParam" responses: "200": content: application/json: examples: default: value: data: attributes: enabled: true filter: query: "@http.status_code:200 service:my-service" filter_type: spans-sampling-processor name: my retention filter rate: 1.0 id: abc-123 type: apm_retention_filter schema: $ref: "#/components/schemas/RetentionFilterResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a given APM retention filter tags: - APM Retention Filters "x-permission": operator: OR permissions: - apm_retention_filter_read put: description: |- Update a retention filter from your organization. Default filters (filters with types spans-errors-sampling-processor and spans-appsec-sampling-processor) cannot be renamed or removed. operationId: UpdateApmRetentionFilter parameters: - $ref: "#/components/parameters/RetentionFilterIdParam" requestBody: content: application/json: examples: default: value: data: attributes: enabled: true filter: query: "@http.status_code:200 service:my-service" filter_type: spans-sampling-processor name: my retention filter rate: 1.0 trace_rate: 1.0 id: retention-filter-id type: apm_retention_filter schema: $ref: "#/components/schemas/RetentionFilterUpdateRequest" description: The updated definition of the retention filter. required: true responses: "200": content: application/json: examples: default: value: data: attributes: enabled: true filter: query: "@http.status_code:200 service:my-service" filter_type: spans-sampling-processor name: my retention filter rate: 1.0 id: abc-123 type: apm_retention_filter schema: $ref: "#/components/schemas/RetentionFilterResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a retention filter tags: - APM Retention Filters x-codegen-request-body-name: body "x-permission": operator: OR permissions: - apm_retention_filter_write /api/v2/apm/services: get: operationId: GetServiceList parameters: - description: Filter services by environment. Can be set to `*` to return all services across all environments. in: query name: filter[env] required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: metadata: - isTraced: true isUsm: false services: - test-service id: abc-123 type: services_list schema: $ref: "#/components/schemas/ServiceList" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_read summary: Get service list tags: - APM /api/v2/app-builder/apps: delete: description: Delete multiple apps in a single request from a list of app IDs. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). Alternatively, you can configure these permissions [in the UI](https://docs.datadoghq.com/account_management/api-app-keys/#actions-api-access). operationId: DeleteApps requestBody: content: application/json: examples: default: value: data: - id: aea2ed17-b45f-40d0-ba59-c86b7972c901 type: appDefinitions - id: f69bb8be-6168-4fe7-a30d-370256b6504a type: appDefinitions - id: ab1ed73e-13ad-4426-b0df-a0ff8876a088 type: appDefinitions schema: $ref: "#/components/schemas/DeleteAppsRequest" required: true responses: "200": content: application/json: examples: default: value: data: - id: 00000000-0000-0000-0000-000000000001 type: appDefinitions schema: $ref: "#/components/schemas/DeleteAppsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete Multiple Apps tags: - App Builder "x-permission": operator: OR permissions: - apps_write get: description: List all apps, with optional filters and sorting. This endpoint is paginated. Only basic app information such as the app ID, name, and description is returned by this endpoint. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). Alternatively, you can configure these permissions [in the UI](https://docs.datadoghq.com/account_management/api-app-keys/#actions-api-access). operationId: ListApps parameters: - description: The number of apps to return per page. in: query name: limit required: false schema: format: int64 type: integer - description: The page number to return. in: query name: page required: false schema: format: int64 type: integer - description: Filter apps by the app creator. Usually the user's email. in: query name: filter[user_name] required: false schema: type: string - description: Filter apps by the app creator's UUID. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 in: query name: filter[user_uuid] required: false schema: format: uuid type: string - description: Filter by app name. in: query name: filter[name] required: false schema: type: string - description: Filter apps by the app name or the app creator. in: query name: filter[query] required: false schema: type: string - description: Filter apps by whether they are published. in: query name: filter[deployed] required: false schema: type: boolean - description: Filter apps by tags. in: query name: filter[tags] required: false schema: type: string - description: Filter apps by whether you have added them to your favorites. in: query name: filter[favorite] required: false schema: type: boolean - description: Filter apps by whether they are enabled for self-service. in: query name: filter[self_service] required: false schema: type: boolean - description: The fields and direction to sort apps by. explode: false in: query name: sort required: false schema: items: $ref: "#/components/schemas/AppsSortField" type: array style: form responses: "200": content: application/json: examples: default: value: data: - attributes: description: A sample app favorite: false name: My App selfService: false tags: - "team:webshop" id: 00000000-0000-0000-0000-000000000001 type: appDefinitions meta: page: totalCount: 1 totalFilteredCount: 1 schema: $ref: "#/components/schemas/ListAppsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Apps tags: - App Builder "x-permission": operator: OR permissions: - apps_run post: description: Create a new app, returning the app ID. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). Alternatively, you can configure these permissions [in the UI](https://docs.datadoghq.com/account_management/api-app-keys/#actions-api-access). operationId: CreateApp requestBody: content: application/json: examples: default: value: data: attributes: components: [] description: This is a simple example app name: Example App queries: [] rootInstanceName: grid0 type: appDefinitions schema: $ref: "#/components/schemas/CreateAppRequest" required: true responses: "201": content: application/json: examples: default: value: data: id: 00000000-0000-0000-0000-000000000001 type: appDefinitions schema: $ref: "#/components/schemas/CreateAppResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create App tags: - App Builder "x-permission": operator: AND permissions: - apps_write - connections_resolve - workflows_run /api/v2/app-builder/apps/{app_id}: delete: description: Delete a single app. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). Alternatively, you can configure these permissions [in the UI](https://docs.datadoghq.com/account_management/api-app-keys/#actions-api-access). operationId: DeleteApp parameters: - description: The ID of the app to delete. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 in: path name: app_id required: true schema: format: uuid type: string responses: "200": content: application/json: examples: default: value: data: id: 00000000-0000-0000-0000-000000000002 type: appDefinitions schema: $ref: "#/components/schemas/DeleteAppResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "410": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Gone "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete App tags: - App Builder "x-permission": operator: OR permissions: - apps_write get: description: Get the full definition of an app. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). Alternatively, you can configure these permissions [in the UI](https://docs.datadoghq.com/account_management/api-app-keys/#actions-api-access). operationId: GetApp parameters: - description: The ID of the app to retrieve. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 in: path name: app_id required: true schema: format: uuid type: string - description: The version number of the app to retrieve. If not specified, the latest version is returned. Version numbers start at 1 and increment with each update. The special values `latest` and `deployed` can be used to retrieve the latest version or the published version, respectively. in: query name: version required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: components: [] description: A sample app name: Example App queries: [] rootInstanceName: grid0 id: 00000000-0000-0000-0000-000000000001 type: appDefinitions schema: $ref: "#/components/schemas/GetAppResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "410": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Gone "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get App tags: - App Builder "x-permission": operator: AND permissions: - apps_run - connections_read patch: description: Update an existing app. This creates a new version of the app. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). Alternatively, you can configure these permissions [in the UI](https://docs.datadoghq.com/account_management/api-app-keys/#actions-api-access). operationId: UpdateApp parameters: - description: The ID of the app to update. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 in: path name: app_id required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: components: [] description: This is a simple example app name: Example App queries: [] rootInstanceName: grid0 id: 9e20cbaf-68da-45a6-9ccf-54193ac29fa5 type: appDefinitions schema: $ref: "#/components/schemas/UpdateAppRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: components: [] description: This is a simple example app name: Example App queries: [] rootInstanceName: grid0 id: 00000000-0000-0000-0000-000000000001 type: appDefinitions schema: $ref: "#/components/schemas/UpdateAppResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update App tags: - App Builder "x-permission": operator: AND permissions: - apps_write - connections_resolve - workflows_run /api/v2/app-builder/apps/{app_id}/deployment: delete: description: Unpublish an app, removing the live version of the app. Unpublishing creates a new instance of a `deployment` object on the app, with a nil `app_version_id` (`00000000-0000-0000-0000-000000000000`). The app can still be updated and published again in the future. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). Alternatively, you can configure these permissions [in the UI](https://docs.datadoghq.com/account_management/api-app-keys/#actions-api-access). operationId: UnpublishApp parameters: - description: The ID of the app to unpublish. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 in: path name: app_id required: true schema: format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: app_version_id: 00000000-0000-0000-0000-000000000000 id: 00000000-0000-0000-0000-000000000001 type: deployment schema: $ref: "#/components/schemas/UnpublishAppResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Unpublish App tags: - App Builder "x-permission": operator: OR permissions: - apps_write post: description: Publish an app for use by other users. To ensure the app is accessible to the correct users, you also need to set a [Restriction Policy](https://docs.datadoghq.com/api/latest/restriction-policies/) on the app if a policy does not yet exist. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). Alternatively, you can configure these permissions [in the UI](https://docs.datadoghq.com/account_management/api-app-keys/#actions-api-access). operationId: PublishApp parameters: - description: The ID of the app to publish. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 in: path name: app_id required: true schema: format: uuid type: string responses: "201": content: application/json: examples: default: value: data: attributes: app_version_id: 00000000-0000-0000-0000-000000000001 id: 00000000-0000-0000-0000-000000000001 type: deployment schema: $ref: "#/components/schemas/PublishAppResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Publish App tags: - App Builder "x-permission": operator: OR permissions: - apps_write /api/v2/app-builder/apps/{app_id}/favorite: patch: description: Add or remove an app from the current user's favorites. Favorited apps can be filtered for using the `filter[favorite]` query parameter on the [List Apps](https://docs.datadoghq.com/api/latest/app-builder/#list-apps) endpoint. operationId: UpdateAppFavorite parameters: - description: The ID of the app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 in: path name: app_id required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: favorite: true type: favorites schema: $ref: "#/components/schemas/UpdateAppFavoriteRequest" required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update App Favorite Status tags: - App Builder "x-permission": operator: OR permissions: - apps_run /api/v2/app-builder/apps/{app_id}/protection-level: patch: description: Update the publication protection level of an app. When set to `approval_required`, future publishes must go through an approval workflow before going live. operationId: UpdateProtectionLevel parameters: - description: The ID of the app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 in: path name: app_id required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: protectionLevel: approval_required type: protectionLevel schema: $ref: "#/components/schemas/UpdateAppProtectionLevelRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: components: [] description: This is a simple example app favorite: false name: Example App queries: [] rootInstanceName: grid0 tags: [] id: 65bb1f25-52e1-4510-9f8d-22d1516ed693 type: appDefinitions schema: $ref: "#/components/schemas/UpdateAppResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update App Protection Level tags: - App Builder "x-permission": operator: OR permissions: - apps_write /api/v2/app-builder/apps/{app_id}/publish-request: post: description: Create a publish request to ask for approval to publish an app whose protection level is `approval_required`. Publishing happens automatically once the request is approved by a user with the appropriate permissions. operationId: CreatePublishRequest parameters: - description: The ID of the app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 in: path name: app_id required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: description: Adds new dashboard widgets and a few bug fixes. title: Release v1.2 to production type: publishRequest schema: $ref: "#/components/schemas/CreatePublishRequestRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: app_version_id: 9e20cbaf-68da-45a6-9ccf-54193ac29fa5 id: 65bb1f25-52e1-4510-9f8d-22d1516ed693 meta: created_at: "2026-04-01T12:00:00Z" user_name: jane.doe@example.com user_uuid: 65bb1f25-52e1-4510-9f8d-22d1516ed693 type: deployment schema: $ref: "#/components/schemas/PublishAppResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create Publish Request tags: - App Builder "x-permission": operator: OR permissions: - apps_write /api/v2/app-builder/apps/{app_id}/revert: post: description: Revert an app to a previous version. The version to revert to is selected through the `version` query parameter. The reverted version becomes the new latest version of the app. operationId: RevertApp parameters: - description: The ID of the app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 in: path name: app_id required: true schema: format: uuid type: string - description: The version number of the app to revert to. Cannot be `latest`. The special value `deployed` can be used to revert to the currently published version. example: "2" in: query name: version required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: components: [] description: This is a simple example app favorite: false name: Example App queries: [] rootInstanceName: grid0 tags: [] id: 65bb1f25-52e1-4510-9f8d-22d1516ed693 type: appDefinitions schema: $ref: "#/components/schemas/UpdateAppResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Revert App tags: - App Builder "x-permission": operator: OR permissions: - apps_write /api/v2/app-builder/apps/{app_id}/self-service: patch: description: Enable or disable self-service for an app. Self-service apps can be discovered and run by users in your organization without explicit access being granted. operationId: UpdateAppSelfService parameters: - description: The ID of the app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 in: path name: app_id required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: selfService: true type: selfService schema: $ref: "#/components/schemas/UpdateAppSelfServiceRequest" required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update App Self-Service Status tags: - App Builder "x-permission": operator: OR permissions: - apps_write /api/v2/app-builder/apps/{app_id}/tags: patch: description: Replace the tags on an app. The provided list overwrites the existing tags entirely; tags not present in the request body are removed. operationId: UpdateAppTags parameters: - description: The ID of the app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 in: path name: app_id required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: tags: - team:platform - service:ops type: tags schema: $ref: "#/components/schemas/UpdateAppTagsRequest" required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update App Tags tags: - App Builder "x-permission": operator: OR permissions: - apps_write /api/v2/app-builder/apps/{app_id}/version-name: patch: description: Assign a human-readable name to a specific version of an app. The version is selected through the `version` query parameter. operationId: UpdateAppVersionName parameters: - description: The ID of the app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 in: path name: app_id required: true schema: format: uuid type: string - description: The version number of the app to name. The special values `latest` and `deployed` can also be used to target the latest or currently published version. example: "3" in: query name: version required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: name: v1.2.0 - bug fix release type: versionNames schema: $ref: "#/components/schemas/UpdateAppVersionNameRequest" required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Name App Version tags: - App Builder "x-permission": operator: OR permissions: - apps_write /api/v2/app-builder/apps/{app_id}/versions: get: description: List the versions of an app. This endpoint is paginated. operationId: ListAppVersions parameters: - description: The ID of the app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 in: path name: app_id required: true schema: format: uuid type: string - description: The number of versions to return per page. in: query name: limit required: false schema: format: int64 type: integer - description: The page number to return. in: query name: page required: false schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: app_id: 65bb1f25-52e1-4510-9f8d-22d1516ed693 created_at: "2026-04-01T12:00:00Z" has_ever_been_published: true name: v1.2.0 - bug fix release updated_at: "2026-04-01T12:00:00Z" user_name: jane.doe@example.com user_uuid: 65bb1f25-52e1-4510-9f8d-22d1516ed693 version: 3 id: 9e20cbaf-68da-45a6-9ccf-54193ac29fa5 type: appVersions meta: page: totalCount: 1 schema: $ref: "#/components/schemas/ListAppVersionsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List App Versions tags: - App Builder "x-permission": operator: AND permissions: - apps_run - connections_read /api/v2/app-builder/blueprint/{blueprint_id}: get: description: Retrieve an app blueprint by its ID. operationId: GetBlueprint parameters: - description: The ID of the blueprint to retrieve. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 in: path name: blueprint_id required: true schema: format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00Z" definition: {} description: Manage your AWS services from Datadog. name: AWS Service Manager slug: aws-service-manager updated_at: "2024-01-01T00:00:00Z" id: 65bb1f25-52e1-4510-9f8d-22d1516ed693 type: blueprint schema: $ref: "#/components/schemas/GetBlueprintResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get Blueprint tags: - App Builder "x-permission": operator: OR permissions: - apps_run - apps_write - connections_read - connections_write /api/v2/app-builder/blueprints: get: description: List available app blueprints. operationId: ListBlueprints parameters: - description: The number of blueprints to return per page. Defaults to 10. Maximum is 100. in: query name: limit required: false schema: format: int64 type: integer - description: The page of results to return. Starts at 0. in: query name: page required: false schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00Z" description: Manage your AWS services from Datadog. name: AWS Service Manager slug: aws-service-manager updated_at: "2024-01-01T00:00:00Z" id: 65bb1f25-52e1-4510-9f8d-22d1516ed693 type: blueprint schema: $ref: "#/components/schemas/ListBlueprintsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Blueprints tags: - App Builder "x-permission": operator: OR permissions: - apps_run - apps_write - connections_read - connections_write /api/v2/app-builder/blueprints/integration-id/{integration_id}: get: description: List app blueprints associated with a specific integration ID. operationId: GetBlueprintsByIntegrationId parameters: - description: The integration ID to filter blueprints by. example: aws in: path name: integration_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00Z" definition: {} description: Manage your AWS services from Datadog. integration_id: aws name: AWS Service Manager slug: aws-service-manager updated_at: "2024-01-01T00:00:00Z" id: 65bb1f25-52e1-4510-9f8d-22d1516ed693 type: blueprint schema: $ref: "#/components/schemas/GetBlueprintsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get Blueprints by Integration ID tags: - App Builder "x-permission": operator: OR permissions: - apps_run - apps_write - connections_read - connections_write /api/v2/app-builder/blueprints/slugs/{slugs}: get: description: Retrieve app blueprints by their slugs. operationId: GetBlueprintsBySlugs parameters: - description: A comma-separated list of blueprint slugs. example: aws-service-manager in: path name: slugs required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00Z" definition: {} description: Manage your AWS services from Datadog. name: AWS Service Manager slug: aws-service-manager updated_at: "2024-01-01T00:00:00Z" id: 65bb1f25-52e1-4510-9f8d-22d1516ed693 type: blueprint schema: $ref: "#/components/schemas/GetBlueprintsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get Blueprints by Slugs tags: - App Builder "x-permission": operator: OR permissions: - apps_run - apps_write - connections_read - connections_write /api/v2/app-builder/tags: get: description: List all tags associated with the authenticated user's apps. operationId: ListTags responses: "200": content: application/json: examples: default: value: data: - id: production type: tag schema: $ref: "#/components/schemas/AppBuilderListTagsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Tags tags: - App Builder "x-permission": operator: OR permissions: - apps_run /api/v2/application_keys: get: description: List all application keys available for your org operationId: ListApplicationKeys parameters: - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - $ref: "#/components/parameters/ApplicationKeysSortParameter" - $ref: "#/components/parameters/ApplicationKeyFilterParameter" - $ref: "#/components/parameters/ApplicationKeyFilterCreatedAtStartParameter" - $ref: "#/components/parameters/ApplicationKeyFilterCreatedAtEndParameter" - $ref: "#/components/parameters/ApplicationKeyFilterOwnedByParameter" - $ref: "#/components/parameters/ApplicationKeyIncludeParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2020-11-23T10:00:00.000Z" last4: abcd name: Application Key for managing dashboards id: 00000000-0000-0000-0000-000000000001 type: application_keys schema: $ref: "#/components/schemas/ListApplicationKeysResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all application keys tags: - Key Management "x-permission": operator: OR permissions: - org_app_keys_read /api/v2/application_keys/{app_key_id}: delete: description: Delete an application key operationId: DeleteApplicationKey parameters: - $ref: "#/components/parameters/ApplicationKeyID" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an application key tags: - Key Management x-codegen-request-body-name: body "x-permission": operator: OR permissions: - org_app_keys_write get: description: Get an application key for your org. operationId: GetApplicationKey parameters: - $ref: "#/components/parameters/ApplicationKeyID" - $ref: "#/components/parameters/ApplicationKeyIncludeParameter" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2020-11-23T10:00:00.000Z" last4: abcd name: Application Key for managing dashboards id: 00000000-0000-0000-0000-000000000002 type: application_keys schema: $ref: "#/components/schemas/ApplicationKeyResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get an application key tags: - Key Management "x-permission": operator: OR permissions: - org_app_keys_read patch: description: Edit an application key operationId: UpdateApplicationKey parameters: - $ref: "#/components/parameters/ApplicationKeyID" requestBody: content: application/json: examples: default: value: data: attributes: name: Application Key for managing dashboards scopes: - dashboards_read - dashboards_write - dashboards_public_share id: 00112233-4455-6677-8899-aabbccddeeff type: application_keys schema: $ref: "#/components/schemas/ApplicationKeyUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2020-11-23T10:00:00.000Z" last4: abcd name: Application Key for managing dashboards id: 00000000-0000-0000-0000-000000000003 type: application_keys schema: $ref: "#/components/schemas/ApplicationKeyResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Edit an application key tags: - Key Management x-codegen-request-body-name: body "x-permission": operator: OR permissions: - org_app_keys_write /api/v2/audit/events: get: description: |- List endpoint returns events that match a Audit Logs search query. [Results are paginated][1]. Use this endpoint to see your latest Audit Logs events. [1]: https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination operationId: ListAuditLogs parameters: - description: Search query following Audit Logs syntax. example: "@type:session @application_id:xxxx" in: query name: filter[query] required: false schema: type: string - description: Minimum timestamp for requested events. example: "2019-01-02T09:42:36.320Z" in: query name: filter[from] required: false schema: format: date-time type: string - description: Maximum timestamp for requested events. example: "2019-01-03T09:42:36.320Z" in: query name: filter[to] required: false schema: format: date-time type: string - description: Order of events in results. in: query name: sort required: false schema: $ref: "#/components/schemas/AuditLogsSort" - description: |- List following results with a cursor provided in the previous query. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" in: query name: page[cursor] required: false schema: type: string - description: Maximum number of events in the response. example: 25 in: query name: page[limit] required: false schema: default: 10 format: int32 maximum: 1000 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: message: "User logged in" service: web-app tags: - "team:A" timestamp: "2024-01-01T00:00:00+00:00" id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: audit meta: elapsed: 132 request_id: MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR status: done schema: $ref: "#/components/schemas/AuditLogsEventsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a list of Audit Logs events tags: ["Audit"] x-pagination: cursorParam: page[cursor] cursorPath: meta.page.after limitParam: page[limit] resultsPath: data "x-permission": operator: OR permissions: - audit_logs_read /api/v2/audit/events/search: post: description: |- List endpoint returns Audit Logs events that match an Audit search query. [Results are paginated][1]. Use this endpoint to build complex Audit Logs events filtering and search. [1]: https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination operationId: SearchAuditLogs requestBody: content: "application/json": examples: default: value: filter: from: now-15m query: "@type:session AND @session.type:user" to: now options: timezone: GMT page: cursor: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== limit: 25 sort: timestamp schema: $ref: "#/components/schemas/AuditLogsSearchEventsRequest" required: false responses: "200": content: application/json: examples: default: value: data: - attributes: message: "User logged in" service: web-app tags: - team:A timestamp: "2019-01-02T09:42:36.320Z" id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: audit links: next: "https://app.datadoghq.com/api/v2/audit/event?filter[query]=foo&page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" meta: elapsed: 132 request_id: MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR status: done schema: $ref: "#/components/schemas/AuditLogsEventsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Search Audit Logs events tags: ["Audit"] x-codegen-request-body-name: body x-pagination: cursorParam: body.page.cursor cursorPath: meta.page.after limitParam: body.page.limit resultsPath: data "x-permission": operator: OR permissions: - audit_logs_read /api/v2/authn_mappings: get: description: List all AuthN Mappings in the organization. operationId: ListAuthNMappings parameters: - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - description: Sort AuthN Mappings depending on the given field. in: query name: sort required: false schema: $ref: "#/components/schemas/AuthNMappingsSort" - description: Filter all mappings by the given string. in: query name: filter required: false schema: type: string - description: Filter by mapping resource type. Defaults to "role" if not specified. in: query name: resource_type schema: $ref: "#/components/schemas/AuthNMappingResourceType" responses: "200": content: application/json: examples: default: value: data: - attributes: attribute_key: member-of attribute_value: Development id: 00000000-0000-0000-0000-000000000003 type: authn_mappings schema: $ref: "#/components/schemas/AuthNMappingsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List all AuthN Mappings tags: - AuthN Mappings "x-permission": operator: OR permissions: - user_access_read post: description: Create an AuthN Mapping. operationId: CreateAuthNMapping requestBody: content: application/json: examples: default: value: data: attributes: attribute_key: member-of attribute_value: Development type: authn_mappings schema: $ref: "#/components/schemas/AuthNMappingCreateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: attribute_key: member-of attribute_value: Development id: 00000000-0000-0000-0000-000000000004 type: authn_mappings schema: $ref: "#/components/schemas/AuthNMappingResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create an AuthN Mapping tags: - AuthN Mappings x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_manage /api/v2/authn_mappings/{authn_mapping_id}: delete: description: Delete an AuthN Mapping specified by AuthN Mapping UUID. operationId: DeleteAuthNMapping parameters: - $ref: "#/components/parameters/AuthNMappingID" responses: "204": description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an AuthN Mapping tags: - AuthN Mappings "x-permission": operator: OR permissions: - user_access_manage get: description: Get an AuthN Mapping specified by the AuthN Mapping UUID. operationId: GetAuthNMapping parameters: - $ref: "#/components/parameters/AuthNMappingID" responses: "200": content: application/json: examples: default: value: data: attributes: attribute_key: member-of attribute_value: Development id: 00000000-0000-0000-0000-000000000001 type: authn_mappings schema: $ref: "#/components/schemas/AuthNMappingResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get an AuthN Mapping by UUID tags: - AuthN Mappings "x-permission": operator: OR permissions: - user_access_read patch: description: Edit an AuthN Mapping. operationId: UpdateAuthNMapping parameters: - $ref: "#/components/parameters/AuthNMappingID" requestBody: content: application/json: examples: default: value: data: attributes: attribute_key: member-of attribute_value: Development id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: authn_mappings schema: $ref: "#/components/schemas/AuthNMappingUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: attribute_key: member-of attribute_value: Development id: 00000000-0000-0000-0000-000000000002 type: authn_mappings schema: $ref: "#/components/schemas/AuthNMappingResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Conflict "422": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Edit an AuthN Mapping tags: - AuthN Mappings x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_manage /api/v2/bits-ai/investigations: get: description: List all Bits AI investigations for the organization. operationId: ListInvestigations parameters: - description: Offset for pagination. example: 0 in: query name: page[offset] required: false schema: format: int64 type: integer - description: Maximum number of investigations to return. example: 25 in: query name: page[limit] required: false schema: default: 25 format: int64 maximum: 100 type: integer - description: Filter investigations by monitor ID. example: 12345678 in: query name: filter[monitor_id] required: false schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: status: "conclusive" title: "Monitor alert investigation for web-server-01" id: "a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d" type: investigation links: first: "https://api.datadoghq.com/api/v2/bits-ai/investigations?page[offset]=0&page[limit]=10" next: "https://api.datadoghq.com/api/v2/bits-ai/investigations?page[offset]=10&page[limit]=10" self: "https://api.datadoghq.com/api/v2/bits-ai/investigations?page[offset]=0&page[limit]=10" meta: page: limit: 10 offset: 0 total: 50 schema: $ref: "#/components/schemas/ListInvestigationsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - bits_investigations_read summary: List Bits AI investigations tags: - Bits AI x-pagination: limitParam: page[limit] pageOffsetParam: page[offset] resultsPath: data "x-permission": operator: OR permissions: - bits_investigations_read post: description: |- Trigger a Bits AI investigation from a monitor alert or a general investigation. This endpoint requires the `bits_investigations_write` permission. When the trigger type is `monitor_alert_trigger`, the `monitors_read` permission is also required. operationId: TriggerInvestigation requestBody: content: application/json: examples: default: value: data: attributes: trigger: monitor_alert_trigger: event_id: "1234567890123456789" event_ts: 1700000000000 monitor_id: 12345678 type: monitor_alert_trigger type: trigger_investigation_request general_investigation: value: data: attributes: trigger: general_investigation: description: "Checkout latency has been elevated for the past hour." tags: - "service:checkout" type: general_investigation type: trigger_investigation_request schema: $ref: "#/components/schemas/TriggerInvestigationRequest" description: Trigger investigation request body. required: true responses: "200": content: application/json: examples: default: value: data: attributes: investigation_id: "a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d" id: "f5e6a7b8-c9d0-1e2f-3a4b-5c6d7e8f9a0b" type: trigger_investigation_response schema: $ref: "#/components/schemas/TriggerInvestigationResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - bits_investigations_write summary: Trigger a Bits AI investigation tags: - Bits AI x-codegen-request-body-name: body "x-permission": operator: OR permissions: - bits_investigations_write /api/v2/bits-ai/investigations/{id}: get: description: Get a specific Bits AI investigation by ID. operationId: GetInvestigation parameters: - description: The ID of the investigation. example: "a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d" in: path name: id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: conclusions: - description: "The investigation found that a memory leak in payments-service caused CPU usage to spike above 95% starting at 14:32 UTC." summary: "CPU usage exceeded 95% for over 10 minutes on web-server-01." title: "High CPU usage detected on web-server-01" status: "conclusive" title: "Monitor alert investigation for web-server-01" id: "a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d" type: investigation links: self: "https://app.datadoghq.com/bits-ai/investigations/a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d" schema: $ref: "#/components/schemas/GetInvestigationResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - bits_investigations_read summary: Get a Bits AI investigation tags: - Bits AI "x-permission": operator: OR permissions: - bits_investigations_read /api/v2/budgets: get: description: List spend budgets for the organization, including active-window spend and effective capacity. operationId: ListAiGatewayBudgets responses: "200": content: application/json: examples: default: value: data: - attributes: capacity_microcents: 100000000 created_at: "2026-08-24T12:00:00Z" created_by: admin@example.com current_period_capacity_microcents: 100000000 current_spend_microcents: 25000000 enabled: true enforcement: BLOCK monitor_id: 12345678 name: Coding agents tags: {} updated_at: "2026-08-24T12:00:00Z" warning_threshold: 0.9 window_end: "2026-11-01T00:00:00Z" window_policy: MONTHLY window_start: "2026-10-01T00:00:00Z" id: 11111111-1111-1111-1111-111111111111 type: budgets schema: $ref: "#/components/schemas/AiGatewayBudgetListResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: List AI Gateway budgets tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Create a spend budget. Scope tags may include provider, model, and custom dimensions. Reserved metadata keys are rejected. operationId: CreateAiGatewayBudget requestBody: content: application/json: schema: $ref: "#/components/schemas/AiGatewayBudgetCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: capacity_microcents: 100000000 created_at: "2026-08-24T12:00:00Z" created_by: admin@example.com enabled: true enforcement: BLOCK monitor_id: 12345678 name: Coding agents tags: {} updated_at: "2026-08-24T12:00:00Z" warning_threshold: 0.9 window_policy: MONTHLY id: 11111111-1111-1111-1111-111111111111 type: budgets schema: $ref: "#/components/schemas/AiGatewayBudgetResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Create an AI Gateway budget tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/budgets/{id}: delete: description: Archive a spend budget by ID while retaining its accounting history. operationId: DeleteAiGatewayBudget parameters: - $ref: "#/components/parameters/AiGatewayBudgetID" responses: "204": description: No Content "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Archive an AI Gateway budget tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a spend budget by ID, including its capacity, scope, reset window, warning threshold, and enforcement mode. operationId: GetAiGatewayBudget parameters: - $ref: "#/components/parameters/AiGatewayBudgetID" responses: "200": content: application/json: examples: default: value: data: attributes: capacity_microcents: 100000000 created_at: "2026-08-24T12:00:00Z" created_by: admin@example.com enabled: true enforcement: BLOCK monitor_id: 12345678 name: Coding agents tags: {} updated_at: "2026-08-24T12:00:00Z" warning_threshold: 0.9 window_policy: MONTHLY id: 11111111-1111-1111-1111-111111111111 type: budgets schema: $ref: "#/components/schemas/AiGatewayBudgetResponse" description: OK "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: Get an AI Gateway budget tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: |- Update a budget's mutable definition. Capacity changes apply to future accounting periods unless `apply_to_current_period` is true. operationId: UpdateAiGatewayBudget parameters: - $ref: "#/components/parameters/AiGatewayBudgetID" requestBody: content: application/json: schema: $ref: "#/components/schemas/AiGatewayBudgetUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: capacity_microcents: 120000000 created_at: "2026-08-24T12:00:00Z" created_by: admin@example.com enabled: true enforcement: BLOCK monitor_id: 12345678 name: Coding agents tags: {} updated_at: "2026-08-27T12:00:00Z" warning_threshold: 0.8 window_policy: MONTHLY id: 11111111-1111-1111-1111-111111111111 type: budgets schema: $ref: "#/components/schemas/AiGatewayBudgetResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Update an AI Gateway budget tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/budgets/{id}/current-period: get: description: Get the active accounting window, enforced capacity, and current spend. operationId: GetAiGatewayBudgetCurrentPeriod parameters: - $ref: "#/components/parameters/AiGatewayBudgetID" responses: "200": content: application/json: examples: default: value: data: attributes: budget_id: 11111111-1111-1111-1111-111111111111 current_spend_microcents: 25000000 default_capacity_microcents: 100000000 effective_capacity_microcents: 120000000 monitor_id: 12345678 window_end: "2026-08-28T00:00:00Z" window_start: "2026-08-27T00:00:00Z" id: 11111111-1111-1111-1111-111111111111 type: budget-periods schema: $ref: "#/components/schemas/AiGatewayBudgetPeriodResponse" description: OK "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: Get an AI Gateway budget's current period tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/budgets/{id}/instances: get: description: List instance counters for an accounting window. Legacy fixed-scope budgets return one pooled row with an empty instance_key. Omit window to use the current window. Use split_dim to keep only counters that match every given dimension value. operationId: ListAiGatewayBudgetInstances parameters: - $ref: "#/components/parameters/AiGatewayBudgetID" - $ref: "#/components/parameters/AiGatewayBudgetInstanceWindow" - $ref: "#/components/parameters/AiGatewayBudgetInstanceSplitDim" - $ref: "#/components/parameters/AiGatewayBudgetInstanceSort" - $ref: "#/components/parameters/AiGatewayBudgetInstanceLimit" - $ref: "#/components/parameters/AiGatewayBudgetInstanceOffset" responses: "200": content: application/json: examples: default: value: data: - attributes: budget_id: 11111111-1111-1111-1111-111111111111 effective_capacity_microcents: 100000000 instance_key: "" modified_at: "2026-10-05T12:00:00Z" spend_microcents: 25000000 split_dims: {} window_start: "2026-10-01T00:00:00Z" id: 11111111-1111-1111-1111-111111111111|2026-10-01T00:00:00Z| type: budget-instances schema: $ref: "#/components/schemas/AiGatewayBudgetInstanceListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: List AI Gateway budget instances tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/budgets/{id}/instances/capacity: post: description: Override active-period capacity for one instance of a template budget, identified by its instance_key. Other instances and the budget's default capacity are unchanged. The override is retained in the budget adjustment audit history. Returns 404 when the instance has no counter in the active period. Not supported for legacy fixed-scope budgets. operationId: OverrideAiGatewayBudgetInstanceCapacity parameters: - $ref: "#/components/parameters/AiGatewayBudgetID" requestBody: content: application/json: schema: $ref: "#/components/schemas/AiGatewayBudgetInstanceCapacityOverrideRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: budget_id: 11111111-1111-1111-1111-111111111111 effective_capacity_microcents: 250000000 instance_key: "v1|7:user_id=36:22222222-2222-2222-2222-222222222222" modified_at: "2026-10-05T12:00:00Z" spend_microcents: 50000000 split_dims: user_id: 22222222-2222-2222-2222-222222222222 window_start: "2026-10-01T00:00:00Z" id: 11111111-1111-1111-1111-111111111111|2026-10-01T00:00:00Z|v1|7:user_id=36:22222222-2222-2222-2222-222222222222 type: budget-instances schema: $ref: "#/components/schemas/AiGatewayBudgetInstanceResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Override a budget instance's capacity tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/budgets/{id}/instances/dimensions: get: description: Search the values that a template budget's split dimensions take across its instance counters in an accounting window. Each dimension returns its top values by spend, with counter counts. Use query or value to narrow results and limit to cap them. The truncated field reports whether more values matched. Each dimension's values are counted under the other dimensions' split_dim filters, so a dimension's own filter does not hide its alternatives. Legacy fixed-scope budgets return an empty list. operationId: ListAiGatewayBudgetInstanceDimensions parameters: - $ref: "#/components/parameters/AiGatewayBudgetID" - $ref: "#/components/parameters/AiGatewayBudgetInstanceWindow" - $ref: "#/components/parameters/AiGatewayBudgetInstanceSplitDim" - $ref: "#/components/parameters/AiGatewayBudgetInstanceDimension" - $ref: "#/components/parameters/AiGatewayBudgetInstanceDimensionQuery" - $ref: "#/components/parameters/AiGatewayBudgetInstanceDimensionValues" - $ref: "#/components/parameters/AiGatewayBudgetInstanceDimensionLimit" responses: "200": content: application/json: examples: default: value: data: - attributes: budget_id: 11111111-1111-1111-1111-111111111111 dim: tag:env truncated: false values: - instance_count: 2 spend_microcents: 50000000 value: prod - instance_count: 1 spend_microcents: 25000000 value: dev window_start: "2026-10-01T00:00:00Z" id: 11111111-1111-1111-1111-111111111111|2026-10-01T00:00:00Z|tag:env type: budget-instance-dimensions schema: $ref: "#/components/schemas/AiGatewayBudgetInstanceDimensionListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: List AI Gateway budget instance dimension values tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/budgets/{id}/instances/reset: post: description: Reset active-period spend for one instance of a template budget, identified by its instance_key. The reset is retained in the budget adjustment audit history. Returns 404 when the instance has no counter in the active period. Not supported for legacy fixed-scope budgets. operationId: ResetAiGatewayBudgetInstanceSpend parameters: - $ref: "#/components/parameters/AiGatewayBudgetID" requestBody: content: application/json: schema: $ref: "#/components/schemas/AiGatewayBudgetInstanceResetRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: budget_id: 11111111-1111-1111-1111-111111111111 effective_capacity_microcents: 100000000 instance_key: "v1|7:user_id=36:22222222-2222-2222-2222-222222222222" modified_at: "2026-10-05T12:00:00Z" spend_microcents: 0 split_dims: user_id: 22222222-2222-2222-2222-222222222222 window_start: "2026-10-01T00:00:00Z" id: 11111111-1111-1111-1111-111111111111|2026-10-01T00:00:00Z|v1|7:user_id=36:22222222-2222-2222-2222-222222222222 type: budget-instances schema: $ref: "#/components/schemas/AiGatewayBudgetInstanceResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Reset a budget instance's spend tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/budgets/{id}/instances/summary: get: description: Aggregate counters for an accounting window, including total spend and the numbers of instances at or above the warning threshold and capacity. Use split_dim to aggregate only counters that match every given dimension value. operationId: GetAiGatewayBudgetInstancesSummary parameters: - $ref: "#/components/parameters/AiGatewayBudgetID" - $ref: "#/components/parameters/AiGatewayBudgetInstanceWindow" - $ref: "#/components/parameters/AiGatewayBudgetInstanceSplitDim" responses: "200": content: application/json: examples: default: value: data: attributes: budget_id: 11111111-1111-1111-1111-111111111111 exceeded_capacity_count: 0 instance_count: 3 over_warning_threshold_count: 1 total_spend_microcents: 75000000 window_start: "2026-10-01T00:00:00Z" id: 11111111-1111-1111-1111-111111111111 type: budget-instances-summary schema: $ref: "#/components/schemas/AiGatewayBudgetInstancesSummaryResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: Get an AI Gateway budget instance summary tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cases: get: description: >- Search work items. operationId: SearchCases parameters: - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - $ref: "#/components/parameters/CaseSortableFieldParameter" - description: Search query in: query name: filter required: false schema: example: "status:open (team:case-management OR team:event-management)" type: string - description: Specify if order is ascending or not in: query name: sort[asc] required: false schema: default: false type: boolean responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" key: CASEM-1234 priority: NOT_DEFINED status: OPEN status_name: Open title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000001 relationships: project: data: id: 00000000-0000-0000-0000-000000000002 type: project type: case meta: page: current: 1 size: 10 total: 1 schema: $ref: "#/components/schemas/CasesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_read summary: Search cases tags: - Case Management x-pagination: limitParam: page[size] pageParam: page[number] pageStart: 1 resultsPath: data post: description: Create a work item operationId: CreateCase requestBody: content: application/json: examples: default: value: data: attributes: priority: NOT_DEFINED status_name: Open title: Security breach investigation type_id: 3b010bde-09ce-4449-b745-71dd5f861963 relationships: assignee: data: id: 00000000-0000-0000-0000-000000000000 type: user project: data: id: e555e290-ed65-49bd-ae18-8acbfcf18db7 type: project type: case schema: $ref: "#/components/schemas/CaseCreateRequest" description: Work item payload required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" key: CASEM-1234 priority: NOT_DEFINED status: OPEN status_name: Open title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000001 relationships: project: data: id: 00000000-0000-0000-0000-000000000002 type: project type: case schema: $ref: "#/components/schemas/CaseResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Create a case tags: - Case Management /api/v2/cases/aggregate: post: description: Performs an aggregation query over work items, grouping results by specified fields and returning counts per group along with a total. Useful for dashboards and analytics. operationId: AggregateCases requestBody: content: application/json: examples: default: value: data: attributes: group_by: groups: - "status" limit: 14 query_filter: "service:case-api" type: aggregate schema: $ref: "#/components/schemas/CaseAggregateRequest" description: Work item aggregate request payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: groups: - group: OPEN value: - 42.0 total: 100.0 id: agg-result-001 type: aggregate schema: $ref: "#/components/schemas/CaseAggregateResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_read summary: Aggregate cases tags: - Case Management /api/v2/cases/bulk: post: description: Applies a single action (such as changing priority, status, assignment, or archiving) to multiple work items at once. The list of work item IDs and the action type with its payload are specified in the request body. operationId: BulkUpdateCases requestBody: content: application/json: examples: default: value: data: attributes: case_ids: - "case-id-1" - "case-id-2" payload: priority: "P1" type: priority type: bulk schema: $ref: "#/components/schemas/CaseBulkUpdateRequest" description: Work item bulk update request payload. required: true responses: "200": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Bulk update cases tags: - Case Management /api/v2/cases/count: get: description: Returns work item counts, optionally grouped by one or more fields (for example, status, priority). Supports a query filter to narrow the scope. operationId: CountCases parameters: - description: Filter query for work items. in: query name: query_filter required: false schema: type: string - description: Comma-separated fields to group by. example: "status,priority" in: query name: group_bys required: false schema: type: string - description: Maximum facet values to return. in: query name: limit required: false schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: groups: - group: status group_values: - count: 42 value: OPEN id: count-result-001 type: count schema: $ref: "#/components/schemas/CaseCountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_read summary: Count cases tags: - Case Management /api/v2/cases/link: get: description: Returns all links associated with a work item. Links define relationships (for example, BLOCKS) between work items. Requires entity_type and entity_id query parameters. operationId: ListCaseLinks parameters: - description: "The entity type to look up links for. Use `CASE` to find links for a specific work item." in: query name: entity_type required: true schema: example: "CASE" type: string - description: "The UUID of the entity to look up links for." in: query name: entity_id required: true schema: example: "bf0cbac6-4c16-4cfb-b6bf-ca5e0ec37a4f" type: string - description: "Optional filter to only return links of a specific relationship type (for example, `BLOCKS` or `CAUSES`)." in: query name: relationship required: false schema: example: "BLOCKS" type: string responses: "200": content: application/json: examples: default: value: data: - attributes: child_entity_id: 4417921d-0866-4a38-822c-6f2a0f65f77d child_entity_type: CASE parent_entity_id: bf0cbac6-4c16-4cfb-b6bf-ca5e0ec37a4f parent_entity_type: CASE relationship: BLOCKS id: 804cd682-55f6-4541-ab00-b608b282ea7d type: link schema: $ref: "#/components/schemas/CaseLinksResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_read summary: List case links tags: - Case Management post: description: Creates a directional link between two work items (for example, work item A blocks work item B). The parent and child work items and their relationship type must be specified. operationId: CreateCaseLink requestBody: content: application/json: examples: default: value: data: attributes: child_entity_id: 4417921d-0866-4a38-822c-6f2a0f65f77d child_entity_type: CASE parent_entity_id: bf0cbac6-4c16-4cfb-b6bf-ca5e0ec37a4f parent_entity_type: CASE relationship: BLOCKS type: link schema: $ref: "#/components/schemas/CaseLinkCreateRequest" description: "Work item link create request." required: true responses: "201": content: application/json: examples: default: value: data: attributes: child_entity_id: 4417921d-0866-4a38-822c-6f2a0f65f77d child_entity_type: CASE parent_entity_id: bf0cbac6-4c16-4cfb-b6bf-ca5e0ec37a4f parent_entity_type: CASE relationship: BLOCKS id: 804cd682-55f6-4541-ab00-b608b282ea7d type: link schema: $ref: "#/components/schemas/CaseLinkResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Create a case link tags: - Case Management /api/v2/cases/link/{link_id}: delete: description: Deletes an existing link between work items by link ID. operationId: DeleteCaseLink parameters: - $ref: "#/components/parameters/LinkIDPathParameter" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Delete a case link tags: - Case Management /api/v2/cases/projects: get: description: >- Get all projects. operationId: GetProjects responses: "200": content: application/json: examples: default: value: data: - attributes: key: SEC name: Security Investigation id: 00000000-0000-0000-0000-000000000002 type: project schema: $ref: "#/components/schemas/ProjectsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_read summary: Get all projects tags: - Case Management post: description: Create a project. operationId: CreateProject requestBody: content: application/json: examples: default: value: data: attributes: key: SEC name: Security Investigation type: project schema: $ref: "#/components/schemas/ProjectCreateRequest" description: Project payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: key: SEC name: Security Investigation id: 00000000-0000-0000-0000-000000000001 type: project schema: $ref: "#/components/schemas/ProjectResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Create a project tags: - Case Management /api/v2/cases/projects/favorites: get: description: Returns the list of Work Management projects that the current authenticated user has marked as favorites. operationId: ListUserCaseProjectFavorites responses: "200": content: application/json: examples: default: value: data: - id: e555e290-ed65-49bd-ae18-8acbfcf18db7 type: project_favorite schema: $ref: "#/components/schemas/ProjectFavoritesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_read summary: List project favorites tags: - Case Management /api/v2/cases/projects/{project_id}: delete: description: Remove a project using the project's `id`. operationId: DeleteProject parameters: - $ref: "#/components/parameters/ProjectIDPathParameter" responses: "204": description: No Content "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Remove a project tags: - Case Management get: description: >- Get the details of a project by `project_id`. operationId: GetProject parameters: - $ref: "#/components/parameters/ProjectIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: key: SEC name: Security Investigation id: 00000000-0000-0000-0000-000000000003 type: project schema: $ref: "#/components/schemas/ProjectResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_read summary: Get the details of a project tags: - Case Management patch: description: >- Update a project. operationId: UpdateProject parameters: - $ref: "#/components/parameters/ProjectIDPathParameter" requestBody: content: application/json: examples: default: value: data: type: project schema: $ref: "#/components/schemas/ProjectUpdateRequest" description: Project payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: key: SEC name: Security Investigation id: 00000000-0000-0000-0000-000000000004 type: project schema: $ref: "#/components/schemas/ProjectResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Update a project tags: - Case Management /api/v2/cases/projects/{project_id}/favorites: delete: description: Removes a Work Management project from the current user's favorites list. operationId: UnfavoriteCaseProject parameters: - $ref: "#/components/parameters/ProjectIDPathParameter" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Unfavorite a project tags: - Case Management post: description: Marks a Work Management project as a favorite for the current authenticated user. operationId: FavoriteCaseProject parameters: - $ref: "#/components/parameters/ProjectIDPathParameter" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Favorite a project tags: - Case Management /api/v2/cases/projects/{project_id}/notification_rules: get: description: >- Get all notification rules for a project. operationId: GetProjectNotificationRules parameters: - description: Project UUID example: "e555e290-ed65-49bd-ae18-8acbfcf18db7" in: path name: project_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: is_enabled: true query: "" recipients: - data: email: test@example.com type: EMAIL triggers: - data: {} type: CASE_CREATED id: 00000000-0000-0000-0000-000000000001 type: notification_rule schema: $ref: "#/components/schemas/CaseNotificationRulesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_read summary: Get notification rules tags: - Case Management post: description: Create a notification rule for a project. operationId: CreateProjectNotificationRule parameters: - description: Project UUID example: "e555e290-ed65-49bd-ae18-8acbfcf18db7" in: path name: project_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: recipients: - type: EMAIL triggers: - type: CASE_CREATED type: notification_rule schema: $ref: "#/components/schemas/CaseNotificationRuleCreateRequest" description: Notification rule payload required: true responses: "201": content: application/json: examples: default: value: data: attributes: is_enabled: true query: "" recipients: - data: email: test@example.com type: EMAIL triggers: - data: {} type: CASE_CREATED id: 00000000-0000-0000-0000-000000000002 type: notification_rule schema: $ref: "#/components/schemas/CaseNotificationRuleResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Create a notification rule tags: - Case Management /api/v2/cases/projects/{project_id}/notification_rules/{notification_rule_id}: delete: description: Delete a notification rule using the notification rule's `id`. operationId: DeleteProjectNotificationRule parameters: - description: Project UUID example: "e555e290-ed65-49bd-ae18-8acbfcf18db7" in: path name: project_id required: true schema: type: string - $ref: "#/components/parameters/NotificationRuleIDPathParameter" responses: "204": description: No Content "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Delete a notification rule tags: - Case Management put: description: >- Update a notification rule. operationId: UpdateProjectNotificationRule parameters: - description: Project UUID example: "e555e290-ed65-49bd-ae18-8acbfcf18db7" in: path name: project_id required: true schema: type: string - $ref: "#/components/parameters/NotificationRuleIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: recipients: - type: EMAIL triggers: - type: CASE_CREATED type: notification_rule schema: $ref: "#/components/schemas/CaseNotificationRuleUpdateRequest" description: Notification rule payload required: true responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Update a notification rule tags: - Case Management /api/v2/cases/projects/{project_id}/rules: get: description: Returns all automation rules configured for a project. Automation rules allow automatic actions to be triggered by work item events like creation, status transitions, or attribute changes. operationId: ListCaseAutomationRules parameters: - description: The UUID of the project that owns the automation rules. example: "e555e290-ed65-49bd-ae18-8acbfcf18db7" in: path name: project_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: action: data: handle: workflow-handle-123 type: EXECUTE_WORKFLOW created_at: "2024-01-01T00:00:00.000Z" name: Auto-assign workflow state: ENABLED trigger: type: CASE_CREATED id: e6773723-fe58-49ff-9975-dff00f14e28d type: rule schema: $ref: "#/components/schemas/AutomationRulesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_read summary: List automation rules tags: - Case Management post: description: Creates an automation rule for a project. The rule defines a trigger event (for example, work item created, status transitioned) and an action to execute. operationId: CreateCaseAutomationRule parameters: - description: The UUID of the project that owns the automation rules. example: "e555e290-ed65-49bd-ae18-8acbfcf18db7" in: path name: project_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: action: data: handle: workflow-handle-123 type: EXECUTE_WORKFLOW name: Auto-assign workflow state: ENABLED trigger: type: CASE_CREATED type: rule schema: $ref: "#/components/schemas/AutomationRuleCreateRequest" description: Automation rule payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: action: data: handle: workflow-handle-123 type: EXECUTE_WORKFLOW created_at: "2024-01-01T00:00:00.000Z" name: Auto-assign workflow state: ENABLED trigger: type: CASE_CREATED id: e6773723-fe58-49ff-9975-dff00f14e28d type: rule schema: $ref: "#/components/schemas/AutomationRuleResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Create an automation rule tags: - Case Management /api/v2/cases/projects/{project_id}/rules/{rule_id}: delete: description: Permanently deletes an automation rule from a project. operationId: DeleteCaseAutomationRule parameters: - description: The UUID of the project that owns the automation rules. example: "e555e290-ed65-49bd-ae18-8acbfcf18db7" in: path name: project_id required: true schema: type: string - $ref: "#/components/parameters/RuleIDPathParameter" responses: "204": description: No Content "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Delete an automation rule tags: - Case Management get: description: Returns a single automation rule identified by its UUID, including its trigger, action, and current state (enabled/disabled). operationId: GetCaseAutomationRule parameters: - description: The UUID of the project that owns the automation rules. example: "e555e290-ed65-49bd-ae18-8acbfcf18db7" in: path name: project_id required: true schema: type: string - $ref: "#/components/parameters/RuleIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: action: data: handle: workflow-handle-123 type: EXECUTE_WORKFLOW created_at: "2024-01-01T00:00:00.000Z" name: Auto-assign workflow state: ENABLED trigger: type: CASE_CREATED id: e6773723-fe58-49ff-9975-dff00f14e28d type: rule schema: $ref: "#/components/schemas/AutomationRuleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_read summary: Get an automation rule tags: - Case Management put: description: Updates the trigger, action, name, or state of an existing automation rule. operationId: UpdateCaseAutomationRule parameters: - description: The UUID of the project that owns the automation rules. example: "e555e290-ed65-49bd-ae18-8acbfcf18db7" in: path name: project_id required: true schema: type: string - $ref: "#/components/parameters/RuleIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: action: data: handle: workflow-handle-123 type: EXECUTE_WORKFLOW name: Auto-assign workflow state: ENABLED trigger: type: CASE_CREATED type: rule schema: $ref: "#/components/schemas/AutomationRuleUpdateRequest" description: Automation rule payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: action: data: handle: workflow-handle-123 type: EXECUTE_WORKFLOW created_at: "2024-01-01T00:00:00.000Z" name: Auto-assign workflow state: ENABLED trigger: type: CASE_CREATED id: e6773723-fe58-49ff-9975-dff00f14e28d type: rule schema: $ref: "#/components/schemas/AutomationRuleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Update an automation rule tags: - Case Management /api/v2/cases/projects/{project_id}/rules/{rule_id}/disable: post: description: Disables an automation rule so it no longer triggers on work item events. The rule configuration is preserved. operationId: DisableCaseAutomationRule parameters: - description: The UUID of the project that owns the automation rules. example: "e555e290-ed65-49bd-ae18-8acbfcf18db7" in: path name: project_id required: true schema: type: string - $ref: "#/components/parameters/RuleIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: action: data: handle: workflow-handle-123 type: EXECUTE_WORKFLOW created_at: "2024-01-01T00:00:00.000Z" name: Auto-assign workflow state: DISABLED trigger: type: CASE_CREATED id: e6773723-fe58-49ff-9975-dff00f14e28d type: rule schema: $ref: "#/components/schemas/AutomationRuleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Disable an automation rule tags: - Case Management /api/v2/cases/projects/{project_id}/rules/{rule_id}/enable: post: description: Enables a previously disabled automation rule so it triggers on matching work item events. operationId: EnableCaseAutomationRule parameters: - description: The UUID of the project that owns the automation rules. example: "e555e290-ed65-49bd-ae18-8acbfcf18db7" in: path name: project_id required: true schema: type: string - $ref: "#/components/parameters/RuleIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: action: data: handle: workflow-handle-123 type: EXECUTE_WORKFLOW created_at: "2024-01-01T00:00:00.000Z" name: Auto-assign workflow state: ENABLED trigger: type: CASE_CREATED id: e6773723-fe58-49ff-9975-dff00f14e28d type: rule schema: $ref: "#/components/schemas/AutomationRuleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Enable an automation rule tags: - Case Management /api/v2/cases/types: get: description: Get all work item types operationId: GetAllCaseTypes responses: "200": content: application/json: examples: default: value: data: - attributes: description: Investigations done in case management emoji: "🕵🏻‍♂️" name: Investigation id: 00000000-0000-0000-0000-000000000001 type: case_type schema: $ref: "#/components/schemas/CaseTypesResponse" description: OK "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all case types tags: - Case Management Type post: description: Create a work item type. operationId: CreateCaseType requestBody: content: application/json: examples: default: value: data: attributes: description: Investigations done in case management emoji: 🕵🏻‍♂️ name: Investigation type: case_type schema: $ref: "#/components/schemas/CaseTypeCreateRequest" description: Work item type payload required: true responses: "201": content: application/json: examples: default: value: data: attributes: description: Investigations done in case management emoji: "🕵🏻‍♂️" name: Investigation id: 00000000-0000-0000-0000-000000000001 type: case_type schema: $ref: "#/components/schemas/CaseTypeResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a case type tags: - Case Management Type /api/v2/cases/types/custom_attributes: get: description: Get all custom attributes operationId: GetAllCustomAttributes responses: "200": content: application/json: examples: default: value: data: - attributes: case_type_id: 00000000-0000-0000-0000-000000000002 description: "AWS Region, must be a valid region supported by AWS" display_name: AWS Region is_multi: true key: aws_region type: TEXT id: 00000000-0000-0000-0000-000000000001 type: custom_attribute schema: $ref: "#/components/schemas/CustomAttributeConfigsResponse" description: OK "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all custom attributes tags: - Case Management Attribute /api/v2/cases/types/{case_type_id}: delete: description: Delete a work item type operationId: DeleteCaseType parameters: - $ref: "#/components/parameters/CaseTypeIDPathParameter" responses: "204": description: No Content "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a case type tags: - Case Management Type put: description: Updates the name, emoji, or description of an existing work item type. operationId: UpdateCaseType parameters: - $ref: "#/components/parameters/CaseTypeIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: description: Investigations done in case management emoji: "🕵🏻‍♂️" name: Investigation type: case_type schema: $ref: "#/components/schemas/CaseTypeUpdateRequest" description: Work item type payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: description: Investigations done in case management emoji: "🕵🏻‍♂️" name: Investigation id: 00000000-0000-0000-0000-000000000001 type: case_type schema: $ref: "#/components/schemas/CaseTypeResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_shared_settings_write summary: Update a case type tags: - Case Management Type /api/v2/cases/types/{case_type_id}/custom_attributes: get: description: Get custom attribute configurations for a work item type. operationId: GetAllCustomAttributeConfigsByCaseType parameters: - $ref: "#/components/parameters/CaseTypeIDPathParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: case_type_id: 00000000-0000-0000-0000-000000000004 description: "AWS Region, must be a valid region supported by AWS" display_name: AWS Region is_multi: true key: aws_region type: TEXT id: 00000000-0000-0000-0000-000000000003 type: custom_attribute schema: $ref: "#/components/schemas/CustomAttributeConfigsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all custom attributes config of case type tags: - Case Management Attribute post: description: Create a custom attribute configuration for a work item type. operationId: CreateCustomAttributeConfig parameters: - $ref: "#/components/parameters/CaseTypeIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: description: AWS Region, must be a valid region supported by AWS display_name: AWS Region is_multi: true key: aws_region type: NUMBER type: custom_attribute schema: $ref: "#/components/schemas/CustomAttributeConfigCreateRequest" description: Custom attribute config payload required: true responses: "201": content: application/json: examples: default: value: data: attributes: case_type_id: 00000000-0000-0000-0000-000000000006 description: "AWS Region, must be a valid region supported by AWS" display_name: AWS Region is_multi: true key: aws_region type: TEXT id: 00000000-0000-0000-0000-000000000005 type: custom_attribute schema: $ref: "#/components/schemas/CustomAttributeConfigResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create custom attribute config for a case type tags: - Case Management Attribute /api/v2/cases/types/{case_type_id}/custom_attributes/{custom_attribute_id}: delete: description: Delete custom attribute config operationId: DeleteCustomAttributeConfig parameters: - $ref: "#/components/parameters/CaseTypeIDPathParameter" - $ref: "#/components/parameters/CaseCustomAttributeIDPathParameter" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete custom attributes config tags: - Case Management Attribute put: description: Updates the display name, description, type, or options of an existing custom attribute configuration for a work item type. operationId: UpdateCustomAttributeConfig parameters: - $ref: "#/components/parameters/CaseTypeIDPathParameter" - $ref: "#/components/parameters/CaseCustomAttributeIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: description: Updated description. display_name: AWS Region type: custom_attribute schema: $ref: "#/components/schemas/CustomAttributeConfigUpdateRequest" description: Custom attribute config payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: case_type_id: 00000000-0000-0000-0000-000000000006 description: Updated description. display_name: AWS Region is_multi: true key: aws_region type: TEXT id: 00000000-0000-0000-0000-000000000005 type: custom_attribute schema: $ref: "#/components/schemas/CustomAttributeConfigResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_shared_settings_write summary: Update custom attribute config tags: - Case Management Attribute /api/v2/cases/views: get: description: Returns all saved work item views for a given project. Views are saved search queries that allow quick access to filtered lists of work items. operationId: ListCaseViews parameters: - description: Filter views by project identifier. example: e555e290-ed65-49bd-ae18-8acbfcf18db7 in: query name: project_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00.000Z" name: Open bugs query: "status:open type:bug" id: a1b2c3d4-e5f6-7890-abcd-ef1234567890 type: view schema: $ref: "#/components/schemas/CaseViewsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_read summary: List case views tags: - Case Management post: description: Creates a new saved work item view with a name, filter query, and associated project. Optionally, a notification rule can be linked to the view. operationId: CreateCaseView requestBody: content: application/json: examples: default: value: data: attributes: name: Open bugs project_id: e555e290-ed65-49bd-ae18-8acbfcf18db7 query: "status:open type:bug" type: view schema: $ref: "#/components/schemas/CaseViewCreateRequest" description: Work item view payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00.000Z" name: Open bugs query: "status:open type:bug" id: a1b2c3d4-e5f6-7890-abcd-ef1234567890 type: view schema: $ref: "#/components/schemas/CaseViewResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Create a case view tags: - Case Management /api/v2/cases/views/{view_id}: delete: description: Permanently deletes a saved work item view. operationId: DeleteCaseView parameters: - $ref: "#/components/parameters/ViewIDPathParameter" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Delete a case view tags: - Case Management get: description: Returns a single saved work item view identified by its UUID, including its query, associated project, and timestamps. operationId: GetCaseView parameters: - $ref: "#/components/parameters/ViewIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00.000Z" name: Open bugs query: "status:open type:bug" id: a1b2c3d4-e5f6-7890-abcd-ef1234567890 type: view schema: $ref: "#/components/schemas/CaseViewResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_read summary: Get a case view tags: - Case Management put: description: Updates the name, query, or notification rule of an existing work item view. operationId: UpdateCaseView parameters: - $ref: "#/components/parameters/ViewIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: name: Updated view name type: view schema: $ref: "#/components/schemas/CaseViewUpdateRequest" description: Work item view payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00.000Z" name: Updated view name query: "status:open type:bug" id: a1b2c3d4-e5f6-7890-abcd-ef1234567890 type: view schema: $ref: "#/components/schemas/CaseViewResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Update a case view tags: - Case Management /api/v2/cases/{case_id}: get: description: >- Get the details of a work item by `case_id`. operationId: GetCase parameters: - $ref: "#/components/parameters/CaseIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" key: CASEM-1234 priority: NOT_DEFINED status: OPEN status_name: Open title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000001 relationships: project: data: id: 00000000-0000-0000-0000-000000000002 type: project type: case schema: $ref: "#/components/schemas/CaseResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_read summary: Get the details of a case tags: - Case Management /api/v2/cases/{case_id}/archive: post: description: Archive work item operationId: ArchiveCase parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: type: case schema: $ref: "#/components/schemas/CaseEmptyRequest" description: Archive work item payload required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" key: CASEM-1234 priority: NOT_DEFINED status: OPEN status_name: Open title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000001 relationships: project: data: id: 00000000-0000-0000-0000-000000000002 type: project type: case schema: $ref: "#/components/schemas/CaseResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Archive case tags: - Case Management /api/v2/cases/{case_id}/assign: post: description: Assign work item to a user operationId: AssignCase parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: assignee_id: f98a5a5b-e0ff-45d4-b2f5-afe6e74de504 type: case schema: $ref: "#/components/schemas/CaseAssignRequest" description: Assign work item payload required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" key: CASEM-1234 priority: NOT_DEFINED status: OPEN status_name: Open title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000001 relationships: project: data: id: 00000000-0000-0000-0000-000000000002 type: project type: case schema: $ref: "#/components/schemas/CaseResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Assign case tags: - Case Management /api/v2/cases/{case_id}/attributes: post: description: Update work item attributes operationId: UpdateAttributes parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: attributes: env: - prod service: - web-store - web-api team: - engineering type: case schema: $ref: "#/components/schemas/CaseUpdateAttributesRequest" description: Work item attributes update payload required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" key: CASEM-1234 priority: NOT_DEFINED status: OPEN status_name: Open title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000001 relationships: project: data: id: 00000000-0000-0000-0000-000000000002 type: project type: case schema: $ref: "#/components/schemas/CaseResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Update case attributes tags: - Case Management /api/v2/cases/{case_id}/comment: post: description: Add a comment to a work item. operationId: CommentCase parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: comment: This is my comment ! type: case schema: $ref: "#/components/schemas/CaseCommentRequest" description: Work item comment payload required: true responses: "200": content: application/json: examples: default: value: data: - attributes: cell_content: message: This is my comment ! created_at: "2024-01-01T00:00:00+00:00" type: COMMENT id: 00000000-0000-0000-0000-000000000001 type: timeline_cell schema: $ref: "#/components/schemas/TimelineResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Comment case tags: - Case Management /api/v2/cases/{case_id}/comment/{cell_id}: delete: description: Delete work item comment operationId: DeleteCaseComment parameters: - $ref: "#/components/parameters/CaseIDPathParameter" - $ref: "#/components/parameters/CellIDPathParameter" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete case comment tags: - Case Management put: description: Updates the text content of an existing comment on a work item timeline. The comment is identified by its cell ID. operationId: UpdateCaseComment parameters: - $ref: "#/components/parameters/CaseIDPathParameter" - $ref: "#/components/parameters/CellIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: comment: Updated comment text type: case schema: $ref: "#/components/schemas/CaseUpdateCommentRequest" description: Work item update comment payload. required: true responses: "200": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Update case comment tags: - Case Management /api/v2/cases/{case_id}/custom_attributes/{custom_attribute_key}: delete: description: Delete custom attribute from work item operationId: DeleteCaseCustomAttribute parameters: - $ref: "#/components/parameters/CaseIDPathParameter" - $ref: "#/components/parameters/CaseCustomAttributeKeyPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" key: CASEM-1234 priority: NOT_DEFINED status: OPEN status_name: Open title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000001 relationships: project: data: id: 00000000-0000-0000-0000-000000000002 type: project type: case schema: $ref: "#/components/schemas/CaseResponse" description: OK "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Delete custom attribute from case tags: - Case Management post: description: Update work item custom attribute operationId: UpdateCaseCustomAttribute parameters: - $ref: "#/components/parameters/CaseIDPathParameter" - $ref: "#/components/parameters/CaseCustomAttributeKeyPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: is_multi: false type: NUMBER value: 42 type: case schema: $ref: "#/components/schemas/CaseUpdateCustomAttributeRequest" description: Update work item custom attribute payload required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" key: CASEM-1234 priority: NOT_DEFINED status: OPEN status_name: Open title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000001 relationships: project: data: id: 00000000-0000-0000-0000-000000000002 type: project type: case schema: $ref: "#/components/schemas/CaseResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Update case custom attribute tags: - Case Management /api/v2/cases/{case_id}/description: post: description: Update work item description operationId: UpdateCaseDescription parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: description: Seeing some weird memory increase... We shouldn't ignore this type: case schema: $ref: "#/components/schemas/CaseUpdateDescriptionRequest" description: Work item description update payload required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" key: CASEM-1234 priority: NOT_DEFINED status: OPEN status_name: Open title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000001 relationships: project: data: id: 00000000-0000-0000-0000-000000000002 type: project type: case schema: $ref: "#/components/schemas/CaseResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Update case description tags: - Case Management /api/v2/cases/{case_id}/due_date: post: description: Sets or updates the due date for a work item. The due date is a calendar date (without a time component) indicating when the work item should be resolved. operationId: UpdateCaseDueDate parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: due_date: "2026-12-31" type: case schema: $ref: "#/components/schemas/CaseUpdateDueDateRequest" description: Work item due date update payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" key: CASEM-1234 priority: NOT_DEFINED status: OPEN status_name: Open title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000001 relationships: project: data: id: 00000000-0000-0000-0000-000000000002 type: project type: case schema: $ref: "#/components/schemas/CaseResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Update case due date tags: - Case Management /api/v2/cases/{case_id}/insights: delete: description: Removes one or more previously added insights from a work item by specifying their type and resource identifier in the request body. operationId: RemoveCaseInsights parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: insights: - ref: "/monitors/12345?q=total" resource_id: "12345" type: SECURITY_SIGNAL type: case schema: $ref: "#/components/schemas/CaseInsightsRequest" description: Work item insights request. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" key: CASEM-1234 priority: NOT_DEFINED status: OPEN status_name: Open title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000001 relationships: project: data: id: 00000000-0000-0000-0000-000000000002 type: project type: case schema: $ref: "#/components/schemas/CaseResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Remove insights from a case tags: - Case Management put: description: >- Adds one or more insights to a work item. Insights are references to related Datadog resources (such as monitors, security signals, incidents, or error tracking issues) that provide investigative context. Up to 100 insights can be added per request. Each insight requires a type (see `CaseInsightType` for allowed values), a ref (URL path to the resource), and a resource_id. operationId: AddCaseInsights parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: insights: - ref: "/monitors/12345?q=total" resource_id: "12345" type: SECURITY_SIGNAL type: case schema: $ref: "#/components/schemas/CaseInsightsRequest" description: Work item insights request. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" key: CASEM-1234 priority: NOT_DEFINED status: OPEN status_name: Open title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000001 relationships: project: data: id: 00000000-0000-0000-0000-000000000002 type: project type: case schema: $ref: "#/components/schemas/CaseResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Add insights to a case tags: - Case Management /api/v2/cases/{case_id}/priority: post: description: Update work item priority operationId: UpdatePriority parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: priority: NOT_DEFINED type: case schema: $ref: "#/components/schemas/CaseUpdatePriorityRequest" description: Work item priority update payload required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" key: CASEM-1234 priority: NOT_DEFINED status: OPEN status_name: Open title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000001 relationships: project: data: id: 00000000-0000-0000-0000-000000000002 type: project type: case schema: $ref: "#/components/schemas/CaseResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Update case priority tags: - Case Management /api/v2/cases/{case_id}/relationships/incidents: post: description: Link an incident to a work item operationId: LinkIncident parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: id: 00000000-0000-0000-0000-000000000000 type: incidents schema: $ref: "#/components/schemas/RelationshipToIncidentRequest" description: Incident link request required: true responses: "201": content: application/json: examples: default: value: data: attributes: key: CASEM-4523 priority: NOT_DEFINED status: OPEN title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000002 type: case schema: $ref: "#/components/schemas/CaseResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Link incident to case tags: - Case Management /api/v2/cases/{case_id}/relationships/jira_issues: delete: description: Remove the link between a Jira issue and a work item operationId: UnlinkJiraIssue parameters: - $ref: "#/components/parameters/CaseIDPathParameter" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Remove Jira issue link from case tags: - Case Management patch: description: Link an existing Jira issue to a work item operationId: LinkJiraIssueToCase parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: jira_issue_url: https://jira.example.com/browse/PROJ-123 type: issues schema: $ref: "#/components/schemas/JiraIssueLinkRequest" description: Jira issue link request required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Link existing Jira issue to case tags: - Case Management post: description: Create a new Jira issue and link it to a work item operationId: CreateCaseJiraIssue parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: fields: {} issue_type_id: "10001" jira_account_id: "1234" project_id: "5678" type: issues schema: $ref: "#/components/schemas/JiraIssueCreateRequest" description: Jira issue creation request required: true responses: "202": description: Accepted "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Create Jira issue for case tags: - Case Management /api/v2/cases/{case_id}/relationships/notebook: post: description: Create a new investigation notebook and link it to a work item operationId: CreateCaseNotebook parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: type: notebook schema: $ref: "#/components/schemas/CaseInvestigationNotebookCreateRequest" description: Case investigation notebook creation request. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Create investigation notebook for case tags: - Case Management /api/v2/cases/{case_id}/relationships/project: patch: description: Update the project associated with a work item operationId: MoveCaseToProject parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: id: e555e290-ed65-49bd-ae18-8acbfcf18db7 type: project schema: $ref: "#/components/schemas/ProjectRelationship" description: Project update request required: true responses: "200": content: application/json: examples: default: value: data: attributes: key: CASEM-4523 priority: NOT_DEFINED status: OPEN title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000001 type: case schema: $ref: "#/components/schemas/CaseResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Update case project tags: - Case Management /api/v2/cases/{case_id}/relationships/servicenow_tickets: post: description: Create a new ServiceNow incident ticket and link it to a work item operationId: CreateCaseServiceNowTicket parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: assignment_group: IT Support instance_name: my-instance type: tickets schema: $ref: "#/components/schemas/ServiceNowTicketCreateRequest" description: ServiceNow ticket creation request required: true responses: "202": description: Accepted "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Create ServiceNow ticket for case tags: - Case Management /api/v2/cases/{case_id}/resolved_reason: post: description: Sets the resolved reason for a security work item (for example, FALSE_POSITIVE, TRUE_POSITIVE). Applicable to security-type work items. operationId: UpdateCaseResolvedReason parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: security_resolved_reason: "FALSE_POSITIVE" type: case schema: $ref: "#/components/schemas/CaseUpdateResolvedReasonRequest" description: Work item resolved reason update payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" key: CASEM-1234 priority: NOT_DEFINED status: OPEN status_name: Open title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000001 relationships: project: data: id: 00000000-0000-0000-0000-000000000002 type: project type: case schema: $ref: "#/components/schemas/CaseResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Update case resolved reason tags: - Case Management /api/v2/cases/{case_id}/status: post: description: Update work item status operationId: UpdateStatus parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: status: OPEN status_name: Open type: case schema: $ref: "#/components/schemas/CaseUpdateStatusRequest" description: Work item status update payload required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" key: CASEM-1234 priority: NOT_DEFINED status: OPEN status_name: Open title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000001 relationships: project: data: id: 00000000-0000-0000-0000-000000000002 type: project type: case schema: $ref: "#/components/schemas/CaseResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Update case status tags: - Case Management /api/v2/cases/{case_id}/timelines: get: description: Returns the timeline of events for a work item, including comments, status changes, and other activity. Supports pagination and sort order. operationId: ListCaseTimeline parameters: - $ref: "#/components/parameters/CaseIDPathParameter" - description: Number of timeline cells to return per page. in: query name: page[size] required: false schema: default: 100 format: int64 type: integer - description: Zero-based page number for pagination. in: query name: page[number] required: false schema: default: 0 format: int64 type: integer - description: "If `true`, returns timeline cells in chronological order (oldest first). Defaults to `false` (newest first)." in: query name: sort[ascending] required: false schema: default: false type: boolean responses: "200": content: application/json: examples: default: value: data: - attributes: cell_content: message: This is a comment created_at: "2024-01-01T00:00:00+00:00" type: COMMENT id: 00000000-0000-0000-0000-000000000001 type: timeline_cell schema: $ref: "#/components/schemas/TimelineResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_read summary: Get case timeline tags: - Case Management /api/v2/cases/{case_id}/title: post: description: Update work item title operationId: UpdateCaseTitle parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: title: Memory leak investigation on API type: case schema: $ref: "#/components/schemas/CaseUpdateTitleRequest" description: Work item title update payload required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" key: CASEM-1234 priority: NOT_DEFINED status: OPEN status_name: Open title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000001 relationships: project: data: id: 00000000-0000-0000-0000-000000000002 type: project type: case schema: $ref: "#/components/schemas/CaseResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Update case title tags: - Case Management /api/v2/cases/{case_id}/unarchive: post: description: Unarchive work item operationId: UnarchiveCase parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: type: case schema: $ref: "#/components/schemas/CaseEmptyRequest" description: Unarchive work item payload required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" key: CASEM-1234 priority: NOT_DEFINED status: OPEN status_name: Open title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000001 relationships: project: data: id: 00000000-0000-0000-0000-000000000002 type: project type: case schema: $ref: "#/components/schemas/CaseResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Unarchive case tags: - Case Management /api/v2/cases/{case_id}/unassign: post: description: Unassign work item operationId: UnassignCase parameters: - $ref: "#/components/parameters/CaseIDPathParameter" requestBody: content: application/json: examples: default: value: data: type: case schema: $ref: "#/components/schemas/CaseEmptyRequest" description: Unassign work item payload required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" key: CASEM-1234 priority: NOT_DEFINED status: OPEN status_name: Open title: Memory leak investigation on API id: 00000000-0000-0000-0000-000000000001 relationships: project: data: id: 00000000-0000-0000-0000-000000000002 type: project type: case schema: $ref: "#/components/schemas/CaseResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Unassign case tags: - Case Management /api/v2/cases/{case_id}/watchers: get: description: Returns the list of users who are watching a work item. Watchers receive notifications about updates to the work item. operationId: ListCaseWatchers parameters: - $ref: "#/components/parameters/CaseIDPathParameter" responses: "200": content: application/json: examples: default: value: data: - id: 8146583c-0b5f-11ec-abf8-da7ad0900001 relationships: user: data: id: 8146583c-0b5f-11ec-abf8-da7ad0900001 type: user type: watcher schema: $ref: "#/components/schemas/CaseWatchersResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_read summary: List case watchers tags: - Case Management /api/v2/cases/{case_id}/watchers/{user_uuid}: delete: description: Removes a user from the watchers list of a work item. The user no longer receives notifications about updates to the work item. operationId: UnwatchCase parameters: - $ref: "#/components/parameters/CaseIDPathParameter" - $ref: "#/components/parameters/UserUUIDPathParameter" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Unwatch a case tags: - Case Management post: description: Adds a user (identified by their UUID) as a watcher of a work item. The user receives notifications about subsequent updates to the work item. operationId: WatchCase parameters: - $ref: "#/components/parameters/CaseIDPathParameter" - $ref: "#/components/parameters/UserUUIDPathParameter" responses: "201": description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Watch a case tags: - Case Management /api/v2/catalog/entity: get: description: Get a list of entities from Software Catalog. operationId: ListCatalogEntity parameters: - $ref: "#/components/parameters/PageOffset" - description: Maximum number of entities in the response. example: 100 in: query name: page[limit] required: false schema: default: 100 format: int64 type: integer - $ref: "#/components/parameters/FilterByID" - $ref: "#/components/parameters/FilterByRef" - $ref: "#/components/parameters/FilterByName" - $ref: "#/components/parameters/FilterByKind" - $ref: "#/components/parameters/FilterByOwner" - $ref: "#/components/parameters/FilterByRelationType" - $ref: "#/components/parameters/FilterByExcludeSnapshot" - $ref: "#/components/parameters/Include" - description: If true, includes discovered services from APM and USM that do not have entity definitions. in: query name: includeDiscovered required: false schema: default: false type: boolean responses: "200": content: application/json: examples: default: value: data: - attributes: apiVersion: v3 kind: service name: myService namespace: default id: 4b163705-23c0-4573-b2fb-f6cea2163fcb type: entity meta: count: 1 includeCount: 0 schema: $ref: "#/components/schemas/ListEntityCatalogResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_read summary: Get a list of entities tags: - Software Catalog x-pagination: limitParam: page[limit] pageOffsetParam: page[offset] resultsPath: data post: description: Create or update entities in Software Catalog. operationId: UpsertCatalogEntity requestBody: content: application/json: examples: default: value: apiVersion: v3 integrations: opsgenie: serviceURL: https://www.opsgenie.com/service/shopping-cart pagerduty: serviceURL: https://www.pagerduty.com/service-directory/Pshopping-cart kind: service metadata: additionalOwners: - name: "" contacts: - contact: https://slack/ type: slack id: 4b163705-23c0-4573-b2fb-f6cea2163fcb inheritFrom: application:default/myapp links: - name: mylink type: link url: https://mylink name: myService namespace: default tags: - this:tag - that:tag schema: $ref: "#/components/schemas/UpsertCatalogEntityRequest" description: Entity YAML or JSON. required: true responses: "202": content: application/json: examples: default: value: data: - attributes: apiVersion: v3 kind: service name: myService namespace: default id: 4b163705-23c0-4573-b2fb-f6cea2163fcb type: entity meta: count: 1 includeCount: 0 schema: $ref: "#/components/schemas/UpsertCatalogEntityResponse" description: ACCEPTED "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_write summary: Create or update entities tags: - Software Catalog x-codegen-request-body-name: body /api/v2/catalog/entity/preview: post: operationId: PreviewCatalogEntities responses: "202": content: application/json: examples: default: value: data: - id: 4b163705-23c0-4573-b2fb-f6cea2163fcb type: entity schema: $ref: "#/components/schemas/EntityResponseArray" description: Accepted "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_read summary: Preview catalog entities tags: - Software Catalog /api/v2/catalog/entity/{entity_id}: delete: description: Delete a single entity in Software Catalog. operationId: DeleteCatalogEntity parameters: - $ref: "#/components/parameters/EntityID" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_write summary: Delete a single entity tags: - Software Catalog /api/v2/catalog/kind: get: description: Get a list of entity kinds from Software Catalog. operationId: ListCatalogKind parameters: - $ref: "#/components/parameters/PageOffset" - description: Maximum number of kinds in the response. example: 100 in: query name: page[limit] required: false schema: default: 100 format: int64 type: integer - $ref: "#/components/parameters/FilterByID" - $ref: "#/components/parameters/FilterByName" responses: "200": content: application/json: examples: default: value: data: - attributes: description: A job entity in the catalog. displayName: My Job name: my-job id: 4b163705-23c0-4573-b2fb-f6cea2163fcb type: kind meta: count: 1 schema: $ref: "#/components/schemas/ListKindCatalogResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_read summary: Get a list of entity kinds tags: - Software Catalog x-pagination: limitParam: page[limit] pageOffsetParam: page[offset] resultsPath: data post: description: Create or update kinds in Software Catalog. operationId: UpsertCatalogKind requestBody: content: application/json: examples: default: value: kind: my-job schema: $ref: "#/components/schemas/UpsertCatalogKindRequest" description: Kind YAML or JSON. required: true responses: "202": content: application/json: examples: default: value: data: - attributes: description: A job entity in the catalog. displayName: My Job name: my-job id: 4b163705-23c0-4573-b2fb-f6cea2163fcb type: kind meta: count: 1 schema: $ref: "#/components/schemas/UpsertCatalogKindResponse" description: ACCEPTED "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_write summary: Create or update kinds tags: - Software Catalog x-codegen-request-body-name: body /api/v2/catalog/kind/{kind_id}: delete: description: Delete a single kind in Software Catalog. operationId: DeleteCatalogKind parameters: - $ref: "#/components/parameters/KindID" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_write summary: Delete a single kind tags: - Software Catalog /api/v2/catalog/relation: get: description: Get a list of entity relations from Software Catalog. operationId: ListCatalogRelation parameters: - $ref: "#/components/parameters/PageOffset" - description: Maximum number of relations in the response. example: 100 in: query name: page[limit] required: false schema: default: 100 format: int64 type: integer - $ref: "#/components/parameters/FilterRelationByType" - $ref: "#/components/parameters/FilterRelationByFromRef" - $ref: "#/components/parameters/FilterRelationByToRef" - $ref: "#/components/parameters/RelationInclude" - description: If true, includes relationships discovered by APM and USM. in: query name: includeDiscovered required: false schema: default: false type: boolean responses: "200": content: application/json: examples: default: value: data: - attributes: from: kind: service name: test-service to: kind: service name: other-service type: RelationTypeOwns id: abc-123 type: relation meta: count: 1 schema: $ref: "#/components/schemas/ListRelationCatalogResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_read summary: Get a list of entity relations tags: - Software Catalog x-pagination: limitParam: page[limit] pageOffsetParam: page[offset] resultsPath: data /api/v2/change-management/change-request: post: description: Create a new change request. operationId: CreateChangeRequest requestBody: content: application/json: examples: default: value: data: attributes: change_request_linked_incident_uuid: 00000000-0000-0000-0000-000000000000 change_request_maintenance_window_query: "" change_request_plan: 1. Deploy to staging 2. Run tests 3. Deploy to production change_request_risk: LOW change_request_type: NORMAL description: Deploying new payment service v2.1 end_date: "2024-01-02T15:00:00Z" project_id: d4bbe1af-f36e-42f1-87c1-493ca35c320e requested_teams: - team-handle-1 start_date: "2024-01-01T03:00:00Z" title: Deploy new payment service type: change_request schema: $ref: "#/components/schemas/ChangeRequestCreateRequest" description: Change request payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: attributes: {} change_request_linked_incident_uuid: "" change_request_maintenance_window_query: "" change_request_plan: "" change_request_risk: LOW change_request_type: NORMAL created_at: "2024-01-01T00:00:00+00:00" creation_source: CS_MANUAL description: Deploying new payment service v2.1 end_date: "2024-01-02T00:00:00+00:00" key: CHM-1234 modified_at: "2024-01-01T00:00:00+00:00" plan_notebook_id: 0 priority: NOT_DEFINED project_id: 00000000-0000-0000-0000-000000000001 start_date: "2024-01-01T00:00:00+00:00" status: OPEN title: Deploy new payment service type: CHANGE_REQUEST id: CHM-1234 relationships: change_request_decisions: data: [] created_by: data: id: 00000000-0000-0000-0000-000000000001 type: user modified_by: data: id: 00000000-0000-0000-0000-000000000001 type: user type: change_request schema: $ref: "#/components/schemas/ChangeRequestResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Create a change request tags: - Change Management x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/change-management/change-request/{change_request_id}: get: description: Get the details of a change request by its ID. operationId: GetChangeRequest parameters: - $ref: "#/components/parameters/ChangeRequestIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: attributes: {} change_request_linked_incident_uuid: "" change_request_maintenance_window_query: "" change_request_plan: "" change_request_risk: LOW change_request_type: NORMAL created_at: "2024-01-01T00:00:00+00:00" creation_source: CS_MANUAL description: Deploying new payment service v2.1 end_date: "2024-01-02T00:00:00+00:00" key: CHM-1234 modified_at: "2024-01-01T00:00:00+00:00" plan_notebook_id: 0 priority: NOT_DEFINED project_id: 00000000-0000-0000-0000-000000000001 start_date: "2024-01-01T00:00:00+00:00" status: OPEN title: Deploy new payment service type: CHANGE_REQUEST id: CHM-1234 relationships: change_request_decisions: data: [] created_by: data: id: 00000000-0000-0000-0000-000000000001 type: user modified_by: data: id: 00000000-0000-0000-0000-000000000001 type: user type: change_request schema: $ref: "#/components/schemas/ChangeRequestResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_read summary: Get a change request tags: - Change Management x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update the properties of a change request. operationId: UpdateChangeRequest parameters: - $ref: "#/components/parameters/ChangeRequestIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: change_request_plan: Updated deployment plan change_request_risk: LOW change_request_type: NORMAL end_date: "2024-01-02T15:00:00Z" id: CHM-1234 start_date: "2024-01-01T03:00:00Z" relationships: change_request_decisions: data: - id: decision-id-0 type: change_request included: - attributes: change_request_status: REQUESTED request_reason: Please review and approve this change id: decision-id-0 type: change_request_decision schema: $ref: "#/components/schemas/ChangeRequestUpdateRequest" description: Change request update payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: attributes: {} change_request_linked_incident_uuid: "" change_request_maintenance_window_query: "" change_request_plan: "" change_request_risk: LOW change_request_type: NORMAL created_at: "2024-01-01T00:00:00+00:00" creation_source: CS_MANUAL description: Deploying new payment service v2.1 end_date: "2024-01-02T00:00:00+00:00" key: CHM-1234 modified_at: "2024-01-01T00:00:00+00:00" plan_notebook_id: 0 priority: NOT_DEFINED project_id: 00000000-0000-0000-0000-000000000001 start_date: "2024-01-01T00:00:00+00:00" status: OPEN title: Deploy new payment service type: CHANGE_REQUEST id: CHM-1234 relationships: change_request_decisions: data: [] created_by: data: id: 00000000-0000-0000-0000-000000000001 type: user modified_by: data: id: 00000000-0000-0000-0000-000000000001 type: user type: change_request schema: $ref: "#/components/schemas/ChangeRequestResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Update a change request tags: - Change Management x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/change-management/change-request/{change_request_id}/branch: post: description: Create a new branch in a repository for a change request. operationId: CreateChangeRequestBranch parameters: - $ref: "#/components/parameters/ChangeRequestIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: branch_name: chm/CHM-1234 repo_id: DataDog/test-repo type: change_request_branch schema: $ref: "#/components/schemas/ChangeRequestBranchCreateRequest" description: Branch creation payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: attributes: {} change_request_linked_incident_uuid: "" change_request_maintenance_window_query: "" change_request_plan: "" change_request_risk: LOW change_request_type: NORMAL created_at: "2024-01-01T00:00:00+00:00" creation_source: CS_MANUAL description: Deploying new payment service v2.1 end_date: "2024-01-02T00:00:00+00:00" key: CHM-1234 modified_at: "2024-01-01T00:00:00+00:00" plan_notebook_id: 0 priority: NOT_DEFINED project_id: 00000000-0000-0000-0000-000000000001 start_date: "2024-01-01T00:00:00+00:00" status: OPEN title: Deploy new payment service type: CHANGE_REQUEST id: CHM-1234 relationships: change_request_decisions: data: [] created_by: data: id: 00000000-0000-0000-0000-000000000001 type: user modified_by: data: id: 00000000-0000-0000-0000-000000000001 type: user type: change_request schema: $ref: "#/components/schemas/ChangeRequestResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Create a change request branch tags: - Change Management x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/change-management/change-request/{change_request_id}/decisions/{decision_id}: delete: description: Delete a decision from a change request. operationId: DeleteChangeRequestDecision parameters: - $ref: "#/components/parameters/ChangeRequestIDPathParameter" - $ref: "#/components/parameters/ChangeRequestDecisionIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: attributes: {} change_request_linked_incident_uuid: "" change_request_maintenance_window_query: "" change_request_plan: "" change_request_risk: LOW change_request_type: NORMAL created_at: "2024-01-01T00:00:00+00:00" creation_source: CS_MANUAL description: Deploying new payment service v2.1 end_date: "2024-01-02T00:00:00+00:00" key: CHM-1234 modified_at: "2024-01-01T00:00:00+00:00" plan_notebook_id: 0 priority: NOT_DEFINED project_id: 00000000-0000-0000-0000-000000000001 start_date: "2024-01-01T00:00:00+00:00" status: OPEN title: Deploy new payment service type: CHANGE_REQUEST id: CHM-1234 relationships: change_request_decisions: data: [] created_by: data: id: 00000000-0000-0000-0000-000000000001 type: user modified_by: data: id: 00000000-0000-0000-0000-000000000001 type: user type: change_request schema: $ref: "#/components/schemas/ChangeRequestResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Delete a change request decision tags: - Change Management x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update a decision on a change request, such as approving or declining it. operationId: UpdateChangeRequestDecision parameters: - $ref: "#/components/parameters/ChangeRequestIDPathParameter" - $ref: "#/components/parameters/ChangeRequestDecisionIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: id: CHM-1234 relationships: change_request_decisions: data: - id: decision-id-0 type: change_request included: - attributes: change_request_status: REQUESTED request_reason: Please review and approve this change id: decision-id-0 type: change_request_decision schema: $ref: "#/components/schemas/ChangeRequestDecisionUpdateRequest" description: Decision update payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: attributes: {} change_request_linked_incident_uuid: "" change_request_maintenance_window_query: "" change_request_plan: "" change_request_risk: LOW change_request_type: NORMAL created_at: "2024-01-01T00:00:00+00:00" creation_source: CS_MANUAL description: Deploying new payment service v2.1 end_date: "2024-01-02T00:00:00+00:00" key: CHM-1234 modified_at: "2024-01-01T00:00:00+00:00" plan_notebook_id: 0 priority: NOT_DEFINED project_id: 00000000-0000-0000-0000-000000000001 start_date: "2024-01-01T00:00:00+00:00" status: OPEN title: Deploy new payment service type: CHANGE_REQUEST id: CHM-1234 relationships: change_request_decisions: data: [] created_by: data: id: 00000000-0000-0000-0000-000000000001 type: user modified_by: data: id: 00000000-0000-0000-0000-000000000001 type: user type: change_request schema: $ref: "#/components/schemas/ChangeRequestResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Update a change request decision tags: - Change Management x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/ci/github/accounts: get: description: |- Retrieve the list of GitHub accounts (organizations or users) available to this Datadog organization through its GitHub App installation, along with each account's and repository's CI Visibility opt-in status. operationId: ListCIAppGitHubAccounts responses: "200": content: application/json: examples: default: value: data: - attributes: account: datadog enabled: true host: github.com repo_count: 2 repositories: - enabled: true name: shopist - enabled: false name: dd-source id: github.com/datadog type: ci_github_account schema: $ref: "#/components/schemas/CIAppGitHubAccountsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - integrations_read summary: List GitHub CI Visibility status tags: ["CI Visibility GitHub Accounts"] x-permission: operator: OR permissions: - integrations_read patch: description: |- Enable or disable CI Visibility for a GitHub account, one of its repositories, or both in the same request. The account (and, optionally, repository) are identified by name. Account-level and repository-level changes are independent and may both be supplied in the same request. At least one of `enabled` or `repository.enabled` must be provided. If the account name matches installations on more than one host, `host` must be supplied to disambiguate, otherwise a 409 is returned. Returns a 404 if the CI Visibility GitHub integration is not enabled for this organization, or if the given account or repository cannot be found by name. operationId: UpdateCIAppGitHubAccount requestBody: content: application/json: examples: default: value: data: attributes: account: datadog enabled: true host: github.com repository: enabled: true name: shopist type: ci_github_account schema: $ref: "#/components/schemas/CIAppGitHubAccountUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: account: datadog enabled: true host: github.com repo_count: 2 repositories: - enabled: true name: shopist - enabled: false name: dd-source id: github.com/datadog type: ci_github_account schema: $ref: "#/components/schemas/CIAppGitHubAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ci_provider_settings_write summary: Update GitHub CI Visibility status tags: ["CI Visibility GitHub Accounts"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - ci_provider_settings_write /api/v2/ci/pipeline: post: description: |- Send your pipeline event to your Datadog platform over HTTP. For details about how pipeline executions are modeled and what execution types we support, see [Pipeline Data Model And Execution Types](https://docs.datadoghq.com/continuous_integration/guides/pipeline_data_model/). Multiple events can be sent in an array (up to 1000). Pipeline events can be submitted with a timestamp that is up to 18 hours in the past. The duration between the event start and end times cannot exceed 1 year. operationId: CreateCIAppPipelineEvent requestBody: content: application/json: examples: default: value: data: attributes: resource: end: "2024-11-25T20:08:11.018Z" git: author_email: john.doe@email.com repository_url: https://github.com/organization/example-repository sha: 7f263865994b76066c4612fd1965215e7dcb4cd2 level: pipeline name: Deploy to AWS partial_retry: false start: "2024-11-25T20:06:41.018Z" status: success unique_id: 3eacb6f3-ff04-4e10-8a9c-46e6d054024a url: https://my-ci-provider.example/pipelines/my-pipeline/run/1 type: cipipeline_resource_request schema: $ref: "#/components/schemas/CIAppCreatePipelineEventRequest" required: true responses: "202": content: application/json: examples: default: value: {} schema: type: object description: Request accepted for processing "400": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Forbidden "408": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Request Timeout "413": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Payload Too Large "429": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Too Many Requests "500": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Service Unavailable security: - apiKeyAuth: [] summary: Send pipeline event tags: ["CI Visibility Pipelines"] x-codegen-request-body-name: body /api/v2/ci/pipelines/analytics/aggregate: post: description: |- Use this API endpoint to aggregate CI Visibility pipeline events into buckets of computed metrics and timeseries. operationId: AggregateCIAppPipelineEvents requestBody: content: "application/json": examples: default: value: compute: - aggregation: pc90 interval: 5m metric: "@duration" type: timeseries filter: from: now-15m query: "@ci.provider.name:github AND @ci.status:error" to: now group_by: - facet: "@ci.status" histogram: interval: 10 max: 100 min: 50 sort: aggregation: count order: asc options: timezone: GMT schema: $ref: "#/components/schemas/CIAppPipelinesAggregateRequest" required: true responses: "200": content: application/json: examples: default: value: data: buckets: - by: "@ci.status": error computes: pc90: - time: "2020-06-08T11:55:00.123Z" value: 2345 schema: $ref: "#/components/schemas/CIAppPipelinesAnalyticsAggregateResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ci_visibility_read summary: Aggregate pipelines events tags: ["CI Visibility Pipelines"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - ci_visibility_read /api/v2/ci/pipelines/events: get: description: |- List endpoint returns CI Visibility pipeline events that match a [search query](https://docs.datadoghq.com/continuous_integration/explorer/search_syntax/). [Results are paginated similarly to logs](https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination). Use this endpoint to see your latest pipeline events. operationId: ListCIAppPipelineEvents parameters: - description: Search query following log syntax. example: "@ci.provider.name:github @ci.pipeline.name:Pull Request Labeler" in: query name: filter[query] required: false schema: type: string - description: Minimum timestamp for requested events. example: "2019-01-02T09:42:36.320Z" in: query name: filter[from] required: false schema: format: date-time type: string - description: Maximum timestamp for requested events. example: "2019-01-03T09:42:36.320Z" in: query name: filter[to] required: false schema: format: date-time type: string - description: Order of events in results. in: query name: sort required: false schema: $ref: "#/components/schemas/CIAppSort" - description: |- List following results with a cursor provided in the previous query. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" in: query name: page[cursor] required: false schema: type: string - description: Maximum number of events in the response. example: 25 in: query name: page[limit] required: false schema: default: 10 format: int32 maximum: 1000 type: integer responses: "200": content: application/json: examples: default: value: data: [] meta: page: {} schema: $ref: "#/components/schemas/CIAppPipelineEventsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ci_visibility_read summary: Get a list of pipelines events tags: ["CI Visibility Pipelines"] x-pagination: cursorParam: page[cursor] cursorPath: meta.page.after limitParam: page[limit] resultsPath: data "x-permission": operator: OR permissions: - ci_visibility_read /api/v2/ci/pipelines/events/search: post: description: |- List endpoint returns CI Visibility pipeline events that match a [search query](https://docs.datadoghq.com/continuous_integration/explorer/search_syntax/). [Results are paginated similarly to logs](https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination). Use this endpoint to build complex events filtering and search. operationId: SearchCIAppPipelineEvents requestBody: content: "application/json": examples: default: value: filter: from: now-15m query: "@ci.provider.name:github AND @ci.status:error" to: now options: timezone: GMT page: cursor: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== limit: 25 sort: timestamp schema: $ref: "#/components/schemas/CIAppPipelineEventsRequest" required: false responses: "200": content: application/json: examples: default: value: data: - attributes: attributes: duration: 2345 ci_level: pipeline tags: - team:backend id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: cipipeline meta: elapsed: 132 request_id: MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR status: done schema: $ref: "#/components/schemas/CIAppPipelineEventsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ci_visibility_read summary: Search pipelines events tags: ["CI Visibility Pipelines"] x-codegen-request-body-name: body x-pagination: cursorParam: body.page.cursor cursorPath: meta.page.after limitParam: body.page.limit resultsPath: data "x-permission": operator: OR permissions: - ci_visibility_read /api/v2/ci/test-optimization/settings/policies: patch: description: |- Partially update Flaky Tests Management repository-level policies for the given repository. Only provided policy blocks are updated; omitted blocks are left unchanged. operationId: UpdateFlakyTestsManagementPolicies requestBody: content: application/json: examples: default: value: data: attributes: attempt_to_fix: retries: 3 disabled: enabled: false quarantined: auto_quarantine_rule: enabled: true window_seconds: 3600 branch_rule: branches: - main enabled: true excluded_branches: [] excluded_test_services: [] enabled: true failure_rate_rule: branches: - main enabled: true min_runs: 10 threshold: 0.5 repository_id: "github.com/example-org/example-repo" type: test_optimization_update_flaky_tests_management_policies_request schema: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: repository_id: github.com/datadog/test-service id: github.com/datadog/test-service type: test_optimization_flaky_tests_management_policies schema: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - test_optimization_settings_write summary: Update Flaky Tests Management policies tags: ["Test Optimization"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - test_optimization_settings_write post: description: |- Retrieve Flaky Tests Management repository-level policies for the given repository. operationId: GetFlakyTestsManagementPolicies requestBody: content: application/json: examples: default: value: data: attributes: repository_id: "github.com/example-org/example-repo" type: test_optimization_get_flaky_tests_management_policies_request schema: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesGetRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: repository_id: github.com/datadog/test-service id: github.com/datadog/test-service type: test_optimization_flaky_tests_management_policies schema: $ref: "#/components/schemas/TestOptimizationFlakyTestsManagementPoliciesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - test_optimization_read summary: Get Flaky Tests Management policies tags: ["Test Optimization"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - test_optimization_read /api/v2/ci/test-optimization/settings/service: delete: description: |- Delete Test Optimization settings for a specific service identified by repository, service name, and environment. operationId: DeleteTestOptimizationServiceSettings requestBody: content: application/json: examples: default: value: data: attributes: env: prod repository_id: github.com/datadog/test-service service_name: test-service type: test_optimization_delete_service_settings_request schema: $ref: "#/components/schemas/TestOptimizationDeleteServiceSettingsRequest" required: true responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - test_optimization_settings_write summary: Delete Test Optimization service settings tags: ["Test Optimization"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - test_optimization_settings_write patch: description: |- Partially update Test Optimization settings for a specific service identified by repository, service name, and environment. Only provided fields are updated; setting a field to `null` is a no-op. To reset a setting to inherit from the repository level, use the corresponding `_inherit` field. The `pr_comments_enabled` field is ignored as it cannot be overridden at the service level. operationId: UpdateTestOptimizationServiceSettings requestBody: content: application/json: examples: default: value: data: attributes: env: prod repository_id: github.com/datadog/test-service service_name: test-service test_impact_analysis_enabled_inherit: true type: test_optimization_update_service_settings_request schema: $ref: "#/components/schemas/TestOptimizationUpdateServiceSettingsRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: auto_test_retries_enabled: false auto_test_retries_enabled_is_overridden: false code_coverage_enabled: false code_coverage_enabled_is_overridden: false early_flake_detection_enabled: false early_flake_detection_enabled_is_overridden: false env: prod failed_test_replay_enabled: false failed_test_replay_enabled_is_overridden: false pr_comments_enabled: false repository_id: github.com/datadog/test-service service_name: test-service test_impact_analysis_enabled: true test_impact_analysis_enabled_is_overridden: true id: 9b8a7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d type: test_optimization_service_settings schema: $ref: "#/components/schemas/TestOptimizationServiceSettingsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - test_optimization_settings_write summary: Update Test Optimization service settings tags: ["Test Optimization"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - test_optimization_settings_write post: description: |- Retrieve Test Optimization settings for a specific service identified by repository, service name, and environment. operationId: GetTestOptimizationServiceSettings requestBody: content: application/json: examples: default: value: data: attributes: env: prod repository_id: github.com/datadog/test-service service_name: test-service type: test_optimization_get_service_settings_request schema: $ref: "#/components/schemas/TestOptimizationGetServiceSettingsRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: auto_test_retries_enabled: false auto_test_retries_enabled_is_overridden: false code_coverage_enabled: false code_coverage_enabled_is_overridden: false early_flake_detection_enabled: false early_flake_detection_enabled_is_overridden: false env: prod failed_test_replay_enabled: false failed_test_replay_enabled_is_overridden: false pr_comments_enabled: false repository_id: github.com/datadog/test-service service_name: test-service test_impact_analysis_enabled: true test_impact_analysis_enabled_is_overridden: true id: 9b8a7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d type: test_optimization_service_settings schema: $ref: "#/components/schemas/TestOptimizationServiceSettingsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - test_optimization_read summary: Get Test Optimization service settings tags: ["Test Optimization"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - test_optimization_read /api/v2/ci/tests/analytics/aggregate: post: description: |- The API endpoint to aggregate CI Visibility test events into buckets of computed metrics and timeseries. operationId: AggregateCIAppTestEvents requestBody: content: "application/json": examples: default: value: compute: - aggregation: pc90 interval: 5m metric: "@duration" type: timeseries filter: from: now-15m query: "@test.service:web-tests AND @test.status:fail" to: now group_by: - facet: "@test.service" histogram: interval: 10 max: 100 min: 50 sort: aggregation: count order: asc options: timezone: GMT schema: $ref: "#/components/schemas/CIAppTestsAggregateRequest" required: true responses: "200": content: application/json: examples: default: value: data: buckets: - by: "@test.service": web-tests computes: pc90: - time: "2020-06-08T11:55:00.123Z" value: 2345 schema: $ref: "#/components/schemas/CIAppTestsAnalyticsAggregateResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ci_visibility_read - AuthZ: - test_optimization_read summary: Aggregate tests events tags: ["CI Visibility Tests"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - ci_visibility_read - test_optimization_read /api/v2/ci/tests/events: get: description: |- List endpoint returns CI Visibility test events that match a [search query](https://docs.datadoghq.com/continuous_integration/explorer/search_syntax/). [Results are paginated similarly to logs](https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination). Use this endpoint to see your latest test events. operationId: ListCIAppTestEvents parameters: - description: Search query following log syntax. example: "@test.name:test_foo @test.suite:github.com/DataDog/dd-go/model" in: query name: filter[query] required: false schema: type: string - description: Minimum timestamp for requested events. example: "2019-01-02T09:42:36.320Z" in: query name: filter[from] required: false schema: format: date-time type: string - description: Maximum timestamp for requested events. example: "2019-01-03T09:42:36.320Z" in: query name: filter[to] required: false schema: format: date-time type: string - description: Order of events in results. in: query name: sort required: false schema: $ref: "#/components/schemas/CIAppSort" - description: |- List following results with a cursor provided in the previous query. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" in: query name: page[cursor] required: false schema: type: string - description: Maximum number of events in the response. example: 25 in: query name: page[limit] required: false schema: default: 10 format: int32 maximum: 1000 type: integer responses: "200": content: application/json: examples: default: value: data: [] meta: page: {} schema: $ref: "#/components/schemas/CIAppTestEventsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ci_visibility_read - AuthZ: - test_optimization_read summary: Get a list of tests events tags: ["CI Visibility Tests"] x-pagination: cursorParam: page[cursor] cursorPath: meta.page.after limitParam: page[limit] resultsPath: data "x-permission": operator: OR permissions: - ci_visibility_read - test_optimization_read /api/v2/ci/tests/events/search: post: description: |- List endpoint returns CI Visibility test events that match a [search query](https://docs.datadoghq.com/continuous_integration/explorer/search_syntax/). [Results are paginated similarly to logs](https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination). Use this endpoint to build complex events filtering and search. operationId: SearchCIAppTestEvents requestBody: content: "application/json": examples: default: value: filter: from: now-15m query: "@test.service:web-tests AND @test.status:fail" to: now options: timezone: GMT page: cursor: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== limit: 25 sort: timestamp schema: $ref: "#/components/schemas/CIAppTestEventsRequest" required: false responses: "200": content: application/json: examples: default: value: data: - attributes: attributes: duration: 2345 tags: - team:backend test_level: test id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: citest links: next: https://app.datadoghq.com/api/v2/ci/tests/events?page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== meta: elapsed: 132 request_id: MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR status: done schema: $ref: "#/components/schemas/CIAppTestEventsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ci_visibility_read - AuthZ: - test_optimization_read summary: Search tests events tags: ["CI Visibility Tests"] x-codegen-request-body-name: body x-pagination: cursorParam: body.page.cursor cursorPath: meta.page.after limitParam: body.page.limit resultsPath: data "x-permission": operator: OR permissions: - ci_visibility_read - test_optimization_read /api/v2/cilogs: post: description: |- Send log lines for a CI job over HTTP. See the [CI Visibility Pipelines API](https://docs.datadoghq.com/api/latest/ci-visibility-pipelines/send-pipeline-event/) for submitting the associated pipeline and job events. A request can contain one log object or an array of up to 1,000 log objects. The maximum uncompressed request body size is 5.1 MiB. You can stream log lines while a CI job runs or send them after it finishes. After you submit the completed job event, 20 seconds without a new log line marks the job's logs as complete. Lines sent after that may not appear. A job can have up to 128 additional attributes and 256 tags. Additional attributes are top-level fields with string, number, Boolean, or null values. Nested objects and arrays are rejected. Additional attributes and `ddtags` apply to all log lines in the job. If an additional attribute has different values on different lines, the first value received is used. Tags supplied on different lines are combined. A job can contain up to 2,000,000 log records or 1 GiB of message bytes in total. To reduce request size, send gzip-compressed JSON with the `Content-Encoding: gzip` header. Retry requests after a 408, 429, 500, or 503 response. operationId: SubmitCILog parameters: - description: HTTP header used to compress the JSON request body. in: header name: Content-Encoding required: false schema: $ref: "#/components/schemas/CILogContentEncoding" requestBody: content: application/json: examples: default: summary: Single CI job log line value: - ddtags: runner:linux,architecture:amd64 job_id: job-456 line_number: 812 message: Running go test ./... pipeline_unique_id: 3eacb6f3-ff04-4e10-8a9c-46e6d054024a provider_name: example-provider section_name: tests status: warn stream: stdout multiple-logs: summary: Multiple CI job log lines value: - job_id: job-456 line_number: 1 message: Running go test ./... pipeline_unique_id: 3eacb6f3-ff04-4e10-8a9c-46e6d054024a - job_id: job-456 line_number: 2 message: Tests passed pipeline_unique_id: 3eacb6f3-ff04-4e10-8a9c-46e6d054024a schema: $ref: "#/components/schemas/CILogRequest" description: CI job log line or batch in JSON format. required: true responses: "202": content: application/json: examples: default: value: {} schema: type: object description: Request accepted for processing "400": content: application/json: schema: $ref: "#/components/schemas/CILogIntakeErrors" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/CILogErrors" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/CILogErrors" description: Forbidden "408": content: application/json: schema: $ref: "#/components/schemas/CILogIntakeErrors" description: Request Timeout "413": content: application/json: schema: $ref: "#/components/schemas/CILogIntakeErrors" description: Payload Too Large "429": content: application/json: schema: $ref: "#/components/schemas/CILogIntakeErrors" description: Too Many Requests security: - apiKeyAuth: [] servers: - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: The regional site for CI Visibility customers. enum: - datadoghq.com - us3.datadoghq.com - us5.datadoghq.com - ap1.datadoghq.com - ap2.datadoghq.com - uk1.datadoghq.com - datadoghq.eu x-enum-varnames: - US1 - US3 - US5 - AP1 - AP2 - UK1 - EU1 subdomain: default: http-intake.logs description: The subdomain where the API is deployed. - url: "{protocol}://{name}" variables: name: default: http-intake.logs.datadoghq.com description: Full site DNS name. protocol: default: https description: The protocol for accessing the API. - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: Any Datadog deployment. subdomain: default: http-intake.logs description: The subdomain where the API is deployed. summary: Send CI job logs tags: - CI Visibility Logs x-codegen-request-body-name: body /api/v2/cloud_security_management/custom_frameworks: post: description: Create a custom framework. operationId: CreateCustomFramework requestBody: content: "application/json": examples: default: value: data: attributes: handle: sec2 name: security-framework requirements: - controls: - name: control rules_id: - def-000-be9 name: criteria version: "2" type: custom_framework schema: $ref: "#/components/schemas/CreateCustomFrameworkRequest" required: true responses: "200": content: "application/json": examples: default: value: data: attributes: handle: sec2 version: "2" id: sec2-2 type: custom_framework schema: $ref: "#/components/schemas/CreateCustomFrameworkResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": $ref: "#/components/responses/BadRequestResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read - security_monitoring_rules_write summary: Create a custom framework tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: AND permissions: - security_monitoring_rules_read - security_monitoring_rules_write /api/v2/cloud_security_management/custom_frameworks/{handle}/{version}: delete: description: Delete a custom framework. operationId: DeleteCustomFramework parameters: - $ref: "#/components/parameters/CustomFrameworkHandle" - $ref: "#/components/parameters/CustomFrameworkVersion" responses: "200": content: "application/json": examples: default: value: data: attributes: handle: sec2 name: security-framework version: "2" id: sec2-2 type: custom_framework schema: $ref: "#/components/schemas/DeleteCustomFrameworkResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": $ref: "#/components/responses/BadRequestResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read - security_monitoring_rules_write summary: Delete a custom framework tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: AND permissions: - security_monitoring_rules_read - security_monitoring_rules_write get: description: Get a custom framework. operationId: GetCustomFramework parameters: - $ref: "#/components/parameters/CustomFrameworkHandle" - $ref: "#/components/parameters/CustomFrameworkVersion" responses: "200": content: "application/json": examples: default: value: data: attributes: handle: sec2 name: security-framework requirements: - controls: - name: control rules_id: - def-000-be9 name: criteria version: "2" id: sec2-2 type: custom_framework schema: $ref: "#/components/schemas/GetCustomFrameworkResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": $ref: "#/components/responses/BadRequestResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read summary: Get a custom framework tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_rules_read put: description: Update a custom framework. operationId: UpdateCustomFramework parameters: - $ref: "#/components/parameters/CustomFrameworkHandle" - $ref: "#/components/parameters/CustomFrameworkVersion" requestBody: content: "application/json": examples: default: value: data: attributes: handle: sec2 name: security-framework requirements: - controls: - name: control rules_id: - def-000-be9 name: criteria version: "2" type: custom_framework schema: $ref: "#/components/schemas/UpdateCustomFrameworkRequest" required: true responses: "200": content: "application/json": examples: default: value: data: attributes: handle: sec2 version: "2" id: sec2-2 type: custom_framework schema: $ref: "#/components/schemas/UpdateCustomFrameworkResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": $ref: "#/components/responses/BadRequestResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read - security_monitoring_rules_write summary: Update a custom framework tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: AND permissions: - security_monitoring_rules_read - security_monitoring_rules_write /api/v2/cloud_security_management/resource_filters: get: description: List resource filters. operationId: GetResourceEvaluationFilters parameters: - $ref: "#/components/parameters/ResourceFilterProvider" - $ref: "#/components/parameters/ResourceFilterAccountID" - $ref: "#/components/parameters/SkipCache" responses: "200": content: "application/json": examples: default: value: data: attributes: cloud_provider: aws: "123456789": - environment:production id: csm_resource_filter type: csm_resource_filter schema: $ref: "#/components/schemas/GetResourceEvaluationFiltersResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_filters_read summary: List resource filters tags: ["Security Monitoring"] "x-permission": operator: OR permissions: - security_monitoring_filters_read put: description: Update resource filters. operationId: UpdateResourceEvaluationFilters requestBody: content: "application/json": examples: default: value: data: attributes: aws: "123456789": - environment:production - team:devops azure: sub-001: - app:frontend gcp: project-abc: - region:us-central1 id: csm_resource_filter type: csm_resource_filter schema: $ref: "#/components/schemas/UpdateResourceEvaluationFiltersRequest" required: true responses: "201": content: "application/json": examples: default: value: data: attributes: cloud_provider: aws: "123456789": - environment:production id: csm_resource_filter type: csm_resource_filter schema: $ref: "#/components/schemas/UpdateResourceEvaluationFiltersResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_filters_write summary: Update resource filters tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_filters_write /api/v2/cloudinventoryservice/syncconfigs: put: description: |- Enable Storage Management for an S3 bucket, GCS bucket, or Azure container by registering the destination that holds its inventory reports. Set `data.id` to the cloud provider (`aws`, `gcp`, or `azure`) and provide the matching settings under data.attributes. Calling this endpoint with the same provider replaces the existing configuration. operationId: UpsertSyncConfig requestBody: content: application/json: examples: default: summary: AWS inventory bucket value: data: attributes: aws: aws_account_id: "123456789012" destination_bucket_name: my-inventory-bucket destination_bucket_region: us-east-1 destination_prefix: logs/ id: aws type: cloud_provider schema: $ref: "#/components/schemas/UpsertCloudInventorySyncConfigRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: aws_account_id: "123456789012" aws_bucket_name: my-inventory-bucket aws_region: us-east-1 id: aws type: sync_configs schema: $ref: "#/components/schemas/CloudInventorySyncConfigResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Enable Storage Management for a bucket tags: - Storage Management x-codegen-request-body-name: body "x-permission": operator: OR permissions: - aws_configurations_manage /api/v2/cloudinventoryservice/syncconfigs/{id}: delete: description: |- Delete a Storage Management configuration by its unique identifier. Deleting a configuration stops inventory file synchronization for the associated cloud account. operationId: DeleteSyncConfig parameters: - $ref: "#/components/parameters/CloudInventorySyncConfigID" responses: "204": description: No Content "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a Storage Management configuration tags: - Storage Management "x-permission": operator: OR permissions: - aws_configurations_manage /api/v2/code-coverage/branch/summary: post: description: |- Retrieve aggregated code coverage statistics for a specific branch in a repository. This endpoint provides overall coverage metrics as well as breakdowns by service and code owner. operationId: GetCodeCoverageBranchSummary requestBody: content: application/json: examples: default: value: data: attributes: branch: prod repository_url: https://github.com/datadog/test-service type: ci_app_coverage_branch_summary_request schema: $ref: "#/components/schemas/BranchCoverageSummaryRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: evaluated_flags_count: 8 evaluated_reports_count: 12 patch_coverage: 70.1 total_coverage: 82.4 id: ZGQxMjM0NV9tYWluXzE3MDk1NjQwMDA= type: ci_app_coverage_summary schema: $ref: "#/components/schemas/CoverageSummaryResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Internal server error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - code_coverage_read summary: Get code coverage summary for a branch tags: ["Code Coverage"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - code_coverage_read /api/v2/code-coverage/commit/summary: post: description: |- Retrieve aggregated code coverage statistics for a specific commit in a repository. This endpoint provides overall coverage metrics as well as breakdowns by service and code owner. The commit SHA must be a 40-character hexadecimal string (SHA-1 hash). operationId: GetCodeCoverageCommitSummary requestBody: content: application/json: examples: default: value: data: attributes: commit_sha: 66adc9350f2cc9b250b69abddab733dd55e1a588 repository_url: https://github.com/datadog/test-service type: ci_app_coverage_commit_summary_request schema: $ref: "#/components/schemas/CommitCoverageSummaryRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: evaluated_flags_count: 8 evaluated_reports_count: 12 patch_coverage: 70.1 total_coverage: 82.4 id: ZGQxMjM0NV9tYWluXzE3MDk1NjQwMDA= type: ci_app_coverage_summary schema: $ref: "#/components/schemas/CoverageSummaryResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Internal server error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - code_coverage_read summary: Get code coverage summary for a commit tags: ["Code Coverage"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - code_coverage_read /api/v2/code-coverage/files: post: description: |- Retrieve per-file code coverage data for a specific commit, branch, or pull request. Exactly one of `commit_sha`, `branch`, or `pr_number` must be provided. Optionally filter by `service`, `codeowner`, or `flag` (at most one). operationId: GetCodeCoverageFiles requestBody: content: application/json: examples: default: value: data: attributes: changed_only: true commit_sha: 66adc9350f2cc9b250b69abddab733dd55e1a588 repository_url: https://github.com/datadog/test-service type: ci_app_coverage_files_request schema: $ref: "#/components/schemas/FilesCoverageRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: base_commit_sha: abc1234567890abcdef1234567890abcdef12345 event_timestamp: 1709564000000 files: src/main.go: added_lines: [11, 12] covered_lines: [10, 11, 15] executable_lines: [10, 11, 12, 15, 20] head_commit_sha: 66adc9350f2cc9b250b69abddab733dd55e1a588 report_count: 3 id: ZGQxMjM0NV9tYWluXzE3MDk1NjQwMDA= type: ci_app_coverage_files schema: $ref: "#/components/schemas/FilesCoverageResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Internal server error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - code_coverage_read summary: Get per-file code coverage data tags: ["Code Coverage"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - code_coverage_read /api/v2/code-coverage/pr/summary: post: description: |- Retrieve aggregated code coverage statistics for a specific pull request in a repository. This endpoint provides overall coverage metrics as well as breakdowns by service and code owner. operationId: GetCodeCoveragePRSummary requestBody: content: application/json: examples: default: value: data: attributes: pr_number: 42 repository_url: https://github.com/datadog/test-service type: ci_app_coverage_pr_summary_request schema: $ref: "#/components/schemas/PRCoverageSummaryRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: evaluated_flags_count: 3 evaluated_reports_count: 5 patch_coverage: 65.2 total_coverage: 78.6 id: ZGQxMjM0NV9wcl80Ml8xNzA5NTY0MDAw type: ci_app_coverage_summary schema: $ref: "#/components/schemas/CoverageSummaryResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Internal server error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - code_coverage_read summary: Get code coverage summary for a pull request tags: ["Code Coverage"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - code_coverage_read /api/v2/compliance_findings/rule_based_view: get: deprecated: true description: |- **This endpoint is deprecated.** Use the [Security Monitoring - Search Security Findings](https://docs.datadoghq.com/api/latest/security-monitoring/search-security-findings/) endpoint instead. Get an aggregated view of compliance rules with their pass, fail, and muted finding counts. Supports filtering by compliance framework, framework version, and additional query filters. operationId: GetRuleBasedView parameters: - $ref: "#/components/parameters/RuleBasedViewTo" - $ref: "#/components/parameters/RuleBasedViewFramework" - $ref: "#/components/parameters/RuleBasedViewVersion" - $ref: "#/components/parameters/RuleBasedViewQueryFindingsWithoutFrameworkVersion" - $ref: "#/components/parameters/RuleBasedViewIncludeRulesWithoutFindings" - $ref: "#/components/parameters/RuleBasedViewIsCustom" - $ref: "#/components/parameters/RuleBasedViewQuery" responses: "200": content: application/json: examples: default: value: data: attributes: count: 1 rules: - compliance_frameworks: - control: 164.308-a-4-i framework: hipaa is_default: true message: "" requirement: Information-Access-Management version: "1" enabled: true id: qjx-udx-xo8 name: IAM roles should not allow untrusted GitHub Actions to assume them resourceAttributes: [] resourceCategory: identity resourceType: aws_iam_role stats: fail: 0 muted: 0 pass: 3 status: critical tags: - security:compliance - cloud_provider:aws - framework:hipaa type: cloud_configuration id: JSONAPI_USELESS_ID type: rule_based_view schema: $ref: "#/components/schemas/RuleBasedViewResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "503": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Service Unavailable security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_findings_read summary: Get the rule-based view of compliance findings tags: ["Compliance"] "x-permission": operator: OR permissions: - security_monitoring_findings_read x-sunset: "2027-06-26" x-unstable: |- **Note**: This endpoint is in Preview and subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/container_images: get: description: |- Get all container images for your organization. This endpoint queries current inventory and does not support time-range parameters. Use `group_by` to return image groups with counts. Grouped results are limited by `page[size]`, may be incomplete, and do not support pagination. **Note**: To enrich the data returned by this endpoint with security scans, see the new [api/v2/security/scanned-assets-metadata](https://docs.datadoghq.com/api/latest/security-monitoring/#list-scanned-assets-metadata) endpoint. operationId: ListContainerImages parameters: - description: |- Comma-separated `key:value` tags. An image must match every tag. Wildcards, negation (`-key:value`), spaces, and `IN (...)` are not supported. Use keys such as `image_registry` and `image_tag`. To match any of several values of the same key, make one request per value. example: short_image:redis,status:running in: query name: filter[tags] required: false schema: type: string - description: |- Comma-separated list of up to three tag keys, such as `image_registry,image_tag`. Returns `container_image_group` objects with counts and tags. Grouped results ignore `sort` and do not support pagination. Images missing a grouping key are excluded. An image with multiple values for a grouping tag can appear in multiple groups. Grouped results may be incomplete. Compare counts only within the returned groups; they do not establish the most common tags or proportions across the inventory. For inventory-wide comparisons, omit `group_by`, keep the same filters, paginate all results, and deduplicate by returned image ID. For an inventory total, use `meta.pagination.total` from a query without grouping. example: image_registry,image_tag in: query name: group_by required: false schema: type: string - description: |- Attribute to sort individual images by, such as `size` or `container_count`. Defaults to `image_name` in ascending order. Prefix the attribute with `-` for descending order, such as `-size`. Ignored when `group_by` is specified. example: "-container_count" in: query name: sort required: false schema: type: string - description: |- Maximum number of results returned. Grouped queries default to `100`, with a maximum of `1000` groups. Without grouping, queries default to `1000`, with a maximum of `10000` images. Minimum is `1`. in: query name: page[size] required: false schema: default: 1000 format: int32 maximum: 10000 minimum: 1 type: integer - description: |- Opaque cursor from `meta.pagination.next_cursor` for individual images. Keep the same filters and sort order. Stop when absent or empty. Grouped queries do not support pagination. in: query name: page[cursor] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: container_count: 1 image_flavors: - built_at: "2026-01-01T00:00:00Z" os_architecture: amd64 os_name: linux os_version: "" size: 100000000 image_tags: - latest name: nginx registry: docker.io repository: library/nginx short_image: nginx sizes: - 100000000 tags: - image_registry:docker.io - image_repository:library/nginx - image_tag:latest - short_image:nginx - status:running id: abc-123 type: container_image meta: pagination: limit: 1000 total: 1 type: cursor_limit grouped: summary: Images grouped by registry. value: data: - attributes: count: 1 name: image_registry:docker.io tags: image_registry: docker.io id: image_registry:docker.io relationships: container_images: data: [] links: related: >- https://api.datadoghq.com/api/v2/container_images?filter[tags]=image_registry:docker.io type: container_image_group meta: pagination: cursor: "" limit: 100 next_cursor: "" prev_cursor: "" total: 0 type: cursor_limit schema: $ref: "#/components/schemas/ContainerImagesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get all Container Images tags: - Container Images x-pagination: cursorParam: page[cursor] cursorPath: meta.pagination.next_cursor limitParam: page[size] resultsPath: data "x-permission": operator: OPEN permissions: [] /api/v2/containers: get: description: |- Get all containers for your organization. Use `group_by` to return container groups with counts. Grouped results are limited by `page[size]` and do not support pagination. To get CPU or memory metrics, use a `container` data source query with `/api/v2/query/scalar` or `/api/v2/query/timeseries`. operationId: ListContainers parameters: - description: |- Comma-separated `key:value` tags. A container must match every tag. Wildcards, negation (`-key:value`), spaces, and `IN (...)` are not supported. To cover several hosts, make one request per host. example: env:prod,short_image:cassandra in: query name: filter[tags] required: false schema: type: string - description: |- Comma-separated list of up to three tag keys to group containers by. Returns `container_group` objects with counts and tags. Grouped results ignore `sort` and do not support pagination. Containers with multiple values for a grouping tag can appear in multiple groups. Summing group counts can overcount distinct containers. example: datacenter,cluster in: query name: group_by required: false schema: type: string - description: |- Attribute to sort individual containers by: `name`, `created_at`, `started_at`, `state`, `container_id`, `host`, `image_name`, or `image_digest`. Defaults to `started_at` in ascending order. Prefix the attribute with `-` for descending order, such as `-started_at`. Ignored when `group_by` is specified. example: started_at in: query name: sort required: false schema: type: string - description: |- Maximum number of results returned. For grouped results, defaults to `100` with a maximum of `1000` groups. in: query name: page[size] required: false schema: default: 1000 format: int32 maximum: 10000 minimum: 1 type: integer - description: |- String to query the next page of results. This key is provided with each valid response from the API in `meta.pagination.next_cursor`. in: query name: page[cursor] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: container_id: abc-123 host: example-host image_name: nginx name: example-container state: running id: abc-123 type: container meta: pagination: limit: 1000 total: 1 type: cursor_limit grouped: summary: Containers grouped by short_image value: data: - attributes: count: 3 tags: short_image: nginx id: short_image:nginx relationships: containers: data: [] links: related: https://api.datadoghq.com/api/v2/containers?filter[tags]=short_image:nginx type: container_group meta: pagination: limit: 100 next_cursor: "" total: 0 type: cursor_limit schema: $ref: "#/components/schemas/ContainersResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get All Containers tags: - Containers x-pagination: cursorParam: page[cursor] cursorPath: meta.pagination.next_cursor limitParam: page[size] resultsPath: data "x-permission": operator: OPEN permissions: [] /api/v2/cost/account_filters/{cloud_account_id}: get: description: Get the account filters for a cloud account (AWS CUR 1.0/2.0, OCI, and other clouds). operationId: GetCostAccountFilters parameters: - $ref: "#/components/parameters/CloudAccountID" responses: "200": content: application/json: examples: default: summary: Include new accounts and exclude specific accounts value: data: attributes: account_filters: excluded_accounts: - "123456789123" - "123456789143" include_new_accounts: true account_id: "123456789123" cloud: aws_cur2 id: "123" type: account_filters include_accounts: summary: Exclude new accounts and include specific accounts value: data: attributes: account_filters: include_new_accounts: false included_accounts: - "123456789123" - "123456789143" account_id: "123456789123" cloud: aws_cur2 id: "123" type: account_filters schema: $ref: "#/components/schemas/AccountFiltersResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Get account filters tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read patch: description: Update the account filters for a cloud account (AWS CUR 1.0/2.0, OCI, and other clouds). operationId: UpdateCostAccountFilters parameters: - $ref: "#/components/parameters/CloudAccountID" requestBody: content: application/json: examples: default: summary: Exclude new accounts and include specific accounts value: data: attributes: account_filters: include_new_accounts: false included_accounts: - "123456789123" - "123456789143" type: account_filters_patch_request exclude_accounts: summary: Include new accounts and exclude specific accounts value: data: attributes: account_filters: excluded_accounts: - "123456789123" - "123456789143" include_new_accounts: true type: account_filters_patch_request schema: $ref: "#/components/schemas/AccountFiltersPatchRequest" required: true responses: "200": content: application/json: examples: default: summary: Exclude new accounts and include specific accounts value: data: attributes: account_filters: include_new_accounts: false included_accounts: - "123456789123" - "123456789143" account_id: "123456789123" cloud: aws_cur2 id: "123" type: account_filters exclude_accounts: summary: Include new accounts and exclude specific accounts value: data: attributes: account_filters: excluded_accounts: - "123456789123" - "123456789143" include_new_accounts: true account_id: "123456789123" cloud: aws_cur2 id: "123" type: account_filters schema: $ref: "#/components/schemas/AccountFiltersResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Update account filters tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_write /api/v2/cost/anomalies: get: description: List detected Cloud Cost Management anomalies for the organization. operationId: ListCostAnomalies parameters: - description: Start time as Unix milliseconds. Defaults to the start of the latest stable seven-day window. in: query name: start required: false schema: example: 1730259950000 format: int64 type: integer - description: End time as Unix milliseconds. Defaults to the end of the latest stable seven-day window. in: query name: end required: false schema: example: 1730429150000 format: int64 type: integer - description: 'Optional JSON object mapping cost tag keys to allowed values, for example `{"team":["payments"],"env":["prod"]}`. Filters match anomaly dimensions or correlated tags.' in: query name: filter required: false schema: example: '{"team":["payments"]}' type: string - description: Minimum absolute anomalous cost change to include. Numeric value; defaults to `1`. in: query name: min_anomalous_threshold required: false schema: example: "1.0" type: string - description: Minimum absolute actual cost to include. Numeric value; defaults to `0`. in: query name: min_cost_threshold required: false schema: example: "0.0" type: string - description: Filter by resolution state. Use `none` for unresolved anomalies, `all` or `*` for resolved anomalies, or a comma-separated list of causes. in: query name: dismissal_cause required: false schema: example: none type: string - description: Sort field. One of `start_date`, `end_date`, `duration`, `max_cost`, `anomalous_cost`, or `dismissal_date`. Defaults to `anomalous_cost`. in: query name: order_by required: false schema: example: anomalous_cost type: string - description: Sort direction. One of `asc` or `desc`. Defaults to `desc`. in: query name: order required: false schema: example: desc type: string - description: Maximum number of anomalies to return. Defaults to `200`. in: query name: limit required: false schema: example: 200 format: int64 type: integer - description: Pagination offset. Defaults to `0`. in: query name: offset required: false schema: example: 0 format: int64 type: integer - description: Optional repeated cloud or SaaS provider filters, such as `aws`, `gcp`, `azure`, `Oracle`, `datadog`, `OpenAI`, or `Anthropic`. explode: true in: query name: provider_ids required: false schema: items: example: aws type: string type: array responses: "200": content: application/json: examples: default: value: data: attributes: anomalies: - actual_cost: 3001.24 anomalous_cost_change: 1250.75 anomaly_end: 1730429150000 anomaly_start: 1730259950000 correlated_tags: region: - us-east-1 - us-west-2 dimensions: service: ec2 max_cost: 5000.5 provider: aws query: 'sum:aws.cost.net.amortized{aws_cost_type IN (Usage,DiscountedUsage,SavingsPlanCoveredUsage) AND aws_product NOT IN (supportenterprise) AND service:"ec2"}.rollup(sum, daily)' uuid: b0a6aaa9-3c4c-48cb-9447-a0d1338b3e09 avg_daily_anomalous_cost: 625.375 total_actual_cost: 3001.24 total_anomalous_cost: 1250.75 total_count: 1 id: anomalies type: anomalies schema: $ref: "#/components/schemas/CostAnomaliesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: List cost anomalies tags: - Cloud Cost Management x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cost/anomalies/{anomaly_id}: get: description: Get a detected Cloud Cost Management anomaly by UUID. operationId: GetCostAnomaly parameters: - $ref: "#/components/parameters/AnomalyID" responses: "200": content: application/json: examples: default: value: data: attributes: actual_cost: 3001.24 anomalous_cost_change: 1250.75 anomaly_end: 1730429150000 anomaly_start: 1730259950000 correlated_tags: region: - us-east-1 - us-west-2 dimensions: service: ec2 max_cost: 5000.5 provider: aws query: 'sum:aws.cost.net.amortized{aws_cost_type IN (Usage,DiscountedUsage,SavingsPlanCoveredUsage) AND aws_product NOT IN (supportenterprise) AND service:"ec2"}.rollup(sum, daily)' uuid: b0a6aaa9-3c4c-48cb-9447-a0d1338b3e09 id: b0a6aaa9-3c4c-48cb-9447-a0d1338b3e09 type: anomalies schema: $ref: "#/components/schemas/CostAnomalyResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Get cost anomaly tags: - Cloud Cost Management x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cost/arbitrary_rule: get: description: List all custom allocation rules - Retrieve a list of all custom allocation rules for the organization operationId: ListCustomAllocationRules responses: "200": content: application/json: examples: default: value: data: - attributes: costs_to_allocate: - condition: is tag: account_id value: "123456789" values: created: "2024-01-01T00:00:00+00:00" enabled: true last_modified_user_uuid: user-example-uuid order_id: 1 processing_status: done provider: - aws rule_name: example-custom-allocation-rule strategy: allocated_by_tag_keys: - team granularity: daily method: proportional type: shared updated: "2024-01-01T00:00:00+00:00" version: 1 id: "123" type: arbitrary_rule schema: $ref: "#/components/schemas/ArbitraryRuleResponseArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: List custom allocation rules tags: - Cloud Cost Management post: description: |- Create a new custom allocation rule with the specified filters and allocation strategy. **Strategy Methods:** - **PROPORTIONAL/EVEN**: Allocates costs proportionally/evenly based on existing costs. Requires: granularity, allocated_by_tag_keys. Optional: based_on_costs, allocated_by_filters, evaluate_grouped_by_tag_keys, evaluate_grouped_by_filters. - **PROPORTIONAL_TIMESERIES/EVEN_TIMESERIES**: Allocates based on timeseries data. Requires: granularity, based_on_timeseries. Optional: evaluate_grouped_by_tag_keys. - **PERCENT**: Allocates fixed percentages to specific tags. Requires: allocated_by (array of percentage allocations). **Filter Conditions:** - Use **value** for single-value conditions: "is", "is not", "contains", "=", "!=", "like", "not like" - Use **values** for multi-value conditions: "in", "not in" - Cannot use both value and values simultaneously. **Supported operators**: is, is not, contains, in, not in, =, !=, like, not like operationId: CreateCustomAllocationRule requestBody: content: application/json: examples: default: value: data: attributes: costs_to_allocate: - condition: is tag: account_id value: "123456789" - condition: in tag: environment value: "" values: - production - staging enabled: true order_id: 1 provider: - aws - gcp rule_name: example-arbitrary-cost-rule strategy: allocated_by_tag_keys: - team - environment based_on_costs: - condition: is tag: service value: web-api - condition: not in tag: team value: "" values: - legacy - deprecated granularity: daily method: proportional type: shared type: upsert_arbitrary_rule schema: $ref: "#/components/schemas/ArbitraryCostUpsertRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: costs_to_allocate: - condition: is tag: account_id value: "123456789" created: "2024-01-01T00:00:00+00:00" enabled: true order_id: 1 provider: - aws rule_name: example-arbitrary-cost-rule strategy: allocated_by_tag_keys: - team granularity: daily method: proportional type: shared updated: "2024-01-01T00:00:00+00:00" version: 1 id: "123" type: arbitrary_rule schema: $ref: "#/components/schemas/ArbitraryRuleResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Create custom allocation rule tags: - Cloud Cost Management /api/v2/cost/arbitrary_rule/reorder: post: description: |- Reorder custom allocation rules - Change the execution order of custom allocation rules. **Important**: You must provide the **complete list** of all rule IDs in the desired execution order. The API will reorder ALL rules according to the provided sequence. Rules are executed in the order specified, with lower indices (earlier in the array) having higher priority. **Example**: If you have rules with IDs [123, 456, 789] and want to change order from 123→456→789 to 456→123→789, send: [{"id": "456"}, {"id": "123"}, {"id": "789"}] operationId: ReorderCustomAllocationRules requestBody: content: application/json: examples: default: value: data: - id: "456" type: arbitrary_rule - id: "123" type: arbitrary_rule - id: "789" type: arbitrary_rule schema: $ref: "#/components/schemas/ReorderRuleResourceArray" required: true responses: "204": description: Successfully reordered rules "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Reorder custom allocation rules tags: - Cloud Cost Management /api/v2/cost/arbitrary_rule/status: get: description: List the processing status of all custom allocation rules. Returns only the ID and processing status for each rule. operationId: ListCustomAllocationRulesStatus responses: "200": content: application/json: examples: default: value: data: - attributes: processing_status: processing id: "123" type: arbitrary_rule_status - attributes: processing_status: done id: "456" type: arbitrary_rule_status schema: $ref: "#/components/schemas/ArbitraryRuleStatusResponseArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: List custom allocation rule statuses tags: - Cloud Cost Management /api/v2/cost/arbitrary_rule/{rule_id}: delete: description: Delete a custom allocation rule - Delete an existing custom allocation rule by its ID operationId: DeleteCustomAllocationRule parameters: - description: The unique identifier of the custom allocation rule in: path name: rule_id required: true schema: format: int64 type: integer responses: "204": description: No Content "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Delete custom allocation rule tags: - Cloud Cost Management get: description: Get a specific custom allocation rule - Retrieve a specific custom allocation rule by its ID operationId: GetCustomAllocationRule parameters: - description: The unique identifier of the custom allocation rule in: path name: rule_id required: true schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: costs_to_allocate: - condition: is tag: account_id value: "123456789" values: created: "2024-01-01T00:00:00+00:00" enabled: true last_modified_user_uuid: user-example-uuid order_id: 1 provider: - aws rule_name: example-custom-allocation-rule strategy: allocated_by_tag_keys: - team granularity: daily method: proportional type: shared updated: "2024-01-01T00:00:00+00:00" version: 1 id: "123" type: arbitrary_rule schema: $ref: "#/components/schemas/ArbitraryRuleResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Get custom allocation rule tags: - Cloud Cost Management patch: description: |- Update an existing custom allocation rule with new filters and allocation strategy. **Strategy Methods:** - **PROPORTIONAL/EVEN**: Allocates costs proportionally/evenly based on existing costs. Requires: granularity, allocated_by_tag_keys. Optional: based_on_costs, allocated_by_filters, evaluate_grouped_by_tag_keys, evaluate_grouped_by_filters. - **PROPORTIONAL_TIMESERIES/EVEN_TIMESERIES**: Allocates based on timeseries data. Requires: granularity, based_on_timeseries. Optional: evaluate_grouped_by_tag_keys. - **PERCENT**: Allocates fixed percentages to specific tags. Requires: allocated_by (array of percentage allocations). - **USAGE_METRIC**: Allocates based on usage metrics (implementation varies). **Filter Conditions:** - Use **value** for single-value conditions: "is", "is not", "contains", "=", "!=", "like", "not like" - Use **values** for multi-value conditions: "in", "not in" - Cannot use both value and values simultaneously. **Supported operators**: is, is not, contains, in, not in, =, !=, like, not like operationId: UpdateCustomAllocationRule parameters: - description: The unique identifier of the custom allocation rule in: path name: rule_id required: true schema: format: int64 type: integer requestBody: content: application/json: examples: default: value: data: attributes: costs_to_allocate: - condition: is tag: account_id value: "123456789" - condition: in tag: environment value: "" values: - production - staging enabled: true order_id: 1 provider: - aws - gcp rule_name: example-arbitrary-cost-rule strategy: allocated_by_tag_keys: - team - environment based_on_costs: - condition: is tag: service value: web-api - condition: not in tag: team value: "" values: - legacy - deprecated granularity: daily method: proportional type: shared type: upsert_arbitrary_rule schema: $ref: "#/components/schemas/ArbitraryCostUpsertRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: costs_to_allocate: - condition: is tag: account_id value: "123456789" created: "2024-01-01T00:00:00+00:00" enabled: true order_id: 1 provider: - aws rule_name: example-arbitrary-cost-rule strategy: allocated_by_tag_keys: - team granularity: daily method: proportional type: shared updated: "2024-01-01T00:00:00+00:00" version: 1 id: "123" type: arbitrary_rule schema: $ref: "#/components/schemas/ArbitraryRuleResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Update custom allocation rule tags: - Cloud Cost Management /api/v2/cost/aws_cur_config: get: description: List the AWS CUR configs. operationId: ListCostAWSCURConfigs responses: "200": content: application/json: examples: default: value: data: - attributes: account_id: "123456789123" bucket_name: dd-cost-bucket bucket_region: us-east-1 created_at: "2023-01-01T12:00:00.000000" error_messages: [] months: 36 report_name: dd-report-name report_prefix: dd-report-prefix status: active status_updated_at: "2023-01-01T12:00:00.000000" updated_at: "2023-01-01T12:00:00.000000" id: "123" type: aws_cur_config schema: $ref: "#/components/schemas/AwsCURConfigsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: List Cloud Cost Management AWS CUR configs tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read post: description: Create a Cloud Cost Management account for an AWS CUR config. operationId: CreateCostAWSCURConfig requestBody: content: application/json: examples: default: value: data: attributes: account_filters: excluded_accounts: - "123456789123" - "123456789143" include_new_accounts: true included_accounts: - "123456789123" - "123456789143" account_id: "123456789123" bucket_name: dd-cost-bucket bucket_region: us-east-1 report_name: dd-report-name report_prefix: dd-report-prefix type: aws_cur_config_post_request schema: $ref: "#/components/schemas/AwsCURConfigPostRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: account_filters: excluded_accounts: - "123456789124" - "123456789125" include_new_accounts: true account_id: "123456789123" bucket_name: dd-cost-bucket bucket_region: us-east-1 created_at: "2023-01-01T12:00:00.000000" error_messages: [] months: 36 report_name: dd-report-name report_prefix: dd-report-prefix status: active status_updated_at: "2023-01-01T12:00:00.000000" updated_at: "2023-01-01T12:00:00.000000" id: "123456789123" type: aws_cur_config schema: $ref: "#/components/schemas/AwsCurConfigResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Create Cloud Cost Management AWS CUR config tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_write /api/v2/cost/aws_cur_config/{cloud_account_id}: delete: description: Archive a Cloud Cost Management Account. operationId: DeleteCostAWSCURConfig parameters: - $ref: "#/components/parameters/CloudAccountID" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Delete Cloud Cost Management AWS CUR config tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_write get: description: Get a specific AWS CUR config. operationId: GetCostAWSCURConfig parameters: - description: The unique identifier of the cloud account in: path name: cloud_account_id required: true schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: account_filters: excluded_accounts: - "123456789124" - "123456789125" include_new_accounts: true account_id: "123456789123" bucket_name: dd-cost-bucket bucket_region: us-east-1 created_at: "2023-01-01T12:00:00.000000" error_messages: [] months: 36 report_name: dd-report-name report_prefix: dd-report-prefix status: active status_updated_at: "2023-01-01T12:00:00.000000" updated_at: "2023-01-01T12:00:00.000000" id: "123456789123" type: aws_cur_config schema: $ref: "#/components/schemas/AwsCurConfigResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Get cost AWS CUR config tags: - Cloud Cost Management patch: description: Update the status (active/archived) and/or account filtering configuration of an AWS CUR config. operationId: UpdateCostAWSCURConfig parameters: - $ref: "#/components/parameters/CloudAccountID" requestBody: content: application/json: examples: default: value: data: attributes: account_filters: excluded_accounts: - "123456789123" - "123456789143" include_new_accounts: true included_accounts: - "123456789123" - "123456789143" is_enabled: true type: aws_cur_config_patch_request schema: $ref: "#/components/schemas/AwsCURConfigPatchRequest" required: true responses: "200": content: application/json: examples: default: value: data: - attributes: account_id: "123456789123" bucket_name: dd-cost-bucket bucket_region: us-east-1 created_at: "2023-01-01T12:00:00.000000" error_messages: [] months: 36 report_name: dd-report-name report_prefix: dd-report-prefix status: active status_updated_at: "2023-01-01T12:00:00.000000" updated_at: "2023-01-01T12:00:00.000000" id: "123" type: aws_cur_config schema: $ref: "#/components/schemas/AwsCURConfigsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Update Cloud Cost Management AWS CUR config tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_write /api/v2/cost/azure_uc_config: get: description: List the Azure configs. operationId: ListCostAzureUCConfigs responses: "200": content: application/json: examples: default: value: data: - attributes: configs: - account_id: 1234abcd-1234-abcd-1234-1234abcd1234 client_id: 1234abcd-1234-abcd-1234-1234abcd1234 created_at: "2023-01-01T12:00:00.000000" dataset_type: actual error_messages: [] export_name: dd-actual-export export_path: dd-export-path id: "123456789123" months: 36 scope: /subscriptions/1234abcd-1234-abcd-1234-1234abcd1234 status: active status_updated_at: "2023-01-01T12:00:00.000000" storage_account: dd-storage-account storage_container: dd-storage-container updated_at: "2023-01-01T12:00:00.000000" id: "123456789123" type: azure_uc_configs schema: $ref: "#/components/schemas/AzureUCConfigsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: List Cloud Cost Management Azure configs tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read post: description: Create a Cloud Cost Management account for an Azure config. operationId: CreateCostAzureUCConfigs requestBody: content: application/json: examples: default: value: data: attributes: account_id: 1234abcd-1234-abcd-1234-1234abcd1234 actual_bill_config: export_name: dd-actual-export export_path: dd-export-path storage_account: dd-storage-account storage_container: dd-storage-container amortized_bill_config: export_name: dd-actual-export export_path: dd-export-path storage_account: dd-storage-account storage_container: dd-storage-container client_id: 1234abcd-1234-abcd-1234-1234abcd1234 scope: /subscriptions/1234abcd-1234-abcd-1234-1234abcd1234 type: azure_uc_config_post_request schema: $ref: "#/components/schemas/AzureUCConfigPostRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: configs: - account_id: 1234abcd-1234-abcd-1234-1234abcd1234 client_id: 1234abcd-1234-abcd-1234-1234abcd1234 created_at: "2023-01-01T12:00:00.000000" dataset_type: actual error_messages: [] export_name: dd-actual-export export_path: dd-export-path id: "123456789123" months: 36 scope: /subscriptions/1234abcd-1234-abcd-1234-1234abcd1234 status: active status_updated_at: "2023-01-01T12:00:00.000000" storage_account: dd-storage-account storage_container: dd-storage-container updated_at: "2023-01-01T12:00:00.000000" id: "123456789123" type: azure_uc_configs schema: $ref: "#/components/schemas/AzureUCConfigPairsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Create Cloud Cost Management Azure configs tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_write /api/v2/cost/azure_uc_config/{cloud_account_id}: delete: description: Archive a Cloud Cost Management Account. operationId: DeleteCostAzureUCConfig parameters: - $ref: "#/components/parameters/CloudAccountID" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Delete Cloud Cost Management Azure config tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_write get: description: Get a specific Azure config. operationId: GetCostAzureUCConfig parameters: - description: The unique identifier of the cloud account in: path name: cloud_account_id required: true schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: configs: - account_id: 1234abcd-1234-abcd-1234-1234abcd1234 client_id: 1234abcd-1234-abcd-1234-1234abcd1234 created_at: "2023-01-01T12:00:00.000000" dataset_type: actual error_messages: [] export_name: dd-actual-export export_path: dd-export-path id: "123456789123" months: 36 scope: /subscriptions/1234abcd-1234-abcd-1234-1234abcd1234 status: active status_updated_at: "2023-01-01T12:00:00.000000" storage_account: dd-storage-account storage_container: dd-storage-container updated_at: "2023-01-01T12:00:00.000000" id: "123456789123" type: azure_uc_configs schema: $ref: "#/components/schemas/UCConfigPair" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Get cost Azure UC config tags: - Cloud Cost Management patch: description: Update the status of an Azure config (active/archived). operationId: UpdateCostAzureUCConfigs parameters: - $ref: "#/components/parameters/CloudAccountID" requestBody: content: application/json: examples: default: value: data: attributes: is_enabled: true type: azure_uc_config_patch_request schema: $ref: "#/components/schemas/AzureUCConfigPatchRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: configs: - account_id: 1234abcd-1234-abcd-1234-1234abcd1234 client_id: 1234abcd-1234-abcd-1234-1234abcd1234 created_at: "2023-01-01T12:00:00.000000" dataset_type: actual error_messages: [] export_name: dd-actual-export export_path: dd-export-path id: "123456789123" months: 36 scope: /subscriptions/1234abcd-1234-abcd-1234-1234abcd1234 status: active status_updated_at: "2023-01-01T12:00:00.000000" storage_account: dd-storage-account storage_container: dd-storage-container updated_at: "2023-01-01T12:00:00.000000" id: "123456789123" type: azure_uc_configs schema: $ref: "#/components/schemas/AzureUCConfigPairsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Update Cloud Cost Management Azure config tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_write /api/v2/cost/budget: put: description: Create a new budget or update an existing one. operationId: UpsertBudget requestBody: content: application/json: examples: default: value: data: attributes: created_at: 1738258683590 created_by: 00000000-0a0a-0a0a-aaa0-00000000000a end_month: 202502 metrics_query: aws.cost.amortized{service:ec2} by {service} name: my budget org_id: 123 start_month: 202501 total_amount: 1000 updated_at: 1738258683590 updated_by: 00000000-0a0a-0a0a-aaa0-00000000000a id: 00000000-0a0a-0a0a-aaa0-00000000000a type: "" schema: $ref: "#/components/schemas/BudgetWithEntries" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: 1738258683590 created_by: 00000000-0a0a-0a0a-aaa0-00000000000a end_month: 202502 entries: - amount: 500 month: 202501 tag_filters: - tag_key: service tag_value: ec2 metrics_query: aws.cost.amortized{service:ec2} by {service} name: my budget org_id: 123 start_month: 202501 total_amount: 1000 updated_at: 1738258683590 updated_by: 00000000-0a0a-0a0a-aaa0-00000000000a id: 00000000-0a0a-0a0a-aaa0-00000000000a type: budget schema: $ref: "#/components/schemas/BudgetWithEntries" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create or update a budget tags: - Cloud Cost Management /api/v2/cost/budget/csv/validate: post: operationId: ValidateCsvBudget responses: "200": content: application/json: examples: default: value: errors: [] schema: $ref: "#/components/schemas/ValidationResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: [] summary: Validate CSV budget tags: - Cloud Cost Management /api/v2/cost/budget/custom-forecast: put: description: |- Create or replace the custom forecast for an existing budget. Pass an empty `entries` list to delete the custom forecast for the budget. operationId: UpsertCustomForecast requestBody: content: application/json: examples: default: value: data: attributes: budget_uid: 00000000-0000-0000-0000-000000000001 entries: - amount: 400 month: 202501 tag_filters: - tag_key: service tag_value: ec2 - amount: 450 month: 202502 tag_filters: - tag_key: service tag_value: ec2 id: "" type: custom_forecast schema: $ref: "#/components/schemas/CustomForecastUpsertRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: budget_uid: 00000000-0000-0000-0000-000000000001 created_at: 1738258683590 created_by: 00000000-0a0a-0a0a-aaa0-00000000000a entries: - amount: 400 month: 202501 tag_filters: - tag_key: service tag_value: ec2 - amount: 450 month: 202502 tag_filters: - tag_key: service tag_value: ec2 updated_at: 1738258683590 updated_by: 00000000-0a0a-0a0a-aaa0-00000000000a id: 11111111-1111-1111-1111-111111111111 type: custom_forecast schema: $ref: "#/components/schemas/CustomForecastResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create or replace a budget's custom forecast tags: - Cloud Cost Management /api/v2/cost/budget/validate: post: description: Validate a budget configuration without creating or modifying it operationId: ValidateBudget requestBody: content: application/json: examples: default: value: data: attributes: created_at: 1738258683590 created_by: 00000000-0a0a-0a0a-aaa0-00000000000a end_month: 202502 entries: - amount: 500 month: 202501 tag_filters: - tag_key: service tag_value: ec2 - amount: 500 month: 202502 tag_filters: - tag_key: service tag_value: ec2 metrics_query: aws.cost.amortized{service:ec2} by {service} name: my budget org_id: 123 start_month: 202501 total_amount: 1000 updated_at: 1738258683590 updated_by: 00000000-0a0a-0a0a-aaa0-00000000000a id: "1" type: budget schema: $ref: "#/components/schemas/BudgetValidationRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: errors: [] valid: true id: budget_validation type: budget_validation schema: $ref: "#/components/schemas/BudgetValidationResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Validate budget tags: - Cloud Cost Management /api/v2/cost/budget/{budget_id}: delete: description: Delete a budget operationId: DeleteBudget parameters: - $ref: "#/components/parameters/BudgetID" responses: "204": description: No Content "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete budget tags: - Cloud Cost Management get: description: Get a budget by ID. Pass `actual=true` or `forecast=true` to include cost data in the response. Use `start` and `end` (millisecond epochs, both required) to set the cost window. When `forecast=true`, each entry also includes `ootb_forecast` (the ML forecast before overrides) and `custom_forecast` (`null` if no override is set, a number if one is). operationId: GetBudget parameters: - $ref: "#/components/parameters/BudgetID" - description: When `true`, includes actual cost data in the response. in: query name: actual required: false schema: type: boolean - description: When `true`, includes forecast cost data in the response, including `ootb_forecast` and `custom_forecast` per entry. in: query name: forecast required: false schema: type: boolean - description: Start of the cost window in milliseconds since epoch. Must be used together with `end`. in: query name: start required: false schema: format: int64 type: integer - description: End of the cost window in milliseconds since epoch. Must be used together with `start`. in: query name: end required: false schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: costs: actual: 850.25 amount: 1000.0 forecast: 1100.5 ootb_forecast: 1100.5 costs_period_end: 1740873600000 costs_period_start: 1738281600000 costs_unit: family: currency id: 42 name: dollar plural: dollars scale_factor: 1.0 short_name: $ created_at: 1738258683590 created_by: 00000000-0a0a-0a0a-aaa0-00000000000a end_month: 202502 entries: - amount: 500 costs: actual: 425.5 amount: 500.0 custom_forecast: forecast: 550.25 ootb_forecast: 550.25 month: 202501 tag_filters: - tag_key: service tag_value: ec2 metrics_query: aws.cost.amortized{service:ec2} by {service} name: my budget org_id: 123 start_month: 202501 total_amount: 1000 updated_at: 1738258683590 updated_by: 00000000-0a0a-0a0a-aaa0-00000000000a id: 00000000-0a0a-0a0a-aaa0-00000000000a type: budget schema: $ref: "#/components/schemas/BudgetWithEntries" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get budget tags: - Cloud Cost Management /api/v2/cost/budget/{budget_id}/custom-forecast: delete: description: Delete the custom forecast for a budget. operationId: DeleteCustomForecast parameters: - $ref: "#/components/parameters/BudgetID" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete a budget's custom forecast tags: - Cloud Cost Management get: description: Get the custom forecast for a budget. operationId: GetCustomForecast parameters: - $ref: "#/components/parameters/BudgetID" responses: "200": content: application/json: examples: default: value: data: attributes: budget_uid: 00000000-0000-0000-0000-000000000001 created_at: 1738258683590 created_by: 00000000-0a0a-0a0a-aaa0-00000000000a entries: - amount: 400 month: 202501 tag_filters: - tag_key: service tag_value: ec2 - amount: 450 month: 202502 tag_filters: - tag_key: service tag_value: ec2 updated_at: 1738258683590 updated_by: 00000000-0a0a-0a0a-aaa0-00000000000a id: 11111111-1111-1111-1111-111111111111 type: custom_forecast schema: $ref: "#/components/schemas/CustomForecastResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a budget's custom forecast tags: - Cloud Cost Management /api/v2/cost/budgets: get: description: List budgets. operationId: ListBudgets responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: 1741011342772 created_by: user1 end_month: 202502 metrics_query: aws.cost.amortized{service:ec2} by {service} name: my budget org_id: 123 start_month: 202501 total_amount: 1000 updated_at: 1741011342772 updated_by: user2 id: 00000000-0a0a-0a0a-aaa0-00000000000a type: budget schema: $ref: "#/components/schemas/BudgetArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List budgets tags: - Cloud Cost Management /api/v2/cost/cloud_accounts: get: description: |- List the OCI and AWS CUR 2.0 cloud accounts for your organization, including account IDs, status, and validation errors. Use `filter[cloud]=oci` or `filter[cloud]=aws_cur2` to return a single cloud. When omitted or empty, both clouds are returned. AWS CUR 1.0, Azure, and GCP accounts are available through their dedicated configuration endpoints. Archived accounts are excluded. The response contains all matching accounts and is not paginated. This endpoint replaces `GET /api/v2/cost/oci_config`. To migrate, use `filter[cloud]=oci` and update clients to accept the `cloud_account` resource type instead of `oci_config`. Account IDs and the existing attributes are preserved; each account also includes the `cloud` attribute. operationId: ListCostCloudAccountsV2 parameters: - description: Filter by cloud, either `oci` or `aws_cur2` (case insensitive). Omit or leave empty to return both. example: oci in: query name: filter[cloud] required: false schema: pattern: ^([oO][cC][iI]|[aA][wW][sS]_[cC][uU][rR]2)?(?![\s\S]) type: string responses: "200": content: application/json: examples: default: value: data: - attributes: account_id: "ocid1.tenancy.oc1..example" cloud: oci created_at: "2026-01-01T12:00:00Z" error_messages: [] status: active status_updated_at: "2026-01-01T12:00:00Z" updated_at: "2026-01-01T12:00:00Z" id: "534" type: cloud_account schema: $ref: "#/components/schemas/CloudCostAccountsResponse" description: OK "400": content: application/json: examples: invalid_cloud: value: errors: - detail: 'attribute "filter[cloud]" must be one of: oci, aws_cur2' status: "400" title: Bad Request schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: List Cloud Cost Management cloud accounts tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read /api/v2/cost/commitments/commitment-list: get: description: Get a list of individual cloud commitments (Reserved Instances or Savings Plans) with their utilization details. The response schema varies based on the provider, product, and commitment type. operationId: GetCommitmentsCommitmentList parameters: - $ref: "#/components/parameters/CommitmentsProvider" - $ref: "#/components/parameters/CommitmentsProduct" - $ref: "#/components/parameters/CommitmentsStart" - $ref: "#/components/parameters/CommitmentsEnd" - $ref: "#/components/parameters/CommitmentsFilterBy" - $ref: "#/components/parameters/CommitmentsCommitmentType" responses: "200": content: application/json: examples: default: value: data: attributes: commitments: - availability_zone: us-east-1a commitment_id: ri-0123456789abcdef0 expiration_date: "2025-12-31T00:00:00Z" instance_type: m5.xlarge number_of_nfus: 4 number_of_reservations: 1 offering_class: standard operating_system: Linux purchase_option: All Upfront region: us-east-1 start_date: "2024-12-31T00:00:00Z" term_length_months: 12 utilization: 85.5 id: commitments_list_response type: commitments_list_response schema: $ref: "#/components/schemas/CommitmentsListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Get commitments list tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cost/commitments/coverage/scalar: get: description: Get scalar coverage metrics for cloud commitment programs, including hours and cost coverage percentages. operationId: GetCommitmentsCoverageScalar parameters: - $ref: "#/components/parameters/CommitmentsProvider" - $ref: "#/components/parameters/CommitmentsProduct" - $ref: "#/components/parameters/CommitmentsStart" - $ref: "#/components/parameters/CommitmentsEnd" - $ref: "#/components/parameters/CommitmentsFilterBy" responses: "200": content: application/json: examples: default: value: columns: - name: service type: group values: - - ec2 - meta: unit: family: percentage id: 17 name: percent plural: percent scale_factor: 1 short_name: "%" name: hours_coverage type: number values: - 0.78 schema: $ref: "#/components/schemas/CommitmentsCoverageScalarResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Get commitments coverage (scalar) tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cost/commitments/coverage/timeseries: get: description: Get timeseries coverage metrics for cloud commitment programs, broken down by coverage type (Reserved Instances, Savings Plans, On-Demand, and Spot) for both hours and cost. operationId: GetCommitmentsCoverageTimeseries parameters: - $ref: "#/components/parameters/CommitmentsProvider" - $ref: "#/components/parameters/CommitmentsProduct" - $ref: "#/components/parameters/CommitmentsStart" - $ref: "#/components/parameters/CommitmentsEnd" - $ref: "#/components/parameters/CommitmentsFilterBy" responses: "200": content: application/json: examples: default: value: cost: series: on_demand_only: - 1000.0 - 900.0 ri: - 3600.0 - 3700.0 sp: - 400.0 - 400.0 spot_only: - 50.0 - 50.0 times: - 1693526400 - 1693612800 hours: series: on_demand_only: - 500.0 - 450.0 ri: - 1800.0 - 1850.0 sp: - 200.0 - 200.0 spot_only: - 100.0 - 100.0 times: - 1693526400 - 1693612800 schema: $ref: "#/components/schemas/CommitmentsCoverageTimeseriesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Get commitments coverage (timeseries) tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cost/commitments/on-demand-hot-spots/scalar: get: description: Get scalar on-demand hot-spots data for cloud commitment programs, showing per-dimension breakdowns of on-demand spending with coverage metrics and potential savings. operationId: GetCommitmentsOnDemandHotspotsScalar parameters: - $ref: "#/components/parameters/CommitmentsProvider" - $ref: "#/components/parameters/CommitmentsProduct" - $ref: "#/components/parameters/CommitmentsStart" - $ref: "#/components/parameters/CommitmentsEnd" - $ref: "#/components/parameters/CommitmentsFilterBy" responses: "200": content: application/json: examples: default: value: columns: - name: service type: group values: - - ec2 - meta: unit: family: money id: 1 name: dollar plural: dollars scale_factor: 1 short_name: "$" name: on_demand_cost type: number values: - 1500.0 total: - meta: unit: family: money id: 1 name: dollar plural: dollars scale_factor: 1 short_name: "$" name: on_demand_cost type: number values: - 1500.0 schema: $ref: "#/components/schemas/CommitmentsOnDemandHotspotsScalarResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Get commitments on-demand hot spots (scalar) tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cost/commitments/savings/scalar: get: description: Get scalar savings metrics for cloud commitment programs, including realized savings and effective savings rate. operationId: GetCommitmentsSavingsScalar parameters: - $ref: "#/components/parameters/CommitmentsProvider" - $ref: "#/components/parameters/CommitmentsProduct" - $ref: "#/components/parameters/CommitmentsStart" - $ref: "#/components/parameters/CommitmentsEnd" - $ref: "#/components/parameters/CommitmentsFilterBy" responses: "200": content: application/json: examples: default: value: columns: - meta: unit: family: money id: 1 name: dollar plural: dollars scale_factor: 1 short_name: "$" name: realized_savings type: number values: - 2500.0 - meta: unit: family: percentage id: 17 name: percent plural: percent scale_factor: 1 short_name: "%" name: effective_savings_rate type: number values: - 0.33 schema: $ref: "#/components/schemas/CommitmentsSavingsScalarResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Get commitments savings (scalar) tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cost/commitments/savings/timeseries: get: description: Get timeseries savings metrics for cloud commitment programs, including actual cost, on-demand equivalent cost, realized savings, and effective savings rate over time. operationId: GetCommitmentsSavingsTimeseries parameters: - $ref: "#/components/parameters/CommitmentsProvider" - $ref: "#/components/parameters/CommitmentsProduct" - $ref: "#/components/parameters/CommitmentsStart" - $ref: "#/components/parameters/CommitmentsEnd" - $ref: "#/components/parameters/CommitmentsFilterBy" responses: "200": content: application/json: examples: default: value: actual_cost: series: total: - 5000.0 - 5200.0 times: - 1693526400 - 1693612800 unit: family: money id: 1 name: dollar plural: dollars scale_factor: 1 short_name: "$" effective_savings_rate: series: total: - 0.33 - 0.33 times: - 1693526400 - 1693612800 on_demand_equivalent_cost: series: total: - 7500.0 - 7800.0 times: - 1693526400 - 1693612800 realized_savings: series: total: - 2500.0 - 2600.0 times: - 1693526400 - 1693612800 schema: $ref: "#/components/schemas/CommitmentsSavingsTimeseriesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Get commitments savings (timeseries) tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cost/commitments/utilization/scalar: get: description: Get scalar utilization metrics for cloud commitment programs, including utilization percentage and unused cost. operationId: GetCommitmentsUtilizationScalar parameters: - $ref: "#/components/parameters/CommitmentsProvider" - $ref: "#/components/parameters/CommitmentsProduct" - $ref: "#/components/parameters/CommitmentsStart" - $ref: "#/components/parameters/CommitmentsEnd" - $ref: "#/components/parameters/CommitmentsFilterBy" - $ref: "#/components/parameters/CommitmentsCommitmentType" responses: "200": content: application/json: examples: default: value: columns: - name: service type: group values: - - ec2 - - rds - meta: unit: family: percentage id: 17 name: percent plural: percent scale_factor: 1 short_name: "%" name: utilization type: number values: - 0.85 - 0.72 schema: $ref: "#/components/schemas/CommitmentsUtilizationScalarResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Get commitments utilization (scalar) tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cost/commitments/utilization/timeseries: get: description: Get timeseries utilization metrics for cloud commitment programs, including used and unused cost series over time. operationId: GetCommitmentsUtilizationTimeseries parameters: - $ref: "#/components/parameters/CommitmentsProvider" - $ref: "#/components/parameters/CommitmentsProduct" - $ref: "#/components/parameters/CommitmentsStart" - $ref: "#/components/parameters/CommitmentsEnd" - $ref: "#/components/parameters/CommitmentsFilterBy" - $ref: "#/components/parameters/CommitmentsCommitmentType" responses: "200": content: application/json: examples: default: value: series: unused: - 750.0 - 600.0 used: - 4250.0 - 4400.0 times: - 1693526400 - 1693612800 unit: family: money id: 1 name: dollar plural: dollars scale_factor: 1 short_name: "$" schema: $ref: "#/components/schemas/CommitmentsUtilizationTimeseriesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Get commitments utilization (timeseries) tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cost/custom_costs: get: description: List the Custom Costs files. operationId: ListCustomCostsFiles parameters: - description: Page number for pagination in: query name: page[number] schema: format: int64 type: integer - description: Page size for pagination in: query name: page[size] schema: default: 100 format: int64 type: integer - description: Filter by file status in: query name: filter[status] schema: type: string - description: Filter files by name with case-insensitive substring matching. in: query name: filter[name] schema: type: string - description: Filter by provider. in: query name: filter[provider] schema: items: type: string type: array - description: Sort key with optional descending prefix in: query name: sort schema: default: created_at type: string responses: "200": content: application/json: examples: default: value: data: - attributes: ai_provider: false billed_cost: 100.5 billing_currency: USD charge_period: end: 1706745600000 start: 1704067200000 name: my_file.json provider_names: - my_provider status: active uploaded_at: 1704067200000 id: 00000000-0000-0000-0000-000000000005 type: custom_costs meta: total_filtered_count: 1 version: "1" schema: $ref: "#/components/schemas/CustomCostsFileListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: List Custom Costs files tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read put: description: Upload a Custom Costs file. operationId: UploadCustomCostsFile parameters: - description: Whether the uploaded file contains the costs of an AI provider. in: query name: ai_provider required: false schema: default: false type: boolean requestBody: content: application/json: examples: default: value: - BilledCost: 100.5 BillingCurrency: USD ChargeDescription: Monthly usage charge for my service ChargePeriodEnd: "2023-02-28" ChargePeriodStart: "2023-02-01" schema: $ref: "#/components/schemas/CustomCostsFileUploadRequest" required: true responses: "202": content: application/json: examples: default: value: data: attributes: ai_provider: false billed_cost: 100.5 billing_currency: USD charge_period: end: 1706745600000 start: 1704067200000 name: my_file.json provider_names: - my_provider status: pending uploaded_at: 1704067200000 id: 00000000-0000-0000-0000-000000000006 type: custom_costs meta: version: "1" schema: $ref: "#/components/schemas/CustomCostsFileUploadResponse" description: Accepted "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Upload Custom Costs file tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_write /api/v2/cost/custom_costs/{file_id}: delete: description: Delete the specified Custom Costs file. operationId: DeleteCustomCostsFile parameters: - $ref: "#/components/parameters/FileID" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Delete Custom Costs file tags: - Cloud Cost Management get: description: Fetch the specified Custom Costs file. operationId: GetCustomCostsFile parameters: - $ref: "#/components/parameters/FileID" responses: "200": content: application/json: examples: default: value: data: attributes: ai_provider: false billed_cost: 100.5 billing_currency: USD charge_period: end: 1706745600000 start: 1704067200000 content: - BilledCost: 100.5 BillingCurrency: USD ChargeDescription: Monthly usage charge for my service ChargePeriodEnd: "2023-02-28" ChargePeriodStart: "2023-02-01" name: my_file.json provider_names: - my_provider status: active uploaded_at: 1704067200000 id: 00000000-0000-0000-0000-000000000007 type: custom_costs meta: version: "1" schema: $ref: "#/components/schemas/CustomCostsFileGetResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Get Custom Costs file tags: - Cloud Cost Management /api/v2/cost/gcp_uc_config: get: description: List the Google Cloud Usage Cost configs. operationId: ListCostGCPUsageCostConfigs responses: "200": content: application/json: examples: default: value: data: - attributes: account_id: 123456_A123BC_12AB34 bucket_name: dd-cost-bucket created_at: "2023-01-01T12:00:00.000000" dataset: billing error_messages: [] export_prefix: datadog_cloud_cost_usage_export export_project_name: dd-cloud-cost-report months: 36 project_id: my-project-123 service_account: dd-ccm-gcp-integration@my-environment.iam.gserviceaccount.com status: active status_updated_at: "2023-01-01T12:00:00.000000" updated_at: "2023-01-01T12:00:00.000000" id: "123456789123" type: gcp_uc_config schema: $ref: "#/components/schemas/GCPUsageCostConfigsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: List Google Cloud Usage Cost configs tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read post: description: Create a Cloud Cost Management account for an Google Cloud Usage Cost config. operationId: CreateCostGCPUsageCostConfig requestBody: content: application/json: examples: default: value: data: attributes: billing_account_id: 123456_A123BC_12AB34 bucket_name: dd-cost-bucket export_dataset_name: billing export_prefix: datadog_cloud_cost_usage_export export_project_name: dd-cloud-cost-report service_account: dd-ccm-gcp-integration@my-environment.iam.gserviceaccount.com type: gcp_uc_config_post_request schema: $ref: "#/components/schemas/GCPUsageCostConfigPostRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: account_id: 123456_A123BC_12AB34 bucket_name: dd-cost-bucket created_at: "2023-01-01T12:00:00.000000" dataset: billing error_messages: [] export_prefix: datadog_cloud_cost_usage_export export_project_name: dd-cloud-cost-report months: 36 project_id: my-project-123 service_account: dd-ccm-gcp-integration@my-environment.iam.gserviceaccount.com status: active status_updated_at: "2023-01-01T12:00:00.000000" updated_at: "2023-01-01T12:00:00.000000" id: "123456789123" type: gcp_uc_config schema: $ref: "#/components/schemas/GCPUsageCostConfigResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Create Google Cloud Usage Cost config tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_write /api/v2/cost/gcp_uc_config/{cloud_account_id}: delete: description: Archive a Cloud Cost Management account. operationId: DeleteCostGCPUsageCostConfig parameters: - $ref: "#/components/parameters/CloudAccountID" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Delete Google Cloud Usage Cost config tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_write get: description: Get a specific Google Cloud Usage Cost config. operationId: GetCostGCPUsageCostConfig parameters: - description: The unique identifier of the cloud account in: path name: cloud_account_id required: true schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: account_id: 123456_A123BC_12AB34 bucket_name: dd-cost-bucket created_at: "2023-01-01T12:00:00.000000" dataset: billing error_messages: [] export_prefix: datadog_cloud_cost_usage_export export_project_name: dd-cloud-cost-report months: 36 project_id: my-project-123 service_account: dd-ccm-gcp-integration@my-environment.iam.gserviceaccount.com status: active status_updated_at: "2023-01-01T12:00:00.000000" updated_at: "2023-01-01T12:00:00.000000" id: "123456789123" type: gcp_uc_config schema: $ref: "#/components/schemas/GcpUcConfigResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Get Google Cloud Usage Cost config tags: - Cloud Cost Management patch: description: Update the status of an Google Cloud Usage Cost config (active/archived). operationId: UpdateCostGCPUsageCostConfig parameters: - $ref: "#/components/parameters/CloudAccountID" requestBody: content: application/json: examples: default: value: data: attributes: is_enabled: true type: gcp_uc_config_patch_request schema: $ref: "#/components/schemas/GCPUsageCostConfigPatchRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: account_id: 123456_A123BC_12AB34 bucket_name: dd-cost-bucket created_at: "2023-01-01T12:00:00.000000" dataset: billing error_messages: [] export_prefix: datadog_cloud_cost_usage_export export_project_name: dd-cloud-cost-report months: 36 project_id: my-project-123 service_account: dd-ccm-gcp-integration@my-environment.iam.gserviceaccount.com status: active status_updated_at: "2023-01-01T12:00:00.000000" updated_at: "2023-01-01T12:00:00.000000" id: "123456789123" type: gcp_uc_config schema: $ref: "#/components/schemas/GCPUsageCostConfigResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Update Google Cloud Usage Cost config tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_write /api/v2/cost/oci_config: get: deprecated: true description: |- **Note**: This endpoint is deprecated. Use [List Cloud Cost Management cloud accounts](https://docs.datadoghq.com/api/latest/cloud-cost-management/#list-cloud-cost-management-cloud-accounts) with `filter[cloud]=oci` instead. Update clients to accept the `cloud_account` resource type instead of `oci_config`. Account IDs and the existing attributes are preserved; each account also includes the `cloud` attribute. List the OCI configs. operationId: ListCostOCIConfigs responses: "200": content: application/json: examples: default: value: data: - attributes: account_id: "ocid1.tenancy.oc1..example" created_at: "2026-01-01T12:00:00Z" status: active status_updated_at: "2026-01-01T12:00:00Z" updated_at: "2026-01-01T12:00:00Z" id: "1" type: oci_config schema: $ref: "#/components/schemas/OCIConfigsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: List Cloud Cost Management OCI configs tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-sunset: "2027-01-01" /api/v2/cost/recommendations: post: description: List cost recommendations matching a filter, with pagination and sorting. operationId: SearchCostRecommendations parameters: - description: Number of results per page, from 1 to 5000. Defaults to 50. in: query name: page[size] schema: default: 50 format: int32 maximum: 5000 minimum: 1 type: integer - description: Pagination token from a previous response. in: query name: page[token] schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: scope: ccm sort: - expression: "@potential_daily_savings" order: DESC id: "@resource_table:aws_ec2_instance" type: recommendations_filter schema: $ref: "#/components/schemas/RecommendationsFilterRequest" required: true responses: "200": content: application/json: examples: default: value: data: - attributes: dd_resource_key: "arn:aws:ec2:us-east-1:123456789012:instance/i-1234567890abcdef0" potential_daily_savings: amount: 1.23 currency: USD recommendation_type: terminate resource_id: i-1234567890abcdef0 resource_type: aws_ec2_instance tags: - "env:prod" - "team:ccm" id: encoded-event-id-1 type: recommendation meta: page: filter: "@resource_table:aws_ec2_instance" page_size: 100 schema: $ref: "#/components/schemas/CostRecommendationArray" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Search cost recommendations tags: - Cloud Cost Management x-permission: operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cost/tag_descriptions: get: description: List Cloud Cost Management tag key descriptions for the organization. Use `filter[cloud]` to scope the result to a single cloud provider; when omitted, both cross-cloud defaults and cloud-specific descriptions are returned. operationId: ListCostTagDescriptions parameters: - description: Filter descriptions to a specific cloud provider (for example, `aws`). Omit to return descriptions across all clouds. in: query name: filter[cloud] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: cloud: aws created_at: "2026-01-01T12:00:00Z" description: AWS account that owns this cost. source: human tag_key: account_id updated_at: "2026-01-01T12:00:00Z" id: account_id type: cost_tag_description schema: $ref: "#/components/schemas/CostTagDescriptionsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: List Cloud Cost Management tag descriptions tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read /api/v2/cost/tag_descriptions/{tag_key}: delete: description: Delete a Cloud Cost Management tag key description. When `cloud` is omitted, deletes every description for the tag key, falling back to Datadog's global default when available. When `cloud` is provided, deletes only the description scoped to that cloud provider. operationId: DeleteCostTagDescriptionByKey parameters: - description: The tag key whose description is being deleted. in: path name: tag_key required: true schema: type: string - description: Cloud provider to scope the deletion to (for example, `aws`). Omit to delete every description for the tag key. in: query name: cloud required: false schema: type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Delete a Cloud Cost Management tag description tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_write get: description: Get the Cloud Cost Management description for a single tag key. Use `filter[cloud]` to scope the lookup to a specific cloud provider; when omitted, the response resolves the description in fallback order (cloud-specific organization override, then cloudless organization default, then Datadog's global default). operationId: GetCostTagDescriptionByKey parameters: - description: The tag key whose description is being fetched. in: path name: tag_key required: true schema: type: string - description: Cloud provider to scope the lookup to (for example, `aws`). Omit to use the resolved fallback. in: query name: filter[cloud] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: cloud: aws created_at: "2026-01-01T12:00:00Z" description: AWS account that owns this cost. source: human tag_key: account_id updated_at: "2026-01-01T12:00:00Z" id: account_id type: cost_tag_description schema: $ref: "#/components/schemas/CostTagDescriptionResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Get a Cloud Cost Management tag description tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read put: description: Create or update a Cloud Cost Management tag key description. The new description and optional cloud scoping are supplied in the request body. Omit `cloud` to set a cross-cloud default for the tag key. operationId: UpsertCostTagDescriptionByKey parameters: - description: The tag key whose description is being upserted. in: path name: tag_key required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: cloud: aws description: AWS account that owns this cost. id: account_id type: cost_tag_description schema: $ref: "#/components/schemas/CostTagDescriptionUpsertRequest" required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Upsert a Cloud Cost Management tag description tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_write /api/v2/cost/tag_descriptions/{tag_key}/generate: get: description: Use AI to draft a Cloud Cost Management tag key description based on associated cost data. The generated description is returned in the response and is not persisted by this endpoint; follow up with `UpsertCostTagDescriptionByKey` to save it. operationId: GenerateCostTagDescriptionByKey parameters: - description: The tag key to generate an AI description for. in: path name: tag_key required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: description: AWS account that owns this cost. id: account_id type: cost_generated_tag_description schema: $ref: "#/components/schemas/GenerateCostTagDescriptionResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Generate a Cloud Cost Management tag description tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read /api/v2/cost/tag_keys: get: description: List Cloud Cost Management tag keys. operationId: ListCostTagKeys parameters: - description: The Cloud Cost Management metric to scope the tag keys to. When omitted, returns tag keys across all metrics. in: query name: filter[metric] schema: type: string - description: |- Filter to return only tag keys that appear with the given `key:value` tag values. For example, `filter[tags]=providername:aws` returns tag keys found on the same cost data, such as `is_aws_ec2_compute` and `aws_instance_type`. in: query name: filter[tags] schema: items: type: string type: array responses: "200": content: application/json: examples: default: value: data: - attributes: sources: - focus value: providername id: providername type: cost_tag_key - attributes: sources: [] value: service id: service type: cost_tag_key schema: $ref: "#/components/schemas/CostTagKeysResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: List Cloud Cost Management tag keys tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read /api/v2/cost/tag_keys/{tag_key}: get: description: Get details for a specific Cloud Cost Management tag key, including example tag values and description. operationId: GetCostTagKey parameters: - $ref: "#/components/parameters/TagKey" - description: The Cloud Cost Management metric to scope the tag key details to. When omitted, returns details across all metrics. in: query name: filter[metric] schema: type: string - description: |- Controls the size of the internal tag value search scope. This does **not** restrict the number of example tag values returned in the response. Defaults to 50, maximum 10000. in: query name: page[size] schema: default: 50 format: int32 maximum: 10000 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: details: description: The cloud provider name reported for the cost line item. tag_values: - aws - gcp - azure sources: - focus value: providername id: providername type: cost_tag_key schema: $ref: "#/components/schemas/CostTagKeyResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Get a Cloud Cost Management tag key tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read /api/v2/cost/tag_metadata: get: description: List Cloud Cost Management tag key metadata, including row counts, cost covered, cardinality, and a sample of top tag values per cloud account. Use `filter[daily]=true` to return daily rows instead of the default monthly roll-up. operationId: ListCostTagMetadata parameters: - description: The month to scope the query to, in `YYYY-MM` format. example: "2026-02" in: query name: filter[month] required: true schema: type: string - description: Filter results to a specific provider. Common cloud values are `aws`, `azure`, `gcp`, `Oracle` (OCI), and `custom`. SaaS billing integrations (for example, `Snowflake`, `MongoDB`, `Databricks`) are also accepted using their display-name string. Values are case-sensitive. in: query name: filter[provider] schema: type: string - description: Filter results to a specific Cloud Cost Management metric (for example, `aws.cost.net.amortized`). When omitted, every available metric for the requested period is returned. in: query name: filter[metric] schema: type: string - description: Restrict results to a single tag key. in: query name: filter[tag_key] schema: type: string - description: When `true`, return one row per day with the day in the `date` attribute. Defaults to the monthly roll-up when omitted. in: query name: filter[daily] schema: $ref: "#/components/schemas/CostTagMetadataDailyFilter" responses: "200": content: application/json: examples: default: value: data: - attributes: cardinality_by_account: "123456789012": 42 cost_covered: 1234.56 metric: aws.cost.net.amortized row_count: 100 tag_sources: - aws-user-defined top_values_by_account: "123456789012": - prod - staging id: env:aws.cost.net.amortized type: cost_tag_key_metadata schema: $ref: "#/components/schemas/CostTagKeyMetadataResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: List Cloud Cost Management tag key metadata tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cost/tag_metadata/currency: get: description: Get the dominant billing currency observed in Cloud Cost Management data for the requested period. The response wraps the currency in a JSON:API `data` array containing at most one entry; the array is empty when no currency data is available. operationId: GetCostTagMetadataCurrency parameters: - description: The month to scope the query to, in `YYYY-MM` format. example: "2026-02" in: query name: filter[month] required: true schema: type: string - description: Filter results to a specific provider. Common cloud values are `aws`, `azure`, `gcp`, `Oracle` (OCI), and `custom`. SaaS billing integrations (for example, `Snowflake`, `MongoDB`, `Databricks`) are also accepted using their display-name string. Values are case-sensitive. in: query name: filter[provider] schema: type: string responses: "200": content: application/json: examples: default: value: data: - id: USD type: cost_currency schema: $ref: "#/components/schemas/CostCurrencyResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Get the Cloud Cost Management billing currency tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cost/tag_metadata/metrics: get: description: List Cloud Cost Management metrics that have data for the requested period. operationId: ListCostTagMetadataMetrics parameters: - description: The month to scope the query to, in `YYYY-MM` format. example: "2026-02" in: query name: filter[month] required: true schema: type: string - description: Filter results to a specific provider. Common cloud values are `aws`, `azure`, `gcp`, `Oracle` (OCI), and `custom`. SaaS billing integrations (for example, `Snowflake`, `MongoDB`, `Databricks`) are also accepted using their display-name string. Values are case-sensitive. in: query name: filter[provider] schema: type: string responses: "200": content: application/json: examples: default: value: data: - id: aws.cost.net.amortized type: cost_metric - id: gcp.cost.amortized type: cost_metric schema: $ref: "#/components/schemas/CostMetricsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: List available Cloud Cost Management metrics tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cost/tag_metadata/months: get: description: |- List months that have Cloud Cost Management tag metadata for a given provider, ordered most-recent first. The response is capped at 36 months. operationId: ListCostTagMetadataMonths parameters: - description: |- Provider to scope the query to. Use the value of the `providername` tag in CCM (for example, `aws`, `azure`, `gcp`, `Oracle`, `Confluent Cloud`, `Snowflake`). For costs uploaded through the Custom Costs API, use `custom`. Values are case-sensitive. example: aws in: query name: filter[provider] required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: - id: "2026-04" type: cost_tag_metadata_month - id: "2026-03" type: cost_tag_metadata_month schema: $ref: "#/components/schemas/CostTagMetadataMonthsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: List Cloud Cost Management tag metadata months tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cost/tag_metadata/orchestrators: get: description: List container orchestrators (for example, `kubernetes`, `ecs`) detected in Cloud Cost Management data for the requested period. operationId: ListCostTagMetadataOrchestrators parameters: - description: The month to scope the query to, in `YYYY-MM` format. example: "2026-02" in: query name: filter[month] required: true schema: type: string - description: Filter results to a specific provider. Common cloud values are `aws`, `azure`, `gcp`, `Oracle` (OCI), and `custom`. SaaS billing integrations (for example, `Snowflake`, `MongoDB`, `Databricks`) are also accepted using their display-name string. Values are case-sensitive. in: query name: filter[provider] schema: type: string responses: "200": content: application/json: examples: default: value: data: - id: ecs type: cost_orchestrator - id: kubernetes type: cost_orchestrator schema: $ref: "#/components/schemas/CostOrchestratorsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: List Cloud Cost Management orchestrators tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cost/tag_metadata/tag_sources: get: description: List Cloud Cost Management tag keys observed for the requested period, along with the origin sources that produced them (for example, `aws-user-defined`, `custom`). operationId: ListCostTagKeySources parameters: - description: The month to scope the query to, in `YYYY-MM` format. example: "2026-02" in: query name: filter[month] required: true schema: type: string - description: Filter results to a specific provider. Common cloud values are `aws`, `azure`, `gcp`, `Oracle` (OCI), and `custom`. SaaS billing integrations (for example, `Snowflake`, `MongoDB`, `Databricks`) are also accepted using their display-name string. Values are case-sensitive. in: query name: filter[provider] schema: type: string - description: Filter results to tag keys that have data for a specific Cloud Cost Management metric (for example, `aws.cost.net.amortized`). When omitted, all tag keys for the requested period are returned. in: query name: filter[metric] schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: tag_key: env tag_sources: - aws-user-defined - custom id: env type: cost_tag_key_source - attributes: tag_key: service tag_sources: - aws id: service type: cost_tag_key_source schema: $ref: "#/components/schemas/CostTagKeySourcesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: List Cloud Cost Management tag sources tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cost/tags: get: description: List Cloud Cost Management tags for a given metric. operationId: ListCostTags parameters: - description: The Cloud Cost Management metric to scope the tags to. When omitted, returns tags across all metrics. in: query name: filter[metric] schema: type: string - description: A substring used to filter the returned tags by name. in: query name: filter[match] schema: type: string - description: |- Filter to return only tags that appear with the given `key:value` tag values. For example, `filter[tags]=providername:aws` returns tags found on the same cost data, such as `aws_instance_type:t3.micro` and `aws_instance_type:m5.large`. in: query name: filter[tags] schema: items: type: string type: array - description: Restrict the returned tags to those whose key matches one of the given tag keys. in: query name: filter[tag_keys] schema: items: type: string type: array - description: |- Controls the size of the internal tag search scope. This does **not** restrict the number of tags returned in the response. Defaults to 50, maximum 10000. in: query name: page[size] schema: default: 50 format: int32 maximum: 10000 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: sources: - focus value: providername:aws id: providername:aws type: cost_tag - attributes: sources: - focus value: providername:gcp id: providername:gcp type: cost_tag schema: $ref: "#/components/schemas/CostTagsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: List Cloud Cost Management tags tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read /api/v2/cost/unit_costs: get: description: List the ROI metrics (unit costs) for the authenticated organization. operationId: ListUnitCosts responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2026-09-01T18:46:15.933716Z" created_by: 36ea1610-8866-4bd3-bb6d-9bb9fc87cad2 denominator_query: formulas: - formula: denominator queries: - data_source: metrics name: denominator query: "avg:system.cpu.user{*}" response_format: timeseries denominator_type: metrics name: Cloud cost per active user numerator_query: formulas: - formula: numerator queries: - data_source: cloud_cost name: numerator query: "sum:aws.cost.net.amortized.shared.resources.allocated{*}.rollup(sum, daily)" response_format: timeseries org_id: 321813 unit_label: user updated_at: "2026-09-01T19:52:08.820536Z" updated_by: 13cc0adf-2595-479e-b448-5051c180dddb id: 64aecd58-e355-4f07-9c3a-56ff6bda6cd8 type: unit_cost - attributes: created_at: "2026-09-02T00:59:12.708413Z" created_by: 36ea1610-8866-4bd3-bb6d-9bb9fc87cad2 denominator_query: formulas: - formula: denominator queries: - compute: aggregation: count data_source: ci_pipelines group_by: [] indexes: - "*" name: denominator search: query: "ci_level:pipeline @ci.status:success" storage: hot response_format: timeseries denominator_type: ci_pipelines name: Cloud cost per successful pipeline numerator_query: formulas: - formula: numerator queries: - data_source: cloud_cost name: numerator query: "sum:custom.cost.amortized{*}.rollup(sum, daily)" response_format: timeseries org_id: 321813 unit_label: pipeline updated_at: "2026-09-02T01:00:05.709773Z" updated_by: 36ea1610-8866-4bd3-bb6d-9bb9fc87cad2 id: ab11677e-396e-4dce-8018-bbeb398315ae type: unit_cost schema: $ref: "#/components/schemas/UnitCostsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List unit costs tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create an ROI metric (unit cost) using the given numerator and denominator queries. operationId: CreateUnitCost requestBody: content: application/json: examples: default: value: data: attributes: denominator_query: formulas: - formula: denominator queries: - data_source: metrics name: denominator query: "avg:system.cpu.user{*}" response_format: timeseries name: Cloud cost per active user numerator_query: formulas: - formula: numerator queries: - data_source: cloud_cost name: numerator query: "sum:aws.cost.net.amortized.shared.resources.allocated{*}.rollup(sum, daily)" response_format: timeseries unit_label: user type: unit_cost schema: $ref: "#/components/schemas/UnitCostCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2026-09-01T18:46:15.933716Z" created_by: 36ea1610-8866-4bd3-bb6d-9bb9fc87cad2 denominator_query: formulas: - formula: denominator queries: - data_source: metrics name: denominator query: "avg:system.cpu.user{*}" response_format: timeseries denominator_type: metrics name: Cloud cost per active user numerator_query: formulas: - formula: numerator queries: - data_source: cloud_cost name: numerator query: "sum:aws.cost.net.amortized.shared.resources.allocated{*}.rollup(sum, daily)" response_format: timeseries org_id: 321813 unit_label: user updated_at: "2026-09-01T18:46:15.933716Z" updated_by: 36ea1610-8866-4bd3-bb6d-9bb9fc87cad2 id: 64aecd58-e355-4f07-9c3a-56ff6bda6cd8 type: unit_cost schema: $ref: "#/components/schemas/UnitCostResponse" description: Created headers: Location: description: The path of the newly created unit cost. schema: type: string "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a unit cost tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cost/unit_costs/{unit_cost_id}: delete: description: Delete an ROI metric (unit cost). operationId: DeleteUnitCost parameters: - $ref: "#/components/parameters/UnitCostID" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a unit cost tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Retrieve an ROI metric (unit cost) by UUID. operationId: GetUnitCost parameters: - $ref: "#/components/parameters/UnitCostID" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-09-01T18:46:15.933716Z" created_by: 36ea1610-8866-4bd3-bb6d-9bb9fc87cad2 denominator_query: formulas: - formula: denominator queries: - data_source: metrics name: denominator query: "avg:system.cpu.user{*}" response_format: timeseries denominator_type: metrics name: Cloud cost per active user numerator_query: formulas: - formula: numerator queries: - data_source: cloud_cost name: numerator query: "sum:aws.cost.net.amortized.shared.resources.allocated{*}.rollup(sum, daily)" response_format: timeseries org_id: 321813 unit_label: user updated_at: "2026-09-01T19:52:08.820536Z" updated_by: 13cc0adf-2595-479e-b448-5051c180dddb id: 64aecd58-e355-4f07-9c3a-56ff6bda6cd8 type: unit_cost schema: $ref: "#/components/schemas/UnitCostResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a unit cost tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: Replace an ROI metric (unit cost) with a new set of attributes. operationId: UpdateUnitCost parameters: - $ref: "#/components/parameters/UnitCostID" requestBody: content: application/json: examples: default: value: data: attributes: denominator_query: formulas: - formula: denominator queries: - data_source: metrics name: denominator query: "avg:system.cpu.user{*}" response_format: timeseries name: Cloud cost per active user numerator_query: formulas: - formula: numerator queries: - data_source: cloud_cost name: numerator query: "sum:aws.cost.net.amortized.shared.resources.allocated{*}.rollup(sum, daily)" response_format: timeseries unit_label: user id: 64aecd58-e355-4f07-9c3a-56ff6bda6cd8 type: unit_cost schema: $ref: "#/components/schemas/UnitCostUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-09-01T18:46:15.933716Z" created_by: 36ea1610-8866-4bd3-bb6d-9bb9fc87cad2 denominator_query: formulas: - formula: denominator queries: - data_source: metrics name: denominator query: "avg:system.cpu.user{*}" response_format: timeseries denominator_type: metrics name: Cloud cost per active user numerator_query: formulas: - formula: numerator queries: - data_source: cloud_cost name: numerator query: "sum:aws.cost.net.amortized.shared.resources.allocated{*}.rollup(sum, daily)" response_format: timeseries org_id: 321813 unit_label: user updated_at: "2026-09-01T19:52:08.820536Z" updated_by: 13cc0adf-2595-479e-b448-5051c180dddb id: 64aecd58-e355-4f07-9c3a-56ff6bda6cd8 type: unit_cost schema: $ref: "#/components/schemas/UnitCostResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a unit cost tags: - Cloud Cost Management "x-permission": operator: OR permissions: - cloud_cost_management_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/cost_by_tag/active_billing_dimensions: get: description: |- Get active billing dimensions for cost attribution. Cost data for a given month becomes available no later than the 19th of the following month. operationId: GetActiveBillingDimensions responses: "200": content: application/json;datetime-format=rfc3339: examples: default: value: data: id: abc-123 type: billing_dimensions schema: $ref: "#/components/schemas/ActiveBillingDimensionsResponse" description: OK "400": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden - User is not authorized "429": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read summary: Get active billing dimensions for cost attribution tags: - Usage Metering "x-permission": operator: OR permissions: - usage_read /api/v2/cost_by_tag/monthly_cost_attribution: get: description: |- Get monthly cost attribution by tag across multi-org and single root-org accounts. Cost Attribution data for a given month becomes available no later than the 19th of the following month. This API endpoint is paginated. To make sure you receive all records, check if the value of `next_record_id` is set in the response. If it is, make another request and pass `next_record_id` as a parameter. Pseudo code example: ``` response := GetMonthlyCostAttribution(start_month, end_month) cursor := response.metadata.pagination.next_record_id WHILE cursor != null BEGIN sleep(5 seconds) # Avoid running into rate limit response := GetMonthlyCostAttribution(start_month, end_month, next_record_id=cursor) cursor := response.metadata.pagination.next_record_id END ``` This endpoint is only accessible for [parent-level organizations](https://docs.datadoghq.com/account_management/multi_organization/). This endpoint is not available in the Government (US1-FED) site. operationId: GetMonthlyCostAttribution parameters: - description: |- Datetime in ISO-8601 format, UTC, precise to month: `[YYYY-MM]` for cost beginning in this month. in: query name: start_month required: true schema: format: date-time type: string - description: "Datetime in ISO-8601 format, UTC, precise to month: `[YYYY-MM]` for cost ending this month." in: query name: end_month required: false schema: format: date-time type: string - description: |- Comma-separated list specifying cost types (e.g., `_on_demand_cost`, `_committed_cost`, `_total_cost`) and the proportions (`_percentage_in_org`, `_percentage_in_account`). Use `*` to retrieve all fields. Example: `infra_host_on_demand_cost,infra_host_percentage_in_account` To obtain the complete list of active billing dimensions that can be used to replace `` in the field names, make a request to the [Get active billing dimensions API](https://docs.datadoghq.com/api/latest/usage-metering/#get-active-billing-dimensions-for-cost-attribution). in: query name: fields required: true schema: type: string - description: "The direction to sort by: `[desc, asc]`." in: query name: sort_direction required: false schema: $ref: "#/components/schemas/SortDirection" - description: "The billing dimension to sort by. Always sorted by total cost. Example: `infra_host`." in: query name: sort_name required: false schema: type: string - description: |- Comma separated list of tag keys used to group cost. If no value is provided the cost will not be broken down by tags. To see which tags are available, look for the value of `tag_config_source` in the API response. in: query name: tag_breakdown_keys required: false schema: type: string - description: List following results with a next_record_id provided in the previous query. in: query name: next_record_id required: false schema: type: string - description: "Include child org cost in the response. Defaults to `true`." in: query name: include_descendants required: false schema: default: true type: boolean responses: "200": content: application/json;datetime-format=rfc3339: examples: default: value: data: - id: abc-123 type: cost_by_tag schema: $ref: "#/components/schemas/MonthlyCostAttributionResponse" description: OK "400": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden - User is not authorized "429": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read - billing_read summary: Get Monthly Cost Attribution tags: - Usage Metering "x-permission": operator: AND permissions: - usage_read - billing_read /api/v2/csm/onboarding/agents: get: description: Get the list of all CSM Agents running on your hosts and containers. operationId: ListAllCSMAgents parameters: - description: The page index for pagination (zero-based). in: query name: page required: false schema: example: 2 format: int32 maximum: 1000000 minimum: 0 type: integer - description: The number of items to include in a single page. in: query name: size required: false schema: example: 12 format: int32 maximum: 100 minimum: 0 type: integer - description: A search query string to filter results (for example, `hostname:COMP-T2H4J27423`). in: query name: query required: false schema: example: "hostname:COMP-T2H4J27423" type: string - description: The sort direction for results. Use `asc` for ascending or `desc` for descending. in: query name: order_direction required: false schema: $ref: "#/components/schemas/OrderDirection" responses: "200": content: "application/json": examples: default: value: data: - attributes: agent_version: "7.50.0" hostname: example-host os: linux id: abc-123 type: datadog_agent meta: page_index: 0 page_size: 10 total_filtered: 1 schema: $ref: "#/components/schemas/CsmAgentsResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all CSM Agents tags: ["CSM Agents"] /api/v2/csm/onboarding/coverage_analysis/cloud_accounts: get: description: |- Get the CSM Coverage Analysis of your Cloud Accounts. This is calculated based on the number of your Cloud Accounts that are scanned for security issues. operationId: GetCSMCloudAccountsCoverageAnalysis responses: "200": content: application/json: examples: default: value: data: attributes: org_id: 123 total_coverage: configured_resources_count: 8 coverage: 0.8 partially_configured_resources_count: 0 total_resources_count: 10 id: abc-123 type: get_cloud_accounts_coverage_analysis_response_public_v0 schema: $ref: "#/components/schemas/CsmCloudAccountsCoverageAnalysisResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get the CSM Cloud Accounts Coverage Analysis tags: ["CSM Coverage Analysis"] /api/v2/csm/onboarding/coverage_analysis/hosts_and_containers: get: description: |- Get the CSM Coverage Analysis of your Hosts and Containers. This is calculated based on the number of agents running on your Hosts and Containers with CSM feature(s) enabled. operationId: GetCSMHostsAndContainersCoverageAnalysis responses: "200": content: application/json: examples: default: value: data: attributes: org_id: 123 total_coverage: configured_resources_count: 8 coverage: 0.8 partially_configured_resources_count: 0 total_resources_count: 10 id: abc-123 type: get_hosts_and_containers_coverage_analysis_response_public_v0 schema: $ref: "#/components/schemas/CsmHostsAndContainersCoverageAnalysisResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get the CSM Hosts and Containers Coverage Analysis tags: ["CSM Coverage Analysis"] /api/v2/csm/onboarding/coverage_analysis/serverless: get: description: |- Get the CSM Coverage Analysis of your Serverless Resources. This is calculated based on the number of agents running on your Serverless Resources with CSM feature(s) enabled. operationId: GetCSMServerlessCoverageAnalysis responses: "200": content: application/json: examples: default: value: data: attributes: org_id: 123 total_coverage: configured_resources_count: 8 coverage: 0.8 partially_configured_resources_count: 0 total_resources_count: 10 id: abc-123 type: get_serverless_coverage_analysis_response_public_v0 schema: $ref: "#/components/schemas/CsmServerlessCoverageAnalysisResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get the CSM Serverless Coverage Analysis tags: ["CSM Coverage Analysis"] /api/v2/csm/onboarding/serverless/agents: get: description: Get the list of all CSM Serverless Agents running on your hosts and containers. operationId: ListAllCSMServerlessAgents parameters: - description: The page index for pagination (zero-based). in: query name: page required: false schema: example: 2 format: int32 maximum: 1000000 minimum: 0 type: integer - description: The number of items to include in a single page. in: query name: size required: false schema: example: 12 format: int32 maximum: 100 minimum: 0 type: integer - description: A search query string to filter results (for example, `hostname:COMP-T2H4J27423`). in: query name: query required: false schema: example: "hostname:COMP-T2H4J27423" type: string - description: The sort direction for results. Use `asc` for ascending or `desc` for descending. in: query name: order_direction required: false schema: $ref: "#/components/schemas/OrderDirection" responses: "200": content: "application/json": examples: default: value: data: - attributes: agent_version: "7.50.0" hostname: example-host os: linux id: abc-123 type: datadog_agent meta: page_index: 0 page_size: 10 total_filtered: 1 schema: $ref: "#/components/schemas/CsmAgentsResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all CSM Serverless Agents tags: ["CSM Agents"] /api/v2/csm/ownership/settings: get: description: Get ownership settings for the org. When settings are unset, the API returns the default opt-out configuration with `auto_tag` set to `true` and `confidence_level` set to `high`. operationId: GetOwnershipSettings responses: "200": content: application/json: examples: default: value: data: attributes: auto_tag: true confidence_level: high version: 1 id: settings type: ownership_settings schema: $ref: "#/components/schemas/OwnershipSettingsResponse" description: OK "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get ownership settings for the org tags: ["CSM Ownership"] x-unstable: |- **Note**: This endpoint is in Preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Update ownership settings for the org. operationId: PostOwnershipSettings requestBody: content: application/json: examples: default: value: data: attributes: auto_tag: true confidence_level: high type: ownership_settings schema: $ref: "#/components/schemas/OwnershipSettingsRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: auto_tag: true confidence_level: high version: 1 id: settings type: ownership_settings schema: $ref: "#/components/schemas/OwnershipSettingsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update ownership settings for the org tags: ["CSM Ownership"] x-unstable: |- **Note**: This endpoint is in Preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/csm/ownership/settings/untagged: get: description: Count findings with no team tag, grouped by ownership confidence level. operationId: GetOwnershipUntaggedFindings responses: "200": content: application/json: examples: default: value: data: attributes: high_confidence: 30 low_confidence: 42 medium_confidence: 70 total: 142 id: untagged type: ownership_untagged_findings schema: $ref: "#/components/schemas/OwnershipUntaggedFindingsResponse" description: OK "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Count untagged findings by ownership confidence tags: ["CSM Ownership"] x-unstable: |- **Note**: This endpoint is in Preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/csm/settings/agentless_hosts: get: description: Get the list of agentless hosts for CSM, with optional pagination and filtering. operationId: ListCSMAgentlessHosts parameters: - description: The page index for pagination (zero-based). in: query name: page required: false schema: default: 0 example: 0 format: int32 maximum: 1000000 minimum: 0 type: integer - description: The number of agentless hosts to return per page. in: query name: size required: false schema: default: 10 example: 10 format: int32 maximum: 100 minimum: 1 type: integer - description: A search query string to filter agentless hosts. in: query name: query required: false schema: example: "cloud_provider:aws" type: string responses: "200": content: application/json: examples: default: value: data: - attributes: account_id: "123456789012" cloud_provider: aws has_posture_management: true has_vulnerability_scanning: true resource_type: aws_ec2_instance id: i-0123456789abcdef0 type: agentless_host meta: page_index: 0 page_size: 10 total_filtered: 1 schema: $ref: "#/components/schemas/CsmAgentlessHostsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List agentless hosts tags: ["CSM Settings"] x-unstable: |- **Note**: This endpoint is in Preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/csm/settings/agentless_hosts/facet_info: get: description: Get the value distribution for a specific agentless host facet, with optional search and filtering. operationId: GetCSMAgentlessHostFacetInfo parameters: - description: The facet identifier to retrieve value distribution for. Valid values are `resource_name`, `account_id`, `resource_type`, `cloud_provider`, `has_vulnerability_scanning`, and `has_posture_management`. in: query name: facet required: true schema: example: cloud_provider type: string - description: A search string to filter the facet values. in: query name: search required: false schema: example: aws type: string - description: A filter query to scope the facet value counts. in: query name: query required: false schema: example: "cloud_provider:aws" type: string responses: "200": content: application/json: examples: default: value: data: attributes: items: - count: 100 value: aws - count: 50 value: gcp id: cloud_provider meta: total_count: 2 type: facet_info schema: $ref: "#/components/schemas/CsmHostFacetInfoResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get agentless host facet info tags: ["CSM Settings"] x-unstable: |- **Note**: This endpoint is in Preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/csm/settings/agentless_hosts/facets: get: description: Get the list of available facets for filtering agentless hosts. operationId: ListCSMAgentlessHostFacets responses: "200": content: application/json: examples: default: value: data: - attributes: bounded: true bundled: true bundledAndUsed: true defaultValues: [] description: The cloud provider of the resource. editable: false facetType: list groups: - agentless name: Cloud Provider path: cloud_provider source: core type: string values: - aws - gcp - azure - oci id: cloud_provider type: agentless_host_facet schema: $ref: "#/components/schemas/CsmAgentlessHostFacetsResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List agentless host facets tags: ["CSM Settings"] x-unstable: |- **Note**: This endpoint is in Preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/csm/settings/hosts: get: description: Get the list of unified hosts for CSM, combining agent and agentless host data, with optional pagination and filtering. operationId: ListCSMUnifiedHosts parameters: - description: The page index for pagination (zero-based). in: query name: page required: false schema: default: 0 example: 0 format: int32 maximum: 1000000 minimum: 0 type: integer - description: The number of hosts to return per page. in: query name: size required: false schema: default: 10 example: 10 format: int32 maximum: 100 minimum: 1 type: integer - description: A search query string to filter unified hosts. in: query name: query required: false schema: example: "source:agent" type: string responses: "200": content: application/json: examples: default: value: data: - attributes: agent_cws_enabled: false agent_posture_management: true agent_version: 7.50.0 datadog_agent_key: key123 os: linux source: agent id: agent-host type: unified_host - attributes: account_id: "123456789012" agentless_posture_management: true agentless_vulnerability_scanning: true cloud_provider: aws resource_type: aws_ec2_instance source: agentless id: i-0123456789abcdef0 type: unified_host meta: page_index: 0 page_size: 10 total_filtered: 2 total_pages: 1 schema: $ref: "#/components/schemas/CsmUnifiedHostsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List unified hosts tags: ["CSM Settings"] x-unstable: |- **Note**: This endpoint is in Preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/csm/settings/hosts/facet_info: get: description: Get the value distribution for a specific unified host facet, with optional search and filtering. operationId: GetCSMUnifiedHostFacetInfo parameters: - description: The facet identifier to retrieve value distribution for. Valid values include `resource_name`, `account_id`, `resource_type`, `cloud_provider`, `agentless_vulnerability_scanning`, `agentless_posture_management`, `hostname`, `agent_version`, `os`, `cluster_name`, `agent_posture_management`, `agent_cws_enabled`, `agent_csm_vm_hosts_enabled`, and `agent_csm_vm_containers_enabled`. in: query name: facet required: true schema: example: cloud_provider type: string - description: A search string to filter the facet values. in: query name: search required: false schema: example: aws type: string - description: A filter query to scope the facet value counts. in: query name: query required: false schema: example: "cloud_provider:aws" type: string responses: "200": content: application/json: examples: default: value: data: attributes: items: - count: 100 value: aws - count: 50 value: gcp id: cloud_provider meta: total_count: 2 type: facet_info schema: $ref: "#/components/schemas/CsmHostFacetInfoResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get unified host facet info tags: ["CSM Settings"] x-unstable: |- **Note**: This endpoint is in Preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/csm/settings/hosts/facets: get: description: Get the list of available facets for filtering unified hosts. operationId: ListCSMUnifiedHostFacets responses: "200": content: application/json: examples: default: value: data: - attributes: bounded: true bundled: true bundledAndUsed: true defaultValues: [] description: The cloud provider of the resource. editable: false facetType: list groups: - hosts name: Cloud Provider path: cloud_provider source: core type: string values: - aws - gcp - azure - oci id: cloud_provider type: unified_host_facet schema: $ref: "#/components/schemas/CsmUnifiedHostFacetsResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List unified host facets tags: ["CSM Settings"] x-unstable: |- **Note**: This endpoint is in Preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/current_user: get: description: |- Get the user associated with the current authentication context. The response includes the user's profile attributes (name, email, handle, status, MFA state), along with related resources: the user's organization, assigned roles with their granted permissions, and team-scoped roles. No additional permissions are required beyond valid authentication. operationId: GetCurrentUser responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00+00:00" disabled: false email: jane.doe@example.com handle: jane.doe icon: "https://secure.gravatar.com/avatar/abc123" mfa_enabled: true modified_at: "2024-06-01T12:00:00+00:00" name: Jane Doe service_account: false status: Active title: Senior Engineer verified: true id: 00000000-0000-9999-0000-000000000000 type: users included: [] schema: $ref: "#/components/schemas/UserResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get current user tags: - Users patch: description: |- Edit the profile of the currently authenticated user. Updatable fields include `name`, `title`, `email`, and `disabled` status. The `id` field in the request body must match the authenticated user's UUID; a mismatch returns a 422 error. Email address changes are recorded in the audit trail. Requires the `user_self_profile_write` permission. operationId: UpdateCurrentUser requestBody: content: application/json: examples: default: value: data: attributes: email: jane.doe@example.com name: Jane Doe title: Staff Engineer id: 00000000-0000-9999-0000-000000000000 type: users schema: $ref: "#/components/schemas/UserUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00+00:00" disabled: false email: jane.doe@example.com handle: jane.doe icon: "https://secure.gravatar.com/avatar/abc123" mfa_enabled: true modified_at: "2024-06-01T12:00:00+00:00" name: Jane Doe service_account: false status: Active title: Staff Engineer verified: true id: 00000000-0000-9999-0000-000000000000 type: users included: [] schema: $ref: "#/components/schemas/UserResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "422": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update current user tags: - Users x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_self_profile_write /api/v2/current_user/application_keys: get: description: List all application keys available for current user operationId: ListCurrentUserApplicationKeys parameters: - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - $ref: "#/components/parameters/ApplicationKeysSortParameter" - $ref: "#/components/parameters/ApplicationKeyFilterParameter" - $ref: "#/components/parameters/ApplicationKeyFilterCreatedAtStartParameter" - $ref: "#/components/parameters/ApplicationKeyFilterCreatedAtEndParameter" - $ref: "#/components/parameters/ApplicationKeyIncludeParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2020-11-23T10:00:00.000Z" last4: abcd name: Application Key for managing dashboards id: 00000000-0000-0000-0000-000000000004 type: application_keys schema: $ref: "#/components/schemas/ListApplicationKeysResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all application keys owned by current user tags: - Key Management "x-permission": operator: OR permissions: - user_app_keys post: description: Create an application key for current user operationId: CreateCurrentUserApplicationKey requestBody: content: application/json: examples: default: value: data: attributes: name: Application Key for managing dashboards scopes: - dashboards_read - dashboards_write - dashboards_public_share type: application_keys schema: $ref: "#/components/schemas/ApplicationKeyCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2020-11-23T10:00:00.000Z" last4: abcd name: Application Key for managing dashboards id: 00000000-0000-0000-0000-000000000005 type: application_keys schema: $ref: "#/components/schemas/ApplicationKeyResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create an application key for current user tags: - Key Management x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_app_keys /api/v2/current_user/application_keys/{app_key_id}: delete: description: Delete an application key owned by current user operationId: DeleteCurrentUserApplicationKey parameters: - $ref: "#/components/parameters/ApplicationKeyID" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an application key owned by current user tags: - Key Management "x-permission": operator: OR permissions: - user_app_keys get: description: |- Get an application key owned by current user. The `key` field is not returned for organizations in [One-Time Read mode](https://docs.datadoghq.com/account_management/api-app-keys/#one-time-read-mode). operationId: GetCurrentUserApplicationKey parameters: - $ref: "#/components/parameters/ApplicationKeyID" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2020-11-23T10:00:00.000Z" last4: abcd name: Application Key for managing dashboards id: 00000000-0000-0000-0000-000000000006 type: application_keys schema: $ref: "#/components/schemas/ApplicationKeyResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get one application key owned by current user tags: - Key Management "x-permission": operator: OR permissions: - user_app_keys patch: description: |- Edit an application key owned by current user. The `key` field is not returned for organizations in [One-Time Read mode](https://docs.datadoghq.com/account_management/api-app-keys/#one-time-read-mode). operationId: UpdateCurrentUserApplicationKey parameters: - $ref: "#/components/parameters/ApplicationKeyID" requestBody: content: application/json: examples: default: value: data: attributes: name: Application Key for managing dashboards scopes: - dashboards_read - dashboards_write - dashboards_public_share id: 00112233-4455-6677-8899-aabbccddeeff type: application_keys schema: $ref: "#/components/schemas/ApplicationKeyUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2020-11-23T10:00:00.000Z" last4: abcd name: Application Key for managing dashboards id: 00000000-0000-0000-0000-000000000007 type: application_keys schema: $ref: "#/components/schemas/ApplicationKeyResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Edit an application key owned by current user tags: - Key Management x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_app_keys /api/v2/dashboard/lists/manual/{dashboard_list_id}/dashboards: delete: description: Delete dashboards from an existing dashboard list. operationId: DeleteDashboardListItems parameters: - description: ID of the dashboard list to delete items from. in: path name: dashboard_list_id required: true schema: format: int64 type: integer requestBody: content: application/json: examples: default: value: dashboards: - id: q5j-nti-fv6 type: host_timeboard schema: $ref: "#/components/schemas/DashboardListDeleteItemsRequest" description: Dashboards to delete from the dashboard list. required: true responses: "200": content: application/json: examples: default: value: deleted_dashboards_from_list: - id: q5j-nti-fv6 type: host_timeboard schema: $ref: "#/components/schemas/DashboardListDeleteItemsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete items from a dashboard list tags: - Dashboard Lists x-codegen-request-body-name: body get: description: Fetch the dashboard list’s dashboard definitions. operationId: GetDashboardListItems parameters: - description: ID of the dashboard list to get items from. in: path name: dashboard_list_id required: true schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: dashboards: - id: q5j-nti-fv6 type: host_timeboard total: 1 schema: $ref: "#/components/schemas/DashboardListItems" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - dashboards_read summary: Get items of a Dashboard List tags: - Dashboard Lists "x-permission": operator: OR permissions: - dashboards_read post: description: Add dashboards to an existing dashboard list. operationId: CreateDashboardListItems parameters: - description: ID of the dashboard list to add items to. in: path name: dashboard_list_id required: true schema: format: int64 type: integer requestBody: content: application/json: examples: default: value: dashboards: - id: q5j-nti-fv6 type: host_timeboard schema: $ref: "#/components/schemas/DashboardListAddItemsRequest" description: Dashboards to add to the dashboard list. required: true responses: "200": content: application/json: examples: default: value: added_dashboards_to_list: - id: q5j-nti-fv6 type: host_timeboard schema: $ref: "#/components/schemas/DashboardListAddItemsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Add Items to a Dashboard List tags: - Dashboard Lists x-codegen-request-body-name: body put: description: Update dashboards of an existing dashboard list. operationId: UpdateDashboardListItems parameters: - description: ID of the dashboard list to update items from. in: path name: dashboard_list_id required: true schema: format: int64 type: integer requestBody: content: application/json: examples: default: value: dashboards: - id: q5j-nti-fv6 type: host_timeboard schema: $ref: "#/components/schemas/DashboardListUpdateItemsRequest" description: New dashboards of the dashboard list. required: true responses: "200": content: application/json: examples: default: value: dashboards: - id: q5j-nti-fv6 type: host_timeboard schema: $ref: "#/components/schemas/DashboardListUpdateItemsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update items of a dashboard list tags: - Dashboard Lists x-codegen-request-body-name: body /api/v2/dashboard/{dashboard_id}/shared: get: description: Retrieve shared dashboards associated with the specified dashboard. operationId: ListSharedDashboardsByDashboardId parameters: - $ref: "#/components/parameters/SharedDashboardDashboardIDPathParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2026-01-01T00:00:00.000Z" embeddable_domains: [] expiration: global_time: live_span: 1h global_time_selectable: false invitees: - access_expiration: created_at: "2026-01-01T00:00:00.000Z" email: jane.doe@example.com last_accessed: selectable_template_vars: [] share_type: invite sharer_disabled: false status: active title: Q1 Metrics Dashboard token: abc-123-token url: https://p.datadoghq.com/sb/abc-123-token viewing_preferences: high_density: false theme: system id: "12345" relationships: dashboard: data: id: abc-def-ghi type: dashboard sharer: data: id: 00000000-0000-0000-0000-000000000000 type: user type: shared_dashboard included: - attributes: title: Q1 Metrics Dashboard id: abc-def-ghi type: dashboard - attributes: handle: jane.doe@example.com name: Jane Doe id: 00000000-0000-0000-0000-000000000000 type: user schema: $ref: "#/components/schemas/ListSharedDashboardsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Dashboard Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - dashboards_read summary: List shared dashboards for a dashboard tags: - Dashboard Sharing "x-permission": operator: OR permissions: - dashboards_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/dashboard/{dashboard_id}/shared/secure-embed: post: description: >- Create a secure embed share for a dashboard. The response includes a one-time `credential` used for HMAC-SHA256 signing. Store it securely — it cannot be retrieved again. operationId: CreateDashboardSecureEmbed parameters: - $ref: "#/components/parameters/DashboardIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: global_time: live_span: "1h" global_time_selectable: true selectable_template_vars: - default_values: ["1"] name: "org_id" prefix: "org_id" visible_tags: ["1"] status: active title: "Q1 Metrics Dashboard" viewing_preferences: high_density: false theme: "system" type: secure_embed_request schema: $ref: "#/components/schemas/SecureEmbedCreateRequest" description: Secure embed creation request body. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" credential: example-credential-value dashboard_id: abc-def-ghi global_time_selectable: true id: "12345" share_type: secure_embed status: active title: "Q1 Metrics Dashboard" token: abc-123-token url: "https://p.datadoghq.com/sb/secure-embed/abc-123-token" id: "12345" type: secure_embed_create_response schema: $ref: "#/components/schemas/SecureEmbedCreateResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Dashboard Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict — max 1000 share URLs per dashboard exceeded "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - dashboards_embed_share summary: Create a secure embed for a dashboard tags: - Dashboard Secure Embed x-codegen-request-body-name: body "x-permission": operator: OR permissions: - dashboards_embed_share x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/dashboard/{dashboard_id}/shared/secure-embed/{token}: delete: description: >- Delete a secure embed share for a dashboard. operationId: DeleteDashboardSecureEmbed parameters: - $ref: "#/components/parameters/DashboardIDPathParameter" - $ref: "#/components/parameters/SecureEmbedTokenPathParameter" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - dashboards_embed_share summary: Delete a secure embed for a dashboard tags: - Dashboard Secure Embed "x-permission": operator: OR permissions: - dashboards_embed_share x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: >- Retrieve an existing secure embed configuration for a dashboard. operationId: GetDashboardSecureEmbed parameters: - $ref: "#/components/parameters/DashboardIDPathParameter" - $ref: "#/components/parameters/SecureEmbedTokenPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" credential_suffix: ab3f dashboard_id: abc-def-ghi global_time_selectable: true id: "12345" share_type: secure_embed status: active title: "Q1 Metrics Dashboard" token: abc-123-token url: "https://p.datadoghq.com/sb/secure-embed/abc-123-token" id: "12345" type: secure_embed_get_response schema: $ref: "#/components/schemas/SecureEmbedGetResponse" description: OK "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - dashboards_read summary: Get a secure embed for a dashboard tags: - Dashboard Secure Embed "x-permission": operator: OR permissions: - dashboards_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: >- Partially update a secure embed configuration. All fields are optional (PATCH semantics). operationId: UpdateDashboardSecureEmbed parameters: - $ref: "#/components/parameters/DashboardIDPathParameter" - $ref: "#/components/parameters/SecureEmbedTokenPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: status: active title: "Q1 Metrics Dashboard (Updated)" type: secure_embed_update_request schema: $ref: "#/components/schemas/SecureEmbedUpdateRequest" description: Secure embed update request body. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" credential_suffix: ab3f dashboard_id: abc-def-ghi global_time_selectable: true id: "12345" share_type: secure_embed status: active title: "Q1 Metrics Dashboard (Updated)" token: abc-123-token url: "https://p.datadoghq.com/sb/secure-embed/abc-123-token" id: "12345" type: secure_embed_update_response schema: $ref: "#/components/schemas/SecureEmbedUpdateResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - dashboards_embed_share summary: Update a secure embed for a dashboard tags: - Dashboard Secure Embed x-codegen-request-body-name: body "x-permission": operator: OR permissions: - dashboards_embed_share x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/dashboards/usage: get: description: Get paginated usage statistics for every dashboard in the caller's organization. Use `page[limit]` and `page[offset]` to walk the result set. Use `filter[edited_before]` or `filter[viewed_before]` to narrow results by edit or view date. View-count fields depend on Real User Monitoring (RUM) and are `null` or `0` in orgs without RUM. **View counts are refreshed once per day** and **only reflect views recorded starting January 2025**; views prior to that date are not included. operationId: ListDashboardsUsage parameters: - description: Maximum number of dashboards to return per page. Server-side maximum is 500; values above 500 return a 400 Bad Request. in: query name: page[limit] required: false schema: default: 250 format: int64 type: integer - description: Zero-based offset into the result set. in: query name: page[offset] required: false schema: default: 0 format: int64 minimum: 0 type: integer - description: Return only dashboards whose last edit (`edited_at`) is strictly before this ISO 8601 timestamp (`edited_at < value`; boundary matches are excluded). Must include a timezone offset (for example, `Z` or `+00:00`); naive timestamps return HTTP 400. in: query name: filter[edited_before] required: false schema: example: "2025-04-26T00:00:00Z" type: string - description: Return only dashboards whose most recent view (`viewed_at`) is strictly before this ISO 8601 timestamp, including dashboards that have never been viewed. Must include a timezone offset; naive timestamps return HTTP 400. Orgs without Real User Monitoring (RUM) will see all dashboards returned by this filter. in: query name: filter[viewed_before] required: false schema: example: "2025-04-26T00:00:00Z" type: string responses: "200": content: application/json: examples: default: value: data: - attributes: author: handle: "jane.doe@example.com" id: "00000000-0000-0000-0000-000000000000" is_disabled: false name: "Jane Doe" created_at: "2026-01-15T09:30:00.000Z" dashboard_quality_score: 0.85 edited_at: "2026-04-20T11:05:00.000Z" org_id: 100 teams: ["sre"] title: "My production overview" total_views: 42 total_views_by_type: embed: 12 in_app: 30 viewed_at: "2026-05-01T14:22:10.000Z" viewer: handle: "john.smith@example.com" id: "00000000-0000-0000-0000-000000000001" is_disabled: false name: "John Smith" widget_count: 12 widget_count_by_type: query_value: 4 timeseries: 8 id: "q5j-nti-fv6" type: "dashboards-usages" links: first: "https://api.datadoghq.com/api/v2/dashboards/usage?page[offset]=0&page[limit]=250" last: "https://api.datadoghq.com/api/v2/dashboards/usage?page[offset]=1000&page[limit]=250" next: "https://api.datadoghq.com/api/v2/dashboards/usage?page[offset]=250&page[limit]=250" self: "https://api.datadoghq.com/api/v2/dashboards/usage" meta: page: first_offset: 0 last_offset: 1000 limit: 250 next_offset: 250 offset: 0 prev_offset: total: 1234 type: offset_limit schema: $ref: "#/components/schemas/ListDashboardsUsageResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - dashboards_read summary: Get usage stats for all dashboards tags: - Dashboards x-pagination: limitParam: page[limit] pageOffsetParam: page[offset] resultsPath: data x-permission: operator: OR permissions: - dashboards_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/dashboards/{dashboard_id}/usage: get: description: Get usage statistics for a single dashboard. The response includes view counts, the most recent view and edit times, widget counts, and the dashboard quality score. View-count fields depend on Real User Monitoring (RUM) and are `null` or `0` in orgs without RUM. **View counts are refreshed once per day** and **only reflect views recorded starting January 2025**; views prior to that date are not included. operationId: GetDashboardUsage parameters: - description: The ID of the dashboard. in: path name: dashboard_id required: true schema: example: "q5j-nti-fv6" type: string responses: "200": content: application/json: examples: default: value: data: attributes: author: handle: "jane.doe" id: "00000000-0000-0000-0000-000000000000" is_disabled: false name: "Jane Doe" created_at: "2026-01-15T09:30:00.000Z" dashboard_quality_score: 0.85 edited_at: "2026-04-20T11:05:00.000Z" org_id: 100 teams: ["sre"] title: "My production overview" total_views: 42 total_views_by_type: embed: 12 in_app: 30 viewed_at: "2026-05-01T14:22:10.000Z" viewer: handle: "john.smith" id: "00000000-0000-0000-0000-000000000001" is_disabled: false name: "John Smith" widget_count: 12 widget_count_by_type: query_value: 4 timeseries: 8 id: "q5j-nti-fv6" type: "dashboards-usages" schema: $ref: "#/components/schemas/DashboardUsageResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - dashboards_read summary: Get usage stats for a dashboard tags: - Dashboards x-permission: operator: OR permissions: - dashboards_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/data-capture/configuration: get: description: Get the organization default mode, scoped capture overrides, and configuration revision. operationId: GetAiGatewayDataCaptureConfiguration responses: "200": content: application/json: examples: default: value: data: attributes: configuration_revision: capture-revision-1 default_mode: metadata_only overrides: - created_at: "2026-10-15T12:00:00Z" id: 11111111-1111-4111-8111-111111111111 mode: metadata_only name: Research revision: 1 scope: tags: env: prod updated_at: "2026-10-15T12:00:00Z" id: organization type: data-capture-configurations schema: $ref: "#/components/schemas/AiGatewayCaptureConfigurationResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: Get the AI Gateway data capture configuration tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: "**Note**: This endpoint is in Preview and is subject to change.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." /api/v2/data-capture/overrides: post: description: Create a scoped override with a client-generated UUID and the current `configuration_revision`. If the override can enable full capture for more traffic, set `confirm_full_capture` to `true`. Returns HTTP 409 when `configuration_revision` is stale, the UUID already exists, or the organization has 100 overrides. Missing `configuration_revision` or required full-capture confirmation returns HTTP 400. Retrying an accepted create with the same UUID returns HTTP 409. To undo a create, read the current configuration revision and delete the override using its returned override revision. operationId: CreateAiGatewayDataCaptureOverride requestBody: content: application/json: schema: $ref: "#/components/schemas/AiGatewayCaptureCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: mode: metadata_only name: Research revision: 1 scope: tags: env: prod id: 11111111-1111-4111-8111-111111111111 type: data-capture-overrides schema: $ref: "#/components/schemas/AiGatewayCaptureOverrideResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Create an AI Gateway data capture override tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: "**Note**: This endpoint is in Preview and is subject to change.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." /api/v2/data-capture/overrides/{id}: delete: description: Delete an override using its `revision` and the current `configuration_revision`. If deleting the override can enable full capture for affected traffic, set `confirm_full_capture` to `true`. Returns HTTP 409 when `configuration_revision` or the override `revision` is stale, including a concurrent change during deletion. Missing revisions or required full-capture confirmation returns HTTP 400. operationId: DeleteAiGatewayDataCaptureOverride parameters: - description: Data capture override ID. in: path name: id required: true schema: description: Capture override UUID. format: uuid type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/AiGatewayCaptureDeleteRequest" required: true responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Delete an AI Gateway data capture override tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: "**Note**: This endpoint is in Preview and is subject to change.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." put: description: Replace an override using its `revision` and the current `configuration_revision`. Changes to capture overrides don't affect routing rules. Returns HTTP 409 when `configuration_revision` or the override `revision` is stale, including a concurrent change during replacement. Missing revisions or required full-capture confirmation returns HTTP 400. operationId: UpdateAiGatewayDataCaptureOverride parameters: - description: Data capture override ID. in: path name: id required: true schema: description: Capture override UUID. format: uuid type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/AiGatewayCaptureUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: mode: metadata_only name: Research revision: 1 scope: tags: env: prod id: 11111111-1111-4111-8111-111111111111 type: data-capture-overrides schema: $ref: "#/components/schemas/AiGatewayCaptureOverrideResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Replace an AI Gateway data capture override tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: "**Note**: This endpoint is in Preview and is subject to change.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." /api/v2/data-observability/monitors/runs/{run_id}/status: get: description: Retrieves the current status of a data observability monitor run. Poll this endpoint after triggering a run to determine when evaluation is complete. operationId: GetDataObservabilityMonitorRunStatus parameters: - description: The ID of the monitor run to retrieve status for. example: "abc123def456" in: path name: run_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: status: ok id: "abc123def456" type: monitor_run schema: $ref: "#/components/schemas/GetDataObservabilityMonitorRunStatusResponse" description: OK "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - data_observability_monitors_write - monitors_write summary: Get data observability monitor run status tags: - Data Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/data-observability/monitors/{monitor_id}/run: post: description: Manually triggers a run for a data observability monitor. Only monitors that are not scheduled (manually-runnable) can be triggered this way. operationId: RunDataObservabilityMonitor parameters: - description: The ID of the data observability monitor to run. example: 12345 in: path name: monitor_id required: true schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: id: "abc123def456" type: monitor_run schema: $ref: "#/components/schemas/RunDataObservabilityMonitorResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - data_observability_monitors_write - monitors_write summary: Run a data observability monitor tags: - Data Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/datasets: get: description: Get all datasets that have been configured for an organization. operationId: GetAllDatasets responses: "200": content: application/json: examples: default: value: data: - attributes: name: Security Audit Dataset principals: - role:94172442-be03-11e9-a77a-3b7612558ac1 product_filters: - filters: - source:cloudtrail product: logs id: 00000000-0000-0000-0000-000000000003 type: dataset schema: $ref: "#/components/schemas/DatasetResponseMulti" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_read summary: Get all datasets tags: - Datasets "x-permission": operator: OR permissions: - user_access_read x-unstable: |- **Note: Data Access is in preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).** post: description: |- Create a dataset with the configurations in the request. operationId: CreateDataset requestBody: content: application/json: examples: default: value: data: attributes: name: Security Audit Dataset principals: - role:94172442-be03-11e9-a77a-3b7612558ac1 product_filters: - filters: - source:cloudtrail product: logs restriction_query_id: 00000000-0000-0000-0000-000000000001 type: dataset schema: $ref: "#/components/schemas/DatasetCreateRequest" description: Dataset payload required: true responses: "200": content: application/json: examples: default: value: data: attributes: name: Security Audit Dataset principals: - "role:abc-123" product_filters: - filters: - source:cloudtrail product: logs id: 00000000-0000-0000-0000-000000000004 type: dataset schema: $ref: "#/components/schemas/DatasetResponseSingle" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_manage summary: Create a dataset tags: - Datasets x-codegen-request-body-name: body x-permission: operator: OR permissions: - user_access_manage x-unstable: |- **Note: Data Access is in preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).** /api/v2/datasets/{dataset_id}: delete: description: Deletes the dataset associated with the ID. operationId: DeleteDataset parameters: - $ref: "#/components/parameters/DatasetID" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_manage summary: Delete a dataset tags: - Datasets "x-permission": operator: OR permissions: - user_access_manage x-unstable: |- **Note: Data Access is in preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).** get: description: Retrieves the dataset associated with the ID. operationId: GetDataset parameters: - $ref: "#/components/parameters/DatasetID" responses: "200": content: application/json: examples: default: value: data: attributes: name: Security Audit Dataset principals: - role:94172442-be03-11e9-a77a-3b7612558ac1 product_filters: - filters: - source:cloudtrail product: logs id: 00000000-0000-0000-0000-000000000001 type: dataset schema: $ref: "#/components/schemas/DatasetResponseSingle" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_read summary: Get a single dataset by ID tags: - Datasets "x-permission": operator: OPEN permissions: [] x-unstable: |- **Note: Data Access is in preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).** put: description: |- Edits the dataset associated with the ID. operationId: UpdateDataset parameters: - $ref: "#/components/parameters/DatasetID" requestBody: content: application/json: examples: default: value: data: attributes: name: Security Audit Dataset principals: - role:94172442-be03-11e9-a77a-3b7612558ac1 product_filters: - filters: - "@application.id:ABCD" product: logs type: dataset schema: $ref: "#/components/schemas/DatasetUpdateRequest" description: Dataset payload required: true responses: "200": content: application/json: examples: default: value: data: attributes: name: Security Audit Dataset principals: - role:94172442-be03-11e9-a77a-3b7612558ac1 product_filters: - filters: - source:cloudtrail product: logs id: 00000000-0000-0000-0000-000000000002 type: dataset schema: $ref: "#/components/schemas/DatasetResponseSingle" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_manage summary: Edit a dataset tags: - Datasets x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_manage x-unstable: |- **Note: Data Access is in preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).** /api/v2/ddsql/query/tabular: post: description: |- Submit a DDSQL statement and return either a `running` state with an opaque `query_id` for the client to poll, or a `completed` state with the column-major result set inlined when the query finishes quickly enough to be served synchronously. For a scoped application key, include `timeseries_query` in its scopes. A query that does not read a data source, such as `SELECT 1`, requires no additional data-source permissions. Queries that read data sources also require the user or service account that owns the application key to have the corresponding data access permissions through their roles. The `timeseries_query` permission does not grant access to the underlying data sources. operationId: ExecuteDdsqlTabularQuery requestBody: content: application/json: examples: default: value: data: attributes: query: "SELECT cloud_provider, count(*) FROM dd.hosts group by cloud_provider" row_limit: 1000 time: from_timestamp: 1736942400000 to_timestamp: 1736946000000 type: ddsql_query_request schema: $ref: "#/components/schemas/DdsqlTabularQueryRequest" required: true responses: "200": content: application/json: examples: completed: summary: Query finished synchronously value: data: attributes: columns: - name: service type: VARCHAR values: - web-store - checkout - name: count type: BIGINT values: - 1024 - 512 state: completed id: "00000000-0000-0000-0000-000000000000" type: ddsql_query_response meta: elapsed: 318 request_id: "req-7f3e7d2c-1a0b-4d3e-9b2a-3c4d5e6f7081" default: summary: Query finished synchronously value: data: attributes: columns: - name: service type: VARCHAR values: - web-store - checkout - name: count type: BIGINT values: - 1024 - 512 state: completed id: "00000000-0000-0000-0000-000000000000" type: ddsql_query_response meta: elapsed: 318 request_id: "req-7f3e7d2c-1a0b-4d3e-9b2a-3c4d5e6f7081" running: summary: Query still executing value: data: attributes: query_id: "eyJxdWVyeSI6ICJTRUxFQ1QgKiBGUk9NIGxvZ3MifQ==" state: running id: "00000000-0000-0000-0000-000000000000" type: ddsql_query_response meta: elapsed: 42 request_id: "req-7f3e7d2c-1a0b-4d3e-9b2a-3c4d5e6f7081" schema: $ref: "#/components/schemas/DdsqlTabularQueryResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - timeseries_query summary: Execute a tabular DDSQL query tags: - DDSQL "x-permission": operator: OR permissions: - timeseries_query /api/v2/ddsql/query/tabular/fetch: post: description: |- Poll a previously submitted DDSQL query for results. Pass the opaque `query_id` returned by a prior `ExecuteDdsqlTabularQuery` (or by a prior `FetchDdsqlTabularQuery` that returned `state: running`) and the server returns either a `running` state to poll again or a `completed` state with the column-major result set inlined. For a scoped application key, include `timeseries_query` in its scopes. Fetch results as the same user and organization that submitted the query. The user or service account that owns the application key must have the data access permissions required by the queried data sources through their roles. operationId: FetchDdsqlTabularQuery requestBody: content: application/json: examples: default: value: data: attributes: query_id: "eyJxdWVyeSI6ICJTRUxFQ1QgKiBGUk9NIGxvZ3MifQ==" type: ddsql_query_fetch_request schema: $ref: "#/components/schemas/DdsqlTabularQueryFetchRequest" required: true responses: "200": content: application/json: examples: completed: summary: Query finished value: data: attributes: columns: - name: service type: VARCHAR values: - web-store - checkout - name: count type: BIGINT values: - 1024 - 512 state: completed id: "00000000-0000-0000-0000-000000000000" type: ddsql_query_response meta: elapsed: 87 request_id: "req-7f3e7d2c-1a0b-4d3e-9b2a-3c4d5e6f7082" default: summary: Query finished value: data: attributes: columns: - name: service type: VARCHAR values: - web-store - checkout - name: count type: BIGINT values: - 1024 - 512 state: completed id: "00000000-0000-0000-0000-000000000000" type: ddsql_query_response meta: elapsed: 87 request_id: "req-7f3e7d2c-1a0b-4d3e-9b2a-3c4d5e6f7082" running: summary: Query still executing value: data: attributes: query_id: "eyJxdWVyeSI6ICJTRUxFQ1QgKiBGUk9NIGxvZ3MifQ==" state: running id: "00000000-0000-0000-0000-000000000000" type: ddsql_query_response meta: elapsed: 12 request_id: "req-7f3e7d2c-1a0b-4d3e-9b2a-3c4d5e6f7082" schema: $ref: "#/components/schemas/DdsqlTabularQueryResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - timeseries_query summary: Fetch the result of a DDSQL query tags: - DDSQL "x-permission": operator: OR permissions: - timeseries_query /api/v2/deletion/data/{product}: post: description: Creates a data deletion request by providing a query and a timeframe targeting the proper data. operationId: CreateDataDeletionRequest parameters: - $ref: "#/components/parameters/ProductName" requestBody: content: application/json: examples: default: value: data: attributes: displayed_total: 100 from: 1672527600000 indexes: - test-index - test-index-2 query: host: abc service: xyz to: 1704063600000 type: create_deletion_req schema: $ref: "#/components/schemas/CreateDataDeletionRequestBody" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00.000000Z" created_by: test@example.com displayed_total: 100 from_time: 1672527600000 is_created: true org_id: 123 product: logs query: "service:xyz host:abc" source: standard starting_at: "2024-01-01T02:00:00.000000Z" status: pending to_time: 1704063600000 total_unrestricted: 100 updated_at: "2024-01-01T00:00:00.000000Z" id: "1" type: deletion_request meta: product: logs request_status: pending schema: $ref: "#/components/schemas/CreateDataDeletionResponseBody" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "412": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Precondition failed error "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Internal server error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Creates a data deletion request tags: - Data Deletion x-permission: operator: OR permissions: - logs_delete_data /api/v2/deletion/requests: get: description: Gets a list of data deletion requests based on several filter parameters. operationId: GetDataDeletionRequests parameters: - description: |- The next page of the previous search. If the next_page parameter is included, the rest of the query elements are ignored. example: "cGFnZTI=" in: query name: next_page required: false schema: type: string - description: Retrieve only the requests related to the given product. example: "logs" in: query name: product required: false schema: type: string - description: Retrieve only the requests that matches the given query. example: "service:xyz host:abc" in: query name: query required: false schema: type: string - description: Retrieve only the requests with the given status. example: "pending" in: query name: status required: false schema: type: string - description: Sets the page size of the search. example: "50" in: query name: page_size required: false schema: default: 50 format: int64 maximum: 50 minimum: 1 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00.000000Z" created_by: test@example.com displayed_total: 100 from_time: 1672527600000 is_created: true org_id: 123 product: logs query: "service:xyz host:abc" source: standard starting_at: "2024-01-01T02:00:00.000000Z" status: pending to_time: 1704063600000 total_unrestricted: 100 updated_at: "2024-01-01T00:00:00.000000Z" id: "1" type: deletion_request - attributes: created_at: "2024-01-01T00:00:00.000000Z" created_by: test@example.com displayed_total: 50 from_time: 1672527600000 is_created: true org_id: 123 product: logs query: "service:abc" recoverable_until: "2024-01-11T02:00:00.000000Z" source: standard starting_at: "2024-01-01T02:00:00.000000Z" status: in_progress to_time: 1704063600000 total_unrestricted: 50 updated_at: "2024-01-01T02:00:00.000000Z" id: "2" type: deletion_request meta: available_slots: 3 max_concurrent_requests: 5 next_page: "cGFnZTI=" product: logs schema: $ref: "#/components/schemas/GetDataDeletionsResponseBody" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Internal server error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Gets a list of data deletion requests tags: - Data Deletion x-permission: operator: OR permissions: - logs_delete_data /api/v2/deletion/requests/{id}/cancel: put: description: Cancels a data deletion request by providing its ID. operationId: CancelDataDeletionRequest parameters: - $ref: "#/components/parameters/RequestId" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00.000000Z" created_by: test@example.com displayed_total: 100 from_time: 1672527600000 is_created: true org_id: 123 product: logs query: "service:xyz host:abc" source: standard starting_at: "2024-01-01T02:00:00.000000Z" status: canceled to_time: 1704063600000 total_unrestricted: 100 updated_at: "2024-01-01T00:00:00.000000Z" id: "1" type: deletion_request meta: product: logs request_status: canceled schema: $ref: "#/components/schemas/CancelDataDeletionResponseBody" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "412": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Precondition failed error "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Internal server error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Cancels a data deletion request tags: - Data Deletion x-permission: operator: OR permissions: - logs_delete_data /api/v2/dem/journeys: post: description: Create a DEM journey. operationId: CreateJourney requestBody: content: application/json: examples: default: value: data: attributes: description: Tracks the user checkout flow from cart to confirmation. journey_rum: rum_steps: - nodes: - query: action.name:'checkout' type: start - nodes: - query: action.name:'confirmation' type: stop name: Checkout Flow tags: - team:synthetics type: journeys schema: $ref: "#/components/schemas/DemJourneyCreateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00Z" created_by: email: jane.doe@example.com handle: jane.doe name: Jane Doe uuid: 00000000-0000-0000-0000-000000000001 description: Tracks checkout flow. journey_rum: rum_steps: - nodes: - query: action.name:'checkout' type: start - nodes: - query: action.name:'confirmation' type: stop name: Checkout Flow org_id: 12345 tags: - team:synthetics test_suite: updated_at: updated_by: variants: [] id: journey-abc123 type: journeys schema: $ref: "#/components/schemas/DemJourneyResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a DEM journey tags: - DEM x-permission: operator: OR permissions: - synthetics_write /api/v2/dem/journeys/inferred/ignored/{journey_id}: delete: description: Remove an ignored inferred DEM journey, making it eligible to appear as a candidate again. operationId: DeleteIgnoredInferredJourney parameters: - description: The unique identifier of the ignored inferred journey to delete. example: inferred-abc123 in: path name: journey_id required: true schema: type: string responses: "204": description: No Content "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an ignored inferred DEM journey tags: - DEM x-permission: operator: OR permissions: - synthetics_write /api/v2/dem/journeys/inferred/search: get: description: >- Search for inferred DEM journeys by status. Returns candidates (status=candidate, the default) or ignored journeys (status=ignored). Supports optional fuzzy name filtering and app ID filtering. operationId: SearchInferredJourneys parameters: - description: >- Filter by inferred journey status. Use `candidate` (default) to retrieve journeys suggested for promotion, or `ignored` to retrieve journeys that have been dismissed. in: query name: status required: false schema: $ref: "#/components/schemas/DemInferredJourneyStatus" - description: Fuzzy search query to filter inferred journeys by name. in: query name: q required: false schema: type: string - description: Filter inferred journeys by application ID. in: query name: app_id required: false schema: type: string responses: "200": content: application/json: examples: candidates: value: data: - attributes: created_at: "2024-01-15T10:30:00Z" description: journey_rum: rum_steps: - nodes: - query: action.name:'checkout' type: start - nodes: - query: action.name:'confirmation' type: stop name: Checkout Flow org_id: 12345 rank: 1 tags: - team:synthetics test_suite: variants: [] id: inferred-abc123 type: journeys default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" description: journey_rum: rum_steps: - nodes: - query: action.name:'checkout' type: start - nodes: - query: action.name:'confirmation' type: stop name: Checkout Flow org_id: 123 rank: 1 tags: - team:synthetics variants: [] id: inferred-abc123 type: journeys ignored: value: data: - attributes: created_at: "2024-01-15T10:30:00Z" description: ignored_at: "2024-01-16T08:00:00Z" journey_rum: rum_steps: - nodes: - query: action.name:'login' type: start - nodes: - query: action.name:'dashboard' type: stop name: Login Flow org_id: 12345 tags: - team:synthetics test_suite: variants: [] id: inferred-def456 type: journeys schema: $ref: "#/components/schemas/DemSearchInferredJourneysResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Search inferred DEM journeys tags: - DEM x-permission: operator: OR permissions: - synthetics_read /api/v2/dem/journeys/inferred/{journey_id}/ignore: post: description: Mark an inferred DEM journey as ignored so it no longer appears in the candidate list. operationId: IgnoreInferredJourney parameters: - description: The unique identifier of the inferred journey to ignore. example: inferred-abc123 in: path name: journey_id required: true schema: type: string responses: "204": description: No Content "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Ignore an inferred DEM journey tags: - DEM x-permission: operator: OR permissions: - synthetics_write /api/v2/dem/journeys/search: get: description: Search for DEM journeys with optional filtering by query, creator, team, and app. operationId: SearchJourneys parameters: - description: A search query string to filter journeys by name. in: query name: query required: false schema: type: string - description: The offset for pagination. in: query name: page[offset] required: false schema: format: int64 type: integer - description: The maximum number of results to return. in: query name: page[limit] required: false schema: format: int64 type: integer - description: Filter journeys by creator handle. in: query name: creator required: false schema: type: string - description: Filter journeys by team tag. in: query name: team required: false schema: type: string - description: Filter journeys by application ID. in: query name: app_id required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-15T10:30:00Z" created_by: email: jane.doe@example.com handle: jane.doe name: Jane Doe uuid: 00000000-0000-0000-0000-000000000001 description: Tracks checkout flow. journey_rum: rum_steps: - nodes: - query: action.name:'checkout' type: start - nodes: - query: action.name:'confirmation' type: stop name: Checkout Flow org_id: 12345 tags: - team:synthetics test_suite: updated_at: updated_by: variants: [] id: journey-abc123 type: journeys schema: $ref: "#/components/schemas/DemJourneysListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Search DEM journeys tags: - DEM x-permission: operator: OR permissions: - synthetics_read /api/v2/dem/journeys/suites/batch: post: description: Return DEM journeys associated with multiple given test suite IDs. operationId: BatchGetJourneysByTestSuiteIDs requestBody: content: application/json: examples: default: value: data: attributes: test_suite_ids: - suite-abc123 - suite-def456 type: batch_get_journeys_by_test_suite_ids_request schema: $ref: "#/components/schemas/DemBatchGetJourneysRequest" required: true responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-15T10:30:00Z" created_by: email: jane.doe@example.com handle: jane.doe name: Jane Doe uuid: 00000000-0000-0000-0000-000000000001 description: Tracks checkout flow. journey_rum: rum_steps: - nodes: - query: action.name:'checkout' type: start - nodes: - query: action.name:'confirmation' type: stop name: Checkout Flow org_id: 12345 tags: - team:synthetics test_suite: updated_at: updated_by: variants: [] id: journey-abc123 type: journeys schema: $ref: "#/components/schemas/DemJourneysListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Batch get DEM journeys by test suite IDs tags: - DEM x-permission: operator: OR permissions: - synthetics_read /api/v2/dem/journeys/variants/{variant_id}: delete: description: Delete a variant from a DEM journey. operationId: DeleteJourneyVariant parameters: - description: The unique identifier of the variant to delete. example: "variant-001" in: path name: variant_id required: true schema: type: string responses: "204": description: No Content "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a DEM journey variant tags: - DEM x-permission: operator: OR permissions: - synthetics_write put: description: Update an existing variant of a DEM journey. operationId: UpdateJourneyVariant parameters: - description: The unique identifier of the variant to update. example: "variant-001" in: path name: variant_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: filter: device.type:mobile name: Mobile checkout rum_steps: - nodes: - query: action.name:'checkout' type: start - nodes: - query: action.name:'confirmation' type: stop type: variants schema: $ref: "#/components/schemas/DemVariantRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: filter: device.type:mobile name: Mobile checkout rum_steps: - nodes: - query: action.name:'checkout' type: start - nodes: - query: action.name:'confirmation' type: stop id: variant-001 type: variants schema: $ref: "#/components/schemas/DemVariantResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a DEM journey variant tags: - DEM x-permission: operator: OR permissions: - synthetics_write /api/v2/dem/journeys/{journey_id}: delete: description: Delete a DEM journey by its ID. operationId: DeleteJourney parameters: - description: The unique identifier of the DEM journey to delete. example: journey-abc123 in: path name: journey_id required: true schema: type: string responses: "204": description: No Content "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a DEM journey tags: - DEM x-permission: operator: OR permissions: - synthetics_write get: description: Retrieve a single DEM journey by its ID. operationId: GetJourney parameters: - description: The unique identifier of the DEM journey. example: journey-abc123 in: path name: journey_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00Z" created_by: email: jane.doe@example.com handle: jane.doe name: Jane Doe uuid: 00000000-0000-0000-0000-000000000001 description: Tracks checkout flow. journey_rum: rum_steps: - nodes: - query: action.name:'checkout' type: start - nodes: - query: action.name:'confirmation' type: stop name: Checkout Flow org_id: 12345 tags: - team:synthetics test_suite: updated_at: updated_by: variants: [] id: journey-abc123 type: journeys schema: $ref: "#/components/schemas/DemJourneyResponse" description: OK "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a DEM journey tags: - DEM x-permission: operator: OR permissions: - synthetics_read put: description: Update an existing DEM journey by its ID. operationId: UpdateJourney parameters: - description: The unique identifier of the DEM journey to update. example: journey-abc123 in: path name: journey_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: description: Tracks the user checkout flow from cart to confirmation. journey_rum: rum_steps: - nodes: - query: action.name:'checkout' type: start - nodes: - query: action.name:'confirmation' type: stop name: Checkout Flow tags: - team:synthetics type: journeys schema: $ref: "#/components/schemas/DemJourneyCreateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00Z" created_by: email: jane.doe@example.com handle: jane.doe name: Jane Doe uuid: 00000000-0000-0000-0000-000000000001 description: Tracks checkout flow. journey_rum: rum_steps: - nodes: - query: action.name:'checkout' type: start - nodes: - query: action.name:'confirmation' type: stop name: Checkout Flow org_id: 12345 tags: - team:synthetics test_suite: updated_at: "2024-01-16T08:00:00Z" updated_by: email: jane.doe@example.com handle: jane.doe name: Jane Doe uuid: 00000000-0000-0000-0000-000000000001 variants: [] id: journey-abc123 type: journeys schema: $ref: "#/components/schemas/DemJourneyResponse" description: OK "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a DEM journey tags: - DEM x-permission: operator: OR permissions: - synthetics_write /api/v2/dem/journeys/{journey_id}/recommended-tests: get: description: >- Retrieve AI-recommended synthetic tests for a DEM journey. Returns an empty list when no recommendation is available. operationId: GetJourneyRecommendedTests parameters: - description: The unique identifier of the journey. example: "journey-abc123" in: path name: journey_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: config: name: Checkout journey type: browser created_at: "2026-08-31T16:00:00Z" name: Checkout journey result_id: result-abc123 session_id: session-abc123 source: gbt type: browser variant_id: variant-001 id: journey-abc123 type: recommended_tests schema: $ref: "#/components/schemas/DemRecommendedTestsResponse" description: OK "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get recommended tests for a DEM journey tags: - DEM x-permission: operator: OR permissions: - synthetics_read /api/v2/dem/journeys/{journey_id}/variants: post: description: Create a variant for a DEM journey. operationId: CreateJourneyVariant parameters: - description: The unique identifier of the journey that owns the variant. example: "journey-abc123" in: path name: journey_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: filter: device.type:mobile name: Mobile checkout rum_steps: - nodes: - query: action.name:'checkout' type: start - nodes: - query: action.name:'confirmation' type: stop type: variants schema: $ref: "#/components/schemas/DemVariantRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: filter: device.type:mobile name: Mobile checkout rum_steps: - nodes: - query: action.name:'checkout' type: start - nodes: - query: action.name:'confirmation' type: stop id: variant-001 type: variants schema: $ref: "#/components/schemas/DemVariantResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a DEM journey variant tags: - DEM x-permission: operator: OR permissions: - synthetics_write /api/v2/dem/journeys/{public_journey_id}/suite: post: description: Trigger test suite creation for a given DEM journey. operationId: CreateTestSuiteForJourney parameters: - description: The public identifier of the DEM journey for which to create a test suite. example: journey-abc123 in: path name: public_journey_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: include_tests_from_journey_coverage: true test_suite_name: Checkout Flow Suite type: create_test_suite_for_journey_request schema: $ref: "#/components/schemas/DemCreateJourneyTestSuiteRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00Z" name: Checkout Flow Suite id: suite-abc123 type: journey_test_suite schema: $ref: "#/components/schemas/DemJourneyTestSuiteResponse" description: Created "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a test suite for a DEM journey tags: - DEM x-permission: operator: OR permissions: - synthetics_write /api/v2/deployment_gates: get: description: |- Returns a paginated list of all deployment gates for the organization. Use `page[cursor]` and `page[size]` query parameters to paginate through results. operationId: ListDeploymentGates parameters: - description: Service name. in: query name: filter[service] required: false schema: type: string - description: Environment name. in: query name: filter[env] required: false schema: type: string - description: Gate identifier. in: query name: filter[identifier] required: false schema: type: string - description: Dry-run state. in: query name: filter[dry_run] required: false schema: type: boolean - description: Cursor for pagination. Use the `meta.page.next_cursor` value from the previous response. Invalid cursors return 400. in: query name: page[cursor] required: false schema: type: string - description: Number of results per page. Defaults to 50. Must be between 1 and 1000. in: query name: page[size] required: false schema: default: 50 format: int64 maximum: 1000 minimum: 1 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" created_by: id: 00000000-0000-0000-0000-000000000004 dry_run: false env: production identifier: pre service: my-service id: 00000000-0000-0000-0000-000000000003 type: deployment_gate meta: page: size: 50 schema: $ref: "#/components/schemas/DeploymentGatesListResponse" description: OK "400": $ref: "#/components/responses/HTTPCDGatesBadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get all deployment gates tags: ["Deployment Gates"] x-permission: operator: OR permissions: - deployment_gates_read x-unstable: |- **Note**: This endpoint is in preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Endpoint to create a deployment gate. operationId: CreateDeploymentGate requestBody: content: application/json: examples: default: value: data: attributes: dry_run: false env: production identifier: pre service: my-service type: deployment_gate schema: $ref: "#/components/schemas/CreateDeploymentGateParams" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" created_by: handle: example-handle id: 00000000-0000-0000-0000-000000000002 name: Example Name dry_run: false env: production identifier: pre service: my-service id: 00000000-0000-0000-0000-000000000001 type: deployment_gate schema: $ref: "#/components/schemas/DeploymentGateResponse" description: OK "400": $ref: "#/components/responses/HTTPCDGatesBadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create deployment gate tags: ["Deployment Gates"] x-permission: operator: OR permissions: - deployment_gates_write x-unstable: |- **Note**: This endpoint is in preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/deployment_gates/evaluations: get: description: |- Returns deployment gate evaluations started in a maximum 30-day window (the default is the previous 24 hours). Results are ordered by start time, newest first. In-progress state is near-real-time and mutable. Finished state is eventually consistent. operationId: ListDeploymentGateEvaluations parameters: - description: Inclusive evaluation start time. Defaults to 24 hours before the request. Together with `filter[to]`, the window may span no more than 30 days. in: query name: filter[from] required: false schema: format: date-time type: string - description: Exclusive evaluation start time. Defaults to the request time. Must be after `filter[from]`; the window may span no more than 30 days. in: query name: filter[to] required: false schema: format: date-time type: string - description: Service values. Repeated or comma-separated values are combined with OR. in: query name: filter[service] required: false schema: items: type: string type: array - description: Environment values. Repeated or comma-separated values are combined with OR. in: query name: filter[env] required: false schema: items: type: string type: array - description: Gate identifier values. Repeated or comma-separated values are combined with OR. in: query name: filter[identifier] required: false schema: items: type: string type: array - description: Gate outcomes. Repeated or comma-separated values are combined with OR. in: query name: filter[status] required: false schema: items: $ref: "#/components/schemas/DeploymentGatesEvaluationResultResponseAttributesGateStatus" type: array - description: Gate-level dry-run state. in: query name: filter[dry_run] required: false schema: type: boolean - description: Gate evaluation UUID. No match returns an empty list. in: query name: filter[evaluation_id] required: false schema: format: uuid type: string - description: Configured gate UUID. Just-in-time evaluations have no gate ID. in: query name: filter[gate_id] required: false schema: format: uuid type: string - description: Deployment version values. Repeated or comma-separated values are combined with OR. in: query name: filter[version] required: false schema: items: type: string type: array - description: Maximum evaluations returned. in: query name: page[size] required: false schema: default: 20 format: int64 maximum: 100 minimum: 1 type: integer - description: Opaque cursor returned in `meta.page.next_cursor` by the previous page. Invalid cursors return 400. in: query name: page[cursor] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: dry_run: true duration_seconds: 900 env: prod evaluation_id: 7853af70-e6bf-49d8-a6cc-1b9b50ef0537 finished_at: "2026-09-14T08:15:00Z" gate_id: e7cd2af1-b67b-11ee-8d0d-2a7caf4aa214 identifier: default service: checkout started_at: "2026-09-14T08:00:00Z" status: fail version: "2026.09.14.1" id: 7853af70-e6bf-49d8-a6cc-1b9b50ef0537 type: deployment_gate_evaluation meta: page: next_cursor: MTc4OTM3MjgwMFx4MDA3ODUzYWY3MC1lNmJmLTQ5ZDgtYTZjYy0xYjliNTBlZjA1Mzc= size: 20 schema: $ref: "#/components/schemas/DeploymentGateEvaluationsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request. "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - deployment_gates_read summary: List deployment gate evaluations tags: ["Deployment Gates"] x-pagination: cursorParam: page[cursor] cursorPath: meta.page.next_cursor limitParam: page[size] resultsPath: data x-permission: operator: OR permissions: [deployment_gates_read] x-unstable: |- **Note**: This endpoint is in preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/deployment_gates/evaluations/rules: get: description: |- Returns rule evaluations whose gate evaluation started in a maximum 30-day window (the default is the previous 24 hours). Filter by gate, rule, gate evaluation, or rule evaluation ID; omit IDs for cross-evaluation searches. Results are ordered by start time, newest first. In-progress state is near-real-time and mutable. Finished state is eventually consistent. Gate-level and rule-level dry-run states are independent. Pagination is deterministic but not snapshot isolated; clients should deduplicate by rule evaluation ID. operationId: ListDeploymentRuleEvaluations parameters: - description: Inclusive gate evaluation start time. Defaults to 24 hours before the request. Together with `filter[to]`, the window may span no more than 30 days. in: query name: filter[from] required: false schema: format: date-time type: string - description: Exclusive gate evaluation start time. Defaults to the request time. Must be after `filter[from]`; the window may span no more than 30 days. in: query name: filter[to] required: false schema: format: date-time type: string - description: Gate evaluation UUID. No match returns an empty list. in: query name: filter[gate_evaluation_id] required: false schema: format: uuid type: string - description: Rule evaluation UUID. No match returns an empty list. in: query name: filter[evaluation_id] required: false schema: format: uuid type: string - description: Configured gate UUID. Just-in-time evaluations have no gate ID. in: query name: filter[gate_id] required: false schema: format: uuid type: string - description: Configured rule UUID. Just-in-time rules have no rule ID. in: query name: filter[rule_id] required: false schema: format: uuid type: string - description: Evaluated service values. Repeated or comma-separated values are combined with OR. in: query name: filter[service] required: false schema: items: type: string type: array - description: Evaluated environment values. Repeated or comma-separated values are combined with OR. in: query name: filter[env] required: false schema: items: type: string type: array - description: Gate identifier values. Repeated or comma-separated values are combined with OR. in: query name: filter[identifier] required: false schema: items: type: string type: array - description: Evaluated deployment version values. Repeated or comma-separated values are combined with OR. in: query name: filter[version] required: false schema: items: type: string type: array - description: Rule statuses. Repeated or comma-separated values are combined with OR. in: query name: filter[status] required: false schema: items: $ref: "#/components/schemas/DeploymentGatesEvaluationResultResponseAttributesGateStatus" type: array - description: |- Rule types. Repeated or comma-separated values are combined with OR. Defaults to all rule types. in: query name: filter[type] required: false schema: items: $ref: "#/components/schemas/DeploymentGateRuleEvaluationType" type: array - description: Rule-level dry-run state. A failed dry-run rule is ignored when computing the gate outcome. in: query name: filter[dry_run] required: false schema: type: boolean - description: Gate-level dry-run state. A failed dry-run gate blocks but does not stop deployment. in: query name: filter[gate_dry_run] required: false schema: type: boolean - description: Rule names. Repeated or comma-separated values are combined with OR. in: query name: filter[name] required: false schema: items: type: string type: array - description: Maximum rule evaluations returned. in: query name: page[size] required: false schema: default: 50 format: int64 maximum: 100 minimum: 1 type: integer - description: Opaque cursor returned in `meta.page.next_cursor` by the previous page. Invalid cursors return 400. in: query name: page[cursor] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: configuration: duration: 900 dry_run: false duration_seconds: 900 env: prod evaluation_id: 4f66c1c6-8346-59e5-be44-238214133260 failures: faulty_apm_resources: [GET /checkout] monitors: [] narratives: [] finished_at: "2026-09-14T08:15:00Z" gate_dry_run: false gate_evaluation_id: 426a8f7b-b3e8-45f9-9d99-a1ed2f7fea04 gate_id: identifier: default name: APM faulty deployment detection reason: A faulty resource was detected. rule_id: service: checkout started_at: "2026-09-14T08:00:00Z" status: fail type: faulty_deployment_detection version: "2026.09.14.1" id: 4f66c1c6-8346-59e5-be44-238214133260 type: deployment_gate_rule_evaluation meta: page: size: 50 schema: $ref: "#/components/schemas/DeploymentGateRuleEvaluationsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request. "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - deployment_gates_read summary: List deployment gate rule evaluations tags: ["Deployment Gates"] x-pagination: cursorParam: page[cursor] cursorPath: meta.page.next_cursor limitParam: page[size] resultsPath: data x-permission: operator: OR permissions: [deployment_gates_read] x-unstable: |- **Note**: This endpoint is in preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/deployment_gates/{gate_id}/rules: get: description: |- Endpoint to get rules for a deployment gate. operationId: GetDeploymentGateRules parameters: - description: The ID of the deployment gate. in: path name: gate_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: rules: - created_at: "2024-01-01T00:00:00+00:00" created_by: id: 00000000-0000-0000-0000-000000000012 dry_run: false gate_id: abc-123 name: My deployment rule options: type: faulty_deployment_detection id: 00000000-0000-0000-0000-000000000011 type: list_deployment_rules schema: $ref: "#/components/schemas/DeploymentGateRulesResponse" description: OK "400": $ref: "#/components/responses/HTTPCDGatesBadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get rules for a deployment gate tags: ["Deployment Gates"] x-permission: operator: OR permissions: - deployment_gates_read x-unstable: |- **Note**: This endpoint is in preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Endpoint to create a deployment rule. A gate for the rule must already exist. operationId: CreateDeploymentRule parameters: - description: The ID of the deployment gate. in: path name: gate_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: dry_run: false name: My deployment rule options: - resource1 - resource2 type: faulty_deployment_detection type: deployment_rule schema: $ref: "#/components/schemas/CreateDeploymentRuleParams" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" created_by: handle: test-user id: 00000000-0000-0000-0000-000000000010 name: Test User dry_run: false gate_id: abc-123 name: My deployment rule options: type: faulty_deployment_detection id: 00000000-0000-0000-0000-000000000009 type: deployment_rule schema: $ref: "#/components/schemas/DeploymentRuleResponse" description: OK "400": $ref: "#/components/responses/HTTPCDGatesBadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create deployment rule tags: ["Deployment Gates"] x-permission: operator: OR permissions: - deployment_gates_write x-unstable: |- **Note**: This endpoint is in preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/deployment_gates/{gate_id}/rules/{id}: delete: description: |- Endpoint to delete a deployment rule. operationId: DeleteDeploymentRule parameters: - description: The ID of the deployment gate. in: path name: gate_id required: true schema: type: string - description: The ID of the deployment rule. in: path name: id required: true schema: type: string responses: "204": description: No Content "400": $ref: "#/components/responses/HTTPCDGatesBadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/HTTPCDGatesNotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete deployment rule tags: ["Deployment Gates"] x-permission: operator: OR permissions: - deployment_gates_write x-unstable: |- **Note**: This endpoint is in preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: |- Endpoint to get a deployment rule. operationId: GetDeploymentRule parameters: - description: The ID of the deployment gate. in: path name: gate_id required: true schema: type: string - description: The ID of the deployment rule. in: path name: id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" created_by: id: 00000000-0000-0000-0000-000000000014 dry_run: false gate_id: abc-123 name: My deployment rule options: type: faulty_deployment_detection id: 00000000-0000-0000-0000-000000000013 type: deployment_rule schema: $ref: "#/components/schemas/DeploymentRuleResponse" description: OK "400": $ref: "#/components/responses/HTTPCDGatesBadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/HTTPCDRulesNotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get deployment rule tags: ["Deployment Gates"] x-permission: operator: OR permissions: - deployment_gates_read x-unstable: |- **Note**: This endpoint is in preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: |- Endpoint to update a deployment rule. operationId: UpdateDeploymentRule parameters: - description: The ID of the deployment gate. in: path name: gate_id required: true schema: type: string - description: The ID of the deployment rule. in: path name: id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: dry_run: false name: Updated deployment rule options: - resource1 - resource2 type: deployment_rule schema: $ref: "#/components/schemas/UpdateDeploymentRuleParams" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" created_by: id: 00000000-0000-0000-0000-000000000016 dry_run: false gate_id: abc-123 name: Updated deployment rule options: - resource1 type: faulty_deployment_detection id: 00000000-0000-0000-0000-000000000015 type: deployment_rule schema: $ref: "#/components/schemas/DeploymentRuleResponse" description: OK "400": $ref: "#/components/responses/HTTPCDGatesBadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/HTTPCDRulesNotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update deployment rule tags: ["Deployment Gates"] x-permission: operator: OR permissions: - deployment_gates_write x-unstable: |- **Note**: This endpoint is in preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/deployment_gates/{id}: delete: description: |- Endpoint to delete a deployment gate. Rules associated with the gate are also deleted. operationId: DeleteDeploymentGate parameters: - description: The ID of the deployment gate. in: path name: id required: true schema: type: string responses: "204": description: No Content "400": $ref: "#/components/responses/HTTPCDGatesBadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/HTTPCDGatesNotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete deployment gate tags: ["Deployment Gates"] x-permission: operator: OR permissions: - deployment_gates_write x-unstable: |- **Note**: This endpoint is in preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: |- Endpoint to get a deployment gate. operationId: GetDeploymentGate parameters: - description: The ID of the deployment gate. in: path name: id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" created_by: id: 00000000-0000-0000-0000-000000000006 dry_run: false env: production identifier: pre service: my-service id: 00000000-0000-0000-0000-000000000005 type: deployment_gate schema: $ref: "#/components/schemas/DeploymentGateResponse" description: OK "400": $ref: "#/components/responses/HTTPCDGatesBadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/HTTPCDGatesNotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get deployment gate tags: ["Deployment Gates"] x-permission: operator: OR permissions: - deployment_gates_read x-unstable: |- **Note**: This endpoint is in preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: |- Endpoint to update a deployment gate. operationId: UpdateDeploymentGate parameters: - description: The ID of the deployment gate. in: path name: id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: dry_run: false id: 12345678-1234-1234-1234-123456789012 type: deployment_gate schema: $ref: "#/components/schemas/UpdateDeploymentGateParams" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" created_by: id: 00000000-0000-0000-0000-000000000008 dry_run: false env: production identifier: pre service: my-service id: 00000000-0000-0000-0000-000000000007 type: deployment_gate schema: $ref: "#/components/schemas/DeploymentGateResponse" description: OK "400": $ref: "#/components/responses/HTTPCDGatesBadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/HTTPCDGatesNotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update deployment gate tags: ["Deployment Gates"] x-permission: operator: OR permissions: - deployment_gates_write x-unstable: |- **Note**: This endpoint is in preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/deployments/gates/evaluation: post: description: |- Triggers an asynchronous deployment gate evaluation for the given service and environment. Returns an evaluation ID that can be used to poll for the result via the `GET /api/v2/deployments/gates/evaluation/{id}` endpoint. When the `configuration` attribute is provided, rules are evaluated inline from that configuration and no pre-configured gate is required. When `configuration` is omitted, rules are resolved from the gate pre-configured for the given service and environment through the Datadog UI, API, or Terraform. operationId: TriggerDeploymentGatesEvaluation requestBody: content: application/json: examples: default: summary: Evaluate a preconfigured gate value: data: attributes: env: staging identifier: pre-deploy primary_tag: region:us-east-1 service: transaction-backend version: v1.2.3 type: deployment_gates_evaluation_request with-configuration: summary: Evaluate with inline rule configuration value: data: attributes: configuration: dry_run: false rules: - dry_run: false name: error rate monitors options: duration: 300 query: "service:transaction-backend env:production" type: monitor - dry_run: false name: apm faulty deployment options: duration: 900 excluded_resources: - "GET /healthcheck" type: faulty_deployment_detection env: production service: transaction-backend version: 1.2.3 type: deployment_gates_evaluation_request schema: $ref: "#/components/schemas/DeploymentGatesEvaluationRequest" required: true responses: "202": content: application/json: examples: default: value: data: attributes: evaluation_id: 00000000-0000-0000-0000-000000000001 id: 00000000-0000-0000-0000-000000000001 type: deployment_gates_evaluation_response schema: $ref: "#/components/schemas/DeploymentGatesEvaluationResponse" description: Accepted "400": $ref: "#/components/responses/HTTPCDGatesBadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/HTTPCDGatesNotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Trigger a deployment gate evaluation tags: ["Deployment Gates"] x-permission: operator: OR permissions: - deployment_gates_evaluate x-unstable: |- **Note**: This endpoint is in preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/deployments/gates/evaluation/{id}: get: description: |- Retrieves the result of a deployment gate evaluation by its evaluation ID. If the evaluation is still in progress, `data.attributes.gate_status` will be `in_progress`; continue polling until it returns `pass` or `fail`. Polling every 10-20 seconds is recommended. The endpoint may return a 404 if called too soon after triggering; retry after a few seconds. operationId: GetDeploymentGatesEvaluationResult parameters: - description: The evaluation ID returned by the trigger endpoint. in: path name: id required: true schema: format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: dry_run: false evaluation_id: 00000000-0000-0000-0000-000000000001 evaluation_url: https://app.datadoghq.com/ci/deployment-gates/evaluations?index=cdgates&query=level%3Agate+%40evaluation_id%3A00000000-0000-0000-0000-000000000001 gate_id: 00000000-0000-0000-0000-000000000001 gate_status: pass rules: [] id: 00000000-0000-0000-0000-000000000001 type: deployment_gates_evaluation_result_response schema: $ref: "#/components/schemas/DeploymentGatesEvaluationResultResponse" description: OK "400": $ref: "#/components/responses/HTTPCDGatesBadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/HTTPCDGatesNotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/HTTPCIAppErrors" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a deployment gate evaluation result tags: ["Deployment Gates"] x-permission: operator: OR permissions: - deployment_gates_evaluate x-unstable: |- **Note**: This endpoint is in preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/domain_allowlist: get: description: Get the domain allowlist for an organization. operationId: GetDomainAllowlist responses: "200": content: application/json: examples: default: value: data: attributes: domains: - "@example.com" enabled: false id: 00000000-0000-0000-0000-000000000002 type: domain_allowlist schema: $ref: "#/components/schemas/DomainAllowlistResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management - AuthZ: - monitors_write summary: Get Domain Allowlist tags: - Domain Allowlist "x-permission": operator: OR permissions: - org_management - monitors_write - generate_dashboard_reports - generate_log_reports - manage_log_reports patch: description: Update the domain allowlist for an organization. operationId: PatchDomainAllowlist requestBody: content: application/json: examples: default: value: data: attributes: domains: - "@static-test-domain.test" enabled: false type: domain_allowlist schema: $ref: "#/components/schemas/DomainAllowlistRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: domains: - "@example.com" enabled: false id: 00000000-0000-0000-0000-000000000001 type: domain_allowlist schema: $ref: "#/components/schemas/DomainAllowlistResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management - AuthZ: - monitors_write summary: Sets Domain Allowlist tags: - Domain Allowlist "x-permission": operator: OR permissions: - org_management - monitors_write - generate_dashboard_reports - generate_log_reports - manage_log_reports /api/v2/dora/deployment: post: description: |- Use this API endpoint to provide deployment data. This is necessary for: - Deployment Frequency - Change Lead Time - Change Failure Rate - Failed Deployment Recovery Time operationId: CreateDORADeployment requestBody: content: application/json: examples: default: value: data: attributes: custom_tags: - language:java - department:engineering env: staging finished_at: 1693491984000000000 git: commit_sha: 66adc9350f2cc9b250b69abddab733dd55e1a588 repository_url: https://github.com/organization/example-repository service: test-service started_at: 1693491974000000000 team: backend version: v1.12.07 schema: $ref: "#/components/schemas/DORADeploymentRequest" required: true responses: "200": content: application/json: examples: default: value: data: id: 4242fcdd31586083 type: dora_deployment schema: $ref: "#/components/schemas/DORADeploymentResponse" description: OK "202": content: application/json: examples: default: value: data: id: 4242fcdd31586083 type: dora_deployment schema: $ref: "#/components/schemas/DORADeploymentResponse" description: OK - but delayed due to incident "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] summary: Send a deployment event tags: ["Delivery Performance"] x-codegen-request-body-name: body /api/v2/dora/deployment/{deployment_id}: delete: description: |- Use this API endpoint to delete a deployment event. operationId: DeleteDORADeployment parameters: - description: The ID of the deployment event to delete. in: path name: deployment_id required: true schema: type: string responses: "202": description: Accepted "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete a deployment event tags: ["Delivery Performance"] x-permission: operator: OR permissions: - dora_metrics_write /api/v2/dora/deployments: patch: description: |- Update a deployment's change failure status, identifying the deployment by its service, environment, and version instead of its ID. Use this to mark a deployment as a change failure or back to stable. You can optionally include remediation details to enable failed deployment recovery time calculation. If multiple deployments match the given service, environment, and version, the most recently finished one is updated. operationId: PatchDORADeploymentByVersion requestBody: content: application/json: examples: default: value: data: attributes: change_failure: true env: production service: my-service version: v1.2.3 type: dora_deployment_patch_request schema: $ref: "#/components/schemas/DORADeploymentPatchByVersionRequest" required: true responses: "202": description: Accepted "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Mark a deployment as failed by version tags: ["Delivery Performance"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - dora_metrics_write post: description: |- Use this API endpoint to get a list of deployment events. operationId: ListDORADeployments requestBody: content: application/json: examples: default: value: data: attributes: from: "2025-01-01T00:00:00Z" limit: 100 query: service:(test-service OR api-service) env:production team:backend sort: -finished_at to: "2025-01-31T23:59:59Z" type: dora_deployments_list_request schema: $ref: "#/components/schemas/DORAListDeploymentsRequest" required: true responses: "200": content: application/json: examples: default: value: data: - attributes: env: production finished_at: "2023-08-31T14:26:24Z" service: test-service started_at: "2023-08-31T14:26:14Z" team: backend id: abc-123 type: dora_deployment schema: $ref: "#/components/schemas/DORADeploymentsListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a list of deployment events tags: ["Delivery Performance"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - dora_metrics_read /api/v2/dora/deployments/{deployment_id}: get: description: |- Use this API endpoint to get a deployment event. operationId: GetDORADeployment parameters: - description: The ID of the deployment event. in: path name: deployment_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: env: production finished_at: "2023-08-31T14:26:24Z" service: test-service started_at: "2023-08-31T14:26:14Z" team: backend id: abc-123 type: dora_deployment schema: $ref: "#/components/schemas/DORADeploymentFetchResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a deployment event tags: ["Delivery Performance"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - dora_metrics_read patch: description: |- Update a deployment's change failure status. Use this to mark a deployment as a change failure or back to stable. You can optionally include remediation details to enable failed deployment recovery time calculation. operationId: PatchDORADeployment parameters: - description: The ID of the deployment event. in: path name: deployment_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: change_failure: true remediation: id: eG42zNIkVjM type: rollback id: z_RwVLi7v4Y type: dora_deployment_patch_request schema: $ref: "#/components/schemas/DORADeploymentPatchRequest" required: true responses: "202": description: Accepted "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Mark a deployment as failed by ID tags: ["Delivery Performance"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - dora_metrics_write /api/v2/dora/failure: post: description: |- Use this API endpoint to provide incident data for DORA Metrics. Note that change failure rate and failed deployment recovery time are computed from change failures detected on deployments, not from incident events sent through this endpoint. Tracking incidents gives a side-by-side view of how failed deployments translate into real-world incidents, including their severity and frequency. operationId: CreateDORAFailure requestBody: content: application/json: examples: default: value: data: attributes: custom_tags: - language:java - department:engineering env: staging finished_at: 1693491984000000000 git: commit_sha: 66adc9350f2cc9b250b69abddab733dd55e1a588 repository_url: https://github.com/organization/example-repository name: Webserver is down failing all requests. services: - test-service severity: High started_at: 1693491974000000000 team: backend version: v1.12.07 schema: $ref: "#/components/schemas/DORAFailureRequest" required: true responses: "200": content: application/json: examples: default: value: data: id: 4242fcdd31586085 type: dora_failure schema: $ref: "#/components/schemas/DORAFailureResponse" description: OK "202": content: application/json: examples: default: value: data: id: 4242fcdd31586085 type: dora_failure schema: $ref: "#/components/schemas/DORAFailureResponse" description: OK - but delayed due to incident "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] summary: Send an incident event tags: ["Delivery Performance"] x-codegen-request-body-name: body /api/v2/dora/failure/{failure_id}: delete: description: |- Use this API endpoint to delete an incident event. operationId: DeleteDORAFailure parameters: - description: The ID of the incident event to delete. in: path name: failure_id required: true schema: type: string responses: "202": description: Accepted "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete an incident event tags: ["Delivery Performance"] x-permission: operator: OR permissions: - dora_metrics_write /api/v2/dora/failures: post: description: |- Use this API endpoint to get a list of incident events. operationId: ListDORAFailures requestBody: content: application/json: examples: default: value: data: attributes: from: "2025-01-01T00:00:00Z" limit: 100 query: severity:(SEV-1 OR SEV-2) env:production team:backend sort: -started_at to: "2025-01-31T23:59:59Z" type: dora_failures_list_request schema: $ref: "#/components/schemas/DORAListFailuresRequest" required: true responses: "200": content: application/json: examples: default: value: data: - attributes: env: production name: Database outage services: - test-service severity: SEV-1 started_at: "2023-08-31T14:29:34Z" team: backend id: abc-123 type: dora_failure schema: $ref: "#/components/schemas/DORAFailuresListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a list of incident events tags: ["Delivery Performance"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - dora_metrics_read /api/v2/dora/failures/{failure_id}: get: description: |- Use this API endpoint to get an incident event. operationId: GetDORAFailure parameters: - description: The ID of the incident event. in: path name: failure_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: env: production name: Database outage services: - test-service severity: SEV-1 started_at: "2023-08-31T14:29:34Z" team: backend id: abc-123 type: dora_failure schema: $ref: "#/components/schemas/DORAFailureFetchResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get an incident event tags: ["Delivery Performance"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - dora_metrics_read /api/v2/dora/incident: post: deprecated: true description: |- **Note**: This endpoint is deprecated. Please use `/api/v2/dora/failure` instead. Use this API endpoint to provide incident data. Tracking incidents gives a side-by-side view of how failed deployments translate into real-world incidents. operationId: CreateDORAIncident requestBody: content: application/json: examples: default: value: data: attributes: custom_tags: - language:java - department:engineering env: staging finished_at: 1693491984000000000 git: commit_sha: 66adc9350f2cc9b250b69abddab733dd55e1a588 repository_url: https://github.com/organization/example-repository name: Webserver is down failing all requests. services: - test-service severity: High started_at: 1693491974000000000 team: backend version: v1.12.07 schema: $ref: "#/components/schemas/DORAFailureRequest" required: true responses: "200": content: application/json: examples: default: value: data: id: 4242fcdd31586085 type: dora_failure schema: $ref: "#/components/schemas/DORAFailureResponse" description: OK "202": content: application/json: examples: default: value: data: id: 4242fcdd31586085 type: dora_failure schema: $ref: "#/components/schemas/DORAFailureResponse" description: OK - but delayed due to incident "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] summary: Send an incident event (legacy) tags: ["Delivery Performance"] x-codegen-request-body-name: body /api/v2/downtime: get: description: Get all scheduled downtimes. operationId: ListDowntimes parameters: - description: Only return downtimes that are active when the request is made. in: query name: current_only required: false schema: type: boolean - description: |- Comma-separated list of resource paths for related resources to include in the response. Supported resource paths are `created_by` and `monitor`. in: query name: include required: false schema: example: "created_by,monitor" type: string - $ref: "#/components/parameters/PageOffset" - description: Maximum number of downtimes in the response. example: 100 in: query name: page[limit] required: false schema: default: 30 format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: created: "2024-01-01T00:00:00+00:00" display_timezone: America/New_York message: Message about the downtime modified: "2024-01-01T00:00:00+00:00" monitor_identifier: monitor_tags: - "*" mute_first_recovery_notification: false notify_end_states: - alert - warn notify_end_types: - canceled - expired scope: env:(staging OR prod) AND datacenter:us-east-1 status: active id: "00000000-0000-1234-0000-000000000000" type: downtime meta: page: total_filtered_count: 1 schema: $ref: "#/components/schemas/ListDowntimesResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitors_downtime summary: Get all downtimes tags: - Downtimes x-pagination: limitParam: page[limit] pageOffsetParam: page[offset] resultsPath: data "x-permission": operator: OR permissions: - monitors_downtime post: description: Schedule a downtime. operationId: CreateDowntime requestBody: content: application/json: examples: default: value: data: attributes: display_timezone: America/New_York message: Message about the downtime monitor_identifier: monitor_id: 123 mute_first_recovery_notification: false notify_end_states: - alert - warn notify_end_types: - canceled - expired schedule: timezone: America/New_York scope: env:(staging OR prod) AND datacenter:us-east-1 type: downtime schema: $ref: "#/components/schemas/DowntimeCreateRequest" description: Schedule a downtime request body. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created: "2024-01-01T00:00:00+00:00" display_timezone: America/New_York message: Message about the downtime modified: "2024-01-01T00:00:00+00:00" monitor_identifier: monitor_tags: - "*" mute_first_recovery_notification: false notify_end_states: - alert - warn notify_end_types: - canceled - expired scope: env:(staging OR prod) AND datacenter:us-east-1 status: active id: "00000000-0000-1234-0000-000000000000" type: downtime schema: $ref: "#/components/schemas/DowntimeResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitors_downtime summary: Schedule a downtime tags: - Downtimes x-codegen-request-body-name: body "x-permission": operator: OR permissions: - monitors_downtime /api/v2/downtime/{downtime_id}: delete: description: |- Cancel a downtime. **Note**: Downtimes canceled through the API are no longer active, but are retained for approximately two days before being permanently removed. The downtime may still appear in search results until it is permanently removed. operationId: CancelDowntime parameters: - description: ID of the downtime to cancel. in: path name: downtime_id required: true schema: example: 00000000-0000-1234-0000-000000000000 type: string responses: "204": description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Downtime not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitors_downtime summary: Cancel a downtime tags: - Downtimes "x-permission": operator: OR permissions: - monitors_downtime get: description: Get downtime detail by `downtime_id`. operationId: GetDowntime parameters: - description: ID of the downtime to fetch. in: path name: downtime_id required: true schema: example: "00000000-0000-1234-0000-000000000000" type: string - description: |- Comma-separated list of resource paths for related resources to include in the response. Supported resource paths are `created_by` and `monitor`. in: query name: include required: false schema: example: "created_by,monitor" type: string - description: |- If `true`, include the `run_as` attribute in the response, which lists the principals allowed to act on behalf of the downtime. **Note**: This feature is currently in Preview and may not be available for all organizations. in: query name: with_run_as required: false schema: default: false type: boolean responses: "200": content: application/json: examples: default: value: data: attributes: created: "2024-01-01T00:00:00+00:00" display_timezone: America/New_York message: Message about the downtime modified: "2024-01-01T00:00:00+00:00" monitor_identifier: monitor_tags: - "*" mute_first_recovery_notification: false notify_end_states: - alert - warn notify_end_types: - canceled - expired scope: env:(staging OR prod) AND datacenter:us-east-1 status: active id: "00000000-0000-1234-0000-000000000000" type: downtime schema: $ref: "#/components/schemas/DowntimeResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitors_downtime summary: Get a downtime tags: - Downtimes "x-permission": operator: OR permissions: - monitors_downtime patch: description: Update a downtime by `downtime_id`. operationId: UpdateDowntime parameters: - description: ID of the downtime to update. in: path name: downtime_id required: true schema: example: "00e000000-0000-1234-0000-000000000000" type: string requestBody: content: application/json: examples: default: value: data: attributes: display_timezone: America/New_York message: Message about the downtime monitor_identifier: monitor_id: 123 mute_first_recovery_notification: false notify_end_states: - alert - warn notify_end_types: - canceled - expired schedule: timezone: America/New_York scope: env:(staging OR prod) AND datacenter:us-east-1 id: 00000000-0000-1234-0000-000000000000 type: downtime schema: $ref: "#/components/schemas/DowntimeUpdateRequest" description: Update a downtime request body. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created: "2024-01-01T00:00:00+00:00" display_timezone: America/New_York message: Message about the downtime modified: "2024-01-01T00:00:00+00:00" monitor_identifier: monitor_tags: - "*" mute_first_recovery_notification: false notify_end_states: - alert - warn notify_end_types: - canceled - expired scope: env:(staging OR prod) AND datacenter:us-east-1 status: active id: "00000000-0000-1234-0000-000000000000" type: downtime schema: $ref: "#/components/schemas/DowntimeResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Downtime not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitors_downtime summary: Update a downtime tags: - Downtimes x-codegen-request-body-name: body "x-permission": operator: OR permissions: - monitors_downtime /api/v2/error-tracking/issues/search: post: description: Search issues endpoint allows you to programmatically search for issues within your organization. This endpoint returns a list of issues that match a given search query, following the event search syntax. The search results are limited to a maximum of 100 issues per request. operationId: SearchIssues parameters: - $ref: "#/components/parameters/SearchIssuesIncludeQueryParameter" requestBody: content: application/json: examples: default: value: data: attributes: from: 1671612804000 order_by: IMPACTED_SESSIONS persona: BACKEND query: service:orders-* AND @language:go to: 1671620004000 type: search_request schema: $ref: "#/components/schemas/IssuesSearchRequest" description: Search issues request payload. required: true responses: "200": content: application/json: examples: default: value: data: - attributes: impacted_sessions: 12 impacted_users: 4 total_count: 82 id: abc-123 type: error_tracking_search_result schema: $ref: "#/components/schemas/IssuesSearchResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - error_tracking_read summary: Search error tracking issues tags: - Error Tracking /api/v2/error-tracking/issues/{issue_id}: get: description: Retrieve the full details for a specific error tracking issue, including attributes and relationships. operationId: GetIssue parameters: - $ref: "#/components/parameters/IssueIDPathParameter" - $ref: "#/components/parameters/GetIssueIncludeQueryParameter" - $ref: "#/components/parameters/GetIssueSamplesBiasesFilterParameter" responses: "200": content: application/json: examples: default: value: data: attributes: error_message: "object of type 'NoneType' has no len()" error_type: builtins.TypeError service: test-service state: OPEN id: 00000000-0000-0000-0000-000000000001 type: issue schema: $ref: "#/components/schemas/IssueResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - error_tracking_read summary: Get the details of an error tracking issue tags: - Error Tracking /api/v2/error-tracking/issues/{issue_id}/assignee: delete: description: Remove the assignee of an issue by `issue_id`. operationId: DeleteIssueAssignee parameters: - $ref: "#/components/parameters/IssueIDPathParameter" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - error_tracking_read - error_tracking_write - cases_read - cases_write summary: Remove the assignee of an issue tags: - Error Tracking put: description: Update the assignee of an issue by `issue_id`. operationId: UpdateIssueAssignee parameters: - $ref: "#/components/parameters/IssueIDPathParameter" requestBody: content: application/json: examples: default: value: data: id: 87cb11a0-278c-440a-99fe-701223c80296 type: assignee schema: $ref: "#/components/schemas/IssueUpdateAssigneeRequest" description: Update issue assignee request payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: error_message: "object of type 'NoneType' has no len()" error_type: builtins.TypeError service: test-service state: OPEN id: 00000000-0000-0000-0000-000000000003 type: issue schema: $ref: "#/components/schemas/IssueResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - error_tracking_read - error_tracking_write - cases_read - cases_write summary: Update the assignee of an issue tags: - Error Tracking /api/v2/error-tracking/issues/{issue_id}/state: put: description: Update the state of an issue by `issue_id`. Use this endpoint to move an issue between states such as `OPEN`, `RESOLVED`, or `IGNORED`. operationId: UpdateIssueState parameters: - $ref: "#/components/parameters/IssueIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: state: RESOLVED id: c1726a66-1f64-11ee-b338-da7ad0900002 type: error_tracking_issue schema: $ref: "#/components/schemas/IssueUpdateStateRequest" description: Update issue state request payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: error_message: "object of type 'NoneType' has no len()" error_type: builtins.TypeError service: test-service state: RESOLVED id: 00000000-0000-0000-0000-000000000002 type: issue schema: $ref: "#/components/schemas/IssueResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - error_tracking_read - error_tracking_write summary: Update the state of an issue tags: - Error Tracking /api/v2/events: get: description: |- List endpoint returns events that match an events search query. [Results are paginated similarly to logs](https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination). Use this endpoint to see your latest events. operationId: ListEvents parameters: - description: Search query following events syntax. in: query name: filter[query] required: false schema: type: string - description: Minimum timestamp for requested events, in milliseconds. in: query name: filter[from] required: false schema: type: string - description: Maximum timestamp for requested events, in milliseconds. in: query name: filter[to] required: false schema: type: string - description: Order of events in results. in: query name: sort required: false schema: $ref: "#/components/schemas/EventsSort" - description: |- List following results with a cursor provided in the previous query. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" in: query name: page[cursor] required: false schema: type: string - description: Maximum number of events in the response. example: 25 in: query name: page[limit] required: false schema: default: 10 format: int32 maximum: 1000 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: message: "Test event" tags: - "env:prod" timestamp: "2019-01-02T09:42:36.320Z" id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: event meta: request_id: MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR schema: $ref: "#/components/schemas/EventsListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - events_read summary: Get a list of events tags: ["Events"] x-pagination: cursorParam: page[cursor] cursorPath: meta.page.after limitParam: page[limit] resultsPath: data "x-permission": operator: OR permissions: - events_read post: description: |- This endpoint allows you to publish events. **Note:** To utilize this endpoint with our client libraries, please ensure you are using the latest version released on or after July 1, 2025. Earlier versions do not support this functionality. **Important:** Upgrade to the latest client library version to use the updated endpoint at `https://event-management-intake.{site}/api/v2/events`. Older client library versions of the Post an event (v2) API send requests to a deprecated endpoint (`https://api.{site}/api/v2/events`). Supported event categories are `change` and `alert`. For more information about change events, see [Change Tracking](https://docs.datadoghq.com/change_tracking). operationId: CreateEvent requestBody: content: application/json: examples: alert-event: description: Example of an alert event for tracking alerts and monitoring events. summary: Alert Event value: {"data": {"attributes": {"aggregation_key": "deduplication_key_here", "attributes": {"custom": {"my-object-attribute": {"my-array-attribute": [1, 2, 3], "my-array-object-attribute": ["name": "test-object-1", "name": "test-object-2"], "my-integer-attribute": 1}, "my-string-attribute": "my-custom-value"}, "links": [{"category": "runbook", "title": "Datadog website", "url": "https://datadoghq.com"}], "priority": "1", "status": "error"}, "category": "alert", "message": "Something is broken!", "tags": ["service:my-test-service", "datacenter:primary"], "title": "My Alerting Event"}, "type": "event"}} change-event: description: Example of a change event for tracking configuration or feature flag changes. summary: Change Event value: {"data": {"attributes": {"aggregation_key": "aggregation_key_123", "attributes": {"author": {"name": "example@datadog.com", "type": "user"}, "change_metadata": {"dd": {"team": "datadog_team", "user_email": "datadog@datadog.com", "user_id": "datadog_user_id", "user_name": "datadog_username"}, "resource_link": "datadog.com/feature/fallback_payments_test"}, "changed_resource": {"name": "fallback_payments_test", "type": "feature_flag"}, "impacted_resources": [{"name": "payments_api", "type": "service"}], "new_value": {"enabled": true, "percentage": "50%", "rule": {"datacenter": "devcycle.us1.prod"}}, "prev_value": {"enabled": true, "percentage": "10%", "rule": {"datacenter": "devcycle.us1.prod"}}}, "category": "change", "host": "hostname", "integration_id": "custom-events", "message": "payment_processed feature flag has been enabled", "tags": ["env:api_client_test"], "timestamp": "2020-01-01T01:30:15.010000Z", "title": "payment_processed feature flag updated"}, "type": "event"}} default: value: data: attributes: aggregation_key: aggregation_key_123 attributes: author: name: example@datadog.com type: user change_metadata: dd: team: datadog_team user_email: datadog@datadog.com user_id: datadog_user_id user_name: datadog_username resource_link: datadog.com/feature/fallback_payments_test changed_resource: name: fallback_payments_test type: feature_flag impacted_resources: - name: payments_api type: service new_value: enabled: true percentage: 50% rule: datacenter: devcycle.us1.prod prev_value: enabled: true percentage: 10% rule: datacenter: devcycle.us1.prod category: change host: hostname integration_id: custom-events message: payment_processed feature flag has been enabled tags: - env:api_client_test timestamp: "2020-01-01T01:30:15.010000Z" title: payment_processed feature flag updated type: event schema: $ref: "#/components/schemas/EventCreateRequestPayload" description: Event creation request payload. required: true responses: "202": content: application/json: examples: default: value: data: attributes: attributes: evt: uid: abc-123 type: event schema: $ref: "#/components/schemas/EventCreateResponsePayload" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] servers: - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: The regional site for customers. enum: - datadoghq.com - us3.datadoghq.com - us5.datadoghq.com - ap1.datadoghq.com - ap2.datadoghq.com - uk1.datadoghq.com - datadoghq.eu - ddog-gov.com - us2.ddog-gov.com x-enum-varnames: - US1 - US3 - US5 - AP1 - AP2 - UK1 - EU1 - GOV - US2_GOV subdomain: default: event-management-intake description: The subdomain where the API is deployed. - url: "{protocol}://{name}" variables: name: default: event-management-intake.datadoghq.com description: Full site DNS name. protocol: default: https description: The protocol for accessing the API. - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: Any Datadog deployment. subdomain: default: event-management-intake description: The subdomain where the API is deployed. summary: Post an event tags: ["Events"] x-codegen-request-body-name: body /api/v2/events/search: post: description: |- List endpoint returns events that match an events search query. [Results are paginated similarly to logs](https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination). Use this endpoint to build complex events filtering and search. operationId: SearchEvents requestBody: content: "application/json": examples: default: value: filter: from: now-15m query: service:web* AND @http.status_code:[200 TO 299] to: now options: timezone: GMT page: cursor: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== limit: 25 sort: timestamp schema: $ref: "#/components/schemas/EventsListRequest" required: false responses: "200": content: application/json: examples: default: value: data: - attributes: message: "Test event" tags: - "env:prod" timestamp: "2019-01-02T09:42:36.320Z" id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: event meta: request_id: MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR schema: $ref: "#/components/schemas/EventsListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - events_read summary: Search events tags: ["Events"] x-codegen-request-body-name: body x-pagination: cursorParam: body.page.cursor cursorPath: meta.page.after limitParam: body.page.limit resultsPath: data "x-permission": operator: OR permissions: - events_read /api/v2/events/{event_id}: get: description: >- Get the details of an event by `event_id`. operationId: GetEvent parameters: - description: The UID of the event. in: path name: event_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: message: "The event message" tags: - "env:api_client_test" timestamp: "2017-01-15T01:30:15.010000Z" id: abc-123 type: event schema: $ref: "#/components/schemas/V2EventResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - events_read summary: Get an event tags: ["Events"] "x-permission": operator: OR permissions: - events_read /api/v2/experiments: get: description: >- List experiments. Returns a paginated list of experiments and their structured metadata for the organization. Supports filtering and pagination. Use Get experiment for variants, decision metrics, traffic exposure, and assignment configuration. operationId: ListExperiments parameters: - description: >- Return only experiments concluded at or after this RFC3339 timestamp. Inclusive, and excludes experiments that have not concluded. in: query name: concluded_since schema: description: |- Return only experiments concluded at or after this RFC3339 timestamp. Inclusive, and excludes experiments that have not concluded. format: date-time type: string - description: Return only experiments created at or after this RFC3339 timestamp. Inclusive. in: query name: created_since schema: description: "Return only experiments created at or after this RFC3339 timestamp. Inclusive." format: date-time type: string - description: >- Maximum number of results to return. Defaults to 25 when omitted, and is capped at 50 (larger values are clamped to 50). The response includes meta.page (with total) and pagination links. in: query name: page[limit] schema: description: |- Maximum number of results to return. Defaults to 25 when omitted, and is capped at 50 (larger values are clamped to 50). The response includes meta.page (with total) and pagination links. format: int64 type: integer - description: Number of results to skip for pagination. Defaults to 0 when omitted. in: query name: page[offset] schema: description: "Number of results to skip for pagination. Defaults to 0 when omitted." format: int64 type: integer - description: |- Filter by protocol UUID. Repeat this parameter to supply several IDs. An experiment matches if it uses any listed protocol. in: query name: protocol_id schema: description: |- Filter by protocol UUID. Repeat this parameter to supply several IDs. An experiment matches if it uses any listed protocol. items: description: "UUID of a protocol to match." format: uuid type: string type: array - description: >- Return only experiments whose results_last_updated is before this RFC3339 timestamp. results_last_updated is the later of the latest successful run completion and the latest stored result refresh. Exclusive, and excludes experiments without successful results. in: query name: results_updated_before schema: description: |- Return only experiments whose results_last_updated is before this RFC3339 timestamp. results_last_updated is the later of the latest successful run completion and the latest stored result refresh. Exclusive, and excludes experiments without successful results. format: date-time type: string - description: >- Return only experiments whose results_last_updated is at or after this RFC3339 timestamp. results_last_updated is the later of the latest successful run completion and the latest stored result refresh. Inclusive, and excludes experiments without successful results. This filter does not include all metadata edits or deletions. in: query name: results_updated_since schema: description: >- Return only experiments whose results_last_updated is at or after this RFC3339 timestamp. results_last_updated is the later of the latest successful run completion and the latest stored result refresh. Inclusive, and excludes experiments without successful results. This filter does not include all metadata edits or deletions. format: date-time type: string - description: "Find experiments whose names contain the search text, regardless of case." in: query name: search schema: description: "Find experiments whose names contain the search text, regardless of case." type: string - description: >- Sort fields: name, created_at, or updated_at. Use a comma-separated list in priority order, for example name,-created_at. Prefix each field with `-` for descending. Defaults to created_at descending. in: query name: sort schema: description: |- Sort fields: name, created_at, or updated_at. Use a comma-separated list in priority order, for example name,-created_at. Prefix each field with `-` for descending. Defaults to created_at descending. type: string - description: |- Filter by experiment status. Accepted values are DRAFT, SCHEDULED, IN_PROGRESS, READY_FOR_DECISION, DECISION_MADE, and CANCELLED. Repeat this parameter to select several statuses, for example `status=IN_PROGRESS&status=READY_FOR_DECISION`. in: query name: status schema: description: |- Filter by experiment status. Accepted values are DRAFT, SCHEDULED, IN_PROGRESS, READY_FOR_DECISION, DECISION_MADE, and CANCELLED. Repeat this parameter to select several statuses, for example `status=IN_PROGRESS&status=READY_FOR_DECISION`. items: description: "Experiment status to include in the results." type: string type: array - description: |- Filter by tag name. Repeat this parameter to supply several tags. An experiment matches if it has at least one listed tag. in: query name: tags schema: description: |- Filter by tag name. Repeat this parameter to supply several tags. An experiment matches if it has at least one listed tag. items: description: "Tag name to match against experiment tags." type: string type: array responses: "200": content: application/json: examples: default: value: data: - attributes: assignments_end_date: "2026-08-15T00:00:00Z" assignments_start_date: "2026-08-01T00:00:00Z" concluded_at: "2026-08-05T09:30:00Z" conclusion: decision_reason: The primary metric improved without material regressions outcome: POSITIVE summary: The treatment improved conversion created_at: "2026-08-01T12:00:00Z" events_end_date: "2026-08-22T00:00:00Z" events_start_date: "2026-08-01T00:00:00Z" experiment_type: STANDARD hypothesis: A clearer checkout button increases purchase conversion name: Checkout button test pipeline_table_suffix: a1b2c3d4 protocol_id: e4d5f6a7-0000-0000-0000-000000000000 related_links: - id: d1d2d3d4-0000-0000-0000-000000000000 title: Experiment design url: https://docs.example.com/checkout-experiment results_last_updated: "2026-08-05T09:25:00Z" status: DECISION_MADE structured_metadata: - enum_values: - beta field_display_name: Launch stage field_key: launch_stage field_type: ENUM - field_display_name: Notes field_key: notes field_type: FREETEXT freetext_value: Checkout redesign subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 summary: The treatment improved conversion tags: - growth teams: - growth updated_at: "2026-08-05T09:30:00Z" id: 550e8400-e29b-41d4-a716-446655440000 type: experiments schema: $ref: "#/components/schemas/ExperimentsExperimentV2ListDTOArray" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Invalid query parameter: bad page[offset]/page[limit], unknown sort field, invalid status, malformed protocol_id UUID, invalid result timestamp range, or a timestamp filter that is not RFC3339. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Missing or invalid authentication (dd-api-key + dd-application-key headers, or a valid user session). "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_experiments_read permission. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_read summary: List experiments tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_read post: description: >- Create a draft experiment. `name` is required. `structured_metadata` identifies each metadata field by `field_key`; use `freetext_value` for free-text fields and `enum_values` for enum fields. When this attribute is present, the request must include a value for every required metadata field. When `protocol_id` is present, the published protocol supplies the subject type, decision metrics, analysis-plan defaults, and configuration and enforcement baselines. The request may also include hypothesis, tags, teams, related links, and assignment or event date overrides that satisfy the protocol's duration rules; omit subject_type_id, decision_metrics, variants, warehouse_exposure_configuration, datadog_flag_configuration, traffic_exposure, split_by_properties, and structured_metadata. The protocol association cannot be changed after creation. Without `protocol_id`, a complete Warehouse or Datadog configuration saves the experiment and its configuration in one transaction. For Datadog flag configuration, send `name`, `subject_type_id`, `decision_metrics`, `variants`, `traffic_exposure`, `assignments_start_date`, `assignments_end_date`, `events_start_date`, and `events_end_date`. The four date fields can be null. Inside `datadog_flag_configuration`, send `feature_flag_id`, `environment_id`, `targeting_rules`, and `entry_point`. Use `targeting_rules: []` and `entry_point: null` when unused. This creates one saved draft allocation that does not serve traffic. Omit all configuration fields to create an experiment without an allocation. This endpoint is not idempotent. operationId: CreateExperiment requestBody: content: application/json: examples: default: description: >- Replace the resource IDs with IDs from your organization. The flag variants must belong to the specified flag. This request saves a draft allocation and does not start traffic. summary: Draft with a Datadog feature flag value: data: attributes: assignments_end_date: "2026-08-15T00:00:00Z" assignments_start_date: "2026-08-01T00:00:00Z" datadog_flag_configuration: entry_point: environment_id: 550e8400-e29b-41d4-a716-446655440005 feature_flag_id: 550e8400-e29b-41d4-a716-446655440004 targeting_rules: [] decision_metrics: - is_primary: true metric_id: b1a2c3d4-0000-0000-0000-000000000000 events_end_date: "2026-08-22T00:00:00Z" events_start_date: "2026-08-01T00:00:00Z" name: Checkout button test structured_metadata: - enum_values: - beta field_key: launch_stage - field_key: notes freetext_value: Checkout redesign subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 traffic_exposure: fraction: 1 mode: STATIC variants: - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440010 is_active: true is_control: true key: control weight: 50 - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440011 is_active: true is_control: false key: treatment weight: 50 type: experiments minimal_draft: description: >- Uses the organization's default subject type. Add an assignment source, decision metrics, variants, and a run window before starting the experiment. summary: Minimal draft value: data: attributes: name: Checkout button test type: experiments published_protocol: description: >- Replace protocol_id with a published protocol ID from your organization. The protocol supplies the configuration and its rules. Do not copy the configuration fields from the other examples into this request. summary: Draft from a published protocol value: data: attributes: name: Checkout protocol test protocol_id: 550e8400-e29b-41d4-a716-446655440040 type: experiments warehouse_assignments: description: >- Replace the subject type, metric, and exposure SQL model IDs with compatible resources from your organization. The SQL model must provide assignments for checkout_button_test and the control and treatment variant keys. This request saves configuration and does not start analysis. summary: Draft with warehouse assignments value: data: attributes: assignments_end_date: "2026-08-15T00:00:00Z" assignments_start_date: "2026-08-01T00:00:00Z" decision_metrics: - is_primary: true metric_id: b1a2c3d4-0000-0000-0000-000000000000 events_end_date: "2026-08-22T00:00:00Z" events_start_date: "2026-08-01T00:00:00Z" name: Warehouse checkout test subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 traffic_exposure: fraction: 1 mode: STATIC variants: - is_active: true is_control: true key: control name: Control weight: 50 - is_active: true is_control: false key: treatment name: Treatment weight: 50 warehouse_exposure_configuration: entry_point: experiment_key: checkout_button_test exposure_sql_model_id: 550e8400-e29b-41d4-a716-446655440050 type: experiments schema: $ref: "#/components/schemas/ExperimentsCreateExperimentV2Request" required: true responses: "201": content: application/json: examples: default: value: data: attributes: assignments_end_date: "2026-08-15T00:00:00Z" assignments_start_date: "2026-08-01T00:00:00Z" concluded_at: created_at: "2026-07-31T12:00:00Z" datadog_flag_configuration: allocation_key: 550e8400-e29b-41d4-a716-446655440030 entry_point: environment_id: 550e8400-e29b-41d4-a716-446655440005 feature_flag_id: 550e8400-e29b-41d4-a716-446655440004 targeting_rules: [] decision_metrics: - is_primary: true metric_id: b1a2c3d4-0000-0000-0000-000000000000 events_end_date: "2026-08-22T00:00:00Z" events_start_date: "2026-08-01T00:00:00Z" experiment_type: STANDARD name: Checkout button test pipeline_table_suffix: a1b2c3d4 related_links: [] results_last_updated: split_by_properties: [] status: DRAFT structured_metadata: - enum_values: - beta field_display_name: Launch stage field_key: launch_stage field_type: ENUM - field_display_name: Notes field_key: notes field_type: FREETEXT freetext_value: Checkout redesign subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 tags: [] teams: [] traffic_exposure: fraction: 1 mode: STATIC updated_at: "2026-07-31T12:00:00Z" variants: - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440010 is_active: true is_control: true key: control name: Control weight: 50 - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440011 is_active: true is_control: false key: treatment name: Treatment weight: 50 warehouse_exposure_configuration: id: 550e8400-e29b-41d4-a716-446655440000 type: experiments schema: $ref: "#/components/schemas/ExperimentsExperimentV2DTO" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Invalid request body: missing required field, malformed variants or decision_metrics, or an unresolvable analysis configuration. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Missing or invalid authentication (dd-api-key + dd-application-key headers, or a valid user session). "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_experiments_write permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The supplied protocol_id does not identify a protocol in this organization. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- The requested configuration is incompatible with the experiment (code: unsupported_configuration). "415": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Request body sent with a media type other than application/json or application/vnd.api+json. "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The supplied protocol is a draft or archived protocol and cannot be applied to a new experiment. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_write summary: Create experiment tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_write /api/v2/experiments/exposure-sql-models: get: description: >- List exposure SQL models. Returns a paginated list of the SQL models that experiment exposures are read from for the organization. Models maintained by Datadog are not included: they cannot be modified and cannot be used as an experiment's assignment source. operationId: ListExposureSQLModels parameters: - description: |- Optional fields to include. Repeat this parameter to request several fields. `counts` adds experiment_count, which costs an extra aggregate query. in: query name: include schema: description: |- Optional fields to include. Repeat this parameter to request several fields. `counts` adds experiment_count, which costs an extra aggregate query. items: description: "Optional response field to include." type: string type: array - description: >- When true, archived models are included in the result. Defaults to false, so archived models are hidden. in: query name: include_archived schema: description: |- When true, archived models are included in the result. Defaults to false, so archived models are hidden. type: boolean - description: >- Maximum number of results to return. Defaults to 25 when omitted, and is capped at 50 (larger values are clamped to 50). The response includes meta.page (with total) and pagination links. in: query name: page[limit] schema: description: |- Maximum number of results to return. Defaults to 25 when omitted, and is capped at 50 (larger values are clamped to 50). The response includes meta.page (with total) and pagination links. format: int64 type: integer - description: Number of results to skip for pagination. Defaults to 0 when omitted. in: query name: page[offset] schema: description: "Number of results to skip for pagination. Defaults to 0 when omitted." format: int64 type: integer - description: "Find exposure SQL models whose names contain the search text, regardless of case." in: query name: search schema: description: "Find exposure SQL models whose names contain the search text, regardless of case." type: string - description: |- Sort field: name, created_at, or updated_at. Prefix with `-` for descending (for example, `-created_at`). Defaults to created_at descending. in: query name: sort schema: description: |- Sort field: name, created_at, or updated_at. Prefix with `-` for descending (for example, `-created_at`). Defaults to created_at descending. type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T12:00:00Z" experiment_column: experiment_id name: Exposure events sql: SELECT user_id, experiment_id, variant, exposed_at, country FROM analytics.exposures subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: exposed_at updated_at: "2024-01-01T12:00:00Z" variant_column: variant id: 550e8400-e29b-41d4-a716-446655440030 type: exposure-sql-models schema: $ref: "#/components/schemas/ExperimentsExposureSQLModelV2DTOArray" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Invalid query parameter: bad page[offset]/page[limit], search longer than 1024 bytes, unknown sort field, non-boolean include_archived, or unknown include value. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Missing or invalid authentication (dd-api-key + dd-application-key headers, or a valid user session). "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_metrics_read permission. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_metrics_read summary: List exposure SQL models tags: - Experiments x-permission: operator: AND permissions: - product_analytics_metrics_read post: description: >- Create an exposure SQL model. Requires at least one subject type. The warehouse connection is resolved from the organization, which has exactly one. operationId: CreateExposureSQLModel requestBody: content: application/json: examples: default: value: data: attributes: date_partition_column: experiment_column: experiment_id name: Exposure events sql: SELECT user_id, experiment_id, variant, exposed_at, country FROM analytics.exposures subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: exposed_at variant_column: variant type: exposure-sql-models schema: $ref: "#/components/schemas/ExperimentsCreateExposureSQLModelV2Request" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T12:00:00Z" experiment_column: experiment_id name: Exposure events sql: SELECT user_id, experiment_id, variant, exposed_at, country FROM analytics.exposures subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: exposed_at updated_at: "2024-01-01T12:00:00Z" variant_column: variant id: 550e8400-e29b-41d4-a716-446655440030 type: exposure-sql-models schema: $ref: "#/components/schemas/ExperimentsExposureSQLModelV2DTO" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed body, validation failure, or the SQL was rejected by the warehouse validator. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_warehouse_model_write permission. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The write collided with an existing record for the organization. "415": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Request body sent with a media type other than application/json or application/vnd.api+json. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_warehouse_model_write summary: Create exposure SQL model tags: - Experiments x-permission: operator: AND permissions: - product_analytics_warehouse_model_write /api/v2/experiments/exposure-sql-models/{exposure_sql_model_id}: get: description: >- Get an exposure SQL model. Returns a single model by its ID for the organization, including its subject types and properties. operationId: GetExposureSQLModel parameters: - description: "The UUID of the exposure SQL model." in: path name: exposure_sql_model_id required: true schema: description: "The UUID of the exposure SQL model." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string - description: |- Optional fields to include. Repeat this parameter to request several fields. `counts` adds experiment_count. in: query name: include schema: description: |- Optional fields to include. Repeat this parameter to request several fields. `counts` adds experiment_count. items: description: "Optional response field to include." type: string type: array responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T12:00:00Z" experiment_column: experiment_id name: Exposure events sql: SELECT user_id, experiment_id, variant, exposed_at, country FROM analytics.exposures subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: exposed_at updated_at: "2024-01-01T12:00:00Z" variant_column: variant id: 550e8400-e29b-41d4-a716-446655440030 type: exposure-sql-models schema: $ref: "#/components/schemas/ExperimentsExposureSQLModelV2DTO" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed exposure SQL model ID (not a valid UUID), or unknown include value. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_metrics_read permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No exposure SQL model with this ID exists for the organization. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_metrics_read summary: Get exposure SQL model tags: - Experiments x-permission: operator: AND permissions: - product_analytics_metrics_read put: description: >- Replace an exposure SQL model. This is a full replacement and is destructive: any subject type or property not present in the body is deleted, and properties are matched on name, column_name and column_type together, so changing one of those replaces the property rather than editing it. Send the complete set you want to keep. Anything removed is listed under meta.removed_subject_type_ids and meta.removed_property_names in the response. The warehouse connection is not settable and is left as stored. operationId: UpdateExposureSQLModel parameters: - description: "The UUID of the exposure SQL model." in: path name: exposure_sql_model_id required: true schema: description: "The UUID of the exposure SQL model." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string - description: |- Optional fields to include. Repeat this parameter to request several fields. `counts` adds experiment_count to the updated model. in: query name: include schema: description: |- Optional fields to include. Repeat this parameter to request several fields. `counts` adds experiment_count to the updated model. items: description: "Optional response field to include." type: string type: array requestBody: content: application/json: examples: default: value: data: attributes: date_partition_column: experiment_column: experiment_id name: Exposure events sql: SELECT user_id, experiment_id, variant, exposed_at, country FROM analytics.exposures subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: exposed_at variant_column: variant type: exposure-sql-models schema: $ref: "#/components/schemas/ExperimentsCreateExposureSQLModelV2Request" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T12:00:00Z" experiment_column: experiment_id name: Exposure events sql: SELECT user_id, experiment_id, variant, exposed_at, country FROM analytics.exposures subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: exposed_at updated_at: "2024-01-01T12:00:00Z" variant_column: variant id: 550e8400-e29b-41d4-a716-446655440030 type: exposure-sql-models schema: $ref: "#/components/schemas/ExperimentsUpdateExposureSQLModelV2Response" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Malformed exposure SQL model ID, malformed body, validation failure, or the SQL was rejected by the warehouse validator. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_warehouse_model_write permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No exposure SQL model with this ID exists for the organization. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The write collided with an existing record for the organization. "415": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Request body sent with a media type other than application/json or application/vnd.api+json. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_warehouse_model_write summary: Update exposure SQL model tags: - Experiments x-permission: operator: AND permissions: - product_analytics_warehouse_model_write /api/v2/experiments/exposure-sql-models/{exposure_sql_model_id}/archive: post: description: >- Archive an exposure SQL model. Archived models are hidden from the default list and are no longer refreshed for new feature flags. Experiments already reading from the model keep working. Archiving is how a model that is in use by an experiment, and therefore cannot be deleted, is retired. operationId: ArchiveExposureSQLModel parameters: - description: "The UUID of the exposure SQL model." in: path name: exposure_sql_model_id required: true schema: description: "The UUID of the exposure SQL model." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "204": description: >- The exposure SQL model was archived. Archiving an already-archived model succeeds and leaves the original archive time in place. "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed exposure SQL model ID (not a valid UUID). "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_warehouse_model_write permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No exposure SQL model with this ID exists for the organization. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_warehouse_model_write summary: Archive exposure SQL model tags: - Experiments x-permission: operator: AND permissions: - product_analytics_warehouse_model_write /api/v2/experiments/exposure-sql-models/{exposure_sql_model_id}/unarchive: post: description: Unarchive an exposure SQL model. Restores an archived model to the default list. operationId: UnarchiveExposureSQLModel parameters: - description: "The UUID of the exposure SQL model." in: path name: exposure_sql_model_id required: true schema: description: "The UUID of the exposure SQL model." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "204": description: >- The exposure SQL model was unarchived. Unarchiving a model that is not archived succeeds and changes nothing. "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed exposure SQL model ID (not a valid UUID). "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_warehouse_model_write permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No exposure SQL model with this ID exists for the organization. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_warehouse_model_write summary: Unarchive exposure SQL model tags: - Experiments x-permission: operator: AND permissions: - product_analytics_warehouse_model_write /api/v2/experiments/metric-collections: get: description: >- List metric collections for the organization. Collections are reusable ordered metric sets; attaching one to an experiment creates an independent snapshot. operationId: ListMetricCollections parameters: - description: |- Optional fields to include. Repeat this parameter to request several fields. `counts` adds metric_count. in: query name: include schema: description: |- Optional fields to include. Repeat this parameter to request several fields. `counts` adds metric_count. items: description: "Optional response field to include." type: string type: array - description: "Number of results per page. The default is 25. Values above 50 are reduced to 50." in: query name: page[limit] schema: description: "Number of results per page. The default is 25. Values above 50 are reduced to 50." format: int64 type: integer - description: "Number of results to skip before returning this page." in: query name: page[offset] schema: description: "Number of results to skip before returning this page." format: int64 type: integer - description: |- Find collections whose names contain the search text, regardless of case. Leading and trailing spaces are ignored. Blank values apply no filter. The maximum length is 1024 UTF-8 bytes. in: query name: search schema: description: |- Find collections whose names contain the search text, regardless of case. Leading and trailing spaces are ignored. Blank values apply no filter. The maximum length is 1024 UTF-8 bytes. type: string - description: |- Sort by one field: `name`, `created_at`, or `updated_at`. Prefix with `-` for descending order. The default is `-created_at`. in: query name: sort schema: description: |- Sort by one field: `name`, `created_at`, or `updated_at`. Prefix with `-` for descending order. The default is `-created_at`. type: string responses: "200": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/ExperimentsMetricCollectionV2DTOArray" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_metrics_read summary: List metric collections tags: - Experiments x-permission: operator: AND permissions: - product_analytics_metrics_read post: description: Create metric collection. operationId: CreateMetricCollection requestBody: content: application/json: examples: default: value: data: attributes: name: Activation type: metric-collections schema: $ref: "#/components/schemas/ExperimentsCreateMetricCollectionV2Request" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2026-08-01T12:00:00Z" description: Metrics reviewed for every checkout experiment. is_guardrail: false metrics: - metric_id: 550e8400-e29b-41d4-a716-446655440020 metric_name: Checkout conversion name: Checkout metrics updated_at: "2026-08-02T09:30:00Z" id: 550e8400-e29b-41d4-a716-446655440040 type: metric-collections schema: $ref: "#/components/schemas/ExperimentsMetricCollectionV2DTO" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "415": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Request body sent with a media type other than application/json or application/vnd.api+json. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_metrics_write summary: Create metric collection tags: - Experiments x-permission: operator: AND permissions: - product_analytics_metrics_write /api/v2/experiments/metric-collections/{metric_collection_id}: delete: description: Delete metric collection. operationId: DeleteMetricCollection parameters: - description: "The UUID of the metric collection." in: path name: metric_collection_id required: true schema: description: "The UUID of the metric collection." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_metrics_write summary: Delete metric collection tags: - Experiments x-permission: operator: AND permissions: - product_analytics_metrics_write get: description: Get metric collection. operationId: GetMetricCollection parameters: - description: "The UUID of the metric collection." in: path name: metric_collection_id required: true schema: description: "The UUID of the metric collection." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-08-01T12:00:00Z" description: Metrics reviewed for every checkout experiment. is_guardrail: false metrics: - metric_id: 550e8400-e29b-41d4-a716-446655440020 metric_name: Checkout conversion name: Checkout metrics updated_at: "2026-08-02T09:30:00Z" id: 550e8400-e29b-41d4-a716-446655440040 type: metric-collections schema: $ref: "#/components/schemas/ExperimentsMetricCollectionV2DTO" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_metrics_read summary: Get metric collection tags: - Experiments x-permission: operator: AND permissions: - product_analytics_metrics_read patch: description: Update metric collection. operationId: UpdateMetricCollection parameters: - description: "The UUID of the metric collection." in: path name: metric_collection_id required: true schema: description: "The UUID of the metric collection." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: metrics: [] type: metric-collections schema: $ref: "#/components/schemas/ExperimentsPatchMetricCollectionV2Request" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-08-01T12:00:00Z" description: Metrics reviewed for every checkout experiment. is_guardrail: false metrics: - metric_id: 550e8400-e29b-41d4-a716-446655440020 metric_name: Checkout conversion name: Checkout metrics updated_at: "2026-08-02T09:30:00Z" id: 550e8400-e29b-41d4-a716-446655440040 type: metric-collections schema: $ref: "#/components/schemas/ExperimentsMetricCollectionV2DTO" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "415": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Request body sent with a media type other than application/json or application/vnd.api+json. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_metrics_write summary: Update metric collection tags: - Experiments x-permission: operator: AND permissions: - product_analytics_metrics_write /api/v2/experiments/metric-sql-models: get: description: >- List metric SQL models. Returns a paginated list of the SQL models that metrics are defined on for the organization. operationId: ListMetricSQLModels parameters: - description: |- Optional fields to include. Repeat this parameter to request several fields. `counts` adds metric_count and experiment_count, which cost an extra aggregate query. in: query name: include schema: description: |- Optional fields to include. Repeat this parameter to request several fields. `counts` adds metric_count and experiment_count, which cost an extra aggregate query. items: description: "Optional response field to include." type: string type: array - description: >- Maximum number of results to return. Defaults to 25 when omitted, and is capped at 50 (larger values are clamped to 50). The response includes meta.page (with total) and pagination links. in: query name: page[limit] schema: description: |- Maximum number of results to return. Defaults to 25 when omitted, and is capped at 50 (larger values are clamped to 50). The response includes meta.page (with total) and pagination links. format: int64 type: integer - description: Number of results to skip for pagination. Defaults to 0 when omitted. in: query name: page[offset] schema: description: "Number of results to skip for pagination. Defaults to 0 when omitted." format: int64 type: integer - description: |- Sort field: name, created_at, updated_at, metric_count, or experiment_count. A single field only; a comma-separated list is rejected. Prefix with `-` for descending (for example, `-created_at`). Defaults to created_at descending. in: query name: sort schema: description: |- Sort field: name, created_at, updated_at, metric_count, or experiment_count. A single field only; a comma-separated list is rejected. Prefix with `-` for descending (for example, `-created_at`). Defaults to created_at descending. type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T12:00:00Z" event_count_measure_id: 550e8400-e29b-41d4-a716-446655440024 is_certified: false measures: - column_name: revenue column_type: FLOAT id: 550e8400-e29b-41d4-a716-446655440021 name: revenue name: Order facts sql: SELECT user_id, order_id, item_type, revenue, created_at FROM analytics.orders subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 unique_subject_count_measure_id: 550e8400-e29b-41d4-a716-446655440022 timestamp_column: created_at updated_at: "2024-01-01T12:00:00Z" id: 550e8400-e29b-41d4-a716-446655440020 type: metric-sql-models schema: $ref: "#/components/schemas/ExperimentsMetricSQLModelV2DTOArray" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Invalid query parameter: bad page[offset]/page[limit], unknown sort field, or unknown include value. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Missing or invalid authentication (dd-api-key + dd-application-key headers, or a valid user session). "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_metrics_read permission. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_metrics_read summary: List metric SQL models tags: - Experiments x-permission: operator: AND permissions: - product_analytics_metrics_read post: description: >- Create a metric SQL model. Requires at least one subject type, whose subject_type_id must already exist for the organization (list them with GET /api/v2/experiments/subject-types). The model is created against the organization's warehouse connection, which is resolved server-side. Only customer-defined measures belong in measures. The response provides unique_subject_count_measure_id for each subject type and event_count_measure_id for use in metric aggregations. column_type is required for every measure and property. Certification is read-only and cannot be changed through this endpoint. operationId: CreateMetricSQLModel requestBody: content: application/json: examples: default: value: data: attributes: date_partition_column: description: measures: - column_name: revenue column_type: FLOAT description: name: name: Order facts sql: SELECT user_id, order_id, item_type, revenue, created_at FROM analytics.orders subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: created_at type: metric-sql-models schema: $ref: "#/components/schemas/ExperimentsCreateMetricSQLModelV2Request" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T12:00:00Z" event_count_measure_id: 550e8400-e29b-41d4-a716-446655440024 is_certified: false measures: - column_name: revenue column_type: FLOAT id: 550e8400-e29b-41d4-a716-446655440021 name: revenue name: Order facts sql: SELECT user_id, order_id, item_type, revenue, created_at FROM analytics.orders subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 unique_subject_count_measure_id: 550e8400-e29b-41d4-a716-446655440022 timestamp_column: created_at updated_at: "2024-01-01T12:00:00Z" id: 550e8400-e29b-41d4-a716-446655440020 type: metric-sql-models schema: $ref: "#/components/schemas/ExperimentsMetricSQLModelV2DTO" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Malformed body, validation failure, the SQL was rejected by the warehouse validator, or the organization has no warehouse connection. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_warehouse_model_write permission. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Another metric SQL model in this organization already uses one of these values. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_warehouse_model_write summary: Create metric SQL model tags: - Experiments x-permission: operator: AND permissions: - product_analytics_warehouse_model_write /api/v2/experiments/metric-sql-models/{metric_sql_model_id}: get: description: >- Get a metric SQL model. Returns a single model by its ID for the organization, including its subject types, measures and properties. operationId: GetMetricSQLModel parameters: - description: |- Optional fields to include. Repeat this parameter to request several fields. `counts` adds metric_count and experiment_count. in: query name: include schema: description: |- Optional fields to include. Repeat this parameter to request several fields. `counts` adds metric_count and experiment_count. items: description: "Optional response field to include." type: string type: array - description: "The UUID of the metric SQL model." in: path name: metric_sql_model_id required: true schema: description: "The UUID of the metric SQL model." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T12:00:00Z" event_count_measure_id: 550e8400-e29b-41d4-a716-446655440024 is_certified: false measures: - column_name: revenue column_type: FLOAT id: 550e8400-e29b-41d4-a716-446655440021 name: revenue name: Order facts sql: SELECT user_id, order_id, item_type, revenue, created_at FROM analytics.orders subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 unique_subject_count_measure_id: 550e8400-e29b-41d4-a716-446655440022 timestamp_column: created_at updated_at: "2024-01-01T12:00:00Z" id: 550e8400-e29b-41d4-a716-446655440020 type: metric-sql-models schema: $ref: "#/components/schemas/ExperimentsMetricSQLModelV2DTO" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed metric SQL model ID (not a valid UUID), or unknown include value. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_metrics_read permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No metric SQL model with this ID exists for the organization. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_metrics_read summary: Get metric SQL model tags: - Experiments x-permission: operator: AND permissions: - product_analytics_metrics_read put: description: >- Replace a metric SQL model. This is a destructive full replace: subject types, customer-defined measures, and properties absent from the body are deleted, so send the complete set. Properties are matched by name; changing a property's column, type, or description preserves its ID. column_type is required for every measure and property. Removing a measure or property that an active metric references returns 409 Conflict. Server-generated IDs returned by GET are read-only and can be left in a replayed body. The response reports removals in meta.deleted_subject_types, meta.deleted_measures, and meta.deleted_properties. Certification is read-only. Certified models cannot be replaced through this endpoint. operationId: UpdateMetricSQLModel parameters: - description: "The UUID of the metric SQL model." in: path name: metric_sql_model_id required: true schema: description: "The UUID of the metric SQL model." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: date_partition_column: description: measures: - column_name: revenue column_type: FLOAT description: name: name: Order facts sql: SELECT user_id, order_id, item_type, revenue, created_at FROM analytics.orders subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 timestamp_column: created_at type: metric-sql-models schema: $ref: "#/components/schemas/ExperimentsCreateMetricSQLModelV2Request" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T12:00:00Z" event_count_measure_id: 550e8400-e29b-41d4-a716-446655440024 is_certified: false measures: - column_name: revenue column_type: FLOAT id: 550e8400-e29b-41d4-a716-446655440021 name: revenue name: Order facts sql: SELECT user_id, order_id, item_type, revenue, created_at FROM analytics.orders subject_types: - column_name: user_id subject_type_id: 550e8400-e29b-41d4-a716-446655440010 unique_subject_count_measure_id: 550e8400-e29b-41d4-a716-446655440022 timestamp_column: created_at updated_at: "2024-01-01T12:00:00Z" id: 550e8400-e29b-41d4-a716-446655440020 type: metric-sql-models schema: $ref: "#/components/schemas/ExperimentsUpdateMetricSQLModelV2Response" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed ID or body, validation failure, or the SQL was rejected by the warehouse validator. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_warehouse_model_write permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No metric SQL model with this ID exists for the organization. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- The model is certified or managed by metric sync, or the update would remove a measure or property still used by an active metric. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_warehouse_model_write summary: Update metric SQL model tags: - Experiments x-permission: operator: AND permissions: - product_analytics_warehouse_model_write /api/v2/experiments/metrics: get: description: List metrics. Returns a paginated list of the experiment metrics defined for the organization. operationId: ListMetrics parameters: - description: |- Optional fields to include. Repeat this parameter to request several fields. `counts` adds experiment_count on each metric, which costs an extra aggregate query. in: query name: include schema: description: |- Optional fields to include. Repeat this parameter to request several fields. `counts` adds experiment_count on each metric, which costs an extra aggregate query. items: description: "Optional response field to include." type: string type: array - description: >- Maximum number of results to return. Defaults to 25 when omitted, and is capped at 50 (larger values are clamped to 50). The response includes meta.page (with total) and pagination links. in: query name: page[limit] schema: description: |- Maximum number of results to return. Defaults to 25 when omitted, and is capped at 50 (larger values are clamped to 50). The response includes meta.page (with total) and pagination links. format: int64 type: integer - description: Number of results to skip for pagination. Defaults to 0 when omitted. in: query name: page[offset] schema: description: "Number of results to skip for pagination. Defaults to 0 when omitted." format: int64 type: integer - description: "Find metrics whose names contain the search text, regardless of case." in: query name: search schema: description: "Find metrics whose names contain the search text, regardless of case." type: string - description: |- Sort field: name, created_at, or updated_at. Prefix with `-` for descending (for example, `-created_at`). A single field only; a comma-separated list is rejected. Defaults to created_at descending. in: query name: sort schema: description: |- Sort field: name, created_at, or updated_at. Prefix with `-` for descending (for example, `-created_at`). A single field only; a comma-separated list is rejected. Defaults to created_at descending. type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T12:00:00Z" data_source_type: CUSTOMER_WAREHOUSE description: Share of sessions that reach the order confirmation page desired_change: METRIC_INCREASES format_as_percent: true metric_type: SIMPLE name: Checkout conversion numerator_aggregation: operation: sum pipeline_column_suffix: agg001 timeframe_start_value: 0 warehouse_metric_measure: id: 550e8400-e29b-41d4-a716-446655440021 pipeline_column_suffix: rev001 reference_url: "" updated_at: "2024-01-01T12:00:00Z" id: 550e8400-e29b-41d4-a716-446655440002 type: metrics schema: $ref: "#/components/schemas/ExperimentsMetricV2DTOArray" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Invalid query parameter: bad page[offset]/page[limit], or unknown sort field." "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Missing or invalid authentication (dd-api-key + dd-application-key headers, or a valid user session). "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_metrics_read permission. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_metrics_read summary: List metrics tags: - Experiments x-permission: operator: AND permissions: - product_analytics_metrics_read post: description: >- Create a metric. The metric's type is derived from the aggregation shape: a numerator alone is SIMPLE, a numerator with a denominator is RATIO, and a percentile aggregation is PERCENTILE. Warehouse aggregations reference measures by UUID. Property filters use property_id or measure_id UUIDs returned by the same metric SQL model; every reference must belong to the aggregation's data source. The is_certified attribute is rejected. Certification cannot be changed through this endpoint. operationId: CreateMetric requestBody: content: application/json: examples: default: value: data: attributes: data_source_type: CUSTOMER_WAREHOUSE description: desired_change: METRIC_INCREASES format_as_percent: true guardrail_cutoff_threshold: name: Checkout conversion numerator_aggregation: operation: sum property_filters: - - operation: IS property_id: 550e8400-e29b-41d4-a716-446655440023 values: - US timeframe_start_value: 0 warehouse_metric_measure: id: 550e8400-e29b-41d4-a716-446655440021 type: metrics schema: $ref: "#/components/schemas/ExperimentsCreateMetricV2Request" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T12:00:00Z" data_source_type: CUSTOMER_WAREHOUSE description: Share of sessions that reach the order confirmation page desired_change: METRIC_INCREASES format_as_percent: true metric_type: SIMPLE name: Checkout conversion numerator_aggregation: operation: sum pipeline_column_suffix: agg001 timeframe_start_value: 0 warehouse_metric_measure: id: 550e8400-e29b-41d4-a716-446655440021 pipeline_column_suffix: rev001 reference_url: "" updated_at: "2024-01-01T12:00:00Z" id: 550e8400-e29b-41d4-a716-446655440002 type: metrics schema: $ref: "#/components/schemas/ExperimentsMetricV2DTO" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed body, validation failure, or an aggregation that does not match metric_type. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Caller lacks product_analytics_metrics_write. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Another metric in this organization already uses one of these values. "415": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Request body sent with a media type other than application/json or application/vnd.api+json. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_metrics_write summary: Create metric tags: - Experiments x-permission: operator: AND permissions: - product_analytics_metrics_write /api/v2/experiments/metrics/{metric_id}: delete: description: >- Delete a metric. Certified metrics are read-only through this endpoint. The record is soft-deleted and stops appearing in reads. A metric still referenced by an experiment cannot be deleted; detach it from those experiments first. operationId: DeleteMetric parameters: - description: "The UUID of the metric." in: path name: metric_id required: true schema: description: "The UUID of the metric." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "204": description: The metric was deleted. "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed metric ID (not a valid UUID). "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Caller lacks product_analytics_metrics_write or edit access to this specific metric. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No metric with this ID exists for the organization. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- The metric is imported, certified, managed by metric sync, or still referenced by one or more experiments and cannot be deleted. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_metrics_write summary: Delete metric tags: - Experiments x-permission: operator: AND permissions: - product_analytics_metrics_write get: description: Get a metric. Returns a single experiment metric by its ID for the organization. operationId: GetMetric parameters: - description: |- Optional fields to include. Repeat this parameter to request several fields. `counts` adds experiment_count: how many experiments currently reference this metric. in: query name: include schema: description: |- Optional fields to include. Repeat this parameter to request several fields. `counts` adds experiment_count: how many experiments currently reference this metric. items: description: "Optional response field to include." type: string type: array - description: "The UUID of the metric." in: path name: metric_id required: true schema: description: "The UUID of the metric." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T12:00:00Z" data_source_type: CUSTOMER_WAREHOUSE description: Share of sessions that reach the order confirmation page desired_change: METRIC_INCREASES format_as_percent: true metric_type: SIMPLE name: Checkout conversion numerator_aggregation: operation: sum pipeline_column_suffix: agg001 timeframe_start_value: 0 warehouse_metric_measure: id: 550e8400-e29b-41d4-a716-446655440021 pipeline_column_suffix: rev001 reference_url: "" updated_at: "2024-01-01T12:00:00Z" id: 550e8400-e29b-41d4-a716-446655440002 type: metrics schema: $ref: "#/components/schemas/ExperimentsMetricV2DTO" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed metric ID (not a valid UUID). "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_metrics_read permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No metric with this ID exists for the organization. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_metrics_read summary: Get metric tags: - Experiments x-permission: operator: AND permissions: - product_analytics_metrics_read patch: description: >- Update a metric. Certified metrics are read-only through this endpoint. This is a partial update: every attribute is optional and an omitted attribute keeps its stored value, so a body carrying only the fields being changed is enough. `guardrail_cutoff_threshold` is nullable -- send null to clear it, omit it to leave it alone. Omitting the aggregation leaves the metric's definition untouched; supplying one replaces it wholesale, and the metric's type is re-derived from the shape supplied. Property filters use property_id or measure_id UUIDs from the aggregation's data source. Attributes that are computed rather than stored (short_id, metric_type, certified_at, experiment_count, created_at, updated_at) are rejected rather than ignored, so a body copied from GET must have them removed. The is_certified attribute is rejected. Certification cannot be changed through this endpoint. operationId: UpdateMetric parameters: - description: "The UUID of the metric." in: path name: metric_id required: true schema: description: "The UUID of the metric." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: name: Checkout conversion id: 550e8400-e29b-41d4-a716-446655440020 type: metrics schema: $ref: "#/components/schemas/ExperimentsUpdateMetricV2Request" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T12:00:00Z" data_source_type: CUSTOMER_WAREHOUSE description: Share of sessions that reach the order confirmation page desired_change: METRIC_INCREASES format_as_percent: true metric_type: SIMPLE name: Checkout conversion numerator_aggregation: operation: sum pipeline_column_suffix: agg001 timeframe_start_value: 0 warehouse_metric_measure: id: 550e8400-e29b-41d4-a716-446655440021 pipeline_column_suffix: rev001 reference_url: "" updated_at: "2024-01-01T12:00:00Z" id: 550e8400-e29b-41d4-a716-446655440002 type: metrics schema: $ref: "#/components/schemas/ExperimentsMetricV2DTO" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed ID or body, or validation failure. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Caller lacks product_analytics_metrics_write or edit access to this specific metric. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No metric with this ID exists for the organization. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- The metric is imported, certified, or managed by metric sync, or another metric in this organization already uses one of these values. "415": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Request body sent with a media type other than application/json or application/vnd.api+json. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_metrics_write summary: Update metric tags: - Experiments x-permission: operator: AND permissions: - product_analytics_metrics_write /api/v2/experiments/protocols: get: description: >- List draft, published, and archived experiment protocols. Omit filter[status] to return all statuses. Only published protocols can be used to create experiments. operationId: ListExperimentProtocols parameters: - description: Filter by protocol status. Repeat this parameter to select more than one status. explode: true in: query name: filter[status] schema: items: $ref: "#/components/schemas/ExperimentsPublicProtocolResponseDataAttributesStatus" type: array style: form - description: "Filter by the UUID of the primary metric in the protocol template." in: query name: filter[primary_metric_id] schema: description: "Filter by the UUID of the primary metric in the protocol template." format: uuid type: string - description: |- Find protocols whose names contain the search text, regardless of case. Leading and trailing spaces are ignored. Blank values apply no filter. The maximum length is 1024 UTF-8 bytes. in: query name: filter[query] schema: description: |- Find protocols whose names contain the search text, regardless of case. Leading and trailing spaces are ignored. Blank values apply no filter. The maximum length is 1024 UTF-8 bytes. type: string - description: "Filter by the UUID of the subject type in the protocol template." in: query name: filter[subject_type_id] schema: description: "Filter by the UUID of the subject type in the protocol template." format: uuid type: string - description: "Number of results per page. The default is 25. Values above 50 are reduced to 50." in: query name: page[limit] schema: description: "Number of results per page. The default is 25. Values above 50 are reduced to 50." format: int64 type: integer - description: "Number of results to skip before returning this page." in: query name: page[offset] schema: description: "Number of results to skip before returning this page." format: int64 type: integer - description: |- Sort by `name`, `subject_type_name`, `primary_metric_name`, or `updated_at`. Prefix with `-` for descending order. The default is `-updated_at`. in: query name: sort schema: description: |- Sort by `name`, `subject_type_name`, `primary_metric_name`, or `updated_at`. Prefix with `-` for descending order. The default is `-updated_at`. type: string responses: "200": content: application/json: examples: default: value: data: - attributes: experiment_count: 0 name: Checkout protocol status: DRAFT updated_at: "2026-07-31T12:00:00Z" id: e4d5f6a7-0000-0000-0000-000000000000 type: protocols schema: $ref: "#/components/schemas/ExperimentsPublicProtocolListResponseArray" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_read summary: List experiment protocols tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_read post: description: >- Create a draft protocol with a name and optional description and migration metadata. The organization's default subject type is selected. Use PATCH to configure the draft, then publish it before creating experiments from it. operationId: CreateExperimentProtocol requestBody: content: application/json: examples: default: value: data: attributes: description: Defaults for checkout experiments. name: Checkout protocol type: protocols schema: $ref: "#/components/schemas/ExperimentsCreateExperimentProtocolRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2026-07-31T12:00:00Z" description: Defaults for checkout experiments. enforcement: confidence_interval_method: LOCKED confidence_level: EDITABLE cuped_calculation: EDITABLE default_duration: EDITABLE environment: EDITABLE flag_source: LOCKED multiple_testing_correction: EDITABLE notifications: EDITABLE primary_metric: EDITABLE secondary_metrics: EDITABLE split_by_exploration_dimensions: EDITABLE subject_type: LOCKED targeting_rules: EDITABLE traffic_exposure: EDITABLE warehouse_exposure_source: EDITABLE experiment_count: 0 is_duration_required_to_start: false is_equal_split_enforced: false is_metric_limit_enabled: false is_minimum_duration_enabled: false metric_groups: [] name: Checkout protocol status: DRAFT subject_type: id: c2b3d4e5-0000-0000-0000-000000000000 name: User subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 updated_at: "2026-07-31T12:00:00Z" id: e4d5f6a7-0000-0000-0000-000000000000 type: protocols schema: $ref: "#/components/schemas/ExperimentsPublicProtocolResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Invalid request or protocol settings. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The caller lacks the product_analytics_experiments_write permission. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: A protocol with this name already exists. "415": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unsupported request content type. "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_write summary: Create experiment protocol tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_write /api/v2/experiments/protocols/{protocol_id}: delete: description: >- Delete a protocol with no linked experiments. Draft, published, and archived protocols can be deleted. Returns 204 with no response body. operationId: DeleteExperimentProtocol parameters: - description: The UUID of the protocol. in: path name: protocol_id required: true schema: description: The UUID of the protocol. example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string - description: >- The updated_at value from the last read. Include the full timestamp, with fractional seconds. Returns 409 if another write changed the protocol. Omit to skip this check. in: query name: expected_updated_at schema: type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Invalid request or protocol settings. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The caller lacks the product_analytics_experiments_write permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No protocol with this ID exists in the organization. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The protocol has linked experiments or expected_updated_at is stale. "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_write summary: Delete experiment protocol tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_write get: description: Get a draft, published, or archived experiment protocol by ID. operationId: GetExperimentProtocol parameters: - description: "The UUID of the protocol." in: path name: protocol_id required: true schema: description: "The UUID of the protocol." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-07-31T12:00:00Z" description: Default settings for checkout experiments. enforcement: confidence_interval_method: LOCKED confidence_level: EDITABLE cuped_calculation: EDITABLE default_duration: EDITABLE environment: EDITABLE flag_source: LOCKED multiple_testing_correction: EDITABLE notifications: EDITABLE primary_metric: EDITABLE secondary_metrics: EDITABLE split_by_exploration_dimensions: EDITABLE subject_type: LOCKED targeting_rules: EDITABLE traffic_exposure: EDITABLE warehouse_exposure_source: EDITABLE experiment_count: 0 is_duration_required_to_start: false is_equal_split_enforced: false is_metric_limit_enabled: false is_minimum_duration_enabled: false metric_groups: [] name: Checkout experiments primary_metric: id: b1a2c3d4-0000-0000-0000-000000000000 name: Checkout conversion primary_metric_id: b1a2c3d4-0000-0000-0000-000000000000 published_at: "2026-07-31T12:00:00Z" status: PUBLISHED subject_type: id: c2b3d4e5-0000-0000-0000-000000000000 name: User subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 updated_at: "2026-07-31T12:00:00Z" id: e4d5f6a7-0000-0000-0000-000000000000 type: protocols schema: $ref: "#/components/schemas/ExperimentsPublicProtocolResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_read summary: Get experiment protocol tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_read patch: description: >- Update the supplied fields of a draft protocol. Published protocols accept only name, description, and migration_metadata changes through PATCH. Use PUT to replace their settings. Archived protocols cannot be edited. Omitted fields keep their current values, including fields inside analysis_plan, exposure_schedule, and enforcement. Arrays replace the stored arrays. Supported null values clear fields; see the request schema. Use primary_metric_id to select the primary metric and default_duration_days to set the experiment analysis duration. Nested metric is_primary and analysis_plan.target_duration_days fields are rejected. operationId: PatchExperimentProtocol parameters: - description: The UUID of the protocol. in: path name: protocol_id required: true schema: description: The UUID of the protocol. example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: description: Updated defaults for checkout experiments. type: protocols schema: $ref: "#/components/schemas/ExperimentsPatchExperimentProtocolRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-07-31T12:00:00Z" description: Updated defaults for checkout experiments. enforcement: confidence_interval_method: LOCKED confidence_level: EDITABLE cuped_calculation: EDITABLE default_duration: EDITABLE environment: EDITABLE flag_source: LOCKED multiple_testing_correction: EDITABLE notifications: EDITABLE primary_metric: EDITABLE secondary_metrics: EDITABLE split_by_exploration_dimensions: EDITABLE subject_type: LOCKED targeting_rules: EDITABLE traffic_exposure: EDITABLE warehouse_exposure_source: EDITABLE experiment_count: 0 is_duration_required_to_start: false is_equal_split_enforced: false is_metric_limit_enabled: false is_minimum_duration_enabled: false metric_groups: [] name: Checkout protocol status: DRAFT subject_type: id: c2b3d4e5-0000-0000-0000-000000000000 name: User subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 updated_at: "2026-07-31T12:00:00Z" id: e4d5f6a7-0000-0000-0000-000000000000 type: protocols schema: $ref: "#/components/schemas/ExperimentsPublicProtocolResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Invalid request or protocol settings. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The caller lacks the product_analytics_experiments_write permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No protocol with this ID exists in the organization. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- The protocol is archived, a published protocol receives settings changes, or the name is already in use. "415": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unsupported request content type. "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_write summary: Update experiment protocol tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_write put: description: >- Replace the template of a published protocol. Draft and archived protocols return 409. Send subject_type_id, all four required boolean settings, and metric_groups. Omitted optional template fields are cleared. Omitted enforcement keeps the existing locks. Use primary_metric_id to select the primary metric. Use default_duration_days to set target_duration_days on experiments created from the protocol. The nested metric is_primary and analysis_plan.target_duration_days fields are rejected. An unchanged GET response can be sent as the request body. Response-only fields are ignored. Independent configuration errors are returned together in the JSON:API errors array. Each error identifies the field in source.pointer. Earlier request and reference checks can stop on the first error. A failed request leaves the protocol unchanged. Changes apply to future experiments; existing experiments keep their settings. operationId: ReplaceExperimentProtocol parameters: - description: The UUID of the protocol. in: path name: protocol_id required: true schema: description: The UUID of the protocol. example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string - description: >- The updated_at value from the last read. Include the full timestamp, with fractional seconds. Returns 409 if another write changed the protocol. Omit to skip this check. in: query name: expected_updated_at schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: is_duration_required_to_start: false is_equal_split_enforced: false is_metric_limit_enabled: false is_minimum_duration_enabled: false metric_groups: [] subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 type: protocols schema: $ref: "#/components/schemas/ExperimentsReplaceExperimentProtocolRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-07-31T12:00:00Z" description: Defaults for checkout experiments. enforcement: confidence_interval_method: LOCKED confidence_level: EDITABLE cuped_calculation: EDITABLE default_duration: EDITABLE environment: EDITABLE flag_source: LOCKED multiple_testing_correction: EDITABLE notifications: EDITABLE primary_metric: EDITABLE secondary_metrics: EDITABLE split_by_exploration_dimensions: EDITABLE subject_type: LOCKED targeting_rules: EDITABLE traffic_exposure: EDITABLE warehouse_exposure_source: EDITABLE experiment_count: 0 is_duration_required_to_start: false is_equal_split_enforced: false is_metric_limit_enabled: false is_minimum_duration_enabled: false metric_groups: [] name: Checkout protocol published_at: "2026-07-31T12:00:00Z" status: PUBLISHED subject_type: id: c2b3d4e5-0000-0000-0000-000000000000 name: User subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 updated_at: "2026-07-31T12:00:00Z" id: e4d5f6a7-0000-0000-0000-000000000000 type: protocols schema: $ref: "#/components/schemas/ExperimentsPublicProtocolResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Invalid request or protocol settings. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The caller lacks the product_analytics_experiments_write permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No protocol with this ID exists in the organization. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The protocol is not published or expected_updated_at is stale. "415": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unsupported request content type. "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_write summary: Replace experiment protocol tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_write /api/v2/experiments/protocols/{protocol_id}/archive: post: description: >- Archive a draft or published protocol. Archived protocols cannot be edited or used to create new experiments. Existing experiments keep their settings. Archiving an already archived protocol returns 409. operationId: ArchiveExperimentProtocol parameters: - description: The UUID of the protocol. in: path name: protocol_id required: true schema: description: The UUID of the protocol. example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string - description: >- The updated_at value from the last read. Include the full timestamp, with fractional seconds. Returns 409 if another write changed the protocol. Omit to skip this check. in: query name: expected_updated_at schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: archived_at: "2026-07-31T14:00:00Z" created_at: "2026-07-31T12:00:00Z" description: Defaults for checkout experiments. enforcement: confidence_interval_method: LOCKED confidence_level: EDITABLE cuped_calculation: EDITABLE default_duration: EDITABLE environment: EDITABLE flag_source: LOCKED multiple_testing_correction: EDITABLE notifications: EDITABLE primary_metric: EDITABLE secondary_metrics: EDITABLE split_by_exploration_dimensions: EDITABLE subject_type: LOCKED targeting_rules: EDITABLE traffic_exposure: EDITABLE warehouse_exposure_source: EDITABLE experiment_count: 0 is_duration_required_to_start: false is_equal_split_enforced: false is_metric_limit_enabled: false is_minimum_duration_enabled: false metric_groups: [] name: Checkout protocol published_at: "2026-07-31T12:00:00Z" status: ARCHIVED subject_type: id: c2b3d4e5-0000-0000-0000-000000000000 name: User subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 updated_at: "2026-07-31T14:00:00Z" id: e4d5f6a7-0000-0000-0000-000000000000 type: protocols schema: $ref: "#/components/schemas/ExperimentsPublicProtocolResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Invalid request or protocol settings. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The caller lacks the product_analytics_experiments_write permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No protocol with this ID exists in the organization. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The protocol is already archived or expected_updated_at is stale. "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_write summary: Archive experiment protocol tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_write /api/v2/experiments/protocols/{protocol_id}/publish: post: description: >- Publish a valid draft protocol. The protocol must have a name and subject type. Supplied references and settings must be valid. An exposure schedule or targeting rules require an environment. Enabled limits require their values. Configurable template fields must have a value before they can be locked. Independent configuration errors are returned together in the JSON:API errors array with source.pointer values that identify the fields. Earlier request and reference checks can stop on the first error. A failed request leaves the protocol unchanged. operationId: PublishExperimentProtocol parameters: - description: The UUID of the protocol. in: path name: protocol_id required: true schema: description: The UUID of the protocol. example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-07-31T12:00:00Z" description: Defaults for checkout experiments. enforcement: confidence_interval_method: LOCKED confidence_level: EDITABLE cuped_calculation: EDITABLE default_duration: EDITABLE environment: EDITABLE flag_source: LOCKED multiple_testing_correction: EDITABLE notifications: EDITABLE primary_metric: EDITABLE secondary_metrics: EDITABLE split_by_exploration_dimensions: EDITABLE subject_type: LOCKED targeting_rules: EDITABLE traffic_exposure: EDITABLE warehouse_exposure_source: EDITABLE experiment_count: 0 is_duration_required_to_start: false is_equal_split_enforced: false is_metric_limit_enabled: false is_minimum_duration_enabled: false metric_groups: [] name: Checkout protocol published_at: "2026-07-31T12:00:00Z" status: PUBLISHED subject_type: id: c2b3d4e5-0000-0000-0000-000000000000 name: User subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 updated_at: "2026-07-31T12:00:00Z" id: e4d5f6a7-0000-0000-0000-000000000000 type: protocols schema: $ref: "#/components/schemas/ExperimentsPublicProtocolResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Invalid request or protocol settings. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The caller lacks the product_analytics_experiments_write permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No protocol with this ID exists in the organization. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Only draft protocols can be published. "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_write summary: Publish experiment protocol tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_write /api/v2/experiments/results/refresh: post: description: >- Trigger a results refresh across the organization's active experiments. Returns the count of experiments whose refresh was triggered (meta.experiments_updated) plus a per-experiment breakdown of what happened to each (meta.results). operationId: RefreshExperimentResultsForOrg parameters: - description: Force a full warehouse rebuild. Defaults to false when omitted. in: query name: full_refresh schema: description: "Force a full warehouse rebuild. Defaults to false when omitted." type: boolean responses: "202": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/ExperimentsRefreshExperimentResultsV2DTOArray" description: Accepted "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The full_refresh query parameter is not a valid boolean. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_experiments_write permission. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_write summary: Refresh experiment results for org tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_write /api/v2/experiments/subject-types: get: description: List subject types. Returns a paginated list of the subject types defined for the organization. operationId: ListSubjectTypes parameters: - description: >- Set to `counts` to add experiment_count, exposure_source_count, metric_sql_model_count and protocol_count to each subject type. Each costs an extra query, so they are omitted unless asked for. in: query name: include schema: description: |- Set to `counts` to add experiment_count, exposure_source_count, metric_sql_model_count and protocol_count to each subject type. Each costs an extra query, so they are omitted unless asked for. type: string - description: >- Maximum number of results to return. Defaults to 25 when omitted, and is capped at 50 (larger values are clamped to 50). The response includes meta.page (with total) and pagination links. in: query name: page[limit] schema: description: |- Maximum number of results to return. Defaults to 25 when omitted, and is capped at 50 (larger values are clamped to 50). The response includes meta.page (with total) and pagination links. format: int64 type: integer - description: Number of results to skip for pagination. Defaults to 0 when omitted. in: query name: page[offset] schema: description: "Number of results to skip for pagination. Defaults to 0 when omitted." format: int64 type: integer - description: "Find subject types whose names contain the search text, regardless of case." in: query name: search schema: description: "Find subject types whose names contain the search text, regardless of case." type: string - description: >- Sort fields: name, created_at, or updated_at. Use a comma-separated list in priority order, for example name,-created_at. Prefix each field with `-` for descending. Defaults to created_at descending. in: query name: sort schema: description: |- Sort fields: name, created_at, or updated_at. Use a comma-separated list in priority order, for example name,-created_at. Prefix each field with `-` for descending. Defaults to created_at descending. type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T12:00:00Z" is_default: true name: User product_analytics_attribute: "@usr.id" updated_at: "2024-01-01T12:00:00Z" warehouse_column_names: - user_id - customer_id id: 550e8400-e29b-41d4-a716-446655440010 type: subject-types schema: $ref: "#/components/schemas/ExperimentsSubjectTypeV2DTOArray" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Invalid query parameter: bad page[offset]/page[limit], or unknown sort field." "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Missing or invalid authentication (dd-api-key + dd-application-key headers, or a valid user session). "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_settings_read permission. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_settings_read summary: List subject types tags: - Experiments x-permission: operator: AND permissions: - product_analytics_settings_read post: description: Create a subject type for the organization. operationId: CreateSubjectType requestBody: content: application/json: examples: default: value: data: attributes: name: User product_analytics_attribute: "@usr.id" warehouse_column_names: - user_id - customer_id type: subject-types schema: $ref: "#/components/schemas/ExperimentsCreateSubjectTypeV2Request" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T12:00:00Z" is_default: true name: User product_analytics_attribute: "@usr.id" updated_at: "2024-01-01T12:00:00Z" warehouse_column_names: - user_id - customer_id id: 550e8400-e29b-41d4-a716-446655440010 type: subject-types schema: $ref: "#/components/schemas/ExperimentsSubjectTypeV2DTO" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Malformed body, or validation failure on name, product_analytics_attribute, or warehouse_column_names. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_settings_write permission. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_settings_write summary: Create subject type tags: - Experiments x-permission: operator: AND permissions: - product_analytics_settings_write /api/v2/experiments/subject-types/{subject_type_id}: delete: description: >- Delete a subject type. The record is soft-deleted and stops appearing in reads. The call is idempotent: deleting the same subject type again also returns 204. The organization's default subject type cannot be deleted; make another one the default first. A subject type that experiments, exposure SQL models, metric SQL models or protocols still reference cannot be deleted either; the refusal names the blockers. operationId: DeleteSubjectType parameters: - description: "The UUID of the subject type." in: path name: subject_type_id required: true schema: description: "The UUID of the subject type." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "204": description: The subject type was deleted. "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed subject type ID (not a valid UUID). "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_settings_write permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No subject type with this ID exists for the organization. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Either this subject type is the organization's default, or experiments, exposure SQL models, metric SQL models or protocols still reference it. When something references it, meta.blockers names them (capped per kind, with truncated set when more exist). "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_settings_write summary: Delete subject type tags: - Experiments x-permission: operator: AND permissions: - product_analytics_settings_write get: description: Get a subject type. Returns a single subject type by its ID for the organization. operationId: GetSubjectType parameters: - description: >- Set to `counts` to add experiment_count, exposure_source_count, metric_sql_model_count and protocol_count. in: query name: include schema: description: |- Set to `counts` to add experiment_count, exposure_source_count, metric_sql_model_count and protocol_count. type: string - description: "The UUID of the subject type." in: path name: subject_type_id required: true schema: description: "The UUID of the subject type." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T12:00:00Z" is_default: true name: User product_analytics_attribute: "@usr.id" updated_at: "2024-01-01T12:00:00Z" warehouse_column_names: - user_id - customer_id id: 550e8400-e29b-41d4-a716-446655440010 type: subject-types schema: $ref: "#/components/schemas/ExperimentsSubjectTypeV2DTO" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed subject type ID (not a valid UUID), or an unsupported include value. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_settings_read permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No subject type with this ID exists for the organization. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_settings_read summary: Get subject type tags: - Experiments x-permission: operator: AND permissions: - product_analytics_settings_read patch: description: >- Update mutable fields on a subject type. Only the fields present in the body are changed. Any subject type can be updated, including the organization's default one, but the is_default flag itself is read-only here: which subject type is the default cannot be changed through this endpoint. operationId: PatchSubjectType parameters: - description: "The UUID of the subject type." in: path name: subject_type_id required: true schema: description: "The UUID of the subject type." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: name: Updated User product_analytics_attribute: "@usr.id" warehouse_column_names: - user_id type: subject-types schema: $ref: "#/components/schemas/ExperimentsPatchSubjectTypeV2Request" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T12:00:00Z" is_default: true name: User product_analytics_attribute: "@usr.id" updated_at: "2024-01-01T12:00:00Z" warehouse_column_names: - user_id - customer_id id: 550e8400-e29b-41d4-a716-446655440010 type: subject-types schema: $ref: "#/components/schemas/ExperimentsSubjectTypeV2DTO" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed subject type ID, malformed body, or no updatable field supplied. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_settings_write permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No subject type with this ID exists for the organization. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_settings_write summary: Patch subject type tags: - Experiments x-permission: operator: AND permissions: - product_analytics_settings_write /api/v2/experiments/subject-types/{subject_type_id}/default: post: description: >- Make this subject type the organization's default. Experiment creation uses the default when the request names no subject type. Promoting one subject type demotes the previous default in the same transaction, so the organization always has exactly one. The call is idempotent: promoting the current default succeeds and changes nothing. There is no matching demote, because an organization cannot have no default; promote a different subject type instead. operationId: SetDefaultSubjectType parameters: - description: "The UUID of the subject type." in: path name: subject_type_id required: true schema: description: "The UUID of the subject type." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "204": description: The subject type is now the organization's default. "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed subject type ID (not a valid UUID). "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_settings_write permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No subject type with this ID exists for the organization. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_settings_write summary: Set default subject type tags: - Experiments x-permission: operator: AND permissions: - product_analytics_settings_write /api/v2/experiments/{experiment_id}: delete: description: >- Delete an experiment and its linked feature flag allocations in one database transaction. After deletion, the experiment is no longer returned by the API. If the transaction fails, neither the experiment nor its allocations are deleted. Deleting an experiment cannot be undone. operationId: DeleteExperiment parameters: - description: "The UUID of the experiment." in: path name: experiment_id required: true schema: description: "The UUID of the experiment." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "204": description: The experiment was deleted. "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed experiment ID (not a valid UUID). "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Missing or invalid authentication (dd-api-key + dd-application-key headers, or a valid user session). "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Authenticated caller lacks the product_analytics_experiments_write permission, lacks permission to edit this experiment, or lacks contribute permission on a feature flag owning one of its allocations. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No experiment with this ID exists for the organization. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- The experiment has a published allocation on an archived flag, must be retained for selective holdout analysis, or its linked allocations changed during authorization. Nothing was deleted. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_write summary: Delete experiment tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_write get: description: >- Get a complete experiment by ID. The response includes structured metadata, related links, and, when a complete setup exists, decision metrics, variants, `warehouse_exposure_configuration`, `datadog_flag_configuration`, STATIC or STEPS traffic exposure, and assignment and event dates. STEPS describes the configured plan rather than wall-clock history; Datadog step durations exclude pauses. The list endpoint omits these setup details. operationId: GetExperiment parameters: - description: "The UUID of the experiment." in: path name: experiment_id required: true schema: description: "The UUID of the experiment." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: assignments_end_date: "2026-08-15T00:00:00Z" assignments_start_date: "2026-08-01T00:00:00Z" concluded_at: "2026-08-05T09:30:00Z" conclusion: decision_reason: The primary metric improved without material regressions outcome: POSITIVE summary: The treatment improved conversion created_at: "2026-08-01T12:00:00Z" datadog_flag_configuration: decision_metrics: - is_primary: true metric_id: b1a2c3d4-0000-0000-0000-000000000000 decision_variant_key: treatment events_end_date: "2026-08-22T00:00:00Z" events_start_date: "2026-08-01T00:00:00Z" experiment_type: STANDARD hypothesis: A clearer checkout button increases purchase conversion name: Checkout button test pipeline_table_suffix: a1b2c3d4 protocol_id: e4d5f6a7-0000-0000-0000-000000000000 related_links: - id: d1d2d3d4-0000-0000-0000-000000000000 title: Experiment design url: https://docs.example.com/checkout-experiment results_last_updated: "2026-08-05T09:25:00Z" split_by_properties: [] status: DECISION_MADE structured_metadata: - enum_values: - beta field_display_name: Launch stage field_key: launch_stage field_type: ENUM - field_display_name: Notes field_key: notes field_type: FREETEXT freetext_value: Checkout redesign subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 summary: The treatment improved conversion tags: - growth teams: - growth traffic_exposure: fraction: 1 mode: STATIC updated_at: "2026-08-05T09:30:00Z" variants: - is_active: true is_control: true key: control name: Control weight: 50 - is_active: true is_control: false key: treatment name: Treatment weight: 50 warehouse_exposure_configuration: entry_point: experiment_key: checkout_button_test exposure_sql_model_id: f5e6a7b8-0000-0000-0000-000000000000 id: 550e8400-e29b-41d4-a716-446655440000 type: experiments schema: $ref: "#/components/schemas/ExperimentsExperimentV2DTO" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed experiment ID (not a valid UUID). "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Missing or invalid authentication (dd-api-key + dd-application-key headers, or a valid user session). "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Authenticated caller lacks the product_analytics_experiments_read permission, or lacks feature-flag and environment read permissions for a Datadog-backed configuration. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No experiment with this ID exists for the organization. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- The stored assignment configuration cannot be represented losslessly by this API (unsupported_configuration). "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_read summary: Get experiment tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_read patch: description: |- Update mutable experiment fields. State and protocol restrictions apply. **PATCH behavior** - Omitted fields stay unchanged, including fields inside `datadog_flag_configuration`. - Supplied `tags`, `teams`, `related_links`, `decision_metrics`, and `variants` replace their stored lists. - Validation can return several field errors before saving any changes. The response is HTTP 400 if any error concerns invalid input. It is HTTP 409 if all errors concern state or protocol conflicts. **Result refreshes** This endpoint does not start a pipeline run. `meta.needs_pipeline_refresh` states whether the edit requires a run. When true, POST to `meta.refresh_endpoint` after finishing your edits. Its `full_refresh` query parameter selects the run type. Keep refresh requirements across edits. A later false value does not clear an earlier requirement. Any `full_refresh=true` requirement takes priority. After start, STATIC and STEPS exposure changes for warehouse experiments without a Datadog flag attempt to recalculate stored results. Changes to decision metrics or the control variant also attempt recalculation when results exist. If stored data is insufficient or recalculation fails, the edit stays saved and `meta.needs_pipeline_refresh` is true. **Exposure rules** - Draft experiments can replace the full STATIC or STEPS plan through `traffic_exposure`. - Warehouse steps start at `assignments_start_date` and can have different durations. - Running warehouse experiments can replace step fractions, durations, and exposure mode. Retained variant weights cannot change through this API. You can send unchanged values again. - After a warehouse experiment ends, configuration replacement supports only STATIC fraction changes. - New Datadog plans have at most five steps. The first fraction must be positive. All steps except the last have equal durations. Durations exclude pauses. - The last step has a null duration. Its fraction stays in effect until assignment ends. - After start, use the experiment UI to change traffic exposure for experiments linked to a Datadog flag. **Metadata** `structured_metadata` updates fields by `field_key`. Use `freetext_value: ""` or `enum_values: []` to clear an optional field. Omitted fields stay unchanged. A null or empty `structured_metadata` attribute makes no change. **Flag changes** Before start, a Datadog update creates or edits the saved draft allocation. To add or replace a flag, send `variants` and `traffic_exposure`. Inside `datadog_flag_configuration`, send `feature_flag_id`, `environment_id`, `targeting_rules`, and `entry_point`. Use `targeting_rules: []` and `entry_point: null` when unused. To replace a flag, also set `reset_on_feature_flag_change: true` inside that object. The server deletes the old draft and creates a new one in the same transaction. The response includes a `datadog_flag_configuration_reset` warning in `meta.warnings`. Set `datadog_flag_configuration: null` to delete the draft allocation. This also clears the experiment's flag association, variants, assignment sources, and entry point. The experiment remains. Flag replacement and removal require a draft experiment without warehouse exposure. These actions do not convert hybrid experiments. operationId: PatchExperiment parameters: - description: "The UUID of the experiment." in: path name: experiment_id required: true schema: description: "The UUID of the experiment." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: datadog_flag_configuration: entry_point: environment_id: 550e8400-e29b-41d4-a716-446655440005 feature_flag_id: 550e8400-e29b-41d4-a716-446655440014 reset_on_feature_flag_change: true targeting_rules: [] structured_metadata: - enum_values: - general_availability field_key: launch_stage traffic_exposure: fraction: 1 mode: STATIC variants: - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440020 is_active: true is_control: true key: control weight: 50 - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440021 is_active: true is_control: false key: treatment weight: 50 type: experiments schema: $ref: "#/components/schemas/ExperimentsPatchExperimentV2Request" required: true responses: "200": content: application/json: examples: default: value: data: attributes: assignments_end_date: "2026-08-15T00:00:00Z" assignments_start_date: "2026-08-01T00:00:00Z" concluded_at: created_at: "2026-07-31T12:00:00Z" datadog_flag_configuration: allocation_key: 550e8400-e29b-41d4-a716-446655440031 entry_point: environment_id: 550e8400-e29b-41d4-a716-446655440005 feature_flag_id: 550e8400-e29b-41d4-a716-446655440014 targeting_rules: [] decision_metrics: - is_primary: true metric_id: b1a2c3d4-0000-0000-0000-000000000000 events_end_date: "2026-08-22T00:00:00Z" events_start_date: "2026-08-01T00:00:00Z" experiment_type: STANDARD name: Checkout button test pipeline_table_suffix: a1b2c3d4 related_links: [] results_last_updated: split_by_properties: [] status: DRAFT structured_metadata: - enum_values: - general_availability field_display_name: Launch stage field_key: launch_stage field_type: ENUM - field_display_name: Notes field_key: notes field_type: FREETEXT freetext_value: Checkout redesign subject_type_id: c2b3d4e5-0000-0000-0000-000000000000 tags: [] teams: [] traffic_exposure: fraction: 1 mode: STATIC updated_at: "2026-07-31T13:00:00Z" variants: - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440020 is_active: true is_control: true key: control name: Control weight: 50 - feature_flag_variant_id: 550e8400-e29b-41d4-a716-446655440021 is_active: true is_control: false key: treatment name: Treatment weight: 50 warehouse_exposure_configuration: id: 550e8400-e29b-41d4-a716-446655440000 type: experiments meta: needs_pipeline_refresh: false warnings: - code: datadog_flag_configuration_reset detail: >- Changing feature_flag_id created a new draft allocation with the supplied randomization settings. schema: $ref: "#/components/schemas/ExperimentsPatchExperimentV2Response" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Invalid request: malformed field, a read-only attribute was sent, a referenced ID doesn't exist, an allocation change is not supported after start, or the resulting analysis configuration is invalid. May return multiple errors. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Missing or invalid authentication (dd-api-key + dd-application-key headers, or a valid user session). "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Authenticated caller lacks the product_analytics_experiments_write permission, lacks permission to edit this experiment, or lacks feature-flag and environment read permissions for a Datadog-backed configuration. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No experiment with this ID exists for the organization. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- The requested configuration is incompatible with the experiment, or a feature flag change requires explicit reset consent and a complete target configuration (codes: unsupported_configuration, feature_flag_change_requires_reset, or feature_flag_change_requires_complete_configuration). "415": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Request body sent with a media type other than application/json or application/vnd.api+json. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_write summary: Patch experiment tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_write /api/v2/experiments/{experiment_id}/analysis-plan: get: description: >- Get the effective public statistical analysis settings for an experiment. has_custom_analysis_settings compares only settings the caller can edit; protocol-required differences from company defaults do not make the plan custom. operationId: GetExperimentAnalysisPlan parameters: - description: "The UUID of the experiment." in: path name: experiment_id required: true schema: description: "The UUID of the experiment." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: bayesian_prior: degrees_of_freedom: standard_deviation: 0.05 confidence_interval_method: Bayesian confidence_level: 0.95 cuped_lookback_period_days: 30 experiment_auto_end_days: 0 experiment_min_duration: 0 experiment_min_sample_size: 0 has_custom_analysis_settings: false is_cuped_enabled: true is_multiple_testing_correction_enabled: false preferential_bonferroni_primary_metric_weight: 0.5 target_duration_days: 14 id: 550e8400-e29b-41d4-a716-446655440000 type: analysis-plans schema: $ref: "#/components/schemas/ExperimentsAnalysisPlanV2DTO" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed experiment ID. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_read summary: Get experiment analysis plan tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_read patch: description: >- Update selected statistical analysis settings. Omitted attributes remain unchanged and nullable attributes can be cleared with null. Protocol-locked settings cannot be changed. operationId: UpdateExperimentAnalysisPlanAttributes parameters: - description: "The UUID of the experiment." in: path name: experiment_id required: true schema: description: "The UUID of the experiment." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: bayesian_prior: degrees_of_freedom: standard_deviation: 0.05 confidence_interval_method: Bayesian confidence_level: 0.95 cuped_lookback_period_days: 30 experiment_auto_end_days: 0 experiment_min_duration: 0 experiment_min_sample_size: 0 is_cuped_enabled: true is_multiple_testing_correction_enabled: false preferential_bonferroni_primary_metric_weight: 0.5 target_duration_days: 14 id: 550e8400-e29b-41d4-a716-446655440000 type: analysis-plans schema: $ref: "#/components/schemas/ExperimentsAnalysisPlanWriteV2Request" required: true responses: "200": content: application/json: examples: default: value: data: attributes: bayesian_prior: degrees_of_freedom: standard_deviation: 0.05 confidence_interval_method: Bayesian confidence_level: 0.95 cuped_lookback_period_days: 30 experiment_auto_end_days: 0 experiment_min_duration: 0 experiment_min_sample_size: 0 has_custom_analysis_settings: true is_cuped_enabled: true is_multiple_testing_correction_enabled: false preferential_bonferroni_primary_metric_weight: 0.5 target_duration_days: 14 id: 550e8400-e29b-41d4-a716-446655440000 type: analysis-plans meta: needs_pipeline_refresh: false schema: $ref: "#/components/schemas/ExperimentsAnalysisPlanV2MutationResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The requested change conflicts with settings locked by the experiment protocol. "415": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Request body sent with a media type other than application/json or application/vnd.api+json. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_write summary: Update experiment analysis plan attributes tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_write /api/v2/experiments/{experiment_id}/cancel: post: description: |- Cancel an experiment, ending it without a winning variant. The experiment moves to CANCELLED status, the supplied reason is recorded in its conclusion as the decision reason, and the experiment is unlinked from the feature flag allocations that exposed it, which stops its exposure. An experiment that has already completed its rollout, had its code removed, or been canceled cannot be canceled again. Canceling is not reversible: an experiment cannot be returned to a running state afterward. It is also not idempotent: canceling an already-canceled experiment returns 409, so a retry after a timeout cannot be distinguished from a cancellation made by someone else. operationId: CancelExperiment parameters: - description: "The UUID of the experiment." in: path name: experiment_id required: true schema: description: "The UUID of the experiment." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: reason: Experiment configuration was incorrect type: cancel-experiment-request schema: $ref: "#/components/schemas/ExperimentsCancelExperimentV2Request" required: true responses: "204": description: "The experiment was canceled and unlinked from its feature flag allocations." "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed experiment ID, malformed request body, or a missing/blank reason. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Missing or invalid authentication (dd-api-key + dd-application-key headers, or a valid user session). "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Authenticated caller lacks the product_analytics_experiments_write permission, lacks permission to edit this experiment, or lacks contribute permission on the feature flag owning its allocation. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No experiment with this ID exists for the organization. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The experiment cannot be canceled in its current state. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_write summary: Cancel experiment tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_write /api/v2/experiments/{experiment_id}/conclude: post: description: >- Conclude an experiment on a winning variant. The experiment moves to DECISION_MADE status, the outcome is recorded in its conclusion, and for a flag-backed experiment the winning variant is rolled out to 100% of the linked feature flag allocation. `decision_variant_key` must match a variant in the experiment. Only an experiment that is currently running or ready for a decision can be concluded. Concluding is not reversible and is not idempotent: concluding an already-concluded experiment returns 409. operationId: ConcludeExperiment parameters: - description: "The UUID of the experiment." in: path name: experiment_id required: true schema: description: "The UUID of the experiment." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: decision_variant_key: treatment type: conclude-experiment-request schema: $ref: "#/components/schemas/ExperimentsConcludeExperimentV2Request" required: true responses: "204": description: >- The experiment was concluded and the winning variant was rolled out to its linked feature flag allocation. "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed experiment ID, malformed request body, or a missing decision_variant_key. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Missing or invalid authentication (dd-api-key + dd-application-key headers, or a valid user session). "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Authenticated caller lacks the product_analytics_experiments_write permission, lacks permission to edit this experiment, or lacks contribute permission on the feature flag owning its allocation. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No experiment with this ID exists for the organization. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- The experiment is not running or ready for a decision, its linked feature flag environment requires an approval for the rollout this would perform, or that flag has a pending suggestion for its allocations. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_write summary: Conclude experiment tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_write /api/v2/experiments/{experiment_id}/diagnostics: get: description: >- Get the diagnostics produced by an experiment's latest analysis run. Each diagnostic includes its category, and the response includes an overall diagnostic or pipeline lifecycle status. operationId: GetExperimentDiagnostics parameters: - description: "The UUID of the experiment." in: path name: experiment_id required: true schema: description: "The UUID of the experiment." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: diagnostics: [] evaluated_at: "2026-08-05T09:25:00Z" result: NO_DATA state: COMPLETED id: 550e8400-e29b-41d4-a716-446655440000 type: experiment-diagnostics schema: $ref: "#/components/schemas/ExperimentsExperimentDiagnosticsV2DTO" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed experiment ID (not a valid UUID). "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_experiments_read permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- No experiment with this ID exists for the organization. Lifecycle statuses in a successful response explain whether analysis has started, is running, or completed without diagnostics. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_read summary: Get experiment diagnostics tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_read /api/v2/experiments/{experiment_id}/metric-groups: get: description: >- List every decision and non-decision metric group attached to an experiment. Metric references are returned in their stored order. An incomplete draft can have no decision group and returns only the groups that exist. operationId: ListExperimentMetricGroups parameters: - description: "The UUID of the experiment." in: path name: experiment_id required: true schema: description: "The UUID of the experiment." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "200": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/ExperimentsExperimentMetricGroupV2DTOArray" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed experiment ID. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The caller lacks the experiments read permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No experiment with this ID exists for the organization. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_read summary: List experiment metric groups tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_read post: description: >- Create a non-decision metric group. The optional metrics array is ordered. Decision groups remain managed through decision_metrics on the experiment resource. This operation does not synchronously recompute results. operationId: CreateExperimentMetricGroup parameters: - description: "The UUID of the experiment." in: path name: experiment_id required: true schema: description: "The UUID of the experiment." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: metrics: - metric_id: 550e8400-e29b-41d4-a716-446655440021 name: Diagnostics type: experiment-metric-groups schema: $ref: "#/components/schemas/ExperimentsCreateExperimentMetricGroupV2Request" required: true responses: "201": content: application/json: examples: default: value: data: attributes: is_decision: false metrics: - is_primary: false metric_id: 550e8400-e29b-41d4-a716-446655440021 metric_name: Checkout conversion name: Diagnostics id: 550e8400-e29b-41d4-a716-446655440022 type: experiment-metric-groups meta: needs_pipeline_refresh: false schema: $ref: "#/components/schemas/ExperimentsExperimentMetricGroupMutationV2" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "415": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Request body sent with a media type other than application/json or application/vnd.api+json. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_write summary: Create experiment metric group tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_write /api/v2/experiments/{experiment_id}/metric-groups/from-collection/{metric_collection_id}: post: description: >- Copy a metric collection into a new non-decision metric group. The group is a request-time snapshot: later changes to the collection do not affect the experiment. Metric order is preserved. The operation is not idempotent, and incompatible or empty collections are rejected without creating a group. operationId: CreateExperimentMetricGroupFromCollection parameters: - description: "The UUID of the experiment." in: path name: experiment_id required: true schema: description: "The UUID of the experiment." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string - description: "The UUID of the metric collection." in: path name: metric_collection_id required: true schema: description: "The UUID of the metric collection." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "201": content: application/json: examples: default: value: data: attributes: is_decision: false metrics: - is_primary: false metric_id: 550e8400-e29b-41d4-a716-446655440020 metric_name: Checkout conversion name: Checkout metrics id: 550e8400-e29b-41d4-a716-446655440022 type: experiment-metric-groups meta: needs_pipeline_refresh: false schema: $ref: "#/components/schemas/ExperimentsExperimentMetricGroupMutationV2" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_write summary: Create experiment metric group from collection tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_write /api/v2/experiments/{experiment_id}/metric-groups/{metric_group_id}: delete: description: >- Delete a non-decision metric group and its memberships. Decision groups remain managed through the experiment resource. This operation does not start a pipeline. Read experiment results after deletion to check stale metadata, then explicitly refresh results when required. operationId: DeleteExperimentMetricGroup parameters: - description: "The UUID of the experiment." in: path name: experiment_id required: true schema: description: "The UUID of the experiment." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string - description: "The UUID of the metric group." in: path name: metric_group_id required: true schema: description: "The UUID of the metric group." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_write summary: Delete experiment metric group tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_write patch: description: >- Update a non-decision metric group. Omitted attributes are unchanged; a supplied metrics array is the complete ordered replacement. Decision groups remain managed through the experiment resource. This operation does not synchronously recompute results. operationId: UpdateExperimentMetricGroup parameters: - description: "The UUID of the experiment." in: path name: experiment_id required: true schema: description: "The UUID of the experiment." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string - description: "The UUID of the metric group." in: path name: metric_group_id required: true schema: description: "The UUID of the metric group." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: metrics: - metric_id: 550e8400-e29b-41d4-a716-446655440021 name: Reliability id: 550e8400-e29b-41d4-a716-446655440022 type: experiment-metric-groups schema: $ref: "#/components/schemas/ExperimentsPatchExperimentMetricGroupV2Request" required: true responses: "200": content: application/json: examples: default: value: data: attributes: is_decision: false metrics: - is_primary: false metric_id: 550e8400-e29b-41d4-a716-446655440021 metric_name: Checkout conversion name: Reliability id: 550e8400-e29b-41d4-a716-446655440022 type: experiment-metric-groups meta: needs_pipeline_refresh: false schema: $ref: "#/components/schemas/ExperimentsExperimentMetricGroupMutationV2" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "415": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Request body sent with a media type other than application/json or application/vnd.api+json. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_write summary: Update experiment metric group tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_write /api/v2/experiments/{experiment_id}/results: get: description: >- Get an experiment's computed results: per-variant statistical analysis for the latest successful run. A historical run cannot be selected. Unavailable analysis statistics, including `p_value` and `confidence_interval`, are omitted. The `numerator`, `denominator`, and `variant_metric_value` fields can be null when their values are unavailable. Do not treat an omitted or null value as zero. operationId: GetExperimentResults parameters: - description: "The UUID of the experiment." in: path name: experiment_id required: true schema: description: "The UUID of the experiment." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "200": content: application/json: examples: default: description: >- Selected fields from an illustrative response. Additional analyses, including control analyses, are omitted here. Conversion is 10% for control and 11% for treatment. The displayed fixed-sample absolute estimate of 0.01 means one percentage point. CUPED is not applied. Statistical values are rounded. summary: Selected conversion result fields value: data: - attributes: assignment_count: 10000 experiment_id: 550e8400-e29b-41d4-a716-446655440000 is_control: true metrics: - assignment_count: 10000 denominator: 10000 desired_change: METRIC_INCREASES metric_id: 550e8400-e29b-41d4-a716-446655440002 metric_name: Checkout conversion numerator: 1000 variant_key: control variant_name: Control id: 550e8400-e29b-41d4-a716-446655440000:control type: experiment-variant-results - attributes: assignment_count: 10000 experiment_id: 550e8400-e29b-41d4-a716-446655440000 is_control: false metrics: - analyses: - confidence_interval: lower: 0.0015 upper: 0.0185 confidence_level: 0.95 is_cuped_adjusted: false is_unreliable: false lift_type: ABSOLUTE method: FIXED_SAMPLE p_value: 0.021 point_estimate: 0.01 standard_error: 0.004335 variant_metric_value: 0.11 z_score: 2.307 assignment_count: 10000 denominator: 10000 desired_change: METRIC_INCREASES metric_id: 550e8400-e29b-41d4-a716-446655440002 metric_name: Checkout conversion numerator: 1100 variant_key: treatment variant_name: Treatment id: 550e8400-e29b-41d4-a716-446655440000:treatment type: experiment-variant-results meta: is_stale: false results_last_updated: "2026-08-15T12:00:00Z" stale_reasons: [] simple_metric: description: >- Selected fields from an illustrative response for orders per assigned user. Additional analyses, including control analyses, are omitted here. This simple metric has no denominator aggregation, so denominator is null. With 10000 assigned users per variant, the totals of 20000 and 22000 orders give means of 2 and 2.2. The displayed absolute estimate is 0.2 orders per user. The interval uses the illustrative standard error of 0.02. summary: Selected simple metric result fields value: data: - attributes: assignment_count: 10000 experiment_id: 550e8400-e29b-41d4-a716-446655440000 is_control: true metrics: - assignment_count: 10000 denominator: desired_change: METRIC_INCREASES metric_id: 550e8400-e29b-41d4-a716-446655440003 metric_name: Orders per assigned user numerator: 20000 variant_key: control variant_name: Control id: 550e8400-e29b-41d4-a716-446655440000:control type: experiment-variant-results - attributes: assignment_count: 10000 experiment_id: 550e8400-e29b-41d4-a716-446655440000 is_control: false metrics: - analyses: - confidence_interval: lower: 0.1608 upper: 0.2392 confidence_level: 0.95 is_cuped_adjusted: false is_unreliable: false lift_type: ABSOLUTE method: FIXED_SAMPLE point_estimate: 0.2 standard_error: 0.02 variant_metric_value: 2.2 z_score: 10.0 assignment_count: 10000 denominator: desired_change: METRIC_INCREASES metric_id: 550e8400-e29b-41d4-a716-446655440003 metric_name: Orders per assigned user numerator: 22000 variant_key: treatment variant_name: Treatment id: 550e8400-e29b-41d4-a716-446655440000:treatment type: experiment-variant-results meta: is_stale: false results_last_updated: "2026-08-15T12:00:00Z" stale_reasons: [] schema: $ref: "#/components/schemas/ExperimentsVariantResultsV2DTOArray" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed experiment ID (not a valid UUID), or the experiment is not configured for analysis. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_experiments_read permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No experiment with this ID exists, or results are not available for it yet. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The experiment's metrics are incompatible with analysis. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_read summary: Get experiment results tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_read /api/v2/experiments/{experiment_id}/results/refresh: post: description: >- Request a results refresh for one experiment. HTTP 202 confirms acceptance, not completed results. The response identifies the experiment and does not include a job ID. Read experiment results to check freshness. A request while a refresh is queued or running returns 409. After completion, another request can start another refresh. operationId: RefreshExperimentResults parameters: - description: "The UUID of the experiment." in: path name: experiment_id required: true schema: description: "The UUID of the experiment." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string - description: Force a full warehouse rebuild. Defaults to false when omitted. in: query name: full_refresh schema: description: "Force a full warehouse rebuild. Defaults to false when omitted." type: boolean responses: "202": content: application/json: examples: default: value: data: attributes: success: true id: 550e8400-e29b-41d4-a716-446655440000 type: experiment-results-refresh schema: $ref: "#/components/schemas/ExperimentsRefreshExperimentResultsV2DTO" description: Accepted "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed experiment ID (not a valid UUID), or full_refresh is not a valid boolean. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Authenticated caller lacks the product_analytics_experiments_write permission, or lacks edit permission on this experiment. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No experiment with this ID exists for the organization. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: A refresh is already queued or running for this experiment. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_write summary: Refresh experiment results tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_write /api/v2/experiments/{experiment_id}/start: post: description: >- Start an experiment. The experiment is started exactly as it is configured; this endpoint accepts no attributes, and a request body carrying any is rejected rather than ignored. Set the run window, duration, or variants with PATCH /api/v2/experiments/{experiment_id} before starting. An unconfigured draft returns HTTP 409. Configure either warehouse_exposure_configuration or datadog_flag_configuration, plus the required experiment fields, before starting. Start validation errors can include meta.configuration_pointer to identify a field on the experiment to correct. For a flag-backed experiment this enables the linked feature flag's environment, clears any stored variant override on it, and starts the allocation's rollout. The request is idempotent: an experiment that is already running or ready for a decision still returns 204, so a retry after a timeout is safe. One exception: an experiment scheduled to start is accepted only when it is backed by your own feature flag; a Datadog-flag experiment in that state returns 409 because its stored state and flag allocation disagree. Cancel and conclude are not idempotent and return 409 when repeated. operationId: StartExperiment parameters: - description: "The UUID of the experiment." in: path name: experiment_id required: true schema: description: "The UUID of the experiment." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string requestBody: content: application/json: examples: default: value: data: type: start-experiment-request schema: $ref: "#/components/schemas/ExperimentsStartExperimentV2Request" required: false responses: "204": description: The experiment was started. "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Malformed experiment ID, a request body carrying attributes this endpoint does not accept, or an experiment managed by a specialized workflow that cannot use this start endpoint. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Missing or invalid authentication (dd-api-key + dd-application-key headers, or a valid user session). "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Authenticated caller lacks the product_analytics_experiments_write permission, lacks permission to edit this experiment, or lacks contribute permission on the feature flag owning its allocation. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No experiment with this ID exists for the organization. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- The experiment cannot be started from its current state, its stored setup is incomplete (missing subject type, primary metric, variants, assignment source, or run window), its linked feature flag environment requires an approval, or that flag has a pending suggestion for a property this would change (environment status, override variant, rollout, or allocations). "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_write summary: Start experiment tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_write /api/v2/experiments/{experiment_id}/traffic-summary: get: description: >- Get an experiment's traffic summary: per-variant exposure counts and a sample-ratio-mismatch flag (is_traffic_imbalanced). SRM statistics live on the diagnostics endpoint. operationId: GetExperimentTrafficSummary parameters: - description: "The UUID of the experiment." in: path name: experiment_id required: true schema: description: "The UUID of the experiment." example: 550e8400-e29b-41d4-a716-446655440000 format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: is_traffic_imbalanced: false total_subjects: 300 variants: - exposure_count: 150 variant_key: control variant_name: control - exposure_count: 150 variant_key: treatment variant_name: treatment id: traffic-summary-1785542400000-1785628800000 type: traffic-summary schema: $ref: "#/components/schemas/ExperimentsTrafficSummaryV2DTO" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Malformed experiment ID (not a valid UUID), or the experiment is not configured for analysis. "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Missing or invalid authentication. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authenticated caller lacks the product_analytics_experiments_read permission. "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: No experiment with this ID exists for the organization. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The experiment's metrics are incompatible with analysis. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - product_analytics_experiments_read summary: Get experiment traffic summary tags: - Experiments x-permission: operator: AND permissions: - product_analytics_experiments_read /api/v2/feature-flags: get: description: |- Returns a paginated list of feature flags for the organization. Supports filtering by key, tags, teams, SDK availability, production status, and other flag properties. Use `page[limit]` and `page[offset]` to paginate, or follow the `next` link in the response. operationId: ListFeatureFlags parameters: - description: Filter feature flags by an exact, case-sensitive key. Use `search` for partial matching. example: example-feature-flag in: query name: key schema: type: string - description: Filter by archived status. If `true`, return only archived flags. If `false`, return only flags that are not archived. If omitted, return both. example: false in: query name: is_archived schema: type: boolean - description: Deprecated alias for `page[limit]`. Use `page[limit]` for new requests. Used only when `page[limit]` is absent. When both parameters are omitted, the server defaults to `25`. Values that exceed `50` are set to `50`; non-positive or empty values use the server default. example: 10 in: query name: limit schema: default: 100 format: int64 maximum: 1000 minimum: 1 type: integer - description: Deprecated alias for `page[offset]`. Used only when `page[offset]` is absent. Defaults to `0`. Negative or empty values are set to `0`. example: 0 in: query name: offset schema: default: 0 format: int64 minimum: 0 type: integer - description: Filter by exact tag values using repeated parameters, such as `tags=env:prod&tags=purpose:sitemap`. A flag must have all ordinary tags. Values of the form `team:` match any selected team and are combined with `teams` into one set. The result must match all ordinary tags, any selected team, and all other filters. Empty values are ignored. example: - env:prod - purpose:sitemap explode: true in: query name: tags schema: items: type: string type: array style: form - description: Filter by team handles without the `team:` prefix. Use repeated parameters to filter by multiple team handles, such as `teams=checkout&teams=payments`. A flag must belong to at least one selected team. Team handles from `teams` and `team:` values from tags are treated as a single set and combined with ordinary tags and other filters using AND logic. Duplicate handles do not duplicate results. Unknown handles do not match any flags. Empty handles, surrounding white space, or using the `team:` prefix return a bad request error. Response tags are unchanged. example: - checkout - payments explode: true in: query name: teams schema: items: type: string type: array style: form - description: Filter by status across production environments. Use repeated parameters to match any selected status. `ENABLED` matches at least one enabled production environment without a variant override. `OVERRIDDEN` matches at least one enabled production environment with a variant override. `DISABLED` matches flags whose associated production environments are all disabled. A flag can match both `ENABLED` and `OVERRIDDEN` in different environments. Flags without associated production environments do not match. This does not filter by a specific environment. Unknown values do not match any status. example: - ENABLED - OVERRIDDEN explode: true in: query name: production_status schema: items: $ref: "#/components/schemas/FeatureFlagProductionStatus" type: array style: form - description: Filter by SDK availability. `CLIENT` returns flags with channel `CLIENT` or `ALL`. `SERVER` returns flags with channel `SERVER` or `ALL`. `ALL`, an empty value, or omission applies no channel restriction; it does not select only flags whose channel is `ALL`. Values are case-insensitive and surrounding white space is ignored. Invalid values return a bad request error. example: CLIENT in: query name: distribution_channel schema: $ref: "#/components/schemas/FeatureFlagDistributionChannel" - description: Case-insensitive substring search on flag names, keys, and tag names. Combined with all other filters. An empty value applies no search restriction. example: checkout in: query name: search schema: type: string - description: Filter by variant value types using repeated parameters. A flag must match at least one selected type. Empty values are ignored. Invalid types return a bad request error. example: - BOOLEAN - STRING explode: true in: query name: value_type schema: items: $ref: "#/components/schemas/ValueType" type: array style: form - description: Filter by creator UUIDs using repeated parameters. A flag must match at least one creator. Empty values are ignored. Invalid UUIDs return a bad request error. example: - 550e8400-e29b-41d4-a716-446655440010 explode: true in: query name: created_by schema: items: format: uuid type: string type: array style: form - description: Filter by feature flag UUIDs using repeated parameters. A flag must match at least one ID and all other filters. Duplicate IDs return each flag once. Unknown IDs and IDs from other organizations do not match any flags. Empty or invalid UUIDs return a bad request error. Pagination still applies. example: - 550e8400-e29b-41d4-a716-446655440000 explode: true in: query name: flag_ids schema: items: format: uuid type: string type: array style: form - description: "Filter by the computed staleness status: `ACTIVE`, `STALE`, or `PERMANENT`. Values are case-insensitive and surrounding white space is ignored. An empty value or omission applies no restriction. Invalid values return a bad request error. Read the computed result from `staleness_details.staleness_status`, not the legacy `staleness_status` response field." example: STALE in: query name: staleness_status schema: $ref: "#/components/schemas/FeatureFlagStalenessStatus" - description: Filter to flags that reference this saved filter in their targeting conditions. An empty value or omission applies no restriction. An invalid UUID returns a bad request error. example: 550e8400-e29b-41d4-a716-446655440020 in: query name: saved_filter_id schema: format: uuid type: string - description: Sort by `name`, `updated_at`, `created_at`, or `evaluations`. Use a comma-separated list for multiple sort fields and prefix a field with `-` for descending order. The default is `updated_at` descending. When favorites are enabled, the authenticated user's favorite flags take precedence over the selected ordering. Unknown fields return a bad request error. example: -updated_at in: query name: sort schema: type: string - description: Maximum number of flags to return. Defaults to `25` and is capped at `50`. Values that exceed `50` are set to `50`. Non-positive or empty values use the default. A non-integer value returns a bad request error. Takes precedence over `limit` when both are present. Pagination applies even when no pagination parameters are supplied. example: 25 in: query name: page[limit] schema: default: 25 format: int64 maximum: 50 minimum: 1 type: integer - description: Number of matching flags to skip before returning results. Defaults to `0`. Negative or empty values are set to `0`. A non-integer value returns a bad request error. Takes precedence over `offset` when both are present. example: 0 in: query name: page[offset] schema: default: 0 format: int64 minimum: 0 type: integer responses: "200": content: application/json: examples: default: value: data: [] links: first: https://api.datadoghq.com/api/v2/feature-flags?page%5Blimit%5D=25&page%5Boffset%5D=0 last: https://api.datadoghq.com/api/v2/feature-flags?page%5Blimit%5D=25&page%5Boffset%5D=0 self: https://api.datadoghq.com/api/v2/feature-flags?page%5Blimit%5D=25&page%5Boffset%5D=0 meta: page: first_offset: 0 last_offset: 0 limit: 25 next_offset: offset: 0 prev_offset: total: 0 type: offset_limit schema: $ref: "#/components/schemas/ListFeatureFlagsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_config_read - feature_flag_environment_config_read summary: List feature flags tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_config_read - feature_flag_environment_config_read post: description: |- Creates a new feature flag with variants. operationId: CreateFeatureFlag requestBody: content: application/json: examples: default: value: data: attributes: default_variant_key: variant-a description: A sample feature flag distribution_channel: ALL key: feature-flag-abc123 name: Feature Flag ABC 123 require_approval: false staleness_status: ACTIVE tags: - team:feature-flags-app value_type: BOOLEAN variants: - key: variant-a name: Variant A value: "true" - key: variant-b name: Variant B value: "false" type: feature-flags schema: $ref: "#/components/schemas/CreateFeatureFlagRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" description: A sample feature flag key: feature-flag-abc123 name: Feature Flag ABC 123 updated_at: "2024-01-01T00:00:00+00:00" value_type: BOOLEAN variants: - id: 00000000-0000-0000-0000-000000000002 key: variant-a name: Variant A value: "true" - id: 00000000-0000-0000-0000-000000000003 key: variant-b name: Variant B value: "false" id: 00000000-0000-0000-0000-000000000001 type: feature-flags schema: $ref: "#/components/schemas/FeatureFlagResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_config_write - feature_flag_environment_config_read summary: Create a feature flag tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_config_write - feature_flag_environment_config_read /api/v2/feature-flags/environments: get: description: |- Returns a list of environments for the organization. Supports filtering by name, key, and DD_ENV. operationId: ListFeatureFlagsEnvironments parameters: - description: Filter environments by name (partial matching). example: "env-search-term" in: query name: name schema: type: string - description: Filter environments by key (partial matching). example: "env-partial" in: query name: key schema: type: string - description: Filter environments by queries that contain the provided DD_ENV value. example: "staging" in: query name: dd_env schema: type: string - description: Maximum number of results to return. example: 10 in: query name: limit schema: default: 100 format: int64 maximum: 1000 minimum: 1 type: integer - description: Number of results to skip. example: 0 in: query name: offset schema: default: 0 format: int64 minimum: 0 type: integer responses: "200": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/ListEnvironmentsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_environment_config_read summary: List environments tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_environment_config_read post: description: |- Creates a new environment for organizing feature flags. operationId: CreateFeatureFlagsEnvironment requestBody: content: application/json: examples: default: value: data: attributes: name: staging-environment queries: - staging - canary type: environments schema: $ref: "#/components/schemas/CreateEnvironmentRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" is_production: false key: staging-environment name: staging-environment queries: - staging require_feature_flag_approval: false updated_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000017 type: environments schema: $ref: "#/components/schemas/EnvironmentResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_environment_config_write summary: Create an environment tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_environment_config_write /api/v2/feature-flags/environments/{environment_id}: delete: description: |- Deletes an environment. This operation cannot be undone. operationId: DeleteFeatureFlagsEnvironment parameters: - $ref: "#/components/parameters/environment_id" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_environment_config_write summary: Delete an environment tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_environment_config_write get: description: |- Returns the details of a specific environment. operationId: GetFeatureFlagsEnvironment parameters: - $ref: "#/components/parameters/environment_id" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" is_production: false key: staging-environment name: staging-environment queries: - staging require_feature_flag_approval: false updated_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000018 type: environments schema: $ref: "#/components/schemas/EnvironmentResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_environment_config_read summary: Get an environment tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_environment_config_read put: description: |- Updates an existing environment's metadata such as name and description. operationId: UpdateFeatureFlagsEnvironment parameters: - $ref: "#/components/parameters/environment_id" requestBody: content: application/json: examples: default: value: data: attributes: name: production-environment queries: - production - prod-us type: environments schema: $ref: "#/components/schemas/UpdateEnvironmentRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" is_production: false key: production-environment name: production-environment queries: - production require_feature_flag_approval: false updated_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000019 type: environments schema: $ref: "#/components/schemas/EnvironmentResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_environment_config_write summary: Update an environment tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_environment_config_write /api/v2/feature-flags/exposure-schedules/{exposure_schedule_id}/pause: post: description: |- Pauses a progressive rollout while preserving rollout state. operationId: PauseExposureSchedule parameters: - $ref: "#/components/parameters/exposure_schedule_id" responses: "200": content: application/json: examples: default: value: absolute_start_time: "2025-06-13T12:00:00Z" allocation_id: "550e8400-e29b-41d4-a716-446655440020" control_variant_id: "550e8400-e29b-41d4-a716-446655440012" created_at: "2024-01-01T12:00:00Z" guardrail_triggered_action: guardrail_triggers: [] id: "550e8400-e29b-41d4-a716-446655440010" rollout_options: autostart: false selection_interval_ms: 3600000 strategy: "UNIFORM_INTERVALS" rollout_steps: [] updated_at: "2024-01-01T12:00:00Z" schema: $ref: "#/components/schemas/AllocationExposureScheduleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_config_write summary: Pause a progressive rollout tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_config_write /api/v2/feature-flags/exposure-schedules/{exposure_schedule_id}/resume: post: description: |- Resumes progression for a previously paused progressive rollout. operationId: ResumeExposureSchedule parameters: - $ref: "#/components/parameters/exposure_schedule_id" responses: "200": content: application/json: examples: default: value: absolute_start_time: "2025-06-13T12:00:00Z" allocation_id: "550e8400-e29b-41d4-a716-446655440020" control_variant_id: "550e8400-e29b-41d4-a716-446655440012" created_at: "2024-01-01T12:00:00Z" guardrail_triggered_action: guardrail_triggers: [] id: "550e8400-e29b-41d4-a716-446655440010" rollout_options: autostart: false selection_interval_ms: 3600000 strategy: "UNIFORM_INTERVALS" rollout_steps: [] updated_at: "2024-01-01T12:00:00Z" schema: $ref: "#/components/schemas/AllocationExposureScheduleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_config_write summary: Resume a progressive rollout tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_config_write /api/v2/feature-flags/exposure-schedules/{exposure_schedule_id}/start: post: description: |- Starts a progressive rollout and begins progression. operationId: StartExposureSchedule parameters: - $ref: "#/components/parameters/exposure_schedule_id" responses: "200": content: application/json: examples: default: value: absolute_start_time: "2025-06-13T12:00:00Z" allocation_id: "550e8400-e29b-41d4-a716-446655440020" control_variant_id: "550e8400-e29b-41d4-a716-446655440012" created_at: "2024-01-01T12:00:00Z" guardrail_triggered_action: guardrail_triggers: [] id: "550e8400-e29b-41d4-a716-446655440010" rollout_options: autostart: false selection_interval_ms: 3600000 strategy: "UNIFORM_INTERVALS" rollout_steps: [] updated_at: "2024-01-01T12:00:00Z" schema: $ref: "#/components/schemas/AllocationExposureScheduleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_config_write summary: Start a progressive rollout tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_config_write /api/v2/feature-flags/exposure-schedules/{exposure_schedule_id}/stop: post: description: |- Stops a progressive rollout and marks it as aborted. operationId: StopExposureSchedule parameters: - $ref: "#/components/parameters/exposure_schedule_id" responses: "200": content: application/json: examples: default: value: absolute_start_time: "2025-06-13T12:00:00Z" allocation_id: "550e8400-e29b-41d4-a716-446655440020" control_variant_id: "550e8400-e29b-41d4-a716-446655440012" created_at: "2024-01-01T12:00:00Z" guardrail_triggered_action: guardrail_triggers: [] id: "550e8400-e29b-41d4-a716-446655440010" rollout_options: autostart: false selection_interval_ms: 3600000 strategy: "UNIFORM_INTERVALS" rollout_steps: [] updated_at: "2024-01-01T12:00:00Z" schema: $ref: "#/components/schemas/AllocationExposureScheduleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_config_write summary: Stop a progressive rollout tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_config_write /api/v2/feature-flags/saved-filters/{saved_filter_id}: get: description: |- Returns a saved filter by ID, including its full targeting rules, conditions, and values. Supports both saved lists and saved rules. Targeting rules are combined with OR, and conditions within each rule are combined with AND. Returns the stored filter definition rather than evaluating it against users or organizations. Archived filters can be retrieved. Filters that are deleted or belong to another organization return a not found error. operationId: GetSavedFilter parameters: - description: The ID of the saved filter. example: "550e8400-e29b-41d4-a716-446655440090" in: path name: saved_filter_id required: true schema: format: uuid type: string responses: "200": content: application/json: examples: default: summary: A saved rule matching an email address OR an organization ID value: data: attributes: created_at: "2026-01-01T12:00:00Z" created_by: "550e8400-e29b-41d4-a716-446655440091" creation_type: RULES description: Users selected by email address or organization ID. name: Early access users targeting_rules: - conditions: - attribute: email id: "550e8400-e29b-41d4-a716-446655440093" operator: ONE_OF value: ["user@example.com"] id: "550e8400-e29b-41d4-a716-446655440092" - conditions: - attribute: org_id id: "550e8400-e29b-41d4-a716-446655440095" operator: ONE_OF value: ["12345", "67890"] id: "550e8400-e29b-41d4-a716-446655440094" updated_at: "2026-01-02T12:00:00Z" id: "550e8400-e29b-41d4-a716-446655440090" type: saved-filters saved_list: summary: A saved list containing user IDs value: data: attributes: created_at: "2026-01-01T12:00:00Z" created_by: "550e8400-e29b-41d4-a716-446655440091" creation_type: LIST name: Early access user list targeting_rules: - conditions: - attribute: user_id id: "550e8400-e29b-41d4-a716-446655440098" operator: ONE_OF value: ["user-123", "user-456"] id: "550e8400-e29b-41d4-a716-446655440097" updated_at: "2026-01-02T12:00:00Z" id: "550e8400-e29b-41d4-a716-446655440096" type: saved-filters schema: $ref: "#/components/schemas/SavedFilterResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_config_read summary: Get a saved filter tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_config_read patch: description: |- Partially updates a saved filter. Supports both `LIST` and `RULES` filters. Supply at least one of `name`, `description`, or `targeting_rules`. Omitted or null fields are preserved. Supplying `targeting_rules` replaces the entire collection and propagates changes to every feature flag that references the saved filter. Metadata-only updates do not require edit permission or approval on those feature flags. Rule updates require edit permission on all consumer flags and are rejected when approval is required, unless the caller has the `feature_flag_approvals_override` permission. The optional `last_updated_at` field detects stale updates. It does not set the update time. operationId: UpdateSavedFilterAttributes parameters: - description: The ID of the saved filter. example: 550e8400-e29b-41d4-a716-446655440090 in: path name: saved_filter_id required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: summary: Rename a saved filter while preserving its description and rules value: data: attributes: name: Early access users type: saved-filters replace_rules: summary: Replace the complete rules collection value: data: attributes: targeting_rules: - conditions: - attribute: user_id operator: ONE_OF value: - test-user-1 - test-user-2 type: saved-filters schema: $ref: "#/components/schemas/PatchSavedFilterRequest" required: true responses: "200": content: application/json: examples: default: summary: A saved filter matching an email address or an organization ID value: data: attributes: created_at: "2026-01-01T12:00:00Z" created_by: 550e8400-e29b-41d4-a716-446655440091 creation_type: RULES description: Users selected by email address or organization ID. name: Early access users targeting_rules: - conditions: - attribute: email id: 550e8400-e29b-41d4-a716-446655440093 operator: ONE_OF value: - user@example.com id: 550e8400-e29b-41d4-a716-446655440092 - conditions: - attribute: org_id id: 550e8400-e29b-41d4-a716-446655440095 operator: ONE_OF value: - "12345" - "67890" id: 550e8400-e29b-41d4-a716-446655440094 updated_at: "2026-01-02T12:00:00Z" id: 550e8400-e29b-41d4-a716-446655440090 type: saved-filters schema: $ref: "#/components/schemas/SavedFilterResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/PatchSavedFilterForbiddenResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/PatchSavedFilterConflictResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_config_write summary: Patch a saved filter tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_config_write /api/v2/feature-flags/{feature_flag_id}: get: description: |- Returns the details of a specific feature flag including variants and environment status. operationId: GetFeatureFlag parameters: - $ref: "#/components/parameters/feature_flag_id" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" description: A sample feature flag key: feature-flag-abc123 name: Feature Flag ABC 123 updated_at: "2024-01-01T00:00:00+00:00" value_type: BOOLEAN variants: - id: 00000000-0000-0000-0000-000000000005 key: variant-a name: Variant A value: "true" - id: 00000000-0000-0000-0000-000000000006 key: variant-b name: Variant B value: "false" id: 00000000-0000-0000-0000-000000000004 type: feature-flags schema: $ref: "#/components/schemas/FeatureFlagResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_config_read - feature_flag_environment_config_read summary: Get a feature flag tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_config_read - feature_flag_environment_config_read put: description: |- Updates an existing feature flag's metadata such as name and description. Does not modify targeting rules or allocations. To change the owning team, update `tags` and include a tag of the form `team:` in the array. `tags` is a full replacement of the existing tag set (including any `team:` tag), so include every tag you want to keep, not just the ones you're adding. operationId: UpdateFeatureFlag parameters: - $ref: "#/components/parameters/feature_flag_id" requestBody: content: application/json: examples: default: value: data: attributes: description: Updated description for the feature flag enabled: true name: Updated Feature Flag XYZ789 tags: ["team:feature-flagging"] type: feature-flags schema: $ref: "#/components/schemas/UpdateFeatureFlagRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" description: A sample feature flag key: feature-flag-abc123 name: Feature Flag ABC 123 updated_at: "2024-01-01T00:00:00+00:00" value_type: BOOLEAN variants: - id: 00000000-0000-0000-0000-000000000008 key: variant-a name: Variant A value: "true" - id: 00000000-0000-0000-0000-000000000009 key: variant-b name: Variant B value: "false" id: 00000000-0000-0000-0000-000000000007 type: feature-flags schema: $ref: "#/components/schemas/FeatureFlagResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_config_write - feature_flag_environment_config_read summary: Update a feature flag tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_config_write - feature_flag_environment_config_read /api/v2/feature-flags/{feature_flag_id}/archive: post: description: |- Archives a feature flag. Archived flags are hidden from the main list but remain accessible and can be unarchived. operationId: ArchiveFeatureFlag parameters: - $ref: "#/components/parameters/feature_flag_id" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" description: A sample feature flag key: feature-flag-abc123 name: Feature Flag ABC 123 updated_at: "2024-01-01T00:00:00+00:00" value_type: BOOLEAN variants: - id: 00000000-0000-0000-0000-000000000011 key: variant-a name: Variant A value: "true" - id: 00000000-0000-0000-0000-000000000012 key: variant-b name: Variant B value: "false" id: 00000000-0000-0000-0000-000000000010 type: feature-flags schema: $ref: "#/components/schemas/FeatureFlagResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_config_write - feature_flag_environment_config_read summary: Archive a feature flag tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_config_write - feature_flag_environment_config_read /api/v2/feature-flags/{feature_flag_id}/environments/{environment_id}/allocations: post: description: |- Creates a new targeting rule (allocation) for a specific feature flag in a specific environment. operationId: CreateAllocationsForFeatureFlagInEnvironment parameters: - $ref: "#/components/parameters/feature_flag_id" - $ref: "#/components/parameters/environment_id" requestBody: content: application/json: examples: default: value: data: attributes: key: "prod-rollout" name: "Production Rollout" type: "FEATURE_GATE" variant_weights: - value: 50 variant_id: "550e8400-e29b-41d4-a716-446655440001" - value: 50 variant_id: "550e8400-e29b-41d4-a716-446655440002" type: "allocations" schema: $ref: "#/components/schemas/CreateAllocationsRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T12:00:00Z" environment_ids: - "550e8400-e29b-41d4-a716-446655440001" guardrail_metrics: [] id: "550e8400-e29b-41d4-a716-446655440020" key: "prod-rollout" name: "Production Rollout" order_position: 0 targeting_rules: [] type: "FEATURE_GATE" updated_at: "2024-01-01T12:00:00Z" variant_weights: - value: 50 variant_id: "550e8400-e29b-41d4-a716-446655440001" id: "550e8400-e29b-41d4-a716-446655440020" type: "allocations" schema: $ref: "#/components/schemas/AllocationResponse" description: Created "202": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" environment_ids: - abc-123 guardrail_metrics: [] id: 00000000-0000-0000-0000-000000000016 key: prod-rollout name: Production Rollout order_position: 0 targeting_rules: [] type: FEATURE_GATE updated_at: "2024-01-01T00:00:00+00:00" variant_weights: - value: 50 variant_id: abc-123 id: 00000000-0000-0000-0000-000000000015 type: allocations schema: $ref: "#/components/schemas/AllocationResponse" description: Accepted - Approval required for this change "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_config_write summary: Create targeting rules for a flag env tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_config_write put: description: |- Updates targeting rules (allocations) for a specific feature flag in a specific environment. This operation replaces the existing allocation set with the request payload. operationId: UpdateAllocationsForFeatureFlagInEnvironment parameters: - $ref: "#/components/parameters/feature_flag_id" - $ref: "#/components/parameters/environment_id" requestBody: content: application/json: examples: default: value: data: - attributes: key: "prod-rollout" name: "Production Rollout" type: "FEATURE_GATE" variant_weights: - value: 50 variant_id: "550e8400-e29b-41d4-a716-446655440001" - value: 50 variant_id: "550e8400-e29b-41d4-a716-446655440002" type: "allocations" schema: $ref: "#/components/schemas/OverwriteAllocationsRequest" required: true responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T12:00:00Z" environment_ids: - "550e8400-e29b-41d4-a716-446655440001" guardrail_metrics: [] id: "550e8400-e29b-41d4-a716-446655440020" key: "prod-rollout" name: "Production Rollout" order_position: 0 targeting_rules: [] type: "FEATURE_GATE" updated_at: "2024-01-01T12:00:00Z" variant_weights: - value: 50 variant_id: "550e8400-e29b-41d4-a716-446655440001" id: "550e8400-e29b-41d4-a716-446655440020" type: "allocations" schema: $ref: "#/components/schemas/ListAllocationsResponse" description: OK "202": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/ListAllocationsResponse" description: Accepted - Approval required for this change "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_config_write summary: Update targeting rules for a flag tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_config_write /api/v2/feature-flags/{feature_flag_id}/environments/{environment_id}/disable: post: description: |- Disable a feature flag in a specific environment. operationId: DisableFeatureFlagEnvironment parameters: - $ref: "#/components/parameters/feature_flag_id" - $ref: "#/components/parameters/environment_id" responses: "200": description: OK "202": description: Accepted - Approval required for this change "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_config_write - feature_flag_environment_config_read summary: Disable a feature flag in an environment tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_config_write - feature_flag_environment_config_read /api/v2/feature-flags/{feature_flag_id}/environments/{environment_id}/enable: post: description: |- Enable a feature flag in a specific environment. operationId: EnableFeatureFlagEnvironment parameters: - $ref: "#/components/parameters/feature_flag_id" - $ref: "#/components/parameters/environment_id" responses: "200": description: OK "202": description: Accepted - Approval required for this change "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_config_write - feature_flag_environment_config_read summary: Enable a feature flag in an environment tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_config_write - feature_flag_environment_config_read /api/v2/feature-flags/{feature_flag_id}/unarchive: post: description: |- Unarchives a previously archived feature flag, making it visible in the main list again. operationId: UnarchiveFeatureFlag parameters: - $ref: "#/components/parameters/feature_flag_id" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" description: This is an example feature flag distribution_channel: ALL key: feature-flag-abc123 name: Feature Flag ABC123 require_approval: false tags: [] updated_at: "2024-01-01T00:00:00+00:00" value_type: boolean variants: - id: 00000000-0000-0000-0000-000000000014 key: variant-abc123 name: Variant ABC123 value: "true" id: 00000000-0000-0000-0000-000000000013 type: feature-flags schema: $ref: "#/components/schemas/FeatureFlagResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_config_write - feature_flag_environment_config_read summary: Unarchive a feature flag tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_config_write - feature_flag_environment_config_read /api/v2/feature-flags/{feature_flag_id}/variants: post: description: |- Adds a single new variant to an existing feature flag. This endpoint is additive-only: it never modifies existing variants. A request whose `key` already exists on the flag is rejected with `409 Conflict`; a `value` whose type does not match the flag's `value_type` is rejected with `400`. The server generates the variant UUID and returns it in the response body; callers (for example, the flag-migration tool) need this UUID to reference the new variant in subsequent allocation syncs. operationId: CreateVariantForFeatureFlag parameters: - $ref: "#/components/parameters/feature_flag_id" requestBody: content: application/json: examples: default: value: data: attributes: key: dark name: Dark Theme value: dark type: variants schema: $ref: "#/components/schemas/CreateVariantRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" key: dark name: Dark Theme updated_at: "2024-01-01T00:00:00+00:00" value: dark id: "550e8400-e29b-41d4-a716-446655440002" type: variants schema: $ref: "#/components/schemas/VariantResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Conflict - A variant with this key already exists on the flag. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_config_write summary: Add a variant to a feature flag tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_config_write /api/v2/feature-flags/{feature_flag_id}/variants/{variant_id}: delete: description: |- Deletes a variant from a feature flag. When backend approvals are enabled and the flag requires approval, this endpoint creates and returns a `FlagSuggestion` with `201 Created` instead of deleting the variant immediately. If a pending suggestion already exists for this flag's variant property, the endpoint returns `409 Conflict`. operationId: DeleteVariantFromFeatureFlag parameters: - $ref: "#/components/parameters/feature_flag_id" - $ref: "#/components/parameters/variant_id" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Conflict - A pending suggestion already exists for this property. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_config_write summary: Delete a variant tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_config_write put: description: |- Updates the name and value of an existing variant on a feature flag. When backend approvals are enabled and the flag requires approval, this endpoint creates and returns a `FlagSuggestion` with `201 Created` instead of applying the change immediately. Use the returned suggestion `id` to approve or reject the change. If a pending suggestion already exists for this flag's variant property, the endpoint returns `409 Conflict`. operationId: UpdateVariantForFeatureFlag parameters: - $ref: "#/components/parameters/feature_flag_id" - $ref: "#/components/parameters/variant_id" requestBody: content: application/json: examples: default: value: data: attributes: name: Dark Theme Updated value: dark_v2 id: "550e8400-e29b-41d4-a716-446655440002" type: variants schema: $ref: "#/components/schemas/UpdateVariantRequest" required: true responses: "200": description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Conflict - A pending suggestion already exists for this property. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - feature_flag_config_write summary: Update a variant tags: - Feature Flags x-permission: operator: AND permissions: - feature_flag_config_write /api/v2/fleet/agent_versions: get: description: |- Retrieve the list of Datadog Agent versions available for deployment. Returns `200` with an empty `data` array if the Agent package exists in the catalog but has no available versions, and `404` only if the Agent package itself is absent from the catalog. operationId: ListFleetAgentVersionsV2 responses: "200": content: application/json: examples: default: value: data: - attributes: version: "7.80.4" id: "7.80.4" type: agent_version - attributes: version: "7.81.1" id: "7.81.1" type: agent_version meta: page: total_count: 2 schema: $ref: "#/components/schemas/FleetAgentVersionsV2Response" description: OK "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List available Datadog Agent versions tags: - Fleet Automation "x-permission": operator: AND permissions: - hosts_read /api/v2/fleet/agents: get: description: |- Retrieve a paginated list of Datadog Agents. Returns agents with support for pagination, sorting, and filtering. Use `page_number` and `page_size` to navigate pages, `filter` to narrow by field values, and `tags` to filter by agent tags. operationId: ListFleetAgentsV2 parameters: - description: Page number for pagination, starting at 0. in: query name: page_number required: false schema: default: 0 format: int64 minimum: 0 type: integer - description: Number of agents to return per page. Maximum value is 100. Defaults to 10. in: query name: page_size required: false schema: default: 10 format: int64 maximum: 100 minimum: 1 type: integer - description: Filter string to narrow down agent results. example: "hostname:my-hostname OR env:dev" in: query name: filter required: false schema: type: string - description: >- Comma-separated list of tag keys to select which tags are included in each agent's `tags` attribute. Does not filter which agents are returned. in: query name: tags required: false schema: type: string - description: >- Agent attribute to sort results by. Must be a supported attribute name; unsupported values return a 400 error. in: query name: sort_attribute required: false schema: type: string - description: Set to `true` to sort results in descending order. Defaults to ascending. in: query name: sort_descending required: false schema: type: boolean responses: "200": content: application/json: examples: default: value: data: - attributes: agent_version: "7.50.0" api_key_name: "Production API Key" api_key_uuid: "a1b2c3d4-e5f6-4321-a123-123456789abc" cloud_provider: aws datadog_data_center: us1 enabled_products: - apm - logs env: - prod first_seen_at: 1699900000 fleet_policies: [] hostname: my-hostname integrations: - mysql ip_addresses: - "10.0.0.1" is_single_step_instrumentation_enabled: false last_restart_at: 1699999999 os: linux otel_collector_versions: [] remote_agent_management: enabled remote_config_status: connected services: - web tags: - key: team value: platform id: my-agent-hostname type: agent meta: page: total_count: 500 total_filtered_count: 1 schema: $ref: "#/components/schemas/FleetAgentsV2Response" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List all Datadog Agents tags: - Fleet Automation "x-permission": operator: AND permissions: - hosts_read /api/v2/fleet/agents/{agent_key}: get: description: |- Retrieve detailed information about a specific Datadog Agent. By default, only `agent_infos` is returned. Use the `include` query parameter to request additional data: `integrations` and/or `configuration_files`. operationId: GetFleetAgentDetailV2 parameters: - description: >- The unique identifier (Agent key) for the Datadog Agent. Must be a 32-character lowercase hexadecimal string. example: "a1b2c3d4e5f67890a1b2c3d4e5f67890" in: path name: agent_key required: true schema: pattern: "^[0-9a-f]{32}$" type: string - description: >- Comma-separated list of additional fields to include in the response. Valid values are `integrations` and `configuration_files`. Omitting this parameter returns only `agent_infos`. Unrecognized values are silently ignored rather than causing an error. example: "integrations,configuration_files" in: query name: include required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: agent_infos: agent_version: "7.50.0" datadog_agent_key: a1b2c3d4e5f67890a1b2c3d4e5f67890 hostname: my-hostname os: linux id: a1b2c3d4e5f67890a1b2c3d4e5f67890 type: agent schema: $ref: "#/components/schemas/FleetAgentDetailV2Response" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get detailed information about an agent tags: - Fleet Automation "x-permission": operator: AND permissions: - hosts_read /api/v2/fleet/deployments: get: description: Retrieve a paginated list of all deployments for fleet automation. operationId: ListFleetDeploymentsV2 parameters: - description: Number of deployments to return per page. Maximum value is 100. in: query name: page_size required: false schema: default: 10 format: int64 maximum: 100 type: integer - description: Page number for pagination, starting at 0. in: query name: page_number required: false schema: default: 0 format: int64 minimum: 0 type: integer - description: |- Field to sort results by (for example, `start_date`). Must be a supported field name; unsupported values return a 400 error. in: query name: sort required: false schema: type: string - description: |- Set to `true` to sort in ascending order. This setting has no effect unless `sort` is also set. Defaults to descending order. in: query name: ascending required: false schema: type: boolean - description: |- Query used to filter deployments. Uses the Datadog query syntax. Filtering on an unsupported field returns a 400 error. For example: - `status:failed` or `status:done_with_errors`: deployments that need investigation. - `status:running`: deployments currently in flight. - `update_type:update_package` or `update_type:update_config_operations`: deployments of a given type. example: "status:failed" in: query name: filter required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: author: "alice@datadoghq.com" config_operations: - file_op: merge-patch file_path: "/datadog.yaml" patch: logs_enabled: true duration_seconds: 0 error_summary: "" estimated_finished_at: 1699999999 finished_at: 0 is_scheduled: true query: "env:prod AND service:web" schedule_id: "sched-123" started_at: 1699990000 status: running target_versions: ["7.52.0"] total_hosts: 10 update_type: update_config_operations id: k7Q-3mX-p9Z type: deployment meta: page: total_count: 1 total_filtered_count: 1 schema: $ref: "#/components/schemas/FleetDeploymentsV2Response" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List all deployments tags: - Fleet Automation "x-permission": operator: AND permissions: - hosts_read /api/v2/fleet/deployments/configure: post: description: |- Create a new deployment to apply configuration changes to a fleet of hosts matching the specified filter query. This endpoint supports two types of configuration operations: - `merge-patch`: Merges the provided patch data with the existing configuration file, creating the file if it doesn't exist. - `delete`: Removes the specified configuration file from the target hosts. You can optionally use `target_packages` to apply the configuration change only to specific package versions. The deployment is created and started automatically. You can specify multiple configuration operations to execute in order on each target host. Use the filter query to target specific hosts using the Datadog query syntax. Set `dry_run` to `true` to validate the configuration and resolve target hosts and packages without deploying anything. A dry run returns a 200 with the validation result instead of creating and starting a deployment. Returns a 400 if `filter_query` or `config_operations` is missing, a target package is missing a name or version or cannot be resolved, the configuration fails validation, or the filter query does not match any host eligible for the deployment. operationId: CreateFleetDeploymentConfigureV2 requestBody: content: application/json: examples: default: value: data: attributes: config_operations: - file_op: merge-patch file_path: /datadog.yaml patch: apm_config: enabled: true log_level: info logs_enabled: true filter_query: env:prod AND datacenter:us-east-1 type: deployment dry_run: summary: Dry run value: data: attributes: config_operations: - file_op: merge-patch file_path: /datadog.yaml patch: log_level: info dry_run: true filter_query: env:prod AND datacenter:us-east-1 type: deployment schema: $ref: "#/components/schemas/FleetDeploymentConfigureV2CreateRequest" description: Request payload containing the deployment details. required: true responses: "200": content: application/json: examples: default: value: data: attributes: dry_run: config_validated: true non_upgradable_hosts: 0 query: "env:prod AND datacenter:us-east-1" total_hosts: 42 id: dry-run type: deployment schema: $ref: "#/components/schemas/FleetDeploymentConfigureV2DryRunResponse" description: OK "201": content: application/json: examples: default: value: data: attributes: author: "alice@datadoghq.com" duration_seconds: 0 error_summary: "" estimated_finished_at: 0 finished_at: 0 is_scheduled: false query: "env:prod AND datacenter:us-east-1" started_at: 1699990000 status: pending target_versions: [] update_type: update_config_operations id: k7Q-3mX-p9Z type: deployment schema: $ref: "#/components/schemas/FleetDeploymentV2CreateResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create a configuration deployment tags: - Fleet Automation "x-permission": operator: AND permissions: - agent_upgrade_write - fleet_policies_write /api/v2/fleet/deployments/upgrade: post: description: |- Create and immediately start a new package upgrade on hosts matching the specified filter query. This endpoint allows you to upgrade the Datadog Agent to a specific version on hosts matching the specified filter query. The deployment is created and started automatically. The system: 1. Identifies all hosts matching the filter query. 2. Validates that the specified version is available. 3. Begins rolling out the package upgrade to the target hosts. Returns a 400 if `filter_query` or `target_packages` is missing, a target package is missing a name or version, or the filter query does not match any host eligible for the upgrade. Returns a 409 if a conflicting upgrade is already running on one or more target hosts. operationId: CreateFleetDeploymentUpgradeV2 requestBody: content: application/json: examples: default: value: data: attributes: filter_query: env:prod AND service:web target_packages: - name: datadog-agent version: 7.52.0 type: deployment schema: $ref: "#/components/schemas/FleetDeploymentPackageUpgradeV2CreateRequest" description: Request payload containing the package upgrade details. required: true responses: "201": content: application/json: examples: default: value: data: attributes: author: "alice@datadoghq.com" duration_seconds: 0 error_summary: "" estimated_finished_at: 0 finished_at: 0 is_scheduled: false query: "env:prod AND service:web" started_at: 1699990000 status: pending target_versions: ["7.52.0"] update_type: update_package id: k7Q-3mX-p9Z type: deployment schema: $ref: "#/components/schemas/FleetDeploymentV2CreateResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Upgrade hosts tags: - Fleet Automation "x-permission": operator: AND permissions: - agent_upgrade_write - fleet_policies_write /api/v2/fleet/deployments/{deployment_id}: get: description: |- Retrieve detailed information about a specific deployment, including its current status, configuration operations, and per-host execution status. Returns a 404 if no deployment matches the given ID or if you do not have access to it. operationId: GetFleetDeploymentV2 parameters: - description: The unique identifier of the deployment to retrieve. example: "k7Q-3mX-p9Z" in: path name: deployment_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: author: "carol@datadoghq.com" canceled_hosts: 1 config_operations: - file_op: merge-patch file_path: "/datadog.yaml" patch: logs_enabled: true duration_seconds: 0 error_summary: "" estimated_finished_at: 1699999999 failed_hosts: 1 high_level_status: running hosts: - hostname: web-01.example.com running_step: applying_config status: running status_details: "step 2/3" versions: - current_version: "7.50.0" package_name: datadog-agent target_version: "7.52.0" - hostname: web-02.example.com status: succeeded versions: - current_version: "7.52.0" package_name: datadog-agent target_version: "7.52.0" is_scheduled: true query: "env:prod AND service:web" running_hosts: 1 schedule_id: "sched-789" skipped_hosts: 1 succeeded_hosts: 1 target_versions: ["7.52.0"] total_hosts: 5 update_type: update_config_operations id: k7Q-3mX-p9Z type: deployment schema: $ref: "#/components/schemas/FleetDeploymentV2DetailResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a deployment by ID tags: - Fleet Automation "x-permission": operator: AND permissions: - hosts_read /api/v2/fleet/deployments/{deployment_id}/cancel: post: description: |- Cancel an active deployment and stop all pending operations. When you cancel a deployment: - All pending operations on hosts that haven't started yet are stopped. - Operations currently in progress on hosts may complete or be interrupted, depending on their current status. - Configuration changes or package upgrades already applied to hosts are not rolled back. After cancellation, you can view the final state of the deployment using the GET endpoint to see which hosts were successfully updated before the cancellation. Only deployments with a `pending` or `running` status can be canceled. Returns a 400 if the deployment is not in a cancelable status. Returns a 404 if no deployment matches the specified ID or if you do not have access to it. operationId: CancelFleetDeploymentV2 parameters: - description: The unique identifier of the deployment to cancel. example: "k7Q-3mX-p9Z" in: path name: deployment_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: message: "Cancellation has been requested; the deployment is stopping." status: stopping id: k7Q-3mX-p9Z type: deployment schema: $ref: "#/components/schemas/FleetDeploymentV2CancelResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Cancel a deployment tags: - Fleet Automation "x-permission": operator: AND permissions: - agent_upgrade_write - fleet_policies_write /api/v2/fleet/schedules: get: description: |- Retrieve all upgrade schedules for the organization. Schedules automate package upgrades by defining maintenance windows and recurrence rules. Each schedule automatically creates deployments based on its configuration. operationId: ListFleetSchedulesV2 responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2023-11-14T22:13:19Z" created_by: user@example.com is_default: false name: Weekly Production Agent Updates next_run: "2025-01-06T02:00:00Z" query: env:prod AND service:web rule: days_of_week: - Mon - Wed interval: 1 maintenance_window_duration: 120 start_maintenance_window: "0200" timezone: America/New_York status: active updated_at: "2023-11-14T22:13:19Z" updated_by: user@example.com version_to_latest: 0 id: abc-def-ghi-123 type: schedule meta: page: total_count: 1 schema: $ref: "#/components/schemas/FleetSchedulesV2Response" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List all schedules tags: - Fleet Automation "x-permission": operator: OR permissions: - hosts_read /api/v2/fleet/schedules/{id}: get: description: |- Retrieve detailed information about a specific schedule by its unique identifier. operationId: GetFleetScheduleV2 parameters: - description: The unique identifier of the schedule to retrieve. example: "abc-def-ghi-123" in: path name: id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2023-11-14T22:13:19Z" created_by: user@example.com is_default: false name: Weekly Production Agent Updates next_run: "2025-01-06T02:00:00Z" query: env:prod AND service:web rule: days_of_week: - Mon - Wed interval: 1 maintenance_window_duration: 120 start_maintenance_window: "0200" timezone: America/New_York status: active updated_at: "2023-11-14T22:13:19Z" updated_by: user@example.com version_to_latest: 0 id: abc-def-ghi-123 type: schedule schema: $ref: "#/components/schemas/FleetScheduleV2Response" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a schedule by ID tags: - Fleet Automation "x-permission": operator: OR permissions: - hosts_read /api/v2/forms: get: description: Get all forms for the authenticated user's organization. operationId: ListForms responses: "200": content: application/json: examples: default: value: data: - attributes: active: true anonymous: false created_at: "2026-05-29T20:06:14.895284Z" datastore_config: datastore_id: 00000000-0000-0000-0000-000000000000 primary_column_name: "" primary_key_generation_strategy: "" description: A form to collect user feedback. end_date: idp_survey: false modified_at: "2026-05-29T20:06:14.895285Z" name: User Feedback Form org_id: 2 self_service: false single_response: false user_id: 10001 user_uuid: 1fc709aa-be19-4539-a47d-52a30d78a978 id: 22f6006a-2302-4926-9396-d2dfcf7b0b34 type: forms schema: $ref: "#/components/schemas/FormsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List forms tags: - Forms x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a new form. The form is created in draft mode and must be published before it can be used. This also creates a new datastore for form responses and links it to the form. operationId: CreateForm requestBody: content: application/json: examples: default: value: data: attributes: anonymous: false data_definition: {} description: A form to collect user feedback. idp_survey: false name: User Feedback Form single_response: false ui_definition: {} type: forms schema: $ref: "#/components/schemas/CreateFormRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: active: true anonymous: false created_at: "2026-05-29T20:06:14.895284Z" datastore_config: datastore_id: 5108ea24-dd83-4696-9caa-f069f73d0fad primary_column_name: id primary_key_generation_strategy: none description: A form to collect user feedback. end_date: idp_survey: false modified_at: "2026-05-29T20:06:14.895285Z" name: User Feedback Form org_id: 2 self_service: false single_response: false user_id: 10001 user_uuid: 1fc709aa-be19-4539-a47d-52a30d78a978 id: 22f6006a-2302-4926-9396-d2dfcf7b0b34 type: forms schema: $ref: "#/components/schemas/FormResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a form tags: - Forms x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/forms/create_and_publish: post: description: Creates a new form and immediately publishes its initial version. This also creates a new datastore for form responses and links it to the form. operationId: CreateAndPublishForm requestBody: content: application/json: examples: default: value: data: attributes: anonymous: false data_definition: {} description: A form to collect user feedback. idp_survey: false name: User Feedback Form single_response: false ui_definition: {} type: forms schema: $ref: "#/components/schemas/CreateFormRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: active: true anonymous: false created_at: "2026-05-29T20:06:14.895284Z" datastore_config: datastore_id: 5108ea24-dd83-4696-9caa-f069f73d0fad primary_column_name: id primary_key_generation_strategy: none description: A form to collect user feedback. end_date: idp_survey: false modified_at: "2026-05-29T20:06:14.895285Z" name: User Feedback Form org_id: 2 self_service: false single_response: false user_id: 10001 user_uuid: 1fc709aa-be19-4539-a47d-52a30d78a978 id: 22f6006a-2302-4926-9396-d2dfcf7b0b34 type: forms schema: $ref: "#/components/schemas/FormResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create and publish a form tags: - Forms x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/forms/{form_id}: delete: description: Delete a form by its ID. This will also try to delete the associated datastore. operationId: DeleteForm parameters: - description: The ID of the form. example: 844dfd88-aa84-4db4-8979-e7bdbb9c1dc3 in: path name: form_id required: true schema: format: uuid type: string responses: "200": content: application/json: examples: default: value: data: id: 844dfd88-aa84-4db4-8979-e7bdbb9c1dc3 type: forms schema: $ref: "#/components/schemas/DeleteFormResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a form tags: - Forms x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a form definition by its ID. operationId: GetForm parameters: - description: The ID of the form. example: 22f6006a-2302-4926-9396-d2dfcf7b0b34 in: path name: form_id required: true schema: format: uuid type: string - description: The version of the form to retrieve. Use 'latest' for the most recent draft, 'published' for the last published version, or a specific version number. in: query name: version required: false schema: default: latest type: string responses: "200": content: application/json: examples: default: value: data: attributes: active: true anonymous: false created_at: "2026-05-29T20:06:14.895284Z" datastore_config: datastore_id: 5108ea24-dd83-4696-9caa-f069f73d0fad primary_column_name: id primary_key_generation_strategy: none description: A form to collect user feedback. end_date: idp_survey: false modified_at: "2026-05-29T20:06:14.895285Z" name: User Feedback Form org_id: 2 self_service: false single_response: false user_id: 10001 user_uuid: 1fc709aa-be19-4539-a47d-52a30d78a978 id: 22f6006a-2302-4926-9396-d2dfcf7b0b34 type: forms schema: $ref: "#/components/schemas/FormResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a form tags: - Forms x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update a form's properties such as its name, description, or datastore configuration. operationId: UpdateForm parameters: - description: The ID of the form. example: 22f6006a-2302-4926-9396-d2dfcf7b0b34 in: path name: form_id required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: form_update: description: An updated description. name: Updated Form Name type: forms schema: $ref: "#/components/schemas/UpdateFormRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: active: true anonymous: false created_at: "2026-05-29T20:06:14.895284Z" datastore_config: datastore_id: 5108ea24-dd83-4696-9caa-f069f73d0fad primary_column_name: id primary_key_generation_strategy: none description: An updated description. end_date: idp_survey: false modified_at: "2026-05-29T20:06:15.000000Z" name: Updated Form Name org_id: 2 self_service: false single_response: false user_id: 10001 user_uuid: 1fc709aa-be19-4539-a47d-52a30d78a978 id: 22f6006a-2302-4926-9396-d2dfcf7b0b34 type: forms schema: $ref: "#/components/schemas/FormResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a form tags: - Forms x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/forms/{form_id}/clone: post: description: Clone an existing form. The clone is created in draft mode using the source form's latest version. operationId: CloneForm parameters: - description: The ID of the form to clone. example: 22f6006a-2302-4926-9396-d2dfcf7b0b34 in: path name: form_id required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: name: Copy of My Form type: forms schema: $ref: "#/components/schemas/CloneFormRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: active: true anonymous: false created_at: "2026-05-30T10:00:00.000000Z" datastore_config: datastore_id: a2b3c4d5-e6f7-8901-2345-6789abcdef01 primary_column_name: id primary_key_generation_strategy: none description: A form to collect user feedback. end_date: idp_survey: false modified_at: "2026-05-30T10:00:00.000000Z" name: Copy of My Form org_id: 2 self_service: false single_response: false user_id: 10001 user_uuid: 1fc709aa-be19-4539-a47d-52a30d78a978 id: 7a1e9054-5f6a-4b08-9e3d-c2f189a3bce0 type: forms schema: $ref: "#/components/schemas/FormResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Clone a form tags: - Forms x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/forms/{form_id}/publish: post: description: Publish a specific version of a form, making it available for submissions. operationId: PublishForm parameters: - description: The ID of the form. example: 22f6006a-2302-4926-9396-d2dfcf7b0b34 in: path name: form_id required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: version: 1 type: form_publications schema: $ref: "#/components/schemas/PublishFormRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-05-29T20:06:13.677353Z" form_id: afc67600-0511-43b1-9b18-578fb4979bd3 form_version: 1 id: "42" modified_at: "2026-05-29T20:06:13.677353Z" org_id: 2 publish_seq: 1 user_id: 10001 user_uuid: 1fc709aa-be19-4539-a47d-52a30d78a978 id: "42" type: form_publications schema: $ref: "#/components/schemas/FormPublicationResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Publish a form version tags: - Forms x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/forms/{form_id}/versions: post: description: |- Create or update the latest draft version of a form. The `upsert_params` field controls optimistic concurrency behavior. operationId: UpsertFormVersion parameters: - description: The ID of the form. example: 22f6006a-2302-4926-9396-d2dfcf7b0b34 in: path name: form_id required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: data_definition: {} state: draft ui_definition: {} upsert_params: match_policy: none type: form_versions schema: $ref: "#/components/schemas/UpsertFormVersionRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-05-29T20:06:14.895921Z" data_definition: $ref: "#/components/schemas/FormDataDefinition" definition_signature: '{"signature":"b7f312957a80cea2c8c9950532b205a90a3f8a7ebb7e52fc25437a25d903d545","version":1}' etag: b51f08b698d88d8027a935d9db649774949f5fb41a0c559bfee6a9a13225c72d modified_at: "2026-05-29T20:06:14.949163Z" state: draft ui_definition: {} user_id: 10001 user_uuid: 1fc709aa-be19-4539-a47d-52a30d78a978 version: 2 id: "126" type: form_versions schema: $ref: "#/components/schemas/FormVersionResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create or update a form version tags: - Forms x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/forms/{form_id}/versions/upsert_and_publish: post: description: Upsert the latest form version and publish it in a single atomic transaction. operationId: UpsertAndPublishFormVersion parameters: - description: The ID of the form. example: 22f6006a-2302-4926-9396-d2dfcf7b0b34 in: path name: form_id required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: data_definition: {} ui_definition: {} upsert_params: etag: b51f08b698d88d8027a935d9db649774949f5fb41a0c559bfee6a9a13225c72d type: form_versions schema: $ref: "#/components/schemas/UpsertAndPublishFormVersionRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: active: true anonymous: false created_at: "2026-05-29T20:06:14.895284Z" datastore_config: datastore_id: 5108ea24-dd83-4696-9caa-f069f73d0fad primary_column_name: id primary_key_generation_strategy: none description: A form to collect user feedback. end_date: idp_survey: false modified_at: "2026-05-29T20:06:15.000000Z" name: User Feedback Form org_id: 2 self_service: false single_response: false user_id: 10001 user_uuid: 1fc709aa-be19-4539-a47d-52a30d78a978 id: 22f6006a-2302-4926-9396-d2dfcf7b0b34 type: forms schema: $ref: "#/components/schemas/FormResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Upsert and publish a form version tags: - Forms x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/global_orgs: get: description: |- Returns organizations across regions for the authenticated user. The `user_handle` query parameter must match the authenticated user's handle. operationId: ListGlobalOrgs parameters: - description: The handle of the authenticated user. in: query name: user_handle required: true schema: example: user@example.com type: string - description: Maximum number of results returned. in: query name: page[limit] required: false schema: default: 100 format: int32 maximum: 1000 minimum: 1 type: integer - description: |- String to query the next page of results. This key is provided with each valid response from the API in `meta.page.next_cursor`. in: query name: page[cursor] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: org: name: Example Org public_id: abcdef12345 subdomain: example uuid: "13d10a96-6ff2-49be-be7b-4f56ebb13335" redirect_url: "https://app.datadoghq.com/account/login/password?dd_oid=13d10a96-6ff2-49be-be7b-4f56ebb13335&login_hint=user%40example.com" source_region: us1.prod.dog user: handle: user@example.com uuid: "cfab5cf9-5472-48ea-a79c-a64045f4f745" type: global_user_orgs links: next: "https://app.datadoghq.com/api/v2/global_orgs?user_handle=user@example.com&page[limit]=100&page[cursor]=next-page" self: "https://app.datadoghq.com/api/v2/global_orgs?user_handle=user@example.com&page[limit]=100" meta: page: cursor: "" limit: 100 next_cursor: next-page type: cursor schema: $ref: "#/components/schemas/GlobalOrgsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_read summary: List global orgs tags: - Organizations x-pagination: cursorParam: page[cursor] cursorPath: meta.page.next_cursor limitParam: page[limit] resultsPath: data "x-permission": operator: OR permissions: - user_access_read /api/v2/governance: get: description: Get the organization-wide AI Gateway governance settings, which are the default data capture mode and whether requests must reach providers covered by a zero data retention agreement. operationId: GetAiGatewayGovernance responses: "200": content: application/json: examples: default: value: data: attributes: data_capture_mode: metadata_only id: organization type: governance schema: $ref: "#/components/schemas/AiGatewayGovernanceResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: Get AI Gateway governance controls tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: Replace the organization-wide AI Gateway governance settings, which are the default data capture mode and whether requests must reach providers covered by a zero data retention agreement. operationId: UpdateAiGatewayGovernance requestBody: content: application/json: schema: $ref: "#/components/schemas/AiGatewayGovernanceReplaceRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: data_capture_mode: full_capture id: organization type: governance schema: $ref: "#/components/schemas/AiGatewayGovernanceResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Replace AI Gateway governance controls tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/governance/config: get: description: |- Retrieve the Governance Console configuration for the organization, including whether the Console is enabled, whether assignment notifications are enabled, and whether usage attribution is configured. operationId: GetGovernanceConfig responses: "200": content: application/json: examples: default: value: data: attributes: assignment_notifications_enabled: true enabled: true usage_attribution_configured: true xorg_insights_enabled: true id: "00000000-0000-0000-0000-000000000000" type: "governance_console_config" schema: $ref: "#/components/schemas/GovernanceConfigResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get the Governance Console configuration tags: - Governance Console x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/governance/control: get: description: |- Retrieve the list of governance controls configured for the organization. Each control pairs a detection definition with the organization's current detection, notification, and mitigation configuration, along with counts of active and mitigated detections. operationId: ListGovernanceControls responses: "200": content: application/json: examples: default: value: data: - attributes: active_detections_count: 12 category: "security" created_at: "2024-01-15T09:30:00Z" created_by: "11111111-2222-3333-4444-555555555555" description: "Identifies API keys that have not been used within your specified time threshold, helping reduce security risks from dormant credentials." detection_parameters: api_key_threshold: 30 insights: [] last_detection_at: "2024-03-01T12:00:00Z" mitigated_detections_count: 3 mitigation_parameters: {} mitigation_type: "" mitigations: - description: "Automatically identifies and revokes inactive API keys to improve security and reduce potential attack surface." execution_modes: - "manual" - "automatic" id: "revoke_api_key" permissions: - "api_keys_write" - "api_keys_delete" supported_parameters: [] title: "Revoke Unused API Keys" name: "Unused API Keys" priority: "High" product: "api_keys" resource_type: "api_key" resource_type_display_name: "API Key" supported_detection_parameters: - default_value: 30 description: "Number of days of inactivity before an API key is considered unused." display_name: "Unused API Key Threshold" name: "api_key_threshold" required: false supported_values: type: "integer" type: "Proactive" id: "unused_api_keys" type: "governance_control" schema: $ref: "#/components/schemas/GovernanceControlsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List controls tags: - Governance Console "x-permission": operator: AND permissions: - governance_console_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/governance/control/{detection_type}: get: description: |- Retrieve a single governance control by its detection type, including the organization's current detection, notification, and mitigation configuration and detection counts. operationId: GetGovernanceControl parameters: - description: The detection type that identifies the control, for example `unused_api_keys`. example: "unused_api_keys" in: path name: detection_type required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: active_detections_count: 12 category: "security" created_at: "2024-01-15T09:30:00Z" created_by: "11111111-2222-3333-4444-555555555555" description: "Identifies API keys that have not been used within your specified time threshold, helping reduce security risks from dormant credentials." detection_parameters: api_key_threshold: 30 insights: [] last_detection_at: "2024-03-01T12:00:00Z" mitigated_detections_count: 3 mitigation_parameters: {} mitigation_type: "revoke_api_key" mitigations: [] name: "Unused API Keys" priority: "High" product: "api_keys" resource_type: "api_key" resource_type_display_name: "API Key" supported_detection_parameters: - default_value: 30 description: "Number of days of inactivity before an API key is considered unused." display_name: "Unused API Key Threshold" name: "api_key_threshold" required: false supported_values: type: "integer" type: "Proactive" id: "unused_api_keys" type: "governance_control" schema: $ref: "#/components/schemas/GovernanceControlResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a control tags: - Governance Console "x-permission": operator: AND permissions: - governance_console_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: |- Update the detection, notification, and mitigation configuration of a governance control. Only the attributes present in the request are modified. Changing the mitigation type or its parameters may require additional permissions. operationId: UpdateGovernanceControl parameters: - description: The detection type that identifies the control, for example `unused_api_keys`. example: "unused_api_keys" in: path name: detection_type required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: detection_parameters: api_key_threshold: 60 mitigation_type: "revoke_api_key" type: "governance_control" schema: $ref: "#/components/schemas/GovernanceControlUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: active_detections_count: 12 category: "security" created_at: "2024-01-15T09:30:00Z" created_by: "11111111-2222-3333-4444-555555555555" description: "Identifies API keys that have not been used within your specified time threshold, helping reduce security risks from dormant credentials." detection_parameters: api_key_threshold: 60 insights: [] last_detection_at: "2024-03-01T12:00:00Z" mitigated_detections_count: 3 mitigation_parameters: {} mitigation_type: "revoke_api_key" mitigations: [] name: "Unused API Keys" priority: "High" product: "api_keys" resource_type: "api_key" resource_type_display_name: "API Key" supported_detection_parameters: [] type: "Proactive" id: "unused_api_keys" type: "governance_control" schema: $ref: "#/components/schemas/GovernanceControlResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update a control tags: - Governance Console "x-permission": operator: AND permissions: - governance_console_read - governance_console_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/governance/control/{detection_type}/detections: get: description: |- Retrieve the detections produced by the governance control with the given detection type. Results can be filtered by state and free-text query, sorted, and paginated. operationId: ListGovernanceControlDetections parameters: - description: The detection type that identifies the control; for example, `unused_api_keys`. example: "unused_api_keys" in: path name: detection_type required: true schema: type: string - description: Restrict the results to detections in the given state. example: "active" in: query name: filter[state] required: false schema: type: string - description: Restrict the results to detections matching the given free-text query. example: "production" in: query name: filter[query] required: false schema: type: string - description: |- A comma-separated list of attributes to sort detections by. Prefix an attribute with `-` for descending order. The attributes available for sorting are `id`, `created_at`, `assigned_to`, `detection_type`, `display_name`, `exception_at`, `mitigate_after`, `mitigated_at`, `priority`, `resource_id`, and `state`. Defaults to `created_at,-id`. example: "-created_at,-id" in: query name: sort required: false schema: type: string - description: "The zero-based index of the page to return; the first page is 0." example: 0 in: query name: page[number] required: false schema: default: 0 format: int64 type: integer - description: The number of detections to return per page. example: 50 in: query name: page[size] required: false schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: assigned_team: "platform-security" assigned_to: "11111111-2222-3333-4444-555555555555" assignment_source: "manual" control_id: "unused_api_keys" created_at: "2024-03-01T12:00:00Z" detection_type: "unused_api_keys" display_name: "CI Deploy Key" metadata: region: "us-east-1" priority: 1 resource_id: "api-key-12345" resource_type: "api_key" state: "active" id: "3f9b2c1a-8d4e-4a6b-9c2f-1e7d5a0b3c4d" type: "governance_control_detection" schema: $ref: "#/components/schemas/GovernanceControlDetectionsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List control detections tags: - Governance Console "x-permission": operator: AND permissions: - governance_console_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/governance/control/{detection_type}/notification_settings: get: description: |- Retrieve the notification settings for the governance control with the given detection type, including, for each supported event type, whether notifications are enabled and which destinations receive them. operationId: GetGovernanceControlNotificationSettings parameters: - description: The detection type that identifies the control; for example, `unused_api_keys`. example: "unused_api_keys" in: path name: detection_type required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: event_settings: - enabled: true event_type: "new_detection" targets: - handle: "#governance-alerts" type: "slack" id: "unused_api_keys" type: "control_notification_settings" schema: $ref: "#/components/schemas/ControlNotificationSettingsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get control notification settings tags: - Governance Console "x-permission": operator: AND permissions: - governance_console_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: |- Replace the notification settings for the governance control with the given detection type, setting, for each supported event type, whether notifications are enabled and which destinations receive them. operationId: UpdateGovernanceControlNotificationSettings parameters: - description: The detection type that identifies the control; for example, `unused_api_keys`. example: "unused_api_keys" in: path name: detection_type required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: event_settings: - enabled: true event_type: "new_detection" targets: - handle: "#governance-alerts" type: "slack" type: "control_notification_settings" schema: $ref: "#/components/schemas/ControlNotificationSettingsUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: event_settings: - enabled: true event_type: "new_detection" targets: - handle: "#governance-alerts" type: "slack" id: "unused_api_keys" type: "control_notification_settings" schema: $ref: "#/components/schemas/ControlNotificationSettingsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update control notification settings tags: - Governance Console "x-permission": operator: AND permissions: - governance_console_read - governance_console_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/governance/detections/mitigate: post: description: |- Apply a mitigation to a set of governance detections of a given detection type. When the mitigation type is omitted, the control's configured mitigation is used. The request is accepted for asynchronous processing. operationId: MitigateGovernanceDetections requestBody: content: application/json: examples: default: value: data: attributes: detection_ids: - "3f9b2c1a-8d4e-4a6b-9c2f-1e7d5a0b3c4d" detection_type: "unused_api_keys" mitigation_parameters: {} mitigation_type: "revoke_api_key" type: "governance_control_detection" schema: $ref: "#/components/schemas/GovernanceMitigationRequest" required: true responses: "202": description: Accepted "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Mitigate detections tags: - Governance Console "x-permission": operator: AND permissions: - governance_console_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/governance/detections/{detection_id}: get: description: Retrieve a single governance detection by its unique identifier. operationId: GetGovernanceDetection parameters: - description: The unique identifier of the detection. example: "3f9b2c1a-8d4e-4a6b-9c2f-1e7d5a0b3c4d" in: path name: detection_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: assigned_team: "platform-security" assigned_to: "11111111-2222-3333-4444-555555555555" assignment_source: "manual" control_id: "unused_api_keys" created_at: "2024-03-01T12:00:00Z" detection_type: "unused_api_keys" display_name: "CI Deploy Key" metadata: region: "us-east-1" priority: 1 resource_id: "api-key-12345" resource_type: "api_key" state: "active" id: "3f9b2c1a-8d4e-4a6b-9c2f-1e7d5a0b3c4d" type: "governance_control_detection" schema: $ref: "#/components/schemas/GovernanceControlDetectionResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a detection tags: - Governance Console "x-permission": operator: AND permissions: - governance_console_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: |- Update a governance detection by its unique identifier. Only the attributes present in the request are modified, allowing a detection to be acknowledged as an exception, reopened, reassigned, or deferred for mitigation. operationId: UpdateGovernanceDetection parameters: - description: The unique identifier of the detection. example: "3f9b2c1a-8d4e-4a6b-9c2f-1e7d5a0b3c4d" in: path name: detection_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: assigned_to: "11111111-2222-3333-4444-555555555555" state: "exception" type: "governance_control_detection" schema: $ref: "#/components/schemas/GovernanceControlDetectionUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: assigned_team: "platform-security" assigned_to: "11111111-2222-3333-4444-555555555555" assignment_source: "manual" control_id: "unused_api_keys" created_at: "2024-03-01T12:00:00Z" detection_type: "unused_api_keys" display_name: "CI Deploy Key" metadata: region: "us-east-1" priority: 1 resource_id: "api-key-12345" resource_type: "api_key" state: "active" id: "3f9b2c1a-8d4e-4a6b-9c2f-1e7d5a0b3c4d" type: "governance_control_detection" schema: $ref: "#/components/schemas/GovernanceControlDetectionResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update a detection tags: - Governance Console "x-permission": operator: AND permissions: - governance_console_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/governance/insights: get: description: |- Retrieve the list of governance insights available to the organization. Each insight reports the query used to compute it, so that the value can be computed client-side. Insights can be filtered by product. operationId: ListGovernanceInsights parameters: - description: |- Restrict the results to insights belonging to the given products. May be repeated to filter by multiple products. Matching is case-insensitive. example: - "Usage" - "Logs Settings" in: query name: filter[product] required: false schema: items: type: string type: array responses: "200": content: application/json: examples: default: value: data: - attributes: audit_query: description: "Number of custom metrics submitted by the organization." display_name: "Custom Metrics" event_query: metric_query: query: "sum:datadog.estimated_usage.metrics.custom{*}" reducer: "sum" source: "metrics" percentage_query: product: "Usage" query_config: chart_type: "line" comparison_shift: "month" directionality: "decrease_better" effective_time_window_days: 30 sub_product: "" time_range: "month" unit_name: "custom metrics" usage_query: id: "498ee21f-8037-48b8-a961-a488692902f4" type: "insight" - attributes: audit_query: compute: aggregation: "cardinality" interval: 86400000 metric: "@usr.id" indexes: - "main" query: "@evt.name:Dashboard" source: "audit" description: "Number of users who have used the Dashboard in the last 30 days" display_name: "Active Users" event_query: metric_query: percentage_query: product: "Usage" query_config: chart_type: "line" comparison_shift: "month" directionality: "neutral" effective_time_window_days: 30 sub_product: "" time_range: "month" unit_name: "active users" usage_query: id: "a3248d1b-5578-4345-a34e-fe9657300f22" type: "insight" schema: $ref: "#/components/schemas/GovernanceInsightsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - events_read - metrics_read summary: List insights tags: - Governance Console "x-permission": operator: OR permissions: - metrics_read - events_read - audit_logs_read - governance_console_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/governance/notification_settings: get: description: |- Retrieve the organization-wide governance notification settings, including whether users are notified when detections are assigned to them. operationId: GetGovernanceNotificationSettings responses: "200": content: application/json: examples: default: value: data: attributes: assignment_notifications_enabled: true id: "11111111-2222-3333-4444-555555555555" type: "governance_notification_settings" schema: $ref: "#/components/schemas/GovernanceNotificationSettingsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get notification settings tags: - Governance Console "x-permission": operator: AND permissions: - governance_console_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: |- Update the organization-wide governance notification settings. Only the attributes present in the request are modified. operationId: UpdateGovernanceNotificationSettings requestBody: content: application/json: examples: default: value: data: attributes: assignment_notifications_enabled: true type: "governance_notification_settings" schema: $ref: "#/components/schemas/GovernanceNotificationSettingsUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: assignment_notifications_enabled: true id: "11111111-2222-3333-4444-555555555555" type: "governance_notification_settings" schema: $ref: "#/components/schemas/GovernanceNotificationSettingsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update notification settings tags: - Governance Console "x-permission": operator: AND permissions: - governance_console_read - governance_console_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/governance/tag_rules: get: description: |- Retrieve all tag rules for the organization. Optionally include disabled or deleted rules, filter by telemetry source, and include each rule's current compliance score via the `include=score` query parameter. operationId: ListTagRules parameters: - description: Whether to include rules that are currently disabled. Defaults to `false`. example: false in: query name: include_disabled required: false schema: type: boolean - description: Whether to include rules that have been soft-deleted. Defaults to `false`. example: false in: query name: include_deleted required: false schema: type: boolean - description: Comma-separated list of related resources to include alongside each rule in the response. Currently the only supported value is `score`. example: "score" in: query name: include required: false schema: $ref: "#/components/schemas/TagRuleInclude" - description: Restrict the result set to rules whose source matches the given value. in: query name: filter[source] required: false schema: $ref: "#/components/schemas/TagRuleSource" - description: Start of the time window used for compliance score computation, as a Unix timestamp in milliseconds. Defaults to a recent window appropriate for the source. example: 1779315066097 in: query name: ts_start required: false schema: format: int64 type: integer - description: End of the time window used for compliance score computation, as a Unix timestamp in milliseconds. Must be in the past and greater than `ts_start`. example: 1779401466097 in: query name: ts_end required: false schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2026-05-21T22:11:06.108696Z" created_by: "test-user" enabled: true modified_at: "2026-05-21T22:11:06.108696Z" modified_by: "test-user" name: "Service tag must be one of api or web" negated: false required: true rule_type: "surfacing" scope: "env" source: "logs" tag_key: "service" tag_value_patterns: - "api" - "web" version: 1 id: "123" relationships: score: data: id: "123-v1-1779315066097-1779401466097" type: "tag_rule_score" type: "tag_rule" included: - attributes: score: 80 ts_end: 1779401466097 ts_start: 1779315066097 version: 1 id: "123-v1-1779315066097-1779401466097" type: "tag_rule_score" schema: $ref: "#/components/schemas/TagRulesListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List tag rules tags: - Tag Rules "x-permission": operator: OR permissions: - telemetry_rules_read - metrics_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Create a new tag rule for the organization. The caller's organization is derived from the authenticated user; cross-organization creation is not supported. Fields such as `rule_id`, `version`, and the timestamp/audit fields are assigned by the server. operationId: CreateTagRule requestBody: content: application/json: examples: default: value: data: attributes: enabled: true name: "Service tag must be one of api or web" negated: false required: true rule_type: "surfacing" scope: "env" source: "logs" tag_key: "service" tag_value_patterns: - "api" - "web" type: "tag_rule" schema: $ref: "#/components/schemas/TagRuleCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2026-05-21T22:11:06.108696Z" created_by: "test-user" enabled: true modified_at: "2026-05-21T22:11:06.108696Z" modified_by: "test-user" name: "Service tag must be one of api or web" negated: false required: true rule_type: "surfacing" scope: "env" source: "logs" tag_key: "service" tag_value_patterns: - "api" - "web" version: 1 id: "123" type: "tag_rule" schema: $ref: "#/components/schemas/TagRuleResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create a tag rule tags: - Tag Rules "x-permission": operator: AND permissions: - telemetry_rules_create x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/governance/tag_rules/{rule_id}: delete: description: |- Delete a tag rule. By default the rule is soft-deleted so it can be recovered later and so that historical score data remains queryable. Pass `hard_delete=true` to remove the rule permanently. operationId: DeleteTagRule parameters: - description: The unique identifier of the tag rule to delete. example: "123" in: path name: rule_id required: true schema: type: string - description: Whether to permanently delete the rule instead of performing a soft delete. Defaults to `false`. example: false in: query name: hard_delete required: false schema: type: boolean responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete a tag rule tags: - Tag Rules "x-permission": operator: AND permissions: - telemetry_rules_create x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: |- Retrieve a single tag rule by ID. Optionally include the rule's current compliance score via the `include=score` query parameter. Rules belonging to other organizations cannot be retrieved. operationId: GetTagRule parameters: - description: The unique identifier of the tag rule. example: "123" in: path name: rule_id required: true schema: type: string - description: Comma-separated list of related resources to include alongside the rule. Currently the only supported value is `score`. example: "score" in: query name: include required: false schema: $ref: "#/components/schemas/TagRuleInclude" - description: Start of the time window used for compliance score computation, as a Unix timestamp in milliseconds. example: 1779315066097 in: query name: ts_start required: false schema: format: int64 type: integer - description: End of the time window used for compliance score computation, as a Unix timestamp in milliseconds. Must be in the past and greater than `ts_start`. example: 1779401466097 in: query name: ts_end required: false schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-05-21T22:11:06.108696Z" created_by: "test-user" enabled: true modified_at: "2026-05-21T22:11:06.108696Z" modified_by: "test-user" name: "Service tag must be one of api or web" negated: false required: true rule_type: "surfacing" scope: "env" source: "logs" tag_key: "service" tag_value_patterns: - "api" - "web" version: 1 id: "123" relationships: score: data: id: "123-v1-1779315066097-1779401466097" type: "tag_rule_score" type: "tag_rule" included: - attributes: score: 80 ts_end: 1779401466097 ts_start: 1779315066097 version: 1 id: "123-v1-1779315066097-1779401466097" type: "tag_rule_score" schema: $ref: "#/components/schemas/TagRuleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a tag rule tags: - Tag Rules "x-permission": operator: OR permissions: - telemetry_rules_read - metrics_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: |- Update one or more attributes of an existing tag rule. Only the fields supplied in the request body are modified; omitted fields retain their current values. The rule's `source` cannot be changed after creation. operationId: UpdateTagRule parameters: - description: The unique identifier of the tag rule to update. example: "123" in: path name: rule_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: enabled: true name: "Service tag must be one of api, web, or worker" id: "123" type: "tag_rule" schema: $ref: "#/components/schemas/TagRuleUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-05-21T22:11:06.108696Z" created_by: "test-user" enabled: true modified_at: "2026-05-21T22:25:01.000000Z" modified_by: "test-user" name: "Service tag must be one of api, web, or worker" negated: false required: true rule_type: "surfacing" scope: "env" source: "logs" tag_key: "service" tag_value_patterns: - "api" - "web" version: 2 id: "123" type: "tag_rule" schema: $ref: "#/components/schemas/TagRuleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update a tag rule tags: - Tag Rules "x-permission": operator: AND permissions: - telemetry_rules_create x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/governance/tag_rules/{rule_id}/score: get: description: |- Retrieve the compliance score for a single tag rule. The score is computed over the requested time window (or a source-appropriate default) and represents the percentage of telemetry within that window that conforms to the rule. A `null` score indicates that no relevant telemetry was found. operationId: GetTagRuleScore parameters: - description: The unique identifier of the tag rule. example: "123" in: path name: rule_id required: true schema: type: string - description: Start of the time window used for compliance score computation, as a Unix timestamp in milliseconds. example: 1779315066097 in: query name: ts_start required: false schema: format: int64 type: integer - description: End of the time window used for compliance score computation, as a Unix timestamp in milliseconds. Must be in the past and greater than `ts_start`. example: 1779401466097 in: query name: ts_end required: false schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: score: 80 ts_end: 1779401466097 ts_start: 1779315066097 version: 1 id: "123-v1-1779315066097-1779401466097" type: "tag_rule_score" schema: $ref: "#/components/schemas/TagRuleScoreResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a tag rule compliance score tags: - Tag Rules "x-permission": operator: OR permissions: - telemetry_rules_read - metrics_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/hamr: get: description: |- Retrieve the High Availability Multi-Region (HAMR) organization connection details for the authenticated organization. This endpoint returns information about the HAMR connection configuration, including the target organization, datacenter, status, and whether this is the primary or secondary organization in the HAMR relationship. operationId: GetHamrOrgConnection responses: "200": content: application/json: examples: default: value: data: attributes: hamr_status: 4 is_primary: true modified_at: "2024-01-01T00:00:00+00:00" modified_by: test@example.com target_org_datacenter: us1 target_org_name: Production Backup Org target_org_uuid: 00000000-0000-0000-0000-000000000001 id: 00000000-0000-0000-0000-000000000001 type: hamr_org_connections schema: $ref: "#/components/schemas/HamrOrgConnectionResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get HAMR organization connection tags: - High Availability MultiRegion x-unstable: |- **Note**: This endpoint is in public beta and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Create or update the High Availability Multi-Region (HAMR) organization connection. This endpoint allows you to configure the HAMR connection between the authenticated organization and a target organization, including setting the connection status (ONBOARDING, PASSIVE, FAILOVER, ACTIVE, RECOVERY) operationId: CreateHamrOrgConnection requestBody: content: application/json: examples: default: value: data: attributes: hamr_status: 4 is_primary: true modified_by: admin@example.com target_org_datacenter: us1 target_org_name: Production Backup Org target_org_uuid: 660f9511-f3ac-52e5-b827-557766551111 id: 550e8400-e29b-41d4-a716-446655440000 type: hamr_org_connections schema: $ref: "#/components/schemas/HamrOrgConnectionRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: hamr_status: 4 is_primary: true modified_at: "2024-01-01T00:00:00+00:00" modified_by: test@example.com target_org_datacenter: us1 target_org_name: Production Backup Org target_org_uuid: 00000000-0000-0000-0000-000000000001 id: 00000000-0000-0000-0000-000000000002 type: hamr_org_connections schema: $ref: "#/components/schemas/HamrOrgConnectionResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create or update HAMR organization connection tags: - High Availability MultiRegion x-unstable: |- **Note**: This endpoint is in public beta and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/identity_providers: get: description: Get all identity providers available for the current organization. operationId: ListIdentityProviders responses: "200": content: application/json: examples: default: value: data: - attributes: authentication_method: "SAML" enabled: true id: "00000000-0000-0000-0000-000000000001" type: identity_providers - attributes: authentication_method: google_oidc enabled: false id: "00000000-0000-0000-0000-000000000002" type: identity_providers - attributes: authentication_method: standard enabled: false id: "00000000-0000-0000-0000-000000000003" type: identity_providers schema: $ref: "#/components/schemas/IdentityProvidersResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authentication error "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management summary: List identity providers tags: - Identity Providers "x-permission": operator: OR permissions: - org_management - user_access_manage /api/v2/identity_providers/{idp_id}: patch: description: Enable or disable an identity provider for the current organization. operationId: UpdateIdentityProvider parameters: - $ref: "#/components/parameters/IdentityProviderId" requestBody: content: application/json: examples: default: value: data: attributes: enabled: true id: "00000000-0000-0000-0000-000000000001" type: identity_providers schema: $ref: "#/components/schemas/IdentityProviderUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: authentication_method: "SAML" enabled: true id: "00000000-0000-0000-0000-000000000001" type: identity_providers schema: $ref: "#/components/schemas/IdentityProviderResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management summary: Update an identity provider tags: - Identity Providers x-codegen-request-body-name: body "x-permission": operator: OR permissions: - org_management /api/v2/identity_providers/{idp_id}/users: get: description: |- Get all users in the organization whose login method has been overridden to use the specified identity provider. operationId: ListIdentityProviderUsers parameters: - $ref: "#/components/parameters/IdentityProviderId" - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - description: User attribute to order results by. Options include `email` and `name`. in: query name: sort required: false schema: default: email example: email type: string - description: "Direction of sort. Options: `asc`, `desc`." in: query name: sort_dir required: false schema: $ref: "#/components/schemas/QuerySortOrder" - description: Filter users by the given string. Defaults to no filtering. in: query name: filter required: false schema: type: string - description: |- Filter on status attribute. Comma-separated list, with possible values `Active`, `Pending`, and `Disabled`. Defaults to no filtering. in: query name: filter[status] required: false schema: example: Active type: string responses: "200": content: application/json: examples: default: value: data: - attributes: email: example@datadoghq.com handle: example-user name: Example User status: Active id: "00000000-0000-9999-0000-000000000001" type: users meta: page: total_count: 1 total_filtered_count: 1 schema: $ref: "#/components/schemas/UsersResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management summary: List users with an identity provider override tags: - Identity Providers x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data "x-permission": operator: OR permissions: - org_management /api/v2/idp/entity_integrations/{integration_id}: delete: description: Delete the configuration stored for a given integration in the caller's organization. operationId: DeleteEntityIntegrationConfig parameters: - $ref: "#/components/parameters/EntityIntegrationConfigID" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an entity integration configuration tags: - Entity Integration Configs x-permission: operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Retrieve the configuration currently stored for a given integration in the caller's organization. operationId: GetEntityIntegrationConfig parameters: - $ref: "#/components/parameters/EntityIntegrationConfigID" responses: "200": content: application/json: example: data: attributes: config: enabled_repos: - github_org_name: myorg hostname: github.com repo_name: myrepo integration_id: github org_id: 1234 id: 01HJABCD12345678ABCDEFGHIJ type: entity_integration_configs schema: $ref: "#/components/schemas/EntityIntegrationConfigResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get an entity integration configuration tags: - Entity Integration Configs x-permission: operator: OR permissions: - integrations_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: |- Create or replace the configuration for a given integration in the caller's organization. The shape of `data.attributes.config` depends on the integration: - For `github`: `config` must contain an `enabled_repos` array of objects with `hostname`, `github_org_name`, and `repo_name`. - For `jira`: `config` must contain an `enabled_projects` array of objects with `hostname`, `account_id`, and `project_key`. - For `pagerduty`: `config` must contain an `accounts` array of objects with a required `enabled` boolean and an optional `subdomain` string. operationId: UpdateEntityIntegrationConfig parameters: - $ref: "#/components/parameters/EntityIntegrationConfigID" requestBody: content: application/json: examples: default: summary: GitHub integration configuration value: data: attributes: config: enabled_repos: - github_org_name: myorg hostname: github.com repo_name: myrepo type: entity_integration_config_requests jira: summary: Jira integration configuration value: data: attributes: config: enabled_projects: - account_id: "123456789" hostname: mycompany.atlassian.net project_key: AAA type: entity_integration_config_requests pagerduty: summary: PagerDuty integration configuration value: data: attributes: config: accounts: - enabled: true subdomain: mycompany type: entity_integration_config_requests schema: $ref: "#/components/schemas/EntityIntegrationConfigRequest" required: true responses: "200": content: application/json: example: data: attributes: config: enabled_repos: - github_org_name: myorg hostname: github.com repo_name: myrepo integration_id: github org_id: 1234 id: 01HJABCD12345678ABCDEFGHIJ type: entity_integration_configs schema: $ref: "#/components/schemas/EntityIntegrationConfigResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create or update entity integration configuration tags: - Entity Integration Configs x-codegen-request-body-name: body x-permission: operator: OR permissions: - integrations_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents: get: description: >- Get all incidents for the user's organization. operationId: ListIncidents parameters: - $ref: "#/components/parameters/IncidentIncludeQueryParameter" - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageOffset" responses: "200": content: application/json: examples: default: value: data: - attributes: created: "2024-01-01T00:00:00+00:00" customer_impacted: false modified: "2024-01-01T00:00:00+00:00" title: A test incident title id: "00000000-0000-0000-1234-000000000000" type: incidents schema: $ref: "#/components/schemas/IncidentsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Get a list of incidents tags: - Incidents x-pagination: limitParam: page[size] pageOffsetParam: page[offset] resultsPath: data "x-permission": operator: OR permissions: - incident_read x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create an incident. operationId: CreateIncident requestBody: content: application/json: examples: default: value: data: attributes: customer_impact_scope: Example customer impact scope customer_impacted: false fields: severity: type: dropdown value: SEV-5 incident_type_uuid: 00000000-0000-0000-0000-000000000000 initial_cells: - cell_type: markdown content: content: "An example timeline cell message." important: false is_test: false notification_handles: - display_name: Jane Doe handle: "@user@email.com" - display_name: Slack Channel handle: "@slack-channel" - display_name: Incident Workflow handle: "@workflow-from-incident" title: A test incident title relationships: commander_user: data: id: 00000000-0000-0000-0000-000000000000 type: users type: incidents schema: $ref: "#/components/schemas/IncidentCreateRequest" description: Incident payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: created: "2024-01-01T00:00:00+00:00" customer_impacted: false fields: severity: type: dropdown value: SEV-5 modified: "2024-01-01T00:00:00+00:00" title: A test incident title id: "00000000-0000-0000-1234-000000000000" type: incidents schema: $ref: "#/components/schemas/IncidentResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Create an incident tags: - Incidents x-codegen-request-body-name: body "x-permission": operator: OR permissions: - incident_write x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/global/incident-handles: delete: description: Delete a global incident handle. operationId: DeleteGlobalIncidentHandle responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete global incident handle tags: - Incidents x-unstable: |- **Note**: This endpoint is in public beta and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Retrieve a list of global incident handles. operationId: ListGlobalIncidentHandles parameters: - description: Comma-separated list of related resources to include in the response in: query name: include required: false schema: example: "created_by_user,last_modified_by_user,commander_user,incident_type" type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" fields: severity: - SEV-1 modified_at: "2024-01-01T00:00:00+00:00" name: "@incident-sev-1" id: 00000000-0000-0000-0000-000000000006 type: incidents_handles schema: $ref: "#/components/schemas/IncidentHandlesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List global incident handles tags: - Incidents x-unstable: |- **Note**: This endpoint is in public beta and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a new global incident handle. operationId: CreateGlobalIncidentHandle parameters: - description: Comma-separated list of related resources to include in the response in: query name: include required: false schema: example: "created_by_user,last_modified_by_user,commander_user,incident_type" type: string requestBody: content: application/json: examples: default: value: data: attributes: fields: severity: - SEV-1 name: "@incident-sev-1" id: b2494081-cdf0-4205-b366-4e1dd4fdf0bf relationships: commander_user: data: id: f7b538b1-ed7c-4e84-82de-fdf84a539d40 type: incident_types incident_type: data: id: f7b538b1-ed7c-4e84-82de-fdf84a539d40 type: incident_types type: incidents_handles schema: $ref: "#/components/schemas/IncidentHandleRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" fields: severity: - SEV-1 modified_at: "2024-01-01T00:00:00+00:00" name: "@incident-sev-1" id: 00000000-0000-0000-0000-000000000007 type: incidents_handles schema: $ref: "#/components/schemas/IncidentHandleResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create global incident handle tags: - Incidents x-unstable: |- **Note**: This endpoint is in public beta and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: Update an existing global incident handle. operationId: UpdateGlobalIncidentHandle parameters: - description: Comma-separated list of related resources to include in the response in: query name: include required: false schema: example: "created_by_user,last_modified_by_user,commander_user,incident_type" type: string requestBody: content: application/json: examples: default: value: data: attributes: fields: severity: - SEV-1 name: "@incident-sev-1" id: b2494081-cdf0-4205-b366-4e1dd4fdf0bf relationships: commander_user: data: id: f7b538b1-ed7c-4e84-82de-fdf84a539d40 type: incident_types incident_type: data: id: f7b538b1-ed7c-4e84-82de-fdf84a539d40 type: incident_types type: incidents_handles schema: $ref: "#/components/schemas/IncidentHandleRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" fields: severity: - SEV-1 modified_at: "2024-01-01T00:00:00+00:00" name: "@incident-sev-1" id: 00000000-0000-0000-0000-000000000008 type: incidents_handles schema: $ref: "#/components/schemas/IncidentHandleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update global incident handle tags: - Incidents x-unstable: |- **Note**: This endpoint is in public beta and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/global/settings: get: description: Retrieve global incident settings for the organization. operationId: GetGlobalIncidentSettings responses: "200": content: application/json: examples: default: value: data: attributes: analytics_dashboard_id: 00000000-0000-0000-0000-000000000002-def created: "2024-01-01T00:00:00+00:00" modified: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000001 type: incidents_global_settings schema: $ref: "#/components/schemas/GlobalIncidentSettingsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get global incident settings tags: - Incidents x-unstable: |- **Note**: This endpoint is in public beta and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update global incident settings for the organization. operationId: UpdateGlobalIncidentSettings requestBody: content: application/json: examples: default: value: data: attributes: analytics_dashboard_id: 00000000-0000-0000-0000-000000000003-def type: incidents_global_settings schema: $ref: "#/components/schemas/GlobalIncidentSettingsRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: analytics_dashboard_id: 00000000-0000-0000-0000-000000000005-def created: "2024-01-01T00:00:00+00:00" modified: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000004 type: incidents_global_settings schema: $ref: "#/components/schemas/GlobalIncidentSettingsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update global incident settings tags: - Incidents x-unstable: |- **Note**: This endpoint is in public beta and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/google-chat-configurations: post: description: Create a Google Chat configuration for incidents. operationId: CreateIncidentGoogleChatConfiguration requestBody: content: application/json: examples: default: value: data: attributes: domain_id: my-domain space_name_template: "{{incident.title}}" space_target_audience_id: "123456789" space_time_zone: America/New_York relationships: incident_type: data: id: 00000000-0000-0000-0000-000000000000 type: incident_types type: google_chat_configurations schema: $ref: "#/components/schemas/IncidentGoogleChatConfigurationRequest" description: Google Chat configuration payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00.000Z" domain_id: my-domain modified_at: "2024-01-01T00:00:00.000Z" space_name_template: "{{incident.title}}" space_target_audience_id: "123456789" space_time_zone: America/New_York id: 00000000-0000-0000-0000-000000000001 type: google_chat_configurations schema: $ref: "#/components/schemas/IncidentGoogleChatConfigurationResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Create an incident Google Chat configuration tags: - Incidents x-codegen-request-body-name: body x-permission: operator: OR permissions: - incident_settings_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/google-chat-configurations/{id}: patch: description: Update a Google Chat configuration for incidents. operationId: UpdateIncidentGoogleChatConfiguration parameters: - $ref: "#/components/parameters/IncidentGoogleChatConfigurationIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: domain_id: updated-domain id: 00000000-0000-0000-0000-000000000001 type: google_chat_configurations schema: $ref: "#/components/schemas/IncidentGoogleChatConfigurationPatchRequest" description: Google Chat configuration patch payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00.000Z" domain_id: updated-domain modified_at: "2024-01-02T00:00:00.000Z" space_name_template: "{{incident.title}}" space_target_audience_id: "123456789" space_time_zone: America/New_York id: 00000000-0000-0000-0000-000000000001 type: google_chat_configurations schema: $ref: "#/components/schemas/IncidentGoogleChatConfigurationResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Update an incident Google Chat configuration tags: - Incidents x-codegen-request-body-name: body x-permission: operator: OR permissions: - incident_settings_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/google-meet-configurations: post: description: Create a Google Meet configuration for incidents. operationId: CreateIncidentGoogleMeetConfiguration requestBody: content: application/json: examples: default: value: data: attributes: allow_manual_meeting_creation: true auto_summarize: false relationships: incident_type: data: id: 00000000-0000-0000-0000-000000000000 type: incident_types type: google_meet_configurations schema: $ref: "#/components/schemas/IncidentGoogleMeetConfigurationRequest" description: Google Meet configuration payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: allow_manual_meeting_creation: true auto_summarize: false created_at: "2024-01-01T00:00:00.000Z" modified_at: "2024-01-01T00:00:00.000Z" id: 00000000-0000-0000-0000-000000000001 type: google_meet_configurations schema: $ref: "#/components/schemas/IncidentGoogleMeetConfigurationResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Create an incident Google Meet configuration tags: - Incidents x-codegen-request-body-name: body x-permission: operator: OR permissions: - incident_settings_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/google-meet-configurations/{id}: patch: description: Update a Google Meet configuration for incidents. operationId: UpdateIncidentGoogleMeetConfiguration parameters: - $ref: "#/components/parameters/IncidentGoogleMeetConfigurationIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: auto_summarize: true id: 00000000-0000-0000-0000-000000000001 type: google_meet_configurations schema: $ref: "#/components/schemas/IncidentGoogleMeetConfigurationPatchRequest" description: Google Meet configuration patch payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: allow_manual_meeting_creation: true auto_summarize: true created_at: "2024-01-01T00:00:00.000Z" modified_at: "2024-01-02T00:00:00.000Z" id: 00000000-0000-0000-0000-000000000001 type: google_meet_configurations schema: $ref: "#/components/schemas/IncidentGoogleMeetConfigurationResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Update an incident Google Meet configuration tags: - Incidents x-codegen-request-body-name: body x-permission: operator: OR permissions: - incident_settings_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/impact-fields: get: description: List all impact fields for incidents. operationId: ListIncidentImpactFields responses: "200": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/IncidentImpactFieldsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_read summary: List incident impact fields tags: - Incidents x-permission: operator: OR permissions: - incident_settings_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create an impact field for incidents. operationId: CreateIncidentImpactField requestBody: content: application/json: examples: default: value: data: attributes: display_name: Customer Impact Scope field_choices: - description: Affects all customers display_name: All Customers value: all_customers - description: Affects some customers display_name: Some Customers value: some_customers field_type: dropdown name: customer_impact_scope relationships: incident_type: data: id: 00000000-0000-0000-0000-000000000000 type: incident_types type: impact_fields schema: $ref: "#/components/schemas/IncidentImpactFieldRequest" description: Impact field payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: display_name: Customer Impact Scope field_choices: - description: Affects all customers display_name: All Customers value: all_customers field_type: dropdown name: customer_impact_scope id: 00000000-0000-0000-0000-000000000001 type: impact_fields schema: $ref: "#/components/schemas/IncidentImpactFieldResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Create an incident impact field tags: - Incidents x-codegen-request-body-name: body x-permission: operator: OR permissions: - incident_settings_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/impact-fields/{field_id}: delete: description: Delete an impact field for incidents. operationId: DeleteIncidentImpactField parameters: - $ref: "#/components/parameters/IncidentImpactFieldIDPathParameter" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Delete an incident impact field tags: - Incidents x-permission: operator: OR permissions: - incident_settings_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: Update an impact field for incidents. operationId: UpdateIncidentImpactField parameters: - $ref: "#/components/parameters/IncidentImpactFieldIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: display_name: Customer Impact Scope Updated field_type: dropdown name: customer_impact_scope relationships: incident_type: data: id: 00000000-0000-0000-0000-000000000000 type: incident_types type: impact_fields schema: $ref: "#/components/schemas/IncidentImpactFieldRequest" description: Impact field update payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: display_name: Customer Impact Scope Updated field_type: dropdown name: customer_impact_scope id: 00000000-0000-0000-0000-000000000001 type: impact_fields schema: $ref: "#/components/schemas/IncidentImpactFieldResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Update an incident impact field tags: - Incidents x-codegen-request-body-name: body x-permission: operator: OR permissions: - incident_settings_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/notification-rules: get: description: Lists all notification rules for the organization. Optionally filter by incident type. operationId: ListIncidentNotificationRules parameters: - $ref: "#/components/parameters/IncidentNotificationRuleIncludeQueryParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: conditions: - field: severity values: - SEV-1 - SEV-2 created: "2024-01-01T00:00:00+00:00" enabled: true handles: - "@team-email@example.com" modified: "2024-01-01T00:00:00+00:00" trigger: incident_created_trigger visibility: organization id: 00000000-0000-0000-0000-000000000001 type: incident_notification_rules schema: $ref: "#/components/schemas/IncidentNotificationRuleArray" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List incident notification rules tags: - Incidents x-permission: operator: AND permissions: - incident_notification_settings_read x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Creates a new notification rule. operationId: CreateIncidentNotificationRule requestBody: content: application/json: examples: default: value: data: attributes: conditions: - field: severity values: - SEV-1 - SEV-2 enabled: true handles: - "@team-email@company.com" - "@slack-channel" renotify_on: - status - severity trigger: incident_created_trigger visibility: organization relationships: incident_type: data: id: 00000000-0000-0000-0000-000000000000 type: incident_types notification_template: data: id: 00000000-0000-0000-0000-000000000001 type: notification_templates type: incident_notification_rules schema: $ref: "#/components/schemas/CreateIncidentNotificationRuleRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: conditions: - field: severity values: - SEV-1 - SEV-2 created: "2024-01-01T00:00:00+00:00" enabled: true handles: - "@team-email@example.com" modified: "2024-01-01T00:00:00+00:00" trigger: incident_created_trigger visibility: organization id: 00000000-0000-0000-0000-000000000001 type: incident_notification_rules schema: $ref: "#/components/schemas/IncidentNotificationRule" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_notification_settings_write summary: Create an incident notification rule tags: - Incidents x-codegen-request-body-name: body x-permission: operator: AND permissions: - incident_notification_settings_write x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/notification-rules/{id}: delete: description: Deletes a notification rule by its ID. operationId: DeleteIncidentNotificationRule parameters: - $ref: "#/components/parameters/IncidentNotificationRuleIDPathParameter" - $ref: "#/components/parameters/IncidentNotificationRuleIncludeQueryParameter" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_notification_settings_write summary: Delete an incident notification rule tags: - Incidents x-permission: operator: AND permissions: - incident_notification_settings_write x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Retrieves a specific notification rule by its ID. operationId: GetIncidentNotificationRule parameters: - $ref: "#/components/parameters/IncidentNotificationRuleIDPathParameter" - $ref: "#/components/parameters/IncidentNotificationRuleIncludeQueryParameter" responses: "200": content: application/json: examples: default: value: data: attributes: conditions: - field: severity values: - SEV-1 - SEV-2 created: "2024-01-01T00:00:00+00:00" enabled: true handles: - "@team-email@example.com" modified: "2024-01-01T00:00:00+00:00" trigger: incident_created_trigger visibility: organization id: 00000000-0000-0000-0000-000000000001 type: incident_notification_rules schema: $ref: "#/components/schemas/IncidentNotificationRule" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_notification_settings_read summary: Get an incident notification rule tags: - Incidents x-permission: operator: AND permissions: - incident_notification_settings_read x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: Updates an existing notification rule with a complete replacement. operationId: UpdateIncidentNotificationRule parameters: - $ref: "#/components/parameters/IncidentNotificationRuleIDPathParameter" - $ref: "#/components/parameters/IncidentNotificationRuleIncludeQueryParameter" requestBody: content: application/json: examples: default: value: data: attributes: conditions: - field: severity values: - SEV-1 - SEV-2 enabled: true handles: - "@team-email@company.com" - "@slack-channel" renotify_on: - status - severity trigger: incident_created_trigger visibility: organization id: 00000000-0000-0000-0000-000000000001 relationships: incident_type: data: id: 00000000-0000-0000-0000-000000000000 type: incident_types notification_template: data: id: 00000000-0000-0000-0000-000000000001 type: notification_templates type: incident_notification_rules schema: $ref: "#/components/schemas/PutIncidentNotificationRuleRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: conditions: - field: severity values: - SEV-1 - SEV-2 created: "2024-01-01T00:00:00+00:00" enabled: true handles: - "@team-email@example.com" modified: "2024-01-01T00:00:00+00:00" trigger: incident_created_trigger visibility: organization id: 00000000-0000-0000-0000-000000000001 type: incident_notification_rules schema: $ref: "#/components/schemas/IncidentNotificationRule" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_notification_settings_write summary: Update an incident notification rule tags: - Incidents x-codegen-request-body-name: body x-permission: operator: AND permissions: - incident_notification_settings_write x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/notification-templates: get: description: Lists all notification templates. Optionally filter by incident type. operationId: ListIncidentNotificationTemplates parameters: - $ref: "#/components/parameters/IncidentNotificationTemplateIncidentTypeFilterQueryParameter" - $ref: "#/components/parameters/IncidentNotificationTemplateIncludeQueryParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: category: alert content: "An incident has been declared.\n\nTitle: {{incident.title}}" created: "2024-01-01T00:00:00+00:00" modified: "2024-01-01T00:00:00+00:00" name: Incident Alert Template subject: "{{incident.severity}} Incident: {{incident.title}}" id: 00000000-0000-0000-0000-000000000001 type: notification_templates schema: $ref: "#/components/schemas/IncidentNotificationTemplateArray" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List incident notification templates tags: - Incidents x-permission: operator: AND permissions: - incident_notification_settings_read x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Creates a new notification template. operationId: CreateIncidentNotificationTemplate requestBody: content: application/json: examples: default: value: data: attributes: category: alert content: "An incident has been declared.\n\nTitle: {{incident.title}}\nSeverity: {{incident.severity}}\nAffected Services: {{incident.services}}\nStatus: {{incident.state}}\n\nPlease join the incident channel for updates." name: Incident Alert Template subject: "{{incident.severity}} Incident: {{incident.title}}" relationships: incident_type: data: id: 00000000-0000-0000-0000-000000000000 type: incident_types type: notification_templates schema: $ref: "#/components/schemas/CreateIncidentNotificationTemplateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: category: alert content: "An incident has been declared.\n\nTitle: {{incident.title}}" created: "2024-01-01T00:00:00+00:00" modified: "2024-01-01T00:00:00+00:00" name: Incident Alert Template subject: "{{incident.severity}} Incident: {{incident.title}}" id: 00000000-0000-0000-0000-000000000001 type: notification_templates schema: $ref: "#/components/schemas/IncidentNotificationTemplate" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_notification_settings_write summary: Create incident notification template tags: - Incidents x-codegen-request-body-name: body x-permission: operator: AND permissions: - incident_notification_settings_write x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/notification-templates/{id}: delete: description: Deletes a notification template by its ID. operationId: DeleteIncidentNotificationTemplate parameters: - $ref: "#/components/parameters/IncidentNotificationTemplateIDPathParameter" - $ref: "#/components/parameters/IncidentNotificationTemplateIncludeQueryParameter" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_notification_settings_write summary: Delete a notification template tags: - Incidents x-permission: operator: AND permissions: - incident_notification_settings_write x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Retrieves a specific notification template by its ID. operationId: GetIncidentNotificationTemplate parameters: - $ref: "#/components/parameters/IncidentNotificationTemplateIDPathParameter" - $ref: "#/components/parameters/IncidentNotificationTemplateIncludeQueryParameter" responses: "200": content: application/json: examples: default: value: data: attributes: category: alert content: "An incident has been declared.\n\nTitle: {{incident.title}}" created: "2024-01-01T00:00:00+00:00" modified: "2024-01-01T00:00:00+00:00" name: Incident Alert Template subject: "{{incident.severity}} Incident: {{incident.title}}" id: 00000000-0000-0000-0000-000000000001 type: notification_templates schema: $ref: "#/components/schemas/IncidentNotificationTemplate" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read - incident_write summary: Get incident notification template tags: - Incidents x-permission: operator: OR permissions: - incident_settings_read - incident_write - incident_read x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Updates an existing notification template's attributes. operationId: UpdateIncidentNotificationTemplate parameters: - $ref: "#/components/parameters/IncidentNotificationTemplateIDPathParameter" - $ref: "#/components/parameters/IncidentNotificationTemplateIncludeQueryParameter" requestBody: content: application/json: examples: default: value: data: attributes: category: update content: "Incident Status Update:\n\nTitle: {{incident.title}}\nNew Status: {{incident.state}}\nSeverity: {{incident.severity}}\nServices: {{incident.services}}\nCommander: {{incident.commander}}\n\nFor more details, visit the incident page." name: Incident Status Update Template subject: "Incident Update: {{incident.title}} - {{incident.state}}" id: 00000000-0000-0000-0000-000000000001 type: notification_templates schema: $ref: "#/components/schemas/PatchIncidentNotificationTemplateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: category: alert content: "An incident has been declared.\n\nTitle: {{incident.title}}" created: "2024-01-01T00:00:00+00:00" modified: "2024-01-01T00:00:00+00:00" name: Incident Alert Template subject: "{{incident.severity}} Incident: {{incident.title}}" id: 00000000-0000-0000-0000-000000000001 type: notification_templates schema: $ref: "#/components/schemas/IncidentNotificationTemplate" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_notification_settings_write summary: Update incident notification template tags: - Incidents x-codegen-request-body-name: body x-permission: operator: AND permissions: - incident_notification_settings_write x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/postmortem-templates: get: description: Retrieve a list of all postmortem templates for incidents. operationId: ListIncidentPostmortemTemplates parameters: - $ref: "#/components/parameters/PostmortemTemplateFilterIncidentTypeParameter" - $ref: "#/components/parameters/PostmortemTemplateSortParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: content: "# Overview\n\n# What Happened\n\n# Timeline\n\n# Action Items" createdAt: "2024-01-01T00:00:00+00:00" is_default: "2024-01-01T00:00:00+00:00" location: datadog_notebooks modifiedAt: "2024-01-01T00:00:00+00:00" name: Standard Postmortem Template id: 00000000-0000-0000-0000-000000000001 relationships: incident_type: data: id: 00000000-0000-0000-0000-000000000009 type: incident_types type: postmortem_templates schema: $ref: "#/components/schemas/PostmortemTemplatesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List postmortem templates tags: - Incidents x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a new postmortem template for incidents. operationId: CreateIncidentPostmortemTemplate requestBody: content: application/json: examples: default: value: data: attributes: content: "# Overview\n\n# What Happened\n\n# Timeline\n\n# Action Items" name: Standard Postmortem Template relationships: incident_type: data: id: 00000000-0000-0000-0000-000000000009 type: incident_types type: postmortem_templates schema: $ref: "#/components/schemas/PostmortemTemplateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: content: "# Overview\n\n# What Happened\n\n# Timeline\n\n# Action Items" createdAt: "2024-01-01T00:00:00+00:00" is_default: location: datadog_notebooks modifiedAt: "2024-01-01T00:00:00+00:00" name: Standard Postmortem Template id: 00000000-0000-0000-0000-000000000002 relationships: incident_type: data: id: 00000000-0000-0000-0000-000000000009 type: incident_types type: postmortem_templates schema: $ref: "#/components/schemas/PostmortemTemplateResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create postmortem template tags: - Incidents x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/postmortem-templates/{template_id}: delete: description: Delete a postmortem template. operationId: DeleteIncidentPostmortemTemplate parameters: - $ref: "#/components/parameters/PostmortemTemplateIdParameter" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete postmortem template tags: - Incidents x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Retrieve details of a specific postmortem template. operationId: GetIncidentPostmortemTemplate parameters: - $ref: "#/components/parameters/PostmortemTemplateIdParameter" responses: "200": content: application/json: examples: default: value: data: attributes: content: "# Overview\n\n# What Happened\n\n# Timeline\n\n# Action Items" createdAt: "2024-01-01T00:00:00+00:00" is_default: location: datadog_notebooks modifiedAt: "2024-01-01T00:00:00+00:00" name: Standard Postmortem Template id: 00000000-0000-0000-0000-000000000003 relationships: incident_type: data: id: 00000000-0000-0000-0000-000000000009 type: incident_types type: postmortem_templates schema: $ref: "#/components/schemas/PostmortemTemplateResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get postmortem template tags: - Incidents x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update an existing postmortem template. operationId: UpdateIncidentPostmortemTemplate parameters: - $ref: "#/components/parameters/PostmortemTemplateIdParameter" requestBody: content: application/json: examples: default: value: data: attributes: name: Standard Postmortem Template id: 00000000-0000-0000-0000-000000000004 type: postmortem_templates schema: $ref: "#/components/schemas/PostmortemTemplateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: content: "# Overview\n\n# What Happened\n\n# Timeline\n\n# Action Items" createdAt: "2024-01-01T00:00:00+00:00" is_default: location: datadog_notebooks modifiedAt: "2024-01-01T00:00:00+00:00" name: Standard Postmortem Template id: 00000000-0000-0000-0000-000000000004 relationships: incident_type: data: id: 00000000-0000-0000-0000-000000000009 type: incident_types type: postmortem_templates schema: $ref: "#/components/schemas/PostmortemTemplateResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update postmortem template tags: - Incidents x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/rules: get: description: List all incident rules. operationId: ListIncidentRules parameters: - description: Filter rules by task ID. in: query name: "filter[task_id]" required: false schema: example: notify-incident-handles-job type: string - description: Filter rules by trigger. in: query name: "filter[trigger]" required: false schema: example: incident_created_trigger type: string - description: Filter rules by incident type UUID. in: query name: incidentTypeUUID required: false schema: example: 00000000-0000-0000-0000-000000000000 format: uuid type: string responses: "200": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/IncidentRulesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_read summary: List incident rules tags: - Incidents x-permission: operator: OR permissions: - incident_settings_read - incident_notification_settings_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create an incident rule. operationId: CreateIncidentRule requestBody: content: application/json: examples: default: value: data: attributes: condition: raw_query: "severity:SEV-1" condition_table_type: 1 enabled: true execution_type: 1 task_id: notify-incident-handles-job task_payload: "{}" trigger: incident_created_trigger type: incident_rules schema: $ref: "#/components/schemas/IncidentRuleRequest" description: Incident rule payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: condition: raw_query: "severity:SEV-1" condition_table_type: 1 created: "2024-01-01T00:00:00.000Z" enabled: true execution_type: 1 modified: "2024-01-01T00:00:00.000Z" task_id: notify-incident-handles-job task_payload: "{}" trigger: incident_created_trigger id: 00000000-0000-0000-0000-000000000001 type: incidents_rules schema: $ref: "#/components/schemas/IncidentRuleResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Create an incident rule tags: - Incidents x-codegen-request-body-name: body x-permission: operator: OR permissions: - incident_settings_write - incident_notification_settings_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/rules/{rule_id}: delete: description: Delete an incident rule. operationId: DeleteIncidentRule parameters: - $ref: "#/components/parameters/IncidentRuleIDPathParameter" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Delete an incident rule tags: - Incidents x-permission: operator: OR permissions: - incident_settings_write - incident_notification_settings_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a single incident rule by ID. operationId: GetIncidentRule parameters: - $ref: "#/components/parameters/IncidentRuleIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: condition: raw_query: "severity:SEV-1" condition_table_type: 1 created: "2024-01-01T00:00:00.000Z" enabled: true execution_type: 1 modified: "2024-01-01T00:00:00.000Z" task_id: notify-incident-handles-job task_payload: "{}" trigger: incident_created_trigger id: 00000000-0000-0000-0000-000000000001 type: incidents_rules schema: $ref: "#/components/schemas/IncidentRuleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_read summary: Get an incident rule tags: - Incidents x-permission: operator: OR permissions: - incident_settings_read - incident_notification_settings_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update an incident rule. operationId: UpdateIncidentRule parameters: - $ref: "#/components/parameters/IncidentRuleIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: enabled: false id: 00000000-0000-0000-0000-000000000001 type: incident_rules schema: $ref: "#/components/schemas/IncidentRulePatchRequest" description: Incident rule patch payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: condition: raw_query: "severity:SEV-1" condition_table_type: 1 created: "2024-01-01T00:00:00.000Z" enabled: false execution_type: 1 modified: "2024-01-02T00:00:00.000Z" task_id: notify-incident-handles-job task_payload: "{}" trigger: incident_created_trigger id: 00000000-0000-0000-0000-000000000001 type: incidents_rules schema: $ref: "#/components/schemas/IncidentRuleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Update an incident rule tags: - Incidents x-codegen-request-body-name: body x-permission: operator: OR permissions: - incident_settings_write - incident_notification_settings_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/types: get: description: Get all incident types. operationId: ListIncidentTypes parameters: - $ref: "#/components/parameters/IncidentTypeIncludeDeletedParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: description: Any incidents that harm the confidentiality, integrity, or availability of our data. is_default: false name: Security Incident id: 00000000-0000-0000-0000-000000000002 type: incident_types schema: $ref: "#/components/schemas/IncidentTypeListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Get a list of incident types tags: - Incidents "x-permission": operator: OR permissions: - incident_settings_read - incident_read x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create an incident type. operationId: CreateIncidentType requestBody: content: application/json: examples: default: value: data: attributes: createdBy: 00000000-0000-0000-0000-000000000000 description: Any incidents that harm (or have the potential to) the confidentiality, integrity, or availability of our data. is_default: false lastModifiedBy: 00000000-0000-0000-0000-000000000000 name: Security Incident prefix: IR type: incident_types schema: $ref: "#/components/schemas/IncidentTypeCreateRequest" description: Incident type payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: description: Any incidents that harm the confidentiality, integrity, or availability of our data. is_default: false name: Security Incident id: 00000000-0000-0000-0000-000000000001 type: incident_types schema: $ref: "#/components/schemas/IncidentTypeResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Create an incident type tags: - Incidents x-codegen-request-body-name: body "x-permission": operator: AND permissions: - incident_settings_write x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/types/org-settings: get: description: List org settings for all incident types. operationId: ListOrgSettings parameters: - description: Maximum number of results to return. in: query name: "page[size]" required: false schema: example: 10 format: int64 type: integer - description: The offset for pagination. in: query name: "page[offset]" required: false schema: example: 0 format: int64 type: integer - description: Whether to include deleted records. in: query name: include-deleted required: false schema: example: false type: boolean - description: Comma-separated list of related resources to include in the response. in: query name: include required: false schema: example: incident_type type: string responses: "200": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/IncidentOrgSettingsListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: List incident type org settings tags: - Incidents x-permission: operator: OR permissions: - incident_settings_read - incident_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/types/{incident_type_id}: delete: description: Delete an incident type. operationId: DeleteIncidentType parameters: - $ref: "#/components/parameters/IncidentTypeIDPathParameter" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Delete an incident type tags: - Incidents x-codegen-request-body-name: body "x-permission": operator: OR permissions: - incident_settings_write x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get incident type details. operationId: GetIncidentType parameters: - $ref: "#/components/parameters/IncidentTypeIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: description: Any incidents that harm the confidentiality, integrity, or availability of our data. is_default: false name: Security Incident id: 00000000-0000-0000-0000-000000000003 type: incident_types schema: $ref: "#/components/schemas/IncidentTypeResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Get incident type details tags: - Incidents "x-permission": operator: OR permissions: - incident_read x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update an incident type. operationId: UpdateIncidentType parameters: - $ref: "#/components/parameters/IncidentTypeIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: createdBy: 00000000-0000-0000-0000-000000000000 description: "Any incidents that harm (or have the potential to) the confidentiality, integrity, or availability of our data. Note: This will notify the security team." is_default: false lastModifiedBy: 00000000-0000-0000-0000-000000000000 name: Security Incident prefix: IR id: 00000000-0000-0000-0000-000000000000 type: incident_types schema: $ref: "#/components/schemas/IncidentTypePatchRequest" description: Incident type payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: description: Any incidents that harm the confidentiality, integrity, or availability of our data. is_default: false name: Security Incident id: 00000000-0000-0000-0000-000000000004 type: incident_types schema: $ref: "#/components/schemas/IncidentTypeResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Update an incident type tags: - Incidents x-codegen-request-body-name: body "x-permission": operator: OR permissions: - incident_settings_write x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/types/{incident_type_id}/org-settings: get: description: Get the org settings for a specific incident type. operationId: GetOrgSettingsByIncidentType parameters: - $ref: "#/components/parameters/IncidentOrgSettingsTypeIDPathParameter" - description: Comma-separated list of related resources to include in the response. in: query name: include required: false schema: example: incident_type type: string responses: "200": content: application/json: examples: default: value: data: attributes: created: "2024-01-01T00:00:00.000Z" modified: "2024-01-01T00:00:00.000Z" settings: allow_anonymous_incident_declaration: false allow_guest_incident_declaration: false pagerduty_paging: true private_incidents_by_default: false id: 00000000-0000-0000-0000-000000000001 type: incident_org_settings schema: $ref: "#/components/schemas/IncidentOrgSettingsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Get org settings by incident type tags: - Incidents x-permission: operator: OR permissions: - incident_settings_read - incident_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/user-defined-fields: get: description: Get a list of all incident user-defined fields. operationId: ListIncidentUserDefinedFields parameters: - description: The number of results to return per page. Must be between 0 and 1000. in: query name: page[size] schema: default: 1000 format: int64 maximum: 1000 minimum: 0 type: integer - description: The page number to retrieve, starting at 0. in: query name: page[number] schema: default: 0 format: int64 minimum: 0 type: integer - description: When true, include soft-deleted fields in the response. in: query name: include-deleted schema: default: false type: boolean - description: Filter results to fields associated with the given incident type UUID. in: query name: filter[incident-type] schema: type: string - description: Comma-separated list of related resources to include. Supported values are "last_modified_by_user", "created_by_user", and "incident_type". in: query name: include schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: category: "what_happened" collected: "active" created: "2026-03-18T08:40:04.437887Z" default_value: deleted: display_name: "Root Cause" metadata: modified: "2026-03-18T08:40:04.437887Z" name: "root_cause" ordinal: "1.1" required: false reserved: false tag_key: type: 1 valid_values: - description: "A bug in the service code." display_name: "Service Bug" value: "service_bug" id: "6f8f42e0-6a84-4495-9a24-6decb0a87de0" relationships: created_by_user: data: id: "00000000-0000-0000-0000-000000000001" type: "users" incident_type: data: id: "7459c30c-c661-4171-9474-db3a486377b2" type: "incident_types" last_modified_by_user: data: id: "00000000-0000-0000-0000-000000000001" type: "users" type: "user_defined_field" meta: offset: 0 size: 1 schema: $ref: "#/components/schemas/IncidentUserDefinedFieldListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Get a list of incident user-defined fields tags: - Incidents x-permission: operator: AND permissions: - incident_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create an incident user-defined field. operationId: CreateIncidentUserDefinedField parameters: - description: Comma-separated list of related resources to include. Supported values are "last_modified_by_user", "created_by_user", and "incident_type". in: query name: include schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: category: what_happened collected: active default_value: critical display_name: Root Cause name: root_cause ordinal: "1.5" required: false tag_key: datacenter type: 3 valid_values: - description: A critical severity incident. display_name: Critical short_description: Critical value: critical relationships: incident_type: data: id: 00000000-0000-0000-0000-000000000000 type: incident_types type: user_defined_field schema: $ref: "#/components/schemas/IncidentUserDefinedFieldCreateRequest" description: Incident user-defined field payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: category: collected: created: "2026-03-18T08:40:05.185406Z" default_value: deleted: display_name: "Root Cause" metadata: modified: "2026-03-18T08:40:05.185406Z" name: "root_cause" ordinal: "9" required: false reserved: false tag_key: type: 3 valid_values: id: "82263487-b540-4c12-8797-58ac1d4fed17" relationships: created_by_user: data: id: "2f2c94fe-cd6e-4f8e-b9c7-d5755aca09a6" type: "users" incident_type: data: id: "7459c30c-c661-4171-9474-db3a486377b2" type: "incident_types" last_modified_by_user: data: id: "2f2c94fe-cd6e-4f8e-b9c7-d5755aca09a6" type: "users" type: "user_defined_field" schema: $ref: "#/components/schemas/IncidentUserDefinedFieldResponse" description: CREATED "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Create an incident user-defined field tags: - Incidents x-codegen-request-body-name: body x-permission: operator: AND permissions: - incident_settings_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/user-defined-fields/{field_id}: delete: description: Delete an incident user-defined field. operationId: DeleteIncidentUserDefinedField parameters: - $ref: "#/components/parameters/IncidentUserDefinedFieldIDPathParameter" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Delete an incident user-defined field tags: - Incidents x-permission: operator: AND permissions: - incident_settings_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get details of an incident user-defined field. operationId: GetIncidentUserDefinedField parameters: - $ref: "#/components/parameters/IncidentUserDefinedFieldIDPathParameter" - description: Comma-separated list of related resources to include. Supported values are "last_modified_by_user", "created_by_user", and "incident_type". in: query name: include schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: category: "what_happened" collected: "active" created: "2026-03-18T08:40:04.437887Z" default_value: deleted: display_name: "Root Cause" metadata: modified: "2026-03-18T08:40:04.437887Z" name: "root_cause" ordinal: "1.1" required: false reserved: false tag_key: type: 1 valid_values: - description: "A bug in the service code." display_name: "Service Bug" value: "service_bug" id: "6f8f42e0-6a84-4495-9a24-6decb0a87de0" relationships: created_by_user: data: id: "00000000-0000-0000-0000-000000000001" type: "users" incident_type: data: id: "7459c30c-c661-4171-9474-db3a486377b2" type: "incident_types" last_modified_by_user: data: id: "00000000-0000-0000-0000-000000000001" type: "users" type: "user_defined_field" schema: $ref: "#/components/schemas/IncidentUserDefinedFieldResponse" description: OK "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Get an incident user-defined field tags: - Incidents x-permission: operator: AND permissions: - incident_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update an incident user-defined field. operationId: UpdateIncidentUserDefinedField parameters: - $ref: "#/components/parameters/IncidentUserDefinedFieldIDPathParameter" - description: Comma-separated list of related resources to include. Supported values are "last_modified_by_user", "created_by_user", and "incident_type". in: query name: include schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: category: what_happened collected: active default_value: critical display_name: Root Cause ordinal: "1.5" required: false valid_values: - description: A critical severity incident. display_name: Critical short_description: Critical value: critical id: 00000000-0000-0000-0000-000000000000 type: user_defined_field schema: $ref: "#/components/schemas/IncidentUserDefinedFieldUpdateRequest" description: Incident user-defined field update payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: category: "what_happened" collected: created: "2026-03-18T08:39:49.913895Z" default_value: deleted: display_name: "Root Cause" metadata: modified: "2026-03-18T08:39:49.922909Z" name: "root_cause" ordinal: "8" required: false reserved: false tag_key: type: 3 valid_values: id: "13a731a3-a010-450e-b6a3-3d450a26170c" relationships: created_by_user: data: id: "8e7d4859-0916-4df8-b51c-5f5a4ea7815e" type: "users" incident_type: data: id: "95edc42f-c55d-46fa-92a1-a182646454af" type: "incident_types" last_modified_by_user: data: id: "8e7d4859-0916-4df8-b51c-5f5a4ea7815e" type: "users" type: "user_defined_field" schema: $ref: "#/components/schemas/IncidentUserDefinedFieldResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Update an incident user-defined field tags: - Incidents x-codegen-request-body-name: body x-permission: operator: AND permissions: - incident_settings_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/user-defined-roles: get: description: List all user-defined roles for incidents. operationId: ListIncidentUserDefinedRoles parameters: - description: Filter roles by incident type UUID. in: query name: filter[incident-type] required: false schema: example: "00000000-0000-0000-0000-000000000001" format: uuid type: string - description: Comma-separated list of related resources to include in the response. in: query name: include required: false schema: example: "created_by_user,last_modified_by_user,incident_type" type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created: "2024-01-01T00:00:00.000Z" description: "The technical lead for the incident." modified: "2024-01-01T00:00:00.000Z" name: "Tech Lead" policy: is_single: true id: "00000000-0000-0000-0000-000000000002" type: incident_user_defined_roles schema: $ref: "#/components/schemas/IncidentUserDefinedRolesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_read summary: List incident user-defined roles tags: - Incidents x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a new user-defined role for incidents. operationId: CreateIncidentUserDefinedRole parameters: - description: Comma-separated list of related resources to include in the response. in: query name: include required: false schema: example: "created_by_user,last_modified_by_user,incident_type" type: string requestBody: content: application/json: examples: default: value: data: attributes: description: "The technical lead for the incident." name: "Tech Lead" policy: is_single: true relationships: incident_type: data: id: "00000000-0000-0000-0000-000000000001" type: incident_types type: incident_user_defined_roles schema: $ref: "#/components/schemas/IncidentUserDefinedRoleRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created: "2024-01-01T00:00:00.000Z" description: "The technical lead for the incident." modified: "2024-01-01T00:00:00.000Z" name: "Tech Lead" policy: is_single: true id: "00000000-0000-0000-0000-000000000002" type: incident_user_defined_roles schema: $ref: "#/components/schemas/IncidentUserDefinedRoleResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Create an incident user-defined role tags: - Incidents x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/config/user-defined-roles/{role_id}: delete: description: Delete an existing user-defined role for incidents. operationId: DeleteIncidentUserDefinedRole parameters: - $ref: "#/components/parameters/IncidentUserDefinedRoleIDPathParameter" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Delete an incident user-defined role tags: - Incidents x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Retrieve a single user-defined role for incidents. operationId: GetIncidentUserDefinedRole parameters: - $ref: "#/components/parameters/IncidentUserDefinedRoleIDPathParameter" - description: Comma-separated list of related resources to include in the response. in: query name: include required: false schema: example: "created_by_user,last_modified_by_user,incident_type" type: string responses: "200": content: application/json: examples: default: value: data: attributes: created: "2024-01-01T00:00:00.000Z" description: "The technical lead for the incident." modified: "2024-01-01T00:00:00.000Z" name: "Tech Lead" policy: is_single: true id: "00000000-0000-0000-0000-000000000002" type: incident_user_defined_roles schema: $ref: "#/components/schemas/IncidentUserDefinedRoleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_read summary: Get an incident user-defined role tags: - Incidents x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update an existing user-defined role for incidents. operationId: UpdateIncidentUserDefinedRole parameters: - $ref: "#/components/parameters/IncidentUserDefinedRoleIDPathParameter" - description: Comma-separated list of related resources to include in the response. in: query name: include required: false schema: example: "created_by_user,last_modified_by_user,incident_type" type: string requestBody: content: application/json: examples: default: value: data: attributes: name: "Updated Tech Lead" id: "00000000-0000-0000-0000-000000000002" type: incident_user_defined_roles schema: $ref: "#/components/schemas/IncidentUserDefinedRolePatchRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created: "2024-01-01T00:00:00.000Z" modified: "2024-01-02T00:00:00.000Z" name: "Updated Tech Lead" policy: is_single: true id: "00000000-0000-0000-0000-000000000002" type: incident_user_defined_roles schema: $ref: "#/components/schemas/IncidentUserDefinedRoleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Update an incident user-defined role tags: - Incidents x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/import: post: description: |- Import an incident from an external system. This endpoint allows you to create incidents with historical data such as custom timestamps for detection, declaration, and resolution. Imported incidents do not execute integrations or notification rules. operationId: ImportIncident parameters: - $ref: "#/components/parameters/IncidentImportIncludeQueryParameter" requestBody: content: application/json: examples: default: value: data: attributes: declared: "2025-01-01T00:00:00Z" detected: "2025-01-01T00:00:00Z" fields: severity: value: SEV-5 state: value: active incident_type_uuid: 00000000-0000-0000-0000-000000000000 resolved: "2025-01-01T01:00:00Z" title: Imported incident from external system visibility: organization relationships: commander_user: data: id: 00000000-0000-0000-0000-000000000000 type: users declared_by_user: data: id: 00000000-0000-0000-0000-000000000000 type: users type: incidents schema: $ref: "#/components/schemas/IncidentImportRequest" description: Incident import payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: created: "2024-01-01T00:00:00+00:00" fields: severity: value: SEV-5 state: value: active modified: "2024-01-01T00:00:00+00:00" title: Imported incident from external system id: "00000000-0000-0000-1234-000000000000" type: incidents schema: $ref: "#/components/schemas/IncidentImportResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Import an incident tags: - Incidents x-codegen-request-body-name: body "x-permission": operator: AND permissions: - incident_write x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/search: get: description: >- Search for incidents matching a certain query. operationId: SearchIncidents parameters: - $ref: "#/components/parameters/IncidentSearchIncludeQueryParameter" - $ref: "#/components/parameters/IncidentSearchQueryQueryParameter" - $ref: "#/components/parameters/IncidentSearchSortQueryParameter" - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageOffset" responses: "200": content: application/json: examples: default: value: data: attributes: facets: severity: [] state: [] incidents: [] total: 0 type: incidents_search_results schema: $ref: "#/components/schemas/IncidentSearchResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Search for incidents tags: - Incidents x-pagination: limitParam: page[size] pageOffsetParam: page[offset] resultsPath: data.attributes.incidents "x-permission": operator: OR permissions: - incident_read x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/{incident_id}: delete: description: Deletes an existing incident from the users organization. operationId: DeleteIncident parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Delete an existing incident tags: - Incidents "x-permission": operator: OR permissions: - incident_write x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: >- Get the details of an incident by `incident_id`. operationId: GetIncident parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/IncidentIncludeQueryParameter" responses: "200": content: application/json: examples: default: value: data: attributes: created: "2024-01-01T00:00:00+00:00" customer_impacted: false fields: severity: type: dropdown value: SEV-5 modified: "2024-01-01T00:00:00+00:00" title: A test incident title id: "00000000-0000-0000-1234-000000000000" type: incidents schema: $ref: "#/components/schemas/IncidentResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Get the details of an incident tags: - Incidents "x-permission": operator: OR permissions: - incident_read x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: >- Updates an incident. Provide only the attributes that should be updated as this request is a partial update. operationId: UpdateIncident parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/IncidentIncludeQueryParameter" requestBody: content: application/json: examples: default: value: data: attributes: customer_impact_scope: Example customer impact scope customer_impacted: false fields: severity: type: dropdown value: SEV-5 notification_handles: - display_name: Jane Doe handle: "@user@email.com" - display_name: Slack Channel handle: "@slack-channel" - display_name: Incident Workflow handle: "@workflow-from-incident" title: A test incident title id: 00000000-0000-0000-4567-000000000000 relationships: commander_user: data: id: 00000000-0000-0000-0000-000000000000 type: users integrations: data: - id: 00000000-abcd-0005-0000-000000000000 type: incident_integrations - id: 00000000-abcd-0006-0000-000000000000 type: incident_integrations postmortem: data: id: 00000000-0000-abcd-3000-000000000000 type: incident_postmortems type: incidents schema: $ref: "#/components/schemas/IncidentUpdateRequest" description: Incident Payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created: "2024-01-01T00:00:00+00:00" customer_impacted: false fields: severity: type: dropdown value: SEV-5 modified: "2024-01-01T00:00:00+00:00" title: A test incident title id: "00000000-0000-0000-1234-000000000000" type: incidents schema: $ref: "#/components/schemas/IncidentResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Update an existing incident tags: - Incidents x-codegen-request-body-name: body "x-permission": operator: OR permissions: - incident_write x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/{incident_id}/ai/postmortem: post: description: Generate an AI postmortem for an incident. operationId: GetIncidentAIPostmortem parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: action_items: "1. Improve failover testing." customer_impact: "5% of users experienced timeouts for 30 minutes." executive_summary: "A database failover caused a 30-minute service outage." key_timeline: "10:00 - Alert fired. 10:30 - Issue resolved." lessons_learned: "We need to test the failover process under realistic load." system_overview: "The primary database cluster experienced a failover event." id: 00000000-0000-0000-0000-000000000000 type: get_incident_ai_postmortem_response schema: $ref: "#/components/schemas/IncidentAIPostmortemResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Get an AI-generated incident postmortem tags: - Incidents x-permission: operator: OR permissions: - incident_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/{incident_id}/attachments: get: description: List incident attachments. operationId: ListIncidentAttachments parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - description: Filter attachments by type. Supported values are `1` (`postmortem`) and `2` (`link`). in: query name: filter[attachment_type] schema: example: "1" type: string - $ref: "#/components/parameters/AttachmentIncludeQueryParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: attachment: documentUrl: "https://app.datadoghq.com/notebook/123/Postmortem-IR-123" title: Postmortem IR-123 attachment_type: postmortem modified: "2024-01-01T00:00:00+00:00" id: 00000000-abcd-0002-0000-000000000000 relationships: incident: data: id: 00000000-0000-0000-1234-000000000000 type: incidents type: incident_attachments schema: $ref: "#/components/schemas/AttachmentArray" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List incident attachments tags: - Incidents "x-permission": operator: OR permissions: - incident_read x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create an incident attachment. operationId: CreateIncidentAttachment parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/AttachmentIncludeQueryParameter" requestBody: content: application/json: examples: default: value: data: attributes: attachment: documentUrl: https://app.datadoghq.com/notebook/123/Postmortem-IR-123 title: Postmortem-IR-123 attachment_type: postmortem type: incident_attachments schema: $ref: "#/components/schemas/CreateAttachmentRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: attachment: documentUrl: "https://app.datadoghq.com/notebook/123/Postmortem-IR-123" title: Postmortem IR-123 attachment_type: postmortem modified: "2024-01-01T00:00:00+00:00" id: 00000000-abcd-0002-0000-000000000000 relationships: incident: data: id: 00000000-0000-0000-1234-000000000000 type: incidents type: incident_attachments schema: $ref: "#/components/schemas/Attachment" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Create incident attachment tags: - Incidents "x-permission": operator: AND permissions: - incident_write x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/{incident_id}/attachments/postmortems: post: description: |- Create a postmortem attachment for an incident. The endpoint accepts markdown for notebooks created in Confluence or Google Docs. Postmortems created from notebooks need to be formatted using frontend notebook cells, in addition to markdown format. operationId: CreateIncidentPostmortemAttachment parameters: - description: The ID of the incident in: path name: incident_id required: true schema: example: "00000000-0000-0000-0000-000000000000" type: string requestBody: content: application/json: examples: default: value: data: attributes: cells: - id: cell-1 type: markdown content: "# Incident Report - IR-123\n[...]" postmortem_template_id: 93645509-874e-45c4-adfa-623bfeaead89-123 title: Postmortem-IR-123 type: incident_attachments schema: $ref: "#/components/schemas/PostmortemAttachmentRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: attachment: documentUrl: "https://app.datadoghq.com/notebook/123/Postmortem-IR-123" title: Postmortem IR-123 attachment_type: postmortem modified: "2024-01-01T00:00:00+00:00" id: 00000000-abcd-0002-0000-000000000000 relationships: incident: data: id: 00000000-0000-0000-1234-000000000000 type: incidents type: incident_attachments schema: $ref: "#/components/schemas/Attachment" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create postmortem attachment tags: - Incidents x-unstable: |- **Note**: This endpoint is in public beta and it's subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/{incident_id}/attachments/{attachment_id}: delete: operationId: DeleteIncidentAttachment parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/AttachmentIDPathParameter" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Delete incident attachment tags: - Incidents "x-permission": operator: AND permissions: - incident_write x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: operationId: UpdateIncidentAttachment parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/AttachmentIDPathParameter" - $ref: "#/components/parameters/AttachmentIncludeQueryParameter" requestBody: content: application/json: examples: default: value: data: attributes: attachment: documentUrl: https://app.datadoghq.com/notebook/124/Postmortem-IR-124 title: Postmortem-IR-124 id: 00000000-abcd-0002-0000-000000000000 type: incident_attachments schema: $ref: "#/components/schemas/PatchAttachmentRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: attachment: documentUrl: "https://app.datadoghq.com/notebook/124/Postmortem-IR-124" title: Postmortem IR-124 attachment_type: postmortem modified: "2024-01-01T00:00:00+00:00" id: 00000000-abcd-0002-0000-000000000000 relationships: incident: data: id: 00000000-0000-0000-1234-000000000000 type: incidents type: incident_attachments schema: $ref: "#/components/schemas/Attachment" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Update incident attachment tags: - Incidents "x-permission": operator: AND permissions: - incident_write x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/{incident_id}/cases/page: post: deprecated: true description: |- Create a page from an incident using the Cases service. **Deprecated**: This endpoint is deprecated. Use [Create an on-call page from an incident](#create-an-on-call-page-from-an-incident) instead. operationId: CreatePageFromIncident parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: description: A critical incident affecting production systems. services: - web-store tags: - env:prod target: identifier: my-oncall-team type: team_handle title: Production outage - SEV-1 type: page schema: $ref: "#/components/schemas/IncidentCreatePageFromIncidentRequest" description: Page creation payload. required: true responses: "200": content: application/json: examples: default: value: data: id: 00000000-0000-0000-0000-000000000001 type: page_uuid schema: $ref: "#/components/schemas/IncidentPageUUIDResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Create a page from an incident tags: - Incidents x-codegen-request-body-name: body x-permission: operator: AND permissions: - oncall_page - incident_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/{incident_id}/configurations: patch: description: Update a configuration for an incident. operationId: UpdateIncidentConfiguration parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: include_in_search: false id: 00000000-0000-0000-0000-000000000001 type: incidents_configurations schema: $ref: "#/components/schemas/IncidentConfigurationPatchRequest" description: Incident configuration patch payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00.000Z" execute_integrations: true execute_notification_rules: true incident_id: 00000000-0000-0000-0000-000000000000 include_in_analytics: true include_in_search: false modified_at: "2024-01-02T00:00:00.000Z" id: 00000000-0000-0000-0000-000000000001 type: incidents_configurations schema: $ref: "#/components/schemas/IncidentConfigurationResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Update an incident configuration tags: - Incidents x-codegen-request-body-name: body x-permission: operator: OR permissions: - incident_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a configuration for an incident. operationId: CreateIncidentConfiguration parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: execute_integrations: true execute_notification_rules: true include_in_analytics: true include_in_search: true type: incidents_configurations schema: $ref: "#/components/schemas/IncidentConfigurationRequest" description: Incident configuration payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00.000Z" execute_integrations: true execute_notification_rules: true incident_id: 00000000-0000-0000-0000-000000000000 include_in_analytics: true include_in_search: true modified_at: "2024-01-01T00:00:00.000Z" id: 00000000-0000-0000-0000-000000000001 type: incidents_configurations schema: $ref: "#/components/schemas/IncidentConfigurationResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Create an incident configuration tags: - Incidents x-codegen-request-body-name: body x-permission: operator: OR permissions: - incident_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/{incident_id}/impacts: get: description: Get all impacts for an incident. operationId: ListIncidentImpacts parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/IncidentImpactIncludeQueryParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: description: "Service was unavailable for external users" end_at: "2024-01-01T01:00:00+00:00" start_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000001 type: incident_impacts schema: $ref: "#/components/schemas/IncidentImpactsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: List an incident's impacts tags: - Incidents "x-permission": operator: OR permissions: - incident_read post: description: Create an impact for an incident. operationId: CreateIncidentImpact parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/IncidentImpactIncludeQueryParameter" requestBody: content: application/json: examples: default: value: data: attributes: description: Service was unavailable for external users end_at: "2025-08-29T13:17:00Z" fields: customers_impacted: all products_impacted: - shopping - marketing start_at: "2025-08-28T13:17:00Z" type: incident_impacts schema: $ref: "#/components/schemas/IncidentImpactCreateRequest" description: Incident impact payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: description: "Service was unavailable for external users" end_at: "2024-01-01T01:00:00+00:00" start_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000002 type: incident_impacts schema: $ref: "#/components/schemas/IncidentImpactResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Create an incident impact tags: - Incidents x-codegen-request-body-name: body "x-permission": operator: OR permissions: - incident_write /api/v2/incidents/{incident_id}/impacts/{impact_id}: delete: description: Delete an incident impact. operationId: DeleteIncidentImpact parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/IncidentImpactIDPathParameter" responses: "204": description: No Content "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Delete an incident impact tags: - Incidents "x-permission": operator: OR permissions: - incident_write patch: description: Update an incident impact. operationId: PatchIncidentImpact parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/IncidentImpactIDPathParameter" - $ref: "#/components/parameters/IncidentImpactIncludeQueryParameter" requestBody: content: application/json: examples: default: value: data: attributes: description: Patched service impact description type: incident_impacts schema: $ref: "#/components/schemas/IncidentImpactPatchRequest" description: Incident impact patch payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: description: Patched service impact description start_at: "2025-08-28T13:17:00Z" id: 00000000-0000-0000-0000-000000000002 type: incident_impacts schema: $ref: "#/components/schemas/IncidentImpactResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Update an incident impact tags: - Incidents x-codegen-request-body-name: body x-permission: operator: OR permissions: - incident_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/{incident_id}/page: post: description: Create an on-call page directly from an incident. operationId: CreateOnCallPageFromIncident parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: description: A critical incident affecting production systems. services: - web-store target: identifier: my-oncall-team type: team_handle title: Production outage - SEV-1 type: page schema: $ref: "#/components/schemas/IncidentCreateOnCallPageRequest" description: On-call page creation payload. required: true responses: "200": content: application/json: examples: default: value: data: id: 00000000-0000-0000-0000-000000000001 type: page_uuid schema: $ref: "#/components/schemas/IncidentPageUUIDResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Create an on-call page from an incident tags: - Incidents x-codegen-request-body-name: body x-permission: operator: AND permissions: - oncall_page - incident_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/{incident_id}/pages/link: post: description: Link an existing on-call page to an incident. operationId: LinkPageToIncident parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: key: PAGE-12345 page_target: identifier: my-oncall-team type: team_handle id: PAGE-12345 type: page schema: $ref: "#/components/schemas/IncidentOnCallPageLinkRequest" description: On-call page link payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: integration_type: 15 status: 2 id: 00000000-0000-0000-0000-000000000001 type: incident_integrations schema: $ref: "#/components/schemas/IncidentIntegrationMetadataResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict - page already linked to incident. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Link a page to an incident tags: - Incidents x-codegen-request-body-name: body x-permission: operator: OR permissions: - incident_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/{incident_id}/relationships/integrations: get: description: Get all integration metadata for an incident. operationId: ListIncidentIntegrations parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: incident_id: 00000000-aaaa-0000-0000-000000000000 integration_type: 8 metadata: issues: - account: https://example.atlassian.net project_key: PROJ id: 00000000-0000-0000-1234-000000000000 type: incident_integrations schema: $ref: "#/components/schemas/IncidentIntegrationMetadataListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Get a list of an incident's integration metadata tags: - Incidents "x-permission": operator: OR permissions: - incident_read x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create an incident integration metadata. operationId: CreateIncidentIntegration parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: incident_id: 00000000-aaaa-0000-0000-000000000000 integration_type: 1 metadata: channels: - channel_id: C0123456789 channel_name: "#new-channel" redirect_url: https://slack.com/app_redirect?channel=C0123456789&team=T01234567 team_id: T01234567 type: incident_integrations schema: $ref: "#/components/schemas/IncidentIntegrationMetadataCreateRequest" description: Incident integration metadata payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: incident_id: 00000000-aaaa-0000-0000-000000000000 integration_type: 8 metadata: issues: - account: https://example.atlassian.net project_key: PROJ id: 00000000-0000-0000-1234-000000000000 type: incident_integrations schema: $ref: "#/components/schemas/IncidentIntegrationMetadataResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Create an incident integration metadata tags: - Incidents x-codegen-request-body-name: body "x-permission": operator: OR permissions: - incident_write x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/{incident_id}/relationships/integrations/{integration_metadata_id}: delete: description: Delete an incident integration metadata. operationId: DeleteIncidentIntegration parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/IncidentIntegrationMetadataIDPathParameter" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Delete an incident integration metadata tags: - Incidents x-codegen-request-body-name: body x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get incident integration metadata details. operationId: GetIncidentIntegration parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/IncidentIntegrationMetadataIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: incident_id: 00000000-aaaa-0000-0000-000000000000 integration_type: 8 metadata: issues: - account: https://example.atlassian.net project_key: PROJ id: 00000000-0000-0000-1234-000000000000 type: incident_integrations schema: $ref: "#/components/schemas/IncidentIntegrationMetadataResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Get incident integration metadata details tags: - Incidents x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update an existing incident integration metadata. operationId: UpdateIncidentIntegration parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/IncidentIntegrationMetadataIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: incident_id: 00000000-aaaa-0000-0000-000000000000 integration_type: 1 metadata: channels: - channel_id: C0123456789 channel_name: "#updated-channel-name" redirect_url: https://slack.com/app_redirect?channel=C0123456789&team=T01234567 team_id: T01234567 type: incident_integrations schema: $ref: "#/components/schemas/IncidentIntegrationMetadataPatchRequest" description: Incident integration metadata payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: incident_id: 00000000-aaaa-0000-0000-000000000000 integration_type: 8 metadata: issues: - account: https://example.atlassian.net issue_key: PROJ-123 project_key: PROJ id: 00000000-0000-0000-1234-000000000000 type: incident_integrations schema: $ref: "#/components/schemas/IncidentIntegrationMetadataResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Update an existing incident integration metadata tags: - Incidents x-codegen-request-body-name: body x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/{incident_id}/relationships/todos: get: description: Get all todos for an incident. operationId: ListIncidentTodos parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: assignees: - "@test.user@example.com" content: Restore lost data. id: 00000000-0000-0000-0000-000000000002 type: incident_todos schema: $ref: "#/components/schemas/IncidentTodoListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Get a list of an incident's todos tags: - Incidents "x-permission": operator: OR permissions: - incident_read x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create an incident todo. operationId: CreateIncidentTodo parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: assignees: - "@test.user@test.com" completed: "2023-03-06T22:00:00.000000+00:00" content: Restore lost data. due_date: "2023-07-10T05:00:00.000000+00:00" incident_id: 00000000-aaaa-0000-0000-000000000000 type: incident_todos schema: $ref: "#/components/schemas/IncidentTodoCreateRequest" description: Incident todo payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: assignees: - "@test.user@example.com" content: Restore lost data. id: 00000000-0000-0000-0000-000000000001 type: incident_todos schema: $ref: "#/components/schemas/IncidentTodoResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Create an incident todo tags: - Incidents x-codegen-request-body-name: body "x-permission": operator: OR permissions: - incident_write x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/{incident_id}/relationships/todos/{todo_id}: delete: description: Delete an incident todo. operationId: DeleteIncidentTodo parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/IncidentTodoIDPathParameter" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Delete an incident todo tags: - Incidents "x-permission": operator: OR permissions: - incident_write x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get incident todo details. operationId: GetIncidentTodo parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/IncidentTodoIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: assignees: - "@test.user@example.com" content: Restore lost data. id: 00000000-0000-0000-0000-000000000003 type: incident_todos schema: $ref: "#/components/schemas/IncidentTodoResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Get incident todo details tags: - Incidents "x-permission": operator: OR permissions: - incident_read x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update an incident todo. operationId: UpdateIncidentTodo parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/IncidentTodoIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: assignees: - "@test.user@test.com" completed: "2023-03-06T22:00:00.000000+00:00" content: Restore lost data. due_date: "2023-07-10T05:00:00.000000+00:00" incident_id: 00000000-aaaa-0000-0000-000000000000 type: incident_todos schema: $ref: "#/components/schemas/IncidentTodoPatchRequest" description: Incident todo payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: assignees: - "@test.user@example.com" content: Restore lost data. id: 00000000-0000-0000-0000-000000000004 type: incident_todos schema: $ref: "#/components/schemas/IncidentTodoResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Update an incident todo tags: - Incidents x-codegen-request-body-name: body "x-permission": operator: OR permissions: - incident_write x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/{incident_id}/responders: get: description: List all responders for an incident. operationId: ListIncidentResponders parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/IncidentResponderIncludeQueryParameter" - $ref: "#/components/parameters/IncidentResponderPageLimitParameter" - $ref: "#/components/parameters/IncidentResponderPageOffsetParameter" responses: "200": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/IncidentRespondersResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: List incident responders tags: - Incidents x-permission: operator: OR permissions: - incident_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Add a responder to an incident. operationId: CreateIncidentResponder parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" requestBody: content: application/json: examples: default: value: data: relationships: user: data: id: 00000000-0000-0000-0000-000000000001 type: users type: incident_responders schema: $ref: "#/components/schemas/IncidentResponderRequest" description: Incident responder payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: created: "2024-01-01T00:00:00.000Z" is_billable: true modified: "2024-01-01T00:00:00.000Z" id: 00000000-0000-0000-0000-000000000002 type: incident_responders schema: $ref: "#/components/schemas/IncidentResponderResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Create an incident responder tags: - Incidents x-codegen-request-body-name: body x-permission: operator: OR permissions: - incident_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/{incident_id}/responders/{responder_id}: delete: description: Remove a responder from an incident. operationId: DeleteIncidentResponder parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/IncidentResponderIDPathParameter" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Delete an incident responder tags: - Incidents x-permission: operator: OR permissions: - incident_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a single responder for an incident. operationId: GetIncidentResponder parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/IncidentResponderIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: created: "2024-01-01T00:00:00.000Z" is_billable: true modified: "2024-01-01T00:00:00.000Z" id: 00000000-0000-0000-0000-000000000002 type: incident_responders schema: $ref: "#/components/schemas/IncidentResponderResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: Get an incident responder tags: - Incidents x-permission: operator: OR permissions: - incident_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/{incident_id}/servicenow-records: post: description: Create a ServiceNow record for an incident. operationId: CreateIncidentServiceNowRecord parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: assignment_group: IT Support configuration_item_mapping: my-service instance_name: my-instance type: incident_servicenow_record_prompt schema: $ref: "#/components/schemas/IncidentServiceNowRecordRequest" description: ServiceNow record payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: incident_id: 00000000-0000-0000-0000-000000000000 integration_type: 13 metadata: records: - instance_name: my-instance record_num: INC0001234 redirect_url: https://my-instance.service-now.com/nav_to.do?uri=incident.do?sys_id=abc123 status: 2 id: 00000000-0000-0000-0000-000000000001 type: incident_integrations schema: $ref: "#/components/schemas/IncidentIntegrationMetadataResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Create an incident ServiceNow record tags: - Incidents x-codegen-request-body-name: body x-permission: operator: OR permissions: - incident_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/{incident_id}/timestamp-overrides: get: description: List all timestamp overrides for an incident. operationId: ListTimestampOverrides parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" responses: "200": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/IncidentTimestampOverridesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_read summary: List incident timestamp overrides tags: - Incidents x-permission: operator: OR permissions: - incident_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a timestamp override for an incident. operationId: CreateTimestampOverride parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: timestamp_type: detected timestamp_value: "2024-01-01T10:00:00.000Z" type: incidents_timestamp_overrides schema: $ref: "#/components/schemas/IncidentTimestampOverrideRequest" description: Timestamp override payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00.000Z" incident_id: 00000000-0000-0000-0000-000000000000 modified_at: "2024-01-01T00:00:00.000Z" timestamp_type: detected timestamp_value: "2024-01-01T10:00:00.000Z" id: 00000000-0000-0000-0000-000000000001 type: incidents_timestamp_overrides schema: $ref: "#/components/schemas/IncidentTimestampOverrideResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Create an incident timestamp override tags: - Incidents x-codegen-request-body-name: body x-permission: operator: OR permissions: - incident_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/incidents/{incident_id}/timestamp-overrides/{id}: delete: description: Delete a timestamp override for an incident. operationId: DeleteTimestampOverride parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/IncidentTimestampOverrideIDPathParameter" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Delete an incident timestamp override tags: - Incidents x-permission: operator: OR permissions: - incident_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update a timestamp override for an incident. operationId: UpdateTimestampOverride parameters: - $ref: "#/components/parameters/IncidentIDPathParameter" - $ref: "#/components/parameters/IncidentTimestampOverrideIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: timestamp_value: "2024-01-01T11:00:00.000Z" id: 00000000-0000-0000-0000-000000000001 type: incidents_timestamp_overrides schema: $ref: "#/components/schemas/IncidentTimestampOverridePatchRequest" description: Timestamp override patch payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00.000Z" incident_id: 00000000-0000-0000-0000-000000000000 modified_at: "2024-01-02T00:00:00.000Z" timestamp_type: detected timestamp_value: "2024-01-01T11:00:00.000Z" id: 00000000-0000-0000-0000-000000000001 type: incidents_timestamp_overrides schema: $ref: "#/components/schemas/IncidentTimestampOverrideResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Update an incident timestamp override tags: - Incidents x-codegen-request-body-name: body x-permission: operator: OR permissions: - incident_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/integration-interfaces/databricks/accounts: get: description: List Databricks integration accounts. operationId: ListDatabricksIntegrationAccounts responses: "200": content: application/json: examples: default: value: data: - attributes: authentication: auth_type: databricks_oauth client_id: 5c10654a-b3a3-4840-b37f-f477590c70a0 dataflows: databricks-cloud-cost-metrics: enabled: true settings: ccm_collect_all_workspaces: true databricks-data-observability-jobs-monitoring: enabled: true settings: dd_api_key_id: fe383f4e-09fc-46bf-8e10-4efdd453a646 djm_global_init_script_enabled: true script_gpum_enabled: false script_logs_enabled: true serverless_jobs_enabled: true databricks-data-observability-quality-monitoring: enabled: true settings: do_crawlers_cron: "0 * * * *" sync_system_catalog: true databricks-model-serving-metrics: enabled: false name: My Databricks Workspace settings: system_tables_sql_warehouse_id: aba7c023d4172910 workspace_url: "https://dbc-1234abcd.cloud.databricks.com" id: a9a69c2e-4f8d-4e42-9c1a-2a7a2d3b7c6f type: integration-account schema: $ref: "#/components/schemas/DatabricksIntegrationAccountsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Databricks integration accounts tags: - Databricks Integration "x-permission": operator: OR permissions: - integrations_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a Databricks integration account. operationId: CreateDatabricksIntegrationAccount requestBody: content: application/json: schema: $ref: "#/components/schemas/DatabricksIntegrationAccountCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: authentication: auth_type: databricks_oauth client_id: 5c10654a-b3a3-4840-b37f-f477590c70a0 dataflows: databricks-cloud-cost-metrics: enabled: true settings: ccm_collect_all_workspaces: true databricks-data-observability-jobs-monitoring: enabled: true settings: dd_api_key_id: fe383f4e-09fc-46bf-8e10-4efdd453a646 djm_global_init_script_enabled: true script_gpum_enabled: false script_logs_enabled: true serverless_jobs_enabled: true databricks-data-observability-quality-monitoring: enabled: true settings: do_crawlers_cron: "0 * * * *" sync_system_catalog: true databricks-model-serving-metrics: enabled: false name: My Databricks Workspace settings: system_tables_sql_warehouse_id: aba7c023d4172910 workspace_url: "https://dbc-1234abcd.cloud.databricks.com" id: a9a69c2e-4f8d-4e42-9c1a-2a7a2d3b7c6f type: integration-account schema: $ref: "#/components/schemas/DatabricksIntegrationAccountResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": $ref: "#/components/responses/UnprocessableEntityResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a Databricks integration account tags: - Databricks Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/integration-interfaces/databricks/accounts/{account_id}: delete: description: Delete a Databricks integration account. operationId: DeleteDatabricksIntegrationAccount parameters: - $ref: "#/components/parameters/IntegrationAccountIdParameter" responses: "200": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a Databricks integration account tags: - Databricks Integration "x-permission": operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a Databricks integration account. operationId: GetDatabricksIntegrationAccount parameters: - $ref: "#/components/parameters/IntegrationAccountIdParameter" responses: "200": content: application/json: examples: default: value: data: attributes: authentication: auth_type: databricks_oauth client_id: 5c10654a-b3a3-4840-b37f-f477590c70a0 dataflows: databricks-cloud-cost-metrics: enabled: true settings: ccm_collect_all_workspaces: true databricks-data-observability-jobs-monitoring: enabled: true settings: dd_api_key_id: fe383f4e-09fc-46bf-8e10-4efdd453a646 djm_global_init_script_enabled: true script_gpum_enabled: false script_logs_enabled: true serverless_jobs_enabled: true databricks-data-observability-quality-monitoring: enabled: true settings: do_crawlers_cron: "0 * * * *" sync_system_catalog: true databricks-model-serving-metrics: enabled: false name: My Databricks Workspace settings: system_tables_sql_warehouse_id: aba7c023d4172910 workspace_url: "https://dbc-1234abcd.cloud.databricks.com" id: a9a69c2e-4f8d-4e42-9c1a-2a7a2d3b7c6f type: integration-account schema: $ref: "#/components/schemas/DatabricksIntegrationAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a Databricks integration account tags: - Databricks Integration "x-permission": operator: OR permissions: - integrations_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update a Databricks integration account. Only the fields provided are changed. operationId: UpdateDatabricksIntegrationAccount parameters: - $ref: "#/components/parameters/IntegrationAccountIdParameter" requestBody: content: application/json: schema: $ref: "#/components/schemas/DatabricksIntegrationAccountUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: authentication: auth_type: databricks_oauth client_id: 5c10654a-b3a3-4840-b37f-f477590c70a0 dataflows: databricks-cloud-cost-metrics: enabled: true settings: ccm_collect_all_workspaces: true databricks-data-observability-jobs-monitoring: enabled: true settings: dd_api_key_id: fe383f4e-09fc-46bf-8e10-4efdd453a646 djm_global_init_script_enabled: true script_gpum_enabled: false script_logs_enabled: true serverless_jobs_enabled: true databricks-data-observability-quality-monitoring: enabled: true settings: do_crawlers_cron: "0 * * * *" sync_system_catalog: true databricks-model-serving-metrics: enabled: false name: My Databricks Workspace settings: system_tables_sql_warehouse_id: aba7c023d4172910 workspace_url: "https://dbc-1234abcd.cloud.databricks.com" id: a9a69c2e-4f8d-4e42-9c1a-2a7a2d3b7c6f type: integration-account schema: $ref: "#/components/schemas/DatabricksIntegrationAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": $ref: "#/components/responses/UnprocessableEntityResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a Databricks integration account tags: - Databricks Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/integration-interfaces/elastic-cloud/accounts: get: description: List Elastic Cloud integration accounts. operationId: ListElasticCloudIntegrationAccounts responses: "200": content: application/json: examples: default: value: data: - attributes: authentication: auth_type: basic username: datadog dataflows: elastic-cloud-metrics: enabled: true status: health: DATAFLOW_HEALTH_OK updated_at: "2026-06-25T08:30:50Z" elastic-cloud-primary-shard-stats: enabled: false name: elastic-cloud-prod settings: tags: "env:prod,team:saasint" url: "https://example.es.us-central1.gcp.cloud.es.io:9243" id: 953a0060-81ec-4221-aed4-d4733b59cd96 type: integration-account schema: $ref: "#/components/schemas/ElasticCloudIntegrationAccountsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Elastic Cloud integration accounts tags: - Elastic Cloud Integration "x-permission": operator: OR permissions: - integrations_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create an Elastic Cloud integration account. operationId: CreateElasticCloudIntegrationAccount requestBody: content: application/json: schema: $ref: "#/components/schemas/ElasticCloudIntegrationAccountCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: authentication: auth_type: basic username: datadog dataflows: elastic-cloud-metrics: enabled: true status: health: DATAFLOW_HEALTH_OK updated_at: "2026-06-25T08:30:50Z" elastic-cloud-primary-shard-stats: enabled: false name: elastic-cloud-prod settings: tags: "env:prod,team:saasint" url: "https://example.es.us-central1.gcp.cloud.es.io:9243" id: 953a0060-81ec-4221-aed4-d4733b59cd96 type: integration-account schema: $ref: "#/components/schemas/ElasticCloudIntegrationAccountResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": $ref: "#/components/responses/UnprocessableEntityResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create an Elastic Cloud integration account tags: - Elastic Cloud Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/integration-interfaces/elastic-cloud/accounts/{account_id}: delete: description: Delete an Elastic Cloud integration account. operationId: DeleteElasticCloudIntegrationAccount parameters: - $ref: "#/components/parameters/IntegrationAccountIdParameter" responses: "200": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an Elastic Cloud integration account tags: - Elastic Cloud Integration "x-permission": operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get an Elastic Cloud integration account. operationId: GetElasticCloudIntegrationAccount parameters: - $ref: "#/components/parameters/IntegrationAccountIdParameter" responses: "200": content: application/json: examples: default: value: data: attributes: authentication: auth_type: basic username: datadog dataflows: elastic-cloud-metrics: enabled: true status: health: DATAFLOW_HEALTH_OK updated_at: "2026-06-25T08:30:50Z" elastic-cloud-primary-shard-stats: enabled: false name: elastic-cloud-prod settings: tags: "env:prod,team:saasint" url: "https://example.es.us-central1.gcp.cloud.es.io:9243" id: 953a0060-81ec-4221-aed4-d4733b59cd96 type: integration-account schema: $ref: "#/components/schemas/ElasticCloudIntegrationAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get an Elastic Cloud integration account tags: - Elastic Cloud Integration "x-permission": operator: OR permissions: - integrations_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update an Elastic Cloud integration account. Only the fields provided are changed. operationId: UpdateElasticCloudIntegrationAccount parameters: - $ref: "#/components/parameters/IntegrationAccountIdParameter" requestBody: content: application/json: schema: $ref: "#/components/schemas/ElasticCloudIntegrationAccountUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: authentication: auth_type: basic username: datadog dataflows: elastic-cloud-metrics: enabled: true status: health: DATAFLOW_HEALTH_OK updated_at: "2026-06-25T08:30:50Z" elastic-cloud-primary-shard-stats: enabled: false name: elastic-cloud-prod settings: tags: "env:prod,team:saasint" url: "https://example.es.us-central1.gcp.cloud.es.io:9243" id: 953a0060-81ec-4221-aed4-d4733b59cd96 type: integration-account schema: $ref: "#/components/schemas/ElasticCloudIntegrationAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": $ref: "#/components/responses/UnprocessableEntityResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update an Elastic Cloud integration account tags: - Elastic Cloud Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/integration-interfaces/snowflake/accounts: get: description: List Snowflake integration accounts. operationId: ListSnowflakeIntegrationAccounts responses: "200": content: application/json: examples: default: value: data: - attributes: authentication: auth_type: snowflake_private_key private_key_name: my-rsa-key dataflows: snowflake-account-usage-metrics: enabled: true settings: account_usage_metrics_aggregate_last_24h: false snowflake-cloud-cost-metrics: enabled: true settings: query_tags: env,team,cost_center snowflake-data-observability-quality-monitoring: enabled: true settings: do_table_crawler_cron: "0 */6 * * *" sync_snowflake_system_database: true snowflake-event-table-logs: enabled: true settings: event_table_events_enabled: true event_table_logs_enabled: true event_table_logs_interval_min: 15 event_table_span_events_enabled: false event_table_spans_enabled: false snowflake-organization-usage-metrics: enabled: true settings: organization_usage_metrics_aggregate_last_24h: false snowflake-query-history-logs: enabled: true settings: join_query_history_with_access_history_enabled: true query_history_logs_interval_min: 15 snowflake-security-logs: enabled: true settings: security_logs_interval_min: 60 snowflake-task-history-logs: enabled: true settings: task_history_logs_interval_min: 30 name: prod-snowflake settings: snowflake_account_identifier: myorg-myaccount username: datadog_user id: a1b2c3d4-e5f6-7890-abcd-ef1234567890 type: integration-account schema: $ref: "#/components/schemas/SnowflakeIntegrationAccountsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Snowflake integration accounts tags: - Snowflake Integration "x-permission": operator: OR permissions: - integrations_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a Snowflake integration account. operationId: CreateSnowflakeIntegrationAccount requestBody: content: application/json: schema: $ref: "#/components/schemas/SnowflakeIntegrationAccountCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: authentication: auth_type: snowflake_private_key private_key_name: my-rsa-key dataflows: snowflake-account-usage-metrics: enabled: true settings: account_usage_metrics_aggregate_last_24h: false snowflake-cloud-cost-metrics: enabled: true settings: query_tags: env,team,cost_center snowflake-data-observability-quality-monitoring: enabled: true settings: do_table_crawler_cron: "0 */6 * * *" sync_snowflake_system_database: true snowflake-event-table-logs: enabled: true settings: event_table_events_enabled: true event_table_logs_enabled: true event_table_logs_interval_min: 15 event_table_span_events_enabled: false event_table_spans_enabled: false snowflake-organization-usage-metrics: enabled: true settings: organization_usage_metrics_aggregate_last_24h: false snowflake-query-history-logs: enabled: true settings: join_query_history_with_access_history_enabled: true query_history_logs_interval_min: 15 snowflake-security-logs: enabled: true settings: security_logs_interval_min: 60 snowflake-task-history-logs: enabled: true settings: task_history_logs_interval_min: 30 name: prod-snowflake settings: snowflake_account_identifier: myorg-myaccount username: datadog_user id: a1b2c3d4-e5f6-7890-abcd-ef1234567890 type: integration-account schema: $ref: "#/components/schemas/SnowflakeIntegrationAccountResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": $ref: "#/components/responses/UnprocessableEntityResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a Snowflake integration account tags: - Snowflake Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/integration-interfaces/snowflake/accounts/{account_id}: delete: description: Delete a Snowflake integration account. operationId: DeleteSnowflakeIntegrationAccount parameters: - $ref: "#/components/parameters/IntegrationAccountIdParameter" responses: "200": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a Snowflake integration account tags: - Snowflake Integration "x-permission": operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a Snowflake integration account. operationId: GetSnowflakeIntegrationAccount parameters: - $ref: "#/components/parameters/IntegrationAccountIdParameter" responses: "200": content: application/json: examples: default: value: data: attributes: authentication: auth_type: snowflake_private_key private_key_name: my-rsa-key dataflows: snowflake-account-usage-metrics: enabled: true settings: account_usage_metrics_aggregate_last_24h: false snowflake-cloud-cost-metrics: enabled: true settings: query_tags: env,team,cost_center snowflake-data-observability-quality-monitoring: enabled: true settings: do_table_crawler_cron: "0 */6 * * *" sync_snowflake_system_database: true snowflake-event-table-logs: enabled: true settings: event_table_events_enabled: true event_table_logs_enabled: true event_table_logs_interval_min: 15 event_table_span_events_enabled: false event_table_spans_enabled: false snowflake-organization-usage-metrics: enabled: true settings: organization_usage_metrics_aggregate_last_24h: false snowflake-query-history-logs: enabled: true settings: join_query_history_with_access_history_enabled: true query_history_logs_interval_min: 15 snowflake-security-logs: enabled: true settings: security_logs_interval_min: 60 snowflake-task-history-logs: enabled: true settings: task_history_logs_interval_min: 30 name: prod-snowflake settings: snowflake_account_identifier: myorg-myaccount username: datadog_user id: a1b2c3d4-e5f6-7890-abcd-ef1234567890 type: integration-account schema: $ref: "#/components/schemas/SnowflakeIntegrationAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a Snowflake integration account tags: - Snowflake Integration "x-permission": operator: OR permissions: - integrations_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update a Snowflake integration account. Only the fields provided are changed. operationId: UpdateSnowflakeIntegrationAccount parameters: - $ref: "#/components/parameters/IntegrationAccountIdParameter" requestBody: content: application/json: schema: $ref: "#/components/schemas/SnowflakeIntegrationAccountUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: authentication: auth_type: snowflake_private_key private_key_name: my-rsa-key dataflows: snowflake-account-usage-metrics: enabled: true settings: account_usage_metrics_aggregate_last_24h: false snowflake-cloud-cost-metrics: enabled: true settings: query_tags: env,team,cost_center snowflake-data-observability-quality-monitoring: enabled: true settings: do_table_crawler_cron: "0 */6 * * *" sync_snowflake_system_database: true snowflake-event-table-logs: enabled: true settings: event_table_events_enabled: true event_table_logs_enabled: true event_table_logs_interval_min: 15 event_table_span_events_enabled: false event_table_spans_enabled: false snowflake-organization-usage-metrics: enabled: true settings: organization_usage_metrics_aggregate_last_24h: false snowflake-query-history-logs: enabled: true settings: join_query_history_with_access_history_enabled: true query_history_logs_interval_min: 15 snowflake-security-logs: enabled: true settings: security_logs_interval_min: 60 snowflake-task-history-logs: enabled: true settings: task_history_logs_interval_min: 30 name: prod-snowflake settings: snowflake_account_identifier: myorg-myaccount username: datadog_user id: a1b2c3d4-e5f6-7890-abcd-ef1234567890 type: integration-account schema: $ref: "#/components/schemas/SnowflakeIntegrationAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": $ref: "#/components/responses/UnprocessableEntityResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a Snowflake integration account tags: - Snowflake Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/integration-interfaces/temporal-cloud-openmetrics/accounts: get: description: List Temporal Cloud OpenMetrics integration accounts. operationId: ListTemporalCloudOpenMetricsIntegrationAccounts responses: "200": content: application/json: examples: default: value: data: - attributes: authentication: auth_type: bearer_token dataflows: temporal-cloud-openmetrics-metrics: enabled: true status: health: DATAFLOW_HEALTH_OK updated_at: "2026-06-25T08:30:50Z" name: temporal-cloud-prod settings: include_opt_in_labels: false namespaces_to_include: prod-*,billing.a1b2c id: 7c2d4e91-5a3b-4f68-b0e2-9d1f6a8c3e57 type: integration-account schema: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Temporal Cloud OpenMetrics accounts tags: - Temporal Cloud OpenMetrics Integration "x-permission": operator: OR permissions: - integrations_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a Temporal Cloud OpenMetrics integration account. operationId: CreateTemporalCloudOpenMetricsIntegrationAccount requestBody: content: application/json: schema: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: authentication: auth_type: bearer_token dataflows: temporal-cloud-openmetrics-metrics: enabled: true status: health: DATAFLOW_HEALTH_OK updated_at: "2026-06-25T08:30:50Z" name: temporal-cloud-prod settings: include_opt_in_labels: false namespaces_to_include: prod-*,billing.a1b2c id: 7c2d4e91-5a3b-4f68-b0e2-9d1f6a8c3e57 type: integration-account schema: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": $ref: "#/components/responses/UnprocessableEntityResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a Temporal Cloud OpenMetrics account tags: - Temporal Cloud OpenMetrics Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/integration-interfaces/temporal-cloud-openmetrics/accounts/{account_id}: delete: description: Delete a Temporal Cloud OpenMetrics integration account. operationId: DeleteTemporalCloudOpenMetricsIntegrationAccount parameters: - $ref: "#/components/parameters/IntegrationAccountIdParameter" responses: "200": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a Temporal Cloud OpenMetrics account tags: - Temporal Cloud OpenMetrics Integration "x-permission": operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a Temporal Cloud OpenMetrics integration account. operationId: GetTemporalCloudOpenMetricsIntegrationAccount parameters: - $ref: "#/components/parameters/IntegrationAccountIdParameter" responses: "200": content: application/json: examples: default: value: data: attributes: authentication: auth_type: bearer_token dataflows: temporal-cloud-openmetrics-metrics: enabled: true status: health: DATAFLOW_HEALTH_OK updated_at: "2026-06-25T08:30:50Z" name: temporal-cloud-prod settings: include_opt_in_labels: false namespaces_to_include: prod-*,billing.a1b2c id: 7c2d4e91-5a3b-4f68-b0e2-9d1f6a8c3e57 type: integration-account schema: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a Temporal Cloud OpenMetrics account tags: - Temporal Cloud OpenMetrics Integration "x-permission": operator: OR permissions: - integrations_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update a Temporal Cloud OpenMetrics integration account. Only the fields provided are changed. operationId: UpdateTemporalCloudOpenMetricsIntegrationAccount parameters: - $ref: "#/components/parameters/IntegrationAccountIdParameter" requestBody: content: application/json: schema: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: authentication: auth_type: bearer_token dataflows: temporal-cloud-openmetrics-metrics: enabled: true status: health: DATAFLOW_HEALTH_OK updated_at: "2026-06-25T08:30:50Z" name: temporal-cloud-prod settings: include_opt_in_labels: false namespaces_to_include: prod-*,billing.a1b2c id: 7c2d4e91-5a3b-4f68-b0e2-9d1f6a8c3e57 type: integration-account schema: $ref: "#/components/schemas/TemporalCloudOpenMetricsIntegrationAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": $ref: "#/components/responses/UnprocessableEntityResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a Temporal Cloud OpenMetrics account tags: - Temporal Cloud OpenMetrics Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/integration-interfaces/twilio/accounts: get: description: List Twilio integration accounts. operationId: ListTwilioIntegrationAccounts responses: "200": content: application/json: examples: default: value: data: - attributes: authentication: auth_type: basic username: SKxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx dataflows: twilio-messages-logs: enabled: true status: health: DATAFLOW_HEALTH_OK updated_at: "2026-06-25T08:30:50Z" name: twilio-prod settings: account_sid: ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx censor_logs: true id: 953a0060-81ec-4221-aed4-d4733b59cd96 type: integration-account schema: $ref: "#/components/schemas/TwilioIntegrationAccountsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Twilio integration accounts tags: - Twilio Integration "x-permission": operator: OR permissions: - integrations_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a Twilio integration account. operationId: CreateTwilioIntegrationAccount requestBody: content: application/json: schema: $ref: "#/components/schemas/TwilioIntegrationAccountCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: authentication: auth_type: basic username: SKxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx dataflows: twilio-messages-logs: enabled: true status: health: DATAFLOW_HEALTH_OK updated_at: "2026-06-25T08:30:50Z" name: twilio-prod settings: account_sid: ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx censor_logs: true id: 953a0060-81ec-4221-aed4-d4733b59cd96 type: integration-account schema: $ref: "#/components/schemas/TwilioIntegrationAccountResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": $ref: "#/components/responses/UnprocessableEntityResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a Twilio integration account tags: - Twilio Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/integration-interfaces/twilio/accounts/{account_id}: delete: description: Delete a Twilio integration account. operationId: DeleteTwilioIntegrationAccount parameters: - $ref: "#/components/parameters/IntegrationAccountIdParameter" responses: "200": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a Twilio integration account tags: - Twilio Integration "x-permission": operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a Twilio integration account. operationId: GetTwilioIntegrationAccount parameters: - $ref: "#/components/parameters/IntegrationAccountIdParameter" responses: "200": content: application/json: examples: default: value: data: attributes: authentication: auth_type: basic username: SKxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx dataflows: twilio-messages-logs: enabled: true status: health: DATAFLOW_HEALTH_OK updated_at: "2026-06-25T08:30:50Z" name: twilio-prod settings: account_sid: ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx censor_logs: true id: 953a0060-81ec-4221-aed4-d4733b59cd96 type: integration-account schema: $ref: "#/components/schemas/TwilioIntegrationAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a Twilio integration account tags: - Twilio Integration "x-permission": operator: OR permissions: - integrations_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update a Twilio integration account. Only the fields provided are changed. operationId: UpdateTwilioIntegrationAccount parameters: - $ref: "#/components/parameters/IntegrationAccountIdParameter" requestBody: content: application/json: schema: $ref: "#/components/schemas/TwilioIntegrationAccountUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: authentication: auth_type: basic username: SKxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx dataflows: twilio-messages-logs: enabled: true status: health: DATAFLOW_HEALTH_OK updated_at: "2026-06-25T08:30:50Z" name: twilio-prod settings: account_sid: ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx censor_logs: true id: 953a0060-81ec-4221-aed4-d4733b59cd96 type: integration-account schema: $ref: "#/components/schemas/TwilioIntegrationAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": $ref: "#/components/responses/UnprocessableEntityResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a Twilio integration account tags: - Twilio Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/integration/aws/accounts: get: description: Get a list of AWS Account Integration Configs. operationId: ListAWSAccounts parameters: - description: |- Optional query parameter to filter accounts by AWS Account ID. If not provided, all accounts are returned. example: "123456789012" in: query name: aws_account_id required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/AWSAccountsResponse" description: AWS Accounts List object "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List all AWS integrations tags: - AWS Integration "x-permission": operator: OR permissions: - aws_configuration_read post: description: Create a new AWS Account Integration Config. operationId: CreateAWSAccount requestBody: content: application/json: examples: default: value: data: attributes: account_tags: - env:prod auth_config: access_key_id: ACCESS_KEY_ID secret_access_key: SECRET_ACCESS_KEY aws_account_id: "123456789012" aws_partition: aws aws_regions: include_all: true logs_config: lambda_forwarder: lambdas: - arn:aws:lambda:us-east-1:123456789012:function:DatadogLambdaLogForwarder sources: - s3 metrics_config: automute_enabled: true collect_cloudwatch_alarms: false collect_custom_metrics: false collect_service_quotas: false enabled: true metric_name_filters: - include_only: - aws.ec2.network_in namespace: AWS/EC2 resource_type_tag_filters: - expression: env:production resource_types: - instance service: ec2 resources_config: cloud_security_posture_management_collection: false extended_collection: true type: account schema: $ref: "#/components/schemas/AWSAccountCreateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: auth_config: access_key_id: ACCESS_KEY_ID aws_account_id: "123456789012" aws_partition: aws id: 00000000-0000-0000-0000-000000000001 type: account schema: $ref: "#/components/schemas/AWSAccountResponse" description: AWS Account object "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create an AWS integration tags: - AWS Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - aws_configurations_manage /api/v2/integration/aws/accounts/{aws_account_config_id}: delete: description: Delete an AWS Account Integration Config by config ID. operationId: DeleteAWSAccount parameters: - $ref: "#/components/parameters/AWSAccountConfigIDPathParameter" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an AWS integration tags: - AWS Integration "x-permission": operator: OR permissions: - aws_configurations_manage get: description: Get an AWS Account Integration Config by config ID. operationId: GetAWSAccount parameters: - $ref: "#/components/parameters/AWSAccountConfigIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: auth_config: access_key_id: ACCESS_KEY_ID aws_account_id: "123456789012" aws_partition: aws id: 00000000-0000-0000-0000-000000000002 type: account schema: $ref: "#/components/schemas/AWSAccountResponse" description: AWS Account object "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get an AWS integration by config ID tags: - AWS Integration "x-permission": operator: OR permissions: - aws_configuration_read patch: description: Update an AWS Account Integration Config by config ID. operationId: UpdateAWSAccount parameters: - $ref: "#/components/parameters/AWSAccountConfigIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: account_tags: - env:prod auth_config: access_key_id: ACCESS_KEY_ID secret_access_key: SECRET_ACCESS_KEY aws_account_id: "123456789012" aws_partition: aws aws_regions: include_all: true logs_config: lambda_forwarder: lambdas: - arn:aws:lambda:us-east-1:123456789012:function:DatadogLambdaLogForwarder sources: - s3 metrics_config: automute_enabled: true collect_cloudwatch_alarms: false collect_custom_metrics: false collect_service_quotas: false enabled: true metric_name_filters: - include_only: - aws.ec2.network_in namespace: AWS/EC2 resource_type_tag_filters: - expression: env:production resource_types: - instance service: ec2 resources_config: cloud_security_posture_management_collection: false extended_collection: true id: 00000000-abcd-0001-0000-000000000000 type: account schema: $ref: "#/components/schemas/AWSAccountUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: auth_config: access_key_id: ACCESS_KEY_ID aws_account_id: "123456789012" aws_partition: aws id: 00000000-0000-0000-0000-000000000003 type: account schema: $ref: "#/components/schemas/AWSAccountResponse" description: AWS Account object "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update an AWS integration tags: - AWS Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - aws_configuration_edit /api/v2/integration/aws/accounts/{aws_account_config_id}/ccm_config: delete: description: |- Delete the Cloud Cost Management config for an AWS Account Integration Config using Cost and Usage Report (CUR) 2.0 by config ID. operationId: DeleteAWSAccountCCMConfig parameters: - $ref: "#/components/parameters/AWSAccountConfigIDPathParameter" responses: "204": description: No Content "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete AWS CCM config tags: - AWS Integration "x-permission": operator: AND permissions: - aws_configuration_edit - cloud_cost_management_write x-unstable: |- **Note**: This endpoint is in preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: |- Get the Cloud Cost Management config for an AWS Account Integration Config using Cost and Usage Report (CUR) 2.0 by config ID. operationId: GetAWSAccountCCMConfig parameters: - $ref: "#/components/parameters/AWSAccountConfigIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: data_export_configs: - bucket_name: billing bucket_region: us-east-1 report_name: cost-and-usage-report report_prefix: reports report_type: CUR2.0 id: 00000000-0000-0000-0000-000000000004 type: ccm_config schema: $ref: "#/components/schemas/AWSCcmConfigResponse" description: AWS CCM Config object "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get AWS CCM config tags: - AWS Integration "x-permission": operator: OR permissions: - aws_configuration_read x-unstable: |- **Note**: This endpoint is in preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: |- Update the Cloud Cost Management config for an AWS Account Integration Config using Cost and Usage Report (CUR) 2.0 by config ID. operationId: UpdateAWSAccountCCMConfig parameters: - $ref: "#/components/parameters/AWSAccountConfigIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: ccm_config: data_export_configs: - bucket_name: billing bucket_region: us-east-1 report_name: cost-and-usage-report report_prefix: reports report_type: CUR2.0 type: ccm_config schema: $ref: "#/components/schemas/AWSCcmConfigRequest" description: Update a Cloud Cost Management config for an AWS Account Integration Config. required: true responses: "200": content: application/json: examples: default: value: data: attributes: data_export_configs: - bucket_name: billing bucket_region: us-east-1 report_name: cost-and-usage-report report_prefix: reports report_type: CUR2.0 id: 00000000-0000-0000-0000-000000000006 type: ccm_config schema: $ref: "#/components/schemas/AWSCcmConfigResponse" description: AWS CCM Config object "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update AWS CCM config tags: - AWS Integration x-codegen-request-body-name: body "x-permission": operator: AND permissions: - aws_configuration_edit - cloud_cost_management_write x-unstable: |- **Note**: This endpoint is in preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Create the Cloud Cost Management config for an AWS Account Integration Config using Cost and Usage Report (CUR) 2.0 by config ID. operationId: CreateAWSAccountCCMConfig parameters: - $ref: "#/components/parameters/AWSAccountConfigIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: ccm_config: data_export_configs: - bucket_name: billing bucket_region: us-east-1 report_name: cost-and-usage-report report_prefix: reports report_type: CUR2.0 type: ccm_config schema: $ref: "#/components/schemas/AWSCcmConfigRequest" description: Create a Cloud Cost Management config for an AWS Account Integration Config. required: true responses: "200": content: application/json: examples: default: value: data: attributes: data_export_configs: - bucket_name: billing bucket_region: us-east-1 report_name: cost-and-usage-report report_prefix: reports report_type: CUR2.0 id: 00000000-0000-0000-0000-000000000005 type: ccm_config schema: $ref: "#/components/schemas/AWSCcmConfigResponse" description: AWS CCM Config object "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create AWS CCM config tags: - AWS Integration x-codegen-request-body-name: body "x-permission": operator: AND permissions: - aws_configuration_edit - cloud_cost_management_write x-unstable: |- **Note**: This endpoint is in preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/integration/aws/accounts/{aws_account_config_id}/metric_name_filter_preview: get: description: |- Preview which collected CloudWatch metrics would be filtered by the account's saved metric name filters. operationId: GetAWSMetricNameFilterPreview parameters: - $ref: "#/components/parameters/AWSAccountConfigIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: namespaces: - filters: - match_count: 1 pattern: "aws.ec2.network_in" metrics: - cw_name: "NetworkIn" dd_names: - filtered: true name: "aws.ec2.network_in" namespace: "AWS/EC2" id: "00000000-0000-0000-0000-000000000001" type: metric_name_filter_preview schema: $ref: "#/components/schemas/AWSMetricNameFilterPreviewResponse" description: AWS metric name filter preview result "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get AWS metric name filter preview tags: - AWS Integration "x-permission": operator: OR permissions: - aws_configuration_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Preview which collected CloudWatch metrics would be filtered by the supplied metric name filters. The filters are not persisted. operationId: PreviewAWSMetricNameFilter parameters: - $ref: "#/components/parameters/AWSAccountConfigIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: metric_name_filters: - exclude_only: - "aws.ec2.network_in" namespace: "AWS/EC2" type: metric_name_filter_preview schema: $ref: "#/components/schemas/AWSMetricNameFilterPreviewRequest" description: The metric name filters to preview. required: true responses: "200": content: application/json: examples: default: value: data: attributes: namespaces: - filters: - match_count: 1 pattern: "aws.ec2.network_in" metrics: - cw_name: "NetworkIn" dd_names: - filtered: true name: "aws.ec2.network_in" namespace: "AWS/EC2" id: "00000000-0000-0000-0000-000000000001" type: metric_name_filter_preview schema: $ref: "#/components/schemas/AWSMetricNameFilterPreviewResponse" description: AWS metric name filter preview result "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Preview AWS metric name filter tags: - AWS Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - aws_configuration_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/integration/aws/available_namespaces: get: description: Get a list of available AWS CloudWatch namespaces that can send metrics to Datadog. operationId: ListAWSNamespaces responses: "200": content: application/json: examples: default: value: data: attributes: namespaces: - AWS/EC2 id: namespaces type: namespaces schema: $ref: "#/components/schemas/AWSNamespacesResponse" description: AWS Namespaces List object "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List available namespaces tags: - AWS Integration "x-permission": operator: OR permissions: - aws_configuration_read /api/v2/integration/aws/event_bridge: delete: description: Delete an Amazon EventBridge source. operationId: DeleteAWSEventBridgeSource requestBody: content: application/json: examples: default: value: data: attributes: account_id: "123456789012" event_generator_name: app-alerts-zyxw3210 region: us-east-1 type: event_bridge schema: $ref: "#/components/schemas/AWSEventBridgeDeleteRequest" description: Delete the Amazon EventBridge source with the given name, region, and associated AWS account. required: true responses: "200": content: application/json: examples: default: value: data: attributes: status: empty id: delete_event_bridge type: event_bridge schema: $ref: "#/components/schemas/AWSEventBridgeDeleteResponse" description: Amazon EventBridge source deleted. "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an Amazon EventBridge source tags: - AWS Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations get: description: Get all Amazon EventBridge sources. operationId: ListAWSEventBridgeSources responses: "200": content: application/json: examples: default: value: data: attributes: accounts: [] is_installed: true id: get_event_bridge type: event_bridge schema: $ref: "#/components/schemas/AWSEventBridgeListResponse" description: Amazon EventBridge sources list. "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all Amazon EventBridge sources tags: - AWS Integration "x-permission": operator: OR permissions: - integrations_read post: description: Create an Amazon EventBridge source. operationId: CreateAWSEventBridgeSource requestBody: content: application/json: examples: default: value: data: attributes: account_id: "123456789012" create_event_bus: true event_generator_name: app-alerts region: us-east-1 type: event_bridge schema: $ref: "#/components/schemas/AWSEventBridgeCreateRequest" description: Create an Amazon EventBridge source for an AWS account with a given name and region. required: true responses: "200": content: application/json: examples: default: value: data: attributes: event_source_name: app-alerts-zyxw3210 has_bus: true region: us-east-1 status: created id: create_event_bridge type: event_bridge schema: $ref: "#/components/schemas/AWSEventBridgeCreateResponse" description: Amazon EventBridge source created. "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create an Amazon EventBridge source tags: - AWS Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integration/aws/generate_new_external_id: post: description: Generate a new external ID for AWS role-based authentication. operationId: CreateNewAWSExternalID responses: "200": content: application/json: examples: default: value: data: attributes: external_id: abc-123 id: external_id type: external_id schema: $ref: "#/components/schemas/AWSNewExternalIDResponse" description: AWS External ID object "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Generate a new external ID tags: - AWS Integration "x-permission": operator: OR permissions: - aws_configuration_edit /api/v2/integration/aws/iam_permissions: get: description: Get all AWS IAM permissions required for the AWS integration. operationId: GetAWSIntegrationIAMPermissions responses: "200": content: application/json: examples: default: value: data: attributes: permissions: - account:GetContactInformation id: permissions type: permissions schema: $ref: "#/components/schemas/AWSIntegrationIamPermissionsResponse" description: AWS IAM Permissions object "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get AWS integration IAM permissions tags: - AWS Integration /api/v2/integration/aws/iam_permissions/resource_collection: get: description: Get all resource collection AWS IAM permissions required for the AWS integration. operationId: GetAWSIntegrationIAMPermissionsResourceCollection responses: "200": content: application/json: examples: default: value: data: attributes: permissions: - account:GetContactInformation id: permissions type: permissions schema: $ref: "#/components/schemas/AWSIntegrationIamPermissionsResponse" description: AWS integration resource collection IAM permissions. "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get resource collection IAM permissions tags: - AWS Integration /api/v2/integration/aws/iam_permissions/standard: get: description: Get all standard AWS IAM permissions required for the AWS integration. operationId: GetAWSIntegrationIAMPermissionsStandard responses: "200": content: application/json: examples: default: value: data: attributes: permissions: - account:GetContactInformation id: permissions type: permissions schema: $ref: "#/components/schemas/AWSIntegrationIamPermissionsResponse" description: AWS integration standard IAM permissions. "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get AWS integration standard IAM permissions tags: - AWS Integration /api/v2/integration/aws/logs/services: get: description: Get a list of AWS services that can send logs to Datadog. operationId: ListAWSLogsServices responses: "200": content: application/json: examples: default: value: data: attributes: logs_services: - s3 id: logs_services type: logs_services schema: $ref: "#/components/schemas/AWSLogsServicesResponse" description: AWS Logs Services List object "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get list of AWS log ready services tags: - AWS Logs Integration "x-permission": operator: OR permissions: - aws_configuration_read /api/v2/integration/aws/validate_ccm_config: post: description: |- Validate a Cloud Cost Management config for an AWS account using Cost and Usage Report (CUR) 2.0 against Datadog's ingest requirements without persisting it. operationId: ValidateAWSCCMConfig requestBody: content: application/json: examples: default: value: data: attributes: account_id: "123456789012" bucket_name: billing bucket_region: us-east-1 report_name: cost-and-usage-report report_prefix: reports type: ccm_config_validation schema: $ref: "#/components/schemas/AWSCcmConfigValidationRequest" description: Validate a Cloud Cost Management config for an AWS account integration config. required: true responses: "200": content: application/json: examples: default: value: data: attributes: account_id: "123456789012" issues: - code: EXPORT_NOT_FOUND description: 'no CUR 2.0 export named "cost-and-usage-report" found' id: ccm_config_validation type: ccm_config_validation schema: $ref: "#/components/schemas/AWSCcmConfigValidationResponse" description: AWS CCM Config validation result "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "503": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Service Unavailable summary: Validate AWS CCM config tags: - AWS Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - cloud_cost_management_read - cloud_cost_management_write x-unstable: |- **Note**: This endpoint is in Preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/integration/gcp/accounts: get: description: List all GCP STS-enabled service accounts configured in your Datadog account. operationId: ListGCPSTSAccounts responses: "200": content: application/json: examples: default: value: data: - attributes: automute: true client_email: service-account@test-project.iam.gserviceaccount.com is_cspm_enabled: true resource_collection_enabled: true id: abc-123 type: gcp_service_account schema: $ref: "#/components/schemas/GCPSTSServiceAccountsResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List all GCP STS-enabled service accounts tags: - GCP Integration "x-permission": operator: OR permissions: - gcp_configuration_read post: description: |- Create a new entry within Datadog for your STS enabled service account. operationId: CreateGCPSTSAccount requestBody: content: application/json: examples: default: value: data: attributes: client_email: datadog-service-account@test-project.iam.gserviceaccount.com cloud_run_revision_filters: - $KEY:$VALUE host_filters: - $KEY:$VALUE is_global_location_enabled: true is_per_project_quota_enabled: true is_resource_change_collection_enabled: true is_security_command_center_enabled: true metric_namespace_configs: - disabled: true id: aiplatform - filters: - snapshot.* - "!*_by_region" id: pubsub monitored_resource_configs: - filters: - $KEY:$VALUE type: gce_instance region_filter_configs: - nam4 - europe-north1 type: gcp_service_account schema: $ref: "#/components/schemas/GCPSTSServiceAccountCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: automute: true client_email: service-account@test-project.iam.gserviceaccount.com is_cspm_enabled: true resource_collection_enabled: true id: abc-123 type: gcp_service_account schema: $ref: "#/components/schemas/GCPSTSServiceAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a new entry for your service account tags: - GCP Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - gcp_configurations_manage /api/v2/integration/gcp/accounts/{account_id}: delete: description: Delete an STS enabled GCP account from within Datadog. operationId: DeleteGCPSTSAccount parameters: - $ref: "#/components/parameters/GCPSTSServiceAccountID" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an STS enabled GCP Account tags: - GCP Integration "x-permission": operator: OR permissions: - gcp_configurations_manage patch: description: Update an STS enabled service account. operationId: UpdateGCPSTSAccount parameters: - $ref: "#/components/parameters/GCPSTSServiceAccountID" requestBody: content: application/json: examples: default: value: data: attributes: client_email: datadog-service-account@test-project.iam.gserviceaccount.com cloud_run_revision_filters: - $KEY:$VALUE host_filters: - $KEY:$VALUE is_global_location_enabled: true is_per_project_quota_enabled: true is_resource_change_collection_enabled: true is_security_command_center_enabled: true metric_namespace_configs: - disabled: true id: aiplatform - filters: - snapshot.* - "!*_by_region" id: pubsub monitored_resource_configs: - filters: - $KEY:$VALUE type: gce_instance region_filter_configs: - nam4 - europe-north1 id: d291291f-12c2-22g4-j290-123456678897 type: gcp_service_account schema: $ref: "#/components/schemas/GCPSTSServiceAccountUpdateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: automute: true client_email: service-account@test-project.iam.gserviceaccount.com is_cspm_enabled: true resource_collection_enabled: true id: abc-123 type: gcp_service_account schema: $ref: "#/components/schemas/GCPSTSServiceAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update STS Service Account tags: - GCP Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - gcp_configuration_edit /api/v2/integration/gcp/sts_delegate: get: description: List your Datadog-GCP STS delegate account configured in your Datadog account. operationId: GetGCPSTSDelegate responses: "200": content: application/json: examples: default: value: data: attributes: delegate_account_email: test@example.com id: abc-123 type: gcp_sts_delegate schema: $ref: "#/components/schemas/GCPSTSDelegateAccountResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List delegate account tags: - GCP Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - gcp_configuration_read post: description: Create a Datadog GCP principal. operationId: MakeGCPSTSDelegate requestBody: content: application/json: examples: default: value: {} schema: example: {} type: object description: Create a delegate service account within Datadog. required: false responses: "200": content: application/json: examples: default: value: data: attributes: delegate_account_email: test@example.com id: abc-123 type: gcp_sts_delegate schema: $ref: "#/components/schemas/GCPSTSDelegateAccountResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a Datadog GCP principal tags: - GCP Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - gcp_configuration_edit /api/v2/integration/google-chat/organizations: get: description: Get a list of all Google Chat organization bindings in the Datadog Google Chat integration. operationId: ListGoogleChatOrganizations responses: "200": content: application/json: examples: default: value: data: - attributes: domain_id: fake-domain-id domain_name: example.com id: 00000000-0000-0000-0000-000000000001 relationships: delegated_user: data: id: 00000000-0000-0000-0000-000000000002 type: google-chat-delegated-user type: google-chat-organization - attributes: domain_id: fake-domain-id-2 domain_name: example2.com id: 00000000-0000-0000-0000-000000000003 type: google-chat-organization schema: $ref: "#/components/schemas/GoogleChatOrganizationsResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all Google Chat organization bindings tags: - Google Chat Integration /api/v2/integration/google-chat/organizations/app/named-spaces/{domain_name}/{space_display_name}: get: description: Get the resource name and organization binding ID of a space in the Datadog Google Chat integration. operationId: GetSpaceByDisplayName parameters: - $ref: "#/components/parameters/GoogleChatOrganizationDomainNamePathParameter" - $ref: "#/components/parameters/GoogleChatOrganizationSpaceDisplayNamePathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: display_name: General organization_binding_id: 00000000-0000-0000-0000-000000000006 resource_name: spaces/AAAAAAAAA space_uri: https://chat.google.com/room/AAAAAAAAA id: 00000000-0000-0000-0000-000000000005 type: google-chat-app-named-space schema: $ref: "#/components/schemas/GoogleChatAppNamedSpaceResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get space information by display name tags: - Google Chat Integration /api/v2/integration/google-chat/organizations/{organization_binding_id}: delete: description: Delete a Google Chat organization binding from the Datadog Google Chat integration. operationId: DeleteGoogleChatOrganization parameters: - $ref: "#/components/parameters/GoogleChatOrganizationBindingIdPathParameter" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a Google Chat organization binding tags: - Google Chat Integration get: description: Get a Google Chat organization binding from the Datadog Google Chat integration. operationId: GetGoogleChatOrganization parameters: - $ref: "#/components/parameters/GoogleChatOrganizationBindingIdPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: domain_id: fake-domain-id domain_name: example.com id: 00000000-0000-0000-0000-000000000001 relationships: delegated_user: data: id: 00000000-0000-0000-0000-000000000002 type: google-chat-delegated-user type: google-chat-organization schema: $ref: "#/components/schemas/GoogleChatOrganizationResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a Google Chat organization binding tags: - Google Chat Integration /api/v2/integration/google-chat/organizations/{organization_binding_id}/delegated-user: delete: description: Delete the delegated user for a Google Chat organization binding from the Datadog Google Chat integration. operationId: DeleteGoogleChatDelegatedUser parameters: - $ref: "#/components/parameters/GoogleChatOrganizationBindingIdPathParameter" responses: "204": description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete the delegated user tags: - Google Chat Integration get: description: Get the delegated user for a Google Chat organization binding in the Datadog Google Chat integration. operationId: GetGoogleChatDelegatedUser parameters: - $ref: "#/components/parameters/GoogleChatOrganizationBindingIdPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: display_name: fake-display-name email: user@example.com features: - incident-automatic-space-creation - workflow-space-creation id: 00000000-0000-0000-0000-000000000002 type: google-chat-delegated-user schema: $ref: "#/components/schemas/GoogleChatDelegatedUserResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get the delegated user tags: - Google Chat Integration /api/v2/integration/google-chat/organizations/{organization_binding_id}/organization-handles: get: description: Get a list of all organization handles from the Datadog Google Chat integration. operationId: ListOrganizationHandles parameters: - $ref: "#/components/parameters/GoogleChatOrganizationBindingIdPathParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: name: example-handle space_display_name: General space_resource_name: spaces/AAAAAAAAA id: 00000000-0000-0000-0000-000000000001 type: google-chat-organization-handle schema: $ref: "#/components/schemas/GoogleChatOrganizationHandlesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all organization handles tags: - Google Chat Integration post: description: Create an organization handle in the Datadog Google Chat integration. operationId: CreateOrganizationHandle parameters: - $ref: "#/components/parameters/GoogleChatOrganizationBindingIdPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: name: fake-handle-name space_resource_name: spaces/AAAAAAAAA type: google-chat-organization-handle schema: $ref: "#/components/schemas/GoogleChatCreateOrganizationHandleRequest" description: Organization handle payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: name: example-handle space_display_name: General space_resource_name: spaces/AAAAAAAAA id: 00000000-0000-0000-0000-000000000002 type: google-chat-organization-handle schema: $ref: "#/components/schemas/GoogleChatOrganizationHandleResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create organization handle tags: - Google Chat Integration x-codegen-request-body-name: body /api/v2/integration/google-chat/organizations/{organization_binding_id}/organization-handles/{handle_id}: delete: description: Delete an organization handle from the Datadog Google Chat integration. operationId: DeleteOrganizationHandle parameters: - description: Your organization binding ID. in: path name: organization_binding_id required: true schema: type: string - description: Your organization handle ID. in: path name: handle_id required: true schema: type: string responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete organization handle tags: - Google Chat Integration get: description: Get an organization handle from the Datadog Google Chat integration. operationId: GetOrganizationHandle parameters: - $ref: "#/components/parameters/GoogleChatOrganizationBindingIdPathParameter" - $ref: "#/components/parameters/GoogleChatHandleIdPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: name: example-handle space_display_name: General space_resource_name: spaces/AAAAAAAAA id: 00000000-0000-0000-0000-000000000003 type: google-chat-organization-handle schema: $ref: "#/components/schemas/GoogleChatOrganizationHandleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get organization handle tags: - Google Chat Integration patch: description: Update an organization handle from the Datadog Google Chat integration. operationId: UpdateOrganizationHandle parameters: - $ref: "#/components/parameters/GoogleChatOrganizationBindingIdPathParameter" - $ref: "#/components/parameters/GoogleChatHandleIdPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: name: fake-handle-name space_resource_name: spaces/AAAAAAAAA type: google-chat-organization-handle schema: $ref: "#/components/schemas/GoogleChatUpdateOrganizationHandleRequest" description: Organization handle payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: name: example-handle space_display_name: General space_resource_name: spaces/AAAAAAAAA id: 00000000-0000-0000-0000-000000000004 type: google-chat-organization-handle schema: $ref: "#/components/schemas/GoogleChatOrganizationHandleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update organization handle tags: - Google Chat Integration x-codegen-request-body-name: body /api/v2/integration/google-chat/organizations/{organization_binding_id}/target-audiences: get: description: Get a list of all target audiences for a Google Chat organization binding in the Datadog Google Chat integration. operationId: ListGoogleChatTargetAudiences parameters: - $ref: "#/components/parameters/GoogleChatOrganizationBindingIdPathParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: audience_id: fake-audience-id-1 audience_name: fake audience name 1 id: 00000000-0000-0000-0000-000000000004 type: google-chat-target-audience - attributes: audience_id: fake-audience-id-2 audience_name: fake-audience-name-2 id: 00000000-0000-0000-0000-000000000005 type: google-chat-target-audience schema: $ref: "#/components/schemas/GoogleChatTargetAudiencesResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all target audiences tags: - Google Chat Integration post: description: Create a target audience for a Google Chat organization binding in the Datadog Google Chat integration. operationId: CreateGoogleChatTargetAudience parameters: - $ref: "#/components/parameters/GoogleChatOrganizationBindingIdPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: audience_id: fake-audience-id-1 audience_name: fake audience name 1 type: google-chat-target-audience schema: $ref: "#/components/schemas/GoogleChatTargetAudienceCreateRequest" description: Target audience payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: audience_id: fake-audience-id-1 audience_name: fake audience name 1 id: 00000000-0000-0000-0000-000000000004 type: google-chat-target-audience schema: $ref: "#/components/schemas/GoogleChatTargetAudienceResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a target audience tags: - Google Chat Integration x-codegen-request-body-name: body /api/v2/integration/google-chat/organizations/{organization_binding_id}/target-audiences/{target_audience_id}: delete: description: Delete a target audience from a Google Chat organization binding in the Datadog Google Chat integration. operationId: DeleteGoogleChatTargetAudience parameters: - $ref: "#/components/parameters/GoogleChatOrganizationBindingIdPathParameter" - $ref: "#/components/parameters/GoogleChatTargetAudienceIdPathParameter" responses: "204": description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a target audience tags: - Google Chat Integration get: description: Get a target audience for a Google Chat organization binding in the Datadog Google Chat integration. operationId: GetGoogleChatTargetAudience parameters: - $ref: "#/components/parameters/GoogleChatOrganizationBindingIdPathParameter" - $ref: "#/components/parameters/GoogleChatTargetAudienceIdPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: audience_id: fake-audience-id-1 audience_name: fake audience name 1 id: 00000000-0000-0000-0000-000000000004 type: google-chat-target-audience schema: $ref: "#/components/schemas/GoogleChatTargetAudienceResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a target audience tags: - Google Chat Integration patch: description: Update a target audience for a Google Chat organization binding in the Datadog Google Chat integration. operationId: UpdateGoogleChatTargetAudience parameters: - $ref: "#/components/parameters/GoogleChatOrganizationBindingIdPathParameter" - $ref: "#/components/parameters/GoogleChatTargetAudienceIdPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: audience_id: updated-audience-id audience_name: updated-audience-name type: google-chat-target-audience schema: $ref: "#/components/schemas/GoogleChatTargetAudienceUpdateRequest" description: Target audience payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: audience_id: updated-audience-id audience_name: updated-audience-name id: 00000000-0000-0000-0000-000000000004 type: google-chat-target-audience schema: $ref: "#/components/schemas/GoogleChatTargetAudienceResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a target audience tags: - Google Chat Integration x-codegen-request-body-name: body /api/v2/integration/jira/accounts: get: description: |- Get all Jira accounts for the organization. operationId: ListJiraAccounts responses: "200": content: application/json: examples: default: value: data: - attributes: consumer_key: consumer-key-1 instance_url: "https://example.atlassian.net" id: account-1 type: jira-account meta: public_key: "c29tZSBkYXRhIHdpdGggACBhbmQg77u/" schema: $ref: "#/components/schemas/JiraAccountsResponse" description: OK "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Jira accounts tags: - Jira Integration x-unstable: |- **Note**: This endpoint is in public beta and it's subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/integration/jira/accounts/{account_id}: delete: description: |- Delete a Jira account by ID. operationId: DeleteJiraAccount parameters: - description: The ID of the Jira account to delete example: "65b3341b-0680-47f9-a6d4-134db45c603e" in: path name: account_id required: true schema: format: uuid type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete Jira account tags: - Jira Integration x-unstable: |- **Note**: This endpoint is in public beta and it's subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/integration/jira/issue-templates: get: description: |- Get all Jira issue templates for the organization. operationId: ListJiraIssueTemplates responses: "200": content: application/json: examples: default: value: data: - attributes: fields: description: payload: "Test Description" type: json issue_type_id: "456" name: Bug Report Template project_id: "123" id: "abc-123" type: jira-issue-template schema: $ref: "#/components/schemas/JiraIssueTemplatesResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Jira issue templates tags: - Jira Integration x-unstable: |- **Note**: This endpoint is in public beta and it's subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Create a new Jira issue template. operationId: CreateJiraIssueTemplate requestBody: content: application/json: examples: default: value: data: attributes: fields: description: payload: Test type: json issue_type_id: "12730" jira-account: id: 80f16d40-1fba-486e-b1fc-983e6ca19bec name: test-template project_id: "10772" type: jira-issue-template schema: $ref: "#/components/schemas/JiraIssueTemplateCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: fields: description: payload: Test type: json issue_type_id: "456" name: test-template project_id: "123" id: "abc-123" type: jira-issue-template schema: $ref: "#/components/schemas/JiraIssueTemplateResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create Jira issue template tags: - Jira Integration x-unstable: |- **Note**: This endpoint is in public beta and it's subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/integration/jira/issue-templates/{issue_template_id}: delete: description: |- Delete a Jira issue template by ID. operationId: DeleteJiraIssueTemplate parameters: - description: The ID of the Jira issue template to delete example: "65b3341b-0680-47f9-a6d4-134db45c603e" in: path name: issue_template_id required: true schema: format: uuid type: string responses: "204": description: No Content "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete Jira issue template tags: - Jira Integration x-unstable: |- **Note**: This endpoint is in public beta and it's subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: |- Get a Jira issue template by ID. operationId: GetJiraIssueTemplate parameters: - description: The ID of the Jira issue template to retrieve example: "65b3341b-0680-47f9-a6d4-134db45c603e" in: path name: issue_template_id required: true schema: format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: fields: description: payload: Test Description type: json issue_type_id: "456" name: test-template project_id: "123" id: "abc-123" type: jira-issue-template schema: $ref: "#/components/schemas/JiraIssueTemplateResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get Jira issue template tags: - Jira Integration x-unstable: |- **Note**: This endpoint is in public beta and it's subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: |- Update a Jira issue template by ID. operationId: UpdateJiraIssueTemplate parameters: - description: The ID of the Jira issue template to update example: "65b3341b-0680-47f9-a6d4-134db45c603e" in: path name: issue_template_id required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: fields: description: payload: Updated Description type: json name: test_template_updated type: jira-issue-template schema: $ref: "#/components/schemas/JiraIssueTemplateUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: fields: description: payload: Updated Description type: json issue_type_id: "456" name: test_template_updated project_id: "123" id: "abc-123" type: jira-issue-template schema: $ref: "#/components/schemas/JiraIssueTemplateResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update Jira issue template tags: - Jira Integration x-unstable: |- **Note**: This endpoint is in public beta and it's subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/integration/ms-teams/configuration/channel/{tenant_name}/{team_name}/{channel_name}: get: description: Get the tenant, team, and channel ID of a channel in the Datadog Microsoft Teams integration. operationId: GetChannelByName parameters: - $ref: "#/components/parameters/MicrosoftTeamsTenantNamePathParameter" - $ref: "#/components/parameters/MicrosoftTeamsTeamNamePathParameter" - $ref: "#/components/parameters/MicrosoftTeamsChannelNamePathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: is_primary: true team_id: 00000000-0000-0000-0000-000000000000 tenant_id: 00000000-0000-0000-0000-000000000001 id: "19:b41k24b14bn1nwffkernfkwrnfneubgkr@thread.tacv2" type: ms-teams-channel-info schema: $ref: "#/components/schemas/MicrosoftTeamsGetChannelByNameResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get channel information by name tags: - Microsoft Teams Integration /api/v2/integration/ms-teams/configuration/tenant-based-handles: get: description: Get a list of all tenant-based handles from the Datadog Microsoft Teams integration. operationId: ListTenantBasedHandles parameters: - $ref: "#/components/parameters/MicrosoftTeamsTenantIDQueryParameter" - $ref: "#/components/parameters/MicrosoftTeamsHandleNameQueryParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: channel_id: fake-channel-id name: fake-handle-name team_id: 00000000-0000-0000-0000-000000000000 tenant_id: 00000000-0000-0000-0000-000000000001 id: 00000000-0000-0000-0000-000000000001 type: ms-teams-tenant-based-handle-info schema: $ref: "#/components/schemas/MicrosoftTeamsTenantBasedHandlesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "412": $ref: "#/components/responses/PreconditionFailedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all tenant-based handles tags: - Microsoft Teams Integration post: description: Create a tenant-based handle in the Datadog Microsoft Teams integration. operationId: CreateTenantBasedHandle requestBody: content: application/json: examples: default: value: data: attributes: channel_id: fake-channel-id name: fake-handle-name team_id: 00000000-0000-0000-0000-000000000000 tenant_id: 00000000-0000-0000-0000-000000000001 type: tenant-based-handle schema: $ref: "#/components/schemas/MicrosoftTeamsCreateTenantBasedHandleRequest" description: Tenant-based handle payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: channel_id: fake-channel-id name: fake-handle-name team_id: 00000000-0000-0000-0000-000000000000 tenant_id: 00000000-0000-0000-0000-000000000001 id: 00000000-0000-0000-0000-000000000002 type: tenant-based-handle schema: $ref: "#/components/schemas/MicrosoftTeamsTenantBasedHandleResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "412": $ref: "#/components/responses/PreconditionFailedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create tenant-based handle tags: - Microsoft Teams Integration x-codegen-request-body-name: body /api/v2/integration/ms-teams/configuration/tenant-based-handles/{handle_id}: delete: description: Delete a tenant-based handle from the Datadog Microsoft Teams integration. operationId: DeleteTenantBasedHandle parameters: - $ref: "#/components/parameters/MicrosoftTeamsTenantBasedHandleIDPathParameter" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "412": $ref: "#/components/responses/PreconditionFailedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete tenant-based handle tags: - Microsoft Teams Integration get: description: Get the tenant, team, and channel information of a tenant-based handle from the Datadog Microsoft Teams integration. operationId: GetTenantBasedHandle parameters: - $ref: "#/components/parameters/MicrosoftTeamsTenantBasedHandleIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: channel_id: fake-channel-id name: fake-handle-name team_id: 00000000-0000-0000-0000-000000000000 tenant_id: 00000000-0000-0000-0000-000000000001 id: 00000000-0000-0000-0000-000000000003 type: tenant-based-handle schema: $ref: "#/components/schemas/MicrosoftTeamsTenantBasedHandleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "412": $ref: "#/components/responses/PreconditionFailedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get tenant-based handle information tags: - Microsoft Teams Integration patch: description: Update a tenant-based handle from the Datadog Microsoft Teams integration. operationId: UpdateTenantBasedHandle parameters: - $ref: "#/components/parameters/MicrosoftTeamsTenantBasedHandleIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: channel_id: fake-channel-id name: fake-handle-name team_id: 00000000-0000-0000-0000-000000000000 tenant_id: 00000000-0000-0000-0000-000000000001 type: tenant-based-handle schema: $ref: "#/components/schemas/MicrosoftTeamsUpdateTenantBasedHandleRequest" description: Tenant-based handle payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: channel_id: fake-channel-id name: fake-handle-name-updated team_id: 00000000-0000-0000-0000-000000000000 tenant_id: 00000000-0000-0000-0000-000000000001 id: 00000000-0000-0000-0000-000000000004 type: tenant-based-handle schema: $ref: "#/components/schemas/MicrosoftTeamsTenantBasedHandleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "412": $ref: "#/components/responses/PreconditionFailedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update tenant-based handle tags: - Microsoft Teams Integration x-codegen-request-body-name: body /api/v2/integration/ms-teams/configuration/user-binding/{tenant_id}: delete: description: Delete the user binding for a given tenant from the Datadog Microsoft Teams integration. operationId: DeleteMSTeamsUserBinding parameters: - $ref: "#/components/parameters/MicrosoftTeamsTenantIDPathParameter" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "412": $ref: "#/components/responses/PreconditionFailedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete user binding tags: - Microsoft Teams Integration /api/v2/integration/ms-teams/configuration/workflows-webhook-handles: get: description: Get a list of all Workflows webhook handles from the Datadog Microsoft Teams integration. operationId: ListWorkflowsWebhookHandles parameters: - $ref: "#/components/parameters/MicrosoftTeamsWorkflowsWebhookHandleNameQueryParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: name: fake-handle-name id: 00000000-0000-0000-0000-000000000005 type: workflows-webhook-handle schema: $ref: "#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandlesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "412": $ref: "#/components/responses/PreconditionFailedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all Workflows webhook handles tags: - Microsoft Teams Integration post: description: Create a Workflows webhook handle in the Datadog Microsoft Teams integration. operationId: CreateWorkflowsWebhookHandle requestBody: content: application/json: examples: default: value: data: attributes: name: fake-handle-name url: https://fake.url.com type: workflows-webhook-handle schema: $ref: "#/components/schemas/MicrosoftTeamsCreateWorkflowsWebhookHandleRequest" description: Workflows Webhook handle payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: name: fake-handle-name id: 00000000-0000-0000-0000-000000000006 type: workflows-webhook-handle schema: $ref: "#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "412": $ref: "#/components/responses/PreconditionFailedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create Workflows webhook handle tags: - Microsoft Teams Integration x-codegen-request-body-name: body /api/v2/integration/ms-teams/configuration/workflows-webhook-handles/{handle_id}: delete: description: Delete a Workflows webhook handle from the Datadog Microsoft Teams integration. operationId: DeleteWorkflowsWebhookHandle parameters: - $ref: "#/components/parameters/MicrosoftTeamsWorkflowsWebhookHandleIDPathParameter" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "412": $ref: "#/components/responses/PreconditionFailedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete Workflows webhook handle tags: - Microsoft Teams Integration get: description: Get the name of a Workflows webhook handle from the Datadog Microsoft Teams integration. operationId: GetWorkflowsWebhookHandle parameters: - $ref: "#/components/parameters/MicrosoftTeamsWorkflowsWebhookHandleIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: name: fake-handle-name id: 00000000-0000-0000-0000-000000000007 type: workflows-webhook-handle schema: $ref: "#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "412": $ref: "#/components/responses/PreconditionFailedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get Workflows webhook handle information tags: - Microsoft Teams Integration patch: description: Update a Workflows webhook handle from the Datadog Microsoft Teams integration. operationId: UpdateWorkflowsWebhookHandle parameters: - $ref: "#/components/parameters/MicrosoftTeamsWorkflowsWebhookHandleIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: name: fake-handle-name url: https://fake.url.com type: workflows-webhook-handle schema: $ref: "#/components/schemas/MicrosoftTeamsUpdateWorkflowsWebhookHandleRequest" description: Workflows Webhook handle payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: name: fake-handle-name-updated id: 00000000-0000-0000-0000-000000000008 type: workflows-webhook-handle schema: $ref: "#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "412": $ref: "#/components/responses/PreconditionFailedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update Workflows webhook handle tags: - Microsoft Teams Integration x-codegen-request-body-name: body /api/v2/integration/oci/products: get: description: >- Lists the products for a given tenancy. Returns the enabled/disabled status of Datadog products (such as Cloud Security Posture Management) for specific OCI tenancies. operationId: ListTenancyProducts parameters: - description: Comma-separated list of product keys to filter by. in: query name: productKeys required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: products: - enabled: true product_key: CLOUD_SECURITY_POSTURE_MANAGEMENT id: ocid.tenancy.test type: oci_tenancy_product schema: $ref: "#/components/schemas/TenancyProductsList" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List tenancy products tags: - OCI Integration /api/v2/integration/oci/tenancies: get: description: >- Get a list of all configured OCI tenancy integrations. Returns basic information about each tenancy including authentication credentials, region settings, and collection preferences for metrics, logs, and resources. operationId: GetTenancyConfigs responses: "200": content: application/json: examples: default: value: data: - attributes: cost_collection_enabled: true home_region: us-ashburn-1 resource_collection_enabled: true user_ocid: ocid.user.test id: ocid.tenancy.test type: oci_tenancy schema: $ref: "#/components/schemas/TenancyConfigList" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get tenancy configs tags: - OCI Integration post: description: >- Create a new tenancy config to establish monitoring and data collection from your OCI environment. Requires OCI authentication credentials and tenancy details. Warning: Datadog recommends interacting with this endpoint only through the Datadog web UI to ensure all necessary OCI resources have been created and configured properly. operationId: CreateTenancyConfig requestBody: content: application/json: examples: default: value: data: attributes: auth_credentials: fingerprint: "" private_key: "" cost_collection_enabled: true dd_compartment_id: ocid.compartment.test dd_stack_id: ocid.stack.test home_region: us-ashburn-1 logs_config: compartment_tag_filters: - datadog:true - env:prod enabled: true enabled_services: - service_1 - service_2 metrics_config: compartment_tag_filters: - datadog:true - env:prod enabled: true excluded_services: - service_1 - service_2 regions_config: available: - us-ashburn-1 - us-phoenix-1 disabled: - us-phoenix-1 enabled: - us-ashburn-1 resource_collection_enabled: true user_ocid: ocid.user.test id: ocid.tenancy.test type: oci_tenancy schema: $ref: "#/components/schemas/CreateTenancyConfigRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: cost_collection_enabled: true home_region: us-ashburn-1 resource_collection_enabled: true user_ocid: ocid.user.test id: ocid.tenancy.test type: oci_tenancy schema: $ref: "#/components/schemas/TenancyConfig" description: Created "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create tenancy config tags: - OCI Integration /api/v2/integration/oci/tenancies/{tenancy_ocid}: delete: description: >- Delete an existing tenancy config. This will stop all data collection from the specified OCI tenancy and remove the stored configuration. This operation cannot be undone. operationId: DeleteTenancyConfig parameters: - description: The OCID of the tenancy config to delete. in: path name: tenancy_ocid required: true schema: type: string responses: "204": description: No Content "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete tenancy config tags: - OCI Integration get: description: >- Get a single tenancy config object by its OCID. Returns detailed configuration including authentication credentials, enabled services, region settings, and collection preferences. operationId: GetTenancyConfig parameters: - description: The OCID of the tenancy config to retrieve. in: path name: tenancy_ocid required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: cost_collection_enabled: true home_region: us-ashburn-1 resource_collection_enabled: true user_ocid: ocid.user.test id: ocid.tenancy.test type: oci_tenancy schema: $ref: "#/components/schemas/TenancyConfig" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get tenancy config tags: - OCI Integration patch: description: >- Update an existing tenancy config. You can modify authentication credentials, enable/disable collection types, update service filters, and change region settings. Warning: We recommend using the Datadog web UI to avoid unintended update effects. operationId: UpdateTenancyConfig parameters: - description: The OCID of the tenancy config to update. in: path name: tenancy_ocid required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: auth_credentials: fingerprint: "" private_key: "" cost_collection_enabled: true home_region: us-ashburn-1 logs_config: compartment_tag_filters: - datadog:true - env:prod enabled: true enabled_services: - service_1 - service_2 metrics_config: compartment_tag_filters: - datadog:true - env:prod enabled: true excluded_services: - service_1 - service_2 regions_config: available: - us-ashburn-1 - us-phoenix-1 disabled: - us-phoenix-1 enabled: - us-ashburn-1 resource_collection_enabled: true user_ocid: ocid.user.test id: ocid.tenancy.test type: oci_tenancy schema: $ref: "#/components/schemas/UpdateTenancyConfigRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: cost_collection_enabled: true home_region: us-ashburn-1 resource_collection_enabled: true user_ocid: ocid.user.test id: ocid.tenancy.test type: oci_tenancy schema: $ref: "#/components/schemas/TenancyConfig" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update tenancy config tags: - OCI Integration /api/v2/integration/opsgenie/accounts: get: description: Get a list of all Opsgenie accounts from the Datadog Opsgenie integration. operationId: ListOpsgenieAccounts responses: "200": content: application/json: examples: default: value: data: - attributes: region: us id: 00000000-0000-0000-0000-000000000001 type: opsgenie-account schema: $ref: "#/components/schemas/OpsgenieAccountsResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all Opsgenie accounts tags: - Opsgenie Integration "x-permission": operator: OR permissions: - integrations_read post: description: Create a new Opsgenie account in the Datadog Opsgenie integration. operationId: CreateOpsgenieAccount requestBody: content: application/json: examples: default: value: data: attributes: api_key: 00000000-0000-0000-0000-000000000000 region: us type: opsgenie-account schema: $ref: "#/components/schemas/OpsgenieAccountCreateRequest" description: Opsgenie account payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: region: us id: 00000000-0000-0000-0000-000000000002 type: opsgenie-account schema: $ref: "#/components/schemas/OpsgenieAccountResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a new Opsgenie account tags: - Opsgenie Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integration/opsgenie/accounts/{account_id}: delete: description: Delete a single Opsgenie account from the Datadog Opsgenie integration. operationId: DeleteOpsgenieAccount parameters: - $ref: "#/components/parameters/OpsgenieAccountIDPathParameter" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an Opsgenie account tags: - Opsgenie Integration "x-permission": operator: OR permissions: - manage_integrations patch: description: Update a single Opsgenie account in the Datadog Opsgenie integration. operationId: UpdateOpsgenieAccount parameters: - $ref: "#/components/parameters/OpsgenieAccountIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: api_key: 00000000-0000-0000-0000-000000000000 region: us id: 596da4af-0563-4097-90ff-07230c3f9db3 type: opsgenie-account schema: $ref: "#/components/schemas/OpsgenieAccountUpdateRequest" description: Opsgenie account payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: region: us id: 00000000-0000-0000-0000-000000000003 type: opsgenie-account schema: $ref: "#/components/schemas/OpsgenieAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": $ref: "#/components/responses/UnprocessableEntityResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update an Opsgenie account tags: - Opsgenie Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integration/opsgenie/services: get: description: Get a list of all services from the Datadog Opsgenie integration. operationId: ListOpsgenieServices responses: "200": content: application/json: examples: default: value: data: - attributes: custom_url: name: fake-opsgenie-service-name region: us id: 00000000-0000-0000-0000-000000000001 type: opsgenie-service schema: $ref: "#/components/schemas/OpsgenieServicesResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all service objects tags: - Opsgenie Integration "x-permission": operator: OR permissions: - integrations_read post: description: Create a new service object in the Opsgenie integration. operationId: CreateOpsgenieService requestBody: content: application/json: examples: default: value: data: attributes: custom_url: https://example.com name: fake-opsgenie-service-name opsgenie_api_key: 00000000-0000-0000-0000-000000000000 region: us type: opsgenie-service schema: $ref: "#/components/schemas/OpsgenieServiceCreateRequest" description: Opsgenie service payload required: true responses: "201": content: application/json: examples: default: value: data: attributes: custom_url: https://example.com name: fake-opsgenie-service-name region: us id: 00000000-0000-0000-0000-000000000002 type: opsgenie-service schema: $ref: "#/components/schemas/OpsgenieServiceResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a new service object tags: - Opsgenie Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integration/opsgenie/services/{integration_service_id}: delete: description: Delete a single service object in the Datadog Opsgenie integration. operationId: DeleteOpsgenieService parameters: - $ref: "#/components/parameters/OpsgenieServiceIDPathParameter" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a single service object tags: - Opsgenie Integration "x-permission": operator: OR permissions: - manage_integrations get: description: Get a single service from the Datadog Opsgenie integration. operationId: GetOpsgenieService parameters: - $ref: "#/components/parameters/OpsgenieServiceIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: custom_url: name: fake-opsgenie-service-name region: us id: 00000000-0000-0000-0000-000000000003 type: opsgenie-service schema: $ref: "#/components/schemas/OpsgenieServiceResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a single service object tags: - Opsgenie Integration "x-permission": operator: OR permissions: - integrations_read patch: description: Update a single service object in the Datadog Opsgenie integration. operationId: UpdateOpsgenieService parameters: - $ref: "#/components/parameters/OpsgenieServiceIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: custom_url: https://example.com name: fake-opsgenie-service-name opsgenie_api_key: 00000000-0000-0000-0000-000000000000 region: us id: 596da4af-0563-4097-90ff-07230c3f9db3 type: opsgenie-service schema: $ref: "#/components/schemas/OpsgenieServiceUpdateRequest" description: Opsgenie service payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: custom_url: https://example.com name: fake-opsgenie-service-name region: us id: 00000000-0000-0000-0000-000000000004 type: opsgenie-service schema: $ref: "#/components/schemas/OpsgenieServiceResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a single service object tags: - Opsgenie Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integration/servicenow/assignment_groups/{instance_id}: get: description: |- Get all assignment groups for a ServiceNow instance. operationId: ListServiceNowAssignmentGroups parameters: - description: The ID of the ServiceNow instance example: "65b3341b-0680-47f9-a6d4-134db45c603e" in: path name: instance_id required: true schema: format: uuid type: string responses: "200": content: application/json: examples: default: value: data: - attributes: assignment_group_name: Network Team assignment_group_sys_id: abc-123 instance_id: 00000000-0000-0000-0000-000000000001 id: 00000000-0000-0000-0000-000000000001 type: assignment_groups schema: $ref: "#/components/schemas/ServiceNowAssignmentGroupsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List ServiceNow assignment groups tags: - ServiceNow Integration /api/v2/integration/servicenow/business_services/{instance_id}: get: description: |- Get all business services for a ServiceNow instance. operationId: ListServiceNowBusinessServices parameters: - description: The ID of the ServiceNow instance example: "65b3341b-0680-47f9-a6d4-134db45c603e" in: path name: instance_id required: true schema: format: uuid type: string responses: "200": content: application/json: examples: default: value: data: - attributes: instance_id: 00000000-0000-0000-0000-000000000001 service_name: IT Support service_sys_id: abc-123 id: 00000000-0000-0000-0000-000000000001 type: business_services schema: $ref: "#/components/schemas/ServiceNowBusinessServicesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List ServiceNow business services tags: - ServiceNow Integration /api/v2/integration/servicenow/handles: get: description: |- Get all ServiceNow templates for the organization. operationId: ListServiceNowTemplates responses: "200": content: application/json: examples: default: value: data: - attributes: handle_name: incident-template instance_id: 00000000-0000-0000-0000-000000000001 servicenow_tablename: incident id: 00000000-0000-0000-0000-000000000001 type: servicenow_templates schema: $ref: "#/components/schemas/ServiceNowTemplatesResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List ServiceNow templates tags: - ServiceNow Integration post: description: |- Create a new ServiceNow template. operationId: CreateServiceNowTemplate requestBody: content: application/json: examples: default: value: data: attributes: assignment_group_id: 65b3341b-0680-47f9-a6d4-134db45c603e business_service_id: 65b3341b-0680-47f9-a6d4-134db45c603e fields_mapping: category: software priority: "1" handle_name: incident-template instance_id: 65b3341b-0680-47f9-a6d4-134db45c603e servicenow_tablename: incident user_id: 65b3341b-0680-47f9-a6d4-134db45c603e type: servicenow_templates schema: $ref: "#/components/schemas/ServiceNowTemplateCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: handle_name: incident-template instance_id: 00000000-0000-0000-0000-000000000001 servicenow_tablename: incident id: 00000000-0000-0000-0000-000000000001 type: servicenow_templates schema: $ref: "#/components/schemas/ServiceNowTemplateResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create ServiceNow template tags: - ServiceNow Integration /api/v2/integration/servicenow/handles/{template_id}: delete: description: |- Delete a ServiceNow template by ID. operationId: DeleteServiceNowTemplate parameters: - description: The ID of the ServiceNow template to delete example: "65b3341b-0680-47f9-a6d4-134db45c603e" in: path name: template_id required: true schema: format: uuid type: string responses: "200": description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete ServiceNow template tags: - ServiceNow Integration get: description: |- Get a ServiceNow template by ID. operationId: GetServiceNowTemplate parameters: - description: The ID of the ServiceNow template to retrieve example: "65b3341b-0680-47f9-a6d4-134db45c603e" in: path name: template_id required: true schema: format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: handle_name: incident-template instance_id: 00000000-0000-0000-0000-000000000001 servicenow_tablename: incident id: 00000000-0000-0000-0000-000000000001 type: servicenow_templates schema: $ref: "#/components/schemas/ServiceNowTemplateResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get ServiceNow template tags: - ServiceNow Integration put: description: |- Update a ServiceNow template by ID. operationId: UpdateServiceNowTemplate parameters: - description: The ID of the ServiceNow template to update example: "65b3341b-0680-47f9-a6d4-134db45c603e" in: path name: template_id required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: assignment_group_id: 65b3341b-0680-47f9-a6d4-134db45c603e business_service_id: 65b3341b-0680-47f9-a6d4-134db45c603e fields_mapping: category: hardware priority: "2" handle_name: incident-template-updated instance_id: 65b3341b-0680-47f9-a6d4-134db45c603e servicenow_tablename: incident user_id: 65b3341b-0680-47f9-a6d4-134db45c603e type: servicenow_templates schema: $ref: "#/components/schemas/ServiceNowTemplateUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: handle_name: incident-template-updated instance_id: 00000000-0000-0000-0000-000000000001 servicenow_tablename: incident id: 00000000-0000-0000-0000-000000000001 type: servicenow_templates schema: $ref: "#/components/schemas/ServiceNowTemplateResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update ServiceNow template tags: - ServiceNow Integration /api/v2/integration/servicenow/instances: get: description: |- Get all ServiceNow instances for the organization. operationId: ListServiceNowInstances responses: "200": content: application/json: examples: default: value: data: - attributes: instance_name: my-servicenow-instance id: 00000000-0000-0000-0000-000000000001 type: instance schema: $ref: "#/components/schemas/ServiceNowInstancesResponse" description: OK "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List ServiceNow instances tags: - ServiceNow Integration /api/v2/integration/servicenow/users/{instance_id}: get: description: |- Get all users for a ServiceNow instance. operationId: ListServiceNowUsers parameters: - description: The ID of the ServiceNow instance example: "65b3341b-0680-47f9-a6d4-134db45c603e" in: path name: instance_id required: true schema: format: uuid type: string responses: "200": content: application/json: examples: default: value: data: - attributes: email: test@example.com full_name: Example Name instance_id: 00000000-0000-0000-0000-000000000001 user_name: example-handle user_sys_id: 00000000-0000-0000-0000-000000000001 id: 00000000-0000-0000-0000-000000000001 type: users schema: $ref: "#/components/schemas/ServiceNowUsersResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List ServiceNow users tags: - ServiceNow Integration /api/v2/integration/slack/user-bindings: get: description: List all Slack user bindings for a given Datadog user from the Datadog Slack integration. operationId: ListSlackUserBindings parameters: - $ref: "#/components/parameters/SlackUserUuidQueryParameter" responses: "200": content: application/json: examples: default: value: data: - id: T01234567 type: team_id - id: T09876543 type: team_id schema: $ref: "#/components/schemas/SlackUserBindingsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Slack user bindings tags: - Slack Integration /api/v2/integration/statuspage/account: delete: description: Delete the Statuspage account configured for your organization. operationId: DeleteStatuspageAccount responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete the Statuspage account tags: - Statuspage Integration "x-permission": operator: OR permissions: - manage_integrations get: description: Get the Statuspage account configured for your organization. operationId: GetStatuspageAccount responses: "200": content: application/json: examples: default: value: data: attributes: api_key: "*****" type: statuspage-account schema: $ref: "#/components/schemas/StatuspageAccountResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get the Statuspage account tags: - Statuspage Integration "x-permission": operator: OR permissions: - integrations_read patch: description: Update the Statuspage account configured for your organization. operationId: UpdateStatuspageAccount requestBody: content: application/json: examples: default: value: data: attributes: api_key: 00000000-0000-0000-0000-000000000000 type: statuspage-account schema: $ref: "#/components/schemas/StatuspageAccountUpdateRequest" description: Statuspage account payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: api_key: "*****" type: statuspage-account schema: $ref: "#/components/schemas/StatuspageAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update the Statuspage account tags: - Statuspage Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations post: description: |- Create a Statuspage account for your organization. Only one Statuspage account can be configured per organization. operationId: CreateStatuspageAccount requestBody: content: application/json: examples: default: value: data: attributes: api_key: 00000000-0000-0000-0000-000000000000 type: statuspage-account schema: $ref: "#/components/schemas/StatuspageAccountCreateRequest" description: Statuspage account payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: api_key: "*****" type: statuspage-account schema: $ref: "#/components/schemas/StatuspageAccountResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create the Statuspage account tags: - Statuspage Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integration/statuspage/url_settings: get: description: Get all Statuspage URL settings configured for your organization. operationId: ListStatuspageUrlSettings responses: "200": content: application/json: examples: default: value: data: - attributes: custom_tags: "team:collaboration-integrations" url: "https://example.statuspage.io" id: 00000000-0000-0000-0000-000000000001 type: statuspage-url-setting schema: $ref: "#/components/schemas/StatuspageUrlSettingsResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all Statuspage URL settings tags: - Statuspage Integration "x-permission": operator: OR permissions: - integrations_read post: description: Create a Statuspage URL setting for your organization. operationId: CreateStatuspageUrlSetting requestBody: content: application/json: examples: default: value: data: attributes: custom_tags: "team:collaboration-integrations" url: "https://example.statuspage.io" type: statuspage-url-setting schema: $ref: "#/components/schemas/StatuspageUrlSettingCreateRequest" description: Statuspage URL setting payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: custom_tags: "team:collaboration-integrations" url: "https://example.statuspage.io" id: 00000000-0000-0000-0000-000000000002 type: statuspage-url-setting schema: $ref: "#/components/schemas/StatuspageUrlSettingResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a Statuspage URL setting tags: - Statuspage Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integration/statuspage/url_settings/{statuspage_url_setting_id}: delete: description: Delete a single Statuspage URL setting from your organization. operationId: DeleteStatuspageUrlSetting parameters: - $ref: "#/components/parameters/StatuspageUrlSettingIDPathParameter" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a Statuspage URL setting tags: - Statuspage Integration "x-permission": operator: OR permissions: - manage_integrations patch: description: Update a single Statuspage URL setting in your organization. operationId: UpdateStatuspageUrlSetting parameters: - $ref: "#/components/parameters/StatuspageUrlSettingIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: custom_tags: "team:collaboration-integrations" url: "https://example.statuspage.io" id: 596da4af-0563-4097-90ff-07230c3f9db3 type: statuspage-url-setting schema: $ref: "#/components/schemas/StatuspageUrlSettingUpdateRequest" description: Statuspage URL setting payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: custom_tags: "team:collaboration-integrations" url: "https://example.statuspage.io" id: 00000000-0000-0000-0000-000000000003 type: statuspage-url-setting schema: $ref: "#/components/schemas/StatuspageUrlSettingResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a Statuspage URL setting tags: - Statuspage Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integration/webhooks/configuration/auth-method: get: description: |- Get a list of all auth methods configured for the Webhooks integration in your organization. operationId: GetAllAuthMethods parameters: - $ref: "#/components/parameters/WebhooksAuthMethodInclude" responses: "200": content: application/json: examples: default: value: data: - attributes: protocol: oauth2-client-credentials id: 00000000-0000-0000-0000-000000000001 relationships: oauth2-client-credentials: data: id: 00000000-0000-0000-0000-000000000001 type: webhooks-auth-method-oauth2-client-credentials type: webhooks-auth-method schema: $ref: "#/components/schemas/WebhooksAuthMethodsResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all auth methods tags: - Webhooks Integration "x-permission": operator: OR permissions: - integrations_read /api/v2/integration/webhooks/configuration/auth-method/oauth2-client-credentials: post: description: |- Create a new OAuth2 client credentials auth method for the Webhooks integration. The `client_secret` is stored securely and never returned. operationId: CreateOAuth2ClientCredentials requestBody: content: application/json: examples: default: value: data: attributes: access_token_url: https://example.com/oauth/token audience: https://api.example.com client_id: my-client-id client_secret: my-client-secret name: my-oauth2-auth scope: read:webhooks write:webhooks type: webhooks-auth-method-oauth2-client-credentials schema: $ref: "#/components/schemas/WebhooksOAuth2ClientCredentialsCreateRequest" description: OAuth2 client credentials payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: access_token_url: https://example.com/oauth/token audience: https://api.example.com client_id: my-client-id name: my-oauth2-auth protocol: oauth2-client-credentials scope: read:webhooks write:webhooks id: 00000000-0000-0000-0000-000000000002 type: webhooks-auth-method-oauth2-client-credentials schema: $ref: "#/components/schemas/WebhooksOAuth2ClientCredentialsResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create an OAuth2 client credentials auth method tags: - Webhooks Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integration/webhooks/configuration/auth-method/oauth2-client-credentials/{auth_method_id}: delete: description: Delete an OAuth2 client credentials auth method by ID. operationId: DeleteOAuth2ClientCredentials parameters: - $ref: "#/components/parameters/WebhooksAuthMethodIDPathParameter" responses: "204": description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an OAuth2 client credentials auth method tags: - Webhooks Integration "x-permission": operator: OR permissions: - manage_integrations get: description: Get a single OAuth2 client credentials auth method by ID. operationId: GetOAuth2ClientCredentials parameters: - $ref: "#/components/parameters/WebhooksAuthMethodIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: access_token_url: https://example.com/oauth/token audience: https://api.example.com client_id: my-client-id name: my-oauth2-auth protocol: oauth2-client-credentials scope: read:webhooks write:webhooks id: 00000000-0000-0000-0000-000000000003 type: webhooks-auth-method-oauth2-client-credentials schema: $ref: "#/components/schemas/WebhooksOAuth2ClientCredentialsResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get an OAuth2 client credentials auth method tags: - Webhooks Integration "x-permission": operator: OR permissions: - integrations_read patch: description: Update an existing OAuth2 client credentials auth method. operationId: UpdateOAuth2ClientCredentials parameters: - $ref: "#/components/parameters/WebhooksAuthMethodIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: name: my-oauth2-auth-renamed type: webhooks-auth-method-oauth2-client-credentials schema: $ref: "#/components/schemas/WebhooksOAuth2ClientCredentialsUpdateRequest" description: OAuth2 client credentials payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: access_token_url: https://example.com/oauth/token audience: https://api.example.com client_id: my-client-id name: my-oauth2-auth-renamed protocol: oauth2-client-credentials scope: read:webhooks write:webhooks id: 00000000-0000-0000-0000-000000000004 type: webhooks-auth-method-oauth2-client-credentials schema: $ref: "#/components/schemas/WebhooksOAuth2ClientCredentialsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update an OAuth2 client credentials auth method tags: - Webhooks Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integrations: get: operationId: ListIntegrations responses: "200": content: application/json: examples: default: value: data: - attributes: categories: - Category::Kubernetes description: Calico is a networking and network security solution for containers. installed: true title: calico id: calico type: integration schema: $ref: "#/components/schemas/ListIntegrationsResponse" description: Successful Response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List Integrations tags: - Integrations /api/v2/integrations/cloudflare/accounts: get: description: List Cloudflare accounts. operationId: ListCloudflareAccounts responses: "200": content: application/json: examples: default: value: data: - attributes: email: test@example.com name: test-name resources: - web - dns - lb - worker zones: - zone_id_1 - zone_id_2 id: abc-123 type: cloudflare-accounts schema: $ref: "#/components/schemas/CloudflareAccountsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Cloudflare accounts tags: - Cloudflare Integration "x-permission": operator: OR permissions: - integrations_read post: description: Create a Cloudflare account. operationId: CreateCloudflareAccount requestBody: content: application/json: examples: default: value: data: attributes: api_key: EXAMPLE_API_KEY_abc123 email: test-email@example.com name: test-name resources: - web - dns - lb - worker zones: - zone_id_1 - zone_id_2 type: cloudflare-accounts schema: $ref: "#/components/schemas/CloudflareAccountCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: email: test@example.com name: test-name id: abc-123 type: cloudflare-accounts schema: $ref: "#/components/schemas/CloudflareAccountResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Add Cloudflare account tags: - Cloudflare Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integrations/cloudflare/accounts/{account_id}: delete: description: Delete a Cloudflare account. operationId: DeleteCloudflareAccount parameters: - description: None in: path name: account_id required: true schema: type: string responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete Cloudflare account tags: - Cloudflare Integration "x-permission": operator: OR permissions: - manage_integrations get: description: Get a Cloudflare account. operationId: GetCloudflareAccount parameters: - description: None in: path name: account_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: email: test@example.com name: test-name resources: - web - dns - lb - worker zones: - zone_id_1 - zone_id_2 id: abc-123 type: cloudflare-accounts schema: $ref: "#/components/schemas/CloudflareAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get Cloudflare account tags: - Cloudflare Integration "x-permission": operator: OR permissions: - integrations_read patch: description: Update a Cloudflare account. operationId: UpdateCloudflareAccount parameters: - description: None in: path name: account_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: api_key: EXAMPLE_API_KEY_abc123 email: test-email@example.com resources: - web - dns - lb - worker zones: - zone_id_1 - zone_id_2 type: cloudflare-accounts schema: $ref: "#/components/schemas/CloudflareAccountUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: email: test@example.com name: test-name resources: - web - dns - lb - worker zones: - zone_id_1 - zone_id_2 id: abc-123 type: cloudflare-accounts schema: $ref: "#/components/schemas/CloudflareAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update Cloudflare account tags: - Cloudflare Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integrations/confluent-cloud/accounts: get: description: List Confluent accounts. operationId: ListConfluentAccount responses: "200": content: application/json: examples: default: value: data: - attributes: api_key: abc-123-key tags: - myTag id: abc-123 type: confluent-cloud-accounts schema: $ref: "#/components/schemas/ConfluentAccountsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Confluent accounts tags: - Confluent Cloud "x-permission": operator: OR permissions: - integrations_read post: description: Create a Confluent account. operationId: CreateConfluentAccount requestBody: content: application/json: examples: default: value: data: attributes: api_key: TESTAPIKEY123 api_secret: test-api-secret-123 resources: - enable_custom_metrics: false id: resource-id-123 resource_type: kafka tags: - myTag - myTag2:myValue tags: - myTag - myTag2:myValue type: confluent-cloud-accounts schema: $ref: "#/components/schemas/ConfluentAccountCreateRequest" description: Confluent payload required: true responses: "201": content: application/json: examples: default: value: data: attributes: api_key: abc-123-key tags: - myTag id: abc-123 type: confluent-cloud-accounts schema: $ref: "#/components/schemas/ConfluentAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Add Confluent account tags: - Confluent Cloud x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integrations/confluent-cloud/accounts/{account_id}: delete: description: Delete a Confluent account with the provided account ID. operationId: DeleteConfluentAccount parameters: - $ref: "#/components/parameters/ConfluentAccountID" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete Confluent account tags: - Confluent Cloud "x-permission": operator: OR permissions: - manage_integrations get: description: Get the Confluent account with the provided account ID. operationId: GetConfluentAccount parameters: - $ref: "#/components/parameters/ConfluentAccountID" responses: "200": content: application/json: examples: default: value: data: attributes: api_key: abc-123-key tags: - myTag id: abc-123 type: confluent-cloud-accounts schema: $ref: "#/components/schemas/ConfluentAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get Confluent account tags: - Confluent Cloud "x-permission": operator: OR permissions: - integrations_read patch: description: Update the Confluent account with the provided account ID. operationId: UpdateConfluentAccount parameters: - $ref: "#/components/parameters/ConfluentAccountID" requestBody: content: application/json: examples: default: value: data: attributes: api_key: TESTAPIKEY123 api_secret: test-api-secret-123 tags: - myTag - myTag2:myValue type: confluent-cloud-accounts schema: $ref: "#/components/schemas/ConfluentAccountUpdateRequest" description: Confluent payload required: true responses: "200": content: application/json: examples: default: value: data: attributes: api_key: abc-123-key tags: - myTag id: abc-123 type: confluent-cloud-accounts schema: $ref: "#/components/schemas/ConfluentAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update Confluent account tags: - Confluent Cloud x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integrations/confluent-cloud/accounts/{account_id}/resources: get: description: Get a Confluent resource for the account associated with the provided ID. operationId: ListConfluentResource parameters: - $ref: "#/components/parameters/ConfluentAccountID" responses: "200": content: application/json: examples: default: value: data: - attributes: enable_custom_metrics: false resource_type: kafka tags: - myTag id: abc-123 type: confluent-cloud-resources schema: $ref: "#/components/schemas/ConfluentResourcesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Confluent Account resources tags: - Confluent Cloud "x-permission": operator: OR permissions: - integrations_read post: description: Create a Confluent resource for the account associated with the provided ID. operationId: CreateConfluentResource parameters: - $ref: "#/components/parameters/ConfluentAccountID" requestBody: content: application/json: examples: default: value: data: attributes: enable_custom_metrics: false resource_type: kafka tags: - myTag - myTag2:myValue id: resource-id-123 type: confluent-cloud-resources schema: $ref: "#/components/schemas/ConfluentResourceRequest" description: Confluent payload required: true responses: "201": content: application/json: examples: default: value: data: attributes: enable_custom_metrics: false resource_type: kafka tags: - myTag id: abc-123 type: confluent-cloud-resources schema: $ref: "#/components/schemas/ConfluentResourceResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Add resource to Confluent account tags: - Confluent Cloud x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integrations/confluent-cloud/accounts/{account_id}/resources/{resource_id}: delete: description: Delete a Confluent resource with the provided resource id for the account associated with the provided account ID. operationId: DeleteConfluentResource parameters: - $ref: "#/components/parameters/ConfluentAccountID" - $ref: "#/components/parameters/ConfluentResourceID" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete resource from Confluent account tags: - Confluent Cloud "x-permission": operator: OR permissions: - manage_integrations get: description: Get a Confluent resource with the provided resource id for the account associated with the provided account ID. operationId: GetConfluentResource parameters: - $ref: "#/components/parameters/ConfluentAccountID" - $ref: "#/components/parameters/ConfluentResourceID" responses: "200": content: application/json: examples: default: value: data: attributes: enable_custom_metrics: false resource_type: kafka tags: - myTag id: abc-123 type: confluent-cloud-resources schema: $ref: "#/components/schemas/ConfluentResourceResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get resource from Confluent account tags: - Confluent Cloud "x-permission": operator: OR permissions: - integrations_read patch: description: Update a Confluent resource with the provided resource id for the account associated with the provided account ID. operationId: UpdateConfluentResource parameters: - $ref: "#/components/parameters/ConfluentAccountID" - $ref: "#/components/parameters/ConfluentResourceID" requestBody: content: application/json: examples: default: value: data: attributes: enable_custom_metrics: false resource_type: kafka tags: - myTag - myTag2:myValue id: resource-id-123 type: confluent-cloud-resources schema: $ref: "#/components/schemas/ConfluentResourceRequest" description: Confluent payload required: true responses: "200": content: application/json: examples: default: value: data: attributes: enable_custom_metrics: false resource_type: kafka tags: - myTag id: abc-123 type: confluent-cloud-resources schema: $ref: "#/components/schemas/ConfluentResourceResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update resource in Confluent account tags: - Confluent Cloud x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integrations/fastly/accounts: get: description: List Fastly accounts. operationId: ListFastlyAccounts responses: "200": content: application/json: examples: default: value: data: - attributes: name: test-name services: [] id: abc-123 type: fastly-accounts schema: $ref: "#/components/schemas/FastlyAccountsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Fastly accounts tags: - Fastly Integration "x-permission": operator: OR permissions: - integrations_read post: description: Create a Fastly account. operationId: CreateFastlyAccount requestBody: content: application/json: examples: default: value: data: attributes: api_key: ABCDEFG123 name: test-name services: - id: 6abc7de6893AbcDe9fghIj tags: - myTag - myTag2:myValue type: fastly-accounts schema: $ref: "#/components/schemas/FastlyAccountCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: name: test-name services: [] id: abc-123 type: fastly-accounts schema: $ref: "#/components/schemas/FastlyAccountResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Add Fastly account tags: - Fastly Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integrations/fastly/accounts/{account_id}: delete: description: Delete a Fastly account. operationId: DeleteFastlyAccount parameters: - $ref: "#/components/parameters/FastlyAccountID" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete Fastly account tags: - Fastly Integration "x-permission": operator: OR permissions: - manage_integrations get: description: Get a Fastly account. operationId: GetFastlyAccount parameters: - $ref: "#/components/parameters/FastlyAccountID" responses: "200": content: application/json: examples: default: value: data: attributes: name: test-name services: [] id: abc-123 type: fastly-accounts schema: $ref: "#/components/schemas/FastlyAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get Fastly account tags: - Fastly Integration "x-permission": operator: OR permissions: - integrations_read patch: description: Update a Fastly account. operationId: UpdateFastlyAccount parameters: - $ref: "#/components/parameters/FastlyAccountID" requestBody: content: application/json: examples: default: value: data: attributes: api_key: ABCDEFG123 type: fastly-accounts schema: $ref: "#/components/schemas/FastlyAccountUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: name: test-name services: [] id: abc-123 type: fastly-accounts schema: $ref: "#/components/schemas/FastlyAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update Fastly account tags: - Fastly Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integrations/fastly/accounts/{account_id}/services: get: description: List Fastly services for an account. operationId: ListFastlyServices parameters: - $ref: "#/components/parameters/FastlyAccountID" responses: "200": content: application/json: examples: default: value: data: - attributes: tags: - myTag id: abc-123 type: fastly-services schema: $ref: "#/components/schemas/FastlyServicesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Fastly services tags: - Fastly Integration "x-permission": operator: OR permissions: - integrations_read post: description: Create a Fastly service for an account. operationId: CreateFastlyService parameters: - $ref: "#/components/parameters/FastlyAccountID" requestBody: content: application/json: examples: default: value: data: attributes: tags: - myTag - myTag2:myValue id: abc123 type: fastly-services schema: $ref: "#/components/schemas/FastlyServiceRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: tags: - myTag id: abc-123 type: fastly-services schema: $ref: "#/components/schemas/FastlyServiceResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Add Fastly service tags: - Fastly Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integrations/fastly/accounts/{account_id}/services/{service_id}: delete: description: Delete a Fastly service for an account. operationId: DeleteFastlyService parameters: - $ref: "#/components/parameters/FastlyAccountID" - $ref: "#/components/parameters/FastlyServiceID" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete Fastly service tags: - Fastly Integration "x-permission": operator: OR permissions: - manage_integrations get: description: Get a Fastly service for an account. operationId: GetFastlyService parameters: - $ref: "#/components/parameters/FastlyAccountID" - $ref: "#/components/parameters/FastlyServiceID" responses: "200": content: application/json: examples: default: value: data: attributes: tags: - myTag id: abc-123 type: fastly-services schema: $ref: "#/components/schemas/FastlyServiceResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get Fastly service tags: - Fastly Integration "x-permission": operator: OR permissions: - integrations_read patch: description: Update a Fastly service for an account. operationId: UpdateFastlyService parameters: - $ref: "#/components/parameters/FastlyAccountID" - $ref: "#/components/parameters/FastlyServiceID" requestBody: content: application/json: examples: default: value: data: attributes: tags: - myTag - myTag2:myValue id: abc123 type: fastly-services schema: $ref: "#/components/schemas/FastlyServiceRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: tags: - myTag id: abc-123 type: fastly-services schema: $ref: "#/components/schemas/FastlyServiceResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update Fastly service tags: - Fastly Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integrations/okta/accounts: get: description: List Okta accounts. operationId: ListOktaAccounts responses: "200": content: application/json: examples: default: value: data: - attributes: auth_method: oauth domain: "https://example.okta.com/" name: Okta-Prod id: 00000000-0000-0000-0000-000000000001 type: okta-accounts schema: $ref: "#/components/schemas/OktaAccountsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Okta accounts tags: - Okta Integration "x-permission": operator: OR permissions: - integrations_read post: description: Create an Okta account. operationId: CreateOktaAccount requestBody: content: application/json: examples: default: value: data: attributes: auth_method: oauth client_id: client_id client_secret: client_secret domain: https://example.okta.com/ name: Okta-Prod id: f749daaf-682e-4208-a38d-c9b43162c609 type: okta-accounts schema: $ref: "#/components/schemas/OktaAccountRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: auth_method: oauth domain: "https://example.okta.com/" name: Okta-Prod id: 00000000-0000-0000-0000-000000000002 type: okta-accounts schema: $ref: "#/components/schemas/OktaAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Add Okta account tags: - Okta Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/integrations/okta/accounts/{account_id}: delete: description: Delete an Okta account. operationId: DeleteOktaAccount parameters: - description: None in: path name: account_id required: true schema: type: string responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete Okta account tags: - Okta Integration "x-permission": operator: OR permissions: - manage_integrations get: description: Get an Okta account. operationId: GetOktaAccount parameters: - description: None in: path name: account_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: auth_method: oauth domain: "https://example.okta.com/" name: Okta-Prod id: 00000000-0000-0000-0000-000000000003 type: okta-accounts schema: $ref: "#/components/schemas/OktaAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get Okta account tags: - Okta Integration "x-permission": operator: OR permissions: - integrations_read patch: description: Update an Okta account. operationId: UpdateOktaAccount parameters: - description: None in: path name: account_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: auth_method: oauth domain: https://example.okta.com/ type: okta-accounts schema: $ref: "#/components/schemas/OktaAccountUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: auth_method: oauth domain: "https://example.okta.com/" name: Okta-Prod id: 00000000-0000-0000-0000-000000000004 type: okta-accounts schema: $ref: "#/components/schemas/OktaAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update Okta account tags: - Okta Integration x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations /api/v2/ip_allowlist: get: description: Returns the IP allowlist and its enabled or disabled state. operationId: GetIPAllowlist responses: "200": content: application/json: examples: default: value: data: attributes: enabled: false entries: - data: attributes: cidr_block: "127.0.0.1/32" note: "Example entry" id: 00000000-0000-0000-0000-000000000003 type: ip_allowlist_entry id: 00000000-0000-0000-0000-000000000001 type: ip_allowlist schema: $ref: "#/components/schemas/IPAllowlistResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management summary: Get IP Allowlist tags: - IP Allowlist "x-permission": operator: OR permissions: - org_management patch: description: Edit the entries in the IP allowlist, and enable or disable it. operationId: UpdateIPAllowlist requestBody: content: application/json: examples: default: value: data: attributes: enabled: false entries: - data: attributes: cidr_block: 127.0.0.1/32 type: ip_allowlist_entry type: ip_allowlist schema: $ref: "#/components/schemas/IPAllowlistUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: enabled: false entries: - data: attributes: cidr_block: "127.0.0.1/32" note: "Example entry" id: 00000000-0000-0000-0000-000000000004 type: ip_allowlist_entry id: 00000000-0000-0000-0000-000000000002 type: ip_allowlist schema: $ref: "#/components/schemas/IPAllowlistResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management summary: Update IP Allowlist tags: - IP Allowlist x-codegen-request-body-name: body "x-permission": operator: OR permissions: - org_management /api/v2/llm-obs/v1/annotated-interactions: get: description: |- Returns annotated interactions across all annotation queues for the given content IDs. Results include queue metadata (ID and name) for each interaction. operationId: GetLLMObsAnnotatedInteractionsByTraceIDs parameters: - description: One or more content IDs to retrieve annotated interactions for. At least one is required. in: query name: contentIds required: true schema: items: type: string type: array - description: Pagination offset. Must be >= 0. Defaults to 0. in: query name: offset schema: default: 0 format: int32 maximum: 2147483647 minimum: 0 type: integer - description: Maximum number of results to return. Must be > 0. Defaults to 100. in: query name: limit schema: default: 100 format: int32 maximum: 2147483647 minimum: 1 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: annotated_interactions: - annotations: - created_at: "0001-01-01T00:00:00Z" created_by: "00000000-0000-0000-0000-000000000002" id: annotation-789 interaction_id: interaction-456 label_values: - label_schema_id: abc-123 value: good modified_at: "0001-01-01T00:00:00Z" modified_by: "00000000-0000-0000-0000-000000000002" can_annotate: true content_id: trace-abc-123 created_at: "2025-06-01T12:00:00Z" id: interaction-456 modified_at: "2025-06-01T12:00:00Z" queue_id: queue-uuid-001 queue_name: My Annotation Queue type: trace total_count: 1 id: trace-query type: annotated_interactions_by_trace schema: $ref: "#/components/schemas/LLMObsAnnotatedInteractionsByTraceResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get annotated interactions by content IDs tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/annotation-queues: get: description: |- List annotation queues. Optionally filter by project ID or queue IDs. These parameters are mutually exclusive. If neither is provided, all queues in the organization are returned. operationId: ListLLMObsAnnotationQueues parameters: - description: Filter annotation queues by project ID. Cannot be used together with `queueIds`. in: query name: projectId schema: type: string - description: >- Filter annotation queues by queue IDs (comma-separated). Cannot be used together with `projectId`. in: query name: queueIds schema: items: type: string type: array responses: "200": content: application/json: examples: default: value: data: - attributes: can_manage_access: true created_at: "2024-01-15T10:30:00Z" created_by: 00000000-0000-0000-0000-000000000002 description: Queue for annotating customer support traces modified_at: "2024-01-15T10:30:00Z" modified_by: 00000000-0000-0000-0000-000000000002 name: My annotation queue owned_by: 00000000-0000-0000-0000-000000000002 project_id: 00000000-0000-0000-0000-000000000002 restrict_to_assignees: false restrict_to_reviewers: true reviewer_emails: - reviewer@example.com id: 00000000-0000-0000-0000-000000000001 type: queues schema: $ref: "#/components/schemas/LLMObsAnnotationQueuesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List Agent Observability annotation queues tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Create an annotation queue. The `name` and `project_id` fields are required. An optional `annotation_schema` can be provided to define the labels for the queue. Optional access-control fields can restrict annotation access to reviewers or assignees. Fields such as `created_by`, `owned_by`, `created_at`, `modified_by`, and `modified_at` are inferred by the backend. operationId: CreateLLMObsAnnotationQueue requestBody: content: application/json: examples: default: value: data: attributes: description: Queue for annotating customer support traces name: My annotation queue project_id: 00000000-0000-0000-0000-000000000002 type: queues with_access_controls: summary: Create queue with access controls value: data: attributes: description: Queue for annotating customer support traces name: Restricted annotation queue project_id: 00000000-0000-0000-0000-000000000002 restrict_to_assignees: false restrict_to_reviewers: true reviewer_emails: - reviewer@example.com type: queues with_schema: summary: Create queue with annotation schema value: data: attributes: annotation_schema: label_schemas: - is_required: true max: 5.0 min: 0.0 name: quality type: score - name: sentiment type: categorical values: - positive - negative - neutral description: Queue for annotating customer support traces name: My annotation queue project_id: 00000000-0000-0000-0000-000000000002 type: queues schema: $ref: "#/components/schemas/LLMObsAnnotationQueueRequest" description: Create annotation queue payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: can_manage_access: true created_at: "2024-01-15T10:30:00Z" created_by: 00000000-0000-0000-0000-000000000002 description: Queue for annotating customer support traces modified_at: "2024-01-15T10:30:00Z" modified_by: 00000000-0000-0000-0000-000000000002 name: My annotation queue owned_by: 00000000-0000-0000-0000-000000000002 project_id: 00000000-0000-0000-0000-000000000002 restrict_to_assignees: false restrict_to_reviewers: true reviewer_emails: - reviewer@example.com id: 00000000-0000-0000-0000-000000000001 type: queues schema: $ref: "#/components/schemas/LLMObsAnnotationQueueResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create an Agent Observability annotation queue tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/annotation-queues/{queue_id}: delete: description: Delete an annotation queue by its ID. operationId: DeleteLLMObsAnnotationQueue parameters: - $ref: "#/components/parameters/LLMObsAnnotationQueueIDPathParameter" responses: "204": description: No Content "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete an Agent Observability annotation queue tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: |- Partially update an annotation queue. The `name`, `description`, `annotation_schema`, `reviewer_emails`, `restrict_to_reviewers`, and `restrict_to_assignees` fields can be updated. operationId: UpdateLLMObsAnnotationQueue parameters: - $ref: "#/components/parameters/LLMObsAnnotationQueueIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: description: Updated description name: Updated queue name restrict_to_assignees: false restrict_to_reviewers: true reviewer_emails: - reviewer@example.com type: queues schema: $ref: "#/components/schemas/LLMObsAnnotationQueueUpdateRequest" description: Update annotation queue payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: can_manage_access: true created_at: "2024-01-15T10:30:00Z" created_by: 00000000-0000-0000-0000-000000000002 description: Queue for annotating customer support traces modified_at: "2024-01-15T10:30:00Z" modified_by: 00000000-0000-0000-0000-000000000002 name: My annotation queue owned_by: 00000000-0000-0000-0000-000000000002 project_id: 00000000-0000-0000-0000-000000000002 restrict_to_assignees: false restrict_to_reviewers: true reviewer_emails: - reviewer@example.com id: 00000000-0000-0000-0000-000000000001 type: queues schema: $ref: "#/components/schemas/LLMObsAnnotationQueueResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update an Agent Observability annotation queue tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/annotation-queues/{queue_id}/annotated-interactions: get: description: Retrieve all interactions (traces and sessions) and their annotations for a given annotation queue. operationId: GetLLMObsAnnotatedInteractions parameters: - $ref: "#/components/parameters/LLMObsAnnotationQueueIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: annotated_interactions: - annotations: [] can_annotate: true content_id: trace-abc-123 id: interaction-456 type: trace id: 00000000-0000-0000-0000-000000000001 type: annotated_interactions schema: $ref: "#/components/schemas/LLMObsAnnotatedInteractionsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get annotated queue interactions tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/annotation-queues/{queue_id}/annotated-interactions/{interaction_id}: get: description: Retrieve an interaction, its annotations, and a page of related events from an annotation queue. operationId: GetLLMObsAnnotatedInteraction parameters: - $ref: "#/components/parameters/LLMObsAnnotationQueueIDPathParameter" - $ref: "#/components/parameters/LLMObsAnnotationQueueInteractionIDPathParameter" - description: Maximum number of events to return. Defaults to 10. in: query name: limit schema: default: 10 format: int32 maximum: 1000 minimum: 1 type: integer - description: Cursor from the previous response to retrieve the next page of events. in: query name: cursor schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: annotated_interaction: annotations: [] can_annotate: true content_id: trace-abc-123 created_at: "2024-01-15T10:30:00Z" id: interaction-456 modified_at: "2024-01-15T10:30:00Z" type: trace events: - attributes: duration: 1500000000 ml_app: my-llm-app name: agent_workflow span_id: span-7a1b2c3d span_kind: agent start_ns: 1705314600000000000 status: ok trace_id: trace-abc-123 id: span-7a1b2c3d type: span interaction_type: session next_cursor: eyJzdGFydCI6MTAwfQ== id: interaction-456 type: annotated_interactions schema: $ref: "#/components/schemas/LLMObsAnnotatedInteractionResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get an annotated queue interaction tags: - Agent Observability x-pagination: cursorParam: cursor cursorPath: data.attributes.next_cursor limitParam: limit resultsPath: data.attributes.events x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/annotation-queues/{queue_id}/annotations: post: description: |- Create or update annotations on interactions in a queue. Each annotation is matched by `interaction_id` and the requesting user's identity. Results and errors in the response are linked to request items by `interaction_id`. Errors for individual items are returned in the `errors` field without blocking the rest of the batch. Requests where every item is denied by queue access rules return `403`. operationId: UpsertLLMObsAnnotations parameters: - $ref: "#/components/parameters/LLMObsAnnotationQueueIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: annotations: - interaction_id: 00000000-0000-0000-0000-000000000001 label_values: - label_schema_id: abc-123 value: good - label_schema_id: ef56gh78 value: positive type: annotations schema: $ref: "#/components/schemas/LLMObsAnnotationsRequest" description: Payload for creating or updating annotations. required: true responses: "200": content: application/json: examples: default: value: data: attributes: annotations: - created_at: "2024-01-15T10:30:00Z" created_by: 00000000-0000-0000-0000-000000000002 id: 00000000-0000-0000-0000-000000000000 interaction_id: 00000000-0000-0000-0000-000000000001 label_values: - label_schema_id: abc-123 value: good modified_at: "2024-01-15T10:30:00Z" modified_by: 00000000-0000-0000-0000-000000000002 id: 00000000-0000-0000-0000-000000000001 type: annotations mixed_access_denied: summary: Some annotations were denied by queue access rules value: data: attributes: annotations: - created_at: "2024-01-15T10:30:00Z" created_by: 00000000-0000-0000-0000-000000000002 id: 00000000-0000-0000-0000-000000000000 interaction_id: 00000000-0000-0000-0000-000000000001 label_values: - label_schema_id: abc-123 value: good modified_at: "2024-01-15T10:30:00Z" modified_by: 00000000-0000-0000-0000-000000000002 errors: - code: permission_denied error: permission denied interaction_id: 00000000-0000-0000-0000-000000000003 id: 00000000-0000-0000-0000-000000000001 type: annotations schema: $ref: "#/components/schemas/LLMObsAnnotationsResponse" description: >- OK — annotations created or updated. For mixed batches, denied items and other per-item errors are listed in `errors`. "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden — all request items were denied by queue access rules "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found — the queue does not exist. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create or update annotations tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/annotation-queues/{queue_id}/annotations/delete: post: description: Delete one or more annotations from an annotation queue. operationId: DeleteLLMObsAnnotations parameters: - $ref: "#/components/parameters/LLMObsAnnotationQueueIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: annotation_ids: - 00000000-0000-0000-0000-000000000000 type: annotations schema: $ref: "#/components/schemas/LLMObsDeleteAnnotationsRequest" description: Delete annotations payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: annotation_ids: - 00000000-0000-0000-0000-000000000000 errors: [] id: 00000000-0000-0000-0000-000000000001 type: annotations partial_failure: summary: Some annotation IDs were not found value: data: attributes: annotation_ids: - 00000000-0000-0000-0000-000000000000 errors: - annotation_id: 00000000-0000-0000-0000-000000000001 error: annotation not found id: 00000000-0000-0000-0000-000000000001 type: annotations schema: $ref: "#/components/schemas/LLMObsDeleteAnnotationsResponse" description: >- OK — annotations deleted. Errors for annotations that could not be deleted are listed in `errors`. "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found — the queue does not exist. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete annotations tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/annotation-queues/{queue_id}/interactions: post: description: |- Add one or more interactions to an annotation queue. At least one interaction must be provided. Each interaction has a `type`: - `trace`, `experiment_trace`, `session`: `content_id` references the upstream entity; the server fetches the actual content. - `display_block`: omit `content_id` and provide the rendered content in `display_block`. The server generates `content_id` as a deterministic hash of the block list. Items of different types can be mixed in a single request. operationId: CreateLLMObsAnnotationQueueInteractions parameters: - $ref: "#/components/parameters/LLMObsAnnotationQueueIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: interactions: - content_id: trace-abc-123 type: trace type: interactions display_block: summary: Add a display_block interaction value: data: attributes: interactions: - display_block: - content: "## Triage Instructions" type: markdown - content: "Inputs" level: md type: header - content: experiment_id: abc-123 label: "Experiments" type: json - code: '
Ready for review
' label: "Review status" type: frontend type: display_block type: interactions schema: $ref: "#/components/schemas/LLMObsAnnotationQueueInteractionsRequest" description: Add interactions payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: interactions: - already_existed: false content_id: trace-abc-123 id: 00000000-0000-0000-0000-000000000000 type: trace id: 00000000-0000-0000-0000-000000000001 type: interactions display_block: summary: display_block response value: data: attributes: interactions: - already_existed: false content_id: 9a87f3e2b1d4c5a6f8b3e2d1c4a7b5f6e3d2a1c4b7e5f8a3d6c2e1b4a7d5f8c2 display_block: - content: "## Triage Instructions" type: markdown id: 00000000-0000-0000-0000-000000000000 type: display_block id: 00000000-0000-0000-0000-000000000001 type: interactions schema: $ref: "#/components/schemas/LLMObsAnnotationQueueInteractionsResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Add annotation queue interactions tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/annotation-queues/{queue_id}/interactions/delete: post: description: Delete one or more interactions from an annotation queue. operationId: DeleteLLMObsAnnotationQueueInteractions parameters: - $ref: "#/components/parameters/LLMObsAnnotationQueueIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: interaction_ids: - 00000000-0000-0000-0000-000000000000 - 00000000-0000-0000-0000-000000000001 type: interactions schema: $ref: "#/components/schemas/LLMObsDeleteAnnotationQueueInteractionsRequest" description: Delete interactions payload. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete annotation queue interactions tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/annotation-queues/{queue_id}/label-schema: get: description: Retrieve the label schema for a given annotation queue. operationId: GetLLMObsAnnotationQueueLabelSchema parameters: - $ref: "#/components/parameters/LLMObsAnnotationQueueIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: annotation_schema: label_schemas: - id: "abc-123" is_required: true max: 5.0 min: 0.0 name: quality type: score - id: "ef56gh78" name: sentiment type: categorical values: - positive - negative - neutral id: "00000000-0000-0000-0000-000000000001" type: queues schema: $ref: "#/components/schemas/LLMObsAnnotationQueueLabelSchemaResponse" description: OK "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get annotation queue label schema tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: |- Create or replace the label schema for a given annotation queue. The label schema defines the labels annotators can apply to interactions in the queue. Label names must be unique within the queue and match the pattern `^[a-zA-Z0-9_-]+$`. Each label must have a valid type: score, categorical, boolean, or text. operationId: UpdateLLMObsAnnotationQueueLabelSchema parameters: - $ref: "#/components/parameters/LLMObsAnnotationQueueIDPathParameter" requestBody: content: application/json: examples: boolean_label: summary: Boolean label schema value: data: attributes: annotation_schema: label_schemas: - has_assessment: true is_assessment: true is_required: true name: is_correct type: boolean type: queues categorical_label: summary: Categorical label schema value: data: attributes: annotation_schema: label_schemas: - is_required: true name: sentiment type: categorical values: - positive - negative - neutral type: queues default: value: data: attributes: annotation_schema: label_schemas: - is_required: true max: 5.0 min: 0.0 name: quality type: score type: queues score_label: summary: Score label schema value: data: attributes: annotation_schema: label_schemas: - has_reasoning: true is_required: true max: 5.0 min: 0.0 name: quality type: score type: queues text_label: summary: Text label schema value: data: attributes: annotation_schema: label_schemas: - is_required: false name: feedback type: text type: queues schema: $ref: "#/components/schemas/LLMObsAnnotationQueueLabelSchemaUpdateRequest" description: Update label schema payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: annotation_schema: label_schemas: - id: abc-123 is_required: true max: 5.0 min: 0.0 name: quality type: score id: 00000000-0000-0000-0000-000000000001 type: queues schema: $ref: "#/components/schemas/LLMObsAnnotationQueueLabelSchemaResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update annotation queue label schema tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/experimentation/analytics: post: description: |- Execute an analytics aggregation over Agent Observability experimentation data. Use this endpoint to compute metrics (for example average eval scores) grouped by fields such as `span_id` or `experiment_id`. At least one `compute` definition and one `index` must be provided. operationId: AggregateLLMObsExperimentation requestBody: content: application/json: examples: default: value: data: attributes: aggregate: compute: - metric: score_value name: avg_faithfulness group_by: - field: span_id indexes: - experiment-evals search: query: "@experiment_id:3fd6b5e0-8910-4b1c-a7d0-5b84de329012 @label:faithfulness" type: experimentation schema: $ref: "#/components/schemas/LLMObsExperimentationAnalyticsRequest" description: Analytics payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: hit_count: 42 result: values: - by: span_id: span-7a1b2c3d metrics: avg_faithfulness: 0.87 id: 00000000-0000-0000-0000-000000000001 type: experimentation schema: $ref: "#/components/schemas/LLMObsExperimentationAnalyticsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Aggregate Agent Observability experimentation tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/experimentation/search: post: description: |- Search across Agent Observability experimentation entities — projects, datasets, dataset records, experiments, and experiment runs — using cursor-based pagination. The `filter.scope` field controls which entity types are returned. At least one valid scope must be provided. Returns `200 OK` when all results fit in a single page. Returns `206 Partial Content` with a cursor in `meta.after` when additional pages are available. operationId: SearchLLMObsExperimentation requestBody: content: application/json: examples: default: value: data: attributes: filter: query: "@project_id:a33671aa-24fd-4dcd-9b33-a8ec7dde7751" scope: - experiments page: limit: 50 type: experimentation schema: $ref: "#/components/schemas/LLMObsExperimentationSearchRequest" description: Experimentation search payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: experiments: - created_at: "2024-01-01T00:00:00+00:00" dataset_id: 9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d description: "" id: 3fd6b5e0-8910-4b1c-a7d0-5b84de329012 name: My Experiment v1 project_id: a33671aa-24fd-4dcd-9b33-a8ec7dde7751 updated_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000001 type: experimentation meta: after: schema: $ref: "#/components/schemas/LLMObsExperimentationSearchResponse" description: OK — all results returned in a single page. "206": content: application/json: examples: default: value: data: attributes: experiments: - created_at: "2024-01-01T00:00:00+00:00" dataset_id: 9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d description: "" id: 3fd6b5e0-8910-4b1c-a7d0-5b84de329012 name: My Experiment v1 project_id: a33671aa-24fd-4dcd-9b33-a8ec7dde7751 updated_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000001 type: experimentation meta: after: eyJpZCI6ImFiYzEyMyJ9 schema: $ref: "#/components/schemas/LLMObsExperimentationSearchResponse" description: Partial Content — more results are available. Use `meta.after` as the next `page.cursor`. "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Search Agent Observability experimentation tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/experimentation/simple-search: post: description: |- Search across Agent Observability experimentation entities using offset-based (page-number) pagination. Use this endpoint when you need total page count or want to navigate to a specific page number. The `filter.scope` field controls which entity types are returned. At least one valid scope must be provided. operationId: SimpleSearchLLMObsExperimentation requestBody: content: application/json: examples: default: value: data: attributes: filter: query: "@project_id:a33671aa-24fd-4dcd-9b33-a8ec7dde7751" scope: - experiments page: limit: 50 number: 1 sort: - direction: desc field: created_at type: experimentation schema: $ref: "#/components/schemas/LLMObsExperimentationSimpleSearchRequest" description: Simple search payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: experiments: - created_at: "2024-01-01T00:00:00+00:00" description: "" id: 3fd6b5e0-8910-4b1c-a7d0-5b84de329012 name: My Experiment v1 project_id: a33671aa-24fd-4dcd-9b33-a8ec7dde7751 updated_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000001 type: experimentation meta: page: current: 1 limit: 50 total_count: 63 total_pages: 2 schema: $ref: "#/components/schemas/LLMObsExperimentationSimpleSearchResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Simple search experimentation entities tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/experiments: get: description: List all Agent Observability experiments sorted by creation date, newest first. operationId: ListLLMObsExperiments parameters: - description: Filter experiments by project ID. Required if `filter[dataset_id]` is not provided. in: query name: filter[project_id] schema: type: string - description: Filter experiments by dataset ID. in: query name: filter[dataset_id] schema: type: string - description: Filter experiments by experiment ID. Can be specified multiple times. in: query name: filter[id] schema: type: string - description: Filter experiments by their exact run name. in: query name: filter[name] schema: type: string - description: >- Filter by logical experiment name. This is the `name` field set when creating an experiment through `POST /experiments`. Returns all experiment runs that share the same name, enabling cross-commit and cross-branch comparisons. in: query name: filter[experiment] schema: type: string - description: |- Filter by JSONB metadata containment. Provide a JSON object string where experiments whose metadata contains all specified key-value pairs are returned. For example: `{"commit":"abc123","branch":"main"}`. in: query name: filter[metadata] schema: type: string - description: >- Filter experiments by the ID of their parent (baseline) experiment. Returns all experiments that were run against the given baseline. Can be specified multiple times. in: query name: filter[parent_experiment_id] schema: type: string - description: When `true`, return only soft-deleted experiments. Defaults to `false`. in: query name: filter[is_deleted] schema: type: boolean - description: When `true`, enrich each experiment with its author's user data in the `author` field. in: query name: include[user_data] schema: type: boolean - description: When `true`, enrich each experiment with its dataset name in the `dataset_name` field. in: query name: include[dataset_names] schema: type: boolean - description: Use the pagination cursor returned in `meta.after` to retrieve the next page of results. in: query name: page[cursor] schema: type: string - description: |- Maximum number of results to return per page. Values above 5000 are clamped to 5000. Defaults to 5000. in: query name: page[limit] schema: format: int64 maximum: 5000 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: config: created_at: "2024-01-01T00:00:00+00:00" dataset_id: 00000000-0000-0000-0000-000000000011 description: "" metadata: name: My Experiment v1 project_id: 00000000-0000-0000-0000-000000000010 updated_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000009 type: experiments schema: $ref: "#/components/schemas/LLMObsExperimentsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List Agent Observability experiments tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a new Agent Observability experiment. operationId: CreateLLMObsExperiment requestBody: content: application/json: examples: default: value: data: attributes: dataset_id: 9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d name: My Experiment v1 project_id: a33671aa-24fd-4dcd-9b33-a8ec7dde7751 type: experiments schema: $ref: "#/components/schemas/LLMObsExperimentRequest" description: Create experiment payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: config: created_at: "2024-01-01T00:00:00+00:00" dataset_id: 00000000-0000-0000-0000-000000000014 description: "" metadata: name: My Experiment v1 project_id: 00000000-0000-0000-0000-000000000013 updated_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000012 type: experiments schema: $ref: "#/components/schemas/LLMObsExperimentResponse" description: OK "201": content: application/json: examples: default: value: data: attributes: config: created_at: "2024-01-01T00:00:00+00:00" dataset_id: 00000000-0000-0000-0000-000000000017 description: "" metadata: name: My Experiment v1 project_id: 00000000-0000-0000-0000-000000000016 updated_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000015 type: experiments schema: $ref: "#/components/schemas/LLMObsExperimentResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create an Agent Observability experiment tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/experiments/delete: post: description: Delete one or more Agent Observability experiments. operationId: DeleteLLMObsExperiments requestBody: content: application/json: examples: default: value: data: attributes: experiment_ids: - 3fd6b5e0-8910-4b1c-a7d0-5b84de329012 type: experiments schema: $ref: "#/components/schemas/LLMObsDeleteExperimentsRequest" description: Delete experiments payload. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete Agent Observability experiments tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/experiments/{experiment_id}: patch: description: Partially update an existing Agent Observability experiment. operationId: UpdateLLMObsExperiment parameters: - $ref: "#/components/parameters/LLMObsExperimentIDPathParameter" requestBody: content: application/json: examples: default: value: data: type: experiments schema: $ref: "#/components/schemas/LLMObsExperimentUpdateRequest" description: Update experiment payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: config: created_at: "2024-01-01T00:00:00+00:00" dataset_id: 00000000-0000-0000-0000-000000000020 description: "" metadata: name: My Experiment v1 project_id: 00000000-0000-0000-0000-000000000019 updated_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000018 type: experiments schema: $ref: "#/components/schemas/LLMObsExperimentResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update an Agent Observability experiment tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/experiments/{experiment_id}/events: get: deprecated: true description: >- Retrieve spans with their evaluation metrics for a given experiment. Returns spans only, with no summary metrics and no pagination. Deprecated in favor of `ListLLMObsExperimentEventsV3`. operationId: ListLLMObsExperimentEventsV1 parameters: - $ref: "#/components/parameters/LLMObsExperimentIDPathParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: duration: 1500000000.0 eval_metrics: [] name: llm_call span_id: span-7a1b2c3d start_ns: 1705314600000000000 status: ok tags: [] trace_id: abc123def456 id: 00000000-0000-0000-0000-000000000001 type: experiments schema: $ref: "#/components/schemas/LLMObsExperimentSpansResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List Agent Observability experiment spans (v1) tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Push spans and metrics for an Agent Observability experiment. operationId: CreateLLMObsExperimentEvents parameters: - $ref: "#/components/parameters/LLMObsExperimentIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: metrics: - assessment: pass label: faithfulness metric_type: score span_id: span-7a1b2c3d timestamp_ms: 1705314600000 spans: - dataset_id: 9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d duration: 1500000000 name: llm_call project_id: a33671aa-24fd-4dcd-9b33-a8ec7dde7751 span_id: span-7a1b2c3d start_ns: 1705314600000000000 status: ok trace_id: abc123def456 type: experiments schema: $ref: "#/components/schemas/LLMObsExperimentEventsRequest" description: Experiment events payload. required: true responses: "202": description: Accepted "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Push events for an Agent Observability experiment tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/integrations/{integration}/accounts: get: description: Retrieve the list of configured accounts for the specified LLM provider integration. operationId: ListLLMObsIntegrationAccounts parameters: - $ref: "#/components/parameters/LLMObsIntegrationPathParameter" responses: "200": content: application/json: examples: default: value: - account_id: "org-XYZ123" account_name: "Production OpenAI" account_region: "" id: "account-abc123" integration: "openai" schema: items: $ref: "#/components/schemas/LLMObsIntegrationAccount" type: array description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List LLM integration accounts tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/integrations/{integration}/{account_id}/inference: post: description: Run an LLM inference request through the specified integration and account, returning the model response and token usage. operationId: CreateLLMObsIntegrationInference parameters: - $ref: "#/components/parameters/LLMObsIntegrationPathParameter" - $ref: "#/components/parameters/LLMObsAccountIDPathParameter" requestBody: content: application/json: examples: default: value: max_tokens: 256 messages: - content: "What is the capital of France?" role: "user" model_id: "gpt-4o" temperature: 0.7 schema: $ref: "#/components/schemas/LLMObsIntegrationInferenceRequest" description: Inference request parameters. required: true responses: "200": content: application/json: examples: default: value: max_tokens: 256 messages: - content: "What is the capital of France?" role: "user" model_id: "gpt-4o" response: assessment: "pass" content: "The capital of France is Paris." finish_reason: "stop" inference_codes: [] input_tokens: 15 latency: 843 output_tokens: 9 tools: [] total_tokens: 24 temperature: 0.7 schema: $ref: "#/components/schemas/LLMObsIntegrationInferenceResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Run an LLM inference tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/integrations/{integration}/{account_id}/models: get: description: Retrieve the list of models available for the specified LLM provider integration and account. operationId: ListLLMObsIntegrationModels parameters: - $ref: "#/components/parameters/LLMObsIntegrationPathParameter" - $ref: "#/components/parameters/LLMObsAccountIDPathParameter" responses: "200": content: application/json: examples: default: value: - has_access: true id: "gpt-4o" integration: "openai" integration_display_name: "OpenAI" json_schema: true model_display_name: "GPT-4o" model_id: "gpt-4o" provider: "openai" provider_display_name: "OpenAI" schema: items: $ref: "#/components/schemas/LLMObsIntegrationModel" type: array description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List LLM integration models tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/projects: get: description: List all Agent Observability projects sorted by creation date, newest first. operationId: ListLLMObsProjects parameters: - description: Filter projects by project ID. in: query name: filter[id] schema: type: string - description: Filter projects by name. in: query name: filter[name] schema: type: string - description: Use the Pagination cursor to retrieve the next page of results. in: query name: page[cursor] schema: type: string - description: Maximum number of results to return per page. in: query name: page[limit] schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" description: "" name: My LLM Project updated_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000001 type: projects schema: $ref: "#/components/schemas/LLMObsProjectsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List Agent Observability projects tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a new Agent Observability project. Returns the existing project if a name conflict occurs. operationId: CreateLLMObsProject requestBody: content: application/json: examples: default: value: data: attributes: name: My LLM Project type: projects schema: $ref: "#/components/schemas/LLMObsProjectRequest" description: Create project payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" description: "" name: My LLM Project updated_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000002 type: projects schema: $ref: "#/components/schemas/LLMObsProjectResponse" description: OK "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" description: "" name: My LLM Project updated_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000003 type: projects schema: $ref: "#/components/schemas/LLMObsProjectResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create an Agent Observability project tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/projects/delete: post: description: Delete one or more Agent Observability projects. operationId: DeleteLLMObsProjects requestBody: content: application/json: examples: default: value: data: attributes: project_ids: - a33671aa-24fd-4dcd-9b33-a8ec7dde7751 type: projects schema: $ref: "#/components/schemas/LLMObsDeleteProjectsRequest" description: Delete projects payload. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete Agent Observability projects tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/projects/{project_id}: patch: description: Partially update an existing Agent Observability project. operationId: UpdateLLMObsProject parameters: - $ref: "#/components/parameters/LLMObsProjectIDPathParameter" requestBody: content: application/json: examples: default: value: data: type: projects schema: $ref: "#/components/schemas/LLMObsProjectUpdateRequest" description: Update project payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" description: "" name: My LLM Project updated_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000004 type: projects schema: $ref: "#/components/schemas/LLMObsProjectResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update an Agent Observability project tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/prompts: get: description: List all Agent Observability prompts in the prompt registry for the organization. operationId: ListLLMObsPrompts parameters: - description: Optional filter for prompts by prompt ID. example: "customer-support-assistant" in: query name: filter[prompt_id] schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: author: "3b12f1df-14fd-4e12-bd6f-4a2f5c8b3d1e" created_at: "2025-01-15T10:00:00Z" created_from: "sdk-registry" description: "Answers customer questions using the company knowledge base." in_registry: true last_version_created_at: "2025-02-01T14:30:00Z" num_versions: 2 prompt_id: "customer-support-assistant" source: registry title: "Customer Support Assistant" id: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" type: prompt-templates schema: $ref: "#/components/schemas/LLMObsPromptsResponse" description: OK "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List Agent Observability prompts tags: - Agent Observability x-permission: operator: OR permissions: - llm_observability_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Create a new prompt (and its first version) in the Agent Observability prompt registry. > **Preview**: Prompt composition is available in Preview. To request access, contact [Datadog Support](https://docs.datadoghq.com/help/) or your Customer Success Manager. operationId: CreateLLMObsPrompt requestBody: content: application/json: examples: default: value: data: attributes: config: model: provider-model response_format: type: json_object temperature: 0.2 description: "Answers customer questions using the company knowledge base." prompt_id: "customer-support-assistant" template: - content: "You are a helpful customer support assistant for {{company_name}}." role: "system" - content: "Help {{customer_name}} with this question: {{question}}" role: "user" title: "Customer Support Assistant" type: prompt-templates schema: $ref: "#/components/schemas/LLMObsCreatePromptRequest" description: Create prompt payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: author: "3b12f1df-14fd-4e12-bd6f-4a2f5c8b3d1e" config: model: provider-model response_format: type: json_object temperature: 0.2 created_at: "2025-01-15T10:00:00Z" created_from: "sdk-registry" description: "Answers customer questions using the company knowledge base." in_registry: true last_version_created_at: "2025-01-15T10:00:00Z" num_versions: 1 prompt_id: "customer-support-assistant" source: registry title: "Customer Support Assistant" id: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" type: prompt-templates schema: $ref: "#/components/schemas/LLMObsCreatePromptResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create an Agent Observability prompt tags: - Agent Observability x-permission: operator: AND permissions: - llm_observability_read - llm_observability_write - feature_flag_config_read - feature_flag_config_write - feature_flag_environment_config_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/prompts/{prompt_id}: delete: description: >- Soft-delete an Agent Observability prompt. The prompt's version rows are retained, but they are no longer accessible through the public prompt registry endpoints. operationId: DeleteLLMObsPrompt parameters: - $ref: "#/components/parameters/LLMObsPromptIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: deleted_at: "2025-02-10T09:15:00Z" prompt_id: "customer-support-assistant" id: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" type: prompt-templates schema: $ref: "#/components/schemas/LLMObsDeletedPromptResponse" description: OK "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete an Agent Observability prompt tags: - Agent Observability x-permission: operator: AND permissions: - llm_observability_read - llm_observability_write - feature_flag_config_read - feature_flag_config_write - feature_flag_environment_config_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get the latest version of an Agent Observability prompt by prompt ID. operationId: GetLLMObsPrompt parameters: - $ref: "#/components/parameters/LLMObsPromptIDPathParameter" - $ref: "#/components/parameters/LLMObsPromptLabelQueryParameter" responses: "200": content: application/json: examples: default: value: data: attributes: chat_template: - content: "You are a helpful customer support assistant for {{company_name}}." role: "system" - content: "Help {{customer_name}} with this question: {{question}}" role: "user" config: model: provider-model temperature: 0.2 prompt_id: "customer-support-assistant" prompt_version_uuid: "d83ab666-61cc-5545-a83b-2424bb85467b" version: "2" id: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" type: prompt-templates schema: $ref: "#/components/schemas/LLMObsPromptSDKResponse" description: OK "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get an Agent Observability prompt tags: - Agent Observability x-permission: operator: OR permissions: - llm_observability_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update the title, the description, or both, for an Agent Observability prompt. operationId: UpdateLLMObsPrompt parameters: - $ref: "#/components/parameters/LLMObsPromptIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: description: "Answers customer questions using the company knowledge base." title: "Customer Support Assistant" type: prompt-templates schema: $ref: "#/components/schemas/LLMObsUpdatePromptRequest" description: Update prompt payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: author: "3b12f1df-14fd-4e12-bd6f-4a2f5c8b3d1e" created_at: "2025-01-15T10:00:00Z" created_from: "sdk-registry" description: "Answers customer questions using the company knowledge base." in_registry: true last_version_created_at: "2025-01-15T10:00:00Z" num_versions: 1 prompt_id: "customer-support-assistant" source: registry title: "Customer Support Assistant" id: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" type: prompt-templates schema: $ref: "#/components/schemas/LLMObsPromptResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update an Agent Observability prompt tags: - Agent Observability x-permission: operator: AND permissions: - llm_observability_read - llm_observability_write - feature_flag_config_read - feature_flag_config_write - feature_flag_environment_config_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/prompts/{prompt_id}/versions: get: description: >- List all versions of an Agent Observability prompt, ordered newest to oldest. If the prompt does not exist, is not registered, or is archived, the response contains an empty list. operationId: ListLLMObsPromptVersions parameters: - $ref: "#/components/parameters/LLMObsPromptIDPathParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: author: "3b12f1df-14fd-4e12-bd6f-4a2f5c8b3d1e" created_at: "2025-02-01T14:30:00Z" description: "Give concise answers and cite relevant help-center articles." prompt_id: "customer-support-assistant" prompt_uuid: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" version: 2 version_created_at: "2025-02-01T14:30:00Z" id: "d83ab666-61cc-5545-a83b-2424bb85467b" type: prompt-template-versions - attributes: author: "3b12f1df-14fd-4e12-bd6f-4a2f5c8b3d1e" created_at: "2025-01-15T10:00:00Z" description: "Initial customer support prompt." prompt_id: "customer-support-assistant" prompt_uuid: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" version: 1 version_created_at: "2025-01-15T10:00:00Z" id: "20e5280b-c75d-5699-8a70-a2773a751428" type: prompt-template-versions schema: $ref: "#/components/schemas/LLMObsPromptVersionsResponse" description: OK "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List versions of an Agent Observability prompt tags: - Agent Observability x-permission: operator: OR permissions: - llm_observability_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Create a new version of an existing Agent Observability prompt. > **Preview**: Prompt composition is available in Preview. To request access, contact [Datadog Support](https://docs.datadoghq.com/help/) or your Customer Success Manager. operationId: CreateLLMObsPromptVersion parameters: - $ref: "#/components/parameters/LLMObsPromptIDPathParameter" requestBody: content: application/json: examples: composed_chat: summary: Create a version that includes all or selected messages from other prompts value: data: attributes: template: messages: - include: prompt_id: "assistant-introduction" version: 2 - include: items: [2, 0, 0] prompt_id: "response-examples" version: 4 - content: "Answer {{question}}." role: "user" type: prompt-template-versions composed_text: summary: Create a version that includes text from another prompt value: data: attributes: description: "Reuse the exact response policy." template: "{{>response-policy version=3}}\n\nAnswer {{question}}." type: prompt-template-versions default: value: data: attributes: config: model: provider-model temperature: 0.4 description: "Give concise answers and cite relevant help-center articles." template: - content: "You are a helpful customer support assistant for {{company_name}}." role: "system" - content: "Help {{customer_name}} with this question: {{question}}" role: "user" type: prompt-template-versions schema: $ref: "#/components/schemas/LLMObsCreatePromptVersionRequest" description: Create prompt version payload. required: true responses: "200": content: application/json: examples: composed_chat: summary: A composed chat version preserves structured authored includes value: data: attributes: authoring_template: messages: - include: prompt_id: "assistant-introduction" version: 2 - include: items: [2, 0, 0] prompt_id: "response-examples" version: 4 - content: "Answer {{question}}." role: "user" prompt_id: "support-chat" prompt_uuid: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" template: - content: "You are a helpful assistant." role: "system" - content: "Here is one concise example." role: "assistant" - content: "You are a helpful assistant." role: "system" - content: "You are a helpful assistant." role: "system" - content: "Answer {{question}}." role: "user" version: 2 id: "d83ab666-61cc-5545-a83b-2424bb85467b" type: prompt-template-versions composed_text: summary: A composed text version returns compiled and authored templates value: data: attributes: authoring_template: "{{>response-policy version=3}}\n\nAnswer {{question}}." prompt_id: "support-answer" prompt_uuid: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" template: "Follow the approved response policy.\n\nAnswer {{question}}." version: 2 id: "d83ab666-61cc-5545-a83b-2424bb85467b" type: prompt-template-versions default: value: data: attributes: author: "3b12f1df-14fd-4e12-bd6f-4a2f5c8b3d1e" config: model: provider-model temperature: 0.4 created_at: "2025-02-01T14:30:00Z" description: "Give concise answers and cite relevant help-center articles." prompt_id: "customer-support-assistant" prompt_uuid: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" template: - content: "You are a helpful customer support assistant for {{company_name}}." role: "system" - content: "Help {{customer_name}} with this question: {{question}}" role: "user" version: 2 version_created_at: "2025-02-01T14:30:00Z" id: "d83ab666-61cc-5545-a83b-2424bb85467b" type: prompt-template-versions schema: $ref: "#/components/schemas/LLMObsPromptVersionResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create a new Agent Observability prompt version tags: - Agent Observability x-permission: operator: AND permissions: - llm_observability_read - llm_observability_write - feature_flag_config_read - feature_flag_config_write - feature_flag_environment_config_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/prompts/{prompt_id}/versions/{version}: get: description: >- Get the full template and configuration of a single, specific version of an Agent Observability prompt. operationId: GetLLMObsPromptVersion parameters: - $ref: "#/components/parameters/LLMObsPromptIDPathParameter" - $ref: "#/components/parameters/LLMObsPromptVersionPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: author: "3b12f1df-14fd-4e12-bd6f-4a2f5c8b3d1e" config: {} created_at: "2025-02-01T14:30:00Z" description: "Give concise answers and cite relevant help-center articles." prompt_id: "customer-support-assistant" prompt_uuid: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" template: - content: "You are a helpful customer support assistant for {{company_name}}." role: "system" - content: "Help {{customer_name}} with this question: {{question}}" role: "user" version: 2 version_created_at: "2025-02-01T14:30:00Z" id: "d83ab666-61cc-5545-a83b-2424bb85467b" type: prompt-template-versions schema: $ref: "#/components/schemas/LLMObsPromptVersionResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a specific Agent Observability prompt version tags: - Agent Observability x-permission: operator: OR permissions: - llm_observability_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: >- Update the description, the feature-flag environments, or both, for a specific version of an Agent Observability prompt. operationId: UpdateLLMObsPromptVersion parameters: - $ref: "#/components/parameters/LLMObsPromptIDPathParameter" - $ref: "#/components/parameters/LLMObsPromptVersionPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: description: "Give concise answers and cite relevant help-center articles." type: prompt-template-versions schema: $ref: "#/components/schemas/LLMObsUpdatePromptVersionRequest" description: Update prompt version payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: author: "3b12f1df-14fd-4e12-bd6f-4a2f5c8b3d1e" config: model: provider-model temperature: 0.4 created_at: "2025-02-01T14:30:00Z" description: "Give concise answers and cite relevant help-center articles." prompt_id: "customer-support-assistant" prompt_uuid: "4a1a28ff-8a25-5f0f-946f-f48264d772eb" template: - content: "You are a helpful customer support assistant for {{company_name}}." role: "system" - content: "Help {{customer_name}} with this question: {{question}}" role: "user" version: 2 version_created_at: "2025-02-01T14:30:00Z" id: "d83ab666-61cc-5545-a83b-2424bb85467b" type: prompt-template-versions schema: $ref: "#/components/schemas/LLMObsPromptVersionResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update an Agent Observability prompt version tags: - Agent Observability x-permission: operator: AND permissions: - llm_observability_read - llm_observability_write - feature_flag_config_read - feature_flag_config_write - feature_flag_environment_config_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/spans/events: get: description: List Agent Observability spans matching the specified filters. operationId: ListLLMObsSpans parameters: - description: Start of the time range. Accepts ISO 8601 or relative format (e.g., `now-15m`). Defaults to `now-15m`. in: query name: filter[from] schema: example: "now-900s" type: string - description: End of the time range. Accepts ISO 8601 or relative format. Defaults to `now`. in: query name: filter[to] schema: example: "now" type: string - description: >- Search query using Agent Observability query syntax. Supports attribute filters using the field:value syntax (e.g. session_id, trace_id, ml_app, meta.span.kind). When provided, structured field filters (`filter[span_id]`, `filter[trace_id]`, etc.) are ignored. in: query name: filter[query] schema: example: "@session_id:abc123def456" type: string - description: Filter by exact span ID. in: query name: filter[span_id] schema: type: string - description: Filter by exact trace ID. in: query name: filter[trace_id] schema: type: string - description: Filter by span kind (e.g., llm, agent, tool, task, workflow). in: query name: filter[span_kind] schema: type: string - description: Filter by span name. in: query name: filter[span_name] schema: type: string - description: Filter by ML application name. in: query name: filter[ml_app] schema: type: string - description: Maximum number of spans to return. Defaults to `10`. in: query name: page[limit] schema: format: int64 type: integer - description: Cursor from the previous response to retrieve the next page. in: query name: page[cursor] schema: type: string - description: Sort order for the results. in: query name: sort schema: type: string - description: Whether to include attachment data in the response. Defaults to `true`. in: query name: include_attachments schema: type: boolean responses: "200": content: application/json: examples: default: summary: List spans for an ML app value: data: - attributes: duration: 1500000000.0 ml_app: my-llm-app model_name: gpt-4o model_provider: openai name: llm_call span_id: "abc123def456" span_kind: llm start_ns: 1705314600000000000 status: ok trace_id: "trace-9a8b7c6d5e4f" id: "abc123def456" type: span meta: elapsed: 132 page: {} request_id: req-abc123 status: done session_id: summary: List spans filtered by session ID value: data: - attributes: duration: 1500000000.0 ml_app: my-llm-app name: llm_call span_id: "abc123def456" span_kind: llm start_ns: 1705314600000000000 status: ok tags: - "session_id:abc123def456" trace_id: "trace-9a8b7c6d5e4f" id: "abc123def456" type: span meta: elapsed: 87 page: {} request_id: req-def456 status: done schema: $ref: "#/components/schemas/LLMObsSpansResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List Agent Observability spans tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/spans/events/search: post: description: Search Agent Observability spans using structured filters in the request body. operationId: SearchLLMObsSpans requestBody: content: application/json: examples: default: summary: Search spans for an ML app value: data: attributes: filter: from: "now-900s" ml_app: "my-llm-app" span_kind: "llm" to: "now" options: include_attachments: true page: limit: 10 type: spans session_id: summary: Search all spans in a session value: data: attributes: filter: from: "now-900s" query: "@session_id:abc123def456" to: "now" options: include_attachments: true page: limit: 50 type: spans schema: $ref: "#/components/schemas/LLMObsSearchSpansRequest" description: Search spans payload. required: true responses: "200": content: application/json: examples: default: value: data: - attributes: duration: 1500000000.0 ml_app: my-llm-app model_name: gpt-4o model_provider: openai name: llm_call span_id: "abc123def456" span_kind: llm start_ns: 1705314600000000000 status: ok trace_id: "trace-9a8b7c6d5e4f" id: "abc123def456" type: span meta: elapsed: 132 page: {} request_id: req-abc123 status: done schema: $ref: "#/components/schemas/LLMObsSpansResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Search Agent Observability spans tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/topic-discovery-clustered-points: get: description: |- List the data points grouped into a topic. For a parent topic, points from all of its leaf topics are returned. operationId: ListLLMObsPatternsClusteredPoints parameters: - $ref: "#/components/parameters/LLMObsPatternsTopicIDQueryParameter" - $ref: "#/components/parameters/LLMObsPatternsPageSizeQueryParameter" - $ref: "#/components/parameters/LLMObsPatternsPageTokenQueryParameter" responses: "200": content: application/json: examples: default: value: data: attributes: next_page_token: "eyJvZmZzZXQiOjUwfQ==" points: - event_id: AAAAAYabc123 id: 9b0c1d2e-3f40-5a61-b728-c9d0e1f2a3b4 input: "How do I get a refund?" is_included: false is_suggested: true session_id: session-7c3f5a1b span_id: "1234567890123456789" topic_id: 5c1fae90-2b6d-4e3a-9f12-7a0c4d8e6b21 topic_id: 5c1fae90-2b6d-4e3a-9f12-7a0c4d8e6b21 id: 5c1fae90-2b6d-4e3a-9f12-7a0c4d8e6b21 type: clustered_points_response schema: $ref: "#/components/schemas/LLMObsPatternsClusteredPointsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List patterns clustered points tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/topic-discovery-configs: get: description: List all patterns configurations for the organization. operationId: ListLLMObsPatternsConfigs responses: "200": content: application/json: examples: default: value: data: attributes: configs: - created_at: "2024-01-15T10:30:00Z" evp_query: "@ml_app:support-bot" hierarchy_depth: 2 id: a7c8d9e0-1234-5678-9abc-def012345678 name: Support chatbot topics num_records: 1000 sampling_ratio: 0.1 scope: "" updated_at: "2024-01-15T10:30:00Z" id: "1000000001" type: list_topic_discovery_configs_response schema: $ref: "#/components/schemas/LLMObsPatternsConfigsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List patterns configurations tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: Create a new patterns configuration, or update an existing one when a configuration ID is provided. operationId: UpsertLLMObsPatternsConfig requestBody: content: application/json: examples: default: value: data: attributes: evp_query: "@ml_app:support-bot" hierarchy_depth: 2 name: Support chatbot topics num_records: 1000 sampling_ratio: 0.1 type: topic_discovery_configs schema: $ref: "#/components/schemas/LLMObsPatternsConfigUpsertRequest" description: Patterns configuration payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00Z" evp_query: "@ml_app:support-bot" hierarchy_depth: 2 name: Support chatbot topics num_records: 1000 sampling_ratio: 0.1 scope: "" updated_at: "2024-01-15T10:30:00Z" id: a7c8d9e0-1234-5678-9abc-def012345678 type: topic_discovery_configs schema: $ref: "#/components/schemas/LLMObsPatternsConfigResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create or update a patterns configuration tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/topic-discovery-configs/latest: get: description: Retrieve the patterns configuration for the organization. operationId: GetLLMObsPatternsConfig responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00Z" evp_query: "@ml_app:support-bot" hierarchy_depth: 2 name: Support chatbot topics num_records: 1000 sampling_ratio: 0.1 scope: "" updated_at: "2024-01-15T10:30:00Z" id: a7c8d9e0-1234-5678-9abc-def012345678 type: topic_discovery_configs schema: $ref: "#/components/schemas/LLMObsPatternsConfigResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a patterns configuration tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/topic-discovery-configs/{config_id}: delete: description: Delete a patterns configuration by its ID. operationId: DeleteLLMObsPatternsConfig parameters: - $ref: "#/components/parameters/LLMObsPatternsConfigIDPathParameter" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete a patterns configuration tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/topic-discovery-runs: get: description: List the completed patterns runs for a configuration. operationId: ListLLMObsPatternsRuns parameters: - $ref: "#/components/parameters/LLMObsPatternsConfigIDQueryParameter" responses: "200": content: application/json: examples: default: value: data: attributes: runs: - completed_at: "2024-01-15T10:45:00Z" created_at: "2024-01-15T10:30:00Z" id: 3fd6b5e0-8910-4b1c-a7d0-5b84de329012 status: completed id: a7c8d9e0-1234-5678-9abc-def012345678 type: list_topic_discovery_runs_response schema: $ref: "#/components/schemas/LLMObsPatternsRunsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List patterns runs tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Start a patterns run for a given configuration. The run executes asynchronously. operationId: TriggerLLMObsPatterns requestBody: content: application/json: examples: default: value: data: attributes: config_id: a7c8d9e0-1234-5678-9abc-def012345678 type: topic_discovery schema: $ref: "#/components/schemas/LLMObsPatternsTriggerRequest" description: Trigger patterns payload. required: true responses: "202": content: application/json: examples: default: value: data: attributes: config_id: a7c8d9e0-1234-5678-9abc-def012345678 run_id: 3fd6b5e0-8910-4b1c-a7d0-5b84de329012 status: started id: a7c8d9e0-1234-5678-9abc-def012345678 type: topic_discovery_run schema: $ref: "#/components/schemas/LLMObsPatternsTriggerResponse" description: Accepted "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Trigger a patterns run tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/topic-discovery-runs/status: get: description: |- Retrieve the status and step-by-step progress of the current or most recent patterns run for a configuration. operationId: GetLLMObsPatternsRunStatus parameters: - $ref: "#/components/parameters/LLMObsPatternsConfigIDQueryParameter" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00Z" progress: - name: query_evp started_at: "2024-01-15T10:30:05Z" status: completed - name: generate_topics started_at: "2024-01-15T10:32:00Z" status: running status: running step: generate_topics id: 3fd6b5e0-8910-4b1c-a7d0-5b84de329012 type: topic_discovery_run_status schema: $ref: "#/components/schemas/LLMObsPatternsRunStatusResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get patterns run status tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/topic-discovery-templates: get: description: List all enabled patterns templates. operationId: ListLLMObsPatternsTemplates responses: "200": content: application/json: examples: default: value: data: attributes: templates: - clustering_instructions: "Group topics by user intent." created_at: "2024-01-15T10:30:00Z" description: "A general-purpose starting point for topic discovery." evp_query_prefix: "" id: a7c8d9e0-1234-5678-9abc-def012345678 name: General scope: span template: "{{span_input}}" time_frame_duration_ms: 604800000 id: "topic_discovery_templates" type: list_topic_discovery_templates_response schema: $ref: "#/components/schemas/LLMObsPatternsTemplatesResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List patterns templates tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/topic-discovery-topics: get: description: |- List the topics discovered by a patterns run. When no run is specified, the most recent completed run is used. operationId: ListLLMObsPatternsTopics parameters: - $ref: "#/components/parameters/LLMObsPatternsConfigIDQueryParameter" - $ref: "#/components/parameters/LLMObsPatternsRunIDQueryParameter" responses: "200": content: application/json: examples: default: value: data: attributes: completed_at: "2024-01-15T10:45:00Z" config_id: a7c8d9e0-1234-5678-9abc-def012345678 created_at: "2024-01-15T10:30:00Z" previous_run_id: "" run_id: 3fd6b5e0-8910-4b1c-a7d0-5b84de329012 topics: - created_at: "2024-01-15T10:44:00Z" description: "Questions about invoices, charges, and refunds." first_seen_at: "2024-01-15T10:44:00Z" hierarchy_level: 0 id: 5c1fae90-2b6d-4e3a-9f12-7a0c4d8e6b21 is_validated: true name: Billing questions parent_topic_id: "" point_count: 125 run_id: 3fd6b5e0-8910-4b1c-a7d0-5b84de329012 id: 3fd6b5e0-8910-4b1c-a7d0-5b84de329012 type: get_topics_response schema: $ref: "#/components/schemas/LLMObsPatternsTopicsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List patterns topics tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/topic-discovery-topics/with-cluster-points: get: description: |- List the topics discovered by a patterns run, with the clustered points attached inline to each leaf topic. When no run is specified, the most recent completed run is used. operationId: ListLLMObsPatternsTopicsWithClusteredPoints parameters: - $ref: "#/components/parameters/LLMObsPatternsConfigIDQueryParameter" - $ref: "#/components/parameters/LLMObsPatternsRunIDQueryParameter" - $ref: "#/components/parameters/LLMObsPatternsIncludeMetricsQueryParameter" responses: "200": content: application/json: examples: default: value: data: attributes: completed_at: "2024-01-15T10:45:00Z" config_id: a7c8d9e0-1234-5678-9abc-def012345678 created_at: "2024-01-15T10:30:00Z" previous_run_id: "" run_id: 3fd6b5e0-8910-4b1c-a7d0-5b84de329012 topics: - cluster_points: - duration: 1500000 estimated_total_cost: 0.0021 evaluation: sentiment: positive input_tokens: 128 output_tokens: 64 span_id: "1234567890123456789" status: ok total_tokens: 192 created_at: "2024-01-15T10:44:00Z" description: "Questions about invoices, charges, and refunds." first_seen_at: "2024-01-15T10:44:00Z" hierarchy_level: 0 id: 5c1fae90-2b6d-4e3a-9f12-7a0c4d8e6b21 is_validated: true name: Billing questions parent_topic_id: "" point_count: 125 run_id: 3fd6b5e0-8910-4b1c-a7d0-5b84de329012 id: 3fd6b5e0-8910-4b1c-a7d0-5b84de329012 type: get_topics_with_cluster_points_response schema: $ref: "#/components/schemas/LLMObsPatternsTopicsWithClusteredPointsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List patterns topics with clustered points tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/{project_id}/datasets: get: description: List all Agent Observability datasets for a project, sorted by creation date, newest first. operationId: ListLLMObsDatasets parameters: - $ref: "#/components/parameters/LLMObsProjectIDPathParameter" - description: Filter datasets by name. in: query name: filter[name] schema: type: string - description: Filter datasets by dataset ID. in: query name: filter[id] schema: type: string - description: Use the Pagination cursor to retrieve the next page of results. in: query name: page[cursor] schema: type: string - description: Maximum number of results to return per page. in: query name: page[limit] schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" current_version: 1 description: "" metadata: name: My LLM Dataset updated_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000005 type: datasets schema: $ref: "#/components/schemas/LLMObsDatasetsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List Agent Observability datasets tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a new Agent Observability dataset within the specified project. operationId: CreateLLMObsDataset parameters: - $ref: "#/components/parameters/LLMObsProjectIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: name: My LLM Dataset type: datasets schema: $ref: "#/components/schemas/LLMObsDatasetRequest" description: Create dataset payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" current_version: 1 description: "" metadata: name: My LLM Dataset updated_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000006 type: datasets schema: $ref: "#/components/schemas/LLMObsDatasetResponse" description: OK "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" current_version: 1 description: "" metadata: name: My LLM Dataset updated_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000007 type: datasets schema: $ref: "#/components/schemas/LLMObsDatasetResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create an Agent Observability dataset tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/{project_id}/datasets/delete: post: description: Delete one or more Agent Observability datasets within the specified project. operationId: DeleteLLMObsDatasets parameters: - $ref: "#/components/parameters/LLMObsProjectIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: dataset_ids: - 9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d type: datasets schema: $ref: "#/components/schemas/LLMObsDeleteDatasetsRequest" description: Delete datasets payload. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete Agent Observability datasets tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/{project_id}/datasets/{dataset_id}: patch: description: Partially update an existing Agent Observability dataset within the specified project. operationId: UpdateLLMObsDataset parameters: - $ref: "#/components/parameters/LLMObsProjectIDPathParameter" - $ref: "#/components/parameters/LLMObsDatasetIDPathParameter" requestBody: content: application/json: examples: default: value: data: type: datasets schema: $ref: "#/components/schemas/LLMObsDatasetUpdateRequest" description: Update dataset payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" current_version: 1 description: "" metadata: name: My LLM Dataset updated_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000008 type: datasets schema: $ref: "#/components/schemas/LLMObsDatasetResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update an Agent Observability dataset tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/{project_id}/datasets/{dataset_id}/batch_update: post: description: Insert, update, and delete records in a single dataset operation. By default, a new dataset version is created when the batch is applied. operationId: BatchUpdateLLMObsDataset parameters: - description: The ID of the Agent Observability project. example: "a33671aa-24fd-4dcd-9b33-a8ec7dde7751" in: path name: project_id required: true schema: type: string - description: The ID of the Agent Observability dataset. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" in: path name: dataset_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: create_new_version: true delete_records: - rec-old-record-1 insert_records: - expected_output: answer: "Paris" input: question: "What is the capital of France?" tags: - "topic:geography" update_records: - expected_output: answer: "Paris, France" id: rec-7c3f5a1b-9e2d-4f8a-b1c6-3d7e9f0a2b4c id: 9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d type: datasets schema: $ref: "#/components/schemas/LLMObsDatasetBatchUpdateRequest" description: Batch update payload. required: true responses: "200": content: application/json: examples: default: value: data: - records: - created_at: "2024-01-15T10:30:00Z" dataset_id: 9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d expected_output: answer: "Paris, France" id: rec-7c3f5a1b-9e2d-4f8a-b1c6-3d7e9f0a2b4c input: question: "What is the capital of France?" metadata: updated_at: "2024-01-15T10:30:00Z" schema: $ref: "#/components/schemas/LLMObsDatasetRecordsMutationResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "413": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Payload Too Large "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Batch update Agent Observability dataset records tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/{project_id}/datasets/{dataset_id}/clone: post: description: Clone a dataset, copying its current records into a new dataset within the same project. operationId: CloneLLMObsDataset parameters: - description: The ID of the Agent Observability project. example: "a33671aa-24fd-4dcd-9b33-a8ec7dde7751" in: path name: project_id required: true schema: type: string - description: The ID of the source Agent Observability dataset to clone. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" in: path name: dataset_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: description: "Clone of the original dataset for experimentation." name: "My cloned dataset" id: 9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d type: datasets schema: $ref: "#/components/schemas/LLMObsDatasetCloneRequest" description: Clone dataset payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00Z" current_version: 0 description: "Clone of the original dataset for experimentation." metadata: name: "My cloned dataset" updated_at: "2024-01-15T10:30:00Z" id: 7c8d4e9a-1234-5678-9abc-def012345678 type: datasets schema: $ref: "#/components/schemas/LLMObsDatasetResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Clone an Agent Observability dataset tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/{project_id}/datasets/{dataset_id}/draft_state: get: description: Retrieve the draft state of a dataset, including whether it is currently locked for editing and which user holds the lock. operationId: GetLLMObsDatasetDraftState parameters: - description: The ID of the Agent Observability project. example: "a33671aa-24fd-4dcd-9b33-a8ec7dde7751" in: path name: project_id required: true schema: type: string - description: The ID of the Agent Observability dataset. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" in: path name: dataset_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: drafting_since: "2024-01-15T10:30:00Z" user: email: jane.doe@example.com handle: jane.doe@example.com id: 00000000-0000-0000-0000-000000000010 name: Jane Doe id: 9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d type: draft_state_data schema: $ref: "#/components/schemas/LLMObsDatasetDraftStateResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get Agent Observability dataset draft state tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/{project_id}/datasets/{dataset_id}/draft_state/lock: patch: description: Acquire the draft lock on a dataset for the calling user. The lock prevents other users from concurrently editing the dataset draft. operationId: LockLLMObsDatasetDraftState parameters: - description: The ID of the Agent Observability project. example: "a33671aa-24fd-4dcd-9b33-a8ec7dde7751" in: path name: project_id required: true schema: type: string - description: The ID of the Agent Observability dataset. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" in: path name: dataset_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: drafting_since: "2024-01-15T10:30:00Z" user: email: jane.doe@example.com handle: jane.doe@example.com id: 00000000-0000-0000-0000-000000000010 name: Jane Doe id: 9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d type: draft_state_data schema: $ref: "#/components/schemas/LLMObsDatasetDraftStateResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Lock Agent Observability dataset draft state tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/{project_id}/datasets/{dataset_id}/draft_state/unlock: patch: description: Release the draft lock on a dataset held by the calling user, allowing other users to edit the dataset draft. operationId: UnlockLLMObsDatasetDraftState parameters: - description: The ID of the Agent Observability project. example: "a33671aa-24fd-4dcd-9b33-a8ec7dde7751" in: path name: project_id required: true schema: type: string - description: The ID of the Agent Observability dataset. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" in: path name: dataset_id required: true schema: type: string responses: "200": description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Unlock Agent Observability dataset draft state tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/{project_id}/datasets/{dataset_id}/export: get: description: Download the contents of a dataset as a CSV file. The download is streamed and includes one row per dataset record. operationId: ExportLLMObsDataset parameters: - description: The ID of the Agent Observability project. example: "a33671aa-24fd-4dcd-9b33-a8ec7dde7751" in: path name: project_id required: true schema: type: string - description: The ID of the Agent Observability dataset. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" in: path name: dataset_id required: true schema: type: string - description: Export format for the dataset contents. Only `csv` is currently supported. in: query name: format schema: $ref: "#/components/schemas/LLMObsDatasetExportFormat" - description: Version of the dataset to export. If omitted, the current version is used. Must be between 0 and the current version of the dataset, inclusive. in: query name: version schema: format: int64 maximum: 2147483647 type: integer responses: "200": content: text/csv: examples: default: value: "id,input,expected_output,metadata,tags\nrec-1,\"What is 2+2?\",\"4\",{},\"\"" schema: type: string description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Export an Agent Observability dataset tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/{project_id}/datasets/{dataset_id}/records: get: description: List all records in an Agent Observability dataset, sorted by creation date, newest first. operationId: ListLLMObsDatasetRecords parameters: - $ref: "#/components/parameters/LLMObsProjectIDPathParameter" - $ref: "#/components/parameters/LLMObsDatasetIDPathParameter" - description: Retrieve records from a specific dataset version. Defaults to the current version. in: query name: filter[version] schema: format: int64 type: integer - description: Use the Pagination cursor to retrieve the next page of results. in: query name: page[cursor] schema: type: string - description: Maximum number of results to return per page. in: query name: page[limit] schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - created_at: "2024-01-01T00:00:00+00:00" dataset_id: 00000000-0000-0000-0000-000000000022 expected_output: answer: "Paris" id: 00000000-0000-0000-0000-000000000021 input: question: "What is the capital of France?" metadata: updated_at: "2024-01-01T00:00:00+00:00" schema: $ref: "#/components/schemas/LLMObsDatasetRecordsListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List Agent Observability dataset records tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update one or more existing records in an Agent Observability dataset. operationId: UpdateLLMObsDatasetRecords parameters: - $ref: "#/components/parameters/LLMObsProjectIDPathParameter" - $ref: "#/components/parameters/LLMObsDatasetIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: records: - id: rec-7c3f5a1b-9e2d-4f8a-b1c6-3d7e9f0a2b4c type: datasets schema: $ref: "#/components/schemas/LLMObsDatasetRecordsUpdateRequest" description: Update records payload. required: true responses: "200": content: application/json: examples: default: value: data: - records: - created_at: "2024-01-01T00:00:00+00:00" dataset_id: 00000000-0000-0000-0000-000000000028 expected_output: answer: "Paris" id: 00000000-0000-0000-0000-000000000027 input: question: "What is the capital of France?" metadata: updated_at: "2024-01-01T00:00:00+00:00" schema: $ref: "#/components/schemas/LLMObsDatasetRecordsMutationResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update Agent Observability dataset records tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Append one or more records to an Agent Observability dataset. operationId: CreateLLMObsDatasetRecords parameters: - $ref: "#/components/parameters/LLMObsProjectIDPathParameter" - $ref: "#/components/parameters/LLMObsDatasetIDPathParameter" requestBody: content: application/json: examples: default: value: data: type: datasets schema: $ref: "#/components/schemas/LLMObsDatasetRecordsRequest" description: Append records payload. required: true responses: "200": content: application/json: examples: default: value: data: - records: - created_at: "2024-01-01T00:00:00+00:00" dataset_id: 00000000-0000-0000-0000-000000000024 expected_output: answer: "Paris" id: 00000000-0000-0000-0000-000000000023 input: question: "What is the capital of France?" metadata: updated_at: "2024-01-01T00:00:00+00:00" schema: $ref: "#/components/schemas/LLMObsDatasetRecordsMutationResponse" description: OK "201": content: application/json: examples: default: value: data: - records: - created_at: "2024-01-01T00:00:00+00:00" dataset_id: 00000000-0000-0000-0000-000000000026 expected_output: answer: "Paris" id: 00000000-0000-0000-0000-000000000025 input: question: "What is the capital of France?" metadata: updated_at: "2024-01-01T00:00:00+00:00" schema: $ref: "#/components/schemas/LLMObsDatasetRecordsMutationResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Append records to an Agent Observability dataset tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/{project_id}/datasets/{dataset_id}/records/delete: post: description: Delete one or more records from an Agent Observability dataset. operationId: DeleteLLMObsDatasetRecords parameters: - $ref: "#/components/parameters/LLMObsProjectIDPathParameter" - $ref: "#/components/parameters/LLMObsDatasetIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: record_ids: - rec-7c3f5a1b-9e2d-4f8a-b1c6-3d7e9f0a2b4c type: datasets schema: $ref: "#/components/schemas/LLMObsDeleteDatasetRecordsRequest" description: Delete records payload. required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete Agent Observability dataset records tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/{project_id}/datasets/{dataset_id}/restore: post: description: Restore a dataset to a previous version. The dataset's current version is bumped, and its records are replaced with the records from the specified prior version. operationId: RestoreLLMObsDatasetVersion parameters: - description: The ID of the Agent Observability project. example: "a33671aa-24fd-4dcd-9b33-a8ec7dde7751" in: path name: project_id required: true schema: type: string - description: The ID of the Agent Observability dataset. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" in: path name: dataset_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: dataset_version: 1 id: 9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d type: datasets schema: $ref: "#/components/schemas/LLMObsDatasetRestoreVersionRequest" description: Restore dataset version payload. required: true responses: "200": description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Restore an Agent Observability dataset version tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v1/{project_id}/datasets/{dataset_id}/versions: get: description: List the active versions of a dataset. A version is created each time a dataset is referenced by an experiment run. operationId: ListLLMObsDatasetVersions parameters: - description: The ID of the Agent Observability project. example: "a33671aa-24fd-4dcd-9b33-a8ec7dde7751" in: path name: project_id required: true schema: type: string - description: The ID of the Agent Observability dataset. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" in: path name: dataset_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: dataset_id: 9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d last_used: "2024-01-15T10:30:00Z" version_number: 1 id: 3fd6b5e0-8910-4b1c-a7d0-5b84de329012 type: dataset_version - attributes: dataset_id: 9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d last_used: "2024-02-20T14:45:00Z" version_number: 2 id: 4ee7c6f1-9a01-5c2d-b8e1-6c95ef43a123 type: dataset_version schema: $ref: "#/components/schemas/LLMObsDatasetVersionsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List Agent Observability dataset versions tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v2/experiments/{experiment_id}/events: get: deprecated: true description: >- Retrieve spans and experiment-level summary metrics for a given experiment. Returns the full events payload without pagination. Deprecated: use `ListLLMObsExperimentEventsV3` instead. operationId: ListLLMObsExperimentEventsV2 parameters: - $ref: "#/components/parameters/LLMObsExperimentIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: spans: - duration: 1500000000.0 eval_metrics: [] id: 00000000-0000-0000-0000-000000000002 name: llm_call span_id: span-7a1b2c3d start_ns: 1705314600000000000 status: ok tags: [] trace_id: abc123def456 summary_metrics: [] id: 00000000-0000-0000-0000-000000000001 type: experiment_events schema: $ref: "#/components/schemas/LLMObsExperimentEventsV2Response" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List Agent Observability experiment events (v2) tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v2/{project_id}/datasets/{dataset_id}/records/upload: post: description: |- Upload records to a dataset from a file. The request is a `multipart/form-data` upload containing a single `file` part. Currently only CSV is supported. The CSV must include an `input` column. Optional columns are `id`, `expected_output`, `metadata`, and `tags`. The response is a Server-Sent Events stream (`text/event-stream`) emitting progress updates while records are processed. The stream emits the following named events: - `progress`: incremental record counts written so far. - `completed`: terminal event with a JSON body containing `records_created`. - `error`: terminal event with a JSON body containing an error `message`. operationId: UploadLLMObsDatasetRecordsFile parameters: - description: The ID of the Agent Observability project. example: "a33671aa-24fd-4dcd-9b33-a8ec7dde7751" in: path name: project_id required: true schema: type: string - description: The ID of the Agent Observability dataset. example: "9f64e5c7-dc5a-45c8-a17c-1b85f0bec97d" in: path name: dataset_id required: true schema: type: string - description: Whether to skip records whose `input` already exists in the dataset. Defaults to `false`. in: query name: deduplicate schema: default: false type: boolean - description: Whether to overwrite existing records that share the same user-provided `id`. Defaults to `true`. in: query name: overwrite schema: default: true type: boolean - description: Tags to apply to every uploaded record, in addition to any tags defined on individual rows. Can be repeated, e.g. `tags=env:prod&tags=team:ai`. in: query name: tags schema: items: type: string type: array - description: Whether to enrich the response with user metadata. in: query name: "include[user_data]" schema: type: boolean requestBody: content: multipart/form-data: examples: default: value: file: records.csv schema: $ref: "#/components/schemas/LLMObsDatasetRecordsUploadFile" description: Multipart upload payload containing the records file. required: true responses: "200": description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Upload records to an Agent Observability dataset tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/llm-obs/v3/experiments/{experiment_id}/events: get: description: Retrieve spans and experiment-level summary metrics for a given experiment with cursor-based pagination. operationId: ListLLMObsExperimentEvents parameters: - $ref: "#/components/parameters/LLMObsExperimentIDPathParameter" - description: Maximum number of spans to return per page. Defaults to 5000. in: query name: page[limit] schema: default: 5000 format: int64 type: integer - description: Opaque cursor from a previous response to fetch the next page of results. in: query name: page[cursor] schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: spans: - duration: 1500000000.0 eval_metrics: [] id: 00000000-0000-0000-0000-000000000002 name: llm_call span_id: span-7a1b2c3d start_ns: 1705314600000000000 status: ok tags: [] trace_id: abc123def456 summary_metrics: [] id: 00000000-0000-0000-0000-000000000001 type: experiment_events meta: after: schema: $ref: "#/components/schemas/LLMObsExperimentEventsV2Response" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List events for an Agent Observability experiment tags: - Agent Observability x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/login/org_configs/max_session_duration: put: description: |- Update the maximum session duration for the current organization. The duration is specified in seconds. operationId: UpdateLoginOrgConfigsMaxSessionDuration requestBody: content: application/json: examples: default: value: data: attributes: max_session_duration: 604800 type: max_session_duration schema: $ref: "#/components/schemas/MaxSessionDurationUpdateRequest" required: true responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management summary: Update the maximum session duration tags: [Organizations] "x-permission": operator: OR permissions: - org_management /api/v2/logs: post: description: |- Send your logs to your Datadog platform over HTTP. Limits per HTTP request are: - Maximum content size per payload (uncompressed): 5MB - Maximum size for a single log: 1MB - Maximum array size if sending multiple logs in an array: 1000 entries Any log exceeding 1MB is accepted and truncated by Datadog: - For a single log request, the API truncates the log at 1MB and returns a 2xx. - For a multi-logs request, the API processes all logs, truncates only logs larger than 1MB, and returns a 2xx. Datadog recommends sending your logs compressed. Add the `Content-Encoding: gzip` header to the request when sending compressed logs. Log events can be submitted with a timestamp that is up to 18 hours in the past. The status codes answered by the HTTP API are: - 202: Accepted: the request has been accepted for processing - 400: Bad request (likely an issue in the payload formatting) - 401: Unauthorized (likely a missing API Key) - 403: Permission issue (likely using an invalid API Key) - 408: Request Timeout, request should be retried after some time - 413: Payload too large (batch is above 5MB uncompressed) - 429: Too Many Requests, request should be retried after some time - 500: Internal Server Error, the server encountered an unexpected condition that prevented it from fulfilling the request, request should be retried after some time - 503: Service Unavailable, the server is not ready to handle the request probably because it is overloaded, request should be retried after some time operationId: SubmitLog parameters: - description: HTTP header used to compress the media-type. in: header name: Content-Encoding required: false schema: $ref: "#/components/schemas/ContentEncoding" - description: Log tags can be passed as query parameters with `text/plain` content type. example: "env:prod,user:my-user" in: query name: ddtags required: false schema: type: string requestBody: content: application/json: examples: default: value: ddsource: nginx ddtags: env:staging,version:5.1 hostname: i-012345678 message: 2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World service: payment multi-json-messages: description: Pass multiple log objects at once. summary: Multi JSON Messages value: - ddsource: "nginx" ddtags: "env:staging,version:5.1" hostname: "i-012345678" message: 2019-11-19T14:37:58,995 INFO [process.name][20081] Hello service: "payment" - ddsource: "nginx" ddtags: "env:staging,version:5.1" hostname: "i-012345679" message: 2019-11-19T14:37:58,995 INFO [process.name][20081] World service: "payment" simple-json-message: description: Log attributes can be passed as `key:value` pairs in valid JSON messages. summary: Simple JSON Message value: ddsource: "nginx" ddtags: "env:staging,version:5.1" hostname: "i-012345678" message: 2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World service: "payment" schema: $ref: "#/components/schemas/HTTPLog" application/logplex-1: examples: default: value: multi-raw-message: description: Submit log messages. summary: Multi Logplex Messages value: "2019-11-19T14:37:58,995 INFO [process.name][20081] Hello\n2019-11-19T14:37:58,995 INFO [process.name][20081] World" multi-raw-message: description: Submit log messages. summary: Multi Logplex Messages value: |- 2019-11-19T14:37:58,995 INFO [process.name][20081] Hello 2019-11-19T14:37:58,995 INFO [process.name][20081] World simple-logplex-message: description: Submit log string. summary: Simple Logplex Message value: 2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World schema: type: string text/plain: examples: default: value: multi-raw-message: description: Submit log string. summary: Multi Raw Messages value: "2019-11-19T14:37:58,995 INFO [process.name][20081] Hello\n2019-11-19T14:37:58,995 INFO [process.name][20081] World" multi-raw-message: description: Submit log string. summary: Multi Raw Messages value: |- 2019-11-19T14:37:58,995 INFO [process.name][20081] Hello 2019-11-19T14:37:58,995 INFO [process.name][20081] World simple-raw-message: description: >- Submit log string. Log attributes can be passed as query parameters in the URL. This enables the addition of tags or the source by using the `ddtags` and `ddsource` parameters: `?host=my-hostname&service=my-service&ddsource=my-source&ddtags=env:prod,user:my-user`. summary: Simple Raw Message value: 2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World schema: type: string description: Log to send (JSON format). required: true responses: "202": content: application/json: examples: default: value: {} schema: type: object description: Request accepted for processing (always 202 empty JSON). "400": content: application/json: schema: $ref: "#/components/schemas/HTTPLogErrors" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/HTTPLogErrors" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/HTTPLogErrors" description: Forbidden "408": content: application/json: schema: $ref: "#/components/schemas/HTTPLogErrors" description: Request Timeout "413": content: application/json: schema: $ref: "#/components/schemas/HTTPLogErrors" description: Payload Too Large "429": content: application/json: schema: $ref: "#/components/schemas/HTTPLogErrors" description: Too Many Requests "500": content: application/json: schema: $ref: "#/components/schemas/HTTPLogErrors" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/HTTPLogErrors" description: Service Unavailable security: - apiKeyAuth: [] servers: - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: The regional site for customers. enum: - datadoghq.com - us3.datadoghq.com - us5.datadoghq.com - ap1.datadoghq.com - ap2.datadoghq.com - uk1.datadoghq.com - datadoghq.eu - ddog-gov.com - us2.ddog-gov.com x-enum-varnames: - US1 - US3 - US5 - AP1 - AP2 - UK1 - EU1 - GOV - US2_GOV subdomain: default: http-intake.logs description: The subdomain where the API is deployed. - url: "{protocol}://{name}" variables: name: default: http-intake.logs.datadoghq.com description: Full site DNS name. protocol: default: https description: The protocol for accessing the API. - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: Any Datadog deployment. subdomain: default: http-intake.logs description: The subdomain where the API is deployed. summary: Send logs tags: - Logs x-codegen-request-body-name: body /api/v2/logs/analytics/aggregate: post: description: |- The API endpoint to aggregate events into buckets and compute metrics and timeseries. operationId: AggregateLogs requestBody: content: "application/json": examples: default: value: compute: - aggregation: pc90 interval: 5m metric: "@duration" type: timeseries filter: from: now-15m indexes: - main - web query: service:web-api AND @http.status_code:[200 TO 299] storage_tier: indexes to: now group_by: - facet: host histogram: interval: 10 max: 100 min: 50 sort: aggregation: count order: asc options: timezone: GMT page: cursor: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== schema: $ref: "#/components/schemas/LogsAggregateRequest" required: true responses: "200": content: application/json: examples: default: value: data: buckets: - by: host: my-hostname computes: c0: 19 meta: elapsed: 132 status: done schema: $ref: "#/components/schemas/LogsAggregateResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - logs_read_data summary: Aggregate events tags: ["Logs"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - logs_read_data /api/v2/logs/archive_searches: get: description: |- List the organization's Archive Searches that haven't expired, up to 5,000. When more exist, `meta.truncated` is `true`. operationId: ListArchiveSearches responses: "200": content: application/json: examples: default: value: data: - attributes: archive_id: mhmyYmyLTOaFYKvhNadu1w bytes_scanned: 0 created_at: "2026-01-02T12:00:00Z" description: Investigating the checkout latency spike. events_scanned: 0 expected_duration: 120 from: "2026-01-01T00:00:00Z" name: checkout-latency-investigation query: service:checkout status:error status: RUNNING to: "2026-01-02T00:00:00Z" id: nv2eu4srgyzdkulggjzg2zkmmzifa2rum5iq type: archive_search meta: truncated: false schema: $ref: "#/components/schemas/ArchiveSearchListResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List Archive Searches tags: - Logs Archive Searches "x-permission": operator: OR permissions: - logs_read_data x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Start a search over the logs stored in an archive. Without a `rehydration` object, the search only scans the archive and reports how much data matched. With one, the matched logs are also indexed into a retained historical view, which requires the `logs_write_historical_view` permission. operationId: CreateArchiveSearch requestBody: content: application/json: schema: $ref: "#/components/schemas/ArchiveSearchCreateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: archive_id: mhmyYmyLTOaFYKvhNadu1w bytes_scanned: 0 created_at: "2026-01-02T12:00:00Z" description: Investigating the checkout latency spike. events_scanned: 0 expected_duration: 120 from: "2026-01-01T00:00:00Z" name: checkout-latency-investigation query: service:checkout status:error status: RUNNING to: "2026-01-02T00:00:00Z" id: nv2eu4srgyzdkulggjzg2zkmmzifa2rum5iq type: archive_search schema: $ref: "#/components/schemas/ArchiveSearchResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create an Archive Search tags: - Logs Archive Searches "x-permission": operator: OR permissions: - logs_write_historical_view - logs_write_archive_search x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/logs/archive_searches/{archive_search_id}: get: description: Get a single Archive Search, including its status and the amount of archive data scanned when the search finishes. operationId: GetArchiveSearch parameters: - description: Unique identifier of the Archive Search. example: nv2eu4srgyzdkulggjzg2zkmmzifa2rum5iq in: path name: archive_search_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: archive_id: mhmyYmyLTOaFYKvhNadu1w bytes_scanned: 402764439 completed_at: "2026-01-02T12:30:00Z" created_at: "2026-01-02T12:00:00Z" description: Investigating the checkout latency spike. events_scanned: 1500 from: "2026-01-01T00:00:00Z" name: checkout-latency-investigation query: service:checkout status:error rehydration: max_rehydrated_events: 1000000 retention_days: 15 tier: standard status: COMPLETED to: "2026-01-02T00:00:00Z" id: nv2eu4srgyzdkulggjzg2zkmmzifa2rum5iq type: archive_search schema: $ref: "#/components/schemas/ArchiveSearchResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get an Archive Search tags: - Logs Archive Searches "x-permission": operator: OR permissions: - logs_read_data x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: |- Turn a plain Archive Search into a Search & Rehydration by indexing the matched logs into a retained historical view. Rehydration is the only thing this endpoint can change, and it only applies to a search that has already finished scanning. operationId: RehydrateArchiveSearch parameters: - description: Unique identifier of the Archive Search. example: nv2eu4srgyzdkulggjzg2zkmmzifa2rum5iq in: path name: archive_search_id required: true schema: type: string requestBody: content: application/json: schema: $ref: "#/components/schemas/ArchiveSearchRehydrateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: archive_id: mhmyYmyLTOaFYKvhNadu1w bytes_scanned: 402764439 created_at: "2026-01-02T12:00:00Z" description: Investigating the checkout latency spike. events_scanned: 1500 from: "2026-01-01T00:00:00Z" name: checkout-latency-investigation query: service:checkout status:error rehydration: max_rehydrated_events: 100000 retention_days: 15 tier: standard status: RUNNING to: "2026-01-02T00:00:00Z" id: nv2eu4srgyzdkulggjzg2zkmmzifa2rum5iq type: archive_search schema: $ref: "#/components/schemas/ArchiveSearchResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "412": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Precondition Failed "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Rehydrate an Archive Search tags: - Logs Archive Searches "x-permission": operator: OR permissions: - logs_write_historical_view x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/logs/archive_searches/{archive_search_id}/cancel: post: description: |- Cancel a running Archive Search. Cancelling an Archive Search that has already finished is a no-op: it returns the resource unchanged instead of returning an error. operationId: CancelArchiveSearch parameters: - description: Unique identifier of the Archive Search. example: nv2eu4srgyzdkulggjzg2zkmmzifa2rum5iq in: path name: archive_search_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: archive_id: mhmyYmyLTOaFYKvhNadu1w bytes_scanned: 102400 completed_at: "2026-01-02T12:05:00Z" created_at: "2026-01-02T12:00:00Z" description: Investigating the checkout latency spike. events_scanned: 500 from: "2026-01-01T00:00:00Z" name: checkout-latency-investigation query: service:checkout status:error status: CANCELLED to: "2026-01-02T00:00:00Z" id: nv2eu4srgyzdkulggjzg2zkmmzifa2rum5iq type: archive_search schema: $ref: "#/components/schemas/ArchiveSearchResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Cancel an Archive Search tags: - Logs Archive Searches "x-permission": operator: OR permissions: - logs_write_historical_view - logs_write_archive_search x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/logs/config/archive-order: get: description: |- Get the current order of your archives. This endpoint takes no JSON arguments. operationId: GetLogsArchiveOrder responses: "200": content: application/json: examples: default: value: data: attributes: archive_ids: - a2zcMylnM4OCHpYusxIi1g - a2zcMylnM4OCHpYusxIi2g - a2zcMylnM4OCHpYusxIi3g type: archive_order schema: $ref: "#/components/schemas/LogsArchiveOrder" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get archive order tags: - Logs Archives "x-permission": operator: OR permissions: - logs_read_config put: description: |- Update the order of your archives. Since logs are processed sequentially, reordering an archive may change the structure and content of the data processed by other archives. **Note**: Using the `PUT` method updates your archive's order by replacing the current order with the new one. operationId: UpdateLogsArchiveOrder requestBody: content: application/json: examples: default: value: data: attributes: archive_ids: - a2zcMylnM4OCHpYusxIi1g - a2zcMylnM4OCHpYusxIi2g - a2zcMylnM4OCHpYusxIi3g type: archive_order schema: $ref: "#/components/schemas/LogsArchiveOrder" description: An object containing the new ordered list of archive IDs. required: true responses: "200": content: application/json: examples: default: value: data: attributes: archive_ids: - a2zcMylnM4OCHpYusxIi1g - a2zcMylnM4OCHpYusxIi2g - a2zcMylnM4OCHpYusxIi3g type: archive_order schema: $ref: "#/components/schemas/LogsArchiveOrder" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "422": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update archive order tags: - Logs Archives x-codegen-request-body-name: body "x-permission": operator: OR permissions: - logs_write_archives /api/v2/logs/config/archives: get: description: |- Get the list of configured logs archives with their definitions. operationId: ListLogsArchives responses: "200": content: application/json: examples: default: value: data: - attributes: destination: bucket: my-bucket integration: account_id: "123456789012" role_name: my-role type: s3 include_tags: false name: Nginx Archive query: source:nginx state: WORKING id: 00000000-0000-0000-0000-000000000001 type: archives schema: $ref: "#/components/schemas/LogsArchives" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all archives tags: - Logs Archives "x-permission": operator: OR permissions: - logs_read_archives post: description: Create an archive in your organization. operationId: CreateLogsArchive requestBody: content: application/json: examples: default: value: data: attributes: compression_method: ZSTD destination: container: container-name storage_account: account-name type: azure include_tags: false name: Nginx Archive query: source:nginx rehydration_max_scan_size_in_gb: 100 rehydration_tags: - team:intake - team:app type: archives s3_access_key_id: value: data: attributes: destination: bucket: my-bucket integration: access_key_id: AKIAIOSFODNN7EXAMPLE type: s3 name: Nginx Archive query: source:nginx type: archives schema: $ref: "#/components/schemas/LogsArchiveCreateRequest" description: The definition of the new archive. required: true responses: "200": content: application/json: examples: default: value: data: attributes: destination: bucket: my-bucket integration: account_id: "123456789012" role_name: my-role type: s3 include_tags: false name: Nginx Archive query: source:nginx state: WORKING id: 00000000-0000-0000-0000-000000000002 type: archives s3_access_key_id: value: data: attributes: destination: bucket: my-bucket integration: access_key_id: AKIAIOSFODNN7EXAMPLE type: s3 include_tags: false name: Nginx Archive query: source:nginx state: WORKING id: 00000000-0000-0000-0000-000000000002 type: archives schema: $ref: "#/components/schemas/LogsArchive" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create an archive tags: - Logs Archives x-codegen-request-body-name: body "x-permission": operator: OR permissions: - logs_write_archives /api/v2/logs/config/archives/{archive_id}: delete: description: |- Delete a given archive from your organization. operationId: DeleteLogsArchive parameters: - $ref: "#/components/parameters/ArchiveID" responses: "204": description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an archive tags: - Logs Archives "x-permission": operator: OR permissions: - logs_write_archives get: description: |- Get a specific archive from your organization. operationId: GetLogsArchive parameters: - $ref: "#/components/parameters/ArchiveID" responses: "200": content: application/json: examples: default: value: data: attributes: destination: bucket: my-bucket integration: account_id: "123456789012" role_name: my-role type: s3 include_tags: false name: Nginx Archive query: source:nginx state: WORKING id: 00000000-0000-0000-0000-000000000003 type: archives schema: $ref: "#/components/schemas/LogsArchive" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get an archive tags: - Logs Archives "x-permission": operator: OR permissions: - logs_read_archives put: description: |- Update a given archive configuration. **Note**: Using this method updates your archive configuration by **replacing** your current configuration with the new one sent to your Datadog organization. operationId: UpdateLogsArchive parameters: - $ref: "#/components/parameters/ArchiveID" requestBody: content: application/json: examples: default: value: data: attributes: compression_method: ZSTD destination: container: container-name storage_account: account-name type: azure include_tags: false name: Nginx Archive query: source:nginx rehydration_max_scan_size_in_gb: 100 rehydration_tags: - team:intake - team:app type: archives s3_access_key_id: value: data: attributes: destination: bucket: my-bucket integration: access_key_id: AKIAIOSFODNN7EXAMPLE type: s3 name: Nginx Archive query: source:nginx type: archives schema: $ref: "#/components/schemas/LogsArchiveCreateRequest" description: New definition of the archive. required: true responses: "200": content: application/json: examples: default: value: data: attributes: destination: bucket: my-bucket integration: account_id: "123456789012" role_name: my-role type: s3 include_tags: false name: Nginx Archive query: source:nginx state: WORKING id: 00000000-0000-0000-0000-000000000004 type: archives s3_access_key_id: value: data: attributes: destination: bucket: my-bucket integration: access_key_id: AKIAIOSFODNN7EXAMPLE type: s3 include_tags: false name: Nginx Archive query: source:nginx state: WORKING id: 00000000-0000-0000-0000-000000000004 type: archives schema: $ref: "#/components/schemas/LogsArchive" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update an archive tags: - Logs Archives x-codegen-request-body-name: body "x-permission": operator: OR permissions: - logs_write_archives /api/v2/logs/config/archives/{archive_id}/readers: delete: description: Removes a role from an archive. ([Roles API](https://docs.datadoghq.com/api/v2/roles/)) operationId: RemoveRoleFromArchive parameters: - $ref: "#/components/parameters/ArchiveID" requestBody: content: application/json: examples: default: value: data: id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: roles schema: $ref: "#/components/schemas/RelationshipToRole" required: true responses: "204": description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Revoke role from an archive tags: - Logs Archives x-codegen-request-body-name: body "x-permission": operator: OR permissions: - logs_write_archives get: description: Returns all read roles a given archive is restricted to. operationId: ListArchiveReadRoles parameters: - $ref: "#/components/parameters/ArchiveID" responses: "200": content: application/json: examples: default: value: data: - attributes: name: Example Role id: 00000000-0000-0000-0000-000000000005 type: roles schema: $ref: "#/components/schemas/RolesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List read roles for an archive tags: - Logs Archives x-codegen-request-body-name: body "x-permission": operator: OR permissions: - logs_read_config post: description: Adds a read role to an archive. ([Roles API](https://docs.datadoghq.com/api/v2/roles/)) operationId: AddReadRoleToArchive parameters: - $ref: "#/components/parameters/ArchiveID" requestBody: content: application/json: examples: default: value: data: id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: roles schema: $ref: "#/components/schemas/RelationshipToRole" required: true responses: "204": description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Grant role to an archive tags: - Logs Archives x-codegen-request-body-name: body "x-permission": operator: OR permissions: - logs_write_archives /api/v2/logs/config/custom-destinations: get: description: Get the list of configured custom destinations in your organization with their definitions. operationId: ListLogsCustomDestinations responses: "200": content: application/json: examples: default: value: data: - attributes: enabled: true forward_tags: true forward_tags_restriction_list: - datacenter - host forward_tags_restriction_list_type: ALLOW_LIST forwarder_destination: auth: type: basic endpoint: https://example.com type: http name: Nginx logs query: source:nginx id: 00000000-0000-0000-0000-000000000001 type: custom_destination schema: $ref: "#/components/schemas/CustomDestinationsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all custom destinations tags: - Logs Custom Destinations "x-permission": operator: OR permissions: - logs_read_config - logs_read_data post: description: Create a custom destination in your organization. operationId: CreateLogsCustomDestination requestBody: content: application/json: examples: default: value: data: attributes: enabled: true forward_tags: true forward_tags_restriction_list: - datacenter - host forward_tags_restriction_list_type: ALLOW_LIST forwarder_destination: endpoint: https://example.com type: http name: Nginx logs query: source:nginx type: custom_destination schema: $ref: "#/components/schemas/CustomDestinationCreateRequest" description: The definition of the new custom destination. required: true responses: "200": content: application/json: examples: default: value: data: attributes: enabled: true forward_tags: true forward_tags_restriction_list: - datacenter - host forward_tags_restriction_list_type: ALLOW_LIST forwarder_destination: auth: type: basic endpoint: https://example.com type: http name: Nginx logs query: source:nginx id: 00000000-0000-0000-0000-000000000002 type: custom_destination schema: $ref: "#/components/schemas/CustomDestinationResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a custom destination tags: - Logs Custom Destinations x-codegen-request-body-name: body "x-permission": operator: OR permissions: - logs_write_forwarding_rules /api/v2/logs/config/custom-destinations/{custom_destination_id}: delete: description: Delete a specific custom destination in your organization. operationId: DeleteLogsCustomDestination parameters: - $ref: "#/components/parameters/CustomDestinationId" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a custom destination tags: - Logs Custom Destinations "x-permission": operator: OR permissions: - logs_write_forwarding_rules get: description: Get a specific custom destination in your organization. operationId: GetLogsCustomDestination parameters: - $ref: "#/components/parameters/CustomDestinationId" responses: "200": content: application/json: examples: default: value: data: attributes: enabled: true forward_tags: true forward_tags_restriction_list: - datacenter - host forward_tags_restriction_list_type: ALLOW_LIST forwarder_destination: auth: type: basic endpoint: https://example.com type: http name: Nginx logs query: source:nginx id: 00000000-0000-0000-0000-000000000003 type: custom_destination schema: $ref: "#/components/schemas/CustomDestinationResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a custom destination tags: - Logs Custom Destinations "x-permission": operator: OR permissions: - logs_read_config - logs_read_data patch: description: Update the given fields of a specific custom destination in your organization. operationId: UpdateLogsCustomDestination parameters: - $ref: "#/components/parameters/CustomDestinationId" requestBody: content: application/json: examples: default: value: data: attributes: enabled: true forward_tags: true forward_tags_restriction_list: - datacenter - host forward_tags_restriction_list_type: ALLOW_LIST forwarder_destination: endpoint: https://example.com type: http name: Nginx logs query: source:nginx id: be5d7a69-d0c8-4d4d-8ee8-bba292d98139 type: custom_destination schema: $ref: "#/components/schemas/CustomDestinationUpdateRequest" description: New definition of the custom destination's fields. required: true responses: "200": content: application/json: examples: default: value: data: attributes: enabled: true forward_tags: true forward_tags_restriction_list: - datacenter - host forward_tags_restriction_list_type: ALLOW_LIST forwarder_destination: auth: type: basic endpoint: https://example.com type: http name: Nginx logs query: source:nginx id: 00000000-0000-0000-0000-000000000004 type: custom_destination schema: $ref: "#/components/schemas/CustomDestinationResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a custom destination tags: - Logs Custom Destinations x-codegen-request-body-name: body "x-permission": operator: OR permissions: - logs_write_forwarding_rules /api/v2/logs/config/metrics: get: description: Get the list of configured log-based metrics with their definitions. operationId: ListLogsMetrics responses: "200": content: application/json: examples: default: value: data: - attributes: compute: aggregation_type: distribution include_percentiles: true path: "@duration" filter: query: "service:web-api AND @http.status_code:[200 TO 299]" group_by: - path: "@http.status_code" tag_name: status_code id: logs.page.load.count type: logs_metrics schema: $ref: "#/components/schemas/LogsMetricsResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all log-based metrics tags: - Logs Metrics "x-permission": operator: OR permissions: - logs_read_config post: description: |- Create a metric based on your ingested logs in your organization. Returns the log-based metric object from the request body when the request is successful. operationId: CreateLogsMetric requestBody: content: application/json: examples: default: value: data: attributes: compute: aggregation_type: distribution include_percentiles: true path: "@duration" filter: query: service:web-api AND @http.status_code:[200 TO 299] group_by: - path: "@http.status_code" tag_name: status_code id: logs.page.load.count type: logs_metrics schema: $ref: "#/components/schemas/LogsMetricCreateRequest" description: The definition of the new log-based metric. required: true responses: "200": content: application/json: examples: default: value: data: attributes: compute: aggregation_type: distribution include_percentiles: true path: "@duration" filter: query: "service:web-api AND @http.status_code:[200 TO 299]" group_by: - path: "@http.status_code" tag_name: status_code id: logs.page.load.count type: logs_metrics schema: $ref: "#/components/schemas/LogsMetricResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a log-based metric tags: - Logs Metrics x-codegen-request-body-name: body "x-permission": operator: OR permissions: - logs_generate_metrics /api/v2/logs/config/metrics/{metric_id}: delete: description: Delete a specific log-based metric from your organization. operationId: DeleteLogsMetric parameters: - $ref: "#/components/parameters/MetricID" responses: "204": description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a log-based metric tags: - Logs Metrics "x-permission": operator: OR permissions: - logs_generate_metrics get: description: Get a specific log-based metric from your organization. operationId: GetLogsMetric parameters: - $ref: "#/components/parameters/MetricID" responses: "200": content: application/json: examples: default: value: data: attributes: compute: aggregation_type: distribution include_percentiles: true path: "@duration" filter: query: "service:web-api AND @http.status_code:[200 TO 299]" group_by: - path: "@http.status_code" tag_name: status_code id: logs.page.load.count type: logs_metrics schema: $ref: "#/components/schemas/LogsMetricResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a log-based metric tags: - Logs Metrics "x-permission": operator: OR permissions: - logs_read_config patch: description: |- Update a specific log-based metric from your organization. Returns the log-based metric object from the request body when the request is successful. operationId: UpdateLogsMetric parameters: - $ref: "#/components/parameters/MetricID" requestBody: content: application/json: examples: default: value: data: attributes: compute: include_percentiles: true filter: query: service:web-api AND @http.status_code:[200 TO 299] group_by: - path: "@http.status_code" tag_name: status_code type: logs_metrics schema: $ref: "#/components/schemas/LogsMetricUpdateRequest" description: New definition of the log-based metric. required: true responses: "200": content: application/json: examples: default: value: data: attributes: compute: aggregation_type: distribution include_percentiles: true path: "@duration" filter: query: "service:web-api AND @http.status_code:[200 TO 299]" group_by: - path: "@http.status_code" tag_name: status_code id: logs.page.load.count type: logs_metrics schema: $ref: "#/components/schemas/LogsMetricResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a log-based metric tags: - Logs Metrics x-codegen-request-body-name: body "x-permission": operator: OR permissions: - logs_generate_metrics /api/v2/logs/config/restriction_queries: get: description: Returns all restriction queries, including their names and IDs. operationId: ListRestrictionQueries parameters: - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" modified_at: "2024-01-01T00:00:00+00:00" restriction_query: "env:sandbox" id: 00000000-0000-0000-0000-000000000001 type: logs_restriction_queries schema: $ref: "#/components/schemas/RestrictionQueryListResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List restriction queries tags: - Logs Restriction Queries "x-permission": operator: OR permissions: - logs_read_config x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a new restriction query for your organization. operationId: CreateRestrictionQuery requestBody: content: application/json: examples: default: value: data: attributes: restriction_query: env:sandbox type: logs_restriction_queries schema: $ref: "#/components/schemas/RestrictionQueryCreatePayload" required: true responses: "200": content: application/json: examples: default: value: data: attributes: restriction_query: "env:sandbox" id: 00000000-0000-0000-0000-000000000002 type: logs_restriction_queries schema: $ref: "#/components/schemas/RestrictionQueryWithoutRelationshipsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a restriction query tags: - Logs Restriction Queries x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_manage x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/logs/config/restriction_queries/role/{role_id}: get: description: Get restriction query for a given role. operationId: GetRoleRestrictionQuery parameters: - $ref: "#/components/parameters/RestrictionQueryRoleID" responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" modified_at: "2024-01-01T00:00:00+00:00" restriction_query: "env:sandbox" id: 00000000-0000-0000-0000-000000000007 type: logs_restriction_queries schema: $ref: "#/components/schemas/RestrictionQueryListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get restriction query for a given role tags: - Logs Restriction Queries "x-permission": operator: OR permissions: - logs_read_config x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/logs/config/restriction_queries/user/{user_id}: get: description: Get all restriction queries for a given user. operationId: ListUserRestrictionQueries parameters: - $ref: "#/components/parameters/RestrictionQueryUserID" responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" modified_at: "2024-01-01T00:00:00+00:00" restriction_query: "env:sandbox" id: 00000000-0000-0000-0000-000000000006 type: logs_restriction_queries schema: $ref: "#/components/schemas/RestrictionQueryListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all restriction queries for a given user tags: - Logs Restriction Queries "x-permission": operator: OR permissions: - logs_read_config x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/logs/config/restriction_queries/{restriction_query_id}: delete: description: Deletes a restriction query. operationId: DeleteRestrictionQuery parameters: - $ref: "#/components/parameters/RestrictionQueryID" responses: "204": description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a restriction query tags: - Logs Restriction Queries x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_manage x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a restriction query in the organization specified by the restriction query's `restriction_query_id`. operationId: GetRestrictionQuery parameters: - $ref: "#/components/parameters/RestrictionQueryID" responses: "200": content: application/json: examples: default: value: data: attributes: restriction_query: "env:sandbox" id: 00000000-0000-0000-0000-000000000003 relationships: {} type: logs_restriction_queries included: [] schema: $ref: "#/components/schemas/RestrictionQueryWithRelationshipsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a restriction query tags: - Logs Restriction Queries x-codegen-request-body-name: body "x-permission": operator: OR permissions: - logs_read_config x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: |- Edit a restriction query. operationId: UpdateRestrictionQuery parameters: - $ref: "#/components/parameters/RestrictionQueryID" requestBody: content: application/json: examples: default: value: data: attributes: restriction_query: env:sandbox type: logs_restriction_queries schema: $ref: "#/components/schemas/RestrictionQueryUpdatePayload" required: true responses: "200": content: application/json: examples: default: value: data: attributes: restriction_query: "env:sandbox" id: 00000000-0000-0000-0000-000000000004 type: logs_restriction_queries schema: $ref: "#/components/schemas/RestrictionQueryWithoutRelationshipsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a restriction query tags: - Logs Restriction Queries x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_manage x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: |- Replace a restriction query. operationId: ReplaceRestrictionQuery parameters: - $ref: "#/components/parameters/RestrictionQueryID" requestBody: content: application/json: examples: default: value: data: attributes: restriction_query: env:sandbox type: logs_restriction_queries schema: $ref: "#/components/schemas/RestrictionQueryUpdatePayload" required: true responses: "200": content: application/json: examples: default: value: data: attributes: restriction_query: "env:sandbox" id: 00000000-0000-0000-0000-000000000005 type: logs_restriction_queries schema: $ref: "#/components/schemas/RestrictionQueryWithoutRelationshipsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Replace a restriction query tags: - Logs Restriction Queries x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_manage x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/logs/config/restriction_queries/{restriction_query_id}/roles: delete: description: Removes a role from a restriction query. operationId: RemoveRoleFromRestrictionQuery parameters: - $ref: "#/components/parameters/RestrictionQueryID" requestBody: content: application/json: examples: default: value: data: id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: roles schema: $ref: "#/components/schemas/RelationshipToRole" required: true responses: "204": description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Revoke role from a restriction query tags: - Logs Restriction Queries x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_manage x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Returns all roles that have a given restriction query. operationId: ListRestrictionQueryRoles parameters: - $ref: "#/components/parameters/RestrictionQueryID" - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" responses: "200": content: application/json: examples: default: value: data: - attributes: name: Datadog Admin Role id: 00000000-0000-0000-0000-000000000008 type: roles schema: $ref: "#/components/schemas/RestrictionQueryRolesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List roles for a restriction query tags: - Logs Restriction Queries x-codegen-request-body-name: body "x-permission": operator: OR permissions: - logs_read_config x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Adds a role to a restriction query. **Note**: This operation automatically grants the `logs_read_data` permission to the role if it doesn't already have it. operationId: AddRoleToRestrictionQuery parameters: - $ref: "#/components/parameters/RestrictionQueryID" requestBody: content: application/json: examples: default: value: data: id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: roles schema: $ref: "#/components/schemas/RelationshipToRole" required: true responses: "204": description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Grant role to a restriction query tags: - Logs Restriction Queries x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_manage x-unstable: |- **Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/logs/events: get: description: |- List endpoint returns logs that match a log search query. [Results are paginated][1]. Use this endpoint to search and filter your logs. **If you are considering archiving logs for your organization, consider use of the Datadog archive capabilities instead of the log list API. See [Datadog Logs Archive documentation][2].** [1]: /logs/guide/collect-multiple-logs-with-pagination [2]: https://docs.datadoghq.com/logs/archives operationId: ListLogsGet parameters: - description: Search query following logs syntax. example: "@datacenter:us @role:db" in: query name: filter[query] required: false schema: type: string - description: |- For customers with multiple indexes, the indexes to search. Defaults to '*' which means all indexes example: ["main", "web"] explode: false in: query name: filter[indexes] required: false schema: items: description: The name of a log index. type: string type: array - description: Minimum timestamp for requested logs. example: "2019-01-02T09:42:36.320Z" in: query name: filter[from] required: false schema: format: date-time type: string - description: Maximum timestamp for requested logs. example: "2019-01-03T09:42:36.320Z" in: query name: filter[to] required: false schema: format: date-time type: string - description: Specifies the storage type to be used example: "indexes" in: query name: filter[storage_tier] required: false schema: $ref: "#/components/schemas/LogsStorageTier" - description: Order of logs in results. in: query name: sort required: false schema: $ref: "#/components/schemas/LogsSort" - description: |- List following results with a cursor provided in the previous query. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" in: query name: page[cursor] required: false schema: type: string - description: Maximum number of logs in the response. example: 25 in: query name: page[limit] required: false schema: default: 10 format: int32 maximum: 5000 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: message: "Hello World" service: web-app tags: - "env:prod" timestamp: "2024-01-01T00:00:00+00:00" id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: log meta: elapsed: 132 status: done schema: $ref: "#/components/schemas/LogsListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Search logs (GET) tags: ["Logs"] x-pagination: cursorParam: page[cursor] cursorPath: meta.page.after limitParam: page[limit] resultsPath: data "x-permission": operator: OR permissions: - logs_read_data /api/v2/logs/events/search: post: description: |- List endpoint returns logs that match a log search query. [Results are paginated][1]. Use this endpoint to search and filter your logs. **If you are considering archiving logs for your organization, consider use of the Datadog archive capabilities instead of the log list API. See [Datadog Logs Archive documentation][2].** [1]: /logs/guide/collect-multiple-logs-with-pagination [2]: https://docs.datadoghq.com/logs/archives operationId: ListLogs requestBody: content: "application/json": examples: default: value: filter: from: now-15m indexes: - main - web query: service:web-api AND @http.status_code:[200 TO 299] storage_tier: indexes to: now options: timezone: GMT page: cursor: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== limit: 25 sort: timestamp schema: $ref: "#/components/schemas/LogsListRequest" required: false responses: "200": content: application/json: examples: default: value: data: - attributes: message: Host connected to remote service: test-service status: INFO id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: log meta: elapsed: 132 status: done schema: $ref: "#/components/schemas/LogsListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - logs_read_data summary: Search logs (POST) tags: ["Logs"] x-codegen-request-body-name: body x-pagination: cursorParam: body.page.cursor cursorPath: meta.page.after limitParam: body.page.limit resultsPath: data "x-permission": operator: OR permissions: - logs_read_data /api/v2/maintenance_windows: get: description: Returns all configured maintenance windows for event management work items. Maintenance windows define time periods during which work item notifications and automation rules are suppressed for work items matching a given query. operationId: ListMaintenanceWindows responses: "200": content: application/json: examples: default: value: data: - attributes: end_at: "2026-06-01T06:00:00Z" name: Weekly maintenance query: "project:SEC" start_at: "2026-06-01T00:00:00Z" id: a1b2c3d4-e5f6-7890-abcd-ef1234567890 type: maintenance_window schema: $ref: "#/components/schemas/MaintenanceWindowsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - event_correlation_config_read summary: List maintenance windows tags: - Case Management post: description: Creates a maintenance window for event management work items with a name, work item filter query, and time range (start and end). operationId: CreateMaintenanceWindow requestBody: content: application/json: examples: default: value: data: attributes: end_at: "2026-06-01T06:00:00Z" name: Weekly maintenance query: "project:SEC" start_at: "2026-06-01T00:00:00Z" type: maintenance_window schema: $ref: "#/components/schemas/MaintenanceWindowCreateRequest" description: Maintenance window payload. required: true responses: "201": content: application/json: examples: default: value: data: attributes: end_at: "2026-06-01T06:00:00Z" name: Weekly maintenance query: "project:SEC" start_at: "2026-06-01T00:00:00Z" id: a1b2c3d4-e5f6-7890-abcd-ef1234567890 type: maintenance_window schema: $ref: "#/components/schemas/MaintenanceWindowResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - event_correlation_config_write summary: Create a maintenance window tags: - Case Management /api/v2/maintenance_windows/{maintenance_window_id}: delete: description: Permanently deletes a maintenance window. operationId: DeleteMaintenanceWindow parameters: - $ref: "#/components/parameters/MaintenanceWindowIDPathParameter" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - event_correlation_config_write summary: Delete a maintenance window tags: - Case Management put: description: Updates the name, query, start time, or end time of an existing maintenance window. operationId: UpdateMaintenanceWindow parameters: - $ref: "#/components/parameters/MaintenanceWindowIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: end_at: "2026-06-01T06:00:00Z" name: Weekly maintenance query: "project:SEC" start_at: "2026-06-01T00:00:00Z" type: maintenance_window schema: $ref: "#/components/schemas/MaintenanceWindowUpdateRequest" description: Maintenance window payload. required: true responses: "200": content: application/json: examples: default: value: data: attributes: end_at: "2026-06-01T06:00:00Z" name: Weekly maintenance query: "project:SEC" start_at: "2026-06-01T00:00:00Z" id: a1b2c3d4-e5f6-7890-abcd-ef1234567890 type: maintenance_window schema: $ref: "#/components/schemas/MaintenanceWindowResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - event_correlation_config_write summary: Update a maintenance window tags: - Case Management /api/v2/metrics: get: description: |- Get a list of actively reporting metrics for your organization, with optional volumes, query activity, and tag configuration filters. When you need volumes, query activity, or tag configuration status for many metrics, use this endpoint instead of calling per-metric endpoints (such as `GET /api/v2/metrics/{metric_name}/volumes` or `GET /api/v2/metrics/{metric_name}/tags`) in a loop, which is slower and quickly reaches rate limits. This endpoint does not return the tag keys or values that a metric was submitted with. Always paginate: send `page[size]` (up to 10000; a few hundred to a few thousand is typical) and follow `meta.pagination.next_cursor` (or `links.next`) until it is null or missing. Without `page[size]` or `page[cursor]`, the response is not paginated: it returns matching metrics in one response, with no pagination metadata, up to a limit of 250,000 metrics by default (some organizations have a different limit). Metrics beyond the limit are left out without any indication. Unpaginated requests in large organizations can also be slow or time out, and clients with response-size limits may fail or truncate the response. If a request with `page[cursor]` returns `410 Gone`, the cursor has expired: restart from the first page (send `page[size]` without `page[cursor]`). - **Volumes**: `include=metric_volumes` adds the indexed and ingested volume of each metric. The volume is a fixed one-hour value and is not affected by `window[seconds]`. Volumes are not returned inside `data`: each metric with volume data has a `relationships.metric_volumes.data` reference, and the volumes themselves are returned as `metric_volumes` resources in the top-level `included` array. To join them, match `included[].id` to the `id` of `data[]` items with type `metrics`; both are the metric name. `manage_tags` items in `data` repeat the same `id`, so skip them when joining. Metrics without volume data, such as standard (non-custom) metrics, have no `metric_volumes` reference or entry. - **Top metrics by volume**: `sort=-metric_volumes.indexed_volume` together with `include=metric_volumes` and `page[size]` (for example, `page[size]=20`) returns the metrics with the highest indexed volume first. Sorting requires a paginated request. - **Volume for a family of metrics**: `filter[metrics.id]=http.request*` with `include=metric_volumes` and `page[size]` returns volumes for every metric whose name starts with `http.request` (a value whose only `*` is at the end is case-sensitive). A value without `*` matches names that contain it, ignoring case. - **Unqueried metrics**: `filter[queried]=false` with `filter[queried][window][seconds]` (for example, `2592000` for 30 days) and `page[size]` returns metrics that were not queried in that window. - **Metrics without a tag configuration**: `filter[configured]=false` with `page[size]` returns custom metrics that have no Metrics without Limits™ tag configuration. - **Metric types**: if `filter[metric_type]` is omitted, metrics of all types are returned. Examples: - Top 20 metrics by indexed volume: `GET /api/v2/metrics?include=metric_volumes&sort=-metric_volumes.indexed_volume&page[size]=20` - Metrics not queried in the last 30 days, with their volumes: `GET /api/v2/metrics?filter[queried]=false&filter[queried][window][seconds]=2592000&include=metric_volumes&page[size]=1000` - Metrics without a tag configuration: `GET /api/v2/metrics?filter[configured]=false&page[size]=1000` - Volumes for metrics whose name starts with `http.request`: `GET /api/v2/metrics?filter[metrics.id]=http.request*&include=metric_volumes&page[size]=1000` Query parameters use bracket notation (for example, `filter[tags]`, `filter[queried][window][seconds]`). Pass them as standard URL query strings, URL-encoding the brackets if your client does not handle them. For example: `GET /api/v2/metrics?filter[tags]=env:prod&window[seconds]=86400&page[size]=500`. operationId: ListTagConfigurations parameters: - description: Only return custom metrics that have been configured (`true`) or not configured (`false`) with Metrics Without Limits. in: query name: filter[configured] required: false schema: type: boolean - description: Only return metrics that are eligible (`true`) or ineligible (`false`) for configuration with Metrics Without Limits. in: query name: filter[is_configurable] required: false schema: type: boolean - description: Only return metrics that have the given tag key(s) in their Metrics Without Limits configuration (included or excluded). in: query name: filter[tags_configured] required: false schema: description: Tag keys to filter by. type: string - description: |- Only return metrics of the given metric type. If omitted, metrics of all types are returned. `distribution` also matches OpenTelemetry histograms; use `exponential_histogram` or `explicit_histogram` to return only one kind of OpenTelemetry histogram. in: query name: filter[metric_type] required: false schema: $ref: "#/components/schemas/MetricTagConfigurationMetricTypeCategory" - description: Only return distribution metrics that have percentile aggregations enabled (true) or disabled (false). in: query name: filter[include_percentiles] required: false schema: type: boolean - description: |- Only return metrics that have been queried (true) or not queried (false) in the look back window. Set the window with `filter[queried][window][seconds]`; if omitted, a default window is used. in: query name: filter[queried] required: false schema: type: boolean - description: |- The look-back window for `filter[queried]`, in seconds. You must also set `filter[queried]`, or the request returns a 400 error. The default value is 2,592,000 seconds (30 days), the maximum value is 15,552,000 seconds (180 days), and the minimum value is 0. With `0`, the window ends now, so `filter[queried]=true` returns almost no metrics and `filter[queried]=false` returns all metrics. For example: `filter[queried]=true&filter[queried][window][seconds]=604800`. in: query name: filter[queried][window][seconds] required: false schema: default: 2592000 format: int64 maximum: 15552000 minimum: 0 type: integer - description: |- Only return metrics that were submitted with tags matching this expression. You can use AND, OR, IN, and wildcards. For example: `filter[tags]=env IN (staging,test) AND service:web*`. in: query name: filter[tags] required: false schema: type: string - description: |- Only return metrics that are used in at least one dashboard, monitor, notebook, or SLO. in: query name: filter[related_assets] required: false schema: type: boolean - description: |- Only return metrics whose name matches this value. A value without `*` matches metric names that contain it, ignoring case (for example, `http.request` matches `app.HTTP.request.count`). A full metric name also matches longer names that contain it. `*` is a wildcard that can appear anywhere and more than once, and these patterns also ignore case: `*.request.count` matches names that end with `.request.count`, and `app.*.count` matches names that start with `app.` and end with `.count`. The exception is a value whose only `*` is at the end (for example, `http.request*`): it matches names that start with that text and is case-sensitive. Spaces are treated as `*`. Only one value is accepted; repeating the parameter returns `400 Bad Request`. Allowed characters are letters, digits, `_`, `.`, `*`, and spaces. An empty value is ignored. in: query name: filter[metrics.id] required: false schema: pattern: "^[a-zA-Z0-9_.* ]*$" type: string - description: |- Only return metrics that have historical metrics ingestion enabled (`true`) or not enabled (`false`). in: query name: filter[historical_metrics] required: false schema: type: boolean - description: Include related resources in the response. Set to `metric_volumes` to include indexed and ingested volume counts for each metric. example: metric_volumes in: query name: include required: false schema: type: string - description: "Sort results by metric volume. Prefix a key with `-` for descending order. Supported keys: `metric_volumes.indexed_volume`, `metric_volumes.ingested_volume`, `metric_volumes.indexed_volume_delta`, `metric_volumes.ingested_volume_delta`. Requires a paginated request (`page[size]` or `page[cursor]`)." example: "-metric_volumes.indexed_volume" in: query name: sort required: false schema: type: string - description: |- Only return metrics that have been actively reporting in this window. The default value is 3,600 seconds (1 hour), the maximum value is 5,184,000 seconds (60 days), and the minimum value is 0. With `0`, the API returns only metrics that reported in the last few minutes. in: query name: window[seconds] required: false schema: default: 3600 format: int64 maximum: 5184000 minimum: 0 type: integer - description: |- Maximum number of results per page. Always send it: without `page[size]` or `page[cursor]`, the response is not paginated and is capped at 250,000 metrics by default, with no indication when results are left out. Send `page[size]` on the first request to opt in to pagination. On subsequent requests, send `page[cursor]` set to the value of `meta.pagination.next_cursor` from the previous response. To retain a custom page size, include `page[size]` on every request. The default value is 10000, the maximum value is 10000, and the minimum value is 1. example: 20 in: query name: page[size] required: false schema: default: 10000 format: int32 maximum: 10000 minimum: 1 type: integer - description: |- Cursor for pagination. Use `page[size]` to opt-in to pagination and get the first page; for subsequent pages, use the value from `meta.pagination.next_cursor` in the response. Pagination is complete when `next_cursor` is null. An expired cursor returns `410 Gone`; restart from the first page without `page[cursor]`. in: query name: page[cursor] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - id: system.cpu.user type: metrics - attributes: created_at: "2020-03-25T09:48:37.463835Z" metric_type: gauge modified_at: "2020-04-25T09:48:37.463835Z" tags: - app - datacenter id: http.endpoint.request type: manage_tags meta: pagination: next_cursor: eyJhZnRlciI6Imh0dHAuZW5kcG9pbnQucmVxdWVzdCJ9 with_metric_volumes: value: data: - id: user.custom.cpu.usage relationships: metric_volumes: data: id: user.custom.cpu.usage type: metric_volumes type: metrics - id: user.custom.mem.usage relationships: metric_volumes: data: id: user.custom.mem.usage type: metric_volumes type: metrics included: - attributes: indexed_volume: 1000 ingested_volume: 456 id: user.custom.cpu.usage type: metric_volumes - attributes: indexed_volume: 250 ingested_volume: 1011 id: user.custom.mem.usage type: metric_volumes schema: $ref: "#/components/schemas/MetricsAndMetricTagConfigurationsResponse" description: Success "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "410": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Gone "429": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metrics_read summary: List all metrics with volumes and query activity tags: - Metrics x-pagination: cursorParam: page[cursor] cursorPath: meta.pagination.next_cursor limitParam: page[size] resultsPath: data "x-permission": operator: OR permissions: - metrics_read /api/v2/metrics/derived-metrics: post: description: |- Create a derived metric for the org. The metric name is supplied as the resource `id`, and the `definition` sets the formula and the queries the formula is computed from. Requires the `Manage Tags for Metrics` permission. operationId: CreateDerivedMetric requestBody: content: application/json: examples: default: value: data: attributes: definition: formula: a queries: - data_source: metrics name: a query: avg:system.cpu.user{*} id: my.derived.metric type: derived_metrics schema: $ref: "#/components/schemas/DerivedMetricCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: definition: formula: a queries: - data_source: metrics name: a query: avg:system.cpu.user{*} id: my.derived.metric type: derived_metrics schema: $ref: "#/components/schemas/DerivedMetricResponse" description: Created headers: Location: description: The URL of the newly created derived metric. schema: type: string "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metric_tags_write summary: Create a derived metric tags: - Metrics x-codegen-request-body-name: body "x-permission": operator: OR permissions: - metric_tags_write /api/v2/metrics/derived-metrics/{metric_name}: delete: description: |- Delete a derived metric by name. Idempotent: returns 204 regardless of whether the derived metric existed. Requires the `Manage Tags for Metrics` permission. operationId: DeleteDerivedMetric parameters: - $ref: "#/components/parameters/MetricName" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metric_tags_write summary: Delete a derived metric tags: - Metrics "x-permission": operator: OR permissions: - metric_tags_write get: description: Get the definition of a derived metric by name. operationId: GetDerivedMetric parameters: - $ref: "#/components/parameters/MetricName" responses: "200": content: application/json: examples: default: value: data: attributes: definition: formula: a queries: - data_source: metrics name: a query: avg:system.cpu.user{*} id: my.derived.metric type: derived_metrics schema: $ref: "#/components/schemas/DerivedMetricResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metrics_read summary: Get a derived metric tags: - Metrics "x-permission": operator: OR permissions: - metrics_read put: description: |- Update the definition of an existing derived metric. The `id` in the request body must match the `metric_name` path parameter. Requires the `Manage Tags for Metrics` permission. operationId: UpdateDerivedMetric parameters: - $ref: "#/components/parameters/MetricName" requestBody: content: application/json: examples: default: value: data: attributes: definition: formula: a queries: - data_source: metrics name: a query: avg:system.cpu.user{*} id: my.derived.metric type: derived_metrics schema: $ref: "#/components/schemas/DerivedMetricCreateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: definition: formula: a queries: - data_source: metrics name: a query: avg:system.cpu.user{*} id: my.derived.metric type: derived_metrics schema: $ref: "#/components/schemas/DerivedMetricResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metric_tags_write summary: Update a derived metric tags: - Metrics x-codegen-request-body-name: body "x-permission": operator: OR permissions: - metric_tags_write /api/v2/metrics/historical-metrics-configurations: post: description: |- Enable historical metrics ingestion (late data ingestion) for a metric. Idempotent: enabling an already-enabled metric returns 200 instead of 201. Not supported for distribution metrics, metrics with an existing tag configuration, or most standard (non-custom) metrics. operationId: CreateHistoricalMetricsConfiguration requestBody: content: application/json: examples: default: value: data: id: dd.test.metric type: historical_metrics_configurations schema: $ref: "#/components/schemas/HistoricalMetricsConfigurationCreateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T12:00:00.000Z" id: dd.test.metric type: historical_metrics_configurations schema: $ref: "#/components/schemas/HistoricalMetricsConfigurationResponse" description: OK "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T12:00:00.000Z" id: dd.test.metric type: historical_metrics_configurations schema: $ref: "#/components/schemas/HistoricalMetricsConfigurationResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - late_metrics_config_write summary: Enable historical metrics ingestion tags: - Metrics x-codegen-request-body-name: body "x-permission": operator: OR permissions: - late_metrics_config_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/metrics/historical-metrics-configurations/{metric_name}: delete: description: |- Disable historical metrics ingestion for a metric. Idempotent: always returns 204, whether or not the configuration existed or the metric itself still exists, so that Terraform destroy succeeds for a metric removed out-of-band. operationId: DeleteHistoricalMetricsConfiguration parameters: - $ref: "#/components/parameters/MetricName" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - late_metrics_config_write summary: Delete a historical metrics configuration tags: - Metrics "x-permission": operator: OR permissions: - late_metrics_config_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: |- Get the historical metrics ingestion configuration for a metric. Existence of the resource means historical metrics ingestion is enabled; returns 404 when it is not enabled for the metric. operationId: GetHistoricalMetricsConfiguration parameters: - $ref: "#/components/parameters/MetricName" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T12:00:00.000Z" id: dd.test.metric type: historical_metrics_configurations schema: $ref: "#/components/schemas/HistoricalMetricsConfigurationResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metrics_read summary: Get a historical metrics configuration tags: - Metrics "x-permission": operator: OR permissions: - metrics_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/metrics/list-tag-indexing-rule-exemptions: get: description: |- Returns explicit exemptions and legacy tag configurations that exclude metrics from tag indexing rules. You can filter results by metric name prefix, whether an exemption is safe to remove, or the UUID of a matching tag indexing rule. You can sort results by metric name or by estimated change in indexed volume. operationId: ListTagIndexingRuleExemptions parameters: - description: |- Filter exemptions to metrics whose names start with this literal prefix. Matching is case-sensitive. Wildcard characters are treated literally. example: dd.test. in: query name: filter[metric_prefix] schema: type: string - description: |- Filter exemptions by whether they are safe to remove. An exemption is considered safe when a fresh, usable estimate indicates that removing it would not increase indexed volume and would not drop tags used to query the metric in monitors, dashboards, notebooks, or SLOs. Set to `true` to return safe-to-remove exemptions, or `false` to return all other exemptions, including those with unavailable or stale estimates. example: true in: query name: filter[safe] schema: type: boolean - description: Filter exemptions to metrics matched by the tag indexing rule with this UUID. example: 00000000-0000-0000-0000-000000000001 in: query name: filter[tag_indexing_rule_id] schema: format: uuid type: string - description: |- Sort field. Prefix the field with `-` for descending order. The default is `estimated_change_in_volume` in ascending order, with the largest reductions (most negative values) first. example: estimated_change_in_volume in: query name: sort schema: $ref: "#/components/schemas/TagIndexingRuleExemptionSort" - description: |- Maximum number of results per page. Defaults to 10000; accepts values from 1 to 10000. If `meta.pagination.next_cursor` is non-null, request the next page by passing that value as `page[cursor]`. Continue until `next_cursor` is null. example: 100 in: query name: page[size] required: false schema: default: 10000 format: int32 maximum: 10000 minimum: 1 type: integer - description: |- Cursor for pagination. Use `page[size]` to opt-in to pagination and get the first page; for subsequent pages, use the value from `meta.pagination.next_cursor` in the response. Pagination is complete when `next_cursor` is null. in: query name: page[cursor] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-15T12:00:00.000Z" created_by_handle: user@datadoghq.com estimated_change_in_volume: 45 kind: exemption missing_indexed_tags: - service reason: This metric has a pre-existing tag configuration. volume_status: ok id: dd.test.metric type: tag_indexing_rule_exemptions links: first: /api/v2/metrics/list-tag-indexing-rule-exemptions?page[size]=100 next: /api/v2/metrics/list-tag-indexing-rule-exemptions?page[size]=100&page[cursor]=next-page-cursor self: /api/v2/metrics/list-tag-indexing-rule-exemptions?page[size]=100 meta: pagination: cursor: limit: 1 next_cursor: next-page-cursor type: cursor_limit schema: $ref: "#/components/schemas/TagIndexingRuleExemptionsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metrics_read summary: List tag indexing rule exemptions tags: - Metrics x-pagination: cursorParam: page[cursor] cursorPath: meta.pagination.next_cursor limitParam: page[size] resultsPath: data "x-permission": operator: OR permissions: - metrics_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/metrics/tag-indexing-rules: get: description: List tag indexing rules for an org, sorted by `rule_order`, with offset/limit pagination. operationId: ListTagIndexingRules parameters: - description: Page size (1–1000, default 100). in: query name: page[limit] schema: format: int64 type: integer - description: Page offset from the start of the list (default 0). in: query name: page[offset] schema: format: int64 type: integer - description: Substring filter on rule name. in: query name: search schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: exclude_tags_mode: false metric_name_matches: - "dd.test.*" name: my-indexing-rule rule_order: 1 tags: - env - service id: "00000000-0000-0000-0000-000000000001" type: tag_indexing_rules meta: total: 1 schema: $ref: "#/components/schemas/TagIndexingRulesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metrics_read summary: List tag indexing rules tags: - Metrics "x-permission": operator: OR permissions: - metrics_read post: description: |- Create a tag indexing rule for the org. `rule_order` is assigned server-side as max+1 among existing rules; use the reorder endpoint to change the evaluation order. Requires the `Manage Tags for Metrics` permission. operationId: CreateTagIndexingRule requestBody: content: application/json: examples: default: value: data: attributes: metric_name_matches: - "dd.test.*" name: my-indexing-rule tags: - env - service type: tag_indexing_rules schema: $ref: "#/components/schemas/TagIndexingRuleCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T12:00:00.000Z" exclude_tags_mode: false metric_name_matches: - "dd.test.*" name: my-indexing-rule rule_order: 1 tags: - env - service id: "00000000-0000-0000-0000-000000000001" type: tag_indexing_rules schema: $ref: "#/components/schemas/TagIndexingRuleResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metric_tags_write summary: Create a tag indexing rule tags: - Metrics x-codegen-request-body-name: body "x-permission": operator: OR permissions: - metric_tags_write /api/v2/metrics/tag-indexing-rules/order: post: description: |- Atomically re-sequence the tag indexing rules for an org to match the supplied list of rule UUIDs. The server assigns `rule_order` 1, 2, … matching each rule UUID by position in the list. The UUIDs of all active rules must be provided; omitting any active rule UUID returns a 400 error. Requires the `Manage Tags for Metrics` permission. operationId: ReorderTagIndexingRules requestBody: content: application/json: examples: default: value: data: attributes: rule_ids: - "00000000-0000-0000-0000-000000000001" - "00000000-0000-0000-0000-000000000002" type: tag_indexing_rules schema: $ref: "#/components/schemas/TagIndexingRuleOrderRequest" required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metric_tags_write summary: Reorder tag indexing rules tags: - Metrics x-codegen-request-body-name: body "x-permission": operator: OR permissions: - metric_tags_write /api/v2/metrics/tag-indexing-rules/{id}: delete: description: |- Soft-delete a tag indexing rule. Idempotent: returns 204 whether the rule existed or was already deleted. Remaining rules in the org are automatically re-sequenced to keep `rule_order` dense and 1-based. Requires the `Manage Tags for Metrics` permission. operationId: DeleteTagIndexingRule parameters: - $ref: "#/components/parameters/TagIndexingRuleId" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metric_tags_write summary: Delete a tag indexing rule tags: - Metrics "x-permission": operator: OR permissions: - metric_tags_write get: description: Get a single tag indexing rule by its UUID. operationId: GetTagIndexingRule parameters: - $ref: "#/components/parameters/TagIndexingRuleId" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T12:00:00.000Z" exclude_tags_mode: false metric_name_matches: - "dd.test.*" name: my-indexing-rule rule_order: 1 tags: - env - service id: "00000000-0000-0000-0000-000000000001" type: tag_indexing_rules schema: $ref: "#/components/schemas/TagIndexingRuleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metrics_read summary: Get a tag indexing rule tags: - Metrics "x-permission": operator: OR permissions: - metrics_read put: description: |- Partially update a tag indexing rule. Fields omitted from the request body are left unchanged. Setting `rule_order` to a value already used by another rule returns 409; use the reorder endpoint for atomic re-sequencing. Requires the `Manage Tags for Metrics` permission. operationId: UpdateTagIndexingRule parameters: - $ref: "#/components/parameters/TagIndexingRuleId" requestBody: content: application/json: examples: default: value: data: attributes: name: my-updated-rule tags: - env - service - version type: tag_indexing_rules schema: $ref: "#/components/schemas/TagIndexingRuleUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: exclude_tags_mode: false metric_name_matches: - "dd.test.*" name: my-updated-rule rule_order: 1 tags: - env - service - version id: "00000000-0000-0000-0000-000000000001" type: tag_indexing_rules schema: $ref: "#/components/schemas/TagIndexingRuleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metric_tags_write summary: Update a tag indexing rule tags: - Metrics x-codegen-request-body-name: body "x-permission": operator: OR permissions: - metric_tags_write /api/v2/metrics/{metric_name}/active-configurations: get: description: |- List tags and aggregations that are actively queried on dashboards, notebooks, monitors, the Metrics Explorer, and using the API for a given metric name. To find which of many metrics are queried or not queried, use `GET /api/v2/metrics` with `filter[queried]` instead of calling this endpoint for each metric. operationId: ListActiveMetricConfigurations parameters: - $ref: "#/components/parameters/MetricName" - description: |- The number of seconds of look back (from now). Default value is 604,800 (1 week), and the minimum value is 14,400 (4 hours). Values below the minimum return `400 Bad Request`. example: 14400 in: query name: window[seconds] required: false schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: active_aggregations: - space: avg time: avg active_tags: - app id: http.endpoint.request type: actively_queried_configurations schema: $ref: "#/components/schemas/MetricSuggestedTagsAndAggregationsResponse" description: Success "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too Many Requests summary: List active tags and aggregations tags: - Metrics "x-permission": operator: OR permissions: - metrics_read /api/v2/metrics/{metric_name}/all-tags: get: description: |- View indexed and ingested tags for a given metric name. Results are filtered by the `window[seconds]` parameter, which defaults to 14400 (4 hours). This window only limits which tags are returned; it does not affect whether the metric is found. A `404 Not Found` response means that no metric with this exact name exists in your organization. Metric names must match exactly. Distribution metrics do not have suffixes such as `.avg` or `.count`, so use the base metric name. For high-cardinality metrics, keep responses small with `filter[include_tag_values]=false`, `page[limit]`, and `filter[match]`. operationId: ListTagsByMetricName parameters: - $ref: "#/components/parameters/MetricName" - description: |- The number of seconds of look back (from now) to query for tag data. Default value is 14400 (4 hours), minimum value is 14400 (4 hours). If you send a value below 14400, the request still succeeds, but the API uses 14400 (4 hours) instead of your value. in: query name: window[seconds] required: false schema: format: int64 type: integer - description: |- Filter results to tags from data points that have the specified tags. For example, `filter[tags]=env:staging,host:123` returns tags only from data points with both `env:staging` and `host:123`. in: query name: filter[tags] required: false schema: type: string - description: |- Filter returned tags to those matching a substring. For example, `filter[match]=env` returns tags like `env:prod`, `environment:staging`, etc. in: query name: filter[match] required: false schema: type: string - description: |- Whether to include tag values in the response. Defaults to true. example: false in: query name: filter[include_tag_values] required: false schema: type: boolean - description: |- Whether to allow partial results. Defaults to false. in: query name: filter[allow_partial] required: false schema: type: boolean - description: Maximum number of results to return. example: 1000 in: query name: page[limit] required: false schema: default: 1000000 format: int32 maximum: 1000000 minimum: 1 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: tags: - "env:prod" - "host:myhost" id: system.cpu.user type: metrics schema: $ref: "#/components/schemas/MetricAllTagsResponse" description: Success "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metrics_read summary: List tags by metric name tags: - Metrics "x-permission": operator: OR permissions: - metrics_read /api/v2/metrics/{metric_name}/assets: get: description: Returns dashboards, monitors, notebooks, and SLOs that a metric is stored in, if any. Updated every 24 hours. operationId: ListMetricAssets parameters: - $ref: "#/components/parameters/MetricName" responses: "200": content: application/json: examples: default: value: data: id: http.endpoint.request relationships: dashboards: data: - id: abc-def-xyz type: dashboards monitors: data: - id: "1775073" type: monitors notebooks: data: [] slos: data: [] type: metrics included: - attributes: popularity: 3.0 title: My Dashboard url: /dashboard/abc-def-xyz id: abc-def-xyz type: dashboards - attributes: title: CPU utilization is high url: /monitors/1775073 id: "1775073" type: monitors schema: $ref: "#/components/schemas/MetricAssetsResponse" description: Success "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Related Assets to a Metric tags: - Metrics /api/v2/metrics/{metric_name}/estimate: get: description: |- Returns the estimated cardinality for a metric with a given tag, percentile and number of aggregations configuration using Metrics without Limits™. To compare current volumes across many metrics, use `GET /api/v2/metrics` with `include=metric_volumes` instead of calling this endpoint for each metric. operationId: EstimateMetricsOutputSeries parameters: - $ref: "#/components/parameters/MetricName" - description: |- Comma-separated list of tag keys that the metric is configured to query with. For example: `filter[groups]=app,host`. example: "app,host" in: query name: filter[groups] required: false schema: type: string - description: |- When `true`, `filter[groups]` is treated as an exclude list instead of an include list. Defaults to `false`. example: false in: query name: filter[exclude_tags_mode] required: false schema: type: boolean - description: |- The number of hours of look back (from now) to estimate cardinality with. If unspecified, it defaults to 0 hours (the most recent data). example: 0 in: query name: filter[hours_ago] required: false schema: format: int32 maximum: 2147483647 minimum: 0 type: integer - description: Deprecated. Number of aggregations has no impact on volume. example: 1 in: query name: filter[num_aggregations] required: false schema: format: int32 maximum: 9 type: integer - description: Deprecated. This query parameter has no effect on the estimate. example: true in: query name: filter[pct] required: false schema: type: boolean - description: A window, in hours, from the look back to estimate cardinality with. The minimum and default is 1 hour. example: 6 in: query name: filter[timespan_h] required: false schema: format: int32 maximum: 2147483647 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: estimate_type: count_or_gauge estimated_at: "2024-01-01T00:00:00+00:00" estimated_output_series: 50 id: system.cpu.user type: metric_cardinality_estimate schema: $ref: "#/components/schemas/MetricEstimateResponse" description: Success "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too Many Requests summary: Tag Configuration Cardinality Estimator tags: - Metrics "x-permission": operator: OPEN permissions: [] /api/v2/metrics/{metric_name}/tag-cardinalities: get: description: Returns the cardinality details of tags for a specific metric. operationId: GetMetricTagCardinalityDetails parameters: - $ref: "#/components/parameters/MetricName" responses: "200": content: application/json: examples: default: value: data: - attributes: cardinality_delta: 25 id: host type: tag_cardinality - attributes: cardinality_delta: 5 id: env type: tag_cardinality meta: metric_name: system.cpu.user schema: $ref: "#/components/schemas/MetricTagCardinalitiesResponse" description: Success "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too Many Requests summary: Get tag key cardinality details tags: - Metrics "x-permission": operator: OR permissions: - metrics_read /api/v2/metrics/{metric_name}/tag-indexing-rule-exemptions: delete: description: |- Remove a metric's exemption from tag indexing rules. Idempotent: returns 204 whether or not an exemption existed. Any associated legacy tag configuration record is also removed. Requires the `Manage Tags for Metrics` permission. operationId: DeleteTagIndexingRuleExemption parameters: - $ref: "#/components/parameters/MetricName" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metric_tags_write summary: Delete a tag indexing rule exemption tags: - Metrics "x-permission": operator: OR permissions: - metric_tags_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: |- Returns why a metric is excluded from tag indexing rules. Returns 200 with `kind=exemption` when an explicit exemption exists, 200 with `kind=legacy_tag_configuration` when the metric has a legacy tag configuration acting as an implicit exclusion, or 404 when neither applies. operationId: GetTagIndexingRuleExemption parameters: - $ref: "#/components/parameters/MetricName" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T12:00:00.000Z" created_by_handle: user@datadoghq.com estimated_change_in_volume: 45 kind: exemption missing_indexed_tags: - service reason: This metric has a pre-existing tag configuration. volume_status: ok id: dd.test.metric type: tag_indexing_rule_exemptions schema: $ref: "#/components/schemas/TagIndexingRuleExemptionResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metrics_read summary: Get a tag indexing rule exemption tags: - Metrics "x-permission": operator: OR permissions: - metrics_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Exempt a metric from all tag indexing rules. The response includes the created exemption resource. Requires the `Manage Tags for Metrics` permission. operationId: CreateTagIndexingRuleExemption parameters: - $ref: "#/components/parameters/MetricName" requestBody: content: application/json: examples: default: value: data: attributes: reason: This metric has a pre-existing tag configuration. type: tag_indexing_rule_exemptions schema: $ref: "#/components/schemas/TagIndexingRuleExemptionCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T12:00:00.000Z" created_by_handle: user@datadoghq.com estimated_change_in_volume: kind: exemption missing_indexed_tags: [] reason: This metric has a pre-existing tag configuration. volume_status: unavailable id: dd.test.metric type: tag_indexing_rule_exemptions schema: $ref: "#/components/schemas/TagIndexingRuleExemptionResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metric_tags_write summary: Create a tag indexing rule exemption tags: - Metrics x-codegen-request-body-name: body "x-permission": operator: OR permissions: - metric_tags_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: |- Update the reason for an explicit tag indexing rule exemption. The exemption's `created_at` and `created_by_handle` values remain unchanged. Returns 404 when the metric has no explicit exemption or has only a legacy tag configuration. Requires the `Manage Tags for Metrics` permission. operationId: UpdateTagIndexingRuleExemption parameters: - $ref: "#/components/parameters/MetricName" requestBody: content: application/json: examples: default: value: data: attributes: reason: This metric must remain exempt because of its query requirements. type: tag_indexing_rule_exemptions schema: $ref: "#/components/schemas/TagIndexingRuleExemptionUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T12:00:00.000Z" created_by_handle: user@datadoghq.com estimated_change_in_volume: kind: exemption missing_indexed_tags: [] reason: This metric must remain exempt because of its query requirements. volume_status: unavailable id: dd.test.metric type: tag_indexing_rule_exemptions schema: $ref: "#/components/schemas/TagIndexingRuleExemptionResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metric_tags_write summary: Update a tag indexing rule exemption tags: - Metrics x-codegen-request-body-name: body "x-permission": operator: OR permissions: - metric_tags_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/metrics/{metric_name}/tag-indexing-rules: get: description: |- List the tag indexing rules that apply to a given metric, sorted by `rule_order`. Matching is performed server-side using each rule's `metric_name_matches` glob patterns. operationId: ListTagIndexingRulesForMetric parameters: - $ref: "#/components/parameters/MetricName" responses: "200": content: application/json: examples: default: value: data: [] meta: total: 0 schema: $ref: "#/components/schemas/TagIndexingRulesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metrics_read summary: List tag indexing rules for a metric tags: - Metrics "x-permission": operator: OR permissions: - metrics_read /api/v2/metrics/{metric_name}/tags: delete: description: |- Deletes a metric's tag configuration. Can only be used with application keys from users with the `Manage Tags for Metrics` permission. Note: This operation is irreversible. operationId: DeleteTagConfiguration parameters: - $ref: "#/components/parameters/MetricName" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too Many Requests summary: Delete a tag configuration tags: - Metrics "x-permission": operator: OR permissions: - metric_tags_write get: description: |- Returns the tag configuration for the given metric name. A metric may exist and submit data without having a tag configuration. A `404 Not Found` response usually means that the metric has no tag configuration, but it is also returned when no metric with this name exists in your organization. To list tag configurations for many metrics, use `GET /api/v2/metrics` with `filter[configured]=true` instead of calling this endpoint for each metric. operationId: ListTagConfigurationByName parameters: - $ref: "#/components/parameters/MetricName" responses: "200": content: application/json: examples: default: value: data: attributes: metric_type: distribution tags: - app - datacenter id: http.endpoint.request type: manage_tags schema: $ref: "#/components/schemas/MetricTagConfigurationResponse" description: Success "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: No tag configuration exists for the metric "429": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - metrics_read summary: List tag configuration by name tags: - Metrics "x-permission": operator: OR permissions: - metrics_read patch: description: |- Update the tag configuration of a metric or percentile aggregations of a distribution metric or custom aggregations of a count, rate, or gauge metric. By setting `exclude_tags_mode` to true the behavior is changed from an allow-list to a deny-list, and tags in the defined list will not be queryable. Can only be used with application keys from users with the `Manage Tags for Metrics` permission. This endpoint requires a tag configuration to be created first. operationId: UpdateTagConfiguration parameters: - $ref: "#/components/parameters/MetricName" requestBody: content: application/json: examples: default: value: data: attributes: group_by: - app - datacenter include_percentiles: false id: http.endpoint.request type: manage_tags schema: $ref: "#/components/schemas/MetricTagConfigurationUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: metric_type: distribution tags: - app - datacenter id: http.endpoint.request type: manage_tags schema: $ref: "#/components/schemas/MetricTagConfigurationResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "422": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Unprocessable Entity "429": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too Many Requests summary: Update a tag configuration tags: - Metrics x-codegen-request-body-name: body "x-permission": operator: OR permissions: - metric_tags_write post: description: |- Create and define a list of queryable tag keys for an existing count/gauge/rate/distribution metric. Optionally, include percentile aggregations on any distribution metric. By setting `exclude_tags_mode` to true, the behavior is changed from an allow-list to a deny-list, and tags in the defined list are not queryable. Can only be used with application keys of users with the `Manage Tags for Metrics` permission. operationId: CreateTagConfiguration parameters: - $ref: "#/components/parameters/MetricName" requestBody: content: application/json: examples: default: value: data: attributes: include_percentiles: false metric_type: distribution tags: - app - datacenter id: http.endpoint.request type: manage_tags schema: $ref: "#/components/schemas/MetricTagConfigurationCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: metric_type: distribution tags: - app - datacenter id: http.endpoint.request type: manage_tags schema: $ref: "#/components/schemas/MetricTagConfigurationResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Conflict "429": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too Many Requests summary: Create a tag configuration tags: - Metrics x-codegen-request-body-name: body "x-permission": operator: OR permissions: - metric_tags_write /api/v2/metrics/{metric_name}/volumes: get: description: |- View hourly average cardinality for the given metric name over the look back period. For Metric Name Pricing customers, view total point volume for the given metric name over the look back period. To get the last hour's indexed and ingested volumes for many metrics, use `GET /api/v2/metrics` with `include=metric_volumes` instead of calling this endpoint for each metric. Use this endpoint when you need a longer look-back for a single metric. operationId: ListVolumesByMetricName parameters: - $ref: "#/components/parameters/MetricName" - description: |- The number of seconds of look back (from now). Default value is 3,600 (1 hour), maximum value is 2,592,000 (1 month). example: 7200 in: query name: window[seconds] required: false schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: indexed_volume: 100 ingested_volume: 200 id: http.endpoint.request type: metric_volumes schema: $ref: "#/components/schemas/MetricVolumesResponse" description: Success "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too Many Requests summary: List distinct metric volumes by metric name tags: - Metrics "x-permission": operator: OPEN permissions: [] /api/v2/model-groups: get: description: List model groups the user can view. The organization-wide policy has id "default" and explicit model, provider, and route selections. Missing or empty selections grant no organization-wide access. Its audience is fixed to the organization; it cannot be renamed or deleted. Named policies retain their access bindings. Requires configuration read permission; named policies also require view access. operationId: ListAiGatewayModelGroups responses: "200": content: application/json: examples: default: value: data: - attributes: allow_fast_mode: true created_at: "2026-08-24T12:00:00Z" max_reasoning_level: models: - created_at: "2026-08-24T12:00:00Z" enabled: true id: "101" model_id_canonical: gpt-5.2-codex model_id_wire: gpt-5.2-codex-20260801 provider_id: 42 source: discovered supported_operations: - OPENAI_CHAT_COMPLETIONS updated_at: "2026-08-24T12:00:00Z" name: Coding models providers: [] routing_rules: - slug: coding-route updated_at: "2026-08-24T12:00:00Z" id: "7" type: model-groups schema: $ref: "#/components/schemas/AiGatewayModelGroupListResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: List AI Gateway model groups tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create an AI Gateway model group from a name and any combination of model catalog entries and routing rules, with optional fast-mode and reasoning limits and initial access bindings. operationId: CreateAiGatewayModelGroup requestBody: content: application/json: schema: $ref: "#/components/schemas/AiGatewayModelGroupCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: allow_fast_mode: true created_at: "2026-08-24T12:00:00Z" max_reasoning_level: models: - created_at: "2026-08-24T12:00:00Z" enabled: true id: "101" model_id_canonical: gpt-5.2-codex model_id_wire: gpt-5.2-codex-20260801 provider_id: 42 source: discovered supported_operations: - OPENAI_CHAT_COMPLETIONS updated_at: "2026-08-24T12:00:00Z" name: Coding models providers: [] routing_rules: - slug: coding-route updated_at: "2026-08-24T12:00:00Z" id: "7" type: model-groups schema: $ref: "#/components/schemas/AiGatewayModelGroupResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Create an AI Gateway model group tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/model-groups/{id}: delete: description: Delete a named model group. The organization-wide policy cannot be deleted. Requires configuration write permission and edit access to the group. operationId: DeleteAiGatewayModelGroup parameters: - $ref: "#/components/parameters/AiGatewayModelGroupID" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Delete an AI Gateway model group tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a named policy or the explicit organization-wide policy by id "default". Requires configuration read permission; named policies also require view access. Provider selections cover current and future models and are returned separately from individual model selections. operationId: GetAiGatewayModelGroup parameters: - $ref: "#/components/parameters/AiGatewayModelGroupID" responses: "200": content: application/json: examples: default: value: data: attributes: allow_fast_mode: true created_at: "2026-08-24T12:00:00Z" max_reasoning_level: models: - created_at: "2026-08-24T12:00:00Z" enabled: true id: "101" model_id_canonical: gpt-5.2-codex model_id_wire: gpt-5.2-codex-20260801 provider_id: 42 source: discovered supported_operations: - OPENAI_CHAT_COMPLETIONS updated_at: "2026-08-24T12:00:00Z" name: Coding models providers: [] routing_rules: - slug: coding-route updated_at: "2026-08-24T12:00:00Z" id: "7" type: model-groups schema: $ref: "#/components/schemas/AiGatewayModelGroupResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: Get an AI Gateway model group tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update a model group. For id "default", save membership and request options atomically with expected_revision. Empty selections grant no organization-wide access. Applicable authorized named policies override organization-wide request options; a rejected named-policy request cannot fall back to organization-wide options. The organization-wide audience is fixed and grants resource use only. Requires configuration write permission; named policies also require edit access. operationId: UpdateAiGatewayModelGroup parameters: - $ref: "#/components/parameters/AiGatewayModelGroupID" requestBody: content: application/json: schema: $ref: "#/components/schemas/AiGatewayModelGroupUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: allow_fast_mode: true created_at: "2026-08-24T12:00:00Z" max_reasoning_level: models: - created_at: "2026-08-24T12:00:00Z" enabled: true id: "101" model_id_canonical: gpt-5.2-codex model_id_wire: gpt-5.2-codex-20260801 provider_id: 42 source: discovered supported_operations: - OPENAI_CHAT_COMPLETIONS updated_at: "2026-08-24T12:00:00Z" name: Coding models providers: [] routing_rules: - slug: coding-route updated_at: "2026-08-24T12:00:00Z" id: "7" type: model-groups schema: $ref: "#/components/schemas/AiGatewayModelGroupResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Update an AI Gateway model group tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/model-lab-api/artifacts/content: get: description: Download the raw content of a Model Lab artifact file. operationId: GetModelLabArtifactContent parameters: - description: ID of the project. in: query name: project_id required: true schema: example: "1" type: string - description: Path to the artifact relative to the project directory. in: query name: artifact_path required: true schema: example: runs/42/model/weights.pt type: string responses: "200": content: application/octet-stream: examples: default: value: "" schema: format: binary type: string description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Get Model Lab artifact content tags: - Model Lab API x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/model-lab-api/facet-keys: get: description: List all available facet keys for filtering Model Lab runs. operationId: ListModelLabRunFacetKeys parameters: - description: Filter by project ID. in: query name: filter[project_id] required: true schema: example: 101 format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: metrics: - accuracy - loss parameters: - learning_rate - algorithm tags: - model - stage id: "1" type: facet_keys schema: $ref: "#/components/schemas/ModelLabFacetKeysResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: List Model Lab run facet keys tags: - Model Lab API x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/model-lab-api/facet-values: get: description: List available facet values for a specific run facet key. operationId: ListModelLabRunFacetValues parameters: - description: Filter by project ID. in: query name: filter[project_id] required: true schema: example: 101 format: int64 type: integer - description: "Facet type. Valid values: parameter, attribute, tag, metric." in: query name: facet_type required: true schema: $ref: "#/components/schemas/ModelLabFacetType" - description: Facet name. in: query name: facet_name required: true schema: example: algorithm type: string responses: "200": content: application/json: examples: default: value: data: attributes: facet_name: algorithm facet_type: parameter values: - gpt4 - dbscan id: "1" type: facet_values schema: $ref: "#/components/schemas/ModelLabFacetValuesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: List Model Lab run facet values tags: - Model Lab API x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/model-lab-api/project-facet-keys: get: description: List all available facet keys for filtering Model Lab projects. operationId: ListModelLabProjectFacetKeys responses: "200": content: application/json: examples: default: value: data: attributes: metrics: [] parameters: [] tags: - model - stage id: "1" type: facet_keys schema: $ref: "#/components/schemas/ModelLabFacetKeysResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: List Model Lab project facet keys tags: - Model Lab API x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/model-lab-api/project-facet-values: get: description: List available facet values for a specific project facet key. operationId: ListModelLabProjectFacetValues parameters: - description: "Facet type. Valid values: tag." in: query name: facet_type required: true schema: $ref: "#/components/schemas/ModelLabProjectFacetType" - description: Facet name. in: query name: facet_name required: true schema: example: model type: string responses: "200": content: application/json: examples: default: value: data: attributes: facet_name: model facet_type: tag values: - opus - gpt4 id: "1" type: facet_values schema: $ref: "#/components/schemas/ModelLabFacetValuesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: List Model Lab project facet values tags: - Model Lab API x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/model-lab-api/projects: get: description: List all Model Lab projects for the current organization. operationId: ListModelLabProjects parameters: - description: Text search filter for project name or description. in: query name: filter required: false schema: type: string - description: Filter by owner UUID. in: query name: filter[owner_id] required: false schema: format: uuid type: string - description: "Filter by tags. Format: key:value,key2:value2." in: query name: filter[tags] required: false schema: type: string - description: "Sort field. Valid values: name, created_at, updated_at. Prefix with '-' for descending order (e.g., -updated_at)." in: query name: sort required: false schema: default: "-updated_at" type: string - description: Number of items per page. Maximum is 100. in: query name: page[size] required: false schema: default: 25 format: int64 maximum: 100 type: integer - description: Page number (1-indexed). in: query name: page[number] required: false schema: default: 1 format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: artifact_storage_location: s3://bucket/active-project created_at: "2024-01-20T10:00:00Z" description: A machine learning training project. is_starred: false name: active-project tags: - key: model value: opus updated_at: "2024-01-20T11:00:00Z" id: "2" type: projects meta: page: number: 1 size: 25 total: 1 schema: $ref: "#/components/schemas/ModelLabProjectsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: List Model Lab projects tags: - Model Lab API x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/model-lab-api/projects/{project_id}: get: description: Get a single Model Lab project by its ID. operationId: GetModelLabProject parameters: - $ref: "#/components/parameters/ModelLabProjectIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: artifact_storage_location: s3://bucket/active-project created_at: "2024-01-20T10:00:00Z" description: A machine learning training project. is_starred: false name: active-project tags: - key: model value: opus updated_at: "2024-01-20T11:00:00Z" id: "2" type: projects schema: $ref: "#/components/schemas/ModelLabProjectResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Get a Model Lab project tags: - Model Lab API x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/model-lab-api/projects/{project_id}/artifacts: get: description: List all artifact files for a specific Model Lab project. operationId: ListModelLabProjectArtifacts parameters: - $ref: "#/components/parameters/ModelLabProjectIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: files: - artifact_path: projects/1/artifacts/model.pkl created_at: "2024-01-20T10:00:00Z" file_size: 204800 filename: model.pkl id: "1" type: project_files schema: $ref: "#/components/schemas/ModelLabProjectArtifactsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: List Model Lab project artifacts tags: - Model Lab API x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/model-lab-api/projects/{project_id}/star: delete: description: Remove the star from a Model Lab project for the current user. operationId: UnstarModelLabProject parameters: - $ref: "#/components/parameters/ModelLabProjectIDPathParameter" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Remove star from a Model Lab project tags: - Model Lab API x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Star a Model Lab project for the current user. operationId: StarModelLabProject parameters: - $ref: "#/components/parameters/ModelLabProjectIDPathParameter" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Star a Model Lab project tags: - Model Lab API x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/model-lab-api/runs: get: description: List all Model Lab runs for the current organization. operationId: ListModelLabRuns parameters: - description: Filter by run ID(s). Comma-separated list for multiple IDs. in: query name: filter[id] required: false schema: type: string - description: Text search filter for run name or description. in: query name: filter required: false schema: type: string - description: Filter by owner UUID. in: query name: filter[owner_id] required: false schema: type: string - description: "Filter by run status. Valid values: pending, running, completed, failed, killed, unresponsive, paused." in: query name: filter[status] required: false schema: $ref: "#/components/schemas/ModelLabRunStatus" - description: Filter by project ID. in: query name: filter[project_id] required: false schema: format: int64 type: integer - description: "Filter by tags. Format: key:value,key2:value2." in: query name: filter[tags] required: false schema: type: string - description: "Filter by params. Format: key:value,key2:>0.5,key3:true." in: query name: filter[params] required: false schema: type: string - description: Filter by parent run ID. Use 'null' to return only root runs (runs with no parent). in: query name: filter[parent_run_id] required: false schema: type: string - description: Sort pinned runs before non-pinned runs. Pinned runs are ordered by pin time descending. in: query name: pinned_first required: false schema: type: boolean - description: Include all runs pinned by the current user, regardless of other filters. in: query name: include_pinned required: false schema: type: boolean - description: When true, also return runs whose descendants match the active filters. The descendant_match field in each result indicates whether the run was included via a descendant match. in: query name: include_descendant_matches required: false schema: type: boolean - description: "Sort field. Valid values: name, created_at, updated_at, duration. Prefix with '-' for descending order (e.g., -updated_at)." in: query name: sort required: false schema: default: "-updated_at" type: string - description: Number of items per page. Maximum is 100. in: query name: page[size] required: false schema: default: 25 format: int64 maximum: 100 type: integer - description: Page number (1-indexed). in: query name: page[number] required: false schema: default: 1 format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-20T10:00:00Z" descendant_match: false description: Fine-tuning run with custom hyperparameters. has_children: false is_pinned: false metric_summaries: [] mlflow_artifact_location: s3://bucket/active-run name: active-run params: - key: algorithm value: gpt4 project_id: 101 started_at: "2024-01-20T10:00:00Z" status: running tags: - key: model value: opus updated_at: "2024-01-20T11:00:00Z" id: "2" type: runs meta: page: number: 1 size: 25 total: 1 schema: $ref: "#/components/schemas/ModelLabRunsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: List Model Lab runs tags: - Model Lab API x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/model-lab-api/runs/{run_id}: delete: description: Delete a Model Lab run by its ID. operationId: DeleteModelLabRun parameters: - $ref: "#/components/parameters/ModelLabRunIDPathParameter" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Delete a Model Lab run tags: - Model Lab API x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a single Model Lab run by its ID. operationId: GetModelLabRun parameters: - $ref: "#/components/parameters/ModelLabRunIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-20T10:00:00Z" descendant_match: false description: Fine-tuning run with custom hyperparameters. has_children: false is_pinned: false metric_summaries: [] mlflow_artifact_location: s3://bucket/active-run name: active-run params: - key: algorithm value: gpt4 project_id: 101 started_at: "2024-01-20T10:00:00Z" status: running tags: - key: model value: opus updated_at: "2024-01-20T11:00:00Z" id: "2" type: runs schema: $ref: "#/components/schemas/ModelLabRunResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Get a Model Lab run tags: - Model Lab API x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/model-lab-api/runs/{run_id}/artifacts: get: description: List artifact files for a specific Model Lab run. operationId: ListModelLabRunArtifacts parameters: - $ref: "#/components/parameters/ModelLabRunIDPathParameter" - description: Optional subdirectory path within the run's artifacts. in: query name: path required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: files: - file_size: 204800 is_dir: false path: model/weights.pt - is_dir: true path: model path_in_project: runs/42 id: "42" type: artifacts schema: $ref: "#/components/schemas/ModelLabRunArtifactsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: List Model Lab run artifacts tags: - Model Lab API x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/model-lab-api/runs/{run_id}/pin: delete: description: Remove the pin from a Model Lab run for the current user. operationId: UnpinModelLabRun parameters: - $ref: "#/components/parameters/ModelLabRunIDPathParameter" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Unpin a Model Lab run tags: - Model Lab API x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Pin a Model Lab run for the current user. operationId: PinModelLabRun parameters: - $ref: "#/components/parameters/ModelLabRunIDPathParameter" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Pin a Model Lab run tags: - Model Lab API x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/models: get: description: >- List all model catalog entries grouped by canonical model ID. Requires `ai_gateway_config_read` and provider View. Catalog and pricing metadata inherit provider access. Lists omit hidden entries; direct reads of hidden resources return 404. operationId: ListAiGatewayModelsByCanonical responses: "200": content: application/json: examples: default: value: data: - attributes: model_id_canonical: gpt-5.2-codex providers: - created_at: "2026-08-24T12:00:00Z" enabled: true id: "101" model_id_wire: gpt-5.2-codex-20260801 provider_id: 42 source: discovered supported_operations: - OPENAI_CHAT_COMPLETIONS updated_at: "2026-08-24T12:00:00Z" id: gpt-5.2-codex type: models-by-canonical schema: $ref: "#/components/schemas/AiGatewayModelsByCanonicalListResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: List AI Gateway models by canonical ID tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/monitor/notification_rule: get: description: Returns a list of all monitor notification rules. operationId: GetMonitorNotificationRules parameters: - description: The page to start paginating from. If `page` is not specified, the argument defaults to the first page. in: query name: page required: false schema: format: int32 maximum: 1000000 minimum: 0 type: integer - description: The number of rules to return per page. If `per_page` is not specified, the argument defaults to 100. in: query name: per_page required: false schema: format: int32 maximum: 1000 minimum: 1 type: integer - description: |- String for sort order, composed of field and sort order separated by a colon, for example `name:asc`. Supported sort directions: `asc`, `desc`. Supported fields: `name`, `created_at`. in: query name: sort required: false schema: type: string - description: |- JSON-encoded filter object. Supported keys: * `text`: Free-text query matched against rule name, tags, and recipients. * `tags`: Array of strings. Return rules that have any of these tags. * `recipients`: Array of strings. Return rules that have any of these recipients. example: '{"text":"error","tags":["env:prod","team:my-team"],"recipients":["slack-monitor-app","email@example.com"]}' in: query name: filters required: false schema: type: string - description: |- Comma-separated list of resource paths for related resources to include in the response. Supported resource path is `created_by`. in: query name: include required: false schema: example: "created_by" type: string responses: "200": content: application/json: examples: default: value: data: - attributes: filter: scope: "team:product" name: A notification rule name recipients: - slack-test-channel id: "00000000-0000-1234-0000-000000000000" type: monitor-notification-rule schema: $ref: "#/components/schemas/MonitorNotificationRuleListResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitors_read summary: Get all monitor notification rules tags: - Monitors x-permission: operator: OR permissions: - monitors_read post: description: Creates a monitor notification rule. operationId: CreateMonitorNotificationRule requestBody: content: application/json: examples: default: value: data: attributes: filter: tags: - team:product - host:abc name: A notification rule name recipients: - slack-test-channel - jira-test type: monitor-notification-rule schema: $ref: "#/components/schemas/MonitorNotificationRuleCreateRequest" description: Request body to create a monitor notification rule. required: true responses: "200": content: application/json: examples: default: value: data: attributes: filter: scope: "team:product" name: A notification rule name recipients: - slack-test-channel id: "00000000-0000-1234-0000-000000000000" type: monitor-notification-rule schema: $ref: "#/components/schemas/MonitorNotificationRuleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a monitor notification rule tags: - Monitors x-permission: operator: OR permissions: - monitor_config_policy_write - monitor_notification_rules_write /api/v2/monitor/notification_rule/{rule_id}: delete: description: Deletes a monitor notification rule by `rule_id`. operationId: DeleteMonitorNotificationRule parameters: - description: ID of the monitor notification rule to delete. in: path name: rule_id required: true schema: type: string responses: "204": description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a monitor notification rule tags: - Monitors x-permission: operator: OR permissions: - monitor_config_policy_write - monitor_notification_rules_write get: description: Returns a monitor notification rule by `rule_id`. operationId: GetMonitorNotificationRule parameters: - description: ID of the monitor notification rule to fetch. in: path name: rule_id required: true schema: type: string - description: |- Comma-separated list of resource paths for related resources to include in the response. Supported resource path is `created_by`. in: query name: include required: false schema: example: "created_by" type: string responses: "200": content: application/json: examples: default: value: data: attributes: filter: scope: "team:product" name: A notification rule name recipients: - slack-test-channel id: "00000000-0000-1234-0000-000000000000" type: monitor-notification-rule schema: $ref: "#/components/schemas/MonitorNotificationRuleResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitors_read summary: Get a monitor notification rule tags: - Monitors x-permission: operator: OR permissions: - monitors_read patch: description: Updates a monitor notification rule by `rule_id`. operationId: UpdateMonitorNotificationRule parameters: - description: ID of the monitor notification rule to update. in: path name: rule_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: filter: tags: - team:product - host:abc name: A notification rule name recipients: - slack-test-channel - jira-test id: 00000000-0000-1234-0000-000000000000 type: monitor-notification-rule schema: $ref: "#/components/schemas/MonitorNotificationRuleUpdateRequest" description: Request body to update the monitor notification rule. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created: "2024-01-01T00:00:00+00:00" filter: scope: "team:product AND host:abc" modified: "2024-01-01T00:00:00+00:00" name: A notification rule name recipients: - slack-test-channel - jira-test id: "00000000-0000-1234-0000-000000000000" type: monitor-notification-rule schema: $ref: "#/components/schemas/MonitorNotificationRuleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a monitor notification rule tags: - Monitors x-codegen-request-body-name: body x-permission: operator: OR permissions: - monitor_config_policy_write - monitor_notification_rules_write /api/v2/monitor/policy: get: description: Get all monitor configuration policies. operationId: ListMonitorConfigPolicies responses: "200": content: application/json: examples: default: value: data: - attributes: policy: tag_key: datacenter tag_key_required: true valid_tag_values: - prod - staging policy_type: tag id: "00000000-0000-1234-0000-000000000000" type: monitor-config-policy downtime: summary: Downtime duration policy value: data: - attributes: policy: max_duration_ms: 3600000 policy_type: downtime id: "00000000-0000-1234-0000-000000000000" type: monitor-config-policy schema: $ref: "#/components/schemas/MonitorConfigPolicyListResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitors_read summary: Get all monitor configuration policies tags: - Monitors "x-permission": operator: OR permissions: - monitors_read post: description: Create a monitor configuration policy. operationId: CreateMonitorConfigPolicy requestBody: content: application/json: examples: default: value: data: attributes: policy: tag_key: datacenter tag_key_required: true valid_tag_values: - prod - staging policy_type: tag type: monitor-config-policy downtime: summary: Downtime duration policy value: data: attributes: policy: max_duration_ms: 3600000 policy_type: downtime type: monitor-config-policy schema: $ref: "#/components/schemas/MonitorConfigPolicyCreateRequest" description: Create a monitor configuration policy request body. required: true responses: "200": content: application/json: examples: default: value: data: attributes: policy: tag_key: datacenter tag_key_required: true valid_tag_values: - prod - staging policy_type: tag id: "00000000-0000-1234-0000-000000000000" type: monitor-config-policy downtime: summary: Downtime duration policy value: data: attributes: policy: max_duration_ms: 3600000 policy_type: downtime id: "00000000-0000-1234-0000-000000000000" type: monitor-config-policy schema: $ref: "#/components/schemas/MonitorConfigPolicyResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a monitor configuration policy tags: - Monitors x-codegen-request-body-name: body "x-permission": operator: OR permissions: - monitor_config_policy_write /api/v2/monitor/policy/{policy_id}: delete: description: Delete a monitor configuration policy. operationId: DeleteMonitorConfigPolicy parameters: - description: ID of the monitor configuration policy. in: path name: policy_id required: true schema: example: "00000000-0000-1234-0000-000000000000" type: string responses: "204": description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a monitor configuration policy tags: - Monitors "x-permission": operator: OR permissions: - monitor_config_policy_write get: description: Get a monitor configuration policy by `policy_id`. operationId: GetMonitorConfigPolicy parameters: - description: ID of the monitor configuration policy. in: path name: policy_id required: true schema: example: "00000000-0000-1234-0000-000000000000" type: string responses: "200": content: application/json: examples: default: value: data: attributes: policy: tag_key: datacenter tag_key_required: true valid_tag_values: - prod - staging policy_type: tag id: "00000000-0000-1234-0000-000000000000" type: monitor-config-policy downtime: summary: Downtime duration policy value: data: attributes: policy: max_duration_ms: 3600000 policy_type: downtime id: "00000000-0000-1234-0000-000000000000" type: monitor-config-policy schema: $ref: "#/components/schemas/MonitorConfigPolicyResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitors_read summary: Get a monitor configuration policy tags: - Monitors "x-permission": operator: OR permissions: - monitors_read patch: description: Edit a monitor configuration policy. operationId: UpdateMonitorConfigPolicy parameters: - description: ID of the monitor configuration policy. in: path name: policy_id required: true schema: example: "00000000-0000-1234-0000-000000000000" type: string requestBody: content: application/json: examples: default: value: data: attributes: policy: tag_key: datacenter tag_key_required: true valid_tag_values: - prod - staging policy_type: tag id: 00000000-0000-1234-0000-000000000000 type: monitor-config-policy downtime: summary: Downtime duration policy value: data: attributes: policy: max_duration_ms: 3600000 policy_type: downtime id: 00000000-0000-1234-0000-000000000000 type: monitor-config-policy schema: $ref: "#/components/schemas/MonitorConfigPolicyEditRequest" description: Description of the update. required: true responses: "200": content: application/json: examples: default: value: data: attributes: policy: tag_key: datacenter tag_key_required: true valid_tag_values: - prod - staging policy_type: tag id: "00000000-0000-1234-0000-000000000000" type: monitor-config-policy downtime: summary: Downtime duration policy value: data: attributes: policy: max_duration_ms: 3600000 policy_type: downtime id: "00000000-0000-1234-0000-000000000000" type: monitor-config-policy schema: $ref: "#/components/schemas/MonitorConfigPolicyResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "422": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Edit a monitor configuration policy tags: - Monitors x-codegen-request-body-name: body "x-permission": operator: OR permissions: - monitor_config_policy_write /api/v2/monitor/template: get: description: Retrieve all monitor user templates. operationId: ListMonitorUserTemplates responses: "200": content: application/json: examples: default: value: data: - attributes: created: "2024-01-01T00:00:00+00:00" description: This is a template for monitoring user activity. modified: "2024-01-01T00:00:00+00:00" monitor_definition: message: You may need to add web hosts if this is consistently high. name: Bytes received on host0 query: avg(last_5m):sum:system.net.bytes_rcvd{host:host0} > 100 type: query alert tags: - product:Our Custom App - integration:Azure title: Postgres CPU Monitor version: 1 id: "00000000-0000-1234-0000-000000000000" type: monitor-user-template schema: $ref: "#/components/schemas/MonitorUserTemplateListResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitors_read summary: Get all monitor user templates tags: - Monitors "x-permission": operator: OR permissions: - monitors_read x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a new monitor user template. operationId: CreateMonitorUserTemplate requestBody: content: application/json: examples: default: value: data: attributes: description: This is a template for monitoring user activity. monitor_definition: message: You may need to add web hosts if this is consistently high. name: Bytes received on host0 query: avg(last_5m):sum:system.net.bytes_rcvd{host:host0} > 100 type: query alert tags: - product:Our Custom App - integration:Azure template_variables: - available_values: - value1 - value2 defaults: - defaultValue name: regionName tag_key: datacenter title: Postgres CPU Monitor type: monitor-user-template schema: $ref: "#/components/schemas/MonitorUserTemplateCreateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created: "2024-01-01T00:00:00+00:00" description: This is a template for monitoring user activity. modified: "2024-01-01T00:00:00+00:00" monitor_definition: message: You may need to add web hosts if this is consistently high. name: Bytes received on host0 query: avg(last_5m):sum:system.net.bytes_rcvd{host:host0} > 100 type: query alert tags: - product:Our Custom App - integration:Azure title: Postgres CPU Monitor version: 1 id: "00000000-0000-1234-0000-000000000000" type: monitor-user-template schema: $ref: "#/components/schemas/MonitorUserTemplateCreateResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a monitor user template tags: - Monitors "x-permission": operator: OR permissions: - monitor_config_policy_write x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/monitor/template/validate: post: description: Validate the structure and content of a monitor user template. operationId: ValidateMonitorUserTemplate requestBody: content: application/json: examples: default: value: data: attributes: description: This is a template for monitoring user activity. monitor_definition: message: You may need to add web hosts if this is consistently high. name: Bytes received on host0 query: avg(last_5m):sum:system.net.bytes_rcvd{host:host0} > 100 type: query alert tags: - product:Our Custom App - integration:Azure template_variables: - available_values: - value1 - value2 defaults: - defaultValue name: regionName tag_key: datacenter title: Postgres CPU Monitor type: monitor-user-template schema: $ref: "#/components/schemas/MonitorUserTemplateCreateRequest" required: true responses: "204": description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Validate a monitor user template tags: - Monitors "x-permission": operator: OR permissions: - monitor_config_policy_write x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/monitor/template/{template_id}: delete: description: Delete an existing monitor user template by its ID. operationId: DeleteMonitorUserTemplate parameters: - description: ID of the monitor user template. in: path name: template_id required: true schema: type: string responses: "204": description: OK "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a monitor user template tags: - Monitors "x-permission": operator: OR permissions: - monitor_config_policy_write x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Retrieve a monitor user template by its ID. operationId: GetMonitorUserTemplate parameters: - description: ID of the monitor user template. in: path name: template_id required: true schema: example: "00000000-0000-1234-0000-000000000000" type: string - description: Whether to include all versions of the template in the response in the versions field. example: false in: query name: with_all_versions required: false schema: type: boolean responses: "200": content: application/json: examples: default: value: data: attributes: created: "2024-01-01T00:00:00+00:00" description: This is a template for monitoring user activity. modified: "2024-01-01T00:00:00+00:00" monitor_definition: message: You may need to add web hosts if this is consistently high. name: Bytes received on host0 query: avg(last_5m):sum:system.net.bytes_rcvd{host:host0} > 100 type: query alert tags: - product:Our Custom App - integration:Azure title: Postgres CPU Monitor version: 1 id: "00000000-0000-1234-0000-000000000000" type: monitor-user-template schema: $ref: "#/components/schemas/MonitorUserTemplateResponse" description: OK "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitors_read summary: Get a monitor user template tags: - Monitors "x-permission": operator: OR permissions: - monitors_read x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: Creates a new version of an existing monitor user template. operationId: UpdateMonitorUserTemplate parameters: - description: ID of the monitor user template. in: path name: template_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: description: This is a template for monitoring user activity. monitor_definition: message: You may need to add web hosts if this is consistently high. name: Bytes received on host0 query: avg(last_5m):sum:system.net.bytes_rcvd{host:host0} > 100 type: query alert tags: - product:Our Custom App - integration:Azure template_variables: - available_values: - value1 - value2 defaults: - defaultValue name: regionName tag_key: datacenter title: Postgres CPU Monitor id: 00000000-0000-1234-0000-000000000000 type: monitor-user-template schema: $ref: "#/components/schemas/MonitorUserTemplateUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created: "2024-01-01T00:00:00+00:00" description: This is a template for monitoring user activity. modified: "2024-01-01T00:00:00+00:00" monitor_definition: message: You may need to add web hosts if this is consistently high. name: Bytes received on host0 query: avg(last_5m):sum:system.net.bytes_rcvd{host:host0} > 100 type: query alert tags: - product:Our Custom App - integration:Azure title: Postgres CPU Monitor version: 2 id: "00000000-0000-1234-0000-000000000000" type: monitor-user-template schema: $ref: "#/components/schemas/MonitorUserTemplateResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a monitor user template to a new version tags: - Monitors "x-permission": operator: OR permissions: - monitor_config_policy_write x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/monitor/template/{template_id}/validate: post: description: Validate the structure and content of an existing monitor user template being updated to a new version. operationId: ValidateExistingMonitorUserTemplate parameters: - description: ID of the monitor user template. in: path name: template_id required: true schema: example: "00000000-0000-1234-0000-000000000000" type: string requestBody: content: application/json: examples: default: value: data: attributes: description: This is a template for monitoring user activity. monitor_definition: message: You may need to add web hosts if this is consistently high. name: Bytes received on host0 query: avg(last_5m):sum:system.net.bytes_rcvd{host:host0} > 100 type: query alert tags: - product:Our Custom App - integration:Azure template_variables: - available_values: - value1 - value2 defaults: - defaultValue name: regionName tag_key: datacenter title: Postgres CPU Monitor id: 00000000-0000-1234-0000-000000000000 type: monitor-user-template schema: $ref: "#/components/schemas/MonitorUserTemplateUpdateRequest" required: true responses: "204": description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Validate an existing monitor user template tags: - Monitors "x-permission": operator: OR permissions: - monitor_config_policy_write x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/monitor/{monitor_id}/downtime_matches: get: description: Get all active downtimes for the specified monitor. operationId: ListMonitorDowntimes parameters: - description: The id of the monitor. in: path name: monitor_id required: true schema: format: int64 type: integer - $ref: "#/components/parameters/PageOffset" - description: Maximum number of downtimes in the response. example: 100 in: query name: page[limit] required: false schema: default: 30 format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: end: "2024-01-01T01:00:00+00:00" groups: - service:postgres scope: env:(staging OR prod) AND datacenter:us-east-1 start: "2024-01-01T00:00:00+00:00" id: "00000000-0000-1234-0000-000000000000" type: downtime_match meta: page: total_filtered_count: 1 schema: $ref: "#/components/schemas/MonitorDowntimeMatchResponse" description: OK "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Monitor Not Found error "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitors_downtime summary: Get active downtimes for a monitor tags: - Downtimes x-codegen-request-body-name: body x-pagination: limitParam: page[limit] pageOffsetParam: page[offset] resultsPath: data "x-permission": operator: OR permissions: - monitors_downtime /api/v2/ndm/devices: get: description: Get the list of devices. operationId: ListDevices parameters: - $ref: "#/components/parameters/NDMPageSize" - $ref: "#/components/parameters/NDMPageNumber" - description: The field to sort devices by. Defaults to `name`. Prefix the field with `-` to sort in descending order, for example, `-name`. example: status in: query name: sort required: false schema: default: name type: string - description: Filter devices by tag. example: status:ok in: query name: filter[tag] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: device_type: other integration: snmp ip_address: 1.2.3.4 name: example device status: ok id: foiwf7rgw38fh type: device meta: page: total_filtered_count: 1 schema: $ref: "#/components/schemas/ListDevicesResponse" description: OK "400": $ref: "#/components/responses/NDMBadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get the list of devices tags: - Network Device Monitoring x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data /api/v2/ndm/devices/{device_id}: get: description: Get the device details. operationId: GetDevice parameters: - description: The id of the device to fetch. example: example:1.2.3.4 in: path name: device_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: device_type: other integration: snmp ip_address: 1.2.3.4 model: xx-123 name: example device status: ok vendor: example vendor id: foiwf7rgw38fh type: device schema: $ref: "#/components/schemas/GetDeviceResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NDMNotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get the device details tags: - Network Device Monitoring /api/v2/ndm/interfaces: get: description: Get the list of interfaces of the device. operationId: GetInterfaces parameters: - description: The ID of the device to get interfaces from. example: example:1.2.3.4 in: query name: device_id required: true schema: type: string - description: Whether to get the IP addresses of the interfaces. example: true in: query name: get_ip_addresses required: false schema: type: boolean responses: "200": content: application/json: examples: default: value: data: - attributes: description: a network interface index: 99 mac_address: 00:00:00:00:00:00 name: if0 status: up id: foiwf7rgw38fh:99 type: interface schema: $ref: "#/components/schemas/GetInterfacesResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get the list of interfaces of the device tags: - Network Device Monitoring /api/v2/ndm/tags/devices/{device_id}: get: description: Get the list of tags for a device. operationId: ListDeviceUserTags parameters: - description: The id of the device to fetch tags for. example: example:1.2.3.4 in: path name: device_id required: true schema: type: string responses: "200": content: application/json: examples: by_source: value: data: attributes: by_source: - source: user tags: - "tag:test" - "tag:testbis" - source: snmp tags: - "device_ip:1.2.3.4" id: foiwf7rgw38fh type: tags default: value: data: attributes: tags: - "tag:test" - "tag:testbis" id: foiwf7rgw38fh type: tags schema: $ref: "#/components/schemas/ListTagsResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NDMNotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get the list of tags for a device tags: - Network Device Monitoring patch: description: |- Update the tags for a device. A device supports up to 20 user tags by default. To request a higher limit for your organization, [contact Support](https://docs.datadoghq.com/help/). operationId: UpdateDeviceUserTags parameters: - description: The id of the device to update tags for. example: example:1.2.3.4 in: path name: device_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: tags: - tag:test - tag:testbis id: example:1.2.3.4 type: tags schema: $ref: "#/components/schemas/ListTagsResponse" required: true responses: "200": content: application/json: examples: default: value: data: attributes: tags: - "tag:test" - "tag:testbis" id: foiwf7rgw38fh type: tags schema: $ref: "#/components/schemas/ListTagsResponse" description: OK "400": $ref: "#/components/responses/NDMBadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NDMNotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update the tags for a device tags: - Network Device Monitoring /api/v2/ndm/tags/interfaces/{interface_id}: get: description: Returns the tags associated with the specified interface. operationId: ListInterfaceUserTags parameters: - description: The ID of the interface for which to retrieve tags. example: example:1.2.3.4:1 in: path name: interface_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: tags: - "tag:test" - "tag:testbis" id: foiwf7rgw38fh:1 type: tags schema: $ref: "#/components/schemas/ListInterfaceTagsResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NDMNotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List tags for an interface tags: - Network Device Monitoring patch: description: Updates the tags associated with the specified interface. operationId: UpdateInterfaceUserTags parameters: - description: The ID of the interface for which to update tags. example: example:1.2.3.4:1 in: path name: interface_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: tags: - tag:test - tag:testbis id: example:1.2.3.4:1 type: tags schema: $ref: "#/components/schemas/ListInterfaceTagsResponse" required: true responses: "200": content: application/json: examples: default: value: data: attributes: tags: - "tag:test" - "tag:testbis" id: foiwf7rgw38fh:1 type: tags schema: $ref: "#/components/schemas/ListInterfaceTagsResponse" description: OK "400": $ref: "#/components/responses/NDMBadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NDMNotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update the tags for an interface tags: - Network Device Monitoring /api/v2/network/connections/aggregate: get: description: Get all aggregated connections. operationId: GetAggregatedConnections parameters: - description: Unix timestamp (number of seconds since epoch) of the start of the query window. If not provided, the start of the query window is 15 minutes before the `to` timestamp. If neither `from` nor `to` are provided, the query window is `[now - 15m, now]`. in: query name: from schema: format: int64 type: integer - description: Unix timestamp (number of seconds since epoch) of the end of the query window. If not provided, the end of the query window is the current time. If neither `from` nor `to` are provided, the query window is `[now - 15m, now]`. in: query name: to schema: format: int64 type: integer - description: Comma-separated list of fields to group connections by. The maximum number of group_by(s) is 10. in: query name: group_by schema: type: string - description: Comma-separated list of tags to filter connections by. in: query name: tags schema: type: string - description: Free-form search query using AND/OR/NOT operators, wildcards, and parentheses. When provided, takes precedence over the `tags` parameter. example: "(client_team:networks OR client_team:platform) AND server_service:hucklebuck" in: query name: query schema: type: string - description: The number of connections to be returned. The maximum value is 7500. The default is 100. in: query name: limit schema: default: 100 format: int32 maximum: 7500 minimum: 1 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: bytes_sent_by_client: 100 bytes_sent_by_server: 200 packets_sent_by_client: 10 packets_sent_by_server: 20 id: abc-123 type: aggregated_connection schema: $ref: "#/components/schemas/SingleAggregatedConnectionResponseArray" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - network_connections_read summary: Get all aggregated connections tags: - Cloud Network Monitoring "x-permission": operator: OR permissions: - network_connections_read /api/v2/network/dns/aggregate: get: description: Get all aggregated DNS traffic. operationId: GetAggregatedDns parameters: - description: Unix timestamp (number of seconds since epoch) of the start of the query window. If not provided, the start of the query window is 15 minutes before the `to` timestamp. If neither `from` nor `to` are provided, the query window is `[now - 15m, now]`. in: query name: from schema: format: int64 type: integer - description: Unix timestamp (number of seconds since epoch) of the end of the query window. If not provided, the end of the query window is the current time. If neither `from` nor `to` are provided, the query window is `[now - 15m, now]`. in: query name: to schema: format: int64 type: integer - description: Comma-separated list of fields to group DNS traffic by. The server side defaults to `network.dns_query` if unspecified. `server_ungrouped` may be used if groups are not desired. The maximum number of group_by(s) is 10. in: query name: group_by schema: type: string - description: Comma-separated list of tags to filter DNS traffic by. in: query name: tags schema: type: string - description: Free-form search query using AND/OR/NOT operators, wildcards, and parentheses. When provided, takes precedence over the `tags` parameter. example: "(client_team:networks OR client_team:platform) AND server_service:hucklebuck" in: query name: query schema: type: string - description: The number of aggregated DNS entries to be returned. The maximum value is 7500. The default is 100. in: query name: limit schema: default: 100 format: int32 maximum: 7500 minimum: 1 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: group_bys: - key: client_service value: test-service - key: network.dns_query value: example.com metrics: - key: dns_total_requests value: 100 id: abc-123 type: aggregated_dns schema: $ref: "#/components/schemas/SingleAggregatedDnsResponseArray" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - network_connections_read summary: Get all aggregated DNS traffic tags: - Cloud Network Monitoring "x-permission": operator: OR permissions: - network_connections_read /api/v2/oauth2/.well-known/openid-configuration: get: description: Retrieve OpenID Connect provider metadata for the OAuth2 v2 token endpoint. operationId: GetOIDCDiscoveryDocument responses: "200": content: application/json: examples: default: value: authorization_endpoint: https://app.datadoghq.com/oauth2/v1/authorize id_token_signing_alg_values_supported: - RS256 issuer: https://app.datadoghq.com/api/v2/oauth2 jwks_uri: https://app.datadoghq.com/oauth2/v1/keys response_types_supported: - code subject_types_supported: - public token_endpoint: https://app.datadoghq.com/api/v2/oauth2/token schema: $ref: "#/components/schemas/OIDCDiscoveryDocument" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: [] servers: - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: The regional site for Datadog customers. enum: - datadoghq.com - us3.datadoghq.com - us5.datadoghq.com - ap1.datadoghq.com - ap2.datadoghq.com - uk1.datadoghq.com - datadoghq.eu - ddog-gov.com - us2.ddog-gov.com x-enum-varnames: - US1 - US3 - US5 - AP1 - AP2 - UK1 - EU1 - GOV - US2_GOV subdomain: default: app description: The subdomain where the API is deployed. - url: "{protocol}://{name}" variables: name: default: app.datadoghq.com description: Full site DNS name. protocol: default: https description: The protocol for accessing the API. - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: Any Datadog deployment. subdomain: default: app description: The subdomain where the API is deployed. summary: Get OpenID Connect provider metadata tags: - OAuth2 Client Public x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/oauth2/.well-known/sites: get: description: Retrieve the list of public OAuth2 sites available for the current environment. This endpoint is used for OAuth2 discovery and returns sites where users can authenticate. operationId: GetOAuth2WellKnownSites responses: "200": content: application/json: examples: default: value: data: attributes: sites: - datadoghq.com - datadoghq.eu - us5.datadoghq.com - us3.datadoghq.com - ap1.datadoghq.com - ap2.datadoghq.com id: prod type: env schema: $ref: "#/components/schemas/OAuth2WellKnownSitesResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: [] summary: Get OAuth2 well-known sites tags: - OAuth2 Client Public x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/oauth2/clients/{client_uuid}/scopes_restriction: delete: description: Delete the scopes restriction configured for the OAuth2 client. operationId: DeleteScopesRestriction parameters: - $ref: "#/components/parameters/OAuthClientUUIDPathParameter" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an OAuth2 client scopes restriction tags: - OAuth2 Client Public x-permission: operator: OR permissions: - org_authorized_apps_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get the scopes restriction configured for the OAuth2 client. operationId: GetScopesRestriction parameters: - $ref: "#/components/parameters/OAuthClientUUIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: required_permission_scopes: scopes_restriction: oidc_scopes: - openid - email permission_scopes: - dashboards_read - metrics_read id: fafa8e1c-36a5-11f0-a83d-da7ad0900001 type: scopes_restriction schema: $ref: "#/components/schemas/OAuthScopesRestrictionResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get an OAuth2 client scopes restriction tags: - OAuth2 Client Public x-permission: operator: OR permissions: - org_authorized_apps_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create or update the scopes restriction configured for the OAuth2 client. operationId: UpsertScopesRestriction parameters: - $ref: "#/components/parameters/OAuthClientUUIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: oidc_scopes: - openid - email permission_scopes: - dashboards_read - metrics_read type: upsert_scopes_restriction schema: $ref: "#/components/schemas/UpsertOAuthScopesRestrictionRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: required_permission_scopes: scopes_restriction: oidc_scopes: - openid - email permission_scopes: - dashboards_read - metrics_read id: fafa8e1c-36a5-11f0-a83d-da7ad0900001 type: scopes_restriction schema: $ref: "#/components/schemas/OAuthScopesRestrictionResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Upsert an OAuth2 client scopes restriction tags: - OAuth2 Client Public x-codegen-request-body-name: body x-permission: operator: OR permissions: - org_authorized_apps_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/oauth2/register: post: description: Register an OAuth2 client using the Dynamic Client Registration protocol defined in RFC 7591. operationId: RegisterOAuthClient requestBody: content: application/json: examples: default: value: client_name: Example MCP Client grant_types: - authorization_code - refresh_token redirect_uris: - https://example.com/oauth/callback response_types: - code token_endpoint_auth_method: none schema: $ref: "#/components/schemas/OAuthClientRegistrationRequest" required: true responses: "201": content: application/json: examples: default: value: client_id: 72b68208-36a6-11f0-b21b-da7ad0900002 client_name: Example MCP Client grant_types: - authorization_code - refresh_token redirect_uris: - https://example.com/oauth/callback response_types: - code token_endpoint_auth_method: none schema: $ref: "#/components/schemas/OAuthClientRegistrationResponse" description: Created "400": content: application/json: examples: default: value: error: invalid_client_metadata error_description: redirect URI is not well-formed schema: $ref: "#/components/schemas/OAuthClientRegistrationError" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" security: [] summary: Register an OAuth2 client tags: - OAuth2 Client Public x-codegen-request-body-name: body x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/obs-pipelines/pipelines: get: description: Retrieve a list of pipelines. operationId: ListPipelines parameters: - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" responses: "200": content: application/json: examples: default: value: data: - attributes: config: destinations: - id: datadog-logs-destination inputs: - datadog-agent-source type: datadog_logs sources: - id: datadog-agent-source type: datadog_agent name: Main Observability Pipeline id: 00000000-0000-0000-0000-000000000001 type: pipelines schema: $ref: "#/components/schemas/ListPipelinesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List pipelines tags: - Observability Pipelines "x-permission": operator: OR permissions: - observability_pipelines_read post: description: Create a new pipeline. operationId: CreatePipeline requestBody: content: application/json: examples: default: value: data: attributes: config: destinations: - id: datadog-logs-destination inputs: - my-processor-group type: datadog_logs pipeline_type: logs processor_groups: - enabled: true id: my-processor-group include: service:my-service inputs: - datadog-agent-source processors: - enabled: true id: filter-processor include: status:error type: filter - enabled: true field: message id: json-processor include: "*" type: parse_json processors: [] sources: - id: datadog-agent-source type: datadog_agent name: Main Observability Pipeline type: pipelines schema: $ref: "#/components/schemas/ObservabilityPipelineSpec" required: true responses: "201": content: application/json: examples: default: value: data: attributes: config: destinations: - id: datadog-logs-destination inputs: - datadog-agent-source type: datadog_logs sources: - id: datadog-agent-source type: datadog_agent name: Main Observability Pipeline id: 00000000-0000-0000-0000-000000000002 type: pipelines schema: $ref: "#/components/schemas/ObservabilityPipeline" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a new pipeline tags: - Observability Pipelines "x-permission": operator: OR permissions: - observability_pipelines_deploy /api/v2/obs-pipelines/pipelines/validate: post: description: |- Validates a pipeline configuration without creating or updating any resources. Returns a list of validation errors, if any. operationId: ValidatePipeline requestBody: content: application/json: examples: default: value: data: attributes: config: destinations: - id: datadog-logs-destination inputs: - my-processor-group type: datadog_logs pipeline_type: logs processor_groups: - enabled: true id: my-processor-group include: service:my-service inputs: - datadog-agent-source processors: - enabled: true id: filter-processor include: status:error type: filter - enabled: true field: message id: json-processor include: "*" type: parse_json processors: [] sources: - id: datadog-agent-source type: datadog_agent name: Main Observability Pipeline type: pipelines schema: $ref: "#/components/schemas/ObservabilityPipelineSpec" required: true responses: "200": content: application/json: examples: default: value: errors: [] schema: $ref: "#/components/schemas/ValidationResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Validate an observability pipeline tags: - Observability Pipelines "x-permission": operator: OR permissions: - observability_pipelines_read /api/v2/obs-pipelines/pipelines/{pipeline_id}: delete: description: Delete a pipeline. operationId: DeletePipeline parameters: - description: The ID of the pipeline to delete. in: path name: pipeline_id required: true schema: type: string responses: "204": description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a pipeline tags: - Observability Pipelines "x-permission": operator: OR permissions: - observability_pipelines_delete get: description: Get a specific pipeline by its ID. operationId: GetPipeline parameters: - description: The ID of the pipeline to retrieve. in: path name: pipeline_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: config: destinations: - id: datadog-logs-destination inputs: - datadog-agent-source type: datadog_logs sources: - id: datadog-agent-source type: datadog_agent name: Main Observability Pipeline id: 00000000-0000-0000-0000-000000000003 type: pipelines schema: $ref: "#/components/schemas/ObservabilityPipeline" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a specific pipeline tags: - Observability Pipelines "x-permission": operator: OR permissions: - observability_pipelines_read put: description: Update a pipeline. operationId: UpdatePipeline parameters: - description: The ID of the pipeline to update. in: path name: pipeline_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: config: destinations: - id: datadog-logs-destination inputs: - my-processor-group type: datadog_logs pipeline_type: logs processor_groups: - enabled: true id: my-processor-group include: service:my-service inputs: - datadog-agent-source processors: - enabled: true id: filter-processor include: status:error type: filter - enabled: true field: message id: json-processor include: "*" type: parse_json processors: [] sources: - id: datadog-agent-source type: datadog_agent name: Main Observability Pipeline id: 3fa85f64-5717-4562-b3fc-2c963f66afa6 type: pipelines schema: $ref: "#/components/schemas/ObservabilityPipeline" required: true responses: "200": content: application/json: examples: default: value: data: attributes: config: destinations: - id: datadog-logs-destination inputs: - datadog-agent-source type: datadog_logs sources: - id: datadog-agent-source type: datadog_agent name: My Updated Pipeline id: 00000000-0000-0000-0000-000000000004 type: pipelines schema: $ref: "#/components/schemas/ObservabilityPipeline" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a pipeline tags: - Observability Pipelines "x-permission": operator: OR permissions: - observability_pipelines_deploy /api/v2/on-call/escalation-policies: get: description: Retrieve a paginated list of On-Call escalation policies, sorted by name. operationId: ListOnCallEscalationPolicies parameters: - description: Number of escalation policies to return per page. The maximum allowed value is 50. in: query name: page[size] required: false schema: default: 20 example: 20 format: int64 maximum: 50 type: integer - $ref: "#/components/parameters/PageNumber" - description: "Search query to filter escalation policies. Supports free-text search on the policy name (case-insensitive) and structured filters on `team.id` and `tags`. When set, `filter[team_id]`, `filter[user_id]`, and `filter[schedule_id]` are ignored. Can't be combined with `filter[tags]` or `filter[tags_any]`." in: query name: filter[query] required: false schema: type: string - description: Comma-separated list of team IDs. Returns escalation policies that belong to any of these teams or have a step targeting any of them. in: query name: filter[team_id] required: false schema: example: "00000000-da3a-0000-0000-000000000000" type: string - description: Comma-separated list of user IDs. Returns escalation policies with a step targeting any of these users. in: query name: filter[user_id] required: false schema: example: "00000000-aba1-0000-0000-000000000000" type: string - description: Comma-separated list of schedule IDs. Returns escalation policies with a step targeting any of these schedules. in: query name: filter[schedule_id] required: false schema: example: "00000000-aba2-0000-0000-000000000000" type: string - description: "Comma-separated list of `key:value` tags. Returns escalation policies that have all of these tags." in: query name: filter[tags] required: false schema: example: "env:prod" type: string - description: "Comma-separated list of `key:value` tags. Returns escalation policies that have at least one of these tags." in: query name: filter[tags_any] required: false schema: example: "env:prod,env:staging" type: string - description: "Comma-separated list of included relationships to be returned. Allowed values: `teams`, `steps`, `steps.targets`, `steps.targets.schedule`, `user.color`. `user.color` populates the `color` attribute of users included through `steps.targets`." in: query name: include required: false schema: type: string responses: "200": content: "application/json": examples: default: value: data: - attributes: name: Escalation Policy 1 resolve_page_on_policy_end: true retries: 2 tags: - env:prod id: 00000000-aba1-0000-0000-000000000000 relationships: steps: data: - id: 00000000-aba1-0000-0000-000000000000 type: steps teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: policies meta: page: first_number: 0 last_number: 0 next_number: number: 0 prev_number: size: 20 total: 1 type: number_size schema: $ref: "#/components/schemas/EscalationPolicies" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List On-Call escalation policies tags: - On-Call x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data "x-permission": operator: AND permissions: - on_call_read post: description: Create a new On-Call escalation policy operationId: CreateOnCallEscalationPolicy parameters: - description: "Comma-separated list of included relationships to be returned. Allowed values: `teams`, `steps`, `steps.targets`." in: query name: include schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: name: Escalation Policy 1 resolve_page_on_policy_end: true retries: 2 steps: - assignment: default escalate_after_seconds: 3600 targets: - id: 00000000-aba1-0000-0000-000000000000 type: users - config: schedule: position: previous id: 00000000-aba2-0000-0000-000000000000 type: schedules - id: 00000000-aba3-0000-0000-000000000000 type: teams - assignment: round-robin escalate_after_seconds: 3600 targets: - id: 00000000-aba1-0000-0000-000000000000 type: users - id: 00000000-abb1-0000-0000-000000000000 type: users relationships: teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: policies schema: $ref: "#/components/schemas/EscalationPolicyCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: name: Escalation Policy 1 resolve_page_on_policy_end: true retries: 2 id: 00000000-aba1-0000-0000-000000000000 relationships: steps: data: - id: 00000000-aba1-0000-0000-000000000000 type: steps teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: policies schema: $ref: "#/components/schemas/EscalationPolicy" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create On-Call escalation policy tags: - On-Call "x-permission": operator: AND permissions: - on_call_write /api/v2/on-call/escalation-policies/{policy_id}: delete: description: Delete an On-Call escalation policy operationId: DeleteOnCallEscalationPolicy parameters: - description: The ID of the escalation policy in: path name: policy_id required: true schema: example: a3000000-0000-0000-0000-000000000000 type: string responses: "204": description: No Content "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete On-Call escalation policy tags: - On-Call "x-permission": operator: AND permissions: - on_call_write get: description: Get an On-Call escalation policy operationId: GetOnCallEscalationPolicy parameters: - description: The ID of the escalation policy in: path name: policy_id required: true schema: example: a3000000-0000-0000-0000-000000000000 type: string - description: "Comma-separated list of included relationships to be returned. Allowed values: `teams`, `steps`, `steps.targets`." in: query name: include schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: name: Escalation Policy 1 resolve_page_on_policy_end: true retries: 2 id: 00000000-aba1-0000-0000-000000000000 relationships: steps: data: - id: 00000000-aba1-0000-0000-000000000000 type: steps teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: policies schema: $ref: "#/components/schemas/EscalationPolicy" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get On-Call escalation policy tags: - On-Call "x-permission": operator: AND permissions: - on_call_read put: description: Update an On-Call escalation policy operationId: UpdateOnCallEscalationPolicy parameters: - description: The ID of the escalation policy in: path name: policy_id required: true schema: example: a3000000-0000-0000-0000-000000000000 type: string - description: "Comma-separated list of included relationships to be returned. Allowed values: `teams`, `steps`, `steps.targets`." in: query name: include schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: name: Escalation Policy 1 resolve_page_on_policy_end: false retries: 2 steps: - assignment: default escalate_after_seconds: 3600 id: 00000000-aba1-0000-0000-000000000000 targets: - id: 00000000-aba1-0000-0000-000000000000 type: users - id: 00000000-aba2-0000-0000-000000000000 type: schedules id: a3000000-0000-0000-0000-000000000000 relationships: teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: policies schema: $ref: "#/components/schemas/EscalationPolicyUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: name: Escalation Policy 1 resolve_page_on_policy_end: true retries: 2 id: 00000000-aba1-0000-0000-000000000000 relationships: steps: data: - id: 00000000-aba1-0000-0000-000000000000 type: steps teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: policies schema: $ref: "#/components/schemas/EscalationPolicy" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update On-Call escalation policy tags: - On-Call "x-permission": operator: AND permissions: - on_call_write /api/v2/on-call/pages: get: description: Retrieve a paginated list of On-Call Pages, optionally filtered by a search query and sorted by a field. operationId: ListOnCallPages parameters: - description: Number of On-Call Pages to return per page of results. The maximum allowed value is 1000. in: query name: page[size] required: false schema: default: 100 example: 100 format: int64 maximum: 1000 type: integer - description: Page of results to return, starting at 0. `page[number]` multiplied by `page[size]` must be less than 50000. in: query name: page[number] required: false schema: default: 0 example: 0 format: int64 minimum: 0 type: integer - description: "Search query to filter Pages. Supports filters such as `status`, `urgency`, `team`, `service`, and `tags`, for example `status:triggered`." in: query name: filter[query] required: false schema: example: "status:triggered" type: string - description: Sort Pages by the given field. Only one field is allowed. in: query name: sort required: false schema: $ref: "#/components/schemas/OnCallPagesSort" responses: "200": content: "application/json": examples: default: value: data: - attributes: created_at: "2026-01-01T10:00:00Z" description: Page details. key: "25137717" status: triggered tags: - service:test title: "Service: Test is down" urgency: high id: 15e74b8b-f865-48d0-bcc5-453323ed2c8f relationships: author: data: id: 00000000-0000-0000-0000-000000000001 type: users closed_by: data: responders: data: - id: 00000000-0000-0000-0000-000000000001 type: users scheduled_action: data: target: data: id: 00000000-da3a-0000-0000-000000000000 type: teams type: pages included: - attributes: email: jane.doe@example.com name: Jane Doe status: active id: 00000000-0000-0000-0000-000000000001 type: users - attributes: avatar: "" description: "" handle: my-team name: My Team id: 00000000-da3a-0000-0000-000000000000 type: teams meta: page: first_number: 0 last_number: 0 next_number: number: 0 prev_number: size: 100 total: 1 type: number_size schema: $ref: "#/components/schemas/OnCallPagesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List On-Call Pages tags: - On-Call x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data "x-permission": operator: AND permissions: - on_call_read post: description: |- Trigger a new On-Call Page. operationId: CreateOnCallPage requestBody: content: application/json: examples: default: value: data: attributes: description: Page details. tags: - service:test target: identifier: my-team type: team_handle title: Page title urgency: low type: pages schema: $ref: "#/components/schemas/CreatePageRequest" required: true responses: "200": content: application/json: examples: default: value: data: id: 00000000-0000-0000-0000-000000000001 type: pages schema: $ref: "#/components/schemas/CreatePageResponse" description: OK. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] servers: - url: https://{site} variables: site: default: navy.oncall.datadoghq.com description: The globally available endpoint for On-Call. enum: - lava.oncall.datadoghq.com - saffron.oncall.datadoghq.com - navy.oncall.datadoghq.com - coral.oncall.datadoghq.com - teal.oncall.datadoghq.com - beige.oncall.datadoghq.eu - scarlet.oncall.datadoghq.com x-enum-varnames: - LAVA - SAFFRON - NAVY - CORAL - TEAL - BEIGE - SCARLET - url: "{protocol}://{name}" variables: name: default: navy.oncall.datadoghq.com description: The full DNS name of the On-Call paging endpoint. enum: - lava.oncall.datadoghq.com - saffron.oncall.datadoghq.com - navy.oncall.datadoghq.com - coral.oncall.datadoghq.com - teal.oncall.datadoghq.com - beige.oncall.datadoghq.eu - scarlet.oncall.datadoghq.com x-enum-varnames: - LAVA - SAFFRON - NAVY - CORAL - TEAL - BEIGE - SCARLET protocol: default: https description: The protocol for accessing the API. - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: The Datadog site where the On-Call paging endpoint is deployed. enum: - datadoghq.com - datadoghq.eu x-enum-varnames: - DATADOGHQ_COM - DATADOGHQ_EU subdomain: default: navy.oncall description: The On-Call paging subdomain. enum: - lava.oncall - saffron.oncall - navy.oncall - coral.oncall - teal.oncall - beige.oncall - scarlet.oncall x-enum-varnames: - LAVA - SAFFRON - NAVY - CORAL - TEAL - BEIGE - SCARLET summary: Create On-Call Page tags: - On-Call Paging /api/v2/on-call/pages/{page_id}: get: description: Get the details of an On-Call Page. operationId: GetOnCallPage parameters: - description: The ID of the Page, or its key. in: path name: page_id required: true schema: example: 15e74b8b-f865-48d0-bcc5-453323ed2c8f type: string responses: "200": content: "application/json": examples: default: value: data: attributes: created_at: "2026-01-01T10:00:00Z" description: Page details. key: "25137717" status: triggered tags: - service:test title: "Service: Test is down" urgency: high id: 15e74b8b-f865-48d0-bcc5-453323ed2c8f relationships: author: data: id: 00000000-0000-0000-0000-000000000001 type: users closed_by: data: links: data: - id: 00000000-0000-0000-0000-000000000003 type: links responders: data: - id: 00000000-0000-0000-0000-000000000001 type: users scheduled_action: data: target: data: id: 00000000-da3a-0000-0000-000000000000 type: teams type: pages included: - attributes: email: jane.doe@example.com name: Jane Doe status: active id: 00000000-0000-0000-0000-000000000001 type: users - attributes: avatar: "" description: "" handle: my-team name: My Team id: 00000000-da3a-0000-0000-000000000000 type: teams - attributes: child_entity_id: 15e74b8b-f865-48d0-bcc5-453323ed2c8f child_entity_type: page parent_entity_id: 00000000-0000-0000-0000-000000000002 parent_entity_type: case relationship: pages id: 00000000-0000-0000-0000-000000000003 type: links schema: $ref: "#/components/schemas/OnCallPageResponse" description: OK "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get On-Call Page tags: - On-Call "x-permission": operator: AND permissions: - on_call_read /api/v2/on-call/pages/{page_id}/acknowledge: post: description: |- Acknowledges an On-Call Page. operationId: AcknowledgeOnCallPage parameters: - description: The page ID. in: path name: page_id required: true schema: example: 15e74b8b-f865-48d0-bcc5-453323ed2c8f format: uuid type: string responses: "202": description: Accepted. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] servers: - url: https://{site} variables: site: default: navy.oncall.datadoghq.com description: The globally available endpoint for On-Call. enum: - lava.oncall.datadoghq.com - saffron.oncall.datadoghq.com - navy.oncall.datadoghq.com - coral.oncall.datadoghq.com - teal.oncall.datadoghq.com - beige.oncall.datadoghq.eu - scarlet.oncall.datadoghq.com x-enum-varnames: - LAVA - SAFFRON - NAVY - CORAL - TEAL - BEIGE - SCARLET - url: "{protocol}://{name}" variables: name: default: navy.oncall.datadoghq.com description: The full DNS name of the On-Call paging endpoint. enum: - lava.oncall.datadoghq.com - saffron.oncall.datadoghq.com - navy.oncall.datadoghq.com - coral.oncall.datadoghq.com - teal.oncall.datadoghq.com - beige.oncall.datadoghq.eu - scarlet.oncall.datadoghq.com x-enum-varnames: - LAVA - SAFFRON - NAVY - CORAL - TEAL - BEIGE - SCARLET protocol: default: https description: The protocol for accessing the API. - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: The Datadog site where the On-Call paging endpoint is deployed. enum: - datadoghq.com - datadoghq.eu x-enum-varnames: - DATADOGHQ_COM - DATADOGHQ_EU subdomain: default: navy.oncall description: The On-Call paging subdomain. enum: - lava.oncall - saffron.oncall - navy.oncall - coral.oncall - teal.oncall - beige.oncall - scarlet.oncall x-enum-varnames: - LAVA - SAFFRON - NAVY - CORAL - TEAL - BEIGE - SCARLET summary: Acknowledge On-Call Page tags: - On-Call Paging /api/v2/on-call/pages/{page_id}/escalate: post: description: |- Escalates an On-Call Page. operationId: EscalateOnCallPage parameters: - description: The page ID. in: path name: page_id required: true schema: example: 15e74b8b-f865-48d0-bcc5-453323ed2c8f format: uuid type: string responses: "202": description: Accepted. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] servers: - url: https://{site} variables: site: default: navy.oncall.datadoghq.com description: The globally available endpoint for On-Call. enum: - lava.oncall.datadoghq.com - saffron.oncall.datadoghq.com - navy.oncall.datadoghq.com - coral.oncall.datadoghq.com - teal.oncall.datadoghq.com - beige.oncall.datadoghq.eu - scarlet.oncall.datadoghq.com x-enum-varnames: - LAVA - SAFFRON - NAVY - CORAL - TEAL - BEIGE - SCARLET - url: "{protocol}://{name}" variables: name: default: navy.oncall.datadoghq.com description: The full DNS name of the On-Call paging endpoint. enum: - lava.oncall.datadoghq.com - saffron.oncall.datadoghq.com - navy.oncall.datadoghq.com - coral.oncall.datadoghq.com - teal.oncall.datadoghq.com - beige.oncall.datadoghq.eu - scarlet.oncall.datadoghq.com x-enum-varnames: - LAVA - SAFFRON - NAVY - CORAL - TEAL - BEIGE - SCARLET protocol: default: https description: The protocol for accessing the API. - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: The Datadog site where the On-Call paging endpoint is deployed. enum: - datadoghq.com - datadoghq.eu x-enum-varnames: - DATADOGHQ_COM - DATADOGHQ_EU subdomain: default: navy.oncall description: The On-Call paging subdomain. enum: - lava.oncall - saffron.oncall - navy.oncall - coral.oncall - teal.oncall - beige.oncall - scarlet.oncall x-enum-varnames: - LAVA - SAFFRON - NAVY - CORAL - TEAL - BEIGE - SCARLET summary: Escalate On-Call Page tags: - On-Call Paging /api/v2/on-call/pages/{page_id}/reroute: post: description: |- Reroutes an On-Call Page. operationId: RerouteOnCallPage parameters: - description: The page ID. in: path name: page_id required: true schema: example: 15e74b8b-f865-48d0-bcc5-453323ed2c8f format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: comment: Rerouting to the database team. target: identifier: my-team type: team_handle type: reroute schema: $ref: "#/components/schemas/RerouteOnCallPageRequest" required: true responses: "204": description: No Content. "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] servers: - url: https://{site} variables: site: default: navy.oncall.datadoghq.com description: The globally available endpoint for On-Call. enum: - lava.oncall.datadoghq.com - saffron.oncall.datadoghq.com - navy.oncall.datadoghq.com - coral.oncall.datadoghq.com - teal.oncall.datadoghq.com - beige.oncall.datadoghq.eu - scarlet.oncall.datadoghq.com x-enum-varnames: - LAVA - SAFFRON - NAVY - CORAL - TEAL - BEIGE - SCARLET - url: "{protocol}://{name}" variables: name: default: navy.oncall.datadoghq.com description: The full DNS name of the On-Call paging endpoint. enum: - lava.oncall.datadoghq.com - saffron.oncall.datadoghq.com - navy.oncall.datadoghq.com - coral.oncall.datadoghq.com - teal.oncall.datadoghq.com - beige.oncall.datadoghq.eu - scarlet.oncall.datadoghq.com x-enum-varnames: - LAVA - SAFFRON - NAVY - CORAL - TEAL - BEIGE - SCARLET protocol: default: https description: The protocol for accessing the API. - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: The Datadog site where the On-Call paging endpoint is deployed. enum: - datadoghq.com - datadoghq.eu x-enum-varnames: - DATADOGHQ_COM - DATADOGHQ_EU subdomain: default: navy.oncall description: The On-Call paging subdomain. enum: - lava.oncall - saffron.oncall - navy.oncall - coral.oncall - teal.oncall - beige.oncall - scarlet.oncall x-enum-varnames: - LAVA - SAFFRON - NAVY - CORAL - TEAL - BEIGE - SCARLET summary: Reroute On-Call Page tags: - On-Call Paging /api/v2/on-call/pages/{page_id}/resolve: post: description: |- Resolves an On-Call Page. operationId: ResolveOnCallPage parameters: - description: The page ID. in: path name: page_id required: true schema: example: 15e74b8b-f865-48d0-bcc5-453323ed2c8f format: uuid type: string responses: "202": description: Accepted. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] servers: - url: https://{site} variables: site: default: navy.oncall.datadoghq.com description: The globally available endpoint for On-Call. enum: - lava.oncall.datadoghq.com - saffron.oncall.datadoghq.com - navy.oncall.datadoghq.com - coral.oncall.datadoghq.com - teal.oncall.datadoghq.com - beige.oncall.datadoghq.eu - scarlet.oncall.datadoghq.com x-enum-varnames: - LAVA - SAFFRON - NAVY - CORAL - TEAL - BEIGE - SCARLET - url: "{protocol}://{name}" variables: name: default: navy.oncall.datadoghq.com description: The full DNS name of the On-Call paging endpoint. enum: - lava.oncall.datadoghq.com - saffron.oncall.datadoghq.com - navy.oncall.datadoghq.com - coral.oncall.datadoghq.com - teal.oncall.datadoghq.com - beige.oncall.datadoghq.eu - scarlet.oncall.datadoghq.com x-enum-varnames: - LAVA - SAFFRON - NAVY - CORAL - TEAL - BEIGE - SCARLET protocol: default: https description: The protocol for accessing the API. - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: The Datadog site where the On-Call paging endpoint is deployed. enum: - datadoghq.com - datadoghq.eu x-enum-varnames: - DATADOGHQ_COM - DATADOGHQ_EU subdomain: default: navy.oncall description: The On-Call paging subdomain. enum: - lava.oncall - saffron.oncall - navy.oncall - coral.oncall - teal.oncall - beige.oncall - scarlet.oncall x-enum-varnames: - LAVA - SAFFRON - NAVY - CORAL - TEAL - BEIGE - SCARLET summary: Resolve On-Call Page tags: - On-Call Paging /api/v2/on-call/schedules: get: description: Retrieve a list of On-Call schedules. operationId: ListOnCallSchedules parameters: - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - description: "Search query to filter schedules. Supports free-text search on schedule name (case-insensitive, `*` wildcards), and structured filters such as `team.id:` and `user.id:` (multiple values can be combined with `OR`, e.g. `user.id:( OR )`)." in: query name: "filter[query]" required: false schema: type: string - description: "Comma-separated list of included relationships to be returned. Allowed value: `teams`." in: query name: include required: false schema: type: string responses: "200": content: "application/json": examples: default: value: data: - attributes: max_responders: 1 name: Primary On-Call tags: [] time_zone: America/New_York id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d relationships: teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: schedules meta: page: first_number: 0 last_number: 0 next_number: number: 0 prev_number: size: 10 total: 1 type: number_size schema: $ref: "#/components/schemas/Schedules" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List On-Call schedules tags: - On-Call x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data "x-permission": operator: AND permissions: - on_call_read post: description: Create a new On-Call schedule operationId: CreateOnCallSchedule parameters: - description: "Comma-separated list of included relationships to be returned. Allowed values: `teams`, `layers`, `layers.members`, `layers.members.user`." in: query name: include schema: type: string requestBody: content: "application/json": examples: default: value: data: attributes: layers: - effective_date: "2025-02-03T05:00:00Z" end_date: "2025-12-31T00:00:00Z" interval: days: 1 members: - user: id: 00000000-aba1-0000-0000-000000000000 name: Layer 1 restrictions: - end_day: friday end_time: "17:00:00" start_day: monday start_time: 09:00:00 rotation_start: "2025-02-01T00:00:00Z" max_responders: 1 name: On-Call Schedule time_zone: America/New_York relationships: teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: schedules schema: $ref: "#/components/schemas/ScheduleCreateRequest" required: true responses: "201": content: "application/json": examples: default: value: data: attributes: max_responders: 1 name: On-Call Schedule time_zone: America/New_York id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d relationships: layers: data: - id: 00000000-0000-0000-0000-000000000001 type: layers teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: schedules schema: $ref: "#/components/schemas/Schedule" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create On-Call schedule tags: - On-Call "x-permission": operator: AND permissions: - on_call_write /api/v2/on-call/schedules/{schedule_id}: delete: description: Delete an On-Call schedule operationId: DeleteOnCallSchedule parameters: - description: The ID of the schedule in: path name: schedule_id required: true schema: example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string responses: "204": description: No Content "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete On-Call schedule tags: - On-Call "x-permission": operator: AND permissions: - on_call_write get: description: Get an On-Call schedule operationId: GetOnCallSchedule parameters: - description: "Comma-separated list of included relationships to be returned. Allowed values: `teams`, `layers`, `layers.members`, `layers.members.user`." in: query name: include schema: type: string - description: The ID of the schedule in: path name: schedule_id required: true schema: example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string responses: "200": content: "application/json": examples: default: value: data: attributes: max_responders: 1 name: On-Call Schedule time_zone: America/New_York id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d relationships: layers: data: - id: 00000000-0000-0000-0000-000000000001 type: layers teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: schedules schema: $ref: "#/components/schemas/Schedule" description: OK "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get On-Call schedule tags: - On-Call "x-permission": operator: AND permissions: - on_call_read put: description: Update a new On-Call schedule operationId: UpdateOnCallSchedule parameters: - description: "Comma-separated list of included relationships to be returned. Allowed values: `teams`, `layers`, `layers.members`, `layers.members.user`." in: query name: include schema: type: string - description: The ID of the schedule in: path name: schedule_id required: true schema: example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string requestBody: content: "application/json": examples: default: value: data: attributes: layers: - effective_date: "2025-02-03T05:00:00Z" end_date: "2025-12-31T00:00:00Z" interval: seconds: 3600 members: - user: id: 00000000-aba1-0000-0000-000000000000 name: Layer 1 restrictions: - end_day: friday end_time: "17:00:00" start_day: monday start_time: 09:00:00 rotation_start: "2025-02-01T00:00:00Z" max_responders: 1 name: On-Call Schedule Updated time_zone: America/New_York id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d relationships: teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: schedules schema: $ref: "#/components/schemas/ScheduleUpdateRequest" required: true responses: "200": content: "application/json": examples: default: value: data: attributes: max_responders: 1 name: On-Call Schedule time_zone: America/New_York id: 00000000-0000-0000-0000-000000000001 relationships: layers: data: - id: 00000000-0000-0000-0000-000000000002 type: layers teams: data: - id: 00000000-0000-0000-0000-000000000003 type: teams type: schedules schema: $ref: "#/components/schemas/Schedule" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update On-Call schedule tags: - On-Call "x-permission": operator: AND permissions: - on_call_write /api/v2/on-call/schedules/{schedule_id}/on-call: get: deprecated: true description: "Retrieves the user who is on-call for the specified schedule at a given time. This endpoint does not support schedules with multiple concurrent on-call responders at a position. Deprecated. Use `Get on-call responders for a schedule` instead." operationId: GetScheduleOnCallUser parameters: - description: "Specifies related resources to include in the response as a comma-separated list. Allowed value: `user`." in: query name: include schema: type: string - description: The ID of the schedule. in: path name: schedule_id required: true schema: example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string - description: Retrieves the on-call user at the given timestamp in RFC3339 format (for example, `2025-05-07T02:53:01Z` or `2025-05-07T02:53:01+00:00`). If you use a time zone offset with `+`, URL-encode the `+` as `%2B`. Defaults to the current time if omitted. in: query name: filter[at_ts] schema: example: "2025-05-07T02:53:01Z" type: string responses: "200": content: application/json: examples: default: value: data: attributes: end: "2024-01-01T03:53:01.000000000Z" start: "2024-01-01T02:53:01.000000000Z" id: 00000000-0000-0000-0000-000000000000 relationships: user: data: id: 00000000-aba1-0000-0000-000000000000 type: users type: shifts schema: $ref: "#/components/schemas/Shift" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get scheduled on-call user tags: - On-Call "x-permission": operator: AND permissions: - on_call_read x-sunset: "2027-02-01" /api/v2/on-call/schedules/{schedule_id}/overrides: get: description: Retrieve a list of overrides for the specified On-Call schedule within a given time range. operationId: ListScheduleOverrides parameters: - description: The ID of the schedule. in: path name: schedule_id required: true schema: example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string - description: "Start of the time range to retrieve overrides for, in RFC3339 format (for example, `2025-05-07T02:53:01Z` or `2025-05-07T02:53:01+00:00`). If you use a time zone offset with `+`, URL-encode the `+` as `%2B`." in: query name: filter[start] required: true schema: example: "2024-01-07T02:53:01Z" format: date-time type: string - description: "End of the time range to retrieve overrides for, in RFC3339 format (for example, `2025-05-07T02:53:01Z` or `2025-05-07T02:53:01+00:00`). If you use a time zone offset with `+`, URL-encode the `+` as `%2B`. The time range cannot exceed 45 days." in: query name: filter[end] required: true schema: example: "2024-01-14T02:53:01Z" format: date-time type: string - description: "Comma-separated list of related resources to include in the response. Allowed values: `user`, `overridden_user`, `user.color`." in: query name: include schema: type: string - description: Number of overrides to return per page. The maximum allowed value is 50. in: query name: "page[size]" schema: default: 10 example: 10 format: int64 maximum: 50 type: integer - $ref: "#/components/parameters/PageNumber" responses: "200": content: application/json: examples: default: value: data: - attributes: end: "2024-01-08T02:53:01.000000000Z" inactive: false start: "2024-01-07T02:53:01.000000000Z" id: 00000000-0000-0000-0000-000000000000 relationships: schedule: data: id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: schedules user: data: id: 00000000-aba1-0000-0000-000000000000 type: users type: overrides schema: $ref: "#/components/schemas/Overrides" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List On-Call schedule overrides tags: - On-Call x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data "x-permission": operator: AND permissions: - on_call_read post: description: Create one or more overrides for the specified On-Call schedule. operationId: CreateScheduleOverrides parameters: - description: The ID of the schedule. in: path name: schedule_id required: true schema: example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string - description: "Comma-separated list of included relationships to be returned. Allowed values: `user`, `overridden_user`, `user.color`." in: query name: include schema: type: string requestBody: content: application/json: examples: default: value: data: - attributes: end: "2024-01-08T02:53:01.000000000Z" start: "2024-01-07T02:53:01.000000000Z" relationships: user: data: id: 00000000-aba1-0000-0000-000000000000 type: users type: overrides schema: $ref: "#/components/schemas/CreateOverridesRequest" required: true responses: "201": content: application/json: examples: default: value: data: - attributes: end: "2024-01-08T02:53:01.000000000Z" inactive: false start: "2024-01-07T02:53:01.000000000Z" id: 00000000-0000-0000-0000-000000000000 relationships: schedule: data: id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: schedules user: data: id: 00000000-aba1-0000-0000-000000000000 type: users type: overrides schema: $ref: "#/components/schemas/OverrideCreateResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create On-Call schedule overrides tags: - On-Call "x-permission": operator: OR permissions: - on_call_respond - on_call_write /api/v2/on-call/schedules/{schedule_id}/overrides/{override_id}: delete: description: Delete an override from the specified On-Call schedule. operationId: DeleteScheduleOverride parameters: - description: The ID of the schedule. in: path name: schedule_id required: true schema: example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string - description: The ID of the override. in: path name: override_id required: true schema: example: 00000000-0000-0000-0000-000000000000 type: string responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete On-Call schedule override tags: - On-Call "x-permission": operator: OR permissions: - on_call_respond - on_call_write /api/v2/on-call/schedules/{schedule_id}/responders: get: description: "Retrieves the on-call responders for the specified schedule, grouped by position (previous, current, next), at a given time. Supports schedules with multiple concurrent on-call responders at a position, by returning a list of shifts per position." operationId: GetScheduleOnCallResponders parameters: - description: "Comma-separated list of included relationships to be returned. Allowed values: `schedule`, `responders`, `responders.shifts`, `responders.shifts.user`." in: query name: include schema: type: string - description: The ID of the schedule. in: path name: schedule_id required: true schema: example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string - description: "Comma-separated list of positions to retrieve. Allowed values: `previous`, `current`, `next`. Defaults to `current` if omitted." in: query name: filter[position] schema: example: previous,current,next type: string - description: "Retrieves the on-call responders at the given timestamp in RFC3339 format (for example, `2025-05-07T02:53:01Z` or `2025-05-07T02:53:01+00:00`). If you use a time zone offset with `+`, URL-encode the `+` as `%2B`. Defaults to the current time if omitted." in: query name: filter[at_ts] schema: example: "2025-05-07T02:53:01Z" type: string responses: "200": content: application/json: examples: default: value: data: attributes: scheduled_at: "2024-05-07T02:53:01.000000000Z" id: "3653d3c6-0c75-11ea-ad28-fb5701eabc7d-1715054400" relationships: responders: data: - id: "3653d3c6-0c75-11ea-ad28-fb5701eabc7d-1715054400-current" type: schedule_oncall_responder schedule: data: id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: schedules type: schedule_oncall_responders included: - attributes: position: current id: "3653d3c6-0c75-11ea-ad28-fb5701eabc7d-1715054400-current" relationships: shifts: data: - id: 00000000-0000-0000-0000-000000000000 type: shifts type: schedule_oncall_responder - attributes: end: "2024-05-08T02:53:01.000000000Z" start: "2024-05-07T02:53:01.000000000Z" id: 00000000-0000-0000-0000-000000000000 relationships: user: data: id: 00000000-aba1-0000-0000-000000000000 type: users type: shifts schema: $ref: "#/components/schemas/ScheduleOnCallResponders" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get on-call responders for a schedule tags: - On-Call "x-permission": operator: AND permissions: - on_call_read /api/v2/on-call/teams/{team_id}/on-call: get: description: Get a team's on-call users at a given time operationId: GetTeamOnCallUsers parameters: - description: "Comma-separated list of included relationships to be returned. Allowed values: `responders`, `escalations`, `escalations.responders`." in: query name: include schema: type: string - description: The team ID in: path name: team_id required: true schema: example: 27590dae-47be-4a7d-9abf-8f4e45124020 type: string responses: "200": content: application/json: examples: default: value: data: id: 00000000-0000-0000-0000-000000000001 relationships: escalations: data: - id: 00000000-aba1-0000-0000-000000000000 type: escalation_policy_steps responders: data: - id: 00000000-aba1-0000-0000-000000000000 type: users type: team_oncall_responders schema: $ref: "#/components/schemas/TeamOnCallResponders" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get team on-call users tags: - On-Call "x-permission": operator: AND permissions: - on_call_read /api/v2/on-call/teams/{team_id}/routing-rules: get: description: Get a team's On-Call routing rules operationId: GetOnCallTeamRoutingRules parameters: - description: The team ID in: path name: team_id required: true schema: example: 27590dae-47be-4a7d-9abf-8f4e45124020 type: string - description: "Comma-separated list of included relationships to be returned. Allowed values: `rules`, `rules.policy`." in: query name: include schema: type: string responses: "200": content: application/json: examples: default: value: data: id: 27590dae-47be-4a7d-9abf-8f4e45124020 type: team_routing_rules schema: $ref: "#/components/schemas/TeamRoutingRules" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get On-Call team routing rules tags: - On-Call "x-permission": operator: AND permissions: - on_call_read put: description: Set a team's On-Call routing rules operationId: SetOnCallTeamRoutingRules parameters: - description: The team ID in: path name: team_id required: true schema: example: 27590dae-47be-4a7d-9abf-8f4e45124020 type: string - description: "Comma-separated list of included relationships to be returned. Allowed values: `rules`, `rules.policy`." in: query name: include schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: rules: - actions: policy_id: "" query: tags.service:test time_restriction: restrictions: - end_day: monday end_time: "17:00:00" start_day: monday start_time: 09:00:00 - end_day: tuesday end_time: "17:00:00" start_day: tuesday start_time: 09:00:00 time_zone: "" urgency: high - actions: - channel: channel type: send_slack_message workspace: workspace policy_id: fad4eee1-13f5-40d8-886b-4e56d8d5d1c6 query: "" time_restriction: urgency: low id: 27590dae-47be-4a7d-9abf-8f4e45124020 type: team_routing_rules schema: $ref: "#/components/schemas/TeamRoutingRulesRequest" required: true responses: "200": content: application/json: examples: default: value: data: id: 00000000-0000-0000-0000-000000000001 type: team_routing_rules schema: $ref: "#/components/schemas/TeamRoutingRules" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Set On-Call team routing rules tags: - On-Call "x-permission": operator: AND permissions: - on_call_write /api/v2/on-call/users/{user_id}/notification-channels: get: description: List the notification channels for a user. The authenticated user must be the target user or have the `on_call_admin` permission operationId: ListUserNotificationChannels parameters: - description: The user ID in: path name: user_id required: true schema: example: 00000000-0000-0000-0000-000000000000 type: string responses: "200": content: "application/json": examples: default: value: data: - attributes: config: address: test@example.com formats: - html type: email id: 27590dae-47be-4a7d-9abf-8f4e45124020 type: notification_channels schema: $ref: "#/components/schemas/ListNotificationChannelsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List On-Call notification channels for a user tags: - On-Call "x-permission": operator: AND permissions: - on_call_read post: description: Create a new notification channel for a user. The authenticated user must be the target user or have the `on_call_admin` permission operationId: CreateUserNotificationChannel parameters: - description: The user ID in: path name: user_id required: true schema: example: 00000000-0000-0000-0000-000000000000 type: string requestBody: content: "application/json": examples: default: value: data: attributes: config: address: foo@bar.com formats: - html type: email type: notification_channels schema: $ref: "#/components/schemas/CreateUserNotificationChannelRequest" required: true responses: "201": content: "application/json": examples: default: value: data: attributes: config: address: test@example.com formats: - html type: email id: 27590dae-47be-4a7d-9abf-8f4e45124020 type: notification_channels schema: $ref: "#/components/schemas/NotificationChannel" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create an On-Call notification channel for a user tags: - On-Call "x-permission": operator: AND permissions: - on_call_respond /api/v2/on-call/users/{user_id}/notification-channels/{channel_id}: delete: description: Delete a notification channel for a user. The authenticated user must be the target user or have the `on_call_admin` permission operationId: DeleteUserNotificationChannel parameters: - description: The user ID in: path name: user_id required: true schema: example: 00000000-0000-0000-0000-000000000000 type: string - description: The channel ID in: path name: channel_id required: true schema: example: 00000000-0000-0000-0000-000000000000 type: string responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete an On-Call notification channel for a user tags: - On-Call "x-permission": operator: AND permissions: - on_call_respond get: description: Get a notification channel for a user. The authenticated user must be the target user or have the `on_call_admin` permission operationId: GetUserNotificationChannel parameters: - description: The user ID in: path name: user_id required: true schema: example: 00000000-0000-0000-0000-000000000000 type: string - description: The channel ID in: path name: channel_id required: true schema: example: 00000000-0000-0000-0000-000000000000 type: string responses: "200": content: "application/json": examples: default: value: data: attributes: config: address: test@example.com formats: - html type: email id: 27590dae-47be-4a7d-9abf-8f4e45124020 type: notification_channels schema: $ref: "#/components/schemas/NotificationChannel" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get an On-Call notification channel for a user tags: - On-Call "x-permission": operator: AND permissions: - on_call_read /api/v2/on-call/users/{user_id}/notification-rules: get: description: List the notification rules for a user. The authenticated user must be the target user or have the `on_call_admin` permission operationId: ListUserNotificationRules parameters: - description: "Comma-separated list of included relationships to be returned. Allowed values: `channel`." in: query name: include schema: type: string - description: The user ID in: path name: user_id required: true schema: example: 00000000-0000-0000-0000-000000000000 type: string responses: "200": content: "application/json": examples: default: value: data: - attributes: category: high_urgency channel_settings: method: sms type: phone delay_minutes: 1 id: 27590dae-47be-4a7d-9abf-8f4e45124020 type: notification_rules schema: $ref: "#/components/schemas/ListOnCallNotificationRulesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List On-Call notification rules for a user tags: - On-Call "x-permission": operator: AND permissions: - on_call_read post: description: Create a new notification rule for a user. The authenticated user must be the target user or have the `on_call_admin` permission operationId: CreateUserNotificationRule parameters: - description: The user ID in: path name: user_id required: true schema: example: 00000000-0000-0000-0000-000000000000 type: string requestBody: content: "application/json": examples: default: value: data: attributes: category: high_urgency channel_settings: method: sms type: phone delay_minutes: 1 relationships: channel: data: id: 1562fab3-a8c2-49e2-8f3a-28dcda2405e2 type: notification_channels type: notification_rules schema: $ref: "#/components/schemas/CreateOnCallNotificationRuleRequest" required: true responses: "201": content: "application/json": examples: default: value: data: attributes: category: high_urgency channel_settings: method: sms type: phone delay_minutes: 1 id: 00000000-0000-0000-0000-000000000001 relationships: channel: data: id: 00000000-0000-0000-0000-000000000002 type: notification_channels type: notification_rules schema: $ref: "#/components/schemas/OnCallNotificationRule" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create an On-Call notification rule for a user tags: - On-Call "x-permission": operator: AND permissions: - on_call_respond /api/v2/on-call/users/{user_id}/notification-rules/{rule_id}: delete: description: Delete a notification rule for a user. The authenticated user must be the target user or have the `on_call_admin` permission operationId: DeleteUserNotificationRule parameters: - description: The user ID in: path name: user_id required: true schema: example: 00000000-0000-0000-0000-000000000000 type: string - description: The rule ID in: path name: rule_id required: true schema: example: 00000000-0000-0000-0000-000000000000 type: string responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete an On-Call notification rule for a user tags: - On-Call "x-permission": operator: OR permissions: - on_call_respond get: description: Get a notification rule for a user. The authenticated user must be the target user or have the `on_call_admin` permission operationId: GetUserNotificationRule parameters: - description: The user ID in: path name: user_id required: true schema: example: 00000000-0000-0000-0000-000000000000 type: string - description: The rule ID in: path name: rule_id required: true schema: example: 00000000-0000-0000-0000-000000000000 type: string - description: "Comma-separated list of included relationships to be returned. Allowed values: `channel`." in: query name: include schema: type: string responses: "200": content: "application/json": examples: default: value: data: attributes: category: high_urgency channel_settings: method: sms type: phone delay_minutes: 1 id: 27590dae-47be-4a7d-9abf-8f4e45124020 relationships: channel: data: id: 1562fab3-a8c2-49e2-8f3a-28dcda2405e2 type: notification_channels type: notification_rules schema: $ref: "#/components/schemas/OnCallNotificationRule" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get an On-Call notification rule for a user tags: - On-Call "x-permission": operator: OR permissions: - on_call_read put: description: Update a notification rule for a user. The authenticated user must be the target user or have the `on_call_admin` permission operationId: UpdateUserNotificationRule parameters: - description: The user ID in: path name: user_id required: true schema: example: 00000000-0000-0000-0000-000000000000 type: string - description: The rule ID in: path name: rule_id required: true schema: example: 00000000-0000-0000-0000-000000000000 type: string - description: "Comma-separated list of included relationships to be returned. Allowed values: `channel`." in: query name: include schema: type: string requestBody: content: "application/json": examples: default: value: data: attributes: category: high_urgency channel_settings: method: sms type: phone delay_minutes: 1 id: 2462ace1-49e2-aab1-xc4f-29cc4ae1105n7 relationships: channel: data: id: 1562fab3-a8c2-49e2-8f3a-28dcda2405e2 type: notification_channels type: notification_rules schema: $ref: "#/components/schemas/UpdateOnCallNotificationRuleRequest" required: true responses: "200": content: "application/json": examples: default: value: data: attributes: category: high_urgency channel_settings: method: sms type: phone delay_minutes: 1 id: 27590dae-47be-4a7d-9abf-8f4e45124020 relationships: channel: data: id: 1562fab3-a8c2-49e2-8f3a-28dcda2405e2 type: notification_channels type: notification_rules schema: $ref: "#/components/schemas/OnCallNotificationRule" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update an On-Call notification rule for a user tags: - On-Call "x-permission": operator: OR permissions: - on_call_read /api/v2/org: get: description: Returns the current organization and its managed organizations in JSON:API format. operationId: ListOrgs parameters: - description: Filter managed organizations by name. example: "My Child Org" in: query name: "filter[name]" required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: id: "4dee724d-00cc-11ea-a77b-570c9d03c6c5" relationships: current_org: data: id: "4dee724d-00cc-11ea-a77b-570c9d03c6c5" type: "orgs" managed_orgs: data: - id: "a1b2c3d4-00cc-11ea-a77b-570c9d03c6c5" type: "orgs" type: "managed_orgs" included: - attributes: created_at: "2019-09-26T17:28:28Z" description: "Production organization." disabled: false modified_at: "2024-01-15T10:30:00Z" name: "My Organization" public_id: "abcdef12345" sharing: "none" url: "https://app.datadoghq.com/account/my-org" id: "4dee724d-00cc-11ea-a77b-570c9d03c6c5" type: "orgs" - attributes: created_at: "2020-05-10T12:00:00Z" description: "Child organization." disabled: false modified_at: "2024-06-20T08:15:00Z" name: "My Child Org" public_id: "ghijkl67890" sharing: "none" url: "https://app.datadoghq.com/account/my-child-org" id: "a1b2c3d4-00cc-11ea-a77b-570c9d03c6c5" type: "orgs" schema: $ref: "#/components/schemas/ManagedOrgsResponse" description: OK "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management - org_connections_write summary: List your managed organizations tags: - Organizations "x-permission": operator: OR permissions: - org_management - org_connections_write /api/v2/org/disable: post: description: |- Disable the Datadog organization associated with the authenticated user or API key. The request body uses JSON:API format. If `org_uuid` is supplied, it must match the authenticated org or the request is rejected. Successful calls disable the org and return the resulting state from the downstream service. Requires the `org_management` permission. **Limitations**: - **Organization age**: Only organizations created within the last 10 days can be disabled through this endpoint. This restriction is a safeguard against accidentally disabling long-running organizations. Attempting to disable an older organization returns a `403 Forbidden`. - **Feature flag**: The feature flag `org_disable_self_service_enabled` must be enabled for the target organization or one of its ancestor organizations. Contact [Datadog support](https://docs.datadoghq.com/help/) to enable this for your organization. Requests for organizations without this flag return a `403 Forbidden`. - **Already-disabled organizations**: If the target organization is already disabled, the request returns a `409 Conflict`. operationId: DisableCustomerOrg requestBody: content: application/json: examples: default: value: data: attributes: org_uuid: "abcdef01-2345-6789-abcd-ef0123456789" id: "1" type: "customer_org_disable" schema: $ref: "#/components/schemas/CustomerOrgDisableRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: status: "disabled" id: "abcdef01-2345-6789-abcd-ef0123456789" type: "org_disable" schema: $ref: "#/components/schemas/CustomerOrgDisableResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_management summary: Disable the authenticated customer organization tags: - Customer Org x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/org/saml_configurations: patch: description: |- Update the SAML preferences for the current organization. Use this endpoint to set the just-in-time (JIT) provisioning domains and the default role assigned to just-in-time provisioned users. operationId: UpdateOrgSamlConfigurations requestBody: content: application/json: examples: default: value: data: attributes: default_role_uuids: - 8dd1cf3c-0c75-11ea-ad28-fb5701eabc7d jit_domains: - example.com type: saml_preferences schema: $ref: "#/components/schemas/OrgSAMLPreferencesUpdateRequest" required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update organization SAML preferences tags: - Organizations x-codegen-request-body-name: body "x-permission": operator: OR permissions: - org_management x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/org_authorized_clients: get: description: Get a list of all OAuth2 clients authorized for the current organization. operationId: ListOrgAuthorizedClients parameters: - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - description: Field to sort results by. Options include `oauth2_client.name`. in: query name: sort required: false schema: default: oauth2_client.name example: oauth2_client.name type: string - description: Filter results by client name, app title, or app description. in: query name: filter required: false schema: type: string - description: Filter results by the OAuth2 client name. in: query name: filter[oauth2_client][name] required: false schema: type: string - description: Filter results by the org-level disabled status. in: query name: filter[disabled] required: false schema: type: string - description: |- Comma-separated list of related resources to include. Options: `oauth2_client`, `oauth2_client.app`, `user_authorized_clients.user`. in: query name: include required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: disabled: false last_exercised: "2024-01-15T10:30:00+00:00" user_count: 2 id: "00000000-0000-0000-0000-000000000001" relationships: oauth2_client: data: id: "00000000-0000-0000-0000-000000000010" type: oauth2_clients user_authorized_clients: data: - id: "00000000-0000-0000-0000-000000000020" type: user_authorized_clients links: related: "/api/v2/org_authorized_clients/00000000-0000-0000-0000-000000000001/user_authorized_clients" type: org_authorized_clients meta: page: total_count: 1 total_filtered_count: 1 schema: $ref: "#/components/schemas/OrgAuthorizedClientsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authentication error "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_authorized_apps_read summary: List org authorized clients tags: - Org Authorized Clients x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data x-permission: operator: OR permissions: - org_authorized_apps_read - manage_integrations /api/v2/org_authorized_clients/{org_authorized_client_id}: delete: description: Disable an OAuth2 client authorization for the current organization, revoking access for all users. operationId: DeleteOrgAuthorizedClient parameters: - $ref: "#/components/parameters/OrgAuthorizedClientId" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_authorized_apps_write summary: Delete an org authorized client tags: - Org Authorized Clients x-permission: operator: OR permissions: - org_authorized_apps_write get: description: Get a single OAuth2 client authorized for the current organization. operationId: GetOrgAuthorizedClient parameters: - $ref: "#/components/parameters/OrgAuthorizedClientId" - description: |- Comma-separated list of related resources to include. Options: `oauth2_client`, `oauth2_client.app`, `oauth2_client.scopes`, `user_authorized_clients.user`. in: query name: include required: false schema: type: string - description: Filter included user authorized clients by disabled status. in: query name: filter[user_authorized_clients][disabled] required: false schema: type: string - description: Filter included user authorized clients by user disabled status. in: query name: filter[user_authorized_clients][user][disabled] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: disabled: false last_exercised: "2024-01-15T10:30:00+00:00" user_count: 2 id: "00000000-0000-0000-0000-000000000001" relationships: oauth2_client: data: id: "00000000-0000-0000-0000-000000000010" type: oauth2_clients user_authorized_clients: data: - id: "00000000-0000-0000-0000-000000000020" type: user_authorized_clients links: related: "/api/v2/org_authorized_clients/00000000-0000-0000-0000-000000000001/user_authorized_clients" type: org_authorized_clients schema: $ref: "#/components/schemas/OrgAuthorizedClientResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_authorized_apps_read summary: Get an org authorized client tags: - Org Authorized Clients x-permission: operator: OR permissions: - org_authorized_apps_read patch: description: Enable or disable an OAuth2 client authorization for the current organization. operationId: UpdateOrgAuthorizedClient parameters: - $ref: "#/components/parameters/OrgAuthorizedClientId" requestBody: content: application/json: examples: default: value: data: attributes: disabled: true id: "00000000-0000-0000-0000-000000000001" type: org_authorized_clients schema: $ref: "#/components/schemas/OrgAuthorizedClientUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: disabled: true last_exercised: "2024-01-15T10:30:00+00:00" user_count: 2 id: "00000000-0000-0000-0000-000000000001" relationships: oauth2_client: data: id: "00000000-0000-0000-0000-000000000010" type: oauth2_clients user_authorized_clients: data: [] links: related: "/api/v2/org_authorized_clients/00000000-0000-0000-0000-000000000001/user_authorized_clients" type: org_authorized_clients schema: $ref: "#/components/schemas/OrgAuthorizedClientResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_authorized_apps_write summary: Update an org authorized client tags: - Org Authorized Clients x-codegen-request-body-name: body x-permission: operator: OR permissions: - org_authorized_apps_write /api/v2/org_authorized_clients/{org_authorized_client_id}/user/{user_id}: delete: description: Disable all authorizations for a specific user for the specified OAuth2 client in the current organization. operationId: DeleteOrgAuthorizedClientAllUserAuthorizations parameters: - $ref: "#/components/parameters/OrgAuthorizedClientId" - $ref: "#/components/parameters/UserIdForOrgClient" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_authorized_apps_write summary: Delete a user's authorizations for a client tags: - Org Authorized Clients x-permission: operator: OR permissions: - org_authorized_apps_write /api/v2/org_authorized_clients/{org_authorized_client_id}/user_authorized_clients: get: description: Get a list of user authorizations for the specified OAuth2 client in the current organization. operationId: ListOrgAuthorizedClientUserAuthorizations parameters: - $ref: "#/components/parameters/OrgAuthorizedClientId" - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - description: "Field to sort results by. Options: `user.name`, `user.email`, `oauth2_client.name`." in: query name: sort required: false schema: $ref: "#/components/schemas/OrgAuthorizedClientUserAuthorizationsSort" - description: Filter results by the user authorization disabled status. in: query name: filter[disabled] required: false schema: type: string - description: Filter results by user name. in: query name: filter[user][name] required: false schema: type: string - description: Filter results by user email. in: query name: filter[user][email] required: false schema: type: string - description: Filter results by whether the user is disabled. in: query name: filter[user][disabled] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-10T08:00:00+00:00" disabled: false last_exercised: "2024-01-15T10:30:00+00:00" modified_at: "2024-01-10T08:00:00+00:00" org_disabled: false id: "00000000-0000-0000-0000-000000000020" relationships: oauth2_client: data: id: "00000000-0000-0000-0000-000000000010" type: oauth2_clients scopes: data: - id: "example_scope" type: scopes user: data: id: "00000000-0000-9999-0000-000000000001" type: users type: user_authorized_clients meta: page: total_count: 1 total_filtered_count: 1 schema: $ref: "#/components/schemas/UserAuthorizedClientsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_authorized_apps_read summary: List user authorizations for a client tags: - Org Authorized Clients x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data x-permission: operator: OR permissions: - org_authorized_apps_read /api/v2/org_authorized_clients/{org_authorized_client_id}/user_authorized_clients/{user_authorized_client_id}: delete: description: Disable a specific user authorization for the specified OAuth2 client in the current organization. operationId: DeleteOrgAuthorizedClientUserAuthorization parameters: - $ref: "#/components/parameters/OrgAuthorizedClientId" - $ref: "#/components/parameters/UserAuthorizedClientIdForOrg" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_authorized_apps_write summary: Delete a user authorization for a client tags: - Org Authorized Clients x-permission: operator: OR permissions: - org_authorized_apps_write /api/v2/org_configs: get: description: Returns all Org Configs (name, description, and value). operationId: ListOrgConfigs responses: "200": content: application/json: examples: default: value: data: - attributes: description: Example org config description name: monitor_timezone value: UTC value_type: bool id: abcd1234 type: org_configs schema: $ref: "#/components/schemas/OrgConfigListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Org Configs tags: [Organizations] "x-permission": operator: OPEN permissions: [] /api/v2/org_configs/{org_config_name}: get: description: Return the name, description, and value of a specific Org Config. operationId: GetOrgConfig parameters: - $ref: "#/components/parameters/OrgConfigName" responses: "200": content: application/json: examples: default: value: data: attributes: description: Example org config description name: monitor_timezone value: UTC value_type: bool id: abcd1234 type: org_configs schema: $ref: "#/components/schemas/OrgConfigGetResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a specific Org Config value tags: [Organizations] "x-permission": operator: OPEN permissions: [] patch: description: Update the value of a specific Org Config. operationId: UpdateOrgConfig parameters: - $ref: "#/components/parameters/OrgConfigName" requestBody: content: application/json: examples: default: value: data: attributes: value: UTC type: org_configs schema: $ref: "#/components/schemas/OrgConfigWriteRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: description: Example org config description name: monitor_timezone value: UTC value_type: bool id: abcd1234 type: org_configs schema: $ref: "#/components/schemas/OrgConfigGetResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a specific Org Config tags: [Organizations] "x-permission": operator: OR permissions: - org_management /api/v2/org_connections: get: description: Returns a list of org connections. operationId: ListOrgConnections parameters: - description: The Org ID of the sink org. example: "0879ce27-29a1-481f-a12e-bc2a48ec9ae1" in: query name: sink_org_id required: false schema: type: string - description: The Org ID of the source org. example: "0879ce27-29a1-481f-a12e-bc2a48ec9ae1" in: query name: source_org_id required: false schema: type: string - description: The limit of number of entries you want to return. Default is 1000. example: 1000 in: query name: limit required: false schema: format: int64 type: integer - description: The pagination offset which you want to query from. Default is 0. example: 0 in: query name: offset required: false schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: connection_types: - logs created_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000001 relationships: {} type: org_connection schema: $ref: "#/components/schemas/OrgConnectionListResponse" description: OK "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_connections_read summary: List Org Connections tags: ["Org Connections"] "x-permission": operator: OR permissions: - org_connections_read post: description: Create a new org connection between the current org and a target org. operationId: CreateOrgConnections requestBody: content: application/json: examples: default: value: data: attributes: connection_types: - logs relationships: sink_org: data: id: f9ec96b0-8c8a-4b0a-9b0a-1b2c3d4e5f6a name: Example Org type: orgs type: org_connection schema: $ref: "#/components/schemas/OrgConnectionCreateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: connection_types: - logs created_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000002 relationships: {} type: org_connection schema: $ref: "#/components/schemas/OrgConnectionResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_connections_write summary: Create Org Connection tags: ["Org Connections"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - org_connections_write /api/v2/org_connections/{connection_id}: delete: description: Delete an existing org connection. operationId: DeleteOrgConnections parameters: - $ref: "#/components/parameters/OrgConnectionId" responses: "200": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_connections_write summary: Delete Org Connection tags: ["Org Connections"] "x-permission": operator: OR permissions: - org_connections_write patch: description: Update an existing org connection. operationId: UpdateOrgConnections parameters: - $ref: "#/components/parameters/OrgConnectionId" requestBody: content: application/json: examples: default: value: data: attributes: connection_types: - logs - metrics id: f9ec96b0-8c8a-4b0a-9b0a-1b2c3d4e5f6a type: org_connection schema: $ref: "#/components/schemas/OrgConnectionUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: connection_types: - logs - metrics created_at: "2024-01-01T00:00:00+00:00" id: f9ec96b0-8c8a-4b0a-9b0a-1b2c3d4e5f6a type: org_connection schema: $ref: "#/components/schemas/OrgConnectionResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - org_connections_write summary: Update Org Connection tags: ["Org Connections"] "x-permission": operator: OR permissions: - org_connections_write /api/v2/org_group_memberships: get: description: >- List organization group memberships. Filter by org group ID or org UUID. At least one of `filter[org_group_id]` or `filter[org_uuid]` must be provided. When filtering by org UUID, returns a single-item list with the membership for that org. operationId: ListOrgGroupMemberships parameters: - $ref: "#/components/parameters/OrgGroupMembershipFilterOrgGroupId" - $ref: "#/components/parameters/OrgGroupMembershipFilterOrgUuid" - $ref: "#/components/parameters/OrgGroupPageNumber" - $ref: "#/components/parameters/OrgGroupPageSize" - $ref: "#/components/parameters/MembershipSort" responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-15T10:30:00Z" modified_at: "2024-01-15T10:30:00Z" org_name: "Acme Corp" org_site: "us1" org_uuid: "c3d4e5f6-a7b8-9012-cdef-012345678901" id: "f1e2d3c4-b5a6-7890-1234-567890abcdef" relationships: org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups type: org_group_memberships links: first: "https://api.datadoghq.com/api/v2/org_group_memberships?filter%5Borg_group_id%5D=a1b2c3d4-e5f6-7890-abcd-ef0123456789&page%5Bnumber%5D=0&page%5Bsize%5D=50" last: "https://api.datadoghq.com/api/v2/org_group_memberships?filter%5Borg_group_id%5D=a1b2c3d4-e5f6-7890-abcd-ef0123456789&page%5Bnumber%5D=0&page%5Bsize%5D=50" next: prev: self: "https://api.datadoghq.com/api/v2/org_group_memberships?filter%5Borg_group_id%5D=a1b2c3d4-e5f6-7890-abcd-ef0123456789&page%5Bnumber%5D=0&page%5Bsize%5D=50" meta: page: first_number: 0 last_number: 0 next_number: number: 0 prev_number: size: 50 total: 1 type: number_size schema: $ref: "#/components/schemas/OrgGroupMembershipListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List org group memberships tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: >- Add a batch of organizations to an existing organization group. This operation is not supported for organization groups with `group_type` set to `config_management`. This is an atomic operation: either all organizations are added or none are. Each request must include between 1 and 100 organizations. Each organization must be identified by a unique `org_uuid` and `org_site` pair, and must be in the same site as the requesting organization. The requesting organization must own the organization group. operationId: CreateOrgGroupMemberships requestBody: content: application/json: examples: default: value: data: attributes: orgs: - org_site: "us1" org_uuid: "c3d4e5f6-a7b8-9012-cdef-012345678901" relationships: org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups type: org_group_memberships schema: $ref: "#/components/schemas/OrgGroupMembershipCreateRequest" required: true responses: "201": description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create org group memberships tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/org_group_memberships/bulk: patch: description: >- Move a batch of organizations from one organization group to another. This is an atomic operation. Each request must include between 1 and 100 organizations. Each organization must be identified by a unique `org_uuid` and `org_site` pair, and must be in the same site as the requesting organization. operationId: BulkUpdateOrgGroupMemberships requestBody: content: application/json: examples: default: value: data: attributes: orgs: - org_site: "us1" org_uuid: "c3d4e5f6-a7b8-9012-cdef-012345678901" relationships: source_org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups target_org_group: data: id: "d4e5f6a7-b890-1234-cdef-567890abcdef" type: org_groups type: org_group_membership_bulk_updates schema: $ref: "#/components/schemas/OrgGroupMembershipBulkUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-15T10:30:00Z" modified_at: "2024-01-16T14:00:00Z" org_name: "Acme Corp" org_site: "us1" org_uuid: "c3d4e5f6-a7b8-9012-cdef-012345678901" id: "f1e2d3c4-b5a6-7890-1234-567890abcdef" relationships: org_group: data: id: "d4e5f6a7-b890-1234-cdef-567890abcdef" type: org_groups type: org_group_memberships schema: $ref: "#/components/schemas/OrgGroupMembershipListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Bulk update org group memberships tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/org_group_memberships/bulk_delete: post: description: >- Delete a batch of memberships from an organization group. This operation is not supported for organization groups with `group_type` set to `config_management`. The memberships to delete are provided as membership resource identifiers, and the organization group they belong to must be specified using `filter[org_group_id]`. Each request must include between 1 and 100 unique membership IDs, and the requesting organization must own the organization group. The request does not fail if a membership ID refers to a membership that has already been deleted, does not exist, or does not belong to the organization group. operationId: DeleteOrgGroupMemberships parameters: - $ref: "#/components/parameters/OrgGroupMembershipDeleteFilterOrgGroupId" requestBody: content: application/json: examples: default: value: data: - id: "f1e2d3c4-b5a6-7890-1234-567890abcdef" type: org_group_memberships - id: "e2d3c4b5-a6f7-8901-2345-67890abcdef1" type: org_group_memberships - id: "d3c4b5a6-f7e8-9012-3456-7890abcdef12" type: org_group_memberships schema: $ref: "#/components/schemas/OrgGroupMembershipBulkDeleteRequest" required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Bulk delete org group memberships tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/org_group_memberships/{org_group_membership_id}: delete: description: >- Remove an organization from an organization group by deleting its membership. This operation is not supported for organization groups with `group_type` set to `config_management`. The organization group that the membership belongs to must be specified using `filter[org_group_id]`, and the requesting organization must own that organization group. Returns `404` if the membership does not exist, was already removed, or does not belong to the organization group. operationId: DeleteOrgGroupMembership parameters: - $ref: "#/components/parameters/OrgGroupMembershipId" - $ref: "#/components/parameters/OrgGroupMembershipDeleteFilterOrgGroupId" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an org group membership tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a specific organization group membership by its ID. operationId: GetOrgGroupMembership parameters: - $ref: "#/components/parameters/OrgGroupMembershipId" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00Z" modified_at: "2024-01-15T10:30:00Z" org_name: "Acme Corp" org_site: "us1" org_uuid: "c3d4e5f6-a7b8-9012-cdef-012345678901" id: "f1e2d3c4-b5a6-7890-1234-567890abcdef" relationships: org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups type: org_group_memberships schema: $ref: "#/components/schemas/OrgGroupMembershipResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get an org group membership tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Move an organization to a different org group by updating its membership. operationId: UpdateOrgGroupMembership parameters: - $ref: "#/components/parameters/OrgGroupMembershipId" requestBody: content: application/json: examples: default: value: data: id: "f1e2d3c4-b5a6-7890-1234-567890abcdef" relationships: org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups type: org_group_memberships schema: $ref: "#/components/schemas/OrgGroupMembershipUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00Z" modified_at: "2024-01-16T14:00:00Z" org_name: "Acme Corp" org_site: "us1" org_uuid: "c3d4e5f6-a7b8-9012-cdef-012345678901" id: "f1e2d3c4-b5a6-7890-1234-567890abcdef" relationships: org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups type: org_group_memberships schema: $ref: "#/components/schemas/OrgGroupMembershipResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update an org group membership tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/org_group_policies: get: description: List policies for an organization group. Requires a filter on org group ID. operationId: ListOrgGroupPolicies parameters: - $ref: "#/components/parameters/OrgGroupPolicyFilterOrgGroupId" - $ref: "#/components/parameters/OrgGroupPolicyFilterPolicyName" - $ref: "#/components/parameters/OrgGroupPolicyFilterPolicyType" - $ref: "#/components/parameters/OrgGroupPageNumber" - $ref: "#/components/parameters/OrgGroupPageSize" - $ref: "#/components/parameters/PolicySort" responses: "200": content: application/json: examples: default: value: data: - attributes: content: value: "UTC" enforcement_tier: "OVERRIDE_ALLOWED" modified_at: "2024-01-15T10:30:00Z" policy_name: "monitor_timezone" policy_type: "org_config" id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" relationships: org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups type: org_group_policies links: first: "https://api.datadoghq.com/api/v2/org_group_policies?filter%5Borg_group_id%5D=a1b2c3d4-e5f6-7890-abcd-ef0123456789&page%5Bnumber%5D=0&page%5Bsize%5D=50" last: "https://api.datadoghq.com/api/v2/org_group_policies?filter%5Borg_group_id%5D=a1b2c3d4-e5f6-7890-abcd-ef0123456789&page%5Bnumber%5D=0&page%5Bsize%5D=50" next: prev: self: "https://api.datadoghq.com/api/v2/org_group_policies?filter%5Borg_group_id%5D=a1b2c3d4-e5f6-7890-abcd-ef0123456789&page%5Bnumber%5D=0&page%5Bsize%5D=50" meta: page: first_number: 0 last_number: 0 next_number: number: 0 prev_number: size: 50 total: 1 type: number_size schema: $ref: "#/components/schemas/OrgGroupPolicyListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List org group policies tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a new policy for an organization group. operationId: CreateOrgGroupPolicy requestBody: content: application/json: examples: org_config: value: data: attributes: content: value: "UTC" enforcement_tier: "OVERRIDE_ALLOWED" policy_name: "monitor_timezone" policy_type: "org_config" relationships: org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups type: org_group_policies role: value: data: attributes: content: permissions: - "1a2b3c4d-5e6f-7890-abcd-ef0123456789" enforcement_tier: "GROUP_MANAGED" policy_name: "finance_read_only" policy_type: "role" relationships: org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups type: org_group_policies schema: $ref: "#/components/schemas/OrgGroupPolicyCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: content: value: "UTC" enforcement_tier: "OVERRIDE_ALLOWED" modified_at: "2024-01-15T10:30:00Z" policy_name: "monitor_timezone" policy_type: "org_config" id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" relationships: org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups type: org_group_policies role: value: data: attributes: content: permissions: - "1a2b3c4d-5e6f-7890-abcd-ef0123456789" enforcement_tier: "GROUP_MANAGED" modified_at: "2024-01-15T10:30:00Z" policy_name: "finance_read_only" policy_type: "role" id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" relationships: org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups type: org_group_policies schema: $ref: "#/components/schemas/OrgGroupPolicyResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create an org group policy tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/org_group_policies/{org_group_policy_id}: delete: description: Delete an organization group policy by its ID. operationId: DeleteOrgGroupPolicy parameters: - $ref: "#/components/parameters/OrgGroupPolicyId" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an org group policy tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a specific organization group policy by its ID. operationId: GetOrgGroupPolicy parameters: - $ref: "#/components/parameters/OrgGroupPolicyId" responses: "200": content: application/json: examples: default: value: data: attributes: content: value: "UTC" enforcement_tier: "OVERRIDE_ALLOWED" modified_at: "2024-01-15T10:30:00Z" policy_name: "monitor_timezone" policy_type: "org_config" id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" relationships: org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups type: org_group_policies schema: $ref: "#/components/schemas/OrgGroupPolicyResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get an org group policy tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update an existing organization group policy. operationId: UpdateOrgGroupPolicy parameters: - $ref: "#/components/parameters/OrgGroupPolicyId" requestBody: content: application/json: examples: org_config: value: data: attributes: content: value: "US/Eastern" enforcement_tier: "GROUP_MANAGED" policy_name: "monitor_timezone" id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" type: org_group_policies role: value: data: attributes: content: permissions: - "1a2b3c4d-5e6f-7890-abcd-ef0123456789" - "2b3c4d5e-6f78-90ab-cdef-0123456789ab" enforcement_tier: "GROUP_MANAGED" id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" type: org_group_policies schema: $ref: "#/components/schemas/OrgGroupPolicyUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: content: value: "US/Eastern" enforcement_tier: "GROUP_MANAGED" modified_at: "2024-01-16T14:00:00Z" policy_name: "monitor_timezone" policy_type: "org_config" id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" relationships: org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups type: org_group_policies role: value: data: attributes: content: permissions: - "1a2b3c4d-5e6f-7890-abcd-ef0123456789" - "2b3c4d5e-6f78-90ab-cdef-0123456789ab" enforcement_tier: "GROUP_MANAGED" modified_at: "2024-01-16T14:00:00Z" policy_name: "finance_read_only" policy_type: "role" id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" relationships: org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups type: org_group_policies schema: $ref: "#/components/schemas/OrgGroupPolicyResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update an org group policy tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/org_group_policy_configs: get: description: List all org configs that are eligible to be used as organization group policies. operationId: ListOrgGroupPolicyConfigs responses: "200": content: application/json: examples: default: value: data: - attributes: allowed_values: ["UTC", "US/Eastern", "US/Pacific"] default_value: "UTC" description: "The default timezone for monitors." name: "monitor_timezone" value_type: "string" id: "monitor_timezone" type: org_group_policy_configs schema: $ref: "#/components/schemas/OrgGroupPolicyConfigListResponse" description: OK "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List org group policy configs tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/org_group_policy_overrides: get: description: >- List policy overrides for an organization group. Requires a filter on org group ID. Optionally filter by policy ID. operationId: ListOrgGroupPolicyOverrides parameters: - $ref: "#/components/parameters/OrgGroupPolicyOverrideFilterOrgGroupId" - $ref: "#/components/parameters/OrgGroupPolicyOverrideFilterPolicyId" - $ref: "#/components/parameters/OrgGroupPageNumber" - $ref: "#/components/parameters/OrgGroupPageSize" - $ref: "#/components/parameters/OverrideSort" responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-15T10:30:00Z" modified_at: "2024-01-15T10:30:00Z" org_site: "us1" org_uuid: "c3d4e5f6-a7b8-9012-cdef-012345678901" id: "9f8e7d6c-5b4a-3210-fedc-ba0987654321" relationships: org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups org_group_policy: data: id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" type: org_group_policies type: org_group_policy_overrides links: first: "https://api.datadoghq.com/api/v2/org_group_policy_overrides?filter%5Borg_group_id%5D=a1b2c3d4-e5f6-7890-abcd-ef0123456789&page%5Bnumber%5D=0&page%5Bsize%5D=50" last: "https://api.datadoghq.com/api/v2/org_group_policy_overrides?filter%5Borg_group_id%5D=a1b2c3d4-e5f6-7890-abcd-ef0123456789&page%5Bnumber%5D=0&page%5Bsize%5D=50" next: prev: self: "https://api.datadoghq.com/api/v2/org_group_policy_overrides?filter%5Borg_group_id%5D=a1b2c3d4-e5f6-7890-abcd-ef0123456789&page%5Bnumber%5D=0&page%5Bsize%5D=50" meta: page: first_number: 0 last_number: 0 next_number: number: 0 prev_number: size: 50 total: 1 type: number_size schema: $ref: "#/components/schemas/OrgGroupPolicyOverrideListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List org group policy overrides tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a new policy override for an organization within an org group. operationId: CreateOrgGroupPolicyOverride requestBody: content: application/json: examples: default: value: data: attributes: org_site: "us1" org_uuid: "c3d4e5f6-a7b8-9012-cdef-012345678901" relationships: org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups org_group_policy: data: id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" type: org_group_policies type: org_group_policy_overrides schema: $ref: "#/components/schemas/OrgGroupPolicyOverrideCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00Z" modified_at: "2024-01-15T10:30:00Z" org_site: "us1" org_uuid: "c3d4e5f6-a7b8-9012-cdef-012345678901" id: "9f8e7d6c-5b4a-3210-fedc-ba0987654321" relationships: org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups org_group_policy: data: id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" type: org_group_policies type: org_group_policy_overrides schema: $ref: "#/components/schemas/OrgGroupPolicyOverrideResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create an org group policy override tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/org_group_policy_overrides/{org_group_policy_override_id}: delete: description: Delete an organization group policy override by its ID. operationId: DeleteOrgGroupPolicyOverride parameters: - $ref: "#/components/parameters/OrgGroupPolicyOverrideId" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an org group policy override tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a specific organization group policy override by its ID. operationId: GetOrgGroupPolicyOverride parameters: - $ref: "#/components/parameters/OrgGroupPolicyOverrideId" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00Z" modified_at: "2024-01-15T10:30:00Z" org_site: "us1" org_uuid: "c3d4e5f6-a7b8-9012-cdef-012345678901" id: "9f8e7d6c-5b4a-3210-fedc-ba0987654321" relationships: org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups org_group_policy: data: id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" type: org_group_policies type: org_group_policy_overrides schema: $ref: "#/components/schemas/OrgGroupPolicyOverrideResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get an org group policy override tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update an existing organization group policy override. operationId: UpdateOrgGroupPolicyOverride parameters: - $ref: "#/components/parameters/OrgGroupPolicyOverrideId" requestBody: content: application/json: examples: default: value: data: attributes: org_site: "us1" org_uuid: "c3d4e5f6-a7b8-9012-cdef-012345678901" id: "9f8e7d6c-5b4a-3210-fedc-ba0987654321" type: org_group_policy_overrides schema: $ref: "#/components/schemas/OrgGroupPolicyOverrideUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00Z" modified_at: "2024-01-16T14:00:00Z" org_site: "us1" org_uuid: "c3d4e5f6-a7b8-9012-cdef-012345678901" id: "9f8e7d6c-5b4a-3210-fedc-ba0987654321" relationships: org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups org_group_policy: data: id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" type: org_group_policies type: org_group_policy_overrides schema: $ref: "#/components/schemas/OrgGroupPolicyOverrideResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update an org group policy override tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/org_group_policy_suggestions: get: description: List suggested organization group policies. Requires a filter on org group ID. operationId: ListOrgGroupPolicySuggestions parameters: - $ref: "#/components/parameters/OrgGroupPolicyFilterOrgGroupId" responses: "200": content: application/json: examples: default: value: data: - attributes: consensus_ratio: 0.75 policy_name: "monitor_timezone" recommended_value: "UTC" status: "pending" id: "1a2b3c4d-5e6f-7890-abcd-ef0123456789" relationships: org_group: data: id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups type: org_group_policy_suggestions schema: $ref: "#/components/schemas/OrgGroupPolicySuggestionListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List org group policy suggestions tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/org_groups: get: description: List all organization groups that the requesting organization has access to. operationId: ListOrgGroups parameters: - $ref: "#/components/parameters/OrgGroupPageNumber" - $ref: "#/components/parameters/OrgGroupPageSize" - $ref: "#/components/parameters/OrgGroupSort" responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-15T10:30:00Z" modified_at: "2024-01-15T10:30:00Z" name: "My Org Group" owner_org_site: "us1" owner_org_uuid: "b2c3d4e5-f6a7-8901-bcde-f01234567890" id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups links: first: "https://api.datadoghq.com/api/v2/org_groups?page%5Bnumber%5D=0&page%5Bsize%5D=50" last: "https://api.datadoghq.com/api/v2/org_groups?page%5Bnumber%5D=0&page%5Bsize%5D=50" next: prev: self: "https://api.datadoghq.com/api/v2/org_groups?page%5Bnumber%5D=0&page%5Bsize%5D=50" meta: page: first_number: 0 last_number: 0 next_number: number: 0 prev_number: size: 50 total: 1 type: number_size schema: $ref: "#/components/schemas/OrgGroupListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List org groups tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a new organization group. operationId: CreateOrgGroup requestBody: content: application/json: examples: default: value: data: attributes: name: "My Org Group" type: org_groups schema: $ref: "#/components/schemas/OrgGroupCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00Z" modified_at: "2024-01-15T10:30:00Z" name: "My Org Group" owner_org_site: "us1" owner_org_uuid: "b2c3d4e5-f6a7-8901-bcde-f01234567890" id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups schema: $ref: "#/components/schemas/OrgGroupResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create an org group tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/org_groups/{org_group_id}: delete: description: Delete an organization group by its ID. operationId: DeleteOrgGroup parameters: - $ref: "#/components/parameters/OrgGroupId" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an org group tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a specific organization group by its ID. operationId: GetOrgGroup parameters: - $ref: "#/components/parameters/OrgGroupId" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00Z" modified_at: "2024-01-15T10:30:00Z" name: "My Org Group" owner_org_site: "us1" owner_org_uuid: "b2c3d4e5-f6a7-8901-bcde-f01234567890" id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups schema: $ref: "#/components/schemas/OrgGroupResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get an org group tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update the name of an existing organization group. operationId: UpdateOrgGroup parameters: - $ref: "#/components/parameters/OrgGroupId" requestBody: content: application/json: examples: default: value: data: attributes: name: "Updated Org Group Name" id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups schema: $ref: "#/components/schemas/OrgGroupUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00Z" modified_at: "2024-01-16T14:00:00Z" name: "Updated Org Group Name" owner_org_site: "us1" owner_org_uuid: "b2c3d4e5-f6a7-8901-bcde-f01234567890" id: "a1b2c3d4-e5f6-7890-abcd-ef0123456789" type: org_groups schema: $ref: "#/components/schemas/OrgGroupResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update an org group tags: [Org Groups] "x-permission": operator: OR permissions: - org_group_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/permissions: get: description: |- Returns a list of all permissions, including name, description, and ID. operationId: ListPermissions parameters: - description: |- Set to `true` to return all permissions, including both permissions that can be assigned to user roles and permissions that can only be used as scopes for OAuth clients and scoped credentials. When `false` (default), only permissions that can be assigned to user roles are returned. example: false in: query name: include_scopes required: false schema: type: boolean responses: "200": content: application/json: examples: default: value: data: - attributes: description: Full access to all resources. display_name: Admin group_name: General name: admin restricted: false id: 00000000-0000-0000-0000-000000000001 type: permissions schema: $ref: "#/components/schemas/PermissionsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_read summary: List permissions tags: - Roles "x-permission": operator: OR permissions: - user_access_read /api/v2/personal_access_tokens: get: description: List all access tokens for the organization. operationId: ListPersonalAccessTokens parameters: - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - $ref: "#/components/parameters/PersonalAccessTokensSortParameter" - $ref: "#/components/parameters/PersonalAccessTokensFilterParameter" - $ref: "#/components/parameters/PersonalAccessTokensFilterOwnerIDParameter" - $ref: "#/components/parameters/PersonalAccessTokensFilterLeakedParameter" - $ref: "#/components/parameters/PersonalAccessTokensIncludeParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" expires_at: "2025-12-31T23:59:59+00:00" name: My Personal Access Token public_portion: ddpat_abc123 scopes: - dashboards_read id: 00000000-0000-0000-0000-000000000002 type: personal_access_tokens meta: page: total_filtered_count: 1 schema: $ref: "#/components/schemas/ListPersonalAccessTokensResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all access tokens tags: - Key Management "x-permission": operator: OR permissions: - user_app_keys - org_app_keys_read post: description: Create a personal access token for the current user. operationId: CreatePersonalAccessToken requestBody: content: application/json: examples: default: value: data: attributes: expires_at: "2025-12-31T23:59:59+00:00" name: My Personal Access Token scopes: - dashboards_read - dashboards_write type: personal_access_tokens schema: $ref: "#/components/schemas/PersonalAccessTokenCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" expires_at: "2025-12-31T23:59:59+00:00" key: "" name: My Personal Access Token public_portion: ddpat_abc123 scopes: - dashboards_read id: 00000000-0000-0000-0000-000000000001 type: personal_access_tokens schema: $ref: "#/components/schemas/PersonalAccessTokenCreateResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a personal access token tags: - Key Management x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_app_keys /api/v2/personal_access_tokens/{token_id}: delete: description: Revoke a specific personal access token. operationId: RevokePersonalAccessToken parameters: - $ref: "#/components/parameters/AccessTokenID" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Revoke a personal access token tags: - Key Management "x-permission": operator: OR permissions: - user_app_keys - org_app_keys_write get: description: Get a specific personal access token by its ID. operationId: GetPersonalAccessToken parameters: - $ref: "#/components/parameters/AccessTokenID" - $ref: "#/components/parameters/PersonalAccessTokensIncludeParameter" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" expires_at: "2025-12-31T23:59:59+00:00" name: My Personal Access Token public_portion: ddpat_abc123 scopes: - dashboards_read id: 00000000-0000-0000-0000-000000000003 type: personal_access_tokens schema: $ref: "#/components/schemas/PersonalAccessTokenResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a personal access token tags: - Key Management "x-permission": operator: OR permissions: - user_app_keys - org_app_keys_read patch: description: Update a specific personal access token. operationId: UpdatePersonalAccessToken parameters: - $ref: "#/components/parameters/AccessTokenID" requestBody: content: application/json: examples: default: value: data: attributes: name: Updated Personal Access Token scopes: - dashboards_read - dashboards_write id: 00112233-4455-6677-8899-aabbccddeeff type: personal_access_tokens schema: $ref: "#/components/schemas/PersonalAccessTokenUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" expires_at: "2025-12-31T23:59:59+00:00" name: My Personal Access Token public_portion: ddpat_abc123 scopes: - dashboards_read id: 00000000-0000-0000-0000-000000000004 type: personal_access_tokens schema: $ref: "#/components/schemas/UpdatedPersonalAccessTokenResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a personal access token tags: - Key Management x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_app_keys - org_app_keys_write /api/v2/policies: get: description: List all routing policy documents for the organization. Pass user_id to filter by user scope. operationId: ListAiGatewayPolicies parameters: - $ref: "#/components/parameters/AiGatewayPolicyUserID" responses: "200": content: application/json: examples: default: value: data: - attributes: priority: 1 tiers: - targets: - model: gpt-5.2-codex priority: 1 provider: prod-us id: coding-agent type: routing-documents schema: $ref: "#/components/schemas/AiGatewayPolicyListResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: List AI Gateway routing policies tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create or replace the routing policy document for an inbound pattern. Pass user_id to scope the policy to a user. operationId: UpsertAiGatewayPolicy parameters: - $ref: "#/components/parameters/AiGatewayPolicyUserID" requestBody: content: application/json: schema: $ref: "#/components/schemas/AiGatewayPolicyRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: priority: 1 tiers: - targets: - model: gpt-5.2-codex priority: 1 provider: prod-us id: coding-agent type: routing-documents schema: $ref: "#/components/schemas/AiGatewayPolicyResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Create or replace an AI Gateway routing policy tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/policies/{inbound}: delete: description: Delete the routing policy document for a specific inbound pattern. operationId: DeleteAiGatewayPolicy parameters: - $ref: "#/components/parameters/AiGatewayPolicyInbound" - $ref: "#/components/parameters/AiGatewayPolicyUserID" responses: "204": description: No Content "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Delete an AI Gateway routing policy tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get the routing policy document for a specific inbound pattern. operationId: GetAiGatewayPolicy parameters: - $ref: "#/components/parameters/AiGatewayPolicyInbound" - $ref: "#/components/parameters/AiGatewayPolicyUserID" responses: "200": content: application/json: examples: default: value: data: attributes: priority: 1 tiers: - targets: - model: gpt-5.2-codex priority: 1 provider: prod-us id: coding-agent type: routing-documents schema: $ref: "#/components/schemas/AiGatewayPolicyResponse" description: OK "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: Get an AI Gateway routing policy tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/posture_management/findings: get: description: |- Get a list of findings. These include both misconfigurations and identity risks. **Note**: To filter and return only identity risks, add the following query parameter: `?filter[tags]=dd_rule_type:ciem` ### Filtering Filters can be applied by appending query parameters to the URL. - Using a single filter: `?filter[attribute_key]=attribute_value` - Chaining filters: `?filter[attribute_key]=attribute_value&filter[attribute_key]=attribute_value...` - Filtering on tags: `?filter[tags]=tag_key:tag_value&filter[tags]=tag_key_2:tag_value_2` Here, `attribute_key` can be any of the filter keys described further below. Query parameters of type `integer` support comparison operators (`>`, `>=`, `<`, `<=`). This is particularly useful when filtering by `evaluation_changed_at` or `resource_discovery_timestamp`. For example: `?filter[evaluation_changed_at]=>20123123121`. You can also use the negation operator on strings. For example, use `filter[resource_type]=-aws*` to filter for any non-AWS resources. The operator must come after the equal sign. For example, to filter with the `>=` operator, add the operator after the equal sign: `filter[evaluation_changed_at]=>=1678809373257`. Query parameters must be only among the documented ones and with values of correct types. Duplicated query parameters (e.g. `filter[status]=low&filter[status]=info`) are not allowed. ### Additional extension fields Additional extension fields are available for some findings. The data is available when you include the query parameter `?detailed_findings=true` in the request. The following fields are available for findings: - `external_id`: The resource external ID related to the finding. - `description`: The description and remediation steps for the finding. - `datadog_link`: The Datadog relative link for the finding. - `ip_addresses`: The list of private IP addresses for the resource related to the finding. ### Response The response includes an array of finding objects, pagination metadata, and a count of items that match the query. Each finding object contains the following: - The finding ID that can be used in a `GetFinding` request to retrieve the full finding details. - Core attributes, including status, evaluation, high-level resource details, muted state, and rule details. - `evaluation_changed_at` and `resource_discovery_date` time stamps. - An array of associated tags. operationId: ListFindings parameters: - description: Limit the number of findings returned. Must be <= 1000. example: 50 in: query name: page[limit] required: false schema: default: 100 format: int64 maximum: 1000 minimum: 1 type: integer - description: Return findings for a given snapshot of time (Unix ms). example: 1678721573794 in: query name: snapshot_timestamp required: false schema: format: int64 minimum: 1 type: integer - description: Return the next page of findings pointed to by the cursor. example: "eyJhZnRlciI6IkFRQUFBWWJiaEJXQS1OY1dqUUFBQUFCQldXSmlhRUpYUVVGQlJFSktkbTlDTUdaWFRVbDNRVUUiLCJ2YWx1ZXMiOlsiY3JpdGljYWwiXX0=" in: query name: page[cursor] required: false schema: type: string - description: Return findings that have these associated tags (repeatable). example: filter[tags]=cloud_provider:aws&filter[tags]=aws_account:999999999999 in: query name: filter[tags] required: false schema: type: string - description: "Return findings that have changed from pass to fail or vice versa on a specified date (Unix ms) or date range (using comparison operators)." example: ">=1678721573794" in: query name: filter[evaluation_changed_at] required: false schema: type: string - description: Set to `true` to return findings that are muted. Set to `false` to return unmuted findings. in: query name: filter[muted] required: false schema: type: boolean - description: Return findings for the specified rule ID. in: query name: filter[rule_id] required: false schema: type: string - description: Return findings for the specified rule. in: query name: filter[rule_name] required: false schema: type: string - description: Return only findings for the specified resource type. in: query name: filter[resource_type] required: false schema: type: string - description: Return only findings for the specified resource id. in: query name: filter[@resource_id] required: false schema: type: string - description: "Return findings that were found on a specified date (Unix ms) or date range (using comparison operators)." example: ">=1678721573794" in: query name: filter[discovery_timestamp] required: false schema: type: string - description: Return only `pass` or `fail` findings. example: pass in: query name: filter[evaluation] required: false schema: $ref: "#/components/schemas/FindingEvaluation" - description: Return only findings with the specified status. example: critical in: query name: filter[status] required: false schema: $ref: "#/components/schemas/FindingStatus" - description: Return findings that match the selected vulnerability types (repeatable). example: - misconfiguration explode: true in: query name: filter[vulnerability_type] required: false schema: items: $ref: "#/components/schemas/FindingVulnerabilityType" type: array - description: Return additional fields for some findings. example: - true in: query name: detailed_findings required: false schema: type: boolean responses: "200": content: application/json: examples: default: value: data: - attributes: evaluation: fail resource: "arn:aws:s3:::my-bucket" resource_type: aws_s3_bucket status: high id: abc-123-xyz type: finding meta: page: cursor: "eyJhZnRlciI6IkFRQUFBWWJiaEJXQS1OY1dqUUFBQUFCQldXSmlhRUpYUVVGQlJFSktkbTlDTUdaWFRVbDNRVUUiLCJ2YWx1ZXMiOlsiY3JpdGljYWwiXX0=" total_filtered_count: 1 snapshot_timestamp: 1678721573794 schema: $ref: "#/components/schemas/ListFindingsResponse" description: OK "400": $ref: "#/components/responses/FindingsBadRequestResponse" "403": $ref: "#/components/responses/FindingsForbiddenResponse" "404": $ref: "#/components/responses/FindingsNotFoundResponse" "429": $ref: "#/components/responses/FindingsTooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_findings_read summary: List findings tags: - "Security Monitoring" x-pagination: cursorParam: page[cursor] cursorPath: meta.page.cursor limitParam: page[limit] resultsPath: data x-unstable: |- **Note**: This endpoint uses the legacy security findings data model and is planned for deprecation. Use the [search security findings endpoint](https://docs.datadoghq.com/api/latest/security-monitoring/#search-security-findings), which is based on the [new security findings schema](https://docs.datadoghq.com/security/guide/findings-schema/), to search security findings. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/posture_management/findings/{finding_id}: get: description: Returns a single finding with message and resource configuration. operationId: GetFinding parameters: - description: The ID of the finding. in: path name: finding_id required: true schema: type: string - description: Return the finding for a given snapshot of time (Unix ms). example: 1678721573794 in: query name: snapshot_timestamp required: false schema: format: int64 minimum: 1 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: evaluation: fail message: "## Remediation\n\n1. Go to Storage Account." resource: my_resource_name resource_type: azure_storage_account status: critical id: abc-123 type: detailed_finding schema: $ref: "#/components/schemas/GetFindingResponse" description: OK "400": $ref: "#/components/responses/FindingsBadRequestResponse" "403": $ref: "#/components/responses/FindingsForbiddenResponse" "404": $ref: "#/components/responses/FindingsNotFoundResponse" "429": $ref: "#/components/responses/FindingsTooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_findings_read summary: Get a finding tags: - "Security Monitoring" x-unstable: |- **Note**: This endpoint uses the legacy security findings data model and is planned for deprecation. Use the [search security findings endpoint](https://docs.datadoghq.com/api/latest/security-monitoring/#search-security-findings), which is based on the [new security findings schema](https://docs.datadoghq.com/security/guide/findings-schema/), to search security findings. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/powerpacks: get: description: Get a list of all powerpacks. operationId: ListPowerpacks parameters: - description: Maximum number of powerpacks in the response. example: 25 in: query name: page[limit] required: false schema: default: 25 format: int64 maximum: 1000 type: integer - $ref: "#/components/parameters/PageOffset" responses: "200": content: application/json: examples: default: value: data: - attributes: description: Powerpack for ABC group_widget: definition: layout_type: ordered type: group widgets: - definition: content: example type: note layout: height: 5 width: 10 x: 0 y: 0 name: Sample Powerpack tags: - "tag:foo1" id: 00000000-0000-0000-0000-000000000001 type: powerpack schema: $ref: "#/components/schemas/ListPowerpacksResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - dashboards_read summary: Get all powerpacks tags: - Powerpack x-pagination: limitParam: page[limit] pageOffsetParam: page[offset] resultsPath: data "x-permission": operator: OR permissions: - dashboards_read post: description: Create a powerpack. operationId: CreatePowerpack requestBody: content: application/json: examples: default: value: data: attributes: description: Powerpack for ABC group_widget: definition: layout_type: ordered show_title: true title: Sample Powerpack type: group widgets: - definition: content: example type: note layout: height: 5 width: 10 x: 0 y: 0 layout: height: 0 width: 0 x: 0 y: 0 live_span: 5m name: Sample Powerpack tags: - tag:foo1 template_variables: - defaults: - "*" name: test relationships: author: data: id: 00000000-0000-0000-2345-000000000000 type: users type: powerpack schema: $ref: "#/components/schemas/Powerpack" description: Create a powerpack request body. required: true responses: "200": content: application/json: examples: default: value: data: id: 00000000-0000-0000-0000-000000000002 type: powerpack schema: $ref: "#/components/schemas/PowerpackResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - dashboards_write summary: Create a new powerpack tags: - Powerpack x-codegen-request-body-name: body "x-permission": operator: OR permissions: - dashboards_write /api/v2/powerpacks/{powerpack_id}: delete: description: Delete a powerpack. operationId: DeletePowerpack parameters: - description: Powerpack id in: path name: powerpack_id required: true schema: type: string responses: "204": description: OK "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Powerpack Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - dashboards_write summary: Delete a powerpack tags: - Powerpack "x-permission": operator: OR permissions: - dashboards_write get: description: Get a powerpack. operationId: GetPowerpack parameters: - description: ID of the powerpack. in: path name: powerpack_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: description: Powerpack for ABC group_widget: definition: layout_type: ordered type: group widgets: - definition: content: example type: note layout: height: 5 width: 10 x: 0 y: 0 name: Sample Powerpack tags: - "tag:foo1" id: 00000000-0000-0000-0000-000000000003 type: powerpack schema: $ref: "#/components/schemas/PowerpackResponse" description: OK "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Powerpack Not Found. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - dashboards_read summary: Get a Powerpack tags: - Powerpack "x-permission": operator: OR permissions: - dashboards_read patch: description: Update a powerpack. operationId: UpdatePowerpack parameters: - description: ID of the powerpack. in: path name: powerpack_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: description: Powerpack for ABC group_widget: definition: layout_type: ordered show_title: true title: Sample Powerpack type: group widgets: - definition: content: example type: note layout: height: 5 width: 10 x: 0 y: 0 layout: height: 0 width: 0 x: 0 y: 0 live_span: 5m name: Sample Powerpack tags: - tag:foo1 template_variables: - defaults: - "*" name: test relationships: author: data: id: 00000000-0000-0000-2345-000000000000 type: users type: powerpack schema: $ref: "#/components/schemas/Powerpack" description: Update a powerpack request body. required: true responses: "200": content: application/json: examples: default: value: data: attributes: description: Powerpack for ABC group_widget: definition: layout_type: ordered type: group widgets: - definition: content: example type: note layout: height: 5 width: 10 x: 0 y: 0 name: Sample Powerpack tags: - "tag:foo1" id: 00000000-0000-0000-0000-000000000004 type: powerpack schema: $ref: "#/components/schemas/PowerpackResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Powerpack Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - dashboards_write summary: Update a powerpack tags: - Powerpack x-codegen-request-body-name: body "x-permission": operator: OR permissions: - dashboards_write /api/v2/processes: get: description: |- Get processes collected by Live Processes for your organization. One request covers a window of at most 1 hour that starts within the past 36 hours. To cover a longer period, make one request per hour. Older data is not available from this endpoint. When a process includes `identifying_tags`, pass them as `tag_filters` in a `process` data source query to `/api/v2/query/scalar` or `/api/v2/query/timeseries` to get CPU or memory metrics for that one process. If absent, don't substitute an empty filter, which would query all processes. operationId: ListProcesses parameters: - description: |- Free-text search over process fields such as the executable and user. When it contains several words, a process must match all of them. Use `tags` for exact values such as host. in: query name: search required: false schema: type: string - description: |- Comma-separated `key:value` tags. A process must match every tag. Wildcards, negation (`-key:value`), spaces, and `IN (...)` are not supported. To cover several hosts, make one request per host. example: account:prod,user:admin in: query name: tags required: false schema: type: string - description: |- Start of the query window, in Unix seconds. Must be within the past 36 hours and at most 1 hour before `to`. If not provided, the start of the query window is 15 minutes before the `to` timestamp. If neither `from` nor `to` is provided, the query window is `[now - 15m, now]`. in: query name: from required: false schema: format: int64 type: integer - description: |- End of the query window, in Unix seconds. Must be at most 1 hour after `from`. If not provided, the end of the query window is 15 minutes after the `from` timestamp. If neither `from` nor `to` is provided, the query window is `[now - 15m, now]`. in: query name: to required: false schema: format: int64 type: integer - description: Maximum number of results returned. in: query name: page[limit] required: false schema: default: 1000 format: int32 maximum: 10000 minimum: 1 type: integer - description: |- String to query the next page of results. This key is provided with each valid response from the API in `meta.page.after`. in: query name: page[cursor] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: cmdline: /usr/bin/python3 executable: /usr/bin/python3 host: my-host identifying_tags: - host:my-host - pid:123 pid: 123 id: abc-123 type: process schema: $ref: "#/components/schemas/ProcessSummariesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get all processes tags: - Processes x-pagination: cursorParam: page[cursor] cursorPath: meta.page.after limitParam: page[limit] resultsPath: data "x-permission": operator: OPEN permissions: [] /api/v2/prodlytics: post: description: |- Send server-side events to Product Analytics. Server-side events are retained for 15 months. Server-Side events in Product Analytics are helpful for tracking events that occur on the server, as opposed to client-side events, which are captured by Real User Monitoring (RUM) SDKs. This allows for a more comprehensive view of the user journey by including actions that happen on the server. Typical examples could be `checkout.completed` or `payment.processed`. Ingested server-side events are integrated into Product Analytics to allow users to select and filter these events in the event picker, similar to how views or actions are handled. **Requirements:** - At least one of `usr`, `account`, or `session` must be provided with a valid ID. - The `application.id` must reference a Product Analytics-enabled application. **Custom Attributes:** Any additional fields in the payload are flattened and searchable as facets. For example, a payload with `{"customer": {"tier": "premium"}}` is searchable with the syntax `@customer.tier:premium` in Datadog. The status codes answered by the HTTP API are: - 202: Accepted: The request has been accepted for processing - 400: Bad request (likely an issue in the payload formatting) - 401: Unauthorized (likely a missing API Key) - 403: Permission issue (likely using an invalid API Key) - 408: Request Timeout, request should be retried after some time - 413: Payload too large (batch is above 5MB uncompressed) - 429: Too Many Requests, request should be retried after some time - 500: Internal Server Error, the server encountered an unexpected condition that prevented it from fulfilling the request, request should be retried after some time - 503: Service Unavailable, the server is not ready to handle the request probably because it is overloaded, request should be retried after some time operationId: SubmitProductAnalyticsEvent requestBody: content: application/json: examples: default: value: application: id: 123abcde-123a-123b-1234-123456789abc event: name: payment.processed type: server usr: id: "123" event-with-account: description: Send a server-side event linked to an account. summary: Event with account ID value: account: id: "account-456" application: id: "123abcde-123a-123b-1234-123456789abc" event: name: "checkout.completed" type: "server" event-with-custom-attributes: description: Send a server-side event with additional custom attributes. summary: Event with custom attributes value: application: id: "123abcde-123a-123b-1234-123456789abc" customer: tier: "premium" event: name: "payment.processed" type: "server" usr: id: "123" event-with-session: description: Send a server-side event linked to a session. summary: Event with session ID value: application: id: "123abcde-123a-123b-1234-123456789abc" event: name: "form.submitted" session: id: "session-789" type: "server" simple-event-with-user: description: Send a server-side event linked to a user. summary: Simple event with user ID value: application: id: "123abcde-123a-123b-1234-123456789abc" event: name: "payment.processed" type: "server" usr: id: "123" schema: $ref: "#/components/schemas/ProductAnalyticsServerSideEventItem" description: Server-side event to send (JSON format). required: true responses: "202": content: application/json: examples: default: value: {} schema: type: object description: Request accepted for processing (always 202 empty JSON). "400": content: application/json: schema: $ref: "#/components/schemas/ProductAnalyticsServerSideEventErrors" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/ProductAnalyticsServerSideEventErrors" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/ProductAnalyticsServerSideEventErrors" description: Forbidden "408": content: application/json: schema: $ref: "#/components/schemas/ProductAnalyticsServerSideEventErrors" description: Request Timeout "413": content: application/json: schema: $ref: "#/components/schemas/ProductAnalyticsServerSideEventErrors" description: Payload Too Large "429": content: application/json: schema: $ref: "#/components/schemas/ProductAnalyticsServerSideEventErrors" description: Too Many Requests "500": content: application/json: schema: $ref: "#/components/schemas/ProductAnalyticsServerSideEventErrors" description: Internal Server Error "503": content: application/json: schema: $ref: "#/components/schemas/ProductAnalyticsServerSideEventErrors" description: Service Unavailable security: - apiKeyAuth: [] servers: - url: https://{site} variables: site: default: browser-intake-datadoghq.com description: The intake domain for the regional site. enum: - browser-intake-datadoghq.com - browser-intake-us3-datadoghq.com - browser-intake-us5-datadoghq.com - browser-intake-ap1-datadoghq.com - browser-intake-ap2-datadoghq.com - browser-intake-uk1-datadoghq.com - browser-intake-datadoghq.eu x-enum-varnames: - US1 - US3 - US5 - AP1 - AP2 - UK1 - EU1 - url: "{protocol}://{name}" variables: name: default: browser-intake-datadoghq.com description: Full site DNS name. protocol: default: https description: The protocol for accessing the API. - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: Any Datadog deployment. subdomain: default: api description: The subdomain where the API is deployed. summary: Send server-side events tags: - Product Analytics x-codegen-request-body-name: body /api/v2/product-analytics/accounts/facet_info: post: description: Get facet information for account attributes including possible values and counts operationId: GetAccountFacetInfo requestBody: content: application/json: examples: default: value: data: attributes: facet_id: first_browser_name limit: 10 search: query: user_org_id:5001 AND first_country_code:US term_search: value: Chrome id: facet_info_request type: users_facet_info_request schema: $ref: "#/components/schemas/FacetInfoRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: result: values: - count: 4892 value: Chrome id: facet_info_response type: users_facet_info schema: $ref: "#/components/schemas/FacetInfoResponse" description: Successful response with facet information "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get account facet info tags: - Rum Audience Management x-unstable: "**Note**: This endpoint may be subject to changes." /api/v2/product-analytics/accounts/query: post: description: Query accounts with flexible filtering by account properties operationId: QueryAccounts requestBody: content: application/json: examples: default: value: data: attributes: limit: 20 query: plan_type:enterprise AND user_count:>100 AND subscription_status:active select_columns: - account_id - account_name - user_count - plan_type - subscription_status - created_at - mrr - industry sort: field: user_count order: DESC wildcard_search_term: tech id: query_account_request type: query_account_request schema: $ref: "#/components/schemas/QueryAccountRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: hits: - account_id: "123" account_name: Example Account plan_type: enterprise user_count: 150 total: 1 id: query_response type: query_response schema: $ref: "#/components/schemas/QueryResponse" description: Successful response with account data "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Query accounts tags: - Rum Audience Management x-unstable: "**Note**: This endpoint may be subject to changes." /api/v2/product-analytics/analytics/list: post: description: |- List the individual event records matching an analytics query. Use `columns` to choose the attributes returned on each row, `sort` to order the rows, and `limit` to cap how many are returned. operationId: QueryProductAnalyticsList requestBody: content: application/json: examples: default: value: data: attributes: from: 1771232048460 query: columns: - "@view.name" limit: 100 query: data_source: product_analytics search: query: "@type:view" to: 1771836848262 type: formula_analytics_extended_list_request schema: $ref: "#/components/schemas/ProductAnalyticsAnalyticsListRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: records: [] total_count: 0 id: abc-123 type: list_response schema: $ref: "#/components/schemas/ProductAnalyticsAnalyticsListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List analytics events tags: - Product Analytics x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_apps_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/product-analytics/analytics/scalar: post: description: |- Compute scalar analytics results for Product Analytics data. Returns aggregated values (counts, averages, percentiles) optionally grouped by facets. operationId: QueryProductAnalyticsScalar requestBody: content: application/json: examples: default: value: data: attributes: from: 1771232048460 query: compute: aggregation: count query: data_source: product_analytics search: query: "@type:view" to: 1771836848262 type: formula_analytics_extended_request schema: $ref: "#/components/schemas/ProductAnalyticsAnalyticsRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: columns: [] id: abc-123 type: scalar_response schema: $ref: "#/components/schemas/ProductAnalyticsScalarResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Compute scalar analytics tags: - Product Analytics x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_apps_read /api/v2/product-analytics/analytics/timeseries: post: description: |- Compute timeseries analytics results for Product Analytics data. Returns time-bucketed values for charts and trend analysis. The `compute.interval` field (milliseconds) is required for time bucketing. operationId: QueryProductAnalyticsTimeseries requestBody: content: application/json: examples: default: value: data: attributes: from: 1771232048460 query: compute: aggregation: count query: data_source: product_analytics search: query: "@type:view" to: 1771836848262 type: formula_analytics_extended_request schema: $ref: "#/components/schemas/ProductAnalyticsAnalyticsRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: series: [] times: [] id: abc-123 type: timeseries_response schema: $ref: "#/components/schemas/ProductAnalyticsTimeseriesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Compute timeseries analytics tags: - Product Analytics x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_apps_read /api/v2/product-analytics/journey/funnel: post: description: |- Compute a funnel over an ordered sequence of Product Analytics events. Returns the per-step conversion counts, conversion rates, and elapsed times, optionally segmented by group-by facets. operationId: QueryProductAnalyticsJourneyFunnel requestBody: content: application/json: examples: default: value: data: attributes: from: 1756425600000 query: compute: aggregation: count search: expression: A -> B node_objects: A: data_source: product_analytics search: query: "@type:view @view.name:Login" B: data_source: product_analytics search: query: "@type:action @action.target.name:Submit" to: 1756857600000 type: journey_request schema: $ref: "#/components/schemas/ProductAnalyticsJourneyFunnelRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: end_to_end_conversion_rate: 0.42 end_to_end_elapsed_time: avg: 9400 max: 86400 min: 1200 funnel_steps: - elapsed_time_to_next_step: avg: 5100 max: 42000 min: 900 groups: [] label: A unit: millisecond value: 1200 initial_count: 1200 id: 00000000-0000-0000-0000-000000000000 type: funnel_response schema: $ref: "#/components/schemas/ProductAnalyticsJourneyFunnelResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Compute journey funnel analysis tags: - Product Analytics x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_apps_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/product-analytics/journey/list: post: description: |- Return the individual sessions that reached, or dropped off at, a given step of the journey. Each row contains the identity join key, the event timestamp, and the columns requested in `entity_columns`. operationId: QueryProductAnalyticsJourneyList requestBody: content: application/json: examples: default: value: data: attributes: from: 1756425600000 query: entity_columns: - "@usr.name" limit: 50 search: expression: A -> B node_objects: A: data_source: product_analytics search: query: "@type:view @view.name:Login" B: data_source: product_analytics search: query: "@type:action @action.target.name:Submit" to: 1756857600000 type: journey_list_request schema: $ref: "#/components/schemas/ProductAnalyticsJourneyListRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: entity: session records: - "@session.id": 00000000-0000-0000-0000-000000000001 "@usr.name": Jane Doe timestamp: 1756425600000 total_count: 231 id: 00000000-0000-0000-0000-000000000000 type: journey_list_response schema: $ref: "#/components/schemas/ProductAnalyticsJourneyListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List journey entities tags: - Product Analytics x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_apps_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/product-analytics/journey/scalar: post: description: |- Compute scalar results for a journey query, such as the conversion count, the conversion rate, or the time to convert, optionally segmented by group-by facets. operationId: QueryProductAnalyticsJourneyScalar requestBody: content: application/json: examples: default: value: data: attributes: from: 1756425600000 query: compute: aggregation: count metric: __dd.conversion_rate search: expression: A -> B node_objects: A: data_source: product_analytics search: query: "@type:view @view.name:Login" B: data_source: product_analytics search: query: "@type:action @action.target.name:Submit" to: 1756857600000 type: formula_journey_request schema: $ref: "#/components/schemas/ProductAnalyticsJourneyScalarRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: columns: [] id: 00000000-0000-0000-0000-000000000000 type: journey_scalar_response schema: $ref: "#/components/schemas/ProductAnalyticsJourneyScalarResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Compute journey scalar analytics tags: - Product Analytics x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_apps_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/product-analytics/journey/timeseries: post: description: |- Compute timeseries results for a journey query. Returns one series per group-by combination, bucketed by the requested interval. operationId: QueryProductAnalyticsJourneyTimeseries requestBody: content: application/json: examples: default: value: data: attributes: from: 1756425600000 interval: 3600000 query: compute: aggregation: count search: expression: A -> B node_objects: A: data_source: product_analytics search: query: "@type:view @view.name:Login" B: data_source: product_analytics search: query: "@type:action @action.target.name:Submit" to: 1756857600000 type: formula_journey_request schema: $ref: "#/components/schemas/ProductAnalyticsFormulaJourneyRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: series: [] times: [] id: 00000000-0000-0000-0000-000000000000 type: journey_timeseries_response schema: $ref: "#/components/schemas/ProductAnalyticsJourneyTimeseriesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Compute journey timeseries analytics tags: - Product Analytics x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_apps_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/product-analytics/retention/grid: post: description: |- Compute a retention grid, showing how much of each cohort came back over each subsequent period. Rows are cohorts, columns are return periods, and each cell holds the count and rate of entities that returned. operationId: QueryProductAnalyticsRetentionGrid requestBody: content: application/json: examples: default: value: data: attributes: from: 1756425600000 query: compute: aggregation: count metric: "__dd.retention_rate" search: cohort_criteria: base_query: data_source: product_analytics search: query: "@type:view @view.name:Signup" time_interval: type: calendar value: alignment: monday quantity: 1 timezone: UTC type: week retention_entity: "@usr.id" return_condition: conversion_on_or_after return_criteria: base_query: data_source: product_analytics search: query: "@type:view" to: 1756857600000 type: retention_grid_request schema: $ref: "#/components/schemas/ProductAnalyticsRetentionGridRequest" description: The retention grid query. required: true responses: "200": content: application/json: examples: default: value: data: attributes: cohorts: [] retention_entity: "@usr.id" retention_periods: [] id: 00000000-0000-0000-0000-000000000000 type: retention_grid_response schema: $ref: "#/components/schemas/ProductAnalyticsRetentionGridResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Compute a retention grid tags: - Product Analytics x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_apps_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/product-analytics/retention/list: post: description: |- List the individual users or accounts counted in one cell of the retention grid. Set `computation_scope` to the cohort and return period you want to examine. operationId: QueryProductAnalyticsRetentionList requestBody: content: application/json: examples: default: value: data: attributes: from: 1756425600000 query: columns: - field: path: "@usr.email" computation_scope: cohort_target: type: index value: 0 return_period_target: type: index value: 1 type: cell limit: 100 search: cohort_criteria: base_query: data_source: product_analytics search: query: "@type:view @view.name:Signup" time_interval: type: calendar value: quantity: 1 type: week retention_entity: "@usr.id" return_condition: conversion_on_or_after to: 1756857600000 type: retention_list_request schema: $ref: "#/components/schemas/ProductAnalyticsRetentionListRequest" description: The retention list query. required: true responses: "200": content: application/json: examples: default: value: data: attributes: records: [] retention_entity: "@usr.id" id: 00000000-0000-0000-0000-000000000000 type: retention_list_response schema: $ref: "#/components/schemas/ProductAnalyticsRetentionListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List the entities behind a retention cell tags: - Product Analytics x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_apps_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/product-analytics/retention/scalar: post: description: Compute retention as a single value per group, suitable for a query value or top list widget. operationId: QueryProductAnalyticsRetentionScalar requestBody: content: application/json: examples: default: value: data: attributes: from: 1756425600000 query: compute: aggregation: count metric: "__dd.retention_rate" search: cohort_criteria: base_query: data_source: product_analytics search: query: "@type:view @view.name:Signup" time_interval: type: calendar value: alignment: monday quantity: 1 timezone: UTC type: week retention_entity: "@usr.id" return_condition: conversion_on_or_after return_criteria: base_query: data_source: product_analytics search: query: "@type:view" to: 1756857600000 type: formula_retention_request schema: $ref: "#/components/schemas/ProductAnalyticsFormulaRetentionRequest" description: The retention scalar query. required: true responses: "200": content: application/json: examples: default: value: data: attributes: columns: [] type: scalar_response schema: $ref: "#/components/schemas/ProductAnalyticsScalarResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Compute retention scalar values tags: - Product Analytics x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_apps_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/product-analytics/retention/timeseries: post: description: |- Compute retention as a series of values over time, using the same query definition as the retention grid. operationId: QueryProductAnalyticsRetentionTimeseries requestBody: content: application/json: examples: default: value: data: attributes: from: 1756425600000 query: compute: aggregation: count metric: "__dd.retention_rate" search: cohort_criteria: base_query: data_source: product_analytics search: query: "@type:view @view.name:Signup" time_interval: type: calendar value: alignment: monday quantity: 1 timezone: UTC type: week retention_entity: "@usr.id" return_condition: conversion_on_or_after return_criteria: base_query: data_source: product_analytics search: query: "@type:view" to: 1756857600000 type: formula_retention_request schema: $ref: "#/components/schemas/ProductAnalyticsFormulaRetentionRequest" description: The retention timeseries query. required: true responses: "200": content: application/json: examples: default: value: data: attributes: series: [] times: [] type: timeseries_response schema: $ref: "#/components/schemas/ProductAnalyticsTimeseriesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Compute retention timeseries tags: - Product Analytics x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_apps_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/product-analytics/sankey: post: description: |- Compute a Sankey diagram of how sessions flow between the values of two facets, showing where users continue and where they drop off at each step. operationId: QueryProductAnalyticsSankey requestBody: content: application/json: examples: default: value: data: attributes: definition: entries_per_step: 10 number_of_steps: 3 source: "@view.name" target: "@view.name" search: query: "@type:view" time: from: 1756425600000 to: 1756857600000 type: sankey_request schema: $ref: "#/components/schemas/ProductAnalyticsSankeyRequest" description: The Sankey diagram query. required: true responses: "200": content: application/json: examples: default: value: data: attributes: links: [] nodes: [] id: 00000000-0000-0000-0000-000000000000 type: sankey_response schema: $ref: "#/components/schemas/ProductAnalyticsSankeyResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Compute a Sankey diagram tags: - Product Analytics x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_apps_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/product-analytics/users/event_filtered_query: post: description: Query users filtered by both user properties and event platform data operationId: QueryEventFilteredUsers requestBody: content: application/json: examples: default: value: data: attributes: event_query: query: "@type:view AND @view.loading_time:>3000 AND @application.name:ecommerce-platform" time_frame: end: 1761309676 start: 1760100076 include_row_count: true limit: 25 query: user_org_id:5001 AND first_country_code:US AND first_browser_name:Chrome select_columns: - user_id - user_email - first_country_code - first_browser_name - events_count - session_count - error_count - avg_loading_time id: query_event_filtered_users_request type: query_event_filtered_users_request schema: $ref: "#/components/schemas/QueryEventFilteredUsersRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: hits: - first_browser_name: Chrome first_country_code: US user_email: test@example.com user_id: "123" total: 1 id: query_response type: query_response schema: $ref: "#/components/schemas/QueryResponse" description: Successful response with filtered user data "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Query event filtered users tags: - Rum Audience Management x-unstable: "**Note**: This endpoint may be subject to changes." /api/v2/product-analytics/users/facet_info: post: description: Get facet information for user attributes including possible values and counts operationId: GetUserFacetInfo requestBody: content: application/json: examples: default: value: data: attributes: facet_id: first_browser_name limit: 10 search: query: user_org_id:5001 AND first_country_code:US term_search: value: Chrome id: facet_info_request type: users_facet_info_request schema: $ref: "#/components/schemas/FacetInfoRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: result: values: - count: 4892 value: Chrome id: facet_info_response type: users_facet_info schema: $ref: "#/components/schemas/FacetInfoResponse" description: Successful response with facet information "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get user facet info tags: - Rum Audience Management x-unstable: "**Note**: This endpoint may be subject to changes." /api/v2/product-analytics/users/query: post: description: Query users with flexible filtering by user properties, with optional wildcard search operationId: QueryUsers requestBody: content: application/json: examples: default: value: data: attributes: limit: 25 query: user_email:*@techcorp.com AND first_country_code:US AND first_browser_name:Chrome select_columns: - user_id - user_email - user_name - user_org_id - first_country_code - first_browser_name - first_device_type - last_seen sort: field: first_seen order: DESC wildcard_search_term: john id: query_users_request type: query_users_request schema: $ref: "#/components/schemas/QueryUsersRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: hits: - user_email: test@example.com user_id: "123" total: 1 id: query_response type: query_response schema: $ref: "#/components/schemas/QueryResponse" description: Successful response with user data "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Query users tags: - Rum Audience Management x-unstable: "**Note**: This endpoint may be subject to changes." /api/v2/product-analytics/{entity}/mapping: get: description: Get entity mapping configuration including all available attributes and their properties operationId: GetMapping parameters: - description: The entity for which to get the mapping in: path name: entity required: true schema: example: users type: string responses: "200": content: application/json: examples: default: value: data: attributes: attributes: [] id: get_mappings_response type: get_mappings_response schema: $ref: "#/components/schemas/GetMappingResponse" description: Successful response with entity mapping configuration "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get mapping tags: - Rum Audience Management x-unstable: "**Note**: This endpoint may be subject to changes." /api/v2/product-analytics/{entity}/mapping/connection: post: description: Create a new data connection and its fields for an entity operationId: CreateConnection parameters: - description: The entity for which to create the connection in: path name: entity required: true schema: example: users type: string requestBody: content: application/json: examples: default: value: data: attributes: fields: - description: Customer subscription tier from `CRM` display_name: Customer Tier id: customer_tier source_name: subscription_tier type: string - description: Customer lifetime value in `USD` display_name: Lifetime Value id: lifetime_value source_name: ltv type: number join_attribute: user_email join_type: email type: ref_table id: crm-integration type: connection_id schema: $ref: "#/components/schemas/CreateConnectionRequest" required: true responses: "201": description: Connection created successfully "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create connection tags: - Rum Audience Management x-unstable: "**Note**: This endpoint may be subject to changes." put: description: Update an existing data connection by adding, updating, or deleting fields operationId: UpdateConnection parameters: - description: The entity for which to update the connection in: path name: entity required: true schema: example: users type: string requestBody: content: application/json: examples: default: value: data: attributes: fields_to_add: - description: Net Promoter Score from customer surveys display_name: NPS Score groups: - Satisfaction - Metrics id: nps_score source_name: net_promoter_score type: number fields_to_delete: - old_revenue_field fields_to_update: - field_id: lifetime_value updated_display_name: Customer Lifetime Value (`USD`) updated_groups: - Financial - Metrics id: crm-integration type: connection_id schema: $ref: "#/components/schemas/UpdateConnectionRequest" required: true responses: "200": description: Connection updated successfully "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update connection tags: - Rum Audience Management x-unstable: "**Note**: This endpoint may be subject to changes." /api/v2/product-analytics/{entity}/mapping/connection/{id}: delete: description: Delete an existing data connection for an entity operationId: DeleteConnection parameters: - description: The connection ID to delete in: path name: id required: true schema: example: connection-id-123 type: string - description: The entity for which to delete the connection in: path name: entity required: true schema: example: users type: string responses: "204": description: Connection deleted successfully "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete connection tags: - Rum Audience Management x-unstable: "**Note**: This endpoint may be subject to changes." /api/v2/product-analytics/{entity}/mapping/connections: get: description: List all data connections for an entity operationId: ListConnections parameters: - description: The entity for which to list connections in: path name: entity required: true schema: example: users type: string responses: "200": content: application/json: examples: default: value: data: attributes: connections: [] id: list_connections_response type: list_connections_response schema: $ref: "#/components/schemas/ListConnectionsResponse" description: Successful response with list of connections "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List connections tags: - Rum Audience Management x-unstable: "**Note**: This endpoint may be subject to changes." /api/v2/product-catalog/skus: get: description: |- Get every generally available Datadog SKU, with the pricing and allotment metadata that applies to it, for the Datadog site serving the request. A SKU is generally available when it is billed through a metered commitment or through automatic billing; SKUs in any other phase are not returned. Prices, allotments, and pricing tiers are returned as they were in effect on `as_of_date`, which defaults to the date of the request. Prices are public list prices: they do not reflect discounts, commitments, or negotiated rates on an account. Each SKU is a separate resource in `data`, identified by its SKU code, and sorted by that code in ascending order. The whole catalog is returned in a single response, so this endpoint is not paginated. operationId: ListProductCatalogSKUs parameters: - description: |- The version of the product catalog response contract to return. `v1` is the latest. This is independent of the `/api/v2` path segment, which is the version of the Datadog API itself. example: v1 in: query name: version required: true schema: $ref: "#/components/schemas/ProductCatalogSKUsAPIVersion" - description: |- The date the returned prices, allotments, and pricing tiers are effective as of, in `YYYY-MM-DD` format. Defaults to the date of the request, and must not be later than it. Set it to a date in a past billing period to reconcile that period against the prices that were in effect then, rather than today. example: "2026-07-01" in: query name: as_of_date required: false schema: format: date type: string responses: "200": content: application/json: examples: default: value: data: - attributes: allotments: [] billing_dimension: audit_trail billing_units: currency: USD default_on_demand_option: monthly number_of_units_included_in_price: 0 on_demand_list_price: "3.00" on_demand_tiered: pricing_type: percent sku_name: Audit Trail id: AUDIT-TRAIL type: Sku - attributes: allotments: - child_sku_code: CM-100 hourly_quantity: 100 monthly_quantity: 100 parent_sku_code: HOSTS-PRO - child_sku_code: CM-INGEST hourly_quantity: 100 monthly_quantity: 100 parent_sku_code: HOSTS-PRO - child_sku_code: CUSTOM-EVENTS hourly_quantity: 0.684932 monthly_quantity: 500 parent_sku_code: HOSTS-PRO - child_sku_code: CONT hourly_quantity: 10 monthly_quantity: 10 parent_sku_code: HOSTS-PRO - child_sku_code: CONT-EXCL-AGENT hourly_quantity: 5 monthly_quantity: 5 parent_sku_code: HOSTS-PRO billing_dimension: infra_host billing_units: hosts currency: USD default_on_demand_option: monthly number_of_units_included_in_price: 1 on_demand_list_price: "18.00" on_demand_tiered: pricing_type: usage sku_name: Infra Host (Pro) id: HOSTS-PRO type: Sku - attributes: allotments: [] billing_dimension: llm_observability_min_spend billing_units: requests currency: USD default_on_demand_option: monthly number_of_units_included_in_price: 10000 on_demand_list_price: on_demand_tiered: tiers: - max_usage_quantity: 100000 min_usage_quantity: 1 price: "120.00" pricing_unit_type: block - max_usage_quantity: min_usage_quantity: 100000 price: "12.00" pricing_unit_type: unit pricing_type: usage sku_name: Agent Observability Min Spend id: LLM-OBSERVABILITY-MIN-SPEND type: Sku schema: $ref: "#/components/schemas/ProductCatalogSKUsResponse" description: OK "400": content: application/json: examples: default: value: errors: - detail: as_of_date must not be later than the date of the request source: parameter: as_of_date status: "400" title: Bad Request schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request - version is missing or invalid, or as_of_date is malformed or in the future "403": content: application/json: examples: default: value: errors: - detail: this endpoint requires the billing_read or usage_read permission status: "403" title: Forbidden schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden - the caller has neither the billing_read nor the usage_read permission "404": content: application/json: examples: default: value: errors: - detail: the requested product catalog version is not supported source: parameter: version status: "404" title: Not Found schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found - the requested catalog version is not supported "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - billing_read - AuthZ: - usage_read summary: List SKUs tags: - Product Catalog x-permission: operator: OR permissions: - billing_read - usage_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/provider-models: get: description: List live models available to a provider integration account that supports model discovery. operationId: ListAiGatewayProviderModels parameters: - $ref: "#/components/parameters/AiGatewayIntegrationType" - $ref: "#/components/parameters/AiGatewayIntegrationAccountID" - $ref: "#/components/parameters/AiGatewayProviderProjectID" - $ref: "#/components/parameters/AiGatewayProviderLocation" - $ref: "#/components/parameters/AiGatewayProviderBedrockRegion" - $ref: "#/components/parameters/AiGatewayProviderFoundryResourceID" responses: "200": content: application/json: examples: default: value: data: - attributes: display_name: GPT-5.2 Codex model_id_wire: gpt-5.2-codex-20260801 supported_operations: - OPENAI_CHAT_COMPLETIONS id: gpt-5.2-codex type: provider-models schema: $ref: "#/components/schemas/AiGatewayDiscoveredModelListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: List models available from a provider integration tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/providers: get: description: >- List the model providers connected to the organization. Credentials stay in each provider's integration account and are never returned. Requires `ai_gateway_config_read` and provider View. Catalog and pricing metadata inherit provider access. Lists omit hidden entries; direct reads of hidden resources return 404. operationId: ListAiGatewayProviders responses: "200": content: application/json: examples: default: value: data: - attributes: cost_multiplier: 1.0 created_at: "2026-08-24T12:00:00Z" integration_account_id: account-123 known_provider: openai name: prod-us slug: prod-us updated_at: "2026-08-24T12:00:00Z" id: "42" type: providers schema: $ref: "#/components/schemas/AiGatewayProviderListResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: List AI Gateway providers tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Creating a provider requires `ai_gateway_config_write`. No provider View check applies before creation. Create a provider and its initial model catalog. All discovered models are enabled; optional models are added as manually managed entries. The slug is the immutable routing identifier. Provider and initial catalog rows are saved in one transaction. Initial sharing is unavailable: supplying initial_bindings returns 503 with stage initial_permissions and outcome not_saved. A failed database commit can return 503 with stage database_commit and outcome unknown; check the provider list before retrying. Creation without initial_bindings keeps normal unrestricted defaults. operationId: CreateAiGatewayProvider requestBody: content: application/json: schema: $ref: "#/components/schemas/AiGatewayProviderCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: cost_multiplier: 1.0 created_at: "2026-08-24T12:00:00Z" integration_account_id: account-123 known_provider: openai name: prod-us slug: prod-us updated_at: "2026-08-24T12:00:00Z" id: "42" type: providers schema: $ref: "#/components/schemas/AiGatewayProviderResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Create an AI Gateway provider tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/providers/{id}: delete: description: >- Requires `ai_gateway_config_write` and provider Edit. Models and pricing inherit provider access. This also applies when force=true. Existing cascades remain and can affect policies the caller cannot edit. Delete a provider by ID. Providers used by routing rules return provider_in_use with HTTP 409 and the affected rules in error metadata. Retry with force=true to remove provider targets and delete rules left without targets. Surviving tiers keep their ordering and weights. A deletion that would rewrite a surviving tier with an unknown ordering_issue fails with HTTP 409 and code routing_rule_unknown_ordering until that rule is replaced or deleted. operationId: DeleteAiGatewayProvider parameters: - $ref: "#/components/parameters/AiGatewayProviderID" - $ref: "#/components/parameters/AiGatewayProviderForceDelete" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Delete an AI Gateway provider tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: >- Get a provider by ID, including its routing slug, integration account, and cost multiplier. Credentials stay in the integration account and are never returned. Requires `ai_gateway_config_read` and provider View. Catalog and pricing metadata inherit provider access. Lists omit hidden entries; direct reads of hidden resources return 404. operationId: GetAiGatewayProvider parameters: - $ref: "#/components/parameters/AiGatewayProviderID" responses: "200": content: application/json: examples: default: value: data: attributes: cost_multiplier: 1.0 created_at: "2026-08-24T12:00:00Z" integration_account_id: account-123 known_provider: openai name: prod-us slug: prod-us updated_at: "2026-08-24T12:00:00Z" id: "42" type: providers schema: $ref: "#/components/schemas/AiGatewayProviderResponse" description: OK "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: Get an AI Gateway provider tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: >- Update a provider's display name or cost multiplier. Provider type, integration settings, and slug are immutable. Requires `ai_gateway_config_write` and provider Edit. Models and pricing inherit provider access. operationId: UpdateAiGatewayProvider parameters: - $ref: "#/components/parameters/AiGatewayProviderID" requestBody: content: application/json: schema: $ref: "#/components/schemas/AiGatewayProviderUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: cost_multiplier: 1.0 created_at: "2026-08-24T12:00:00Z" integration_account_id: account-123 known_provider: openai name: prod-us slug: prod-us updated_at: "2026-08-24T12:00:00Z" id: "42" type: providers schema: $ref: "#/components/schemas/AiGatewayProviderResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Update an AI Gateway provider tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/providers/{provider_id}/models: get: description: >- List all model catalog entries for a provider. Requires `ai_gateway_config_read` and provider View. Catalog and pricing metadata inherit provider access. Lists omit hidden entries; direct reads of hidden resources return 404. operationId: ListAiGatewayModels parameters: - $ref: "#/components/parameters/AiGatewayProviderIDForModels" responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2026-08-24T12:00:00Z" enabled: true model_id_canonical: gpt-5.2-codex model_id_wire: gpt-5.2-codex-20260801 provider_id: 42 source: discovered supported_operations: - OPENAI_CHAT_COMPLETIONS updated_at: "2026-08-24T12:00:00Z" id: "101" type: model-catalog-entries schema: $ref: "#/components/schemas/AiGatewayModelCatalogEntryListResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: List models for an AI Gateway provider tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Requires `ai_gateway_config_write` and provider Edit. Models and pricing inherit provider access. Add a manually managed model catalog entry to a provider. Manually managed entries are not modified by automatic catalog synchronization. operationId: CreateAiGatewayModel parameters: - $ref: "#/components/parameters/AiGatewayProviderIDForModels" requestBody: content: application/json: schema: $ref: "#/components/schemas/AiGatewayModelCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2026-08-24T12:00:00Z" enabled: true model_id_canonical: gpt-5.2-codex model_id_wire: gpt-5.2-codex-20260801 provider_id: 42 source: manual supported_operations: - OPENAI_CHAT_COMPLETIONS updated_at: "2026-08-24T12:00:00Z" id: "101" type: model-catalog-entries schema: $ref: "#/components/schemas/AiGatewayModelCatalogEntryResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Add a model to an AI Gateway provider tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/providers/{provider_id}/models/bulk: post: description: |- Requires `ai_gateway_config_write` and provider Edit. Models and pricing inherit provider access. Add multiple manually managed model catalog entries to a provider in a single request. Manually managed entries are not modified by automatic catalog synchronization. operationId: BulkCreateAiGatewayModels parameters: - $ref: "#/components/parameters/AiGatewayProviderIDForModels" requestBody: content: application/json: schema: $ref: "#/components/schemas/AiGatewayModelsBulkCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: - attributes: created_at: "2026-08-24T12:00:00Z" enabled: true model_id_canonical: gpt-5.2-codex model_id_wire: gpt-5.2-codex-20260801 provider_id: 42 source: manual supported_operations: - OPENAI_CHAT_COMPLETIONS updated_at: "2026-08-24T12:00:00Z" id: "101" type: model-catalog-entries schema: $ref: "#/components/schemas/AiGatewayModelCatalogEntryListResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Add multiple models to an AI Gateway provider tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/providers/{provider_id}/models/{canonical}: delete: description: |- Requires `ai_gateway_config_write` and provider Edit. Models and pricing inherit provider access. Delete a manually managed model catalog entry by its canonical model ID. Discovered entries are read-only. operationId: DeleteAiGatewayModel parameters: - $ref: "#/components/parameters/AiGatewayProviderIDForModels" - $ref: "#/components/parameters/AiGatewayModelCanonicalID" responses: "204": description: No Content "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Delete a model from an AI Gateway provider tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: >- Update a manually managed model catalog entry. Discovered entries are read-only. Requires `ai_gateway_config_write` and provider Edit. Models and pricing inherit provider access. operationId: UpdateAiGatewayModel parameters: - $ref: "#/components/parameters/AiGatewayProviderIDForModels" - $ref: "#/components/parameters/AiGatewayModelCanonicalID" requestBody: content: application/json: schema: $ref: "#/components/schemas/AiGatewayModelUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-08-24T12:00:00Z" enabled: true model_id_canonical: gpt-5.2-codex model_id_wire: gpt-5.2-codex-20260801 provider_id: 42 source: manual supported_operations: - OPENAI_CHAT_COMPLETIONS updated_at: "2026-08-24T12:00:00Z" id: "101" type: model-catalog-entries schema: $ref: "#/components/schemas/AiGatewayModelCatalogEntryResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Update a model for an AI Gateway provider tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/providers/{provider_id}/models/{canonical}/pricing: delete: description: >- Clear a custom provider model's pricing override. Requires `ai_gateway_config_write` and provider Edit. Models and pricing inherit provider access. operationId: DeleteAiGatewayModelPricing parameters: - $ref: "#/components/parameters/AiGatewayProviderIDForModels" - $ref: "#/components/parameters/AiGatewayModelCanonicalID" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Delete a model pricing override tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: >- Get a custom provider model's pricing override and effective pricing source. Requires `ai_gateway_config_read` and provider View. Catalog and pricing metadata inherit provider access. Lists omit hidden entries; direct reads of hidden resources return 404. operationId: GetAiGatewayModelPricing parameters: - $ref: "#/components/parameters/AiGatewayProviderIDForModels" - $ref: "#/components/parameters/AiGatewayModelCanonicalID" responses: "200": content: application/json: examples: default: value: data: attributes: effective_source: model_override pricing_config: rates: cache_read_cost_per_mtok: 0.02 cache_write_cost_per_mtok: 0.25 non_cached_input_cost_per_mtok: 0.2 output_cost_per_mtok: 1.0 source: type: custom version: 1 id: 7/custom-model type: model-pricing schema: $ref: "#/components/schemas/AiGatewayModelPricingResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: Get a model pricing override tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: >- Set a custom provider model's pricing override. Requires `ai_gateway_config_write` and provider Edit. Models and pricing inherit provider access. operationId: UpdateAiGatewayModelPricing parameters: - $ref: "#/components/parameters/AiGatewayProviderIDForModels" - $ref: "#/components/parameters/AiGatewayModelCanonicalID" requestBody: content: application/json: examples: catalog: summary: Use catalog pricing with an override value: data: attributes: pricing_config: overrides: output_cost_per_mtok: 9.5 source: provider_id: openai type: catalog version: 1 id: 7/gpt-4o type: model-pricing custom: summary: Set custom pricing value: data: attributes: pricing_config: rates: cache_read_cost_per_mtok: 0.02 cache_write_cost_per_mtok: 0.25 non_cached_input_cost_per_mtok: 0.2 output_cost_per_mtok: 1.0 source: type: custom version: 1 id: 7/custom-model type: model-pricing schema: $ref: "#/components/schemas/AiGatewayModelPricingRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: effective_source: model_override pricing_config: rates: cache_read_cost_per_mtok: 0.02 cache_write_cost_per_mtok: 0.25 non_cached_input_cost_per_mtok: 0.2 output_cost_per_mtok: 1.0 source: type: custom version: 1 id: 7/custom-model type: model-pricing schema: $ref: "#/components/schemas/AiGatewayModelPricingResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Set a model pricing override tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/pruned_trace/{trace_id}: get: description: |- Retrieve a pruned, hierarchical view of an APM trace by its trace ID. The trace is summarized as a tree of spans rooted at the trace root and reduced in size to keep rendering large traces in the UI practical. A `400 Bad Request` response means the trace ID is malformed. A `404 Not Found` response means no trace with this ID is available, such as when the trace is outside the retention period. This endpoint is rate limited to `60` requests per minute per organization. operationId: GetPrunedTraceByID parameters: - $ref: "#/components/parameters/TraceIDPathParameter" - description: |- Span ID to expand and preserve in the pruned tree even when its branch would normally be summarized. example: 9876543210987654321 in: query name: expand_span_id required: false schema: format: int64 type: integer - description: |- Optional Unix time hint, in seconds, used to optimize the lookup of the trace in long-term storage. example: 1716800000 in: query name: time_hint required: false schema: format: int32 maximum: 2147483647 type: integer - description: |- Force the trace to be loaded from a specific source. When unset, the API picks the source automatically. example: driveline in: query name: force_source required: false schema: type: string - description: |- Restrict the pruned tree to spans matching the given `key:value` pairs. Values may be passed as repeated query parameters. example: - service:web-store in: query name: include_path required: false schema: items: type: string type: array - description: |- Regex patterns of tag keys whose values must be included in the pruned spans. Values may be passed as repeated query parameters. example: - "^http\\." in: query name: tag_include required: false schema: items: type: string type: array - description: |- Regex patterns of tag keys whose values must be excluded from the pruned spans. Values may be passed as repeated query parameters. example: - "^_dd\\." in: query name: tag_exclude required: false schema: items: type: string type: array - description: When set to `true`, only service entry spans are included in the pruned tree. example: false in: query name: only_service_entry_spans required: false schema: type: boolean responses: "200": content: application/json: examples: default: value: data: attributes: is_truncated: false size_bytes: 12345 summarized_trace: root: children: [] durationSeconds: 0.5 endTime: "2026-05-27T12:00:00.5Z" error: 0 hidden_child_spans_count: 0 meta: env: production metrics: http.status_code: 200 name: web.request parentID: 0 resource: GET /products service: web-store spanID: 9876543210987654321 span_kind: SERVER startTime: "2026-05-27T12:00:00Z" traceId: "0000000000000000abc1230000000000" id: "0000000000000000abc1230000000000" type: pruned_trace schema: $ref: "#/components/schemas/PrunedTraceResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "504": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Gateway Timeout security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_read summary: Get a pruned trace by ID tags: - APM Trace x-permission: operator: OR permissions: - apm_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/query/scalar: post: description: |- Query scalar values (as seen on Query Value, Table, and Toplist widgets). Multiple data sources are supported with the ability to process the data using formulas and functions. operationId: QueryScalarData requestBody: content: "application/json": examples: default: value: data: attributes: formulas: - formula: a+b limit: count: 10 from: 1568899800000 queries: - aggregator: avg data_source: metrics query: avg:system.cpu.user{*} by {env} to: 1568923200000 type: scalar_request schema: $ref: "#/components/schemas/ScalarFormulaQueryRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: columns: [] type: scalar_response schema: $ref: "#/components/schemas/ScalarFormulaQueryResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - timeseries_query summary: Query scalar data across multiple products tags: - Metrics x-codegen-request-body-name: body "x-permission": operator: OR permissions: - timeseries_query /api/v2/query/timeseries: post: description: |- Query timeseries data across various data sources and process the data by applying formulas and functions. Datadog recommends using this endpoint over the v1 `/api/v1/query` endpoint for querying timeseries data. operationId: QueryTimeseriesData requestBody: content: "application/json": examples: default: value: data: attributes: formulas: - formula: a+b limit: count: 10 from: 1568899800000 interval: 5000 queries: - data_source: metrics query: avg:system.cpu.user{*} by {env} to: 1568923200000 type: timeseries_request schema: $ref: "#/components/schemas/TimeseriesFormulaQueryRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: series: [] times: [] values: [] type: timeseries_response schema: $ref: "#/components/schemas/TimeseriesFormulaQueryResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - timeseries_query summary: Query timeseries data across multiple products tags: - Metrics x-codegen-request-body-name: body "x-permission": operator: OR permissions: - timeseries_query /api/v2/rate-limits: get: description: List the organization's AI Gateway rate limits. operationId: ListAiGatewayRateLimits responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2026-09-01T00:00:00Z" created_by: user@example.com enabled: true input_tokens_per_minute: 500000 mode: ALERT name: Default rate limit output_tokens_per_minute: 200000 requests_per_minute: 1000 revision: 1 tags: provider: openai updated_at: "2026-09-15T14:30:00Z" updated_by: user@example.com id: 33333333-3333-3333-3333-333333333333 type: rate-limits schema: $ref: "#/components/schemas/AiGatewayRateLimitListResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: List AI Gateway rate limits tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a rate limit. All requests matching its scope share one allowance, and every matching rate limit applies. Returns 409 when another active rate limit has the same user, Team, and tags, or when the organization already has the maximum number of rate limits. operationId: CreateAiGatewayRateLimit requestBody: content: application/json: schema: $ref: "#/components/schemas/AiGatewayRateLimitCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2026-09-01T00:00:00Z" created_by: user@example.com enabled: true input_tokens_per_minute: 500000 mode: ALERT name: Default rate limit output_tokens_per_minute: 200000 requests_per_minute: 1000 revision: 1 tags: provider: openai updated_at: "2026-09-01T00:00:00Z" updated_by: user@example.com id: 33333333-3333-3333-3333-333333333333 type: rate-limits schema: $ref: "#/components/schemas/AiGatewayRateLimitResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Create an AI Gateway rate limit tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/rate-limits/usage: get: description: Get live usage for the organization's rate limits. Returns requests and tokens counted in the rolling one-minute window and requests limited in the last 15 minutes for each enabled rate limit, plus `untracked` (traffic no enforced rate limit covers) and `total` (all gateway traffic). operationId: GetAiGatewayRateLimitUsage responses: "200": content: application/json: examples: default: value: data: - attributes: input_tokens: 45000 limited_requests: 3 output_tokens: 12000 requests: 120 would_limit_requests: 0 id: 33333333-3333-3333-3333-333333333333 type: rate-limit-usage - attributes: input_tokens: 160000 limited_requests: 3 output_tokens: 41000 requests: 450 would_limit_requests: 0 id: total type: rate-limit-usage - attributes: input_tokens: 115000 limited_requests: 0 output_tokens: 29000 requests: 330 would_limit_requests: 0 id: untracked type: rate-limit-usage schema: $ref: "#/components/schemas/AiGatewayRateLimitUsageListResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: Get AI Gateway rate limit usage tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/rate-limits/{id}: delete: description: Archive a rate limit by ID. An archived rate limit no longer appears in lists or lookups, and its alert monitor is deleted. operationId: DeleteAiGatewayRateLimit parameters: - $ref: "#/components/parameters/AiGatewayRateLimitID" responses: "204": description: No Content "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Archive an AI Gateway rate limit tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a rate limit by ID, including its scope, per-minute request and token limits, and whether it is enabled. operationId: GetAiGatewayRateLimit parameters: - $ref: "#/components/parameters/AiGatewayRateLimitID" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-09-01T00:00:00Z" created_by: user@example.com enabled: true input_tokens_per_minute: 500000 mode: ALERT name: Default rate limit output_tokens_per_minute: 200000 requests_per_minute: 1000 revision: 1 tags: provider: openai updated_at: "2026-09-15T14:30:00Z" updated_by: user@example.com id: 33333333-3333-3333-3333-333333333333 type: rate-limits schema: $ref: "#/components/schemas/AiGatewayRateLimitResponse" description: OK "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: Get an AI Gateway rate limit tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update a rate limit. Only the attributes sent are changed. Scope stays editable, and changes never reset current usage. Returns 409 when the rule was changed concurrently or the new scope duplicates another rule. operationId: UpdateAiGatewayRateLimit parameters: - $ref: "#/components/parameters/AiGatewayRateLimitID" requestBody: content: application/json: schema: $ref: "#/components/schemas/AiGatewayRateLimitUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-09-01T00:00:00Z" created_by: user@example.com enabled: true input_tokens_per_minute: 500000 mode: ALERT name: Default rate limit output_tokens_per_minute: 200000 requests_per_minute: 1000 revision: 2 tags: provider: openai updated_at: "2026-09-15T14:30:00Z" updated_by: user@example.com id: 33333333-3333-3333-3333-333333333333 type: rate-limits schema: $ref: "#/components/schemas/AiGatewayRateLimitResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Update an AI Gateway rate limit tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/reference-tables/queries/batch-rows: post: description: >- Batch query reference table rows by their primary key values. Returns only found rows in the included array. operationId: BatchRowsQuery requestBody: content: application/json: examples: default: value: data: attributes: row_ids: - row_id_1 - row_id_2 table_id: 00000000-0000-0000-0000-000000000000 type: reference-tables-batch-rows-query happy_path: summary: Batch query reference table rows by their primary key values. value: data: attributes: row_ids: - "row_id_1" - "row_id_2" table_id: 00000000-0000-0000-0000-000000000000 type: reference-tables-batch-rows-query schema: $ref: "#/components/schemas/BatchRowsQueryRequest" required: true responses: "200": content: application/json: examples: default: value: data: id: 00000000-0000-0000-0000-000000000000 relationships: rows: data: - id: row_id_1 type: row - id: row_id_2 type: row type: reference-tables-batch-rows-query schema: $ref: "#/components/schemas/BatchRowsQueryResponse" description: >- Successfully retrieved rows. Some or all requested rows were found. Response includes found rows in the included section. "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Batch rows query tags: - Reference Tables /api/v2/reference-tables/tables: get: description: List all reference tables in this organization. operationId: ListTables parameters: - description: Number of tables to return. example: 15 in: query name: page[limit] required: false schema: default: 15 format: int64 maximum: 100 minimum: 1 type: integer - description: Number of tables to skip for pagination. example: 0 in: query name: page[offset] required: false schema: default: 0 format: int64 minimum: 0 type: integer - description: >- Sort field and direction for the list of reference tables. Use field name for ascending, prefix with "-" for descending. example: "-updated_at" in: query name: sort required: false schema: $ref: "#/components/schemas/ReferenceTableSortType" - description: Filter by table status. example: DONE in: query name: filter[status] required: false schema: type: string - description: Filter by exact table name match. example: "my_reference_table" in: query name: filter[table_name][exact] required: false schema: type: string - description: Filter by table name containing substring. example: "user" in: query name: filter[table_name][contains] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: status: DONE table_name: my_reference_table id: abc-123 type: reference_table schema: $ref: "#/components/schemas/TableResultV2Array" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List tables tags: - Reference Tables post: description: |- Creates a reference table. You can provide data in two ways: 1. Call POST /api/v2/reference-tables/upload to get an upload ID. Then, PUT the CSV data (not the file itself) in chunks to each URL in the request body. Finally, call this POST endpoint with `upload_id` in `file_metadata`. 2. Provide `access_details` in `file_metadata` pointing to a CSV file in cloud storage. operationId: CreateReferenceTable requestBody: content: application/json: examples: cloud_storage: summary: Create table from cloud storage (S3) value: data: attributes: description: Customer reference data synced from S3 file_metadata: access_details: aws_detail: aws_account_id: "924305315327" aws_bucket_name: my-data-bucket file_path: customers.csv sync_enabled: true schema: fields: - name: customer_id type: STRING - name: customer_name type: STRING - name: email type: STRING primary_keys: - customer_id source: S3 table_name: customer_reference_data tags: - team:data-platform type: reference_table default: value: data: attributes: description: Customer reference data synced from S3 file_metadata: access_details: aws_detail: aws_account_id: "924305315327" aws_bucket_name: my-data-bucket file_path: customers.csv sync_enabled: true schema: fields: - name: customer_id type: STRING - name: customer_name type: STRING - name: email type: STRING primary_keys: - customer_id source: S3 table_name: customer_reference_data tags: - team:data-platform type: reference_table local_file: summary: Create table from local file upload value: data: attributes: description: Product catalog uploaded via local file file_metadata: upload_id: "00000000-0000-0000-0000-000000000000" schema: fields: - name: product_id type: STRING - name: product_name type: STRING - name: price type: DOUBLE primary_keys: - product_id source: LOCAL_FILE table_name: product_catalog tags: - team:ecommerce type: reference_table schema: $ref: "#/components/schemas/CreateTableRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: status: DONE table_name: my_reference_table id: abc-123 type: reference_table schema: $ref: "#/components/schemas/TableResultV2" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create reference table tags: - Reference Tables /api/v2/reference-tables/tables/{id}: delete: description: Delete a reference table by ID operationId: DeleteTable parameters: - description: Unique identifier of the reference table to delete in: path name: id required: true schema: type: string responses: "200": description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete table tags: - Reference Tables get: description: Get a reference table by ID operationId: GetTable parameters: - description: Unique identifier of the reference table to retrieve in: path name: id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_by: 00000000-0000-0000-0000-000000000000 description: example description file_metadata: access_details: {} sync_enabled: false last_updated_by: 00000000-0000-0000-0000-000000000000 row_count: 5 schema: fields: - name: id type: INT32 - name: name type: STRING primary_keys: - id source: S3 status: DONE table_name: test_reference_table tags: - tag1 updated_at: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000000 type: reference_table schema: $ref: "#/components/schemas/TableResultV2" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get table tags: - Reference Tables patch: description: >- Update a reference table by ID. You can update the table's data, description, and tags. Note: The source type cannot be changed after table creation. For data updates: For existing tables of type `source:LOCAL_FILE`, call POST api/v2/reference-tables/uploads first to get an upload ID, then PUT chunks of CSV data to each provided URL, and finally call this PATCH endpoint with the upload_id in file_metadata. For existing tables with `source:` types of `S3`, `GCS`, or `AZURE`, provide updated access_details in file_metadata pointing to a CSV file in the same type of cloud storage. operationId: UpdateReferenceTable parameters: - description: Unique identifier of the reference table to update in: path name: id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: description: this is a cloud table generated via a cloud bucket sync file_metadata: access_details: aws_detail: aws_account_id: test-account-id aws_bucket_name: test-bucket file_path: test_rt.csv sync_enabled: true schema: fields: - name: id type: INT32 - name: name type: STRING primary_keys: - id tags: - test_tag type: reference_table schema: $ref: "#/components/schemas/PatchTableRequest" required: true responses: "200": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update reference table tags: - Reference Tables /api/v2/reference-tables/tables/{id}/rows: delete: description: Delete multiple rows from a Reference Table by their primary key values. operationId: DeleteRows parameters: - description: Unique identifier of the reference table to delete rows from in: path name: id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: - id: primary_key_value type: row schema: $ref: "#/components/schemas/BatchDeleteRowsRequestArray" required: true responses: "200": description: Rows deleted successfully "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "412": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Precondition Failed "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete rows tags: - Reference Tables get: description: Get reference table rows by their primary key values. operationId: GetRowsByID parameters: - description: Unique identifier of the reference table to get rows from example: "table-123" in: path name: id required: true schema: type: string - description: List of row IDs (primary key values) to retrieve from the reference table. example: ["row1", "row2"] explode: true in: query name: row_id required: true schema: items: type: string type: array responses: "200": content: application/json: examples: default: value: data: - attributes: values: id: 1 name: Example Row id: row_id_1 type: row meta: found_count: 1 not_found: - row_id_2 requested_count: 2 schema: $ref: "#/components/schemas/TableRowResourceArray" description: Some or all requested rows were found. "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get rows by id tags: - Reference Tables post: description: >- Create or update rows in a Reference Table by their primary key values. If a row with the specified primary key exists, it is updated; otherwise, a new row is created. operationId: UpsertRows parameters: - description: Unique identifier of the reference table to upsert rows into in: path name: id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: - attributes: values: age: 25 example_key_value: primary_key_value name: row_name id: primary_key_value type: row happy_path: summary: Upsert a row with mixed string and int values value: data: - attributes: values: age: 25 example_key_value: "primary_key_value" name: "row_name" id: "primary_key_value" type: row schema: $ref: "#/components/schemas/BatchUpsertRowsRequestArray" required: true responses: "200": description: Rows created or updated successfully "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "412": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Precondition Failed "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Upsert rows tags: - Reference Tables /api/v2/reference-tables/tables/{id}/rows/list: get: description: >- List all rows in a reference table using cursor-based pagination. Pass the `page[continuation_token]` from the previous response to fetch the next page on the same consistent snapshot. Returns 400 for tables with more than 10,000,000 rows. operationId: ListReferenceTableRows parameters: - description: Unique identifier of the reference table to list rows from. example: "00000000-0000-0000-0000-000000000000" in: path name: id required: true schema: type: string - description: Number of rows to return per page. Defaults to 100, maximum is 1000. example: 100 in: query name: page[limit] required: false schema: default: 100 format: int64 maximum: 1000 minimum: 1 type: integer - description: >- Opaque cursor from the previous response's next link. Pass this to retrieve the next page on the same consistent snapshot. example: "eyJzaWQiOjEyMzQ1LCJwayI6ImV4YW1wbGVfcGsifQ==" in: query name: page[continuation_token] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: values: category: tor intention: suspicious ip_address: 102.130.113.9 id: 102.130.113.9 type: row links: first: "/api/v2/reference-tables/tables//rows/list?page[limit]=100" next: "/api/v2/reference-tables/tables//rows/list?page[continuation_token]=" self: "/api/v2/reference-tables/tables//rows/list?page[continuation_token]=" schema: $ref: "#/components/schemas/ListRowsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List rows tags: - Reference Tables /api/v2/reference-tables/uploads: post: description: Create a reference table upload for bulk data ingestion operationId: CreateReferenceTableUpload requestBody: content: application/json: examples: default: value: data: attributes: headers: - product_id - product_name - price part_count: 3 part_size: 10000000 table_name: my_products_table type: upload schema: $ref: "#/components/schemas/CreateUploadRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: part_urls: - https://example.com/upload-part-1 id: 00000000-0000-0000-0000-000000000000 type: upload schema: $ref: "#/components/schemas/CreateUploadResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create reference table upload tags: - Reference Tables /api/v2/remote_config/products/asm/waf/custom_rules: get: description: Retrieve a list of WAF custom rule. operationId: ListApplicationSecurityWAFCustomRules responses: "200": content: application/json: examples: default: value: data: - attributes: blocking: false conditions: - operator: match_regex parameters: inputs: - address: server.request.query key_path: - id regex: path.* enabled: false name: Block request from bad useragent tags: category: attack_attempt type: lfi id: 00000000-0000-0000-0000-000000000003 type: custom_rule schema: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleListResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List all WAF custom rules tags: - "Application Security" post: description: Create a new WAF custom rule with the given parameters. operationId: CreateApplicationSecurityWafCustomRule requestBody: content: application/json: examples: default: value: data: attributes: action: action: block_request parameters: location: /blocking status_code: 403 blocking: false conditions: - operator: match_regex parameters: data: blocked_users regex: path.* value: custom_tag enabled: false name: Block request from a bad useragent path_glob: /api/search/* scope: - env: prod service: billing-service tags: category: business_logic type: users.login.success type: custom_rule schema: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleCreateRequest" description: The definition of the new WAF Custom Rule. required: true responses: "201": content: "application/json": examples: default: value: data: attributes: blocking: false conditions: - operator: match_regex parameters: inputs: - address: server.request.query key_path: - id regex: path.* enabled: false name: Block request from a bad useragent tags: category: attack_attempt type: lfi id: 00000000-0000-0000-0000-000000000004 type: custom_rule schema: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "409": $ref: "#/components/responses/ConcurrentModificationResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a WAF custom rule tags: - "Application Security" x-codegen-request-body-name: body /api/v2/remote_config/products/asm/waf/custom_rules/{custom_rule_id}: delete: description: Delete a specific WAF custom rule. operationId: DeleteApplicationSecurityWafCustomRule parameters: - $ref: "#/components/parameters/ApplicationSecurityWafCustomRuleIDParam" responses: "204": description: No Content "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConcurrentModificationResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a WAF Custom Rule tags: - "Application Security" x-terraform-resource: appsec_waf_custom_rule get: description: Retrieve a WAF custom rule by ID. operationId: GetApplicationSecurityWafCustomRule parameters: - $ref: "#/components/parameters/ApplicationSecurityWafCustomRuleIDParam" responses: "200": content: application/json: examples: default: value: data: attributes: blocking: false conditions: - operator: match_regex parameters: inputs: - address: server.request.query key_path: - id regex: path.* enabled: false name: Block request from bad useragent tags: category: attack_attempt type: lfi id: 00000000-0000-0000-0000-000000000001 type: custom_rule schema: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a WAF custom rule tags: - "Application Security" x-terraform-resource: appsec_waf_custom_rule put: description: |- Update a specific WAF custom Rule. Returns the Custom Rule object when the request is successful. operationId: UpdateApplicationSecurityWafCustomRule parameters: - $ref: "#/components/parameters/ApplicationSecurityWafCustomRuleIDParam" requestBody: content: application/json: examples: default: value: data: attributes: action: action: block_request parameters: location: /blocking status_code: 403 blocking: false conditions: - operator: match_regex parameters: data: blocked_users inputs: - address: server.request.query key_path: - id regex: path.* value: custom_tag enabled: false name: Block request from bad useragent path_glob: /api/search/* scope: - env: prod service: billing-service tags: category: business_logic type: users.login.success type: custom_rule schema: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleUpdateRequest" description: New definition of the WAF Custom Rule. required: true responses: "200": content: application/json: examples: default: value: data: attributes: blocking: false conditions: - operator: match_regex parameters: inputs: - address: server.request.query key_path: - id regex: path.* enabled: false name: Block request from bad useragent tags: category: attack_attempt type: lfi id: 00000000-0000-0000-0000-000000000002 type: custom_rule schema: $ref: "#/components/schemas/ApplicationSecurityWafCustomRuleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConcurrentModificationResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a WAF Custom Rule tags: - "Application Security" x-codegen-request-body-name: body x-terraform-resource: appsec_waf_custom_rule /api/v2/remote_config/products/asm/waf/exclusion_filters: get: description: Retrieve a list of WAF exclusion filters. operationId: ListApplicationSecurityWafExclusionFilters responses: "200": content: application/json: examples: default: value: data: - attributes: description: Exclude false positives on a path enabled: true ip_list: - 198.51.100.72 parameters: - list.search.query path_glob: /accounts/* id: 00000000-0000-0000-0000-000000000003 type: exclusion_filter schema: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFiltersResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List all WAF exclusion filters tags: - "Application Security" "x-permission": operator: AND permissions: - appsec_protect_read x-terraform-resource: appsec_waf_exclusion_filter post: description: |- Create a new WAF exclusion filter with the given parameters. A request matched by an exclusion filter will be ignored by the Application Security WAF product. Go to https://app.datadoghq.com/security/appsec/passlist to review existing exclusion filters (also called passlist entries). operationId: CreateApplicationSecurityWafExclusionFilter requestBody: content: application/json: examples: default: value: data: attributes: description: Exclude false positives on a path enabled: true ip_list: - 198.51.100.72 on_match: monitor parameters: - list.search.query path_glob: /accounts/* rules_target: - rule_id: dog-913-009 tags: category: attack_attempt type: lfi scope: - env: www service: prod type: exclusion_filter schema: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterCreateRequest" description: The definition of the new WAF exclusion filter. required: true responses: "200": content: "application/json": examples: default: value: data: attributes: description: Exclude false positives on a path enabled: true ip_list: - 198.51.100.72 parameters: - list.search.query path_glob: /accounts/* id: 00000000-0000-0000-0000-000000000004 type: exclusion_filter schema: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "409": $ref: "#/components/responses/ConcurrentModificationResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a WAF exclusion filter tags: - "Application Security" x-codegen-request-body-name: body "x-permission": operator: AND permissions: - appsec_protect_write x-terraform-resource: appsec_waf_exclusion_filter /api/v2/remote_config/products/asm/waf/exclusion_filters/{exclusion_filter_id}: delete: description: Delete a specific WAF exclusion filter using its identifier. operationId: DeleteApplicationSecurityWafExclusionFilter parameters: - $ref: "#/components/parameters/ApplicationSecurityWafExclusionFilterID" responses: "204": description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConcurrentModificationResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a WAF exclusion filter tags: - "Application Security" "x-permission": operator: AND permissions: - appsec_protect_write x-terraform-resource: appsec_waf_exclusion_filter get: description: Retrieve a specific WAF exclusion filter using its identifier. operationId: GetApplicationSecurityWafExclusionFilter parameters: - $ref: "#/components/parameters/ApplicationSecurityWafExclusionFilterID" responses: "200": content: application/json: examples: default: value: data: attributes: description: Exclude false positives on a path enabled: true ip_list: - 198.51.100.72 parameters: - list.search.query path_glob: /accounts/* id: 00000000-0000-0000-0000-000000000001 type: exclusion_filter schema: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a WAF exclusion filter tags: - "Application Security" "x-permission": operator: AND permissions: - appsec_protect_read x-terraform-resource: appsec_waf_exclusion_filter put: description: |- Update a specific WAF exclusion filter using its identifier. Returns the exclusion filter object when the request is successful. operationId: UpdateApplicationSecurityWafExclusionFilter parameters: - $ref: "#/components/parameters/ApplicationSecurityWafExclusionFilterID" requestBody: content: application/json: examples: default: value: data: attributes: description: Exclude false positives on a path enabled: true ip_list: - 198.51.100.72 on_match: monitor parameters: - list.search.query path_glob: /accounts/* rules_target: - rule_id: dog-913-009 tags: category: attack_attempt type: lfi scope: - env: www service: prod type: exclusion_filter schema: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterUpdateRequest" description: The exclusion filter to update. required: true responses: "200": content: application/json: examples: default: value: data: attributes: description: Exclude false positives on a path enabled: true ip_list: - 198.51.100.72 parameters: - list.search.query path_glob: /accounts/* id: 00000000-0000-0000-0000-000000000002 type: exclusion_filter schema: $ref: "#/components/schemas/ApplicationSecurityWafExclusionFilterResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConcurrentModificationResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a WAF exclusion filter tags: - "Application Security" x-codegen-request-body-name: body "x-permission": operator: AND permissions: - appsec_protect_write x-terraform-resource: appsec_waf_exclusion_filter /api/v2/remote_config/products/asm/waf/policies: get: description: Retrieve a list of WAF policies. operationId: ListApplicationSecurityWAFPolicies responses: "200": content: application/json: examples: default: value: data: - attributes: description: Monitor security scanners and application attacks such as Server-Side-Request-Forgery (SSRF), SQL Injection, Log4Shell, and Cross-Site-Scripting (XSS). isDefault: true name: Managed - Monitoring-only rules: [] rulesets: [] scope: [] version: 0 id: recommended meta: {} type: policy - attributes: description: Block known attack tools without impacting legitimate security scans. isDefault: false name: Managed - Block attack tools protectionPresets: - attack-tools rules: [] rulesets: [] scope: [] version: 0 id: recommended-attack-tools meta: {} type: policy schema: $ref: "#/components/schemas/ApplicationSecurityPolicyListResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List all WAF policies tags: - "Application Security" post: description: Create a new WAF policy. operationId: CreateApplicationSecurityWafPolicy requestBody: content: application/json: examples: default: value: data: attributes: basedOn: recommended description: Policy applied to internal web applications. isDefault: false name: Internal Network Policy protectionPresets: - attack-tools rules: - blocking: false enabled: true id: rasp-001-002 scope: - env: prod service: billing-service version: 0 type: policy schema: $ref: "#/components/schemas/ApplicationSecurityPolicyCreateRequest" description: The new WAF policy. required: true responses: "201": content: "application/json": examples: default: value: data: attributes: description: Policy applied to internal web applications. isDefault: false name: Internal Network Policy protectionPresets: - attack-tools rules: - blocking: false enabled: true id: rasp-001-002 rulesets: [] scope: - env: prod service: billing-service version: 0 id: 841d53b4-4d73-4585-99cc-39dd10883f7c meta: added_at: "2026-04-16T10:25:18Z" added_by: 9919ec9b-ebc7-49ee-8dc8-03626e717cca added_by_name: CI Account type: policy schema: $ref: "#/components/schemas/ApplicationSecurityPolicyResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "409": $ref: "#/components/responses/ConcurrentModificationResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a WAF Policy tags: - "Application Security" x-codegen-request-body-name: body /api/v2/remote_config/products/asm/waf/policies/{policy_id}: delete: description: Delete a specific WAF policy. operationId: DeleteApplicationSecurityWafPolicy parameters: - $ref: "#/components/parameters/ApplicationSecurityPolicyIDParam" responses: "204": description: No Content "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConcurrentModificationResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a WAF Policy tags: - "Application Security" x-terraform-resource: appsec_waf_policy get: description: Retrieve a WAF policy by ID. operationId: GetApplicationSecurityWafPolicy parameters: - $ref: "#/components/parameters/ApplicationSecurityPolicyIDParam" responses: "200": content: application/json: examples: default: value: data: attributes: description: This is a test policy. isDefault: false name: Test policy rules: [] rulesets: [] scope: [] version: -1 id: cc3e574d-9b5a-4310-b7f4-5560483f84b1 meta: added_at: "2026-04-16T10:25:20Z" added_by: 9919ec9b-ebc7-49ee-8dc8-03626e717cca added_by_name: CI Account type: policy schema: $ref: "#/components/schemas/ApplicationSecurityPolicyResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a WAF Policy tags: - "Application Security" x-terraform-resource: appsec_waf_policy put: description: |- Update a specific WAF policy. Returns the policy object when the request is successful. operationId: UpdateApplicationSecurityWafPolicy parameters: - $ref: "#/components/parameters/ApplicationSecurityPolicyIDParam" requestBody: content: application/json: examples: default: value: data: attributes: description: Policy applied to internal web applications. isDefault: false name: Internal Network Policy protectionPresets: - attack-tools rules: - blocking: false enabled: true id: rasp-001-002 scope: - env: prod service: billing-service version: 0 type: policy schema: $ref: "#/components/schemas/ApplicationSecurityPolicyUpdateRequest" description: New WAF policy. required: true responses: "200": content: application/json: examples: default: value: data: attributes: description: Policy applied to internal web applications. isDefault: false name: Internal Network Policy protectionPresets: - attack-tools rules: - blocking: false enabled: true id: rasp-001-002 rulesets: [] scope: - env: prod service: billing-service version: 0 id: 841d53b4-4d73-4585-99cc-39dd10883f7c meta: added_at: "2026-04-16T10:25:18Z" added_by: 9919ec9b-ebc7-49ee-8dc8-03626e717cca added_by_name: CI Account type: policy schema: $ref: "#/components/schemas/ApplicationSecurityPolicyResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConcurrentModificationResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a WAF Policy tags: - "Application Security" x-codegen-request-body-name: body x-terraform-resource: appsec_waf_policy /api/v2/remote_config/products/cws/agent_rules: get: description: |- Get the list of Workload Protection agent rules. **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below. operationId: ListCSMThreatsAgentRules parameters: - $ref: "#/components/parameters/CloudWorkloadSecurityQueryAgentPolicyID" responses: "200": content: "application/json": examples: default: value: data: - attributes: description: My Agent rule enabled: true expression: exec.file.name == "sh" name: my_agent_rule id: abc-123 type: agent_rule schema: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRulesListResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all Workload Protection agent rules tags: ["CSM Threats"] post: description: |- Create a new Workload Protection agent rule with the given parameters. **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below. operationId: CreateCSMThreatsAgentRule requestBody: content: application/json: examples: default: value: data: attributes: description: My Agent rule enabled: true expression: exec.file.name == "sh" name: my_agent_rule policy_id: a8c8e364-6556-434d-b798-a4c23de29c0b silent: false type: agent_rule schema: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleCreateRequest" description: "The definition of the new agent rule" required: true responses: "200": content: "application/json": examples: default: value: data: attributes: description: My Agent rule enabled: true expression: exec.file.name == "sh" name: my_agent_rule id: abc-123 type: agent_rule schema: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a Workload Protection agent rule tags: ["CSM Threats"] x-codegen-request-body-name: body /api/v2/remote_config/products/cws/agent_rules/{agent_rule_id}: delete: description: |- Delete a specific Workload Protection agent rule. **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below. operationId: DeleteCSMThreatsAgentRule parameters: - $ref: "#/components/parameters/CloudWorkloadSecurityAgentRuleID" - $ref: "#/components/parameters/CloudWorkloadSecurityQueryAgentPolicyID" responses: "204": description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a Workload Protection agent rule tags: ["CSM Threats"] get: description: |- Get the details of a specific Workload Protection agent rule. **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below. operationId: GetCSMThreatsAgentRule parameters: - $ref: "#/components/parameters/CloudWorkloadSecurityAgentRuleID" - $ref: "#/components/parameters/CloudWorkloadSecurityQueryAgentPolicyID" responses: "200": content: application/json: examples: default: value: data: attributes: description: My Agent rule enabled: true expression: exec.file.name == "sh" name: my_agent_rule id: abc-123 type: agent_rule schema: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a Workload Protection agent rule tags: ["CSM Threats"] patch: description: |- Update a specific Workload Protection Agent rule. Returns the agent rule object when the request is successful. **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below. operationId: UpdateCSMThreatsAgentRule parameters: - $ref: "#/components/parameters/CloudWorkloadSecurityAgentRuleID" - $ref: "#/components/parameters/CloudWorkloadSecurityQueryAgentPolicyID" requestBody: content: application/json: examples: default: value: data: attributes: description: My Agent rule enabled: true expression: exec.file.name == "sh" policy_id: a8c8e364-6556-434d-b798-a4c23de29c0b silent: false id: 3dd-0uc-h1s type: agent_rule schema: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleUpdateRequest" description: "New definition of the agent rule" required: true responses: "200": content: application/json: examples: default: value: data: attributes: description: My Agent rule enabled: true expression: exec.file.name == "sh" name: my_agent_rule id: abc-123 type: agent_rule schema: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConcurrentModificationResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a Workload Protection agent rule tags: ["CSM Threats"] x-codegen-request-body-name: body /api/v2/remote_config/products/cws/policy: get: description: |- Get the list of Workload Protection policies. **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below. operationId: ListCSMThreatsAgentPolicies responses: "200": content: "application/json": examples: default: value: data: - attributes: description: My agent policy enabled: true name: my_agent_policy id: abc-123 type: policy schema: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPoliciesListResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all Workload Protection policies tags: ["CSM Threats"] post: description: |- Create a new Workload Protection policy with the given parameters. **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below. operationId: CreateCSMThreatsAgentPolicy requestBody: content: application/json: examples: default: value: data: attributes: description: My agent policy enabled: false hostTagsLists: - - env:test name: my_agent_policy type: policy schema: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPolicyCreateRequest" description: "The definition of the new Agent policy" required: true responses: "201": content: "application/json": examples: default: value: data: attributes: description: My agent policy enabled: false name: my_agent_policy id: abc-123 type: policy schema: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPolicyResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a Workload Protection policy tags: ["CSM Threats"] x-codegen-request-body-name: body /api/v2/remote_config/products/cws/policy/download: get: description: |- The download endpoint generates a Workload Protection policy file from your currently active Workload Protection agent rules, and downloads them as a `.policy` file. This file can then be deployed to your agents to update the policy running in your environment. **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below. operationId: DownloadCSMThreatsPolicy responses: "200": content: application/zip: examples: default: value: "" schema: format: binary type: string description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: "Download the Workload Protection policy" tags: ["CSM Threats"] /api/v2/remote_config/products/cws/policy/{policy_id}: delete: description: |- Delete a specific Workload Protection policy. **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below. operationId: DeleteCSMThreatsAgentPolicy parameters: - $ref: "#/components/parameters/CloudWorkloadSecurityPathAgentPolicyID" responses: "202": description: OK "204": description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a Workload Protection policy tags: ["CSM Threats"] get: description: |- Get the details of a specific Workload Protection policy. **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below. operationId: GetCSMThreatsAgentPolicy parameters: - $ref: "#/components/parameters/CloudWorkloadSecurityPathAgentPolicyID" responses: "200": content: application/json: examples: default: value: data: attributes: description: My agent policy enabled: true name: my_agent_policy id: abc-123 type: policy schema: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPolicyResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a Workload Protection policy tags: ["CSM Threats"] patch: description: |- Update a specific Workload Protection policy. Returns the policy object when the request is successful. **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below. operationId: UpdateCSMThreatsAgentPolicy parameters: - $ref: "#/components/parameters/CloudWorkloadSecurityPathAgentPolicyID" requestBody: content: application/json: examples: default: value: data: attributes: description: My agent policy enabled: false name: my_agent_policy id: 6517fcc1-cec7-4394-a655-8d6e9d085255 type: policy schema: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPolicyUpdateRequest" description: "New definition of the Agent policy" required: true responses: "200": content: application/json: examples: default: value: data: attributes: description: My agent policy enabled: false name: my_agent_policy id: abc-123 type: policy schema: $ref: "#/components/schemas/CloudWorkloadSecurityAgentPolicyResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConcurrentModificationResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a Workload Protection policy tags: ["CSM Threats"] x-codegen-request-body-name: body /api/v2/remote_config/products/rum/configs/{config_id}: get: description: Retrieve a RUM SDK configuration by its identifier. operationId: GetRumSdkConfig parameters: - description: The ID of the RUM SDK configuration. example: "abc12345-1234-5678-abcd-ef1234567890" in: path name: config_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: rum: application_id: "f80e917c-3cd0-4048-ade7-1c4c207baa99" default_privacy_level: "mask-user-input" enable_privacy_for_action_name: false env: "production" service: "my-service" session_replay_sample_rate: 10 session_sample_rate: 50 trace_sample_rate: 100 track_session_across_subdomains: false id: "abc12345-1234-5678-abcd-ef1234567890" meta: updated_at: "2024-01-15T09:30:00.000Z" updated_by: "user@datadoghq.com" type: rum_sdk_config schema: $ref: "#/components/schemas/RumSdkConfigResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a RUM SDK configuration tags: - RUM Remote Config x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: |- Update an existing RUM SDK configuration by its identifier. Returns the updated configuration when successful. operationId: UpdateRumSdkConfig parameters: - description: The ID of the RUM SDK configuration. example: "abc12345-1234-5678-abcd-ef1234567890" in: path name: config_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: rum: default_privacy_level: "mask" enable_privacy_for_action_name: true session_replay_sample_rate: 20 session_sample_rate: 75 id: "abc12345-1234-5678-abcd-ef1234567890" type: rum_sdk_config schema: $ref: "#/components/schemas/RumSdkConfigUpdateRequest" description: The RUM SDK configuration update. required: true responses: "200": content: application/json: examples: default: value: data: attributes: rum: application_id: "f80e917c-3cd0-4048-ade7-1c4c207baa99" default_privacy_level: "mask" enable_privacy_for_action_name: true session_replay_sample_rate: 20 session_sample_rate: 75 id: "abc12345-1234-5678-abcd-ef1234567890" type: rum_sdk_config schema: $ref: "#/components/schemas/RumSdkConfigResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a RUM SDK configuration tags: - RUM Remote Config x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_apps_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/replay/heatmap/snapshots: get: description: List heatmap snapshots. operationId: ListReplayHeatmapSnapshots parameters: - description: Device type to filter snapshots. in: query name: filter[device_type] schema: example: desktop type: string - description: View name to filter snapshots. in: query name: filter[view_name] required: true schema: example: /home type: string - description: Maximum number of snapshots to return. in: query name: page[limit] schema: example: 10 format: int64 type: integer - description: Filter by application ID. in: query name: filter[application_id] schema: example: aaaaaaaa-1111-2222-3333-bbbbbbbbbbbb type: string responses: "200": content: application/json: examples: default: value: data: - attributes: device_type: desktop event_id: 11111111-2222-3333-4444-555555555555 snapshot_name: My Snapshot view_name: /home id: 00000000-0000-0000-0000-000000000001 type: snapshots schema: $ref: "#/components/schemas/SnapshotArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List replay heatmap snapshots tags: - Rum Replay Heatmaps x-permission: operator: OR permissions: - rum_session_replay_read post: description: Create a heatmap snapshot. operationId: CreateReplayHeatmapSnapshot requestBody: content: application/json: examples: default: value: data: attributes: application_id: aaaaaaaa-1111-2222-3333-bbbbbbbbbbbb device_type: desktop event_id: 11111111-2222-3333-4444-555555555555 is_device_type_selected_by_user: false snapshot_name: My Snapshot start: 0 view_name: /home type: snapshots schema: $ref: "#/components/schemas/SnapshotCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: device_type: desktop event_id: 11111111-2222-3333-4444-555555555555 snapshot_name: My Snapshot view_name: /home id: 00000000-0000-0000-0000-000000000001 type: snapshots schema: $ref: "#/components/schemas/Snapshot" description: Created "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create replay heatmap snapshot tags: - Rum Replay Heatmaps /api/v2/replay/heatmap/snapshots/{snapshot_id}: delete: description: Delete a heatmap snapshot. operationId: DeleteReplayHeatmapSnapshot parameters: - description: Unique identifier of the heatmap snapshot. in: path name: snapshot_id required: true schema: example: 00000000-0000-0000-0000-000000000001 type: string responses: "204": description: No Content "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete replay heatmap snapshot tags: - Rum Replay Heatmaps patch: description: Update a heatmap snapshot. operationId: UpdateReplayHeatmapSnapshot parameters: - description: Unique identifier of the heatmap snapshot. in: path name: snapshot_id required: true schema: example: 00000000-0000-0000-0000-000000000001 type: string requestBody: content: application/json: examples: default: value: data: attributes: event_id: 11111111-2222-3333-4444-555555555555 is_device_type_selected_by_user: false start: 0 id: 00000000-0000-0000-0000-000000000001 type: snapshots schema: $ref: "#/components/schemas/SnapshotUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: device_type: desktop event_id: 11111111-2222-3333-4444-555555555555 snapshot_name: My Snapshot view_name: /home id: 00000000-0000-0000-0000-000000000001 type: snapshots schema: $ref: "#/components/schemas/Snapshot" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update replay heatmap snapshot tags: - Rum Replay Heatmaps /api/v2/reporting/dataset/{dataset_id}/schedules: get: description: |- Retrieve all report schedules for a given published dataset. Returns report schedules belonging to the authenticated user's organization that target the specified dataset. Requires the `generate_log_reports` or `manage_log_reports` permission. operationId: ListDatasetReportSchedules parameters: - description: The identifier of the published dataset to retrieve report schedules for. example: "MW5vdGVib29rX2NlbGw6ZDI0ZTM2MWMtZDFlNC00NDYwLWIyOWUtNTg3YTczMzA3MDFm" in: path name: dataset_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: cell_id: "sevhjcis" dataset_id: "MW5vdGVib29rX2NlbGw6ZDI0ZTM2MWMtZDFlNC00NDYwLWIyOWUtNTg3YTczMzA3MDFm" description: "This is a scheduled notebook dataset report." file_row_limit: 5000 inline_row_limit: 10 next_recurrence: 1725859200000 notebook_id: 1 recipients: - "test@datadoghq.com" resource_id: "aaaabbbb-1111-2222-3333-444455556666" resource_type: widget_dataset_list rrule: "DTSTART;TZID=America/New_York:20240912T090000\nRRULE:FREQ=DAILY;BYHOUR=9;BYMINUTE=0" status: active timeframe: "calendar_day" timezone: "America/New_York" title: "My Cool Dataset Report" id: "e1234567-1234-1234-1234-123456789012" relationships: author: data: id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" type: users type: schedule included: - attributes: email: "user@example.com" name: "Example User" id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" type: users schema: $ref: "#/components/schemas/DatasetReportScheduleListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List dataset report schedules tags: - Report Schedules /api/v2/reporting/print: post: description: |- Initiate a one-off, print-only report for a dashboard or integration dashboard. The report is rendered as a PDF and made available for download through the URL returned in the response. Requires a reporting permission appropriate to the targeted resource type. operationId: PrintReport requestBody: content: application/json: examples: default: value: data: attributes: resource_id: "abc-def-ghi" resource_type: dashboard template_variables: - name: "env" values: - "prod" timeframe: "1w" timezone: "America/New_York" type: report schema: $ref: "#/components/schemas/PrintReportRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: download_url: "https://app.datadoghq.com/..." from_ts: 1780318800000 resource_id: "abc-def-ghi" resource_type: dashboard template_variables: - name: "env" values: - "prod" timeframe: "1w" timezone: "America/New_York" to_ts: 1780923600000 id: "11111111-2222-3333-4444-555555555555" type: report schema: $ref: "#/components/schemas/PrintReportResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Print a report tags: - Report Schedules x-codegen-request-body-name: body /api/v2/reporting/schedule: post: description: |- Create a new scheduled report. A schedule renders a dashboard or integration dashboard on a recurring cadence and delivers it to the configured recipients over email, Slack, or Microsoft Teams. Requires the `generate_dashboard_reports` permission. operationId: CreateReportSchedule requestBody: content: application/json: examples: default: value: data: attributes: delivery_format: pdf description: "Weekly summary of infrastructure health." recipients: - "user@example.com" - "slack:T01234567.C01234567.alerts" - "teams:11111111-1111-1111-1111-111111111111|22222222-2222-2222-2222-222222222222|19:exampleChannelId@thread.tacv2" resource_id: "abc-def-ghi" resource_type: dashboard rrule: "DTSTART;TZID=America/New_York:20260601T090000\nRRULE:FREQ=WEEKLY;BYDAY=MO;BYHOUR=9;BYMINUTE=0" template_variables: - name: "env" values: - "prod" timeframe: "1w" timezone: "America/New_York" title: "Weekly Infrastructure Report" type: schedule schema: $ref: "#/components/schemas/ReportScheduleCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: delivery_format: pdf description: "Weekly summary of infrastructure health." next_recurrence: 1780923600000 recipients: - "user@example.com" - "slack:T01234567.C01234567.alerts" - "teams:11111111-1111-1111-1111-111111111111|22222222-2222-2222-2222-222222222222|19:exampleChannelId@thread.tacv2" resource_id: "abc-def-ghi" resource_type: dashboard rrule: "DTSTART;TZID=America/New_York:20260601T090000\nRRULE:FREQ=WEEKLY;BYDAY=MO;BYHOUR=9;BYMINUTE=0" status: active tab_id: "66666666-7777-8888-9999-000000000000" template_variables: - name: "env" values: - "prod" timeframe: "1w" timezone: "America/New_York" title: "Weekly Infrastructure Report" id: "11111111-2222-3333-4444-555555555555" relationships: author: data: id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" type: users type: schedule included: - attributes: email: "user@example.com" name: "Example User" id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" type: users schema: $ref: "#/components/schemas/ReportScheduleResponse" description: CREATED "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a report schedule tags: - Report Schedules x-codegen-request-body-name: body x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/reporting/schedule/list: get: description: |- List dashboard and integration dashboard report schedules for the organization. The response is paginated and can be filtered by title, author UUID, or recipients. Requires the `generate_dashboard_reports` permission. operationId: ListReportSchedules parameters: - description: The maximum number of schedules to return. The maximum value is 50. example: 25 in: query name: page[limit] required: false schema: default: 25 format: int64 maximum: 50 minimum: 1 type: integer - description: The offset from which to start returning schedules. example: 0 in: query name: page[offset] required: false schema: default: 0 format: int64 minimum: 0 type: integer - description: Filter schedules by report title. example: "Weekly" in: query name: filter[title] required: false schema: type: string - description: Filter schedules by author UUID. example: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" in: query name: filter[author_uuid] required: false schema: format: uuid type: string - description: Filter schedules by a comma-separated list of recipients. example: "user@example.com,team@example.com" in: query name: filter[recipients] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: delivery_format: pdf description: "Weekly summary of infrastructure health." next_recurrence: 1780923600000 recipients: - "user@example.com" resource_id: "abc-def-ghi" resource_type: dashboard rrule: "DTSTART;TZID=America/New_York:20260601T090000\nRRULE:FREQ=WEEKLY;BYDAY=MO;BYHOUR=9;BYMINUTE=0" status: active template_variables: - name: "env" values: - "prod" timeframe: "1w" timezone: "America/New_York" title: "Weekly Infrastructure Report" id: "11111111-2222-3333-4444-555555555555" relationships: author: data: id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" type: users resource: data: id: "abc-def-ghi" type: resource type: schedule included: - attributes: email: "user@example.com" name: "Example User" id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" type: users - attributes: resource_type: dashboard template_variables: - available_values: - "prod" - "staging" defaults: - "prod" name: "env" prefix: "env" title: "Infrastructure Overview" id: "abc-def-ghi" type: resource links: first: "https://api.datadoghq.com/api/v2/reporting/schedule/list?page[offset]=0&page[limit]=25" last: next: "https://api.datadoghq.com/api/v2/reporting/schedule/list?page[offset]=25&page[limit]=25" prev: self: "https://api.datadoghq.com/api/v2/reporting/schedule/list?page[limit]=25" meta: pagination: first_offset: 0 last_offset: 0 limit: 25 next_offset: 25 offset: 0 prev_offset: 0 total: 1 type: offset_limit schema: $ref: "#/components/schemas/ReportScheduleListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List report schedules tags: - Report Schedules /api/v2/reporting/schedule/{resource_type}/{resource_id}: get: description: |- Get all report schedules that target a dashboard or integration dashboard resource. Requires a reporting read permission appropriate to the targeted resource type. operationId: GetReportSchedulesForResource parameters: - description: The type of resource to fetch report schedules for. example: dashboard in: path name: resource_type required: true schema: $ref: "#/components/schemas/ReportScheduleResourceType" - description: The identifier of the resource to fetch report schedules for. example: "abc-def-ghi" in: path name: resource_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: delivery_format: pdf description: "Weekly summary of infrastructure health." next_recurrence: 1780923600000 recipients: - "user@example.com" resource_id: "abc-def-ghi" resource_type: dashboard rrule: "DTSTART;TZID=America/New_York:20260601T090000\nRRULE:FREQ=WEEKLY;BYDAY=MO;BYHOUR=9;BYMINUTE=0" status: active tab_id: "66666666-7777-8888-9999-000000000000" template_variables: - name: "env" values: - "prod" timeframe: "1w" timezone: "America/New_York" title: "Weekly Infrastructure Report" id: "11111111-2222-3333-4444-555555555555" type: schedule included: - attributes: email: "user@example.com" name: "Example User" id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" type: users schema: $ref: "#/components/schemas/ReportScheduleListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get report schedules for a resource tags: - Report Schedules /api/v2/reporting/schedule/{schedule_uuid}: delete: description: |- Delete a report schedule by its unique identifier. The response returns the deleted schedule. Requires a reporting write permission appropriate to the targeted resource type and schedule ownership. operationId: DeleteReportSchedule parameters: - description: The unique identifier of the report schedule to delete. example: "11111111-2222-3333-4444-555555555555" in: path name: schedule_uuid required: true schema: format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: delivery_format: pdf description: "Weekly summary of infrastructure health." next_recurrence: 1780923600000 recipients: - "user@example.com" resource_id: "abc-def-ghi" resource_type: dashboard rrule: "DTSTART;TZID=America/New_York:20260601T090000\nRRULE:FREQ=WEEKLY;BYDAY=MO;BYHOUR=9;BYMINUTE=0" status: inactive tab_id: "66666666-7777-8888-9999-000000000000" template_variables: - name: "env" values: - "prod" timeframe: "1w" timezone: "America/New_York" title: "Weekly Infrastructure Report" id: "11111111-2222-3333-4444-555555555555" type: schedule included: - attributes: email: "user@example.com" name: "Example User" id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" type: users schema: $ref: "#/components/schemas/ReportScheduleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a report schedule tags: - Report Schedules get: description: |- Get a report schedule by its unique identifier. Requires a reporting read permission appropriate to the targeted resource type. operationId: GetReportSchedule parameters: - description: The unique identifier of the report schedule to fetch. example: "11111111-2222-3333-4444-555555555555" in: path name: schedule_uuid required: true schema: format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: delivery_format: pdf description: "Weekly summary of infrastructure health." next_recurrence: 1780923600000 recipients: - "user@example.com" resource_id: "abc-def-ghi" resource_type: dashboard rrule: "DTSTART;TZID=America/New_York:20260601T090000\nRRULE:FREQ=WEEKLY;BYDAY=MO;BYHOUR=9;BYMINUTE=0" status: active tab_id: "66666666-7777-8888-9999-000000000000" template_variables: - name: "env" values: - "prod" timeframe: "1w" timezone: "America/New_York" title: "Weekly Infrastructure Report" id: "11111111-2222-3333-4444-555555555555" type: schedule included: - attributes: email: "user@example.com" name: "Example User" id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" type: users schema: $ref: "#/components/schemas/ReportScheduleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a report schedule tags: - Report Schedules patch: description: |- Update an existing scheduled report by its identifier. The editable attributes are replaced with the supplied values; the targeted resource (`resource_id` and `resource_type`) cannot be changed after creation. Requires the `generate_dashboard_reports` permission and schedule ownership. operationId: PatchReportSchedule parameters: - description: The unique identifier of the report schedule to update. example: "11111111-2222-3333-4444-555555555555" in: path name: schedule_uuid required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: delivery_format: pdf description: "Updated weekly summary of infrastructure health." recipients: - "user@example.com" - "slack:T01234567.C01234567.alerts" - "teams:11111111-1111-1111-1111-111111111111|22222222-2222-2222-2222-222222222222|19:exampleChannelId@thread.tacv2" rrule: "DTSTART;TZID=America/New_York:20260601T090000\nRRULE:FREQ=WEEKLY;BYDAY=MO;BYHOUR=9;BYMINUTE=0" template_variables: - name: "env" values: - "prod" timeframe: "1w" timezone: "America/New_York" title: "Weekly Infrastructure Report" type: schedule schema: $ref: "#/components/schemas/ReportSchedulePatchRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: delivery_format: pdf description: "Updated weekly summary of infrastructure health." next_recurrence: 1780923600000 recipients: - "user@example.com" - "slack:T01234567.C01234567.alerts" - "teams:11111111-1111-1111-1111-111111111111|22222222-2222-2222-2222-222222222222|19:exampleChannelId@thread.tacv2" resource_id: "abc-def-ghi" resource_type: dashboard rrule: "DTSTART;TZID=America/New_York:20260601T090000\nRRULE:FREQ=WEEKLY;BYDAY=MO;BYHOUR=9;BYMINUTE=0" status: active tab_id: "66666666-7777-8888-9999-000000000000" template_variables: - name: "env" values: - "prod" timeframe: "1w" timezone: "America/New_York" title: "Weekly Infrastructure Report" id: "11111111-2222-3333-4444-555555555555" relationships: author: data: id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" type: users type: schedule included: - attributes: email: "user@example.com" name: "Example User" id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" type: users schema: $ref: "#/components/schemas/ReportScheduleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a report schedule tags: - Report Schedules x-codegen-request-body-name: body x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/reporting/schedule/{schedule_uuid}/toggle: patch: description: |- Activate or pause a report schedule by setting its status to `active` or `inactive`. Requires a reporting write permission appropriate to the targeted resource type and schedule ownership. operationId: ToggleReportSchedule parameters: - description: The unique identifier of the report schedule to toggle. example: "11111111-2222-3333-4444-555555555555" in: path name: schedule_uuid required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: status: inactive type: schedule schema: $ref: "#/components/schemas/ReportScheduleToggleRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: delivery_format: pdf description: "Weekly summary of infrastructure health." next_recurrence: 1780923600000 recipients: - "user@example.com" resource_id: "abc-def-ghi" resource_type: dashboard rrule: "DTSTART;TZID=America/New_York:20260601T090000\nRRULE:FREQ=WEEKLY;BYDAY=MO;BYHOUR=9;BYMINUTE=0" status: inactive tab_id: "66666666-7777-8888-9999-000000000000" template_variables: - name: "env" values: - "prod" timeframe: "1w" timezone: "America/New_York" title: "Weekly Infrastructure Report" id: "11111111-2222-3333-4444-555555555555" type: schedule included: - attributes: email: "user@example.com" name: "Example User" id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" type: users schema: $ref: "#/components/schemas/ReportScheduleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Toggle a report schedule tags: - Report Schedules x-codegen-request-body-name: body /api/v2/restriction_policy/{resource_id}: delete: description: |- Deletes the restriction policy associated with a specified resource. For AI Gateway provider policies, requires `ai_gateway_config_write` and standard restriction-policy authorization. Deleting a provider policy restores normal unrestricted defaults. operationId: DeleteRestrictionPolicy parameters: - $ref: "#/components/parameters/ResourceID" responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete a restriction policy tags: - Restriction Policies "x-permission": operator: OPEN permissions: [] get: description: |- Retrieves the restriction policy associated with a specified resource. For AI Gateway provider policies, requires `ai_gateway_config_read`. operationId: GetRestrictionPolicy parameters: - $ref: "#/components/parameters/ResourceID" responses: "200": content: application/json: examples: default: value: data: attributes: bindings: - principals: - "role:00000000-0000-1111-0000-000000000000" relation: editor id: dashboard:abc-def-ghi type: restriction_policy schema: $ref: "#/components/schemas/RestrictionPolicyResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a restriction policy tags: - Restriction Policies "x-permission": operator: OPEN permissions: [] post: description: |- Updates the restriction policy associated with a resource. #### Supported resources Restriction policies can be applied to the following resources: - AI Gateway Providers: `ai-gateway-provider` - Dashboards: `dashboard` - Integration Services: `integration-service` - Integration Webhooks: `integration-webhook` - Notebooks: `notebook` - Powerpacks: `powerpack` - Reference Tables: `reference-table` - Security Rules: `security-rule` - Service Level Objectives: `slo` - Synthetic Global Variables: `synthetics-global-variable` - Synthetic Tests: `synthetics-test` - Synthetic Private Locations: `synthetics-private-location` - Monitors: `monitor` - Workflows: `workflow` - App Builder Apps: `app-builder-app` - Connections: `connection` - Connection Groups: `connection-group` - RUM Applications: `rum-application` - Cross Org Connections: `cross-org-connection` - Spreadsheets: `spreadsheet` - On-Call Schedules: `on-call-schedule` - On-Call Escalation Policies: `on-call-escalation-policy` - On-Call Team Routing Rules: `on-call-team-routing-rules` - Logs Pipelines: `logs-pipeline` - Case Management Projects: `case-management-project` - Monitor Notification Rules: `monitor-notification-rule` - Status Pages: `status-page` - Feature Flags: `feature-flag` - Network Path Configs: `network-path-config` AI Gateway provider policies control configuration and inherited model/catalog/pricing visibility. The editor relation includes View. Providers have no Run relation; restriction policies don't affect inference. Reading provider policies requires `ai_gateway_config_read`. Updating or deleting them requires `ai_gateway_config_write` and follows standard restriction-policy authorization, including administrator recovery and self-lockout checks. Providers without a restriction policy retain the normal unrestricted defaults. #### Supported relations for resources Resource Type | Supported Relations ----------------------------|-------------------------- AI Gateway Providers | `viewer`, `editor` Dashboards | `viewer`, `editor` Integration Services | `viewer`, `editor` Integration Webhooks | `viewer`, `editor` Notebooks | `viewer`, `editor` Powerpacks | `viewer`, `editor` Security Rules | `viewer`, `editor` Service Level Objectives | `viewer`, `editor` Synthetic Global Variables | `viewer`, `editor` Synthetic Tests | `viewer`, `editor` Synthetic Private Locations | `viewer`, `editor` Monitors | `viewer`, `editor` Reference Tables | `viewer`, `editor` Workflows | `viewer`, `runner`, `editor` App Builder Apps | `viewer`, `editor` Connections | `viewer`, `resolver`, `editor` Connection Groups | `viewer`, `editor` RUM Application | `viewer`, `editor` Cross Org Connections | `viewer`, `editor` Spreadsheets | `viewer`, `editor` On-Call Schedules | `viewer`, `overrider`, `editor` On-Call Escalation Policies | `viewer`, `editor` On-Call Team Routing Rules | `viewer`, `editor` Logs Pipelines | `viewer`, `processors_editor`, `editor` Case Management Projects | `viewer`, `contributor`, `manager` Monitor Notification Rules | `viewer`, `editor` Status Pages | `viewer`, `responder`, `manager` Feature Flags | `viewer`, `contributor`, `editor` Network Path Configs | `viewer`, `editor` operationId: UpdateRestrictionPolicy parameters: - $ref: "#/components/parameters/ResourceID" - description: Allows admins (users with the `user_access_manage` permission) to remove their own access from the resource if set to `true`. By default, this is set to `false`, preventing admins from locking themselves out. in: query name: allow_self_lockout required: false schema: type: boolean requestBody: content: application/json: examples: default: value: data: attributes: bindings: - principals: - user:4dee724d-00cc-11ea-a77b-570c9d03c6c5 relation: editor id: dashboard:abc-def-ghi type: restriction_policy schema: $ref: "#/components/schemas/RestrictionPolicyUpdateRequest" description: Restriction policy payload required: true responses: "200": content: application/json: examples: default: value: data: attributes: bindings: - principals: - "role:00000000-0000-1111-0000-000000000000" relation: editor id: dashboard:abc-def-ghi type: restriction_policy schema: $ref: "#/components/schemas/RestrictionPolicyResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update a restriction policy tags: - Restriction Policies x-codegen-request-body-name: body "x-permission": operator: OPEN permissions: [] /api/v2/roles: get: description: Returns all roles, including their names and their unique identifiers. operationId: ListRoles parameters: - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - description: |- Sort roles depending on the given field. Sort order is **ascending** by default. Sort order is **descending** if the field is prefixed by a negative sign, for example: `sort=-name`. in: query name: sort required: false schema: $ref: "#/components/schemas/RolesSort" - description: Filter all roles by the given string. in: query name: filter required: false schema: type: string - description: Filter all roles by the given list of role IDs. in: query name: filter[id] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: name: developers id: 00000000-0000-0000-0000-000000000001 type: roles meta: page: total_count: 1 total_filtered_count: 1 schema: $ref: "#/components/schemas/RolesResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_read summary: List roles tags: - Roles "x-permission": operator: OR permissions: - user_access_read post: description: |- Create a new role for your organization. [Restricted permissions](https://docs.datadoghq.com/account_management/rbac/permissions/#restricted-permissions), such as Dashboards Read and Monitors Read, are added to every new role by default, even if they are omitted from the request. To exclude them, set `default_permissions_opt_out` to `true`. operationId: CreateRole requestBody: content: application/json: examples: default: value: data: attributes: name: developers type: roles schema: $ref: "#/components/schemas/RoleCreateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: name: developers id: 00000000-0000-0000-0000-000000000002 type: roles schema: $ref: "#/components/schemas/RoleCreateResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_manage summary: Create role tags: - Roles x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_manage /api/v2/roles/templates: get: description: List all role templates operationId: ListRoleTemplates responses: "200": content: application/json: examples: default: value: data: - attributes: description: Role template with permissions for standard access. name: Datadog Standard Role id: "2" relationships: permissions: data: - id: 984d2ee2-dbb1-11e8-a1b5-1b33e7f4e7a0 type: permissions type: roles schema: $ref: "#/components/schemas/RoleTemplateArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_read summary: List role templates tags: - Roles x-unstable: "**Note**: This endpoint may be subject to changes." /api/v2/roles/{role_id}: delete: description: Disables a role. operationId: DeleteRole parameters: - $ref: "#/components/parameters/RoleID" responses: "204": description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_manage summary: Delete role tags: - Roles x-codegen-request-body-name: body get: description: Get a role in the organization specified by the role’s `role_id`. operationId: GetRole parameters: - $ref: "#/components/parameters/RoleID" responses: "200": content: application/json: examples: default: value: data: attributes: name: developers id: 00000000-0000-0000-0000-000000000003 type: roles schema: $ref: "#/components/schemas/RoleResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_read summary: Get a role tags: - Roles x-codegen-request-body-name: body patch: description: |- Edit a role. Can only be used with application keys belonging to administrators. [Restricted permissions](https://docs.datadoghq.com/account_management/rbac/permissions/#restricted-permissions), such as Dashboards Read and Monitors Read, remain on the role by default, even if they are omitted from the request. To exclude them, set `default_permissions_opt_out` to `true`. Omitting the `permissions` relationship from the request leaves the role's existing permissions unchanged. Sending `"permissions": {"data": []}` removes all permissions except restricted default permissions, which remain unless `default_permissions_opt_out` is `true`. Some restricted permissions can only be excluded after Minimal Access Roles is enabled for the organization. operationId: UpdateRole parameters: - $ref: "#/components/parameters/RoleID" requestBody: content: application/json: examples: default: value: data: attributes: name: updated-role-name id: 00000000-0000-1111-0000-000000000000 type: roles schema: $ref: "#/components/schemas/RoleUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: name: developers team_count: 0 id: 00000000-0000-0000-0000-000000000004 type: roles schema: $ref: "#/components/schemas/RoleUpdateResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "422": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_manage summary: Update a role tags: - Roles x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_manage /api/v2/roles/{role_id}/clone: post: description: Clone an existing role operationId: CloneRole parameters: - $ref: "#/components/parameters/RoleID" requestBody: content: application/json: examples: default: value: data: attributes: name: cloned-role type: roles schema: $ref: "#/components/schemas/RoleCloneRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: name: developers id: 00000000-0000-0000-0000-000000000011 type: roles schema: $ref: "#/components/schemas/RoleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_manage summary: Create a new role by cloning an existing role tags: - Roles x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_manage /api/v2/roles/{role_id}/permissions: delete: description: Removes a permission from a role. operationId: RemovePermissionFromRole parameters: - $ref: "#/components/parameters/RoleID" requestBody: content: application/json: examples: default: value: data: id: 6f66600e-dd12-11e8-9e55-7f30fbb45e73 type: permissions schema: $ref: "#/components/schemas/RelationshipToPermission" required: true responses: "200": content: application/json: examples: default: value: data: - attributes: name: logs_read_data id: 00000000-0000-0000-0000-000000000007 type: permissions schema: $ref: "#/components/schemas/PermissionsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_manage summary: Revoke permission tags: - Roles x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_manage get: description: Returns a list of all permissions for a single role. operationId: ListRolePermissions parameters: - $ref: "#/components/parameters/RoleID" responses: "200": content: application/json: examples: default: value: data: - attributes: name: logs_read_data id: 00000000-0000-0000-0000-000000000005 type: permissions schema: $ref: "#/components/schemas/PermissionsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_read summary: List permissions for a role tags: - Roles x-codegen-request-body-name: body post: description: Adds a permission to a role. operationId: AddPermissionToRole parameters: - $ref: "#/components/parameters/RoleID" requestBody: content: application/json: examples: default: value: data: id: 6f66600e-dd12-11e8-9e55-7f30fbb45e73 type: permissions schema: $ref: "#/components/schemas/RelationshipToPermission" required: true responses: "200": content: application/json: examples: default: value: data: - attributes: name: logs_read_data id: 00000000-0000-0000-0000-000000000006 type: permissions schema: $ref: "#/components/schemas/PermissionsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_manage summary: Grant permission to a role tags: - Roles x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_manage /api/v2/roles/{role_id}/users: delete: description: Removes a user from a role. operationId: RemoveUserFromRole parameters: - $ref: "#/components/parameters/RoleID" requestBody: content: application/json: examples: default: value: data: id: 00000000-0000-0000-2345-000000000000 type: users schema: $ref: "#/components/schemas/RelationshipToUser" required: true responses: "200": content: application/json: examples: default: value: data: - attributes: email: test@example.com name: Example Name id: 00000000-0000-0000-0000-000000000010 type: users schema: $ref: "#/components/schemas/UsersResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_manage summary: Remove a user from a role tags: - Roles x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_manage get: description: Gets all users of a role. operationId: ListRoleUsers parameters: - $ref: "#/components/parameters/RoleID" - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - description: |- User attribute to order results by. Sort order is **ascending** by default. Sort order is **descending** if the field is prefixed by a negative sign, for example `sort=-name`. Options: `name`, `email`, `status`. in: query name: sort required: false schema: default: name type: string - description: Filter all users by the given string. Defaults to no filtering. in: query name: filter required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: email: test@example.com name: Example Name id: 00000000-0000-0000-0000-000000000008 type: users schema: $ref: "#/components/schemas/UsersResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_read summary: Get all users of a role tags: - Roles post: description: Adds a user to a role. operationId: AddUserToRole parameters: - $ref: "#/components/parameters/RoleID" requestBody: content: application/json: examples: default: value: data: id: 00000000-0000-0000-2345-000000000000 type: users schema: $ref: "#/components/schemas/RelationshipToUser" required: true responses: "200": content: application/json: examples: default: value: data: - attributes: email: test@example.com name: Example Name id: 00000000-0000-0000-0000-000000000009 type: users schema: $ref: "#/components/schemas/UsersResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_manage summary: Add a user to a role tags: - Roles x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_manage /api/v2/routing-rules: delete: description: >- Delete a routing rule. Referenced rules require force=true. Surviving tiers keep their ordering and weights. A deletion that would rewrite a surviving tier with an unknown ordering_issue fails with HTTP 409 and code routing_rule_unknown_ordering until that rule is replaced or deleted. operationId: DeleteAiGatewayRoutingRule parameters: - $ref: "#/components/parameters/AiGatewayRoutingRuleSlug" - $ref: "#/components/parameters/AiGatewayRoutingRuleForceDelete" responses: "204": description: No Content "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Delete an AI Gateway routing rule tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: List all routing rules for the organization. operationId: ListAiGatewayRoutingRules responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2026-08-24T12:00:00Z" route_id: 123 tiers: - ordering: configured targets: - model: gpt-5.2-codex provider: prod-us type: model updated_at: "2026-08-24T12:00:00Z" id: coding type: routing-rules schema: $ref: "#/components/schemas/AiGatewayRoutingRuleListResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: List AI Gateway routing rules tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: >- Create an organization-owned routing rule. Data capture overrides are managed independently. Each tier has an ordering, which defaults to configured. A weighted_affinity tier distributes first-choice assignments by relative target weights (1 to 10000, default 1) and accepts only distinct model targets with an explicit provider. Weights need not total 100. Configured tiers must omit weights or set them to null. operationId: CreateAiGatewayRoutingRule requestBody: content: application/json: examples: weighted_affinity: value: data: attributes: slug: coding tiers: - ordering: weighted_affinity targets: - model: gpt-5.2-codex provider: prod-us type: model weight: 70 - model: gpt-4o-mini provider: prod-us type: model type: routing-rules schema: $ref: "#/components/schemas/AiGatewayRoutingRuleCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2026-08-24T12:00:00Z" route_id: 123 tiers: - ordering: configured targets: - model: gpt-5.2-codex provider: prod-us type: model updated_at: "2026-08-24T12:00:00Z" id: coding type: routing-rules weighted_affinity: value: data: attributes: created_at: "2026-08-24T12:00:00Z" route_id: 123 tiers: - ordering: weighted_affinity targets: - model: gpt-5.2-codex provider: prod-us type: model weight: 70 - model: gpt-4o-mini provider: prod-us type: model weight: 1 updated_at: "2026-08-24T12:00:00Z" id: coding type: routing-rules schema: $ref: "#/components/schemas/AiGatewayRoutingRuleResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Create an AI Gateway routing rule tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: >- Replace a routing rule's tiers. The slug is immutable; data capture is managed independently. This is a full replacement: omitted or null ordering resets the tier to configured, and omitted or null weights in a weighted_affinity tier reset to 1. Omitted or null reasoning_level clears a model destination's reasoning override. Replacing a rule repairs tiers reported with an ordering_issue. operationId: UpdateAiGatewayRoutingRule parameters: - $ref: "#/components/parameters/AiGatewayRoutingRuleSlug" requestBody: content: application/json: schema: $ref: "#/components/schemas/AiGatewayRoutingRuleReplaceRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-08-24T12:00:00Z" route_id: 123 tiers: - ordering: configured targets: - model: gpt-5.2-codex provider: prod-us type: model updated_at: "2026-08-24T12:00:00Z" id: coding type: routing-rules schema: $ref: "#/components/schemas/AiGatewayRoutingRuleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_write summary: Replace an AI Gateway routing rule tags: - AI Gateway x-codegen-request-body-name: body x-permission: operator: OR permissions: - ai_gateway_config_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/routing-rules/get: get: description: Get a routing rule by its organization-unique slug. operationId: GetAiGatewayRoutingRule parameters: - $ref: "#/components/parameters/AiGatewayRoutingRuleSlug" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-08-24T12:00:00Z" route_id: 123 tiers: - ordering: configured targets: - model: gpt-5.2-codex provider: prod-us type: model updated_at: "2026-08-24T12:00:00Z" id: coding type: routing-rules schema: $ref: "#/components/schemas/AiGatewayRoutingRuleResponse" description: OK "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - ai_gateway_config_read summary: Get an AI Gateway routing rule tags: - AI Gateway x-permission: operator: OR permissions: - ai_gateway_config_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/rum/analytics/aggregate: post: description: |- The API endpoint to aggregate RUM events into buckets of computed metrics and timeseries. operationId: AggregateRUMEvents requestBody: content: "application/json": examples: default: value: compute: - aggregation: pc90 interval: 5m metric: "@duration" type: timeseries filter: from: now-15m query: "@type:session AND @session.type:user" to: now group_by: - facet: "@view.time_spent" histogram: interval: 10 max: 100 min: 50 sort: aggregation: count order: asc options: timezone: GMT page: cursor: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== limit: 25 schema: $ref: "#/components/schemas/RUMAggregateRequest" required: true responses: "200": content: application/json: examples: default: value: data: buckets: - by: "@session.type": user "@type": view computes: c0: 19 meta: elapsed: 132 request_id: abc-123 status: done schema: $ref: "#/components/schemas/RUMAnalyticsAggregateResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Aggregate RUM events tags: ["RUM"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - rum_apps_read /api/v2/rum/applications: get: description: List all the RUM applications in your organization. operationId: GetRUMApplications responses: "200": content: application/json: examples: default: value: data: - attributes: application_id: abc-123 created_at: 1659479836169 created_by_handle: example-handle name: my_rum_application org_id: 123 type: browser updated_at: 1659479836169 updated_by_handle: example-handle id: abc-123 type: rum_application schema: $ref: "#/components/schemas/RUMApplicationsResponse" description: OK "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List all the RUM applications tags: ["RUM"] "x-permission": operator: OR permissions: - rum_apps_read post: description: Create a new RUM application in your organization. operationId: CreateRUMApplication requestBody: content: application/json: examples: default: value: data: attributes: name: my_new_rum_application product_analytics_retention_state: MAX rum_event_processing_state: ALL type: browser type: rum_application_create schema: $ref: "#/components/schemas/RUMApplicationCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: application_id: abc-123 client_token: abc-123-token created_at: 1659479836169 created_by_handle: example-handle name: my_rum_application org_id: 123 type: browser updated_at: 1659479836169 updated_by_handle: example-handle id: abc-123 type: rum_application schema: $ref: "#/components/schemas/RUMApplicationResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a new RUM application tags: ["RUM"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - rum_apps_write /api/v2/rum/applications/{app_id}/relationships/retention_filters: patch: description: |- Order RUM retention filters for a RUM application. Returns RUM retention filter objects without attributes from the request body when the request is successful. operationId: OrderRetentionFilters parameters: - $ref: "#/components/parameters/RumApplicationIDParameter" requestBody: content: application/json: examples: default: value: data: - id: 051601eb-54a0-abc0-03f9-cc02efa18892 type: retention_filters schema: $ref: "#/components/schemas/RumRetentionFiltersOrderRequest" description: New definition of the RUM retention filter. required: true responses: "200": content: application/json: examples: default: value: data: - id: "051601eb-54a0-abc0-03f9-cc02efa18892" type: retention_filters schema: $ref: "#/components/schemas/RumRetentionFiltersOrderResponse" description: Ordered "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Order RUM retention filters tags: - Rum Retention Filters x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_retention_filters_write - product_analytics_apps_write /api/v2/rum/applications/{app_id}/retention_filters: get: description: Get the list of RUM retention filters for a RUM application. operationId: ListRetentionFilters parameters: - $ref: "#/components/parameters/RumApplicationIDParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: cross_product_sampling: trace_enabled: true trace_sample_rate: 25.0 enabled: true event_type: session name: Retention filter for session query: "@session.has_replay:true" sample_rate: 50.5 id: "051601eb-54a0-abc0-03f9-cc02efa18892" type: retention_filters schema: $ref: "#/components/schemas/RumRetentionFiltersResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all RUM retention filters tags: - Rum Retention Filters x-permission: operator: OR permissions: - rum_retention_filters_read post: description: |- Create a RUM retention filter for a RUM application. Returns RUM retention filter objects from the request body when the request is successful. operationId: CreateRetentionFilter parameters: - $ref: "#/components/parameters/RumApplicationIDParameter" requestBody: content: application/json: examples: default: value: data: attributes: cross_product_sampling: trace_enabled: true trace_sample_rate: 25.0 enabled: true event_type: session name: Retention filter for session query: "@session.has_replay:true" sample_rate: 50.5 type: retention_filters schema: $ref: "#/components/schemas/RumRetentionFilterCreateRequest" description: The definition of the new RUM retention filter. required: true responses: "201": content: application/json: examples: default: value: data: attributes: enabled: true event_type: session name: Retention filter for session query: "@session.has_replay:true" sample_rate: 50.5 id: 00000000-0000-0000-0000-000000000001 type: retention_filters schema: $ref: "#/components/schemas/RumRetentionFilterResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a RUM retention filter tags: - Rum Retention Filters x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_retention_filters_write - product_analytics_apps_write /api/v2/rum/applications/{app_id}/retention_filters/exclusion: get: description: |- Get the list of exclusion filters for a RUM application. The built-in Error Tracking exclusion filter (`error_tracking_exclusion_filter`) is always returned first. operationId: ListExclusionFilters parameters: - $ref: "#/components/parameters/RumExclusionFilterApplicationIDParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: enabled: true name: Ignored / Excluded errors from Error Tracking id: error_tracking_exclusion_filter meta: enabled_at: 1735689600000 updated_at: 1735689600000 updated_by_handle: jane.doe@example.com type: exclusion_filters - attributes: enabled: true event_type: error name: Exclude noisy browser extension errors query: "@error.message:*extension*" id: "051601eb-54a0-abc0-03f9-cc02efa18892" meta: enabled_at: 1735689600000 updated_at: 1735689600000 updated_by_handle: jane.doe@example.com type: exclusion_filters schema: $ref: "#/components/schemas/RumExclusionFiltersResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all RUM exclusion filters tags: - Rum Retention Filters x-permission: operator: OR permissions: - rum_retention_filters_read post: description: |- Create an exclusion filter for a RUM application. Returns the created exclusion filter when the request is successful. operationId: CreateExclusionFilter parameters: - $ref: "#/components/parameters/RumExclusionFilterApplicationIDParameter" requestBody: content: application/json: examples: default: value: data: attributes: enabled: true event_type: error name: Exclude noisy browser extension errors query: "@error.message:*extension*" type: exclusion_filters schema: $ref: "#/components/schemas/RumExclusionFilterCreateRequest" description: The definition of the new RUM exclusion filter. required: true responses: "201": content: application/json: examples: default: value: data: attributes: enabled: true event_type: error name: Exclude noisy browser extension errors query: "@error.message:*extension*" id: "051601eb-54a0-abc0-03f9-cc02efa18892" meta: enabled_at: 1735689600000 updated_at: 1735689600000 updated_by_handle: jane.doe@example.com type: exclusion_filters schema: $ref: "#/components/schemas/RumExclusionFilterResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a RUM exclusion filter tags: - Rum Retention Filters x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_retention_filters_write /api/v2/rum/applications/{app_id}/retention_filters/exclusion/{ef_id}: delete: description: |- Delete an exclusion filter for a RUM application. The built-in Error Tracking exclusion filter (`error_tracking_exclusion_filter`) cannot be deleted; attempting to do so returns a `405 Method Not Allowed` response. operationId: DeleteExclusionFilter parameters: - $ref: "#/components/parameters/RumExclusionFilterApplicationIDParameter" - $ref: "#/components/parameters/RumExclusionFilterIDParameter" responses: "204": description: No Content "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "405": $ref: "#/components/responses/RumExclusionFilterMethodNotAllowedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a RUM exclusion filter tags: - Rum Retention Filters x-permission: operator: OR permissions: - rum_retention_filters_write get: description: Get a single exclusion filter for a RUM application. operationId: GetExclusionFilter parameters: - $ref: "#/components/parameters/RumExclusionFilterApplicationIDParameter" - $ref: "#/components/parameters/RumExclusionFilterIDParameter" responses: "200": content: application/json: examples: default: value: data: attributes: enabled: true event_type: error name: Exclude noisy browser extension errors query: "@error.message:*extension*" id: "051601eb-54a0-abc0-03f9-cc02efa18892" meta: enabled_at: 1735689600000 updated_at: 1735689600000 updated_by_handle: jane.doe@example.com type: exclusion_filters schema: $ref: "#/components/schemas/RumExclusionFilterResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a RUM exclusion filter tags: - Rum Retention Filters x-permission: operator: OR permissions: - rum_retention_filters_read patch: description: |- Update an exclusion filter for a RUM application. For the built-in Error Tracking exclusion filter (`error_tracking_exclusion_filter`), only `enabled` can be updated; `name`, `event_type`, and `query` must be omitted. Returns the updated exclusion filter when the request is successful. operationId: UpdateExclusionFilter parameters: - $ref: "#/components/parameters/RumExclusionFilterApplicationIDParameter" - $ref: "#/components/parameters/RumExclusionFilterIDParameter" requestBody: content: application/json: examples: default: value: data: attributes: enabled: false event_type: error name: Exclude noisy browser extension errors query: "@error.message:*extension*" id: "051601eb-54a0-abc0-03f9-cc02efa18892" type: exclusion_filters schema: $ref: "#/components/schemas/RumExclusionFilterUpdateRequest" description: New definition of the RUM exclusion filter. required: true responses: "200": content: application/json: examples: default: value: data: attributes: enabled: false event_type: error name: Exclude noisy browser extension errors query: "@error.message:*extension*" id: "051601eb-54a0-abc0-03f9-cc02efa18892" meta: enabled_at: 1735689600000 updated_at: 1735689600000 updated_by_handle: jane.doe@example.com type: exclusion_filters schema: $ref: "#/components/schemas/RumExclusionFilterResponse" description: Updated "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a RUM exclusion filter tags: - Rum Retention Filters x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_retention_filters_write /api/v2/rum/applications/{app_id}/retention_filters/permanent: get: description: |- Get the list of permanent RUM retention filters for a RUM application. Permanent retention filters are predefined filters that cannot be created or deleted. For each filter, the `editability` block indicates which cross-product fields can be updated. operationId: ListPermanentRetentionFilters parameters: - $ref: "#/components/parameters/RumApplicationIDParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: cross_product_sampling: trace_enabled: true trace_sample_rate: 100.0 description: RUM retains all Synthetics sessions. editability: trace_editable: true name: Synthetics Sessions id: synthetics_sessions type: permanent_retention_filters - attributes: cross_product_sampling: trace_enabled: true trace_sample_rate: 100.0 description: RUM retains all sessions with forced replays. editability: trace_editable: true name: Forced Replay Sessions id: forced_replay_sessions type: permanent_retention_filters - attributes: cross_product_sampling: trace_enabled: true trace_sample_rate: 100.0 description: Configures APM trace sampling for RUM sessions using flat sampling. editability: trace_editable: false name: RUM APM Flat Sampling id: rum_apm_flat_sampling type: permanent_retention_filters schema: $ref: "#/components/schemas/RumPermanentRetentionFiltersResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all permanent RUM retention filters tags: - Rum Retention Filters x-permission: operator: OR permissions: - rum_retention_filters_read /api/v2/rum/applications/{app_id}/retention_filters/permanent/{permanent_rf_id}: get: description: Get a permanent RUM retention filter for a RUM application by its identifier. operationId: GetPermanentRetentionFilter parameters: - $ref: "#/components/parameters/RumApplicationIDParameter" - $ref: "#/components/parameters/RumPermanentRetentionFilterIDParameter" responses: "200": content: application/json: examples: default: value: data: attributes: cross_product_sampling: trace_enabled: true trace_sample_rate: 75.0 description: RUM retains all Synthetics sessions. editability: trace_editable: true name: Synthetics Sessions id: synthetics_sessions type: permanent_retention_filters schema: $ref: "#/components/schemas/RumPermanentRetentionFilterResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a permanent RUM retention filter tags: - Rum Retention Filters x-permission: operator: OR permissions: - rum_retention_filters_read patch: description: |- Update the cross-product sampling configuration of a permanent RUM retention filter for a RUM application. Only fields marked as editable in the `editability` block of the filter can be updated. Updating a non-editable field returns a `400` response. operationId: UpdatePermanentRetentionFilter parameters: - $ref: "#/components/parameters/RumApplicationIDParameter" - $ref: "#/components/parameters/RumPermanentRetentionFilterIDParameter" requestBody: content: application/json: examples: default: value: data: attributes: cross_product_sampling: trace_enabled: true trace_sample_rate: 50.0 id: synthetics_sessions type: permanent_retention_filters schema: $ref: "#/components/schemas/RumPermanentRetentionFilterUpdateRequest" description: New configuration of the permanent RUM retention filter. required: true responses: "200": content: application/json: examples: default: value: data: attributes: cross_product_sampling: trace_enabled: true trace_sample_rate: 50.0 description: RUM retains all Synthetics sessions. editability: trace_editable: true name: Synthetics Sessions id: synthetics_sessions type: permanent_retention_filters schema: $ref: "#/components/schemas/RumPermanentRetentionFilterResponse" description: Updated "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a permanent RUM retention filter tags: - Rum Retention Filters x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_retention_filters_write /api/v2/rum/applications/{app_id}/retention_filters/{rf_id}: delete: description: Delete a RUM retention filter for a RUM application. operationId: DeleteRetentionFilter parameters: - $ref: "#/components/parameters/RumApplicationIDParameter" - $ref: "#/components/parameters/RumRetentionFilterIDParameter" responses: "204": description: No Content "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a RUM retention filter tags: - Rum Retention Filters x-permission: operator: OR permissions: - rum_retention_filters_write - product_analytics_apps_write get: description: Get a RUM retention filter for a RUM application. operationId: GetRetentionFilter parameters: - $ref: "#/components/parameters/RumApplicationIDParameter" - $ref: "#/components/parameters/RumRetentionFilterIDParameter" responses: "200": content: application/json: examples: default: value: data: attributes: cross_product_sampling: trace_enabled: true trace_sample_rate: 25.0 enabled: true event_type: session name: Retention filter for session query: "@session.has_replay:true" sample_rate: 50.5 id: "051601eb-54a0-abc0-03f9-cc02efa18892" type: retention_filters schema: $ref: "#/components/schemas/RumRetentionFilterResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a RUM retention filter tags: - Rum Retention Filters x-permission: operator: OR permissions: - rum_retention_filters_read patch: description: |- Update a RUM retention filter for a RUM application. Returns RUM retention filter objects from the request body when the request is successful. operationId: UpdateRetentionFilter parameters: - $ref: "#/components/parameters/RumApplicationIDParameter" - $ref: "#/components/parameters/RumRetentionFilterIDParameter" requestBody: content: application/json: examples: default: value: data: attributes: cross_product_sampling: trace_enabled: true trace_sample_rate: 25.0 enabled: true event_type: session name: Retention filter for session query: "@session.has_replay:true" sample_rate: 50.5 id: 051601eb-54a0-abc0-03f9-cc02efa18892 type: retention_filters schema: $ref: "#/components/schemas/RumRetentionFilterUpdateRequest" description: New definition of the RUM retention filter. required: true responses: "200": content: application/json: examples: default: value: data: attributes: cross_product_sampling: trace_enabled: true trace_sample_rate: 25.0 enabled: true event_type: session name: Retention filter for session query: "@session.has_replay:true" sample_rate: 50.5 id: "051601eb-54a0-abc0-03f9-cc02efa18892" type: retention_filters schema: $ref: "#/components/schemas/RumRetentionFilterResponse" description: Updated "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a RUM retention filter tags: - Rum Retention Filters x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_retention_filters_write - product_analytics_apps_write /api/v2/rum/applications/{id}: delete: description: Delete an existing RUM application in your organization. operationId: DeleteRUMApplication parameters: - description: RUM application ID. in: path name: id required: true schema: type: string responses: "204": description: No Content "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a RUM application tags: ["RUM"] "x-permission": operator: OR permissions: - rum_apps_write get: description: Get the RUM application with given ID in your organization. operationId: GetRUMApplication parameters: - description: RUM application ID. in: path name: id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: application_id: abc-123 client_token: abc-123-token created_at: 1659479836169 created_by_handle: example-handle name: my_rum_application org_id: 123 type: browser updated_at: 1659479836169 updated_by_handle: example-handle id: abc-123 type: rum_application schema: $ref: "#/components/schemas/RUMApplicationResponse" description: OK "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a RUM application tags: ["RUM"] "x-permission": operator: OR permissions: - rum_apps_read patch: description: Update the RUM application with given ID in your organization. operationId: UpdateRUMApplication parameters: - description: RUM application ID. in: path name: id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: name: updated_name_for_my_existing_rum_application product_analytics_retention_state: MAX rum_event_processing_state: ALL type: browser id: abcd1234-0000-0000-abcd-1234abcd5678 type: rum_application_update schema: $ref: "#/components/schemas/RUMApplicationUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: application_id: abc-123 client_token: abc-123-token created_at: 1659479836169 created_by_handle: example-handle name: updated_name_for_my_existing_rum_application org_id: 123 type: browser updated_at: 1659479836169 updated_by_handle: example-handle id: abc-123 type: rum_application schema: $ref: "#/components/schemas/RUMApplicationResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "422": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Unprocessable Entity. "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a RUM application tags: ["RUM"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - rum_apps_write /api/v2/rum/config: get: description: Get the RUM configuration for your organization. operationId: GetRumConfig responses: "200": content: application/json: examples: default: value: data: attributes: disabled: false enforced_application_tags: true enforced_application_tags_updated_at: "2024-01-15T09:30:00.000Z" enforced_application_tags_updated_by: "user@example.com" ootb_metrics_version: 5 ootb_metrics_version_installed_at: "2024-01-15T09:30:00.000Z" retention_filters_enabled: true retention_filters_enabled_updated_at: "2024-01-15T09:30:00.000Z" retention_filters_enabled_updated_by: "contract-update-job" id: "1234" type: rum_config schema: $ref: "#/components/schemas/RumConfigResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get the RUM configuration tags: - RUM Config x-permission: operator: OR permissions: - rum_apps_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: |- Update the RUM configuration for your organization. Returns the RUM configuration object from the request body when the request is successful. operationId: UpdateRumConfig requestBody: content: application/json: examples: default: value: data: attributes: enforced_application_tags: false type: rum_config schema: $ref: "#/components/schemas/RumConfigUpdateRequest" description: New definition of the RUM configuration. required: true responses: "200": content: application/json: examples: default: value: data: attributes: disabled: false enforced_application_tags: false enforced_application_tags_updated_at: "2024-01-15T09:30:00.000Z" enforced_application_tags_updated_by: "user@example.com" ootb_metrics_version: 5 ootb_metrics_version_installed_at: "2024-01-15T09:30:00.000Z" retention_filters_enabled: true retention_filters_enabled_updated_at: "2024-01-15T09:30:00.000Z" retention_filters_enabled_updated_by: "contract-update-job" id: "1234" type: rum_config schema: $ref: "#/components/schemas/RumConfigResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update the RUM configuration tags: - RUM Config x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_apps_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Create the RUM configuration for your organization. Returns the RUM configuration object from the request body when the request is successful. operationId: CreateRumConfig requestBody: content: application/json: examples: default: value: data: attributes: enforced_application_tags: true type: rum_config schema: $ref: "#/components/schemas/RumConfigCreateRequest" description: The definition of the RUM configuration to create. required: true responses: "201": content: application/json: examples: default: value: data: attributes: disabled: false enforced_application_tags: true enforced_application_tags_updated_at: "2024-01-15T09:30:00.000Z" enforced_application_tags_updated_by: "user@example.com" ootb_metrics_version: 5 ootb_metrics_version_installed_at: "2024-01-15T09:30:00.000Z" retention_filters_enabled: true retention_filters_enabled_updated_at: "2024-01-15T09:30:00.000Z" retention_filters_enabled_updated_by: "contract-update-job" id: "1234" type: rum_config schema: $ref: "#/components/schemas/RumConfigResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create the RUM configuration tags: - RUM Config x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_apps_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/rum/config/archive: get: description: >- Get the list of archive configurations for your organization. operationId: ListRUMArchiveConfigs parameters: - description: Page number. in: query name: page[number] required: false schema: default: 0 format: int32 maximum: 10000 minimum: 0 type: integer - description: Configurations per page. in: query name: page[size] required: false schema: default: 20 format: int32 maximum: 100 minimum: 1 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: enabled: true org_id: 123 retention_days: 90 updated_at: "2026-09-21T12:00:00Z" updated_by: user@example.com id: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 type: rum_archive_config meta: page: total_filtered_count: 1 empty: value: data: [] meta: page: total_filtered_count: 0 schema: $ref: "#/components/schemas/RumArchiveConfigListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Forbidden "429": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] summary: List archive configurations tags: - RUM Managed Archives x-permission: operator: OR permissions: - rum_rehydration_filter_read /api/v2/rum/config/archive/{app_id}: delete: description: >- Delete the archive configuration for a RUM application. Archived and recovered session data is not deleted. operationId: DeleteRUMArchiveConfig parameters: - description: RUM application ID. in: path name: app_id required: true schema: description: Application UUID. example: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 format: uuid type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] summary: Delete an archive configuration tags: - RUM Managed Archives x-permission: operator: OR permissions: - rum_rehydration_filter_write get: description: >- Get the archive configuration for a RUM application. operationId: GetRUMArchiveConfig parameters: - description: RUM application ID. in: path name: app_id required: true schema: description: Application UUID. example: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: enabled: true org_id: 123 retention_days: 90 updated_at: "2026-09-21T12:00:00Z" updated_by: user@example.com id: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 type: rum_archive_config schema: $ref: "#/components/schemas/RumArchiveConfigResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] summary: Get an archive configuration tags: - RUM Managed Archives x-permission: operator: OR permissions: - rum_rehydration_filter_read put: description: >- Create or update the archive configuration for a RUM application. The application ID in the path must match `data.id`. Disabling archiving does not delete archived sessions. operationId: UpdateRUMArchiveConfig parameters: - description: RUM application ID. Must match data.id for PUT. in: path name: app_id required: true schema: description: Application UUID. example: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: enabled: true retention_days: 90 id: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 type: rum_archive_config disabled: value: data: attributes: enabled: false id: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 type: rum_archive_config schema: $ref: "#/components/schemas/RumArchiveConfigUpsertRequest" description: JSON:API request body. required: true responses: "200": content: application/json: examples: default: value: data: attributes: enabled: true org_id: 123 retention_days: 90 updated_at: "2026-09-21T12:00:00Z" updated_by: user@example.com id: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 type: rum_archive_config schema: $ref: "#/components/schemas/RumArchiveConfigResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] summary: Create or update an archive configuration tags: - RUM Managed Archives x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_rehydration_filter_write /api/v2/rum/config/metrics: get: description: |- Get the list of all RUM-based metrics configured for your organization, with their definitions. The list is not paginated. Metrics whose stored definition cannot be converted to the RUM format are omitted from the list. To retrieve a single metric, use `GetRumMetric`. operationId: ListRumMetrics responses: "200": content: application/json: examples: default: value: data: - attributes: compute: aggregation_type: distribution include_percentiles: true path: "@duration" event_type: session filter: query: "@service:web-api" group_by: - path: "@browser.name" tag_name: browser_name uniqueness: when: match id: rum.sessions.web.count type: rum_metrics schema: $ref: "#/components/schemas/RumMetricsResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all RUM-based metrics tags: - Rum Metrics x-permission: operator: OR permissions: - rum_apps_read post: description: |- Create a metric based on your organization's RUM data. The metric name is set in `data.id`, is unique within your organization, and cannot be changed after creation. The `event_type`, `compute`, and `uniqueness` settings cannot be changed after creation either. Only `filter`, `group_by`, and `compute.include_percentiles` can be changed with `UpdateRumMetric`. `uniqueness` is required when `event_type` is `session` or `view`, and must be omitted for any other event type. When `aggregation_type` is `distribution`, `include_percentiles` is required. When it is `count`, `include_percentiles` and `path` must be omitted. Returns the created RUM-based metric when the request is successful. The request returns a `409 Conflict` error if a metric with the same name already exists. operationId: CreateRumMetric requestBody: content: application/json: examples: count_metric: summary: Count of error events value: data: attributes: compute: aggregation_type: count event_type: error filter: query: "@view.name:/checkout" group_by: - path: "@error.source" id: rum.errors.checkout.count type: rum_metrics default: summary: Distribution of session durations value: data: attributes: compute: aggregation_type: distribution include_percentiles: true path: "@duration" event_type: session filter: query: "@service:web-api" group_by: - path: "@browser.name" tag_name: browser_name uniqueness: when: match id: rum.sessions.web.count type: rum_metrics schema: $ref: "#/components/schemas/RumMetricCreateRequest" description: The definition of the new RUM-based metric. required: true responses: "201": content: application/json: examples: default: value: data: attributes: compute: aggregation_type: distribution include_percentiles: true path: "@duration" event_type: session filter: query: "@service:web-api" group_by: - path: "@browser.name" tag_name: browser_name uniqueness: when: match id: rum.sessions.web.count type: rum_metrics schema: $ref: "#/components/schemas/RumMetricResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a RUM-based metric tags: - Rum Metrics x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_generate_metrics /api/v2/rum/config/metrics/{metric_id}: delete: description: |- Delete a specific RUM-based metric from your organization. Metric data that was already generated is not deleted. Deleting a metric cannot be undone. operationId: DeleteRumMetric parameters: - $ref: "#/components/parameters/RumMetricIDParameter" responses: "204": description: No Content "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a RUM-based metric tags: - Rum Metrics x-permission: operator: OR permissions: - rum_generate_metrics get: description: |- Get a specific RUM-based metric from your organization. The `metric_id` is the metric name returned in `data.id` by `ListRumMetrics` and `CreateRumMetric`. operationId: GetRumMetric parameters: - $ref: "#/components/parameters/RumMetricIDParameter" responses: "200": content: application/json: examples: default: value: data: attributes: compute: aggregation_type: distribution include_percentiles: true path: "@duration" event_type: session filter: query: "@service:web-api" group_by: - path: "@browser.name" tag_name: browser_name uniqueness: when: match id: rum.sessions.web.count type: rum_metrics schema: $ref: "#/components/schemas/RumMetricResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a RUM-based metric tags: - Rum Metrics x-permission: operator: OR permissions: - rum_apps_read patch: description: |- Update a specific RUM-based metric from your organization. Only `filter`, `group_by`, and `compute.include_percentiles` can be updated. `event_type`, `uniqueness`, `compute.aggregation_type`, `compute.path`, and the metric name are immutable. To change them, delete the metric and create a new one. Omitted attributes keep their current value. When provided, `filter.query` replaces the whole filter query (an empty query is ignored) and `group_by` replaces the whole list of group by rules. `data.id` is required and must match the `metric_id` path parameter, otherwise the request returns a `409 Conflict` error. The request also returns a `409 Conflict` error when `compute.include_percentiles` is set on a metric whose `aggregation_type` is not `distribution`. Returns the updated RUM-based metric when the request is successful. operationId: UpdateRumMetric parameters: - $ref: "#/components/parameters/RumMetricIDParameter" requestBody: content: application/json: examples: default: value: data: attributes: compute: include_percentiles: true filter: query: "@service:web-api" group_by: - path: "@browser.name" tag_name: browser_name id: rum.sessions.web.count type: rum_metrics disable_percentiles: summary: Stop generating percentile aggregations value: data: attributes: compute: include_percentiles: false id: rum.sessions.web.count type: rum_metrics schema: $ref: "#/components/schemas/RumMetricUpdateRequest" description: New definition of the RUM-based metric. required: true responses: "200": content: application/json: examples: default: value: data: attributes: compute: aggregation_type: distribution include_percentiles: true path: "@duration" event_type: session filter: query: "@service:web-api" group_by: - path: "@browser.name" tag_name: browser_name uniqueness: when: match id: rum.sessions.web.count type: rum_metrics schema: $ref: "#/components/schemas/RumMetricResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a RUM-based metric tags: - Rum Metrics x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_generate_metrics /api/v2/rum/config/retention-quota/{scope_type}/{scope_id}: delete: description: Delete the RUM retention quota configuration for a given scope. operationId: DeleteRumQuotaConfig parameters: - $ref: "#/components/parameters/RumRetentionQuotaScopeTypeParameter" - $ref: "#/components/parameters/RumRetentionQuotaScopeIDParameter" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a RUM retention quota configuration tags: - RUM Retention Quotas x-permission: operator: OR permissions: - rum_retention_filters_write get: description: Get the RUM retention quota configuration for a given scope. operationId: GetRumQuotaConfig parameters: - $ref: "#/components/parameters/RumRetentionQuotaScopeTypeParameter" - $ref: "#/components/parameters/RumRetentionQuotaScopeIDParameter" responses: "200": content: application/json: examples: default: value: data: attributes: custom: daily_reset_time: "08:00" daily_reset_timezone: "+09:00" quota_reached_action: stop session_limit: 1000000 window_type: daily mode: custom org_id: 2 updated_at: "2026-03-04T15:37:54.951447Z" updated_by: test@example.com id: cd73a516-a481-4af5-8352-9b577465c77b type: rum_quota_config schema: $ref: "#/components/schemas/RumRetentionQuotaConfigResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a RUM retention quota configuration tags: - RUM Retention Quotas x-permission: operator: OR permissions: - rum_retention_filters_read put: description: |- Create or update the RUM retention quota configuration for a given scope. Returns the retention quota configuration object when the request is successful. operationId: UpsertRumQuotaConfig parameters: - $ref: "#/components/parameters/RumRetentionQuotaScopeTypeParameter" - $ref: "#/components/parameters/RumRetentionQuotaScopeIDParameter" requestBody: content: application/json: examples: default: value: data: attributes: custom: daily_reset_time: "08:00" daily_reset_timezone: "+09:00" quota_reached_action: stop session_limit: 1000000 window_type: daily mode: custom id: cd73a516-a481-4af5-8352-9b577465c77b type: rum_quota_config schema: $ref: "#/components/schemas/RumRetentionQuotaConfigUpdateRequest" description: The definition of the RUM retention quota configuration to create or update. required: true responses: "200": content: application/json: examples: default: value: data: attributes: custom: daily_reset_time: "08:00" daily_reset_timezone: "+09:00" quota_reached_action: stop session_limit: 1000000 window_type: daily mode: custom org_id: 2 updated_at: "2026-03-04T21:52:53.526022Z" updated_by: test@example.com id: cd73a516-a481-4af5-8352-9b577465c77b type: rum_quota_config schema: $ref: "#/components/schemas/RumRetentionQuotaConfigResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create or update a RUM retention quota config tags: - RUM Retention Quotas x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_retention_filters_write /api/v2/rum/config/teams-ownership/mappings: get: description: Get the list of teams ownership mappings for your organization, optionally filtered. operationId: ListTeamsOwnershipMappings parameters: - $ref: "#/components/parameters/TeamsOwnershipFilterViewNameParameter" - $ref: "#/components/parameters/TeamsOwnershipFilterTeamHandleParameter" - $ref: "#/components/parameters/TeamsOwnershipFilterApplicationIdParameter" - $ref: "#/components/parameters/TeamsOwnershipFilterServiceParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: application_id: "11111111-2222-3333-4444-555555555555" created_at: "2026-01-15T09:30:00.000Z" created_by: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" match_type: "exact" org_id: 123456 service: "web-checkout" team_handle: "team-rum" view_name: "/checkout" id: "123" type: teams_ownership_mappings schema: $ref: "#/components/schemas/TeamsOwnershipMappingsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List teams ownership mappings tags: - Rum Teams Ownership x-permission: operator: OR permissions: - rum_apps_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Create a teams ownership mapping for your organization. Returns the teams ownership mapping object from the request body when the request is successful. operationId: CreateTeamsOwnershipMapping requestBody: content: application/json: examples: default: value: data: attributes: application_id: "11111111-2222-3333-4444-555555555555" match_type: "exact" service: "web-checkout" team_handle: "team-rum" view_name: "/checkout" type: teams_ownership_mappings schema: $ref: "#/components/schemas/TeamsOwnershipMappingCreateRequest" description: The definition of the teams ownership mapping to create. required: true responses: "201": content: application/json: examples: default: value: data: attributes: application_id: "11111111-2222-3333-4444-555555555555" created_at: "2026-01-15T09:30:00.000Z" created_by: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" match_type: "exact" org_id: 123456 service: "web-checkout" team_handle: "team-rum" view_name: "/checkout" id: "123" type: teams_ownership_mappings schema: $ref: "#/components/schemas/TeamsOwnershipMappingResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a teams ownership mapping tags: - Rum Teams Ownership x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_apps_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/rum/config/teams-ownership/mappings/operations: post: description: |- Add and remove teams ownership mappings for your organization in a single atomic request, following the JSON:API [atomic operations extension](https://jsonapi.org/ext/atomic/). Operations are applied together: if any operation is invalid, none of the operations are applied. Add operations are processed before remove operations, so results may not appear in the same order as the request. operationId: CreateTeamsOwnershipMappingsBatch requestBody: content: application/json: examples: default: value: atomic:operations: - data: attributes: application_id: "11111111-2222-3333-4444-555555555555" match_type: "exact" service: "web-checkout" team_handle: "team-rum" view_name: "/checkout" type: teams_ownership_mappings op: add - op: remove ref: id: "456" type: teams_ownership_mappings schema: $ref: "#/components/schemas/TeamsOwnershipMappingBatchRequest" description: The list of add and remove operations to apply atomically. required: true responses: "200": content: application/json: examples: default: value: atomic:results: - data: attributes: application_id: "11111111-2222-3333-4444-555555555555" created_at: "2026-01-15T09:30:00.000Z" created_by: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" match_type: "exact" org_id: 123456 service: "web-checkout" team_handle: "team-rum" view_name: "/checkout" id: "123" type: teams_ownership_mappings - {} schema: $ref: "#/components/schemas/TeamsOwnershipMappingBatchResponse" description: OK "400": content: application/json: examples: default: value: errors: - detail: "prefix match_type is not enabled for this org" status: "400" title: "Bad Request" schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: |- Bad Request. One or more operations failed validation, so none of the operations were applied. Errors are returned in the JSON:API atomic operations error format rather than the standard error response. "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found. One or more mappings requested for removal do not exist. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict. One or more mappings requested for creation already exist. "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Bulk create and remove teams ownership mappings tags: - Rum Teams Ownership x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_apps_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/rum/config/teams-ownership/mappings/{id}: delete: description: Delete a specific teams ownership mapping from your organization. operationId: DeleteTeamsOwnershipMapping parameters: - $ref: "#/components/parameters/TeamsOwnershipMappingIdParameter" responses: "204": description: No Content "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a teams ownership mapping tags: - Rum Teams Ownership x-permission: operator: OR permissions: - rum_apps_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a specific teams ownership mapping from your organization. operationId: GetTeamsOwnershipMapping parameters: - $ref: "#/components/parameters/TeamsOwnershipMappingIdParameter" responses: "200": content: application/json: examples: default: value: data: attributes: application_id: "11111111-2222-3333-4444-555555555555" created_at: "2026-01-15T09:30:00.000Z" created_by: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" match_type: "exact" org_id: 123456 service: "web-checkout" team_handle: "team-rum" view_name: "/checkout" id: "123" type: teams_ownership_mappings schema: $ref: "#/components/schemas/TeamsOwnershipMappingResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a teams ownership mapping tags: - Rum Teams Ownership x-permission: operator: OR permissions: - rum_apps_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/rum/config/teams-ownership/rules: get: description: |- Get the list of teams ownership rules for your organization, optionally filtered. Rules group the underlying mappings by `view_name`, `application_id`, `service`, and `match_type`, collapsing every team that owns the same view into a single entry. operationId: ListTeamsOwnershipRules parameters: - $ref: "#/components/parameters/TeamsOwnershipFilterViewNameParameter" - $ref: "#/components/parameters/TeamsOwnershipFilterTeamHandleParameter" - $ref: "#/components/parameters/TeamsOwnershipFilterApplicationIdParameter" - $ref: "#/components/parameters/TeamsOwnershipFilterServiceParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: application_id: "11111111-2222-3333-4444-555555555555" match_type: "exact" service: "web-checkout" teams: - mapping_id: "123" team_handle: "team-rum" view_name: "/checkout" id: "3b1e2f7a9c4d6e8f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f" type: teams_ownership_grouped_mappings schema: $ref: "#/components/schemas/TeamsOwnershipRulesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List teams ownership rules tags: - Rum Teams Ownership x-permission: operator: OR permissions: - rum_apps_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/rum/events: get: description: |- List endpoint returns events that match a RUM search query. [Results are paginated][1]. Use this endpoint to see your latest RUM events. [1]: https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination operationId: ListRUMEvents parameters: - description: Search query following RUM syntax. example: "@type:session @application_id:xxxx" in: query name: filter[query] required: false schema: type: string - description: Minimum timestamp for requested events. example: "2019-01-02T09:42:36.320Z" in: query name: filter[from] required: false schema: format: date-time type: string - description: Maximum timestamp for requested events. example: "2019-01-03T09:42:36.320Z" in: query name: filter[to] required: false schema: format: date-time type: string - description: Order of events in results. in: query name: sort required: false schema: $ref: "#/components/schemas/RUMSort" - description: |- List following results with a cursor provided in the previous query. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" in: query name: page[cursor] required: false schema: type: string - description: Maximum number of events in the response. example: 25 in: query name: page[limit] required: false schema: default: 10 format: int32 maximum: 1000 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: service: test-service timestamp: "2024-01-01T00:00:00+00:00" id: abc-123 type: rum schema: $ref: "#/components/schemas/RUMEventsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a list of RUM events tags: ["RUM"] x-pagination: cursorParam: page[cursor] cursorPath: meta.page.after limitParam: page[limit] resultsPath: data "x-permission": operator: OR permissions: - rum_apps_read /api/v2/rum/events/search: post: description: |- List endpoint returns RUM events that match a RUM search query. [Results are paginated][1]. Use this endpoint to build complex RUM events filtering and search. [1]: https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination operationId: SearchRUMEvents requestBody: content: "application/json": examples: default: value: filter: from: now-15m query: "@type:session AND @session.type:user" to: now options: timezone: GMT page: cursor: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== limit: 25 sort: timestamp schema: $ref: "#/components/schemas/RUMSearchEventsRequest" required: true responses: "200": content: application/json: examples: default: value: data: - attributes: service: test-service timestamp: "2024-01-01T00:00:00+00:00" id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: rum meta: elapsed: 132 request_id: abc-123 status: done schema: $ref: "#/components/schemas/RUMEventsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Search RUM events tags: ["RUM"] x-codegen-request-body-name: body x-pagination: cursorParam: body.page.cursor cursorPath: meta.page.after limitParam: body.page.limit resultsPath: data "x-permission": operator: OR permissions: - rum_apps_read /api/v2/rum/operations: post: description: Create a new RUM operation, defining the journey used to detect it from RUM events. operationId: CreateRUMOperation requestBody: content: application/json: examples: default: value: data: attributes: application_id: "abc12345-1234-5678-abcd-ef1234567890" category: conversion description: "Tracks users completing the checkout flow." display_name: Checkout completed journey_rum: rum_steps: - nodes: - query: '@type:action @action.type:click @action.target.name:"Checkout"' type: start - nodes: - query: '@type:action @action.type:click @action.target.name:"Confirm order"' type: stop name: checkout_completed tags: - "team:checkout" type: operations schema: $ref: "#/components/schemas/RUMOperationCreateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: application_id: "abc12345-1234-5678-abcd-ef1234567890" category: conversion created_at: "2024-01-15T10:30:00Z" created_by: email: jane.doe@example.com handle: jane.doe name: Jane Doe uuid: "abc12345-1234-5678-abcd-ef1234567890" description: "Tracks users completing the checkout flow." display_name: Checkout completed feature_ids: - "journey-123" journey_rum: rum_steps: - nodes: - id: "node-1" query: '@type:action @action.type:click @action.target.name:"Checkout"' type: start - nodes: - id: "node-2" query: '@type:action @action.type:click @action.target.name:"Confirm order"' type: stop name: checkout_completed org_id: 123456 tags: - "team:checkout" updated_at: updated_by: id: "abc12345-1234-5678-abcd-ef1234567890" type: operations schema: $ref: "#/components/schemas/RUMOperationResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict. An operation with this name already exists. "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a RUM operation tags: - RUM Operations x-permission: operator: OR permissions: - rum_apps_write /api/v2/rum/operations/by-name/{name}: get: description: Retrieve a specific RUM operation by its unique name. operationId: GetRUMOperationByName parameters: - description: The unique name of the RUM operation. in: path name: name required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: application_id: "abc12345-1234-5678-abcd-ef1234567890" category: conversion created_at: "2024-01-15T10:30:00Z" created_by: email: jane.doe@example.com handle: jane.doe name: Jane Doe uuid: "abc12345-1234-5678-abcd-ef1234567890" description: "Tracks users completing the checkout flow." display_name: Checkout completed feature_ids: - "journey-123" journey_rum: rum_steps: - nodes: - id: "node-1" query: '@type:action @action.type:click @action.target.name:"Checkout"' type: start - nodes: - id: "node-2" query: '@type:action @action.type:click @action.target.name:"Confirm order"' type: stop name: checkout_completed org_id: 123456 tags: - "team:checkout" updated_at: updated_by: id: "abc12345-1234-5678-abcd-ef1234567890" type: operations schema: $ref: "#/components/schemas/RUMOperationResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a RUM operation by name tags: - RUM Operations x-permission: operator: OR permissions: - rum_apps_read /api/v2/rum/operations/search: get: description: |- Search RUM operations for your organization. Supports filtering by query, creator, team, journey, and application. operationId: ListRUMOperations parameters: - description: A search query to filter operations by name. in: query name: query required: false schema: example: "checkout" type: string - description: Offset for pagination. in: query name: page[offset] required: false schema: default: 0 format: int64 minimum: 0 type: integer - description: Number of items per page. Maximum of 100. in: query name: page[limit] required: false schema: default: 50 format: int64 maximum: 100 minimum: 1 type: integer - description: Filter operations by the email of their creator. in: query name: creator required: false schema: example: user@example.com type: string - description: Filter operations by team. Accepts a comma-separated list of teams. in: query name: team required: false schema: example: "frontend,checkout" type: string - description: Filter operations by journey ID. Accepts a comma-separated list of journey IDs. in: query name: feature_id required: false schema: type: string - description: Filter operations by RUM application ID. in: query name: application_id required: false schema: example: "abc12345-1234-5678-abcd-ef1234567890" format: uuid type: string responses: "200": content: application/json: examples: default: value: data: - attributes: application_id: "abc12345-1234-5678-abcd-ef1234567890" category: conversion created_at: "2024-01-15T10:30:00Z" created_by: email: jane.doe@example.com handle: jane.doe name: Jane Doe uuid: "abc12345-1234-5678-abcd-ef1234567890" description: "Tracks users completing the checkout flow." display_name: Checkout completed feature_ids: - "journey-123" journey_rum: rum_steps: - nodes: - id: "node-1" query: '@type:action @action.type:click @action.target.name:"Checkout"' type: start - nodes: - id: "node-2" query: '@type:action @action.type:click @action.target.name:"Confirm order"' type: stop name: checkout_completed org_id: 123456 tags: - "team:checkout" updated_at: updated_by: id: "abc12345-1234-5678-abcd-ef1234567890" type: operations meta: page: first_offset: 0 last_offset: 0 limit: 50 next_offset: offset: 0 prev_offset: total: 1 type: offset schema: $ref: "#/components/schemas/RUMOperationsListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Search RUM operations tags: - RUM Operations x-permission: operator: OR permissions: - rum_apps_read /api/v2/rum/operations/strong_links: get: description: |- List links between RUM operations and journeys. A link confirms that a journey belongs to an operation. Provide `operation_id`, `feature_id` (journey ID), or both to filter results; at least one is required. operationId: ListRUMOperationStrongLinks parameters: - description: Filter links by RUM operation ID. in: query name: operation_id required: false schema: type: string - description: Filter links by journey (feature) ID. in: query name: feature_id required: false schema: type: string - description: Offset for pagination. in: query name: page[offset] required: false schema: default: 0 format: int64 minimum: 0 type: integer - description: Number of items per page. Maximum of 200. in: query name: page[limit] required: false schema: default: 50 format: int64 maximum: 200 minimum: 1 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-15T10:30:00Z" description: "Confirmed link between checkout_completed and journey-123." feature_id: "journey-123" operation_id: "abc12345-1234-5678-abcd-ef1234567890" status: CONFIRMED tags: - "team:checkout" updated_at: id: "abc12345-1234-5678-abcd-ef1234567890:journey-123" type: strong_links meta: limit: 50 offset: 0 total: 1 schema: $ref: "#/components/schemas/RUMOperationStrongLinksListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List RUM operation links tags: - RUM Operations x-permission: operator: OR permissions: - rum_apps_read post: description: |- Create a link between a RUM operation and a journey, confirming that the journey belongs to the operation. The operation can be identified by `operation_id` or `operation_name`; if `operation_name` does not match an existing operation, a stub operation is created. operationId: CreateRUMOperationStrongLink requestBody: content: application/json: examples: default: value: data: attributes: description: "Confirmed link between checkout_completed and journey-123." feature_id: "journey-123" operation_id: "abc12345-1234-5678-abcd-ef1234567890" status: CONFIRMED tags: - "team:checkout" type: strong_links schema: $ref: "#/components/schemas/RUMOperationStrongLinkCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00Z" description: "Confirmed link between checkout_completed and journey-123." feature_id: "journey-123" operation_id: "abc12345-1234-5678-abcd-ef1234567890" status: CONFIRMED tags: - "team:checkout" updated_at: id: "abc12345-1234-5678-abcd-ef1234567890:journey-123" type: strong_links schema: $ref: "#/components/schemas/RUMOperationStrongLinkResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found. The referenced `operation_id` does not exist. "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict. A link between this operation and journey already exists. "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a RUM operation link tags: - RUM Operations /api/v2/rum/operations/strong_links/{rum_operation_id}/{feature_id}: delete: description: Delete the link between a RUM operation and a journey. operationId: DeleteRUMOperationStrongLink parameters: - description: The unique identifier of the RUM operation. in: path name: rum_operation_id required: true schema: type: string - description: The unique identifier of the journey. in: path name: feature_id required: true schema: type: string responses: "204": description: No Content "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a RUM operation link tags: - RUM Operations put: description: Update the status of a link between a RUM operation and a journey. operationId: UpdateRUMOperationStrongLink parameters: - description: The unique identifier of the RUM operation. in: path name: rum_operation_id required: true schema: type: string - description: The unique identifier of the journey. in: path name: feature_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: status: CONFIRMED type: strong_links schema: $ref: "#/components/schemas/RUMOperationStrongLinkUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-15T10:30:00Z" description: "Confirmed link between checkout_completed and journey-123." feature_id: "journey-123" operation_id: "abc12345-1234-5678-abcd-ef1234567890" status: CONFIRMED tags: - "team:checkout" updated_at: "2024-01-16T09:00:00Z" id: "abc12345-1234-5678-abcd-ef1234567890:journey-123" type: strong_links schema: $ref: "#/components/schemas/RUMOperationStrongLinkResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a RUM operation link tags: - RUM Operations /api/v2/rum/operations/{rum_operation_id}: delete: description: Delete a RUM operation. operationId: DeleteRUMOperation parameters: - description: The unique identifier of the RUM operation to delete. in: path name: rum_operation_id required: true schema: type: string responses: "204": description: No Content "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a RUM operation tags: - RUM Operations x-permission: operator: OR permissions: - rum_apps_write get: description: Retrieve a specific RUM operation by its unique identifier. operationId: GetRUMOperation parameters: - description: The unique identifier of the RUM operation. in: path name: rum_operation_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: application_id: "abc12345-1234-5678-abcd-ef1234567890" category: conversion created_at: "2024-01-15T10:30:00Z" created_by: email: jane.doe@example.com handle: jane.doe name: Jane Doe uuid: "abc12345-1234-5678-abcd-ef1234567890" description: "Tracks users completing the checkout flow." display_name: Checkout completed feature_ids: - "journey-123" journey_rum: rum_steps: - nodes: - id: "node-1" query: '@type:action @action.type:click @action.target.name:"Checkout"' type: start - nodes: - id: "node-2" query: '@type:action @action.type:click @action.target.name:"Confirm order"' type: stop name: checkout_completed org_id: 123456 tags: - "team:checkout" updated_at: updated_by: id: "abc12345-1234-5678-abcd-ef1234567890" type: operations schema: $ref: "#/components/schemas/RUMOperationResponse" description: OK "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a RUM operation tags: - RUM Operations x-permission: operator: OR permissions: - rum_apps_read put: description: |- Update an existing RUM operation. Fields omitted from the request body keep their existing value, with the exception of `journey_rum`, which is required and fully replaced on every update. operationId: UpdateRUMOperation parameters: - description: The unique identifier of the RUM operation to update. in: path name: rum_operation_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: application_id: "abc12345-1234-5678-abcd-ef1234567890" category: conversion description: "Tracks users completing the checkout flow." display_name: Checkout completed journey_rum: rum_steps: - nodes: - query: '@type:action @action.type:click @action.target.name:"Checkout"' type: start - nodes: - query: '@type:action @action.type:click @action.target.name:"Confirm order"' type: stop name: checkout_completed tags: - "team:checkout" id: "abc12345-1234-5678-abcd-ef1234567890" type: operations schema: $ref: "#/components/schemas/RUMOperationUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: application_id: "abc12345-1234-5678-abcd-ef1234567890" category: conversion created_at: "2024-01-15T10:30:00Z" created_by: email: jane.doe@example.com handle: jane.doe name: Jane Doe uuid: "abc12345-1234-5678-abcd-ef1234567890" description: "Tracks users completing the checkout flow." display_name: Checkout completed feature_ids: - "journey-123" journey_rum: rum_steps: - nodes: - id: "node-1" query: '@type:action @action.type:click @action.target.name:"Checkout"' type: start - nodes: - id: "node-2" query: '@type:action @action.type:click @action.target.name:"Confirm order"' type: stop name: checkout_completed org_id: 123456 tags: - "team:checkout" updated_at: "2024-01-16T09:00:00Z" updated_by: email: jane.doe@example.com handle: jane.doe name: Jane Doe uuid: "abc12345-1234-5678-abcd-ef1234567890" id: "abc12345-1234-5678-abcd-ef1234567890" type: operations schema: $ref: "#/components/schemas/RUMOperationResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict. An operation with this name already exists. "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a RUM operation tags: - RUM Operations x-permission: operator: OR permissions: - rum_apps_write /api/v2/rum/query/insight/aggregated_long_tasks: post: description: |- Get aggregated long task data for a RUM view, grouped by invoker type and sampled across multiple view instances. operationId: QueryAggregatedLongTasks requestBody: content: application/json: examples: default: value: data: attributes: application_id: ccbc53b1-74f2-496b-bdd7-9a8fa7b7376b from: 1762437564 sample_size: 20 to: 1762523964 view_name: /account/login(/:type) type: aggregated_long_tasks schema: $ref: "#/components/schemas/AggregatedLongTasksRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: application_id: ccbc53b1-74f2-496b-bdd7-9a8fa7b7376b criteria: from: 1762437564 long_tasks_by_invoker_type: - impact_score: 0.4 invoker_type: resolve-promise stats_per_view: total_blocking_time_ms: average: 3504.1 max: 3517.8 min: 3500.1 total_count: average: 1.0 max: 1.0 min: 1.0 top_invokers: - file: src/pages/Gallery.tsx impact_score: 0.67 invoker: Response.json.then stats_per_view: total_count: average: 1.0 max: 1.0 min: 1.0 view_occurrences: 68 view_occurrences: 68 sampled_view_ids: - 6fbf69b6-9455-436a-b894-a6bf64126d40 to: 1762523964 view_count: 20 view_name: /account/login(/:type) id: 2f0b3455 type: aggregated_long_tasks schema: $ref: "#/components/schemas/AggregatedLongTasksResponse" description: Successful response "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Query aggregated long tasks tags: ["RUM Insights"] x-permission: operator: OR permissions: - rum_apps_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/rum/query/insight/aggregated_waterfall: post: description: |- Get aggregated network resource waterfall data for a RUM view, sampled across multiple view instances. operationId: QueryAggregatedWaterfall requestBody: content: application/json: examples: default: value: data: attributes: application_id: ccbc53b1-74f2-496b-bdd7-9a8fa7b7376b criteria: metric: largest_contentful_paint min: 0.3 from: 1762437564 sample_size: 20 to: 1762523964 view_name: /account/login(/:type) type: aggregated_waterfall schema: $ref: "#/components/schemas/AggregatedWaterfallRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: application_id: ccbc53b1-74f2-496b-bdd7-9a8fa7b7376b criteria: metric: largest_contentful_paint min: 0.3 from: 1762437564 resources: - avg_duration_ms: 839.1 avg_start_time_ms: 1486.3 cache_hit_rate_pct: 100.0 cached_count: 27 downloaded_count: 0 http_method: GET load_frequency_pct: 54.0 local_cache_count: 20 max_duration_ms: 945.6 median_duration_ms: 836.2 min_duration_ms: 812.7 non_blocking_count: 23 p75_duration_ms: 844.1 p95_duration_ms: 861.8 render_blocking_count: 4 render_blocking_pct: 14.8 resource_type: fetch resource_url_path_group: /api/gallery server_validated_cache_count: 7 timing_breakdown: avg_connect_ms: 0.0 avg_dns_ms: 0.0 avg_download_ms: 0.6 avg_first_byte_ms: 59.9 avg_redirect_ms: 0.0 avg_ssl_ms: 0.0 total_requests: 27 views_with_resource: 27 sampled_view_ids: - 6fbf69b6-9455-436a-b894-a6bf64126d40 to: 1762523964 total_cache_hit_rate_pct: 0.5 view_count: 20 view_name: /account/login(/:type) id: 2f0b3455 type: aggregated_waterfall schema: $ref: "#/components/schemas/AggregatedWaterfallResponse" description: Successful response "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Query aggregated waterfall tags: ["RUM Insights"] x-permission: operator: OR permissions: - rum_apps_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/rum/recover/count: post: description: >- Return the full estimated number of recoverable sessions and the configured maximum per batch. The estimate is not capped at that maximum. This endpoint does not create a recovery request. Narrow the query or time range if the estimate exceeds max_recoverable_sessions. Creation checks a fresh estimate and returns 400 if it exceeds the configured maximum. operationId: GetRUMRecoverySessionCount requestBody: content: application/json: examples: default: value: data: attributes: from: 1789905600000 query: service:web to: 1789992000000 type: rum_recovery_count schema: $ref: "#/components/schemas/RumRecoveryCountRequest" description: JSON:API request body. required: true responses: "200": content: application/json: examples: above_maximum: summary: An estimate of 150,000 exceeds the batch maximum value: data: attributes: estimated_count: 150000 max_recoverable_sessions: 100000 id: count type: rum_recovery_count default: value: data: attributes: estimated_count: 100 max_recoverable_sessions: 100000 id: count type: rum_recovery_count schema: $ref: "#/components/schemas/RumRecoveryCountResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] summary: Estimate recoverable sessions tags: - RUM Recovery x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_rehydration_index /api/v2/rum/recover/requests: get: description: >- List batch recovery requests for your organization. Set `type=batch`. Optional `from` and `to` bounds filter request creation time; `query` filters the queries stored on recovery requests. A filtered page can be empty or contain fewer than `limit` results and still include `meta.next_cursor`. Continue until the cursor is absent, keeping the filters unchanged between pages. operationId: ListRUMRecoveryBatchRequests parameters: - description: Must equal batch. in: query name: type required: true schema: $ref: "#/components/schemas/RumRecoveryBatchRequestType" - description: >- Number of results returned per page, at most 100 (default 50). Omitted, zero, or negative values use 50. Invalid integers return 400. in: query name: limit required: false schema: default: 50 format: int32 maximum: 100 type: integer - description: Opaque next-page cursor. Keep type, from, to, and query unchanged between pages. in: query name: cursor required: false schema: type: string - description: >- Start of the request creation-time range in Unix milliseconds, inclusive. This filters created_at, not the time range of the sessions being recovered. Must be earlier than to when both are provided. example: 1789905600000 in: query name: from required: false schema: format: int64 maximum: 253402300799999 minimum: 1 type: integer - description: >- End of the request creation-time range in Unix milliseconds, exclusive. This filters created_at, not the time range of the sessions being recovered. Must be later than from when both are provided. example: 1789992000000 in: query name: to required: false schema: format: int64 maximum: 253402300799999 minimum: 1 type: integer - description: >- Filter recovery requests whose stored query selects matching facet values. Supports facet:value and facet:(A OR B) terms combined with AND, including * and ? wildcards in filter values. Attribute facets keep their leading @. At most 4096 bytes. Exclusions, repeated facets, free text, ranges, and OR between terms return 400. Stored queries that cannot be matched unambiguously are excluded. Blank values apply no query filter. example: "service:checkout AND @usr.id:(123 OR 456)" in: query name: query required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2026-09-21T12:00:00Z" discovery_status: PROCESSING from: 1789905600000 query: service:checkout sessions_discovered: 84200 sessions_failed: 0 sessions_processed: 56000 slices_completed: 8 slices_failed: 0 status: PROCESSING to: 1789992000000 total_slices: 12 updated_at: "2026-09-21T12:05:00Z" id: 11111111-1111-4111-8111-111111111111 type: rum_batch_recovery_request meta: {} empty: value: data: [] meta: {} filtered_page: summary: An empty filtered page with more history to scan value: data: [] meta: next_cursor: example schema: $ref: "#/components/schemas/RumRecoveryBatchListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] summary: List batch recovery requests tags: - RUM Recovery x-permission: operator: OR permissions: - rum_rehydration_index post: description: >- Start targeted or query-based batch recovery. Use the returned `data.id` to poll the recovery request for progress. Batch creation checks a fresh recoverable-session estimate against the configured maximum (100,000 by default), accepting estimates equal to the maximum. Use the count operation to check the current maximum; creation can still reject a changed estimate. Narrow the query or time range if the maximum is exceeded. Creation is not idempotent. After an uncertain response, check session search or batch listing before retrying. operationId: CreateRUMRecoveryRequest requestBody: content: application/json: examples: batch: value: data: attributes: estimated_count: 100 from: 1789905600000 query: service:web request_type: batch to: 1789992000000 type: rum_recovery_request default: value: data: attributes: sessions: - application_id: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 session_id: 00000000-0000-4000-8000-000000000001 type: rum_recovery_request targeted: value: data: attributes: sessions: - application_id: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 session_id: 00000000-0000-4000-8000-000000000001 type: rum_recovery_request schema: $ref: "#/components/schemas/RumRecoveryCreateRequest" description: JSON:API request body. required: true responses: "202": content: application/json: examples: default: value: data: attributes: created_at: "2026-09-21T12:00:00Z" failed_sessions: 0 processed_sessions: 0 status: PENDING total_sessions: 1 id: 11111111-1111-4111-8111-111111111111 type: rum_recovery_request pending_batch: value: data: attributes: created_at: "2026-09-21T12:00:00Z" discovery_status: PENDING estimated_count: 100 failed_sessions: 0 processed_sessions: 0 status: PENDING id: 11111111-1111-4111-8111-111111111111 type: rum_recovery_request queued_batch: value: data: attributes: created_at: "2026-09-21T12:00:00Z" discovery_status: QUEUED estimated_count: 100 failed_sessions: 0 processed_sessions: 0 status: PENDING id: 11111111-1111-4111-8111-111111111111 type: rum_recovery_request targeted: value: data: attributes: created_at: "2026-09-21T12:00:00Z" failed_sessions: 0 processed_sessions: 0 status: PENDING total_sessions: 1 id: 11111111-1111-4111-8111-111111111111 type: rum_recovery_request schema: $ref: "#/components/schemas/RumRecoveryCreateResponse" description: Accepted "400": content: application/json: examples: limit_exceeded: summary: The server estimate exceeds the configured batch maximum value: errors: - code: batch_recovery_limit_exceeded detail: >- Estimated recoverable sessions exceed the batch maximum. Narrow the query or time range. meta: estimated_count: 150000 max_recoverable_sessions: 100000 status: "400" title: Bad Request schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: >- Conflict. Targeted sessions are already retained, in flight, or previously failed, or a concurrent batch was created. "429": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: >- Too many requests, or the batch recovery queue is full. security: - apiKeyAuth: [] appKeyAuth: [] summary: Create a recovery request tags: - RUM Recovery x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_rehydration_index /api/v2/rum/recover/requests/{request_id}: get: description: >- Get progress for a targeted or batch recovery request. A `COMPLETED` request can include failed sessions; check individual session statuses for targeted recovery. operationId: GetRUMRecoveryRequest parameters: - description: Recovery request UUID. in: path name: request_id required: true schema: description: Request identifier. example: 11111111-1111-4111-8111-111111111111 format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-09-21T12:00:00Z" failed_sessions: 0 processed_sessions: 1 sessions: - application_id: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 events_recovered: 17 session_id: 00000000-0000-4000-8000-000000000001 status: RECOVERED status: COMPLETED total_sessions: 1 updated_at: "2026-09-21T12:00:00Z" id: 11111111-1111-4111-8111-111111111111 type: rum_recovery_request targeted: value: data: attributes: created_at: "2026-09-21T12:00:00Z" failed_sessions: 0 processed_sessions: 1 sessions: - application_id: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 events_recovered: 17 session_id: 00000000-0000-4000-8000-000000000001 status: RECOVERED status: COMPLETED total_sessions: 1 updated_at: "2026-09-21T12:00:00Z" id: 11111111-1111-4111-8111-111111111111 type: rum_recovery_request schema: $ref: "#/components/schemas/RumRecoveryRequestResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] summary: Get recovery request progress tags: - RUM Recovery x-permission: operator: OR permissions: - rum_rehydration_filter_read patch: description: >- Cancel pending work for a batch recovery request. Work already in progress can finish, and recovered data is not removed. Requests in a terminal state return `409`. operationId: UpdateRUMRecoveryBatchRequest parameters: - description: Recovery request UUID. in: path name: request_id required: true schema: description: Request identifier. example: 11111111-1111-4111-8111-111111111111 format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: status: cancelled type: rum_recovery_request minimal: value: data: attributes: status: cancelled schema: $ref: "#/components/schemas/RumRecoveryCancelRequest" description: JSON:API request body. required: true responses: "200": content: application/json: examples: default: value: data: attributes: cancelled_at: "2026-09-21T12:00:00Z" cancelled_by: user@example.com discovery_status: CANCELLED id: 11111111-1111-4111-8111-111111111111 type: rum_recovery_request schema: $ref: "#/components/schemas/RumRecoveryCancelResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] summary: Cancel a batch recovery request tags: - RUM Recovery x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_rehydration_index /api/v2/rum/recover/sessions: post: description: >- Search archived RUM sessions. Use `meta.page.next_cursor` to retrieve the next page. operationId: SearchRUMArchiveSessions requestBody: content: application/json: examples: default: value: data: attributes: from: 1789905600000 limit: 50 query: service:web to: 1789992000000 type: rum_archive_sessions_request schema: $ref: "#/components/schemas/RumArchiveSessionsSearchRequest" description: JSON:API request body. required: true responses: "200": content: application/json: examples: default: value: data: - attributes: account_id: anonymous_id: application_id: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 country: recovery_status: status: AVAILABLE service: web session_id: 00000000-0000-4000-8000-000000000001 timestamp: 1789905600000 user_id: version: id: 00000000-0000-4000-8000-000000000001 type: rum_archive_session meta: page: total_count: 1 empty: value: data: [] meta: page: total_count: 0 recovered: value: data: - attributes: account_id: anonymous_id: application_id: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 country: recovery_status: recovered_at: "2026-09-21T12:00:00Z" request_id: 11111111-1111-4111-8111-111111111111 status: RECOVERED service: web session_id: 00000000-0000-4000-8000-000000000001 timestamp: 1789905600000 user_id: version: id: 00000000-0000-4000-8000-000000000001 type: rum_archive_session meta: page: total_count: 1 unavailable_status: value: data: - attributes: account_id: anonymous_id: application_id: a33671aa-24fd-4dcd-ba4b-5bbdbafe7690 country: recovery_status: service: web session_id: 00000000-0000-4000-8000-000000000001 timestamp: 1789905600000 user_id: version: id: 00000000-0000-4000-8000-000000000001 type: rum_archive_session meta: page: total_count: 1 schema: $ref: "#/components/schemas/RumArchiveSessionsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Forbidden "429": content: application/json: schema: $ref: "#/components/schemas/RumManagedArchiveErrorResponse" description: Too Many Requests security: - apiKeyAuth: [] appKeyAuth: [] summary: Search archived sessions tags: - RUM Recovery x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_rehydration_filter_read /api/v2/rum/replay/playlists: get: description: List playlists. operationId: ListRumReplayPlaylists parameters: - description: Filter playlists by the UUID of the user who created them. in: query name: filter[created_by_uuid] schema: example: 00000000-0000-0000-0000-000000000001 type: string - description: Search query to filter playlists by name. in: query name: filter[query] schema: example: my playlist type: string - description: Page number for pagination (0-indexed). in: query name: page[number] schema: example: 0 format: int64 type: integer - description: Number of items per page. in: query name: page[size] schema: example: 25 format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: name: My Playlist id: "123" type: rum_replay_playlist schema: $ref: "#/components/schemas/PlaylistArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List RUM replay playlists tags: - Rum Replay Playlists x-permission: operator: OR permissions: - rum_session_replay_read post: description: Create a playlist. operationId: CreateRumReplayPlaylist requestBody: content: application/json: examples: default: value: data: attributes: created_by: handle: john.doe@example.com id: 00000000-0000-0000-0000-000000000001 uuid: 00000000-0000-0000-0000-000000000001 name: My Playlist type: rum_replay_playlist schema: $ref: "#/components/schemas/Playlist" required: true responses: "201": content: application/json: examples: default: value: data: attributes: name: My Playlist id: "123" type: rum_replay_playlist schema: $ref: "#/components/schemas/Playlist" description: Created "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create RUM replay playlist tags: - Rum Replay Playlists x-permission: operator: OR permissions: - rum_playlist_write /api/v2/rum/replay/playlists/{playlist_id}: delete: description: Delete a playlist. operationId: DeleteRumReplayPlaylist parameters: - description: Unique identifier of the playlist. in: path name: playlist_id required: true schema: example: 1234567 format: int64 type: integer responses: "204": description: No Content "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete RUM replay playlist tags: - Rum Replay Playlists x-permission: operator: OR permissions: - rum_playlist_write get: description: Get a playlist. operationId: GetRumReplayPlaylist parameters: - description: Unique identifier of the playlist. in: path name: playlist_id required: true schema: example: 1234567 format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: name: My Playlist id: "123" type: rum_replay_playlist schema: $ref: "#/components/schemas/Playlist" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get RUM replay playlist tags: - Rum Replay Playlists x-permission: operator: OR permissions: - rum_session_replay_read put: description: Update a playlist. operationId: UpdateRumReplayPlaylist parameters: - description: Unique identifier of the playlist. in: path name: playlist_id required: true schema: example: 1234567 format: int64 type: integer requestBody: content: application/json: examples: default: value: data: attributes: created_by: handle: john.doe@example.com id: 00000000-0000-0000-0000-000000000001 uuid: 00000000-0000-0000-0000-000000000001 name: My Playlist type: rum_replay_playlist schema: $ref: "#/components/schemas/Playlist" required: true responses: "200": content: application/json: examples: default: value: data: attributes: name: My Playlist id: "123" type: rum_replay_playlist schema: $ref: "#/components/schemas/Playlist" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update RUM replay playlist tags: - Rum Replay Playlists x-permission: operator: OR permissions: - rum_playlist_write /api/v2/rum/replay/playlists/{playlist_id}/sessions: delete: description: Remove sessions from a playlist. operationId: BulkRemoveRumReplayPlaylistSessions parameters: - description: Unique identifier of the playlist. in: path name: playlist_id required: true schema: example: 1234567 format: int64 type: integer requestBody: content: application/json: examples: default: value: data: - id: 00000000-0000-0000-0000-000000000001 type: rum_replay_session schema: $ref: "#/components/schemas/SessionIdArray" required: true responses: "204": description: No Content "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Bulk remove RUM replay playlist sessions tags: - Rum Replay Playlists x-permission: operator: OR permissions: - rum_playlist_write get: description: List sessions in a playlist. operationId: ListRumReplayPlaylistSessions parameters: - description: Unique identifier of the playlist. in: path name: playlist_id required: true schema: example: 1234567 format: int64 type: integer - description: Page number for pagination (0-indexed). in: query name: page[number] schema: example: 0 format: int64 type: integer - description: Number of items per page. in: query name: page[size] schema: example: 25 format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: track: main id: 00000000-0000-0000-0000-000000000001 type: rum_replay_session schema: $ref: "#/components/schemas/PlaylistsSessionArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List RUM replay playlist sessions tags: - Rum Replay Playlists x-permission: operator: OR permissions: - rum_session_replay_read /api/v2/rum/replay/playlists/{playlist_id}/sessions/{session_id}: delete: description: Remove a session from a playlist. operationId: RemoveRumReplaySessionFromPlaylist parameters: - description: Unique identifier of the playlist. in: path name: playlist_id required: true schema: example: 1234567 format: int64 type: integer - description: Unique identifier of the session. in: path name: session_id required: true schema: example: 00000000-0000-0000-0000-000000000001 type: string responses: "204": description: No Content "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Remove RUM replay session from playlist tags: - Rum Replay Playlists x-permission: operator: OR permissions: - rum_playlist_write put: description: Add a session to a playlist. operationId: AddRumReplaySessionToPlaylist parameters: - description: "Data source type. Valid values: 'rum' or 'product_analytics'. Defaults to 'rum'." in: query name: data_source schema: example: rum type: string - description: Server-side timestamp in milliseconds. in: query name: ts required: true schema: example: 1704067200000 format: int64 type: integer - description: Unique identifier of the playlist. in: path name: playlist_id required: true schema: example: 1234567 format: int64 type: integer - description: Unique identifier of the session. in: path name: session_id required: true schema: example: 00000000-0000-0000-0000-000000000001 type: string responses: "200": content: application/json: examples: default: value: data: attributes: track: main id: 00000000-0000-0000-0000-000000000001 type: rum_replay_session schema: $ref: "#/components/schemas/PlaylistsSession" description: OK "201": content: application/json: examples: default: value: data: attributes: track: main id: 00000000-0000-0000-0000-000000000001 type: rum_replay_session schema: $ref: "#/components/schemas/PlaylistsSession" description: Created "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Add RUM replay session to playlist tags: - Rum Replay Playlists x-permission: operator: OR permissions: - rum_playlist_write /api/v2/rum/replay/sessions/{session_id}/views/{view_id}/segments: get: description: Get segments for a view. operationId: GetSegments parameters: - description: Unique identifier of the view. in: path name: view_id required: true schema: example: 00000000-0000-0000-0000-000000000002 type: string - description: "Storage source: 'event_platform' or 'blob'." in: query name: source schema: example: event_platform type: string - description: Unique identifier of the session. in: path name: session_id required: true schema: example: 00000000-0000-0000-0000-000000000001 type: string - description: Server-side timestamp in milliseconds. in: query name: ts schema: example: 1704067200000 format: int64 type: integer - description: Maximum size in bytes for the segment list. in: query name: max_list_size schema: example: 1048576 format: int64 type: integer - description: |- Token of the next page from the `X-Paging` header of the previous response. Send it without changes, URL-encoded in the query string. Omit it to get the first page. in: query name: paging schema: type: string responses: "200": description: OK headers: X-Has-More-Segments-To-Fetch: description: |- `true` if the view has more segments to get. To get them, send the request again with the `paging` query parameter until this header is `false`. schema: type: boolean X-Paging: description: |- Token of the next page to send in the `paging` query parameter. Present only when `X-Has-More-Segments-To-Fetch` is `true`. schema: type: string "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get segments tags: - Rum Replay Sessions x-permission: operator: OR permissions: - rum_session_replay_read /api/v2/rum/replay/sessions/{session_id}/watchers: get: description: List session watchers. operationId: ListRumReplaySessionWatchers parameters: - description: Number of items per page. in: query name: page[size] schema: example: 25 format: int64 type: integer - description: Page number for pagination (0-indexed). in: query name: page[number] schema: example: 0 format: int64 type: integer - description: Unique identifier of the session. in: path name: session_id required: true schema: example: 00000000-0000-0000-0000-000000000001 type: string responses: "200": content: application/json: examples: default: value: data: - attributes: handle: test@example.com last_watched_at: "2024-01-01T00:00:00+00:00" watch_count: 1 id: abc-123 type: rum_replay_watcher schema: $ref: "#/components/schemas/WatcherArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List RUM replay session watchers tags: - Rum Replay Viewership x-permission: operator: OR permissions: - rum_session_replay_read /api/v2/rum/replay/sessions/{session_id}/watches: delete: description: Delete session watch history. operationId: DeleteRumReplaySessionWatch parameters: - description: Unique identifier of the session. in: path name: session_id required: true schema: example: 00000000-0000-0000-0000-000000000001 type: string responses: "204": description: No Content "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete RUM replay session watch tags: - Rum Replay Viewership x-permission: operator: OR permissions: - rum_playlist_write post: description: Record a session watch. operationId: CreateRumReplaySessionWatch parameters: - description: Unique identifier of the session. in: path name: session_id required: true schema: example: 00000000-0000-0000-0000-000000000001 type: string requestBody: content: application/json: examples: default: value: data: attributes: application_id: aaaaaaaa-1111-2222-3333-bbbbbbbbbbbb event_id: 11111111-2222-3333-4444-555555555555 timestamp: "2026-01-13T17:15:53.208340Z" type: rum_replay_watch schema: $ref: "#/components/schemas/Watch" required: true responses: "201": content: application/json: examples: default: value: data: attributes: application_id: aaaaaaaa-1111-2222-3333-bbbbbbbbbbbb event_id: 11111111-2222-3333-4444-555555555555 timestamp: "2024-01-01T00:00:00+00:00" id: abc-123 type: rum_replay_watch schema: $ref: "#/components/schemas/Watch" description: Created "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create RUM replay session watch tags: - Rum Replay Viewership x-permission: operator: OR permissions: - rum_playlist_write /api/v2/rum/replay/viewership-history/sessions: get: description: List watched sessions. operationId: ListRumReplayViewershipHistorySessions parameters: - description: Start timestamp in milliseconds for watched_at filter. in: query name: filter[watched_at][start] schema: example: 1704067200000 format: int64 type: integer - description: Page number for pagination (0-indexed). in: query name: page[number] schema: example: 0 format: int64 type: integer - description: Filter by user UUID. Defaults to current user if not specified. in: query name: filter[created_by] schema: example: 00000000-0000-0000-0000-000000000001 type: string - description: End timestamp in milliseconds for watched_at filter. in: query name: filter[watched_at][end] schema: example: 1704153600000 format: int64 type: integer - description: Comma-separated list of session IDs to filter by. in: query name: filter[session_ids] schema: example: 11111111-2222-3333-4444-555555555555,22222222-3333-4444-5555-666666666666 type: string - description: Number of items per page. in: query name: page[size] schema: example: 25 format: int64 type: integer - description: Filter by application ID. in: query name: filter[application_id] schema: example: aaaaaaaa-1111-2222-3333-bbbbbbbbbbbb type: string responses: "200": content: application/json: examples: default: value: data: - attributes: last_watched_at: "2024-01-01T00:00:00+00:00" id: abc-123 type: rum_replay_session schema: $ref: "#/components/schemas/ViewershipHistorySessionArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List RUM replay viewership history sessions tags: - Rum Replay Viewership x-permission: operator: OR permissions: - rum_session_replay_read /api/v2/saml_configurations: get: description: Get the list of SAML configurations for the current organization. An organization has at most one SAML configuration. operationId: ListSAMLConfigurations responses: "200": content: application/json: examples: default: value: data: - attributes: assertion_consumer_service: - https://app.datadoghq.com/account/saml/assertion entity_id: https://app.datadoghq.com/account/saml/metadata.xml?id=00000000-0000-0000-0000-000000000000 expires_at: "2010-10-26T13:31:15+00:00" idp_initiated: true jit_domains: - example.com sso_url: https://app.datadoghq.com/account/login/id/00000000-0000-0000-0000-000000000000 id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d relationships: default_roles: data: - id: 8dd1cf3c-0c75-11ea-ad28-fb5701eabc7d type: roles type: saml_configurations included: - attributes: name: Datadog Standard Role id: 8dd1cf3c-0c75-11ea-ad28-fb5701eabc7d type: roles schema: $ref: "#/components/schemas/SAMLConfigurationsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List SAML configurations tags: - Organizations "x-permission": operator: OR permissions: - org_management /api/v2/saml_configurations/idp_metadata: post: description: |- Endpoint for uploading IdP metadata for SAML setup. Use this endpoint to upload or replace IdP metadata for SAML login configuration. operationId: UploadIdPMetadata requestBody: content: multipart/form-data: examples: default: value: {} schema: $ref: "#/components/schemas/IdPMetadataFormData" required: true responses: "200": description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Upload IdP metadata tags: - Organizations x-codegen-request-body-name: body "x-permission": operator: OR permissions: - org_management /api/v2/saml_configurations/{saml_config_uuid}: get: description: Get a single SAML configuration for the current organization by its UUID. operationId: GetSAMLConfiguration parameters: - $ref: "#/components/parameters/SAMLConfigurationUUIDPathParameter" responses: "200": content: application/json: examples: default: value: data: attributes: assertion_consumer_service: - https://app.datadoghq.com/account/saml/assertion entity_id: https://app.datadoghq.com/account/saml/metadata.xml?id=00000000-0000-0000-0000-000000000000 expires_at: "2010-10-26T13:31:15+00:00" idp_initiated: true jit_domains: - example.com sso_url: https://app.datadoghq.com/account/login/id/00000000-0000-0000-0000-000000000000 id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d relationships: default_roles: data: - id: 8dd1cf3c-0c75-11ea-ad28-fb5701eabc7d type: roles type: saml_configurations included: - attributes: name: Datadog Standard Role id: 8dd1cf3c-0c75-11ea-ad28-fb5701eabc7d type: roles schema: $ref: "#/components/schemas/SAMLConfigurationResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a SAML configuration tags: - Organizations "x-permission": operator: OR permissions: - org_management patch: description: |- Update a single SAML configuration for the current organization. Use this endpoint to enable or disable identity-provider-initiated login, set the just-in-time provisioning domains, and set the default role assigned to just-in-time provisioned users. A default role is required to enable just-in-time provisioning. operationId: UpdateSAMLConfiguration parameters: - $ref: "#/components/parameters/SAMLConfigurationUUIDPathParameter" requestBody: content: application/json: examples: default: value: data: attributes: idp_initiated: true jit_domains: - example.com id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d relationships: default_roles: data: - id: 8dd1cf3c-0c75-11ea-ad28-fb5701eabc7d type: roles type: saml_configurations schema: $ref: "#/components/schemas/SAMLConfigurationUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: assertion_consumer_service: - https://app.datadoghq.com/account/saml/assertion entity_id: https://app.datadoghq.com/account/saml/metadata.xml?id=00000000-0000-0000-0000-000000000000 expires_at: "2010-10-26T13:31:15+00:00" idp_initiated: true jit_domains: - example.com sso_url: https://app.datadoghq.com/account/login/id/00000000-0000-0000-0000-000000000000 id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d relationships: default_roles: data: - id: 8dd1cf3c-0c75-11ea-ad28-fb5701eabc7d type: roles type: saml_configurations included: - attributes: name: Datadog Standard Role id: 8dd1cf3c-0c75-11ea-ad28-fb5701eabc7d type: roles schema: $ref: "#/components/schemas/SAMLConfigurationResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "422": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a SAML configuration tags: - Organizations x-codegen-request-body-name: body "x-permission": operator: OR permissions: - org_management /api/v2/scorecard/campaigns: get: description: Fetches all scorecard campaigns. operationId: ListScorecardCampaigns parameters: - description: Maximum number of campaigns to return. in: query name: page[limit] required: false schema: default: 10 example: 10 format: int64 type: integer - description: Offset for pagination. in: query name: page[offset] required: false schema: default: 0 example: 0 format: int64 type: integer - description: Filter campaigns by name (full-text search). in: query name: filter[campaign][name] required: false schema: example: security type: string - description: Filter campaigns by status. in: query name: filter[campaign][status] required: false schema: example: in_progress type: string - description: Filter campaigns by owner UUID. in: query name: filter[campaign][owner] required: false schema: example: 550e8400-e29b-41d4-a716-446655440000 type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2026-01-01T00:00:00Z" entity_scope: kind:service key: test-campaign-1 modified_at: "2026-01-01T00:00:00Z" name: Test Campaign 1 owner: "" start_date: "2026-01-01T00:00:00Z" status: in_progress id: campaign-1 meta: entity_count: 25 rule_count: 2 relationships: rules: data: - id: rule-1 type: rule - id: rule-2 type: rule type: campaign meta: count: 1 limit: 10 offset: 0 total: 1 schema: $ref: "#/components/schemas/ListCampaignsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_read - cases_read summary: List all campaigns tags: - Scorecards post: description: Creates a new scorecard campaign. operationId: CreateScorecardCampaign requestBody: content: application/json: examples: default: value: data: attributes: description: Campaign to improve security posture for Q1 2024. due_date: "2024-03-31T23:59:59Z" entity_scope: "kind:service AND team:platform" guidance: Please ensure all services pass the security requirements. key: q1-security-2024 name: Q1 Security Campaign owner_id: 550e8400-e29b-41d4-a716-446655440000 rule_ids: - q8MQxk8TCqrHnWkx - r9NRyl9UDrsIoXly start_date: "2024-01-01T00:00:00Z" status: in_progress type: campaign schema: $ref: "#/components/schemas/CreateCampaignRequest" description: Campaign data. required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2026-01-01T00:00:00Z" key: minimal-campaign modified_at: "2026-01-01T00:00:00Z" name: Minimal Campaign owner: 21f98ae1-4ae2-11eb-958f-07e105a6e810 start_date: "2026-01-01T00:00:00Z" status: in_progress id: campaign-2 relationships: rules: data: - id: rule-1 type: rule type: campaign schema: $ref: "#/components/schemas/CampaignResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_write - cases_write summary: Create a new campaign tags: - Scorecards /api/v2/scorecard/campaigns/{campaign_id}: delete: description: Deletes a single campaign by ID or key. operationId: DeleteScorecardCampaign parameters: - description: Campaign ID or key. in: path name: campaign_id required: true schema: example: c10ODp0VCrrIpXmz type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_write - cases_write summary: Delete a campaign tags: - Scorecards get: description: Fetches a single campaign by ID or key. operationId: GetScorecardCampaign parameters: - description: Campaign ID or key. in: path name: campaign_id required: true schema: example: c10ODp0VCrrIpXmz type: string - description: Include related data (for example, scores). in: query name: include required: false schema: example: scores type: string - description: Include metadata (entity and rule counts). in: query name: include_meta required: false schema: example: true type: boolean responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-01-01T00:00:00Z" key: test-campaign modified_at: "2026-01-01T00:00:00Z" name: Test Campaign owner: "" start_date: "2026-01-01T00:00:00Z" status: in_progress id: c2b79b87-327c-40fa-b726-228f1a60bbb4 relationships: campaign_score: data: id: c2b79b87-327c-40fa-b726-228f1a60bbb4 type: score rule_scores: data: - id: rule-1 type: score rules: data: - id: rule-1 type: rule type: campaign included: - attributes: aggregation: campaign denominator: 13 numerator: 10 score: 76.92 total_fail: 2 total_no_data: 0 total_pass: 10 total_skip: 1 id: c2b79b87-327c-40fa-b726-228f1a60bbb4 type: score schema: $ref: "#/components/schemas/CampaignResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_read - cases_read summary: Get a campaign tags: - Scorecards put: description: Updates an existing campaign. operationId: UpdateScorecardCampaign parameters: - description: Campaign ID or key. in: path name: campaign_id required: true schema: example: c10ODp0VCrrIpXmz type: string requestBody: content: application/json: examples: default: value: data: attributes: description: Campaign to improve security posture for Q1 2024. due_date: "2024-03-31T23:59:59Z" entity_scope: "kind:service AND team:platform" guidance: Please ensure all services pass the security requirements. key: q1-security-2024 name: Q1 Security Campaign owner_id: 550e8400-e29b-41d4-a716-446655440000 rule_ids: - q8MQxk8TCqrHnWkx - r9NRyl9UDrsIoXly start_date: "2024-01-01T00:00:00Z" status: in_progress type: campaign schema: $ref: "#/components/schemas/UpdateCampaignRequest" description: Campaign data. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-01-01T00:00:00Z" description: Updated Description key: updated-campaign modified_at: "2026-01-02T00:00:00Z" name: Updated Campaign owner: 21f98ae1-4ae2-11eb-958f-07e105a6e810 start_date: "2026-01-01T00:00:00Z" status: completed id: 9c15b9ca-5abd-4875-84c2-02e166a45959 relationships: rules: data: - id: rule-1 type: rule - id: rule-2 type: rule type: campaign schema: $ref: "#/components/schemas/CampaignResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_write - cases_write summary: Update a campaign tags: - Scorecards /api/v2/scorecard/outcomes: get: description: Fetches all rule outcomes. operationId: ListScorecardOutcomes parameters: - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageOffset" - description: Include related rule details in the response. in: query name: include required: false schema: example: rule type: string - description: Return only specified values in the outcome attributes. in: query name: fields[outcome] required: false schema: example: state, service_name type: string - description: Return only specified values in the included rule details. in: query name: fields[rule] required: false schema: example: name type: string - description: Filter outcomes on a specific service name. in: query name: filter[outcome][service_name] required: false schema: example: web-store type: string - description: Filter outcomes by a specific state. in: query name: filter[outcome][state] required: false schema: example: fail type: string - description: Filter outcomes based on whether a rule is enabled or disabled. in: query name: filter[rule][enabled] required: false schema: example: true type: boolean - description: Filter outcomes based on rule ID. in: query name: filter[rule][id] required: false schema: example: f4485c79-0762-449c-96cf-c31e54a659f6 type: string - description: Filter outcomes based on rule name. in: query name: filter[rule][name] required: false schema: example: SLOs Defined type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2026-01-06T12:51:32.000546001Z" modified_at: "2026-01-06T12:51:32.000546001Z" remarks: test service_name: my-service state: pass id: a75tJIv_kNQ relationships: rule: data: id: rule-1 type: rule type: outcome links: next: /api/v2/scorecard/outcomes?page%5Blimit%5D=100&page%5Boffset%5D=100 schema: $ref: "#/components/schemas/OutcomesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_read summary: List all rule outcomes tags: - Scorecards x-pagination: limitParam: page[size] pageOffsetParam: page[offset] resultsPath: data post: description: Updates multiple scorecard rule outcomes in a single batched request. operationId: UpdateScorecardOutcomes requestBody: content: application/json: examples: default: value: data: attributes: results: - entity_reference: service:my-service remarks: 'See: Services' rule_id: q8MQxk8TCqrHnWkx state: pass type: batched-outcome schema: $ref: "#/components/schemas/UpdateOutcomesAsyncRequest" description: Set of scorecard outcomes. required: true responses: "202": description: Accepted "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_write summary: Update Scorecard outcomes tags: - Scorecards x-codegen-request-body-name: body /api/v2/scorecard/outcomes/batch: post: deprecated: true description: Sets multiple service-rule outcomes in a single batched request. operationId: CreateScorecardOutcomesBatch requestBody: content: application/json: examples: default: value: data: attributes: results: - remarks: 'See: Services' rule_id: q8MQxk8TCqrHnWkx service_name: my-service state: pass type: batched-outcome schema: $ref: "#/components/schemas/OutcomesBatchRequest" description: Set of scorecard outcomes. required: true responses: "200": content: application/json: examples: default: value: data: - attributes: modified_at: "2026-03-11T07:37:20.758067Z" remarks: test remarks service_name: my-service state: pass id: nFs2_9E97Zo relationships: rule: data: id: rule-1 type: rule type: outcome meta: total_received: 1 total_staged: 1 schema: $ref: "#/components/schemas/OutcomesBatchResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_write summary: Create outcomes batch tags: - Scorecards x-codegen-request-body-name: body x-sunset: "2026-04-01" x-unstable: |- **Note**: This endpoint is deprecated. To update outcomes, use the [Update Scorecard outcomes](https://docs.datadoghq.com/api/latest/scorecards/update-scorecard-outcomes/) endpoint. /api/v2/scorecard/rules: get: description: Fetch all rules. operationId: ListScorecardRules parameters: - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageOffset" - description: Include related scorecard details in the response. in: query name: include required: false schema: example: scorecard type: string - description: Filter the rules on a rule ID. in: query name: filter[rule][id] required: false schema: example: 37d2f990-c885-4972-949b-8b798213a166 type: string - description: Filter for enabled rules only. in: query name: filter[rule][enabled] required: false schema: example: true type: boolean - description: Filter for custom rules only. in: query name: filter[rule][custom] required: false schema: example: true type: boolean - description: Filter rules on the rule name. in: query name: filter[rule][name] required: false schema: example: Code Repos Defined type: string - description: Filter rules on the rule description. in: query name: filter[rule][description] required: false schema: example: Identifying type: string - description: Return only specific fields in the response for rule attributes. in: query name: fields[rule] required: false schema: example: name, description type: string - description: Return only specific fields in the included response for scorecard attributes. in: query name: fields[scorecard] required: false schema: example: name type: string responses: "200": content: application/json: examples: default: value: data: - attributes: category: Test Scorecard created_at: "2026-01-06T12:51:32Z" custom: true enabled: true level: 3 modified_at: "2026-01-06T12:51:32Z" name: Test Rule 1 scorecard_name: Test Scorecard id: rule-1 relationships: scorecard: data: id: scorecard-1 type: scorecard type: rule included: - attributes: description: Scorecard Description name: Test Scorecard id: scorecard-1 type: scorecard links: next: /api/v2/scorecard/rules?include=scorecard&page%5Blimit%5D=100&page%5Boffset%5D=100 schema: $ref: "#/components/schemas/ListRulesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_read summary: List all rules tags: - Scorecards x-pagination: limitParam: page[size] pageOffsetParam: page[offset] resultsPath: data post: description: Creates a new rule. operationId: CreateScorecardRule requestBody: content: application/json: examples: default: value: data: attributes: enabled: true name: My Rule owner: Datadog scorecard_name: My Scorecard type: rule schema: $ref: "#/components/schemas/CreateRuleRequest" description: Rule attributes. required: true responses: "201": content: application/json: examples: default: value: data: attributes: category: Test Scorecard created_at: "2026-01-06T12:51:32Z" custom: true enabled: true level: 3 modified_at: "2026-01-06T12:51:32Z" name: Test Rule scorecard_name: Test Scorecard id: rule-1 relationships: scorecard: data: id: scorecard-1 type: scorecard type: rule schema: $ref: "#/components/schemas/CreateRuleResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_write summary: Create a new rule tags: - Scorecards x-codegen-request-body-name: body /api/v2/scorecard/rules/{rule_id}: delete: description: Deletes a single rule. operationId: DeleteScorecardRule parameters: - $ref: "#/components/parameters/RuleId" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_write summary: Delete a rule tags: - Scorecards put: description: Updates an existing rule. operationId: UpdateScorecardRule parameters: - $ref: "#/components/parameters/RuleId" requestBody: content: application/json: examples: default: value: data: attributes: description: Updated Description enabled: false name: Updated Rule owner: team:updated-team scope_query: kind:service scorecard_name: Updated Scorecard type: rule schema: $ref: "#/components/schemas/UpdateRuleRequest" description: Rule attributes. required: true responses: "200": content: application/json: examples: default: value: data: attributes: category: Updated Scorecard created_at: "2026-01-06T12:51:32Z" custom: true description: Updated Description enabled: false level: 1 modified_at: "2026-01-06T13:00:00Z" name: Updated Rule owner: team:updated-team scope_query: kind:service scorecard_name: Updated Scorecard id: rule-1 relationships: scope: data: id: ae07a16e-1319-5e61-bdba-b3026bc2bdcd type: entity-scope scorecard: data: id: scorecard-2 type: scorecard type: rule schema: $ref: "#/components/schemas/UpdateRuleResponse" description: Rule updated successfully "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_write summary: Update an existing scorecard rule tags: - Scorecards x-codegen-request-body-name: body /api/v2/scorecard/scorecards: get: description: Fetches all scorecards. operationId: ListScorecards parameters: - description: Offset for pagination. in: query name: page[offset] required: false schema: default: 0 example: 0 format: int64 type: integer - description: Maximum number of scorecards to return. in: query name: page[size] required: false schema: default: 100 example: 10 format: int64 type: integer - description: Filter by scorecard ID. in: query name: filter[scorecard][id] required: false schema: example: q8MQxk8TCqrHnWkx type: string - description: Filter by scorecard name (partial match). in: query name: filter[scorecard][name] required: false schema: example: Observability type: string - description: Filter by scorecard description (partial match). in: query name: filter[scorecard][description] required: false schema: example: Best Practices type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2026-01-01T00:00:00Z" description: Best practices for observability. modified_at: "2026-01-05T14:20:00Z" name: Observability Best Practices id: q8MQxk8TCqrHnWkx type: scorecard schema: $ref: "#/components/schemas/ListScorecardsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_read summary: List all scorecards tags: - Scorecards /api/v2/scorecard/scores/{aggregation}: get: description: Returns a list of scorecard scores for each aggregation type, with score breakdowns. operationId: ListScorecardScores parameters: - description: The type of scores being requested. in: path name: aggregation required: true schema: $ref: "#/components/schemas/ScorecardScoresAggregation" - description: Filter scores by rule ID(s), comma-separated. in: query name: filter[rule][id] required: false schema: type: string - description: Filter scores by rule name. in: query name: filter[rule][name] required: false schema: type: string - description: Filter scores by rule level(s), comma-separated. in: query name: filter[rule][level] required: false schema: type: string - description: Filter scores by scorecard ID(s), comma-separated. in: query name: filter[rule][scorecard_id] required: false schema: type: string - description: Filter scores to show only custom rules. in: query name: filter[rule][is_custom] required: false schema: type: boolean - description: Filter scores to show only enabled rules. in: query name: filter[rule][is_enabled] required: false schema: type: boolean - description: "Sort scores by field. Use a hyphen prefix for descending order. Options: score, numerator, denominator, total_pass, total_fail, total_skip, total_no_data." in: query name: sort required: false schema: type: string - description: Offset for pagination. in: query name: page[offset] required: false schema: default: 0 format: int64 type: integer - description: Number of scores to return. Max is 1000. in: query name: page[limit] required: false schema: default: 100 format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: aggregation: by-entity denominator: 4 numerator: 3 score: 0.75 total_fail: 1 total_no_data: 0 total_pass: 3 total_skip: 0 id: service:my-service relationships: entity: data: id: service:my-service type: entity type: score links: next: /api/v2/scorecard/scores/by-entity?page[offset]=100&page[limit]=100 meta: count: 1 limit: 100 offset: 0 total: 42 schema: $ref: "#/components/schemas/ListScorecardScoresResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_read summary: List all scores tags: - Scorecards /api/v2/seats/users: delete: description: |- Unassign seats from users for a product code. operationId: UnassignSeatsUser requestBody: content: application/json: examples: default: value: data: attributes: product_code: "" user_uuids: - 626a4e8e-64bd-409d-b80e-428f08ac0b62 type: seat-assignments schema: $ref: "#/components/schemas/UnassignSeatsUserRequest" required: true responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "422": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Unassign seats from users tags: - Seats "x-permission": operator: OR permissions: - billing_edit - incident_write - on_call_write get: description: |- Get the list of users assigned seats for a product code. operationId: GetSeatsUsers parameters: - description: The product code for which to retrieve seat users. in: query name: product_code required: true schema: type: string - description: Maximum number of results to return. in: query name: page[limit] required: false schema: format: int64 type: integer - description: Cursor for pagination. in: query name: page[cursor] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: assigned_at: "2024-01-01T00:00:00+00:00" email: test@example.com name: Example Name id: 00000000-0000-0000-0000-000000000001 type: seat-users schema: $ref: "#/components/schemas/SeatUserDataArray" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "422": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get users with seats tags: - Seats "x-permission": operator: OR permissions: - billing_read - incident_read - on_call_read post: description: |- Assign seats to users for a product code. operationId: AssignSeatsUser requestBody: content: application/json: examples: default: value: data: attributes: product_code: "" user_uuids: - "" type: seat-assignments schema: $ref: "#/components/schemas/AssignSeatsUserRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: assigned_ids: - abc-123 product_code: example-product id: 00000000-0000-0000-0000-000000000002 type: seat-assignments schema: $ref: "#/components/schemas/AssignSeatsUserResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "422": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Assign seats to users tags: - Seats "x-permission": operator: OR permissions: - billing_edit - incident_write - on_call_write /api/v2/security-entities/risk-scores: get: description: |- Get a list of entity risk scores for your organization. Entity risk scores provide security risk assessment for entities like cloud resources, identities, or services based on detected signals, misconfigurations, and identity risks. operationId: ListEntityRiskScores parameters: - description: Start time for the query in Unix timestamp (milliseconds). Defaults to 2 weeks ago. in: query name: from required: false schema: example: 1704067200000 format: int64 type: integer - description: End time for the query in Unix timestamp (milliseconds). Defaults to now. in: query name: to required: false schema: example: 1705276800000 format: int64 type: integer - description: Size of the page to return. Maximum is 1000. in: query name: page[size] required: false schema: default: 10 example: 10 format: int64 type: integer - description: Page number to return (1-indexed). in: query name: page[number] required: false schema: default: 1 example: 1 format: int64 type: integer - description: Query ID for pagination consistency. in: query name: page[queryId] required: false schema: example: "abc123def456" type: string - description: |- Sort order for results. Format: `field:direction` where direction is `asc` or `desc`. Supported fields: `riskScore`, `lastDetected`, `firstDetected`, `entityName`, `signalsDetected`. in: query name: filter[sort] required: false schema: example: "riskScore:desc" type: string - description: |- Supports filtering by entity attributes, risk scores, severity, and more. Example: `severity:critical AND entityType:aws_iam_user` in: query name: filter[query] required: false schema: example: "severity:critical" type: string - description: Filter by entity type(s). Can specify multiple values. explode: true in: query name: entityType required: false schema: example: ["aws_iam_user", "aws_ec2_instance"] items: example: "aws_iam_user" type: string type: array style: form responses: "200": content: application/json: examples: default: value: data: - attributes: accountIds: - "123456789012" configRisks: hasIdentityRisk: false hasMisconfiguration: true hasPrivilegedRole: false isPrivileged: false isProduction: true isPubliclyAccessible: true entityMetadata: environments: - production mitreTactics: - ta0006-credential-access mitreTechniques: - t1078-valid-accounts services: - api-gateway sources: - cloudtrail entityName: test-user entityProviders: - AWS entityRoles: [] entitySubTypes: - "IAM User" entityTypes: - "IAMUser" firstDetected: 1704067200000 lastActivityTitle: "Suspicious API call detected" lastDetected: 1705276800000 riskScore: 85 riskScoreEvolution: 12 severity: critical signalsDetected: 15 id: "arn:aws:iam::123456789012:user/test-user" type: SecurityEntityRiskScore meta: pageNumber: 1 pageSize: 10 queryId: "abc123def456" totalRowCount: 1 schema: $ref: "#/components/schemas/SecurityEntityRiskScoresResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Entity Risk Scores tags: - Entity Risk Scores x-unstable: |- **Note**: This endpoint is in public beta and it's subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security-entities/risk-scores/{entity_id}: get: description: |- Get the risk score for a specific entity by its ID. Returns security risk assessment including risk score, severity, detected signals, misconfigurations, and identity risks. operationId: GetEntityRiskScore parameters: - description: The URL-encoded unique identifier for the entity. in: path name: entity_id required: true schema: example: "arn:aws:iam::123456789012:user/john.doe" type: string responses: "200": content: application/json: examples: default: value: data: attributes: accountIds: - "123456789012" configRisks: hasIdentityRisk: false hasMisconfiguration: true hasPrivilegedRole: false isPrivileged: false isProduction: true isPubliclyAccessible: true entityMetadata: environments: - production mitreTactics: - ta0006-credential-access mitreTechniques: - t1078-valid-accounts services: - api-gateway sources: - cloudtrail entityName: "test-user" entityProviders: - AWS entityRoles: [] entitySubTypes: - "IAM User" entityTypes: - "IAMUser" firstDetected: 1704067200000 lastActivityTitle: "Suspicious API call detected" lastDetected: 1705276800000 riskScore: 85 riskScoreEvolution: 12 severity: critical signalsDetected: 15 id: "arn:aws:iam::123456789012:user/test-user" type: SecurityEntityRiskScore schema: $ref: "#/components/schemas/SecurityEntityRiskScoreResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get Entity Risk Score tags: - Entity Risk Scores x-unstable: |- **Note**: This endpoint is in public beta and it's subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/asm/services/{service_filter}: get: description: |- Retrieve Application Security details for services matching the given name. Returns Application Security activation, compatibility, and product enablement information for each matching `(service, environment)` pair, along with a count of services that have Application Security Management (Threats) enabled. operationId: GetAsmServiceByName parameters: - $ref: "#/components/parameters/ApplicationSecurityServiceNameParam" responses: "200": content: application/json: examples: default: value: data: - attributes: agent_versions: - 7.50.0 app_type: web asm_threat_compatible: true backend_waf_event_count: 10 business_logic: [] color: "" env: prod event_count: 42 event_trend: [] has_appsec_enabled: true hits: 0 iast_product_activation: false iast_product_compatibility: compatible iast_product_compatibility_reasons: [] languages: - go last_ingested_spans: 1610000000 rc_capabilities: - ASM_DD_RULES recommended_business_logic: [] risk_product_activation: false risk_product_compatibility: compatible risk_product_compatibility_reasons: [] rules_version: - 1.13.0 service: web-store signal_count: 0 signal_trend: [] source: - services-activity teams: - security-team tracer_versions: - 1.60.0 vm-activation: enabled vuln_critical_count: 0 vuln_high_count: 0 without_filter_services: 0 id: web-store_prod type: service_env meta: num_services_with_appsec: 1 schema: $ref: "#/components/schemas/ApplicationSecurityServicesResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get Application Security details for a service tags: - "Application Security" "x-permission": operator: OR permissions: - apm_service_catalog_read - appsec_protect_read - apm_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/cloud_workload/policy/download: get: description: |- The download endpoint generates a Workload Protection policy file from your currently active Workload Protection agent rules, and downloads them as a `.policy` file. This file can then be deployed to your agents to update the policy running in your environment. **Note**: This endpoint should only be used for the Government (US1-FED) site. operationId: DownloadCloudWorkloadPolicyFile responses: "200": content: application/yaml: examples: default: value: "" schema: format: binary type: string description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: "Download the Workload Protection policy (US1-FED)" tags: ["CSM Threats"] "x-permission": operator: OR permissions: - security_monitoring_cws_agent_rules_read /api/v2/security/findings: get: description: |- Get a list of security findings that match a search query. [See the schema for security findings](https://docs.datadoghq.com/security/guide/findings-schema/). ### Query Syntax This endpoint uses the logs query syntax. Findings attributes (living in the attributes.attributes. namespace) are prefixed by @ when queried. Tags are queried without a prefix. Example: `@severity:(critical OR high) @status:open team:platform` operationId: ListSecurityFindings parameters: - description: The search query following log search syntax. example: "@severity:(critical OR high) @status:open team:platform" in: query name: filter[query] required: false schema: default: "*" type: string - description: Get the next page of results with a cursor provided in the previous query. example: "eyJhZnRlciI6IkF3QUFBWnPcm1pd0FBQUJbVlBQUKBa1pqRTVdZUzSTBNemN0YWiIsLTE3Mjk0MzYwMjFdfQ==" in: query name: page[cursor] required: false schema: type: string - description: The maximum number of findings in the response. example: 25 in: query name: page[limit] required: false schema: default: 10 format: int64 maximum: 150 minimum: 1 type: integer - description: Sorts by @detection_changed_at. in: query name: sort required: false schema: $ref: "#/components/schemas/SecurityFindingsSort" responses: "200": content: application/json: examples: default: value: data: - attributes: attributes: severity: high status: open tags: - "team:platform" timestamp: 1765901760 id: ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw== type: finding meta: elapsed: 548 status: done schema: $ref: "#/components/schemas/ListSecurityFindingsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_findings_read summary: List security findings tags: - "Security Monitoring" x-pagination: cursorParam: page[cursor] cursorPath: meta.page.after limitParam: page[limit] resultsPath: data "x-permission": operator: OR permissions: - security_monitoring_findings_read - appsec_vm_read /api/v2/security/findings/assignee: patch: description: >- Assign or unassign security findings. You can assign up to 100 security findings per request. Set `assignee_id` to the unique identifier of the Datadog user you want to assign the findings to. Omit `assignee_id` (or set it to `null`) to unassign the findings. Per-finding warnings and failures are returned in the response `meta` object. operationId: UpdateFindingsAssignee requestBody: content: application/json: examples: default: value: data: attributes: assignee_id: "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0" id: "00000000-0000-0000-0000-000000000001" relationships: findings: data: - id: "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==" type: "findings" type: "assignee" schema: $ref: "#/components/schemas/AssigneeRequest" required: true responses: "202": content: application/json: examples: default: value: data: attributes: assignee_id: "f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0" id: "00000000-0000-0000-0000-000000000001" type: "assignee" schema: $ref: "#/components/schemas/AssigneeResponse" description: Accepted "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Assign or unassign security findings tags: - "Security Monitoring" x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_findings_write - appsec_vm_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/default_inbox_rules: get: description: |- Get all default inbox rules for the current organization. Datadog manages default inbox rules. Their name, rule, and action are read-only, and each organization can change only whether they are enabled. operationId: ListSecurityFindingsAutomationDefaultInboxRules responses: "200": content: application/json: examples: default: value: data: - attributes: action: description: "Maintained by Datadog Security Research. Customize your inbox by adding your own rules, cloning this rule, or disabling it." created_at: 1787064734329 created_by: id: "datadog.security_research" name: "Datadog Security Research" type: system enabled: true modified_at: 1787064734329 modified_by: id: "datadog.security_research" name: "Datadog Security Research" type: system name: "Secrets" rule: finding_types: - secret query: "@git.repository_visibility:public OR @secret.validation_status:valid" id: secret_default_rule type: default_inbox_rules - attributes: action: description: "Detects misconfigurations in your environment." created_at: 1722439510282 created_by: id: "datadog.security_research" name: "Datadog Security Research" type: system enabled: false modified_at: 1722439510282 modified_by: id: "datadog.security_research" name: "Datadog Security Research" type: system name: "Misconfigurations" rule: finding_types: - misconfiguration id: misconfiguration_default_rule type: default_inbox_rules schema: $ref: "#/components/schemas/DefaultInboxRulesResponse" description: Successfully retrieved the list of default inbox rules "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get all default inbox rules tags: - Security Monitoring x-permission: operator: OR permissions: - security_pipelines_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/default_inbox_rules/{rule_id}: get: description: |- Get the details of a default inbox rule by ID. Datadog manages default inbox rules. Their name, rule, and action are read-only, and each organization can change only whether they are enabled. operationId: GetSecurityFindingsAutomationDefaultInboxRule parameters: - description: |- The ID of the default inbox rule. Known default rule IDs include: `identity_risk_default_rule`, `secret_default_rule`, `library_vulnerability_default_rule`, `attack_path_default_rule`, `host_and_container_vulnerability_default_rule`, `runtime_code_vulnerability_default_rule`, `iac_misconfiguration_default_rule`, and `misconfiguration_default_rule`. Datadog can add new default rules over time. in: path name: rule_id required: true schema: example: "secret_default_rule" type: string responses: "200": content: application/json: examples: default: value: data: attributes: action: description: "Maintained by Datadog Security Research. Customize your inbox by adding your own rules, cloning this rule, or disabling it." created_at: 1787064734329 created_by: id: "datadog.security_research" name: "Datadog Security Research" type: system enabled: true modified_at: 1787064734329 modified_by: id: "datadog.security_research" name: "Datadog Security Research" type: system name: "Secrets" rule: finding_types: - secret query: "@git.repository_visibility:public OR @secret.validation_status:valid" id: secret_default_rule type: default_inbox_rules schema: $ref: "#/components/schemas/DefaultInboxRuleResponse" description: Successfully retrieved the default inbox rule "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a default inbox rule tags: - Security Monitoring x-permission: operator: OR permissions: - security_pipelines_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/default_inbox_rules/{rule_id}/disable: post: description: Disable a default inbox rule for the current organization. operationId: DisableSecurityFindingsAutomationDefaultInboxRule parameters: - description: |- The ID of the default inbox rule. Known default rule IDs include: `identity_risk_default_rule`, `secret_default_rule`, `library_vulnerability_default_rule`, `attack_path_default_rule`, `host_and_container_vulnerability_default_rule`, `runtime_code_vulnerability_default_rule`, `iac_misconfiguration_default_rule`, and `misconfiguration_default_rule`. Datadog can add new default rules over time. in: path name: rule_id required: true schema: example: "secret_default_rule" type: string responses: "200": content: application/json: examples: default: value: data: attributes: action: description: "Maintained by Datadog Security Research. Customize your inbox by adding your own rules, cloning this rule, or disabling it." created_at: 1787064734329 created_by: id: "datadog.security_research" name: "Datadog Security Research" type: system enabled: false modified_at: 1788255000000 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Secrets" rule: finding_types: - secret query: "@git.repository_visibility:public OR @secret.validation_status:valid" id: secret_default_rule type: default_inbox_rules schema: $ref: "#/components/schemas/DefaultInboxRuleResponse" description: Successfully disabled the default inbox rule "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Disable a default inbox rule tags: - Security Monitoring x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/default_inbox_rules/{rule_id}/enable: post: description: Enable a default inbox rule for the current organization. operationId: EnableSecurityFindingsAutomationDefaultInboxRule parameters: - description: |- The ID of the default inbox rule. Known default rule IDs include: `identity_risk_default_rule`, `secret_default_rule`, `library_vulnerability_default_rule`, `attack_path_default_rule`, `host_and_container_vulnerability_default_rule`, `runtime_code_vulnerability_default_rule`, `iac_misconfiguration_default_rule`, and `misconfiguration_default_rule`. Datadog can add new default rules over time. in: path name: rule_id required: true schema: example: "secret_default_rule" type: string responses: "200": content: application/json: examples: default: value: data: attributes: action: description: "Maintained by Datadog Security Research. Customize your inbox by adding your own rules, cloning this rule, or disabling it." created_at: 1787064734329 created_by: id: "datadog.security_research" name: "Datadog Security Research" type: system enabled: true modified_at: 1788255000000 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Secrets" rule: finding_types: - secret query: "@git.repository_visibility:public OR @secret.validation_status:valid" id: secret_default_rule type: default_inbox_rules schema: $ref: "#/components/schemas/DefaultInboxRuleResponse" description: Successfully enabled the default inbox rule "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Enable a default inbox rule tags: - Security Monitoring x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/due_date_rules: get: description: Get all due date rules for the current organization. operationId: ListSecurityFindingsAutomationDueDateRules parameters: - description: The number of rules per page. Maximum is 1000. in: query name: page[size] required: false schema: default: 1000 example: 10 format: int64 maximum: 1000 minimum: 1 type: integer - description: The page number to return. in: query name: page[number] required: false schema: default: 0 example: 0 format: int64 minimum: 0 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: action: due_days_per_severity: - due_in_days: 7 severity: critical - due_in_days: 30 severity: high due_from: first_seen created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: true modified_at: 1722439510282 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Critical findings due in 7 days" rule: finding_types: - misconfiguration query: "env:prod" id: "00000000-0000-0000-0000-000000000000" type: due_date_rules links: first: "/api/v2/security/findings/automation/due_date_rules?page[size]=1000&page[number]=0" last: "/api/v2/security/findings/automation/due_date_rules?page[size]=1000&page[number]=0" meta: page: total_filtered_count: 1 schema: $ref: "#/components/schemas/DueDateRulesResponse" description: Successfully retrieved the list of due date rules "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get all due date rules tags: - Security Monitoring x-permission: operator: OR permissions: - security_pipelines_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a due date rule for the current organization. operationId: CreateSecurityFindingsAutomationDueDateRule requestBody: content: application/json: examples: default: value: data: attributes: action: due_days_per_severity: - due_in_days: 7 severity: critical - due_in_days: 30 severity: high due_from: first_seen enabled: true name: "Critical findings due in 7 days" rule: finding_types: - misconfiguration query: "env:prod" type: due_date_rules schema: $ref: "#/components/schemas/DueDateRuleCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: action: due_days_per_severity: - due_in_days: 7 severity: critical - due_in_days: 30 severity: high due_from: first_seen created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: true modified_at: 1722439510282 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Critical findings due in 7 days" rule: finding_types: - misconfiguration query: "env:prod" id: "00000000-0000-0000-0000-000000000000" type: due_date_rules schema: $ref: "#/components/schemas/DueDateRuleResponse" description: Successfully created the due date rule "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/ForbiddenResponse" "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create a due date rule tags: - Security Monitoring x-codegen-request-body-name: body x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/due_date_rules/reorder: post: description: Reorder the list of due date rules for the current organization. operationId: ReorderSecurityFindingsAutomationDueDateRules requestBody: content: application/json: examples: default: value: data: - id: "00000000-0000-0000-0000-000000000000" type: due_date_rules - id: "11111111-1111-1111-1111-111111111111" type: due_date_rules schema: $ref: "#/components/schemas/DueDateRuleReorderRequest" required: true responses: "200": content: application/json: examples: default: value: data: - id: "00000000-0000-0000-0000-000000000000" type: due_date_rules - id: "11111111-1111-1111-1111-111111111111" type: due_date_rules schema: $ref: "#/components/schemas/DueDateRuleReorderResponse" description: Successfully reordered the due date rules "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/ForbiddenResponse" "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Reorder due date rules tags: - Security Monitoring x-codegen-request-body-name: body x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/due_date_rules/{rule_id}: delete: description: Delete a due date rule by ID. operationId: DeleteSecurityFindingsAutomationDueDateRule parameters: - description: The ID of the due date rule. in: path name: rule_id required: true schema: example: "00000000-0000-0000-0000-000000000000" format: uuid type: string responses: "204": description: Successfully deleted the due date rule "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete a due date rule tags: - Security Monitoring x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get the details of a due date rule by ID. operationId: GetSecurityFindingsAutomationDueDateRule parameters: - description: The ID of the due date rule. in: path name: rule_id required: true schema: example: "00000000-0000-0000-0000-000000000000" format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: action: due_days_per_severity: - due_in_days: 7 severity: critical - due_in_days: 30 severity: high due_from: first_seen created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: true modified_at: 1722439510282 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Critical findings due in 7 days" rule: finding_types: - misconfiguration query: "env:prod" id: "00000000-0000-0000-0000-000000000000" type: due_date_rules schema: $ref: "#/components/schemas/DueDateRuleResponse" description: Successfully retrieved the due date rule "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a due date rule tags: - Security Monitoring x-permission: operator: OR permissions: - security_pipelines_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: Update a due date rule by ID. operationId: UpdateSecurityFindingsAutomationDueDateRule parameters: - description: The ID of the due date rule. in: path name: rule_id required: true schema: example: "00000000-0000-0000-0000-000000000000" format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: action: due_days_per_severity: - due_in_days: 7 severity: critical - due_in_days: 30 severity: high - due_in_days: 90 severity: medium due_from: fix_available enabled: true name: "Critical findings due in 7 days" rule: finding_types: - misconfiguration query: "env:prod" id: "00000000-0000-0000-0000-000000000000" type: due_date_rules schema: $ref: "#/components/schemas/DueDateRuleUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: action: due_days_per_severity: - due_in_days: 7 severity: critical - due_in_days: 30 severity: high - due_in_days: 90 severity: medium due_from: fix_available created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: true modified_at: 1722439510999 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Critical findings due in 7 days" rule: finding_types: - misconfiguration query: "env:prod" id: "00000000-0000-0000-0000-000000000000" type: due_date_rules schema: $ref: "#/components/schemas/DueDateRuleResponse" description: Successfully updated the due date rule "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update a due date rule tags: - Security Monitoring x-codegen-request-body-name: body x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/inbox_rules: get: description: Get all inbox rules for the current organization. operationId: ListSecurityFindingsAutomationInboxRules parameters: - description: The number of rules per page. Maximum is 1000. in: query name: page[size] required: false schema: default: 1000 example: 10 format: int64 maximum: 1000 minimum: 1 type: integer - description: The page number to return. in: query name: page[number] required: false schema: default: 0 example: 0 format: int64 minimum: 0 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: action: description: "Needs triage" created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: true modified_at: 1722439510282 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Triage production misconfigurations" rule: finding_types: - misconfiguration query: "env:prod" id: "00000000-0000-0000-0000-000000000000" type: inbox_rules links: first: "/api/v2/security/findings/automation/inbox_rules?page[size]=1000&page[number]=0" last: "/api/v2/security/findings/automation/inbox_rules?page[size]=1000&page[number]=0" meta: page: total_filtered_count: 1 schema: $ref: "#/components/schemas/InboxRulesResponse" description: Successfully retrieved the list of inbox rules "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get all inbox rules tags: - Security Monitoring x-permission: operator: OR permissions: - security_pipelines_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create an inbox rule for the current organization. operationId: CreateSecurityFindingsAutomationInboxRule requestBody: content: application/json: examples: default: value: data: attributes: action: description: "Needs triage" enabled: true name: "Triage production misconfigurations" rule: finding_types: - misconfiguration query: "env:prod" type: inbox_rules schema: $ref: "#/components/schemas/InboxRuleCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: action: description: "Needs triage" created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: true modified_at: 1722439510282 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Triage production misconfigurations" rule: finding_types: - misconfiguration query: "env:prod" id: "00000000-0000-0000-0000-000000000000" type: inbox_rules schema: $ref: "#/components/schemas/InboxRuleResponse" description: Successfully created the inbox rule "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/ForbiddenResponse" "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create an inbox rule tags: - Security Monitoring x-codegen-request-body-name: body x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/inbox_rules/reorder: post: description: Reorder the list of inbox rules for the current organization. operationId: ReorderSecurityFindingsAutomationInboxRules requestBody: content: application/json: examples: default: value: data: - id: "00000000-0000-0000-0000-000000000000" type: inbox_rules - id: "11111111-1111-1111-1111-111111111111" type: inbox_rules schema: $ref: "#/components/schemas/InboxRuleReorderRequest" required: true responses: "200": content: application/json: examples: default: value: data: - id: "00000000-0000-0000-0000-000000000000" type: inbox_rules - id: "11111111-1111-1111-1111-111111111111" type: inbox_rules schema: $ref: "#/components/schemas/InboxRuleReorderResponse" description: Successfully reordered the inbox rules "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/ForbiddenResponse" "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Reorder inbox rules tags: - Security Monitoring x-codegen-request-body-name: body x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/inbox_rules/{rule_id}: delete: description: Delete an inbox rule by ID. operationId: DeleteSecurityFindingsAutomationInboxRule parameters: - description: The ID of the inbox rule. in: path name: rule_id required: true schema: example: "00000000-0000-0000-0000-000000000000" format: uuid type: string responses: "204": description: Successfully deleted the inbox rule "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete an inbox rule tags: - Security Monitoring x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get the details of an inbox rule by ID. operationId: GetSecurityFindingsAutomationInboxRule parameters: - description: The ID of the inbox rule. in: path name: rule_id required: true schema: example: "00000000-0000-0000-0000-000000000000" format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: action: description: "Needs triage" created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: true modified_at: 1722439510282 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Triage production misconfigurations" rule: finding_types: - misconfiguration query: "env:prod" id: "00000000-0000-0000-0000-000000000000" type: inbox_rules schema: $ref: "#/components/schemas/InboxRuleResponse" description: Successfully retrieved the inbox rule "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get an inbox rule tags: - Security Monitoring x-permission: operator: OR permissions: - security_pipelines_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: Update an inbox rule by ID. operationId: UpdateSecurityFindingsAutomationInboxRule parameters: - description: The ID of the inbox rule. in: path name: rule_id required: true schema: example: "00000000-0000-0000-0000-000000000000" format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: action: description: "Needs triage" enabled: false name: "Triage production misconfigurations" rule: finding_types: - misconfiguration query: "env:prod" id: "00000000-0000-0000-0000-000000000000" type: inbox_rules schema: $ref: "#/components/schemas/InboxRuleUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: action: description: "Needs triage" created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: false modified_at: 1722439510999 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Triage production misconfigurations" rule: finding_types: - misconfiguration query: "env:prod" id: "00000000-0000-0000-0000-000000000000" type: inbox_rules schema: $ref: "#/components/schemas/InboxRuleResponse" description: Successfully updated the inbox rule "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update an inbox rule tags: - Security Monitoring x-codegen-request-body-name: body x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/mute_rules: get: description: Get all mute rules for the current organization. operationId: ListSecurityFindingsAutomationMuteRules parameters: - description: The number of rules per page. Maximum is 1000. in: query name: page[size] required: false schema: default: 1000 example: 10 format: int64 maximum: 1000 minimum: 1 type: integer - description: The page number to return. in: query name: page[number] required: false schema: default: 0 example: 0 format: int64 minimum: 0 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: action: expire_at: 4070908800000 reason: risk_accepted reason_description: "Accepted for dev environments only" created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: true modified_at: 1722439510282 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Mute accepted risks in dev" rule: finding_types: - misconfiguration query: "env:dev team:platform @severity:low" id: "00000000-0000-0000-0000-000000000000" type: mute_rules links: first: "/api/v2/security/findings/automation/mute_rules?page[size]=1000&page[number]=0" last: "/api/v2/security/findings/automation/mute_rules?page[size]=1000&page[number]=0" meta: page: total_filtered_count: 1 schema: $ref: "#/components/schemas/MuteRulesResponse" description: Successfully retrieved the list of mute rules "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get all mute rules tags: - Security Monitoring x-permission: operator: OR permissions: - security_pipelines_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a mute rule for the current organization. operationId: CreateSecurityFindingsAutomationMuteRule requestBody: content: application/json: examples: default: value: data: attributes: action: expire_at: 4070908800000 reason: risk_accepted reason_description: "Accepted for dev environments only" enabled: true name: "Mute accepted risks in dev" rule: finding_types: - misconfiguration query: "env:dev team:platform @severity:low" type: mute_rules schema: $ref: "#/components/schemas/MuteRuleCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: action: expire_at: 4070908800000 reason: risk_accepted reason_description: "Accepted for dev environments only" created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: true modified_at: 1722439510282 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Mute accepted risks in dev" rule: finding_types: - misconfiguration query: "env:dev team:platform @severity:low" id: "00000000-0000-0000-0000-000000000000" type: mute_rules schema: $ref: "#/components/schemas/MuteRuleResponse" description: Successfully created the mute rule "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/ForbiddenResponse" "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create a mute rule tags: - Security Monitoring x-codegen-request-body-name: body x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/mute_rules/reorder: post: description: Reorder the list of mute rules for the current organization. operationId: ReorderSecurityFindingsAutomationMuteRules requestBody: content: application/json: examples: default: value: data: - id: "00000000-0000-0000-0000-000000000000" type: mute_rules - id: "11111111-1111-1111-1111-111111111111" type: mute_rules schema: $ref: "#/components/schemas/MuteRuleReorderRequest" required: true responses: "200": content: application/json: examples: default: value: data: - id: "00000000-0000-0000-0000-000000000000" type: mute_rules - id: "11111111-1111-1111-1111-111111111111" type: mute_rules schema: $ref: "#/components/schemas/MuteRuleReorderResponse" description: Successfully reordered the mute rules "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/ForbiddenResponse" "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Reorder mute rules tags: - Security Monitoring x-codegen-request-body-name: body x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/mute_rules/{rule_id}: delete: description: Delete a mute rule by ID. operationId: DeleteSecurityFindingsAutomationMuteRule parameters: - description: The ID of the mute rule. in: path name: rule_id required: true schema: example: "00000000-0000-0000-0000-000000000000" format: uuid type: string responses: "204": description: Successfully deleted the mute rule "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete a mute rule tags: - Security Monitoring x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get the details of a mute rule by ID. operationId: GetSecurityFindingsAutomationMuteRule parameters: - description: The ID of the mute rule. in: path name: rule_id required: true schema: example: "00000000-0000-0000-0000-000000000000" format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: action: expire_at: 4070908800000 reason: risk_accepted reason_description: "Accepted for dev environments only" created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: true modified_at: 1722439510282 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Mute accepted risks in dev" rule: finding_types: - misconfiguration query: "env:dev team:platform @severity:low" id: "00000000-0000-0000-0000-000000000000" type: mute_rules schema: $ref: "#/components/schemas/MuteRuleResponse" description: Successfully retrieved the mute rule "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a mute rule tags: - Security Monitoring x-permission: operator: OR permissions: - security_pipelines_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: Update a mute rule by ID. operationId: UpdateSecurityFindingsAutomationMuteRule parameters: - description: The ID of the mute rule. in: path name: rule_id required: true schema: example: "00000000-0000-0000-0000-000000000000" format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: action: reason: risk_accepted enabled: false name: "Mute accepted risks in dev" rule: finding_types: - misconfiguration query: "env:dev" id: "00000000-0000-0000-0000-000000000000" type: mute_rules schema: $ref: "#/components/schemas/MuteRuleUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: action: reason: risk_accepted created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: false modified_at: 1722439510999 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Mute accepted risks in dev" rule: finding_types: - misconfiguration query: "env:dev" id: "00000000-0000-0000-0000-000000000000" type: mute_rules schema: $ref: "#/components/schemas/MuteRuleResponse" description: Successfully updated the mute rule "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update a mute rule tags: - Security Monitoring x-codegen-request-body-name: body x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/severity_modifier_rules: get: description: Get all severity modifier rules for the current organization. operationId: ListSecurityFindingsAutomationSeverityModifierRules parameters: - description: The number of rules per page. Maximum is 1000. in: query name: page[size] required: false schema: default: 1000 example: 10 format: int64 maximum: 1000 minimum: 1 type: integer - description: The page number to return. in: query name: page[number] required: false schema: default: 0 example: 0 format: int64 minimum: 0 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: action: description: "Lower severity for dev environment noise" severity: low type: set created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: true modified_at: 1722439510282 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Downgrade misconfigurations in dev" rule: finding_types: - misconfiguration query: "env:dev" id: "00000000-0000-0000-0000-000000000000" type: severity_modifier_rules links: first: "/api/v2/security/findings/automation/severity_modifier_rules?page[size]=1000&page[number]=0" last: "/api/v2/security/findings/automation/severity_modifier_rules?page[size]=1000&page[number]=0" meta: page: total_filtered_count: 1 schema: $ref: "#/components/schemas/SeverityModifierRulesResponse" description: Successfully retrieved the list of severity modifier rules "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get all severity modifier rules tags: - Security Monitoring x-permission: operator: OR permissions: - security_pipelines_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a severity modifier rule for the current organization. operationId: CreateSecurityFindingsAutomationSeverityModifierRule requestBody: content: application/json: examples: default: value: data: attributes: action: description: "Lower severity for dev environment noise" severity: low type: set enabled: true name: "Downgrade misconfigurations in dev" rule: finding_types: - misconfiguration query: "env:dev" type: severity_modifier_rules schema: $ref: "#/components/schemas/SeverityModifierRuleCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: action: description: "Lower severity for dev environment noise" severity: low type: set created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: true modified_at: 1722439510282 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Downgrade misconfigurations in dev" rule: finding_types: - misconfiguration query: "env:dev" id: "00000000-0000-0000-0000-000000000000" type: severity_modifier_rules schema: $ref: "#/components/schemas/SeverityModifierRuleResponse" description: Successfully created the severity modifier rule "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/ForbiddenResponse" "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create a severity modifier rule tags: - Security Monitoring x-codegen-request-body-name: body x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/severity_modifier_rules/reorder: post: description: Reorder the list of severity modifier rules for the current organization. operationId: ReorderSecurityFindingsAutomationSeverityModifierRules requestBody: content: application/json: examples: default: value: data: - id: "00000000-0000-0000-0000-000000000000" type: severity_modifier_rules - id: "11111111-1111-1111-1111-111111111111" type: severity_modifier_rules schema: $ref: "#/components/schemas/SeverityModifierRuleReorderRequest" required: true responses: "200": content: application/json: examples: default: value: data: - id: "00000000-0000-0000-0000-000000000000" type: severity_modifier_rules - id: "11111111-1111-1111-1111-111111111111" type: severity_modifier_rules schema: $ref: "#/components/schemas/SeverityModifierRuleReorderResponse" description: Successfully reordered the severity modifier rules "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/ForbiddenResponse" "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Reorder severity modifier rules tags: - Security Monitoring x-codegen-request-body-name: body x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/severity_modifier_rules/{rule_id}: delete: description: Delete a severity modifier rule by ID. operationId: DeleteSecurityFindingsAutomationSeverityModifierRule parameters: - description: The ID of the severity modifier rule. in: path name: rule_id required: true schema: example: "00000000-0000-0000-0000-000000000000" format: uuid type: string responses: "204": description: Successfully deleted the severity modifier rule "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete a severity modifier rule tags: - Security Monitoring x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get the details of a severity modifier rule by ID. operationId: GetSecurityFindingsAutomationSeverityModifierRule parameters: - description: The ID of the severity modifier rule. in: path name: rule_id required: true schema: example: "00000000-0000-0000-0000-000000000000" format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: action: description: "Lower severity for dev environment noise" severity: low type: set created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: true modified_at: 1722439510282 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Downgrade misconfigurations in dev" rule: finding_types: - misconfiguration query: "env:dev" id: "00000000-0000-0000-0000-000000000000" type: severity_modifier_rules schema: $ref: "#/components/schemas/SeverityModifierRuleResponse" description: Successfully retrieved the severity modifier rule "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a severity modifier rule tags: - Security Monitoring x-permission: operator: OR permissions: - security_pipelines_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: Update a severity modifier rule by ID. operationId: UpdateSecurityFindingsAutomationSeverityModifierRule parameters: - description: The ID of the severity modifier rule. in: path name: rule_id required: true schema: example: "00000000-0000-0000-0000-000000000000" format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: action: severity_delta: down_one type: shift enabled: false name: "Downgrade misconfigurations in dev" rule: finding_types: - misconfiguration query: "env:dev" id: "00000000-0000-0000-0000-000000000000" type: severity_modifier_rules schema: $ref: "#/components/schemas/SeverityModifierRuleUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: action: severity_delta: down_one type: shift created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: false modified_at: 1722439510999 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Downgrade misconfigurations in dev" rule: finding_types: - misconfiguration query: "env:dev" id: "00000000-0000-0000-0000-000000000000" type: severity_modifier_rules schema: $ref: "#/components/schemas/SeverityModifierRuleResponse" description: Successfully updated the severity modifier rule "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update a severity modifier rule tags: - Security Monitoring x-codegen-request-body-name: body x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/ticket_creation_rules: get: description: Get all ticket creation rules for the current organization. operationId: ListSecurityFindingsAutomationTicketCreationRules parameters: - description: The number of rules per page. Maximum is 1000. in: query name: page[size] required: false schema: default: 1000 example: 10 format: int64 maximum: 1000 minimum: 1 type: integer - description: The page number to return. in: query name: page[number] required: false schema: default: 0 example: 0 format: int64 minimum: 0 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: action: max_tickets_per_day: 100 project_id: "11111111-1111-1111-1111-111111111111" target: jira created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: true modified_at: 1722439510282 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Auto-create Jira tickets for critical findings" rule: finding_types: - misconfiguration query: "env:prod" id: "00000000-0000-0000-0000-000000000000" type: ticket_creation_rules links: first: "/api/v2/security/findings/automation/ticket_creation_rules?page[size]=1000&page[number]=0" last: "/api/v2/security/findings/automation/ticket_creation_rules?page[size]=1000&page[number]=0" meta: page: total_filtered_count: 1 schema: $ref: "#/components/schemas/TicketCreationRulesResponse" description: Successfully retrieved the list of ticket creation rules "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get all ticket creation rules tags: - Security Monitoring x-permission: operator: OR permissions: - security_pipelines_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a ticket creation rule for the current organization. operationId: CreateSecurityFindingsAutomationTicketCreationRule requestBody: content: application/json: examples: default: value: data: attributes: action: max_tickets_per_day: 100 project_id: "11111111-1111-1111-1111-111111111111" target: jira enabled: true name: "Auto-create Jira tickets for critical findings" rule: finding_types: - misconfiguration query: "env:prod" type: ticket_creation_rules schema: $ref: "#/components/schemas/TicketCreationRuleCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: action: max_tickets_per_day: 100 project_id: "11111111-1111-1111-1111-111111111111" target: jira created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: true modified_at: 1722439510282 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Auto-create Jira tickets for critical findings" rule: finding_types: - misconfiguration query: "env:prod" id: "00000000-0000-0000-0000-000000000000" type: ticket_creation_rules schema: $ref: "#/components/schemas/TicketCreationRuleResponse" description: Successfully created the ticket creation rule "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/ForbiddenResponse" "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create a ticket creation rule tags: - Security Monitoring x-codegen-request-body-name: body x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/ticket_creation_rules/reorder: post: description: Reorder the list of ticket creation rules for the current organization. operationId: ReorderSecurityFindingsAutomationTicketCreationRules requestBody: content: application/json: examples: default: value: data: - id: "00000000-0000-0000-0000-000000000000" type: ticket_creation_rules - id: "11111111-1111-1111-1111-111111111111" type: ticket_creation_rules schema: $ref: "#/components/schemas/TicketCreationRuleReorderRequest" required: true responses: "200": content: application/json: examples: default: value: data: - id: "00000000-0000-0000-0000-000000000000" type: ticket_creation_rules - id: "11111111-1111-1111-1111-111111111111" type: ticket_creation_rules schema: $ref: "#/components/schemas/TicketCreationRuleReorderResponse" description: Successfully reordered the ticket creation rules "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/ForbiddenResponse" "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Reorder ticket creation rules tags: - Security Monitoring x-codegen-request-body-name: body x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/automation/ticket_creation_rules/{rule_id}: delete: description: Delete a ticket creation rule by ID. operationId: DeleteSecurityFindingsAutomationTicketCreationRule parameters: - description: The ID of the ticket creation rule. in: path name: rule_id required: true schema: example: "00000000-0000-0000-0000-000000000000" format: uuid type: string responses: "204": description: Successfully deleted the ticket creation rule "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete a ticket creation rule tags: - Security Monitoring x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get the details of a ticket creation rule by ID. operationId: GetSecurityFindingsAutomationTicketCreationRule parameters: - description: The ID of the ticket creation rule. in: path name: rule_id required: true schema: example: "00000000-0000-0000-0000-000000000000" format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: action: max_tickets_per_day: 100 project_id: "11111111-1111-1111-1111-111111111111" target: jira created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: true modified_at: 1722439510282 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Auto-create Jira tickets for critical findings" rule: finding_types: - misconfiguration query: "env:prod" id: "00000000-0000-0000-0000-000000000000" type: ticket_creation_rules schema: $ref: "#/components/schemas/TicketCreationRuleResponse" description: Successfully retrieved the ticket creation rule "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a ticket creation rule tags: - Security Monitoring x-permission: operator: OR permissions: - security_pipelines_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: Update a ticket creation rule by ID. operationId: UpdateSecurityFindingsAutomationTicketCreationRule parameters: - description: The ID of the ticket creation rule. in: path name: rule_id required: true schema: example: "00000000-0000-0000-0000-000000000000" format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: action: max_tickets_per_day: 50 project_id: "11111111-1111-1111-1111-111111111111" target: jira enabled: true name: "Auto-create Jira tickets for critical findings" rule: finding_types: - misconfiguration query: "env:prod" id: "00000000-0000-0000-0000-000000000000" type: ticket_creation_rules schema: $ref: "#/components/schemas/TicketCreationRuleUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: action: max_tickets_per_day: 50 project_id: "11111111-1111-1111-1111-111111111111" target: jira created_at: 1722439510282 created_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user enabled: true modified_at: 1722439510999 modified_by: id: "00000000-0000-0000-0000-000000000000" name: "Jane Doe" type: user name: "Auto-create Jira tickets for critical findings" rule: finding_types: - misconfiguration query: "env:prod" id: "00000000-0000-0000-0000-000000000000" type: ticket_creation_rules schema: $ref: "#/components/schemas/TicketCreationRuleResponse" description: Successfully updated the ticket creation rule "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update a ticket creation rule tags: - Security Monitoring x-codegen-request-body-name: body x-permission: operator: OR permissions: - security_pipelines_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/findings/cases: delete: description: >- Detach security findings from their case. This operation dissociates security findings from their associated cases without deleting the cases themselves. You can detach security findings from multiple different cases in a single request, with a limit of 50 security findings per request. Security findings that are not currently attached to any case will be ignored. operationId: DetachCase requestBody: content: application/json: examples: default: value: data: id: c1234567-89ab-cdef-0123-456789abcdef relationships: findings: data: - id: ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw== type: findings type: cases schema: $ref: "#/components/schemas/DetachCaseRequest" required: true responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Detach security findings from their case tags: - "Security Monitoring" x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_findings_write - appsec_vm_write post: description: >- Create cases for security findings. You can create up to 50 cases per request and associate up to 50 security findings per case. Security findings that are already attached to another case will be detached from their previous case and attached to the newly created case. operationId: CreateCases requestBody: content: application/json: examples: default: value: data: - attributes: assignee_id: f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0 description: A description of the case. priority: NOT_DEFINED title: A title for the case. relationships: findings: data: - id: YjdhNDM3N2QyNTFjYmUwYTY3NDdhMTg0YTk2Yjg5MDl-ZjNmMzAwOTFkZDNhNGQzYzI0MzgxNTk4MjRjZmE2NzE= type: findings project: data: id: aeadc05e-98a8-11ec-ac2c-da7ad0900001 type: cases schema: $ref: "#/components/schemas/CreateCaseRequestArray" required: true responses: "201": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" description: A description of the case. modified_at: "2024-01-01T00:00:00+00:00" priority: P4 status: OPEN title: A title for the case. id: 00000000-0000-0000-0000-000000000001 type: cases schema: $ref: "#/components/schemas/FindingCaseResponseArray" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create cases for security findings tags: - "Security Monitoring" x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_findings_write - appsec_vm_write /api/v2/security/findings/cases/{case_id}: patch: description: >- Attach security findings to a case. You can attach up to 50 security findings per case. Security findings that are already attached to another case will be detached from their previous case and attached to the specified case. operationId: AttachCase parameters: - description: Unique identifier of the case to attach security findings to in: path name: case_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: id: c1234567-89ab-cdef-0123-456789abcdef relationships: findings: data: - id: ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw== type: cases schema: $ref: "#/components/schemas/AttachCaseRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" description: A description of the case. modified_at: "2024-01-01T00:00:00+00:00" priority: P4 status: OPEN title: A title for the case. id: 00000000-0000-0000-0000-000000000002 type: cases schema: $ref: "#/components/schemas/FindingCaseResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Attach security findings to a case tags: - "Security Monitoring" x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_findings_write - appsec_vm_write /api/v2/security/findings/jira_issues: patch: description: >- Attach security findings to a Jira issue by providing the Jira issue URL. You can attach up to 50 security findings per Jira issue. If the Jira issue is not linked to any case, this operation will create a case for the security findings and link the Jira issue to the newly created case. To configure the Jira integration, see [Bidirectional ticket syncing with Jira](https://docs.datadoghq.com/security/ticketing_integrations/#bidirectional-ticket-syncing-with-jira). Security findings that are already attached to another Jira issue will be detached from their previous Jira issue and attached to the specified Jira issue. operationId: AttachJiraIssue requestBody: content: application/json: examples: default: value: data: attributes: jira_issue_url: https://datadoghq-sandbox-538.atlassian.net/browse/CSMSEC-105476 relationships: findings: data: - id: ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw== project: data: id: aeadc05e-98a8-11ec-ac2c-da7ad0900001 type: projects type: jira_issues schema: $ref: "#/components/schemas/AttachJiraIssueRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" description: A description of the Jira issue. modified_at: "2024-01-01T00:00:00+00:00" priority: P4 status: OPEN title: A title for the Jira issue. id: 00000000-0000-0000-0000-000000000004 type: cases schema: $ref: "#/components/schemas/FindingCaseResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Attach security findings to a Jira issue tags: - "Security Monitoring" x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_findings_write - appsec_vm_write post: description: >- Create Jira issues for security findings. This operation creates a case in Datadog and a Jira issue linked to that case for bidirectional sync between Datadog and Jira. To configure the Jira integration, see [Bidirectional ticket syncing with Jira](https://docs.datadoghq.com/security/ticketing_integrations/#bidirectional-ticket-syncing-with-jira). You can create up to 50 Jira issues per request and associate up to 50 security findings per Jira issue. Security findings that are already attached to another Jira issue will be detached from their previous Jira issue and attached to the newly created Jira issue. operationId: CreateJiraIssues requestBody: content: application/json: examples: default: value: data: - attributes: assignee_id: f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0 description: A description of the Jira issue. fields: key1: value key2: - value key3: key4: value priority: NOT_DEFINED title: A title for the Jira issue. relationships: project: data: id: aeadc05e-98a8-11ec-ac2c-da7ad0900001 type: jira_issues schema: $ref: "#/components/schemas/CreateJiraIssueRequestArray" required: true responses: "201": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" description: A description of the Jira issue. modified_at: "2024-01-01T00:00:00+00:00" priority: P4 status: OPEN title: A title for the Jira issue. id: 00000000-0000-0000-0000-000000000003 type: cases schema: $ref: "#/components/schemas/FindingCaseResponseArray" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create Jira issues for security findings tags: - "Security Monitoring" x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_findings_write - appsec_vm_write /api/v2/security/findings/linear_issues: patch: description: >- Attach security findings to a Linear issue by providing the Linear issue URL. You can attach up to 50 security findings per Linear issue. If the Linear issue is not linked to any case, this operation will create a case for the security findings and link the Linear issue to the newly created case. Security findings that are already attached to another Linear issue will be detached from their previous Linear issue and attached to the specified Linear issue. operationId: AttachLinearIssue requestBody: content: application/json: examples: default: value: data: attributes: linear_issue_url: https://linear.app/your-workspace/issue/ENG-123 relationships: findings: data: - id: ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw== type: findings project: data: id: aeadc05e-98a8-11ec-ac2c-da7ad0900001 type: projects type: linear_issues schema: $ref: "#/components/schemas/AttachLinearIssueRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" description: A description of the Linear issue. modified_at: "2024-01-01T00:00:00+00:00" priority: P4 status: OPEN title: A title for the Linear issue. id: 00000000-0000-0000-0000-000000000008 type: cases schema: $ref: "#/components/schemas/FindingCaseResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Attach security findings to a Linear issue tags: - "Security Monitoring" x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_findings_write - appsec_vm_write post: description: >- Create Linear issues for security findings. This operation creates a case in Datadog and a Linear issue linked to that case for bidirectional sync between Datadog and Linear. You can create up to 50 Linear issues per request and associate up to 50 security findings per Linear issue. Security findings that are already attached to another Linear issue will be detached from their previous Linear issue and attached to the newly created Linear issue. operationId: CreateLinearIssues requestBody: content: application/json: examples: default: value: data: - attributes: assignee_id: f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0 description: A description of the Linear issue. label_ids: - a1b2c3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d linear_project_id: d4c3b2a1-6f5e-8b7a-0d9c-2f1e4a3b6c5d priority: NOT_DEFINED title: A title for the Linear issue. relationships: findings: data: - id: ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw== type: findings project: data: id: aeadc05e-98a8-11ec-ac2c-da7ad0900001 type: projects type: linear_issues schema: $ref: "#/components/schemas/CreateLinearIssueRequestArray" required: true responses: "201": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" description: A description of the Linear issue. modified_at: "2024-01-01T00:00:00+00:00" priority: P4 status: OPEN title: A title for the Linear issue. id: 00000000-0000-0000-0000-000000000007 type: cases schema: $ref: "#/components/schemas/FindingCaseResponseArray" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create Linear issues for security findings tags: - "Security Monitoring" x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_findings_write - appsec_vm_write /api/v2/security/findings/mute: patch: description: >- Mute or unmute security findings. You can mute or unmute up to 100 security findings per request. The request body must include `is_muted` and `reason` attributes. The allowed reasons depend on whether the finding is being muted or unmuted: - To mute a finding: `PENDING_FIX`, `FALSE_POSITIVE`, `OTHER`, `NO_FIX`, `DUPLICATE`, `RISK_ACCEPTED`. - To unmute a finding: `NO_PENDING_FIX`, `HUMAN_ERROR`, `NO_LONGER_ACCEPTED_RISK`, `OTHER`. operationId: MuteSecurityFindings requestBody: content: application/json: examples: default: value: data: attributes: mute: description: "To be resolved later." expire_at: 1778721573794 is_muted: true reason: "RISK_ACCEPTED" relationships: findings: data: - id: "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==" type: "findings" type: "mute" schema: $ref: "#/components/schemas/MuteFindingsRequest" required: true responses: "202": content: application/json: examples: default: value: data: id: 00000000-0000-0000-0000-000000000001 type: mute schema: $ref: "#/components/schemas/MuteFindingsResponse" description: Accepted "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/UnauthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Unprocessable Entity" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Mute or unmute security findings tags: - "Security Monitoring" x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_findings_write - appsec_vm_write /api/v2/security/findings/search: post: description: |- Get a list of security findings that match a search query. [See the schema for security findings](https://docs.datadoghq.com/security/guide/findings-schema/). ### Query Syntax The API uses the logs query syntax. Findings attributes (living in the attributes.attributes. namespace) are prefixed by @ when queried. Tags are queried without a prefix. Example: `@severity:(critical OR high) @status:open team:platform` operationId: SearchSecurityFindings requestBody: content: application/json: examples: default: value: data: attributes: filter: "@severity:(critical OR high) @status:open team:platform" page: cursor: eyJhZnRlciI6IkF3QUFBWnPcm1pd0FBQUJbVlBQUKBa1pqRTVdZUzSTBNemN0YWiIsLTE3Mjk0MzYwMjFdfQ== limit: 25 sort: "@detection_changed_at" schema: $ref: "#/components/schemas/SecurityFindingsSearchRequest" required: true responses: "200": content: application/json: examples: default: value: data: - attributes: attributes: severity: high status: open tags: - "team:platform" timestamp: 1765901760 id: ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw== type: finding meta: elapsed: 548 status: done schema: $ref: "#/components/schemas/ListSecurityFindingsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_findings_read summary: Search security findings tags: - "Security Monitoring" x-codegen-request-body-name: body x-pagination: cursorParam: body.data.attributes.page.cursor cursorPath: meta.page.after limitParam: body.data.attributes.page.limit resultsPath: data "x-permission": operator: OR permissions: - security_monitoring_findings_read - appsec_vm_read /api/v2/security/findings/servicenow_tickets: patch: description: >- Attach security findings to a ServiceNow ticket by providing the ServiceNow ticket URL. You can attach up to 50 security findings per ServiceNow ticket. If the ServiceNow ticket is not linked to any case, this operation will create a case for the security findings and link the ServiceNow ticket to the newly created case. Security findings that are already attached to another ServiceNow ticket will be detached from their previous ServiceNow ticket and attached to the specified ServiceNow ticket. operationId: AttachServiceNowTicket requestBody: content: application/json: examples: default: value: data: attributes: servicenow_ticket_url: https://example.service-now.com/now/nav/ui/classic/params/target/incident.do?sys_id=abcdef0123456789abcdef0123456789 relationships: findings: data: - id: ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw== type: findings project: data: id: aeadc05e-98a8-11ec-ac2c-da7ad0900001 type: projects type: servicenow_tickets schema: $ref: "#/components/schemas/AttachServiceNowTicketRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" description: A description of the ServiceNow ticket. modified_at: "2024-01-01T00:00:00+00:00" priority: P4 status: OPEN title: A title for the ServiceNow ticket. id: 00000000-0000-0000-0000-000000000006 type: cases schema: $ref: "#/components/schemas/FindingCaseResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Attach security findings to a ServiceNow ticket tags: - "Security Monitoring" x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_findings_write - appsec_vm_write post: description: >- Create ServiceNow tickets for security findings. This operation creates a case in Datadog and a ServiceNow ticket linked to that case for bidirectional sync between Datadog and ServiceNow. You can create up to 50 ServiceNow tickets per request and associate up to 50 security findings per ServiceNow ticket. Security findings that are already attached to another ServiceNow ticket will be detached from their previous ServiceNow ticket and attached to the newly created ServiceNow ticket. operationId: CreateServiceNowTickets requestBody: content: application/json: examples: default: value: data: - attributes: assignee_id: f315bdaf-9ee7-4808-a9c1-99c15bf0f4d0 description: A description of the ServiceNow ticket. priority: NOT_DEFINED title: A title for the ServiceNow ticket. relationships: findings: data: - id: ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw== type: findings project: data: id: aeadc05e-98a8-11ec-ac2c-da7ad0900001 type: projects type: servicenow_tickets schema: $ref: "#/components/schemas/CreateServiceNowTicketRequestArray" required: true responses: "201": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" description: A description of the ServiceNow ticket. modified_at: "2024-01-01T00:00:00+00:00" priority: P4 status: OPEN title: A title for the ServiceNow ticket. id: 00000000-0000-0000-0000-000000000005 type: cases schema: $ref: "#/components/schemas/FindingCaseResponseArray" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create ServiceNow tickets for security findings tags: - "Security Monitoring" x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_findings_write - appsec_vm_write /api/v2/security/findings/severity: patch: description: |- Set or clear the manual severity override of security findings. You can update up to 100 security findings per request. Use the `set` action with a `value` to apply a manual severity override. `value` is required for `set` and must be omitted for `clear`. The `info` value sets the lowest severity the finding type allows. Use the `clear` action to remove a manual severity override. `clear` does not remove a severity set by an automation rule. The optional `description` is accepted with both actions and has a limit of 280 characters. Auto-closed findings are excluded. Findings whose severity was set by an automation rule are skipped and listed in the response `meta.warnings`. If every finding is skipped this way, the request fails with a `400` error. Findings that cannot be found are skipped without a warning. The request fails with a `404` error only if none of the findings can be found. operationId: UpdateFindingsSeverity requestBody: content: application/json: examples: default: value: data: attributes: severity: action: "set" description: "Database contains sensitive data." value: "high" relationships: findings: data: - id: "ZGVmLTAwcC1pZXJ-aS0wZjhjNjMyZDNmMzRlZTgzNw==" type: "findings" - id: "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=" type: "findings" type: "severity_override" schema: $ref: "#/components/schemas/SeverityOverrideRequest" required: true responses: "202": content: application/json: examples: default: value: data: id: "00000000-0000-0000-0000-000000000001" type: "severity_override" meta: warnings: - detail: >- cannot set severity on finding because it is overridden by an automation severity modifier rule; disable or update the automation rule first finding_id: "ZGVmLTAwMC0wYmd-MDE4NjcyMDJkMzE4MDE5ODY5MGE4ZmQ2MmFlMjg0Y2M=" status: 400 title: "Bad Request" schema: $ref: "#/components/schemas/SeverityOverrideResponse" description: Accepted "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Unprocessable Entity" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Override the severity of security findings tags: - "Security Monitoring" x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_findings_write - appsec_vm_write - data_scanner_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/ownership/{resource_id}: get: description: Get all current ownership inferences for a resource, one per owner type (`user`, `team`, `service`, `unknown`). operationId: ListOwnershipInferences parameters: - description: The identifier of the resource to retrieve ownership inferences for. in: path name: resource_id required: true schema: example: test-resource type: string responses: "200": content: application/json: examples: default: value: data: attributes: items: - checksum: abc123 confidence: "0.9500" created_at: "2026-01-15T10:00:00Z" evidence_versions: - pipeline_id: p1 explanation: High confidence match id: test-resource:team owner_type: team primary_contact_ref: ref:handle/team-a sources: [] status: suggested updated_at: "2026-01-15T10:00:00Z" id: test-resource type: ownership_inferences schema: $ref: "#/components/schemas/OwnershipInferenceListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List ownership inferences for a resource tags: ["CSM Ownership"] x-unstable: |- **Note**: This endpoint is in Preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/ownership/{resource_id}/history: get: description: List inference history entries for a resource across all owner types, ordered from most recent to oldest. Uses cursor-based pagination. operationId: ListOwnershipHistory parameters: - description: The identifier of the resource to retrieve inference history for. in: path name: resource_id required: true schema: example: res-1 type: string - description: An opaque, base64-encoded cursor token returned by a previous call in `pagination.next_cursor`. Omit to fetch the first page. in: query name: cursor required: false schema: example: eyJpZCI6OTh9 type: string - description: The maximum number of history entries to return per page. in: query name: limit required: false schema: default: 25 example: 25 format: int32 maximum: 100 minimum: 1 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: items: - checksum: "" confidence: "0.9000" created_at: "2026-01-15T10:00:00Z" evidence_versions: explanation: "" failed_at: failure_reason: id: 100 owner_type: team primary_contact_ref: ref:handle/team-a resource_id: res-1 retry_schedule: sources: [] status: suggested pagination: has_more: false next_cursor: id: res-1 type: ownership_history schema: $ref: "#/components/schemas/OwnershipHistoryResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List ownership inference history for a resource tags: ["CSM Ownership"] x-unstable: |- **Note**: This endpoint is in Preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/ownership/{resource_id}/{owner_type}: get: description: |- Get the current ownership inference for a resource for a specific owner type. This endpoint supports ETag-based caching. Pass the previously returned `ETag` value in the `If-None-Match` request header to receive a `304 Not Modified` response when the inference has not changed. operationId: GetOwnershipInference parameters: - description: The identifier of the resource to retrieve the ownership inference for. in: path name: resource_id required: true schema: example: test-resource type: string - description: The owner type of the inference to retrieve. in: path name: owner_type required: true schema: $ref: "#/components/schemas/OwnershipOwnerType" - description: A previously returned `ETag` value. When supplied and the resource has not changed, the endpoint returns `304 Not Modified`. in: header name: If-None-Match required: false schema: example: '"abc123"' type: string responses: "200": content: application/json: examples: default: value: data: attributes: checksum: abc123 confidence: "0.9500" created_at: "2026-01-15T10:00:00Z" evidence_versions: - pipeline_id: p1 explanation: High confidence match owner_type: team primary_contact_ref: ref:handle/team-a sources: [] status: suggested updated_at: "2026-01-15T10:00:00Z" id: test-resource:team type: ownership_inference schema: $ref: "#/components/schemas/OwnershipInferenceResponse" description: OK headers: Cache-Control: description: The cache control directives applied to the response. schema: example: private, max-age=60 type: string ETag: description: A strong validator that identifies the current state of the inference. schema: example: '"abc123"' type: string "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get an ownership inference by owner type tags: ["CSM Ownership"] x-unstable: |- **Note**: This endpoint is in Preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/ownership/{resource_id}/{owner_type}/evidence: get: description: |- Get the evidence versions backing the current ownership inference for a resource and owner type. This endpoint supports weak ETag caching. Pass the previously returned `ETag` value in the `If-None-Match` request header to receive a `304 Not Modified` response when the evidence has not changed. operationId: GetOwnershipEvidence parameters: - description: The identifier of the resource to retrieve evidence for. in: path name: resource_id required: true schema: example: test-resource type: string - description: The owner type of the inference to retrieve evidence for. in: path name: owner_type required: true schema: $ref: "#/components/schemas/OwnershipOwnerType" - description: A previously returned weak `ETag` value. When supplied and the evidence has not changed, the endpoint returns `304 Not Modified`. in: header name: If-None-Match required: false schema: example: W/"f2e126916327bda8" type: string responses: "200": content: application/json: examples: default: value: data: attributes: evidence_versions: - pipeline_id: p1 version: v3 id: test-resource type: ownership_evidence schema: $ref: "#/components/schemas/OwnershipEvidenceResponse" description: OK headers: ETag: description: A weak validator that identifies the current state of the evidence. schema: example: W/"f2e126916327bda8" type: string "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get the evidence for an ownership inference tags: ["CSM Ownership"] x-unstable: |- **Note**: This endpoint is in Preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/ownership/{resource_id}/{owner_type}/feedback: post: description: |- Submit feedback on the current ownership inference for a resource and owner type. Valid actions are `confirm`, `reject`, `correct`, and `persist`. The request must include the current inference `checksum` in `inference_checksum`. If the checksum does not match the current inference state, the endpoint returns `409 Conflict`. When `action` is `correct`, `corrected_owner_handle` and `corrected_owner_type` are required. operationId: CreateOwnershipFeedback parameters: - description: The identifier of the resource that the feedback applies to. in: path name: resource_id required: true schema: example: res-1 type: string - description: The type of owner that the feedback applies to. in: path name: owner_type required: true schema: $ref: "#/components/schemas/OwnershipOwnerType" requestBody: content: application/json: examples: default: value: data: attributes: action: confirm inference_checksum: abc123 type: ownership_feedback schema: $ref: "#/components/schemas/OwnershipFeedbackRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: action: confirm checksum: abc123 new_status: suggested owner_type: team previous_status: suggested primary_contact_ref: ref:handle/team-a updated_at: "2026-01-15T10:00:00Z" id: res-1 type: ownership_feedback_result schema: $ref: "#/components/schemas/OwnershipFeedbackResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/OwnershipInferenceResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Submit feedback on an ownership inference tags: ["CSM Ownership"] x-unstable: |- **Note**: This endpoint is in Preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/ownership/{resource_id}/{owner_type}/history: get: description: List inference history entries for a resource filtered by owner type, ordered from most recent to oldest. Uses cursor-based pagination. operationId: ListOwnershipHistoryByOwnerType parameters: - description: The identifier of the resource to retrieve inference history for. in: path name: resource_id required: true schema: example: res-1 type: string - description: The owner type to filter history by. in: path name: owner_type required: true schema: $ref: "#/components/schemas/OwnershipOwnerType" - description: An opaque, base64-encoded cursor token returned by a previous call in `pagination.next_cursor`. Omit to fetch the first page. in: query name: cursor required: false schema: example: eyJpZCI6OTh9 type: string - description: The maximum number of history entries to return per page. in: query name: limit required: false schema: default: 25 example: 25 format: int32 maximum: 100 minimum: 1 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: items: - checksum: "" confidence: "0.9000" created_at: "2026-01-15T10:00:00Z" evidence_versions: explanation: "" failed_at: failure_reason: id: 100 owner_type: team primary_contact_ref: ref:handle/team-a resource_id: res-1 retry_schedule: sources: [] status: suggested pagination: has_more: false next_cursor: id: res-1 type: ownership_history schema: $ref: "#/components/schemas/OwnershipHistoryResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List ownership history by owner type tags: ["CSM Ownership"] x-unstable: |- **Note**: This endpoint is in Preview and may be subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/sboms: get: description: |- Get a list of assets SBOMs for an organization. The `filter[asset_type]` parameter is required for initial requests (when no `page[token]` is provided). Subsequent pages encode the asset type in the pagination token, so `filter[asset_type]` is not required for paginated requests. Mixing infrastructure asset types (`Host`, `HostImage`, `Image`, `ServerlessFunction`) with code asset types (`Repository`, `Service`) in the same request is not supported and returns a 400 error. ### Pagination Please review the [Pagination section](#pagination) for the "List Vulnerabilities" endpoint. ### Filtering Please review the [Filtering section](#filtering) for the "List Vulnerabilities" endpoint. ### Metadata Please review the [Metadata section](#metadata) for the "List Vulnerabilities" endpoint. operationId: ListAssetsSBOMs parameters: - description: Its value must come from the `links` section of the response of the first request. Do not manually edit it. example: "b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4" in: query name: page[token] required: false schema: type: string - description: The page number to be retrieved. It should be equal to or greater than 1. example: 1 in: query name: page[number] required: false schema: format: int64 minimum: 1 type: integer - description: >- The type of the assets for the SBOM request. Required for initial requests (when no `page[token]` is provided). Infrastructure types (`Host`, `HostImage`, `Image`, `ServerlessFunction`) and code types (`Repository`, `Service`) cannot be mixed in the same request. example: Repository in: query name: filter[asset_type] required: false schema: $ref: "#/components/schemas/AssetType" - description: The name of the asset for the SBOM request. example: "github.com/datadog/datadog-agent" in: query name: filter[asset_name] required: false schema: type: string - description: The name of the component that is a dependency of an asset. example: "opentelemetry-api" in: query name: filter[package_name] required: false schema: type: string - description: The version of the component that is a dependency of an asset. example: "1.33.1" in: query name: filter[package_version] required: false schema: type: string - description: The software license name of the component that is a dependency of an asset. example: "Apache-2.0" in: query name: filter[license_name] required: false schema: type: string - description: The software license type of the component that is a dependency of an asset. example: "network_strong_copyleft" in: query name: filter[license_type] required: false schema: $ref: "#/components/schemas/SBOMComponentLicenseType" responses: "200": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/ListAssetsSBOMsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Bad request: The server cannot process the request due to invalid syntax in the request." "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Forbidden: Access denied" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Not found: asset not found" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List assets SBOMs tags: - "Security Monitoring" x-permission: operator: OR permissions: - appsec_vm_read /api/v2/security/sboms/{asset_type}: get: description: |- Get a single SBOM related to an asset by its type and name. operationId: GetSBOM parameters: - description: The type of the asset for the SBOM request. example: Repository in: path name: asset_type required: true schema: $ref: "#/components/schemas/AssetType" - description: The name of the asset for the SBOM request. example: "github.com/datadog/datadog-agent" in: query name: filter[asset_name] required: true schema: type: string - description: The container image `repo_digest` for the SBOM request. When the requested asset type is 'Image', this filter is mandatory. example: "sha256:0ae7da091191787229d321e3638e39c319a97d6e20f927d465b519d699215bf7" in: query name: filter[repo_digest] required: false schema: type: string - description: The standard of the SBOM. example: CycloneDX in: query name: ext:format required: false schema: $ref: "#/components/schemas/SBOMFormat" responses: "200": content: application/json: examples: default: value: data: attributes: bomFormat: CycloneDX components: - name: google.golang.org/grpc type: library version: 1.68.1 dependencies: [] metadata: {} serialNumber: urn:uuid:abc-123 specVersion: "1.6" version: 1 id: "github.com/datadog/datadog-agent" type: sboms schema: $ref: "#/components/schemas/GetSBOMResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Bad request: The server cannot process the request due to invalid syntax in the request." "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Forbidden: Access denied" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Not found: asset not found" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get SBOM tags: - "Security Monitoring" x-permission: operator: OR permissions: - appsec_vm_read /api/v2/security/scanned-assets-metadata: get: description: |- Get a list of security scanned assets metadata for an organization. ### Pagination For the "List Vulnerabilities" endpoint, see the [Pagination section](#pagination). ### Filtering For the "List Vulnerabilities" endpoint, see the [Filtering section](#filtering). ### Metadata For the "List Vulnerabilities" endpoint, see the [Metadata section](#metadata). ### Related endpoints This endpoint returns additional metadata for cloud resources that is not available from the standard resource endpoints. To access a richer dataset, call this endpoint together with the relevant resource endpoint(s) and merge (join) their results using the resource identifier. **Hosts** To enrich host data, join the response from the [Hosts](https://docs.datadoghq.com/api/latest/hosts/) endpoint with the response from the scanned-assets-metadata endpoint on the following key fields: | ENDPOINT | JOIN KEY | TYPE | | --- | --- | --- | | [/api/v1/hosts](https://docs.datadoghq.com/api/latest/hosts/) | host_list.host_name | string | | /api/v2/security/scanned-assets-metadata | data.attributes.asset.name | string | **Host Images** To enrich host image data, join the response from the [Hosts](https://docs.datadoghq.com/api/latest/hosts/) endpoint with the response from the scanned-assets-metadata endpoint on the following key fields: | ENDPOINT | JOIN KEY | TYPE | | --- | --- | --- | | [/api/v1/hosts](https://docs.datadoghq.com/api/latest/hosts/) | host_list.tags_by_source["Amazon Web Services"]["image"] | string | | /api/v2/security/scanned-assets-metadata | data.attributes.asset.name | string | **Container Images** To enrich container image data, join the response from the [Container Images](https://docs.datadoghq.com/api/latest/container-images/) endpoint with the response from the scanned-assets-metadata endpoint on the following key fields: | ENDPOINT | JOIN KEY | TYPE | | --- | --- | --- | | [/api/v2/container_images](https://docs.datadoghq.com/api/latest/container-images/) | `data.attributes.name`@`data.attributes.repo_digest` | string | | /api/v2/security/scanned-assets-metadata | data.attributes.asset.name | string | operationId: ListScannedAssetsMetadata parameters: - description: Its value must come from the `links` section of the response of the first request. Do not manually edit it. example: "b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4" in: query name: page[token] required: false schema: type: string - description: The page number to be retrieved. It should be equal to or greater than 1. example: 1 in: query name: page[number] required: false schema: format: int64 minimum: 1 type: integer - description: The type of the scanned asset. example: Host in: query name: filter[asset.type] required: false schema: $ref: "#/components/schemas/CloudAssetType" - description: The name of the scanned asset. example: "i-0fc7edef1ab26d7ef" in: query name: filter[asset.name] required: false schema: type: string - description: The origin of last success scan. example: "agent" in: query name: filter[last_success.origin] required: false schema: type: string - description: The environment of last success scan. example: "prod" in: query name: filter[last_success.env] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: asset: name: i-0fc7edef1ab26d7ef type: Host first_success_timestamp: "2024-01-01T00:00:00Z" last_success: env: prod id: "Host|i-0fc7edef1ab26d7ef" type: scanned-assets-metadata schema: $ref: "#/components/schemas/ScannedAssetsMetadata" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Bad request: The server cannot process the request due to invalid syntax in the request." "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Forbidden: Access denied" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Not found: asset not found" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List scanned assets metadata tags: - "Security Monitoring" x-permission: operator: OR permissions: - appsec_vm_read x-unstable: |- **Note**: This endpoint is a private preview. If you are interested in accessing this API, [fill out this form](https://forms.gle/kMYC1sDr6WDUBDsx9). /api/v2/security/siem/ioc-explorer: get: description: |- Get a list of indicators of compromise (IoCs) matching the specified filters. operationId: ListIndicatorsOfCompromise parameters: - description: Number of results per page. in: query name: limit required: false schema: default: 50 format: int32 maximum: 2147483647 type: integer - description: Pagination offset. in: query name: offset required: false schema: default: 0 format: int32 maximum: 2147483647 type: integer - description: Search/filter query (supports field:value syntax). in: query name: query required: false schema: type: string - description: "Sort column: score, first_seen_ts_epoch, last_seen_ts_epoch, indicator, indicator_type, signal_count, log_count, category, as_type." in: query name: sort[column] required: false schema: default: score type: string - description: "Sort order: asc or desc." in: query name: sort[order] required: false schema: default: desc type: string - description: When true, return only OCSF field-based matches. When false, return regex/message-based matches. in: query name: ocsf required: false schema: default: true type: boolean - description: Filter indicators whose triage state was updated by a specific user identified by their handle. in: query name: worked_by required: false schema: type: string - description: Filter by triage state. in: query name: triage_state required: false schema: $ref: "#/components/schemas/IoCTriageState" responses: "200": content: "application/json": examples: default: value: data: attributes: data: - id: abc-123 indicator: "192.0.2.1" indicator_type: ip score: 85.0 metadata: count: 1 paging: offset: 0 id: abc-123 type: ioc_explorer_list_response schema: $ref: "#/components/schemas/IoCExplorerListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_signals_read summary: List indicators of compromise tags: ["Security Monitoring"] x-unstable: |- **Note**: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates. /api/v2/security/siem/ioc-explorer/indicator: get: description: |- Get detailed information about a specific indicator of compromise (IoC). operationId: GetIndicatorOfCompromise parameters: - description: The indicator value to look up (for example, an IP address or domain). in: query name: indicator required: true schema: type: string - description: When true, return only OCSF field-based matches. When false, return regex/message-based matches. in: query name: ocsf required: false schema: default: true type: boolean - description: Include full triage history for the indicator. in: query name: include_triage_history required: false schema: default: false type: boolean - description: Maximum number of triage history events returned. Only applied when `include_triage_history` is true. in: query name: triage_history_limit required: false schema: default: 50 format: int32 maximum: 1000 minimum: 1 type: integer - description: Pagination offset into the triage history. Only applied when `include_triage_history` is true. in: query name: triage_history_offset required: false schema: default: 0 format: int32 maximum: 2147483647 type: integer responses: "200": content: "application/json": examples: default: value: data: attributes: data: id: abc-123 indicator: "192.0.2.1" indicator_type: ip score: 85.0 id: abc-123 type: ioc_indicator_response schema: $ref: "#/components/schemas/GetIoCIndicatorResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_signals_read summary: Get an indicator of compromise tags: ["Security Monitoring"] x-unstable: |- **Note**: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates. /api/v2/security/siem/ioc-explorer/triage: post: description: |- Set the triage state of an indicator of compromise (IoC). This creates or updates the triage state for the indicator in your organization. operationId: CreateIoCTriageState requestBody: content: "application/json": examples: default: value: data: attributes: indicator: "192.0.2.1" triage_state: reviewed type: ioc_triage_state schema: $ref: "#/components/schemas/IoCTriageWriteRequest" description: The triage state to set for the indicator. required: true responses: "201": content: "application/json": examples: default: value: data: attributes: created_at: "2026-06-04T12:00:00Z" indicator: "192.0.2.1" triage_state: reviewed triaged_at: "2026-06-04T12:00:00Z" triaged_by: 11111111-2222-3333-4444-555555555555 id: abc-123 type: ioc_triage_state schema: $ref: "#/components/schemas/IoCTriageWriteResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_signals_write summary: Create or update an indicator triage state tags: ["Security Monitoring"] x-unstable: |- **Note**: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates. /api/v2/security/signals/notification_rules: get: description: Returns the list of notification rules for security signals. operationId: GetSignalNotificationRules responses: "200": $ref: "#/components/responses/NotificationRulesList" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get the list of signal-based notification rules tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_notification_profiles_read post: description: Create a new notification rule for security signals and return the created rule. operationId: CreateSignalNotificationRule requestBody: content: "application/json": examples: default: value: data: attributes: enabled: true name: Rule selectors: query: (source:production_service OR env:prod) rule_types: - misconfiguration - attack_path severities: - critical trigger_source: security_findings targets: - "@john.doe@email.com" time_aggregation: 86400 type: notification_rules schema: $ref: "#/components/schemas/CreateNotificationRuleParameters" description: |- The body of the create notification rule request is composed of the rule type and the rule attributes: the rule name, the selectors, the notification targets, and the rule enabled status. required: true responses: "201": content: "application/json": examples: default: value: data: attributes: created_at: 1722439510282 created_by: handle: example-handle name: Example Name enabled: true modified_at: 1722439510282 modified_by: handle: example-handle name: Example Name name: Rule 1 selectors: query: env:prod rule_types: - log_detection severities: - critical trigger_source: security_signals targets: - "@test@example.com" version: 1 id: aaa-bbb-ccc type: notification_rules schema: $ref: "#/components/schemas/NotificationRuleResponse" description: Successfully created the notification rule. "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create a new signal-based notification rule tags: - Security Monitoring x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_notification_profiles_write /api/v2/security/signals/notification_rules/{id}: delete: description: Delete a notification rule for security signals. operationId: DeleteSignalNotificationRule parameters: - description: ID of the notification rule. in: path name: id required: true schema: type: string responses: "204": description: "Rule successfully deleted." "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete a signal-based notification rule tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_notification_profiles_write get: description: Get the details of a notification rule for security signals. operationId: GetSignalNotificationRule parameters: - description: ID of the notification rule. in: path name: id required: true schema: type: string responses: "200": content: "application/json": examples: default: value: data: attributes: created_at: 1722439510282 created_by: handle: example-handle name: Example Name enabled: true modified_at: 1722439510282 modified_by: handle: example-handle name: Example Name name: Rule 1 selectors: query: env:prod rule_types: - log_detection severities: - critical trigger_source: security_signals targets: - "@test@example.com" version: 1 id: aaa-bbb-ccc type: notification_rules schema: $ref: "#/components/schemas/NotificationRuleResponse" description: Notification rule details. "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get details of a signal-based notification rule tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_notification_profiles_read patch: description: "Partially update the notification rule. All fields are optional; if a field is not provided, it is not updated." operationId: PatchSignalNotificationRule parameters: - description: ID of the notification rule. in: path name: id required: true schema: type: string requestBody: content: "application/json": examples: default: value: data: attributes: enabled: true name: Rule selectors: query: (source:production_service OR env:prod) rule_types: - misconfiguration - attack_path severities: - critical trigger_source: security_findings targets: - "@john.doe@email.com" time_aggregation: 86400 version: 1 id: aaa-bbb-ccc type: notification_rules schema: $ref: "#/components/schemas/PatchNotificationRuleParameters" required: true responses: "200": content: "application/json": examples: default: value: data: attributes: created_at: 1722439510282 created_by: handle: example-handle name: Example Name enabled: true modified_at: 1722439510282 modified_by: handle: example-handle name: Example Name name: Rule 1 selectors: query: env:prod rule_types: - log_detection severities: - critical trigger_source: security_signals targets: - "@test@example.com" version: 1 id: aaa-bbb-ccc type: notification_rules schema: $ref: "#/components/schemas/NotificationRuleResponse" description: Notification rule successfully patched. "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": $ref: "#/components/responses/UnprocessableEntityResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Patch a signal-based notification rule tags: - Security Monitoring x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_notification_profiles_write /api/v2/security/threat-intel/stix: post: description: |- Ingest a STIX 2.1 bundle containing threat intelligence indicators. Only indicator objects are processed. Supported indicator patterns contain IPv4 addresses, IPv6 addresses, domain names, or SHA-256 file hashes. Non-indicator objects are ignored and are not included in the response counters. Indicator objects with unsupported STIX versions or patterns that produce no supported observable values increment the `unsupported` counter. Patterns that cannot be parsed increment the `invalid` counter. Processing is best effort, so valid supported indicators in the same bundle are still added. A successful response means ingestion has completed. Reference-table materialization and enrichment happen asynchronously. Requests are limited to 50 MB as received, 100 MB after decompression, and 10 requests per second per API key. Gzip-compressed request bodies are supported. operationId: AddSTIXThreatIntel parameters: - description: >- Vendor identifier for the feed. The value must not exceed 10 characters. Datadog normalizes the accepted value to lowercase, converts non-alphanumeric characters to underscores, and trims leading and trailing underscores. example: acme in: header name: ti_vendor required: true schema: maxLength: 10 minLength: 1 type: string - description: Content encoding for the request body. Use gzip for a compressed STIX bundle. in: header name: Content-Encoding required: false schema: $ref: "#/components/schemas/STIXContentEncoding" requestBody: content: application/json: examples: default: value: id: bundle--11111111-1111-4111-8111-111111111111 objects: - created: "2026-07-22T12:00:00Z" id: indicator--22222222-2222-4222-8222-222222222222 modified: "2026-07-22T12:00:00Z" pattern: "[ipv4-addr:value = '198.51.100.42']" pattern_type: stix spec_version: "2.1" type: indicator valid_from: "2026-07-22T12:00:00Z" spec_version: "2.1" type: bundle schema: $ref: "#/components/schemas/STIXBundleRequest" description: >- A STIX 2.1 bundle containing indicator objects. The request body must not exceed 50 MB as received or 100 MB after decompression. required: true responses: "200": content: application/json: examples: default: value: data: attributes: accepted: 1 invalid: 0 unsupported: 0 id: acme type: threat-intel-stix-ingest schema: $ref: "#/components/schemas/STIXIngestResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": $ref: "#/components/responses/UnauthorizedResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "413": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The request body exceeds 50 MB as received or 100 MB after decompression. "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too many requests "502": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The STIX ingestion service returned an error while processing the request. "503": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: The STIX ingestion service is temporarily unavailable. security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Ingest STIX threat intelligence tags: - Threat Intelligence x-codegen-request-body-name: body x-permission: operator: OR permissions: - reference_tables_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/vulnerabilities: get: deprecated: true description: |- Get a list of vulnerabilities. ### Pagination Pagination is enabled by default in both `vulnerabilities` and `assets`. The size of the page varies depending on the endpoint and cannot be modified. To automate the request of the next page, you can use the links section in the response. This endpoint will return paginated responses. The pages are stored in the links section of the response: ```JSON { "data": [...], "meta": {...}, "links": { "self": "https://.../api/v2/security/vulnerabilities", "first": "https://.../api/v2/security/vulnerabilities?page[number]=1&page[token]=abc", "last": "https://.../api/v2/security/vulnerabilities?page[number]=43&page[token]=abc", "next": "https://.../api/v2/security/vulnerabilities?page[number]=2&page[token]=abc" } } ``` - `links.previous` is empty if the first page is requested. - `links.next` is empty if the last page is requested. #### Token Vulnerabilities can be created, updated or deleted at any point in time. Upon the first request, a token is created to ensure consistency across subsequent paginated requests. A token is valid only for 24 hours. #### First request We consider a request to be the first request when there is no `page[token]` parameter. The response of this first request contains the newly created token in the `links` section. This token can then be used in the subsequent paginated requests. *Note: The first request may take longer to complete than subsequent requests.* #### Subsequent requests Any request containing valid `page[token]` and `page[number]` parameters will be considered a subsequent request. If the `token` is invalid, a `404` response will be returned. If the page `number` is invalid, a `400` response will be returned. The returned `token` is valid for all requests in the pagination sequence. To send paginated requests in parallel, reuse the same `token` and change only the `page[number]` parameter. ### Filtering The request can include some filter parameters to filter the data to be retrieved. The format of the filter parameters follows the [JSON:API format](https://jsonapi.org/format/#fetching-filtering): `filter[$prop_name]`, where `prop_name` is the property name in the entity being filtered by. All filters can include multiple values, where data will be filtered with an OR clause: `filter[title]=Title1,Title2` will filter all vulnerabilities where title is equal to `Title1` OR `Title2`. String filters are case sensitive. Boolean filters accept `true` or `false` as values. Number filters must include an operator as a second filter input: `filter[$prop_name][$operator]`. For example, for the vulnerabilities endpoint: `filter[cvss.base.score][lte]=8`. Available operators are: `eq` (==), `lt` (<), `lte` (<=), `gt` (>) and `gte` (>=). ### Metadata Following [JSON:API format](https://jsonapi.org/format/#document-meta), object including non-standard meta-information. This endpoint includes the meta member in the response. For more details on each of the properties included in this section, check the endpoints response tables. ```JSON { "data": [...], "meta": { "total": 1500, "count": 18732, "token": "some_token" }, "links": {...} } ``` ### Extensions Requests may include extensions to modify the behavior of the requested endpoint. The filter parameters follow the [JSON:API format](https://jsonapi.org/extensions/#extensions) format: `ext:$extension_name`, where `extension_name` is the name of the modifier that is being applied. Extensions can only include one value: `ext:modifier=value`. operationId: ListVulnerabilities parameters: - description: Its value must come from the `links` section of the response of the first request. Do not manually edit it. example: "b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4" in: query name: page[token] required: false schema: type: string - description: The page number to be retrieved. It should be equal or greater than `1` example: 1 in: query name: page[number] required: false schema: format: int64 minimum: 1 type: integer - description: Filter by vulnerability type. example: WeakCipher in: query name: filter[type] required: false schema: $ref: "#/components/schemas/VulnerabilityType" - description: Filter by vulnerability base (i.e. from the original advisory) severity score. example: 5.5 in: query name: filter[cvss.base.score][`$op`] required: false schema: format: double maximum: 10 minimum: 0 type: number - description: Filter by vulnerability base severity. example: Medium in: query name: filter[cvss.base.severity] required: false schema: $ref: "#/components/schemas/VulnerabilitySeverity" - description: Filter by vulnerability base CVSS vector. example: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" in: query name: filter[cvss.base.vector] required: false schema: type: string - description: Filter by vulnerability Datadog severity score. example: 4.3 in: query name: filter[cvss.datadog.score][`$op`] required: false schema: format: double maximum: 10 minimum: 0 type: number - description: Filter by vulnerability Datadog severity. example: Medium in: query name: filter[cvss.datadog.severity] required: false schema: $ref: "#/components/schemas/VulnerabilitySeverity" - description: Filter by vulnerability Datadog CVSS vector. example: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:X/RC:X/CR:X/IR:X/AR:X/MAV:L/MAC:H/MPR:L/MUI:N/MS:U/MC:N/MI:N/MA:H" in: query name: filter[cvss.datadog.vector] required: false schema: type: string - description: Filter by the status of the vulnerability. example: Open in: query name: filter[status] required: false schema: $ref: "#/components/schemas/VulnerabilityStatus" - description: Filter by the tool of the vulnerability. example: SCA in: query name: filter[tool] required: false schema: $ref: "#/components/schemas/VulnerabilityTool" - description: Filter by library name. example: linux-aws-5.15 in: query name: filter[library.name] required: false schema: type: string - description: Filter by library version. example: 5.15.0 in: query name: filter[library.version] required: false schema: type: string - description: Filter by advisory ID. example: CVE-2023-0615 in: query name: filter[advisory.id] required: false schema: type: string - description: Filter by exploitation probability. example: false in: query name: filter[risks.exploitation_probability] required: false schema: type: boolean - description: Filter by POC exploit availability. example: false in: query name: filter[risks.poc_exploit_available] required: false schema: type: boolean - description: Filter by public exploit availability. example: false in: query name: filter[risks.exploit_available] required: false schema: type: boolean - description: Filter by vulnerability [EPSS](https://www.first.org/epss/) severity score. example: 0.00042 in: query name: filter[risks.epss.score][`$op`] required: false schema: format: double maximum: 1 minimum: 0 type: number - description: Filter by vulnerability [EPSS](https://www.first.org/epss/) severity. example: Low in: query name: filter[risks.epss.severity] required: false schema: $ref: "#/components/schemas/VulnerabilitySeverity" - description: Filter by language. example: ubuntu in: query name: filter[language] required: false schema: type: string - description: Filter by ecosystem. example: Deb in: query name: filter[ecosystem] required: false schema: $ref: "#/components/schemas/VulnerabilityEcosystem" - description: Filter by vulnerability location. example: "com.example.Class:100" in: query name: filter[code_location.location] required: false schema: type: string - description: Filter by vulnerability file path. example: "src/Class.java:100" in: query name: filter[code_location.file_path] required: false schema: type: string - description: Filter by method. example: FooBar in: query name: filter[code_location.method] required: false schema: type: string - description: Filter by fix availability. example: false in: query name: filter[fix_available] required: false schema: type: boolean - description: Filter by vulnerability `repo_digest` (when the vulnerability is related to `Image` asset). example: "sha256:0ae7da091191787229d321e3638e39c319a97d6e20f927d465b519d699215bf7" in: query name: filter[repo_digests] required: false schema: type: string - description: Filter by origin. example: agentless-scanner in: query name: filter[origin] required: false schema: type: string - description: Filter for whether the vulnerability affects a running kernel (for vulnerabilities related to a `Host` asset). example: true in: query name: filter[running_kernel] required: false schema: type: boolean - description: Filter by asset name. This field supports the usage of wildcards (*). example: datadog-agent in: query name: filter[asset.name] required: false schema: type: string - description: Filter by asset type. example: Host in: query name: filter[asset.type] required: false schema: $ref: "#/components/schemas/AssetType" - description: Filter by the first version of the asset this vulnerability has been detected on. example: v1.15.1 in: query name: filter[asset.version.first] required: false schema: type: string - description: Filter by the last version of the asset this vulnerability has been detected on. example: v1.15.1 in: query name: filter[asset.version.last] required: false schema: type: string - description: Filter by the repository url associated to the asset. example: github.com/DataDog/datadog-agent.git in: query name: filter[asset.repository_url] required: false schema: type: string - description: Filter whether the asset is in production or not. example: false in: query name: filter[asset.risks.in_production] required: false schema: type: boolean - description: Filter whether the asset is under attack or not. example: false in: query name: filter[asset.risks.under_attack] required: false schema: type: boolean - description: Filter whether the asset is publicly accessible or not. example: false in: query name: filter[asset.risks.is_publicly_accessible] required: false schema: type: boolean - description: Filter whether the asset is publicly accessible or not. example: false in: query name: filter[asset.risks.has_privileged_access] required: false schema: type: boolean - description: Filter whether the asset has access to sensitive data or not. example: false in: query name: filter[asset.risks.has_access_to_sensitive_data] required: false schema: type: boolean - description: Filter by asset environments. example: staging in: query name: filter[asset.environments] required: false schema: type: string - description: Filter by asset teams. example: compute in: query name: filter[asset.teams] required: false schema: type: string - description: Filter by asset architecture. example: arm64 in: query name: filter[asset.arch] required: false schema: type: string - description: Filter by asset operating system name. example: ubuntu in: query name: filter[asset.operating_system.name] required: false schema: type: string - description: Filter by asset operating system version. example: "24.04" in: query name: filter[asset.operating_system.version] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/ListVulnerabilitiesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Bad request: The server cannot process the request due to invalid syntax in the request." "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Forbidden: Access denied" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Not found: There is no request associated with the provided token." "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List vulnerabilities tags: - "Security Monitoring" x-permission: operator: OR permissions: - appsec_vm_read x-sunset: "2027-01-01" x-unstable: |- **Note**: This endpoint is deprecated. See the [List Security Findings endpoint](https://docs.datadoghq.com/api/latest/security-monitoring/#list-security-findings). post: description: |- Import security vulnerabilities from an external scanner in CycloneDX 1.5 format. The payload is validated against the CycloneDX 1.5 JSON schema and the following additional constraints: - `metadata`, `metadata.component`, and `metadata.component.name` are required. - `metadata.tools.components` must contain exactly one element with a `name` field. - `components` cannot be empty. Each component requires `bom-ref`, `type`, `name`, and `version`. - When `type` is `library`, `purl` is required and must be a valid PURL. - When `type` is `operating-system`, `name` must be one of the supported OS values: `alma`, `alpine`, `amazon`, `azurelinux`, `bottlerocket`, `cbl-mariner`, `chainguard`, `centos`, `debian`, `fedora`, `opensuse`, `opensuse-leap`, `opensuse-tumbleweed`, `oracle`, `photon`, `redhat`, `rocky`, `slem`, `sles`, `ubuntu`, `wolfi`, `windows`, `macos`. - `vulnerabilities` cannot be empty. Each vulnerability requires `id`, exactly one `ratings` entry, and at least one `affects` entry. - Each `affects[].ref` must match a `bom-ref` value in `components`. operationId: ImportSecurityVulnerabilities requestBody: content: application/json: examples: default: value: bomFormat: CycloneDX components: - bom-ref: a3390fca-c315-41ae-ae05-af5e7859cdee name: lodash purl: "pkg:npm/lodash@4.17.21" type: library version: 4.17.21 metadata: component: name: i-12345 type: operating-system tools: components: - name: my-scanner type: application specVersion: "1.5" version: 1 vulnerabilities: - affects: - ref: a3390fca-c315-41ae-ae05-af5e7859cdee description: "Sample vulnerability detected in the application." id: CVE-2021-1234 ratings: - score: 9.0 severity: high vector: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N" schema: $ref: "#/components/schemas/CycloneDXBom" required: true responses: "200": description: Vulnerabilities accepted successfully. "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_findings_write summary: Import security vulnerabilities tags: - Security Monitoring x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_findings_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security/vulnerabilities/notification_rules: get: description: Returns the list of notification rules for security vulnerabilities. operationId: GetVulnerabilityNotificationRules responses: "200": $ref: "#/components/responses/NotificationRulesList" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get the list of vulnerability notification rules tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_notification_profiles_read post: description: Create a new notification rule for security vulnerabilities and return the created rule. operationId: CreateVulnerabilityNotificationRule requestBody: content: "application/json": examples: default: value: data: attributes: enabled: true name: Rule selectors: query: (source:production_service OR env:prod) rule_types: - misconfiguration - attack_path severities: - critical trigger_source: security_findings targets: - "@john.doe@email.com" time_aggregation: 86400 type: notification_rules schema: $ref: "#/components/schemas/CreateNotificationRuleParameters" description: |- The body of the create notification rule request is composed of the rule type and the rule attributes: the rule name, the selectors, the notification targets, and the rule enabled status. required: true responses: "201": content: "application/json": examples: default: value: data: attributes: created_at: 1722439510282 created_by: handle: example-handle name: Example Name enabled: true modified_at: 1722439510282 modified_by: handle: example-handle name: Example Name name: Rule 1 selectors: query: env:prod rule_types: - misconfiguration severities: - critical trigger_source: security_findings targets: - "@test@example.com" time_aggregation: 86400 version: 1 id: aaa-bbb-ccc type: notification_rules schema: $ref: "#/components/schemas/NotificationRuleResponse" description: Successfully created the notification rule. "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create a new vulnerability-based notification rule tags: - Security Monitoring x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_notification_profiles_write /api/v2/security/vulnerabilities/notification_rules/{id}: delete: description: Delete a notification rule for security vulnerabilities. operationId: DeleteVulnerabilityNotificationRule parameters: - description: ID of the notification rule. in: path name: id required: true schema: type: string responses: "204": description: "Rule successfully deleted." "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete a vulnerability-based notification rule tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_notification_profiles_write get: description: Get the details of a notification rule for security vulnerabilities. operationId: GetVulnerabilityNotificationRule parameters: - description: ID of the notification rule. in: path name: id required: true schema: type: string responses: "200": content: "application/json": examples: default: value: data: attributes: created_at: 1722439510282 created_by: handle: example-handle name: Example Name enabled: true modified_at: 1722439510282 modified_by: handle: example-handle name: Example Name name: Rule 1 selectors: query: env:prod rule_types: - misconfiguration severities: - critical trigger_source: security_findings targets: - "@test@example.com" time_aggregation: 86400 version: 1 id: aaa-bbb-ccc type: notification_rules schema: $ref: "#/components/schemas/NotificationRuleResponse" description: Notification rule details. "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get details of a vulnerability notification rule tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_notification_profiles_read patch: description: "Partially update the notification rule. All fields are optional; if a field is not provided, it is not updated." operationId: PatchVulnerabilityNotificationRule parameters: - description: ID of the notification rule. in: path name: id required: true schema: type: string requestBody: content: "application/json": examples: default: value: data: attributes: enabled: true name: Rule selectors: query: (source:production_service OR env:prod) rule_types: - misconfiguration - attack_path severities: - critical trigger_source: security_findings targets: - "@john.doe@email.com" time_aggregation: 86400 version: 1 id: aaa-bbb-ccc type: notification_rules schema: $ref: "#/components/schemas/PatchNotificationRuleParameters" required: true responses: "200": content: "application/json": examples: default: value: data: attributes: created_at: 1722439510282 created_by: handle: example-handle name: Example Name enabled: true modified_at: 1722439510282 modified_by: handle: example-handle name: Example Name name: Rule 1 selectors: query: env:prod rule_types: - misconfiguration severities: - critical trigger_source: security_findings targets: - "@test@example.com" time_aggregation: 86400 version: 1 id: aaa-bbb-ccc type: notification_rules schema: $ref: "#/components/schemas/NotificationRuleResponse" description: Notification rule successfully patched. "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": $ref: "#/components/responses/UnprocessableEntityResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Patch a vulnerability-based notification rule tags: - Security Monitoring x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_notification_profiles_write /api/v2/security/vulnerable-assets: get: description: |- Get a list of vulnerable assets. ### Pagination Please review the [Pagination section for the "List Vulnerabilities"](#pagination) endpoint. ### Filtering Please review the [Filtering section for the "List Vulnerabilities"](#filtering) endpoint. ### Metadata Please review the [Metadata section for the "List Vulnerabilities"](#metadata) endpoint. operationId: ListVulnerableAssets parameters: - description: Its value must come from the `links` section of the response of the first request. Do not manually edit it. example: "b82cef018aab81ed1d4bb4xb35xxfc065da7efa685fbcecdbd338f3015e3afabbbfa3a911b4984_721ee28a-zecb-4e45-9960-c42065b574f4" in: query name: page[token] required: false schema: type: string - description: The page number to be retrieved. It should be equal or greater than `1` example: 1 in: query name: page[number] required: false schema: format: int64 minimum: 1 type: integer - description: Filter by name. This field supports the usage of wildcards (*). example: datadog-agent in: query name: filter[name] required: false schema: type: string - description: Filter by type. example: Host in: query name: filter[type] required: false schema: $ref: "#/components/schemas/AssetType" - description: Filter by the first version of the asset since it has been vulnerable. example: v1.15.1 in: query name: filter[version.first] required: false schema: type: string - description: Filter by the last detected version of the asset. example: v1.15.1 in: query name: filter[version.last] required: false schema: type: string - description: Filter by the repository url associated to the asset. example: github.com/DataDog/datadog-agent.git in: query name: filter[repository_url] required: false schema: type: string - description: Filter whether the asset is in production or not. example: false in: query name: filter[risks.in_production] required: false schema: type: boolean - description: Filter whether the asset (Service) is under attack or not. example: false in: query name: filter[risks.under_attack] required: false schema: type: boolean - description: Filter whether the asset (Host) is publicly accessible or not. example: false in: query name: filter[risks.is_publicly_accessible] required: false schema: type: boolean - description: Filter whether the asset (Host) has privileged access or not. example: false in: query name: filter[risks.has_privileged_access] required: false schema: type: boolean - description: Filter whether the asset (Host) has access to sensitive data or not. example: false in: query name: filter[risks.has_access_to_sensitive_data] required: false schema: type: boolean - description: Filter by environment. example: staging in: query name: filter[environments] required: false schema: type: string - description: Filter by teams. example: compute in: query name: filter[teams] required: false schema: type: string - description: Filter by architecture. example: arm64 in: query name: filter[arch] required: false schema: type: string - description: Filter by operating system name. example: ubuntu in: query name: filter[operating_system.name] required: false schema: type: string - description: Filter by operating system version. example: "24.04" in: query name: filter[operating_system.version] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/ListVulnerableAssetsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Bad request: The server cannot process the request due to invalid syntax in the request." "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Forbidden: Access denied" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: "Not found: There is no request associated with the provided token." "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List vulnerable assets tags: - "Security Monitoring" x-permission: operator: OR permissions: - appsec_vm_read x-unstable: |- **Note**: This endpoint is a private preview. If you are interested in accessing this API, [fill out this form](https://forms.gle/kMYC1sDr6WDUBDsx9). /api/v2/security_monitoring/batch-migrations: get: description: |- List the batch migrations of your organization. A batch migration groups detection rules from another SIEM that the Datadog Detection Agent translates into Cloud SIEM detection rules. To retrieve a single batch migration, filter by its ID with `filter[query]=id:`. Poll this endpoint to follow the progress of a batch migration through its `status` and `resourceStatusCounts`. operationId: ListSecurityMonitoringBatchMigrations parameters: - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationPageSize" - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationPageNumber" - description: |- A search query in Datadog search syntax to filter batch migrations, such as `status:completed`. Filterable attributes are `id`, `name`, `description`, `status`, `createdBy`, and `lastUpdatedBy`. Free text matches the batch migration name. in: query name: filter[query] required: false schema: example: "status:draft" type: string responses: "200": content: application/json: examples: default: value: data: - attributes: createdAt: "2026-09-21T12:00:00Z" createdBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d description: Rules imported from Splunk inputSource: batch_migration lastUpdatedAt: "2026-09-21T12:00:00Z" lastUpdatedBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d name: Splunk migration orgId: 123456 resourceStatusCounts: canceled: 0 completed: 0 duplicate: 0 failed: 0 inProgress: 0 pending: 1 published: 0 publishing: 0 status: draft tags: - source:splunk id: 7cdb3a75-64fb-46ce-9445-41969e78fe8e type: batchMigration meta: totalCount: 1 schema: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationsListResponse" description: OK "400": $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" "401": $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" "403": $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read summary: List batch migrations tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_rules_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. post: description: |- Create a batch migration in the `draft` status, together with 1 to 100 initial resources. Each resource holds one source rule to translate into a Cloud SIEM detection rule. To load more rules, add them with the add resources endpoint before starting the batch migration. A batch migration can hold up to 1000 resources. The response does not include the created resources: list the resources of the batch migration to retrieve them. Alternatively, use the start-a-rule-proposal endpoint to get a single proposed rule. operationId: CreateSecurityMonitoringBatchMigration requestBody: content: application/json: examples: default: value: data: attributes: description: Rules imported from Splunk name: Splunk migration resources: - description: Detects repeated failed Windows authentication attempts. input: index=wineventlog EventCode=4625 inputType: spl name: Repeated Windows login failures - input: >- Alert when PowerShell is launched with a command line that downloads and executes a remote script, such as IEX with Net.WebClient or Invoke-WebRequest. inputType: natural_language name: Suspicious PowerShell download cradle tags: - source:splunk type: batchMigration schema: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: createdAt: "2026-09-21T12:00:00Z" createdBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d description: Rules imported from Splunk inputSource: batch_migration lastUpdatedAt: "2026-09-21T12:00:00Z" lastUpdatedBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d name: Splunk migration orgId: 123456 resourceStatusCounts: canceled: 0 completed: 0 duplicate: 0 failed: 0 inProgress: 0 pending: 2 published: 0 publishing: 0 status: draft tags: - source:splunk id: 7cdb3a75-64fb-46ce-9445-41969e78fe8e type: batchMigration schema: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResponse" description: Created "400": $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" "401": $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" "403": $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Create a batch migration tags: - Security Monitoring x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_rules_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. /api/v2/security_monitoring/batch-migrations/{batch_id}: delete: description: |- Delete a batch migration and its resources. Detection rules that were already published are not deleted. Returns `409 Conflict` while any resource is `in_progress` or `publishing`: cancel the batch migration, or wait for publishing to finish, and then try again. operationId: DeleteSecurityMonitoringBatchMigration parameters: - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationID" responses: "204": description: No Content "400": $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" "401": $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" "403": $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" "404": $ref: "#/components/responses/SecurityMonitoringBatchMigrationNotFoundResponse" "409": $ref: "#/components/responses/SecurityMonitoringBatchMigrationConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Delete a batch migration tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_rules_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. patch: description: |- Update the name, description, or tags of a batch migration, in any status. At least one of these attributes must be provided. Omitted attributes are left unchanged, and `tags` replaces the full list of tags. operationId: UpdateSecurityMonitoringBatchMigration parameters: - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationID" requestBody: content: application/json: examples: default: value: data: attributes: name: Splunk migration - Windows tags: - source:splunk - team:secops type: batchMigration schema: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: createdAt: "2026-09-21T12:00:00Z" createdBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d description: Rules imported from Splunk inputSource: batch_migration lastUpdatedAt: "2026-09-21T12:05:00Z" lastUpdatedBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d name: Splunk migration - Windows orgId: 123456 resourceStatusCounts: canceled: 0 completed: 0 duplicate: 0 failed: 0 inProgress: 0 pending: 1 published: 0 publishing: 0 status: draft tags: - source:splunk - team:secops id: 7cdb3a75-64fb-46ce-9445-41969e78fe8e type: batchMigration schema: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResponse" description: OK "400": $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" "401": $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" "403": $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" "404": $ref: "#/components/responses/SecurityMonitoringBatchMigrationNotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Update a batch migration tags: - Security Monitoring x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_rules_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. /api/v2/security_monitoring/batch-migrations/{batch_id}/cancel: post: description: |- Cancel an `in_progress` batch migration. Resources that are `pending` or `in_progress` become `canceled`. Resources that are already `completed` or `failed` keep their status and output, so completed resources can still be published. Canceling a `canceled` batch migration succeeds, so the request can be safely retried. Returns `409 Conflict` if the batch migration is `draft` or `completed`. operationId: CancelSecurityMonitoringBatchMigration parameters: - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationID" responses: "202": description: Accepted "400": $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" "401": $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" "403": $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" "404": $ref: "#/components/responses/SecurityMonitoringBatchMigrationNotFoundResponse" "409": $ref: "#/components/responses/SecurityMonitoringBatchMigrationConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Cancel a batch migration tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_rules_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. /api/v2/security_monitoring/batch-migrations/{batch_id}/publish: post: description: |- Create a Cloud SIEM detection rule from the `output` of each selected `completed` resource of a batch migration. Completed resources can be published while the rest of the batch migration is still being translated. When `resourceIds` is omitted or empty, every `completed` resource is published. Published rules are created disabled. Every requested resource must be publishable: `completed`, or left in `publishing` for more than one minute after an uncertain result. Otherwise, the request returns `409 Conflict` and nothing is published. Already published resources are not publishable. The response reports the outcome of each resource, and some resources can be published while others fail. A `failed` result that contains a `ruleId` means the rule was created: do not retry that resource. Publishing a rule with a `block_ip` or `block_user` action requires the `appsec_protect_write` permission. operationId: PublishSecurityMonitoringBatchMigration parameters: - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationID" requestBody: content: application/json: examples: all_completed: summary: Publish every completed resource value: data: attributes: {} type: batchMigrationPublish default: value: data: attributes: resourceIds: - c968cf83-56c2-4d54-a993-6c86dfb83527 type: batchMigrationPublish schema: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishRequest" required: true responses: "200": content: application/json: examples: default: value: data: - attributes: ruleId: abc-def-ghi status: published id: c968cf83-56c2-4d54-a993-6c86dfb83527 type: batchMigrationPublishedResource schema: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationPublishResponse" description: OK "400": $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" "401": $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" "403": $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" "404": $ref: "#/components/responses/SecurityMonitoringBatchMigrationNotFoundResponse" "409": $ref: "#/components/responses/SecurityMonitoringBatchMigrationConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Publish a batch migration tags: - Security Monitoring x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_rules_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. /api/v2/security_monitoring/batch-migrations/{batch_id}/resources: delete: description: |- Delete resources from a batch migration. The request is all-or-nothing: it returns `404 Not Found` if any resource does not exist, and `409 Conflict` if any resource is `in_progress` or `publishing`. In both cases nothing is deleted. Duplicate resource IDs are ignored. Detection rules already published from the deleted resources are not deleted. operationId: DeleteSecurityMonitoringBatchMigrationResources parameters: - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationID" requestBody: content: application/json: examples: default: value: data: attributes: resourceIds: - c968cf83-56c2-4d54-a993-6c86dfb83527 type: batchMigrationResources schema: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesDeleteRequest" required: true responses: "204": description: No Content "400": $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" "401": $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" "403": $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" "404": $ref: "#/components/responses/SecurityMonitoringBatchMigrationNotFoundResponse" "409": $ref: "#/components/responses/SecurityMonitoringBatchMigrationConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Delete resources from a batch migration tags: - Security Monitoring x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_rules_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. get: description: |- List the resources of a batch migration, including the input of each source rule and, once translated, the proposed Cloud SIEM detection rule in `output`. operationId: ListSecurityMonitoringBatchMigrationResources parameters: - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationID" - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationPageSize" - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationPageNumber" - description: |- A search query in Datadog search syntax to filter resources, such as `status:completed`. Filterable attributes are `id`, `name`, `description`, `inputType`, `status`, `input`, `createdBy`, and `lastUpdatedBy`. Free text matches the resource name. in: query name: filter[query] required: false schema: example: "status:completed inputType:spl" type: string responses: "200": content: application/json: examples: default: value: data: - attributes: batchId: 7cdb3a75-64fb-46ce-9445-41969e78fe8e createdAt: "2026-09-21T12:00:00Z" createdBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d description: Detects repeated failed Windows authentication attempts. input: index=wineventlog EventCode=4625 inputType: spl lastUpdatedAt: "2026-09-21T12:02:00Z" lastUpdatedBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d name: Repeated Windows login failures output: cases: - condition: failed_logins >= 5 name: Repeated failures notifications: [] status: medium isEnabled: false message: Repeated failed Windows login attempts were detected. name: Repeated Windows login failures options: evaluationWindow: 300 keepAlive: 3600 maxSignalDuration: 86400 queries: - aggregation: count groupByFields: - "@usr.name" - "@network.client.ip" name: failed_logins query: "source:windows @evt.id:4625" tags: - source:windows - migration:splunk type: log_detection outputType: siem_rule status: completed id: c968cf83-56c2-4d54-a993-6c86dfb83527 type: batchMigrationResource meta: totalCount: 1 schema: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesListResponse" description: OK "400": $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" "401": $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" "403": $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" "404": $ref: "#/components/responses/SecurityMonitoringBatchMigrationNotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read summary: List batch migration resources tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_rules_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. post: description: |- Add 1 to 1000 resources to a `draft` batch migration. Returns `409 Conflict` if the batch migration is not `draft`, and `400 Bad Request` if the batch migration would contain more than 1000 resources. operationId: CreateSecurityMonitoringBatchMigrationResources parameters: - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationID" requestBody: content: application/json: examples: default: value: data: attributes: resources: - input: index=linux process=sudo "authentication failure" | stats count by user, host inputType: spl name: Linux sudo abuse type: batchMigrationResources schema: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: - attributes: batchId: 7cdb3a75-64fb-46ce-9445-41969e78fe8e createdAt: "2026-09-21T12:10:00Z" createdBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d input: index=linux process=sudo "authentication failure" | stats count by user, host inputType: spl lastUpdatedAt: "2026-09-21T12:10:00Z" lastUpdatedBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d name: Linux sudo abuse output: outputType: siem_rule status: pending id: 0b3f5e5c-8a2b-4a8f-9f0e-3c1d2e4f5a6b type: batchMigrationResource schema: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourcesCreateResponse" description: Created "400": $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" "401": $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" "403": $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" "404": $ref: "#/components/responses/SecurityMonitoringBatchMigrationNotFoundResponse" "409": $ref: "#/components/responses/SecurityMonitoringBatchMigrationConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Add resources to a batch migration tags: - Security Monitoring x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_rules_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. /api/v2/security_monitoring/batch-migrations/{batch_id}/resources/{resource_id}: patch: description: |- Update a resource of a batch migration. At least one of `name`, `description`, `inputType`, or `input` must be provided. `name` and `description` can be updated at any time. `inputType` and `input` can only be updated while the resource is `pending`; otherwise, the request returns `409 Conflict`. The translated `output` cannot be edited. operationId: UpdateSecurityMonitoringBatchMigrationResource parameters: - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationID" - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationResourceID" requestBody: content: application/json: examples: default: value: data: attributes: input: index=wineventlog EventCode=4625 | stats count by user type: batchMigrationResource schema: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: batchId: 7cdb3a75-64fb-46ce-9445-41969e78fe8e createdAt: "2026-09-21T12:00:00Z" createdBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d input: index=wineventlog EventCode=4625 | stats count by user inputType: spl lastUpdatedAt: "2026-09-21T12:15:00Z" lastUpdatedBy: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d name: Repeated Windows login failures output: outputType: siem_rule status: pending id: c968cf83-56c2-4d54-a993-6c86dfb83527 type: batchMigrationResource schema: $ref: "#/components/schemas/SecurityMonitoringBatchMigrationResourceResponse" description: OK "400": $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" "401": $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" "403": $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" "404": $ref: "#/components/responses/SecurityMonitoringBatchMigrationNotFoundResponse" "409": $ref: "#/components/responses/SecurityMonitoringBatchMigrationConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Update a batch migration resource tags: - Security Monitoring x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_rules_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. /api/v2/security_monitoring/batch-migrations/{batch_id}/start: post: description: |- Start translating the `pending` resources of a `draft` batch migration into Cloud SIEM detection rules. The batch migration moves to `in_progress`, and its resources are translated asynchronously. Once no resource is `pending` or `in_progress`, the batch migration moves to `completed`. Starting an `in_progress` batch migration again does not queue duplicate work, so the request can be safely retried, including after a timeout or a `5xx` error. Returns `409 Conflict` if the batch migration is `completed` or `canceled`. An organization can translate up to 2000 resources in total across all of its batch migrations. Resources that were already processed count toward this limit even after they are deleted, and `pending` resources of `in_progress` batch migrations reserve capacity. Returns `409 Conflict` if starting the batch migration would exceed this limit. To request a higher limit for your organization, contact [Datadog support](https://docs.datadoghq.com/help/). operationId: StartSecurityMonitoringBatchMigration parameters: - $ref: "#/components/parameters/SecurityMonitoringBatchMigrationID" responses: "202": description: Accepted "400": $ref: "#/components/responses/SecurityMonitoringBatchMigrationBadRequestResponse" "401": $ref: "#/components/responses/SecurityMonitoringBatchMigrationUnauthorizedResponse" "403": $ref: "#/components/responses/SecurityMonitoringBatchMigrationForbiddenResponse" "404": $ref: "#/components/responses/SecurityMonitoringBatchMigrationNotFoundResponse" "409": $ref: "#/components/responses/SecurityMonitoringBatchMigrationConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": $ref: "#/components/responses/SecurityMonitoringBatchMigrationInternalServerErrorResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Start a batch migration tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_rules_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. /api/v2/security_monitoring/cloud_workload_security/agent_rules: get: description: |- Get the list of agent rules. **Note**: This endpoint should only be used for the Government (US1-FED) site. operationId: ListCloudWorkloadSecurityAgentRules responses: "200": content: "application/json": examples: default: value: data: - attributes: description: My Agent rule enabled: true expression: exec.file.name == "sh" name: my_agent_rule id: abc-123 type: agent_rule schema: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRulesListResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get all Workload Protection agent rules (US1-FED) tags: ["CSM Threats"] "x-permission": operator: OR permissions: - security_monitoring_cws_agent_rules_read post: description: |- Create a new agent rule with the given parameters. **Note**: This endpoint should only be used for the Government (US1-FED) site. operationId: CreateCloudWorkloadSecurityAgentRule requestBody: content: application/json: examples: default: value: data: attributes: description: My Agent rule enabled: true expression: exec.file.name == "sh" name: my_agent_rule type: agent_rule schema: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleCreateRequest" description: "The definition of the new agent rule" required: true responses: "200": content: "application/json": examples: default: value: data: attributes: description: My Agent rule enabled: true expression: exec.file.name == "sh" name: my_agent_rule id: abc-123 type: agent_rule schema: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a Workload Protection agent rule (US1-FED) tags: ["CSM Threats"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_cws_agent_rules_write /api/v2/security_monitoring/cloud_workload_security/agent_rules/{agent_rule_id}: delete: description: |- Delete a specific agent rule. **Note**: This endpoint should only be used for the Government (US1-FED) site. operationId: DeleteCloudWorkloadSecurityAgentRule parameters: - $ref: "#/components/parameters/CloudWorkloadSecurityAgentRuleID" responses: "204": description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a Workload Protection agent rule (US1-FED) tags: ["CSM Threats"] "x-permission": operator: OR permissions: - security_monitoring_cws_agent_rules_write get: description: |- Get the details of a specific agent rule. **Note**: This endpoint should only be used for the Government (US1-FED) site. operationId: GetCloudWorkloadSecurityAgentRule parameters: - $ref: "#/components/parameters/CloudWorkloadSecurityAgentRuleID" responses: "200": content: application/json: examples: default: value: data: attributes: description: My Agent rule enabled: true expression: exec.file.name == "sh" name: my_agent_rule id: abc-123 type: agent_rule schema: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a Workload Protection agent rule (US1-FED) tags: ["CSM Threats"] "x-permission": operator: OR permissions: - security_monitoring_cws_agent_rules_read patch: description: |- Update a specific agent rule. Returns the agent rule object when the request is successful. **Note**: This endpoint should only be used for the Government (US1-FED) site. operationId: UpdateCloudWorkloadSecurityAgentRule parameters: - $ref: "#/components/parameters/CloudWorkloadSecurityAgentRuleID" requestBody: content: application/json: examples: default: value: data: attributes: description: My Agent rule enabled: true expression: exec.file.name == "sh" id: 3dd-0uc-h1s type: agent_rule schema: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleUpdateRequest" description: "New definition of the agent rule" required: true responses: "200": content: application/json: examples: default: value: data: attributes: description: My Agent rule enabled: true expression: exec.file.name == "sh" name: my_agent_rule id: abc-123 type: agent_rule schema: $ref: "#/components/schemas/CloudWorkloadSecurityAgentRuleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConcurrentModificationResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a Workload Protection agent rule (US1-FED) tags: ["CSM Threats"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_cws_agent_rules_write /api/v2/security_monitoring/configuration/critical_assets: get: description: Get the list of all critical assets. operationId: ListSecurityMonitoringCriticalAssets responses: "200": content: application/json: examples: default: value: data: - attributes: enabled: true query: security:monitoring rule_query: type:log_detection source:cloudtrail severity: increase version: 1 id: 4e2435a5-6670-4b8f-baff-46083cd1c250 type: critical_assets schema: $ref: "#/components/schemas/SecurityMonitoringCriticalAssetsResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_critical_assets_read summary: Get all critical assets tags: - Security Monitoring post: description: Create a new critical asset. operationId: CreateSecurityMonitoringCriticalAsset requestBody: content: application/json: examples: default: value: data: attributes: enabled: true query: security:monitoring rule_query: type:(log_detection OR signal_correlation OR workload_security OR application_security) source:cloudtrail severity: increase tags: - team:database - source:cloudtrail type: critical_assets schema: $ref: "#/components/schemas/SecurityMonitoringCriticalAssetCreateRequest" description: The definition of the new critical asset. required: true responses: "200": content: "application/json": examples: default: value: data: attributes: enabled: true query: security:monitoring rule_query: type:log_detection source:cloudtrail severity: increase version: 1 id: 4e2435a5-6670-4b8f-baff-46083cd1c250 type: critical_assets schema: $ref: "#/components/schemas/SecurityMonitoringCriticalAssetResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_critical_assets_write summary: Create a critical asset tags: - Security Monitoring x-codegen-request-body-name: body /api/v2/security_monitoring/configuration/critical_assets/rules/{rule_id}: get: description: Get the list of critical assets that affect a specific existing rule by the rule's ID. operationId: GetCriticalAssetsAffectingRule parameters: - $ref: "#/components/parameters/SecurityMonitoringRuleID" responses: "200": content: application/json: examples: default: value: data: - attributes: enabled: true query: security:monitoring rule_query: type:log_detection source:cloudtrail severity: increase version: 1 id: 4e2435a5-6670-4b8f-baff-46083cd1c250 type: critical_assets schema: $ref: "#/components/schemas/SecurityMonitoringCriticalAssetsResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_critical_assets_read summary: Get critical assets affecting a specific rule tags: - Security Monitoring /api/v2/security_monitoring/configuration/critical_assets/{critical_asset_id}: delete: description: Delete a specific critical asset. operationId: DeleteSecurityMonitoringCriticalAsset parameters: - $ref: "#/components/parameters/SecurityMonitoringCriticalAssetID" responses: "204": description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_critical_assets_write summary: Delete a critical asset tags: - Security Monitoring get: description: Get the details of a specific critical asset. operationId: GetSecurityMonitoringCriticalAsset parameters: - $ref: "#/components/parameters/SecurityMonitoringCriticalAssetID" responses: "200": content: application/json: examples: default: value: data: attributes: enabled: true query: security:monitoring rule_query: type:log_detection source:cloudtrail severity: increase version: 1 id: 4e2435a5-6670-4b8f-baff-46083cd1c250 type: critical_assets schema: $ref: "#/components/schemas/SecurityMonitoringCriticalAssetResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_critical_assets_read summary: Get a critical asset tags: - Security Monitoring patch: description: Update a specific critical asset. operationId: UpdateSecurityMonitoringCriticalAsset parameters: - $ref: "#/components/parameters/SecurityMonitoringCriticalAssetID" requestBody: content: application/json: examples: default: value: data: attributes: enabled: true query: security:monitoring rule_query: type:log_detection source:cloudtrail severity: increase tags: - technique:T1110-brute-force - source:cloudtrail version: 1 type: critical_assets schema: $ref: "#/components/schemas/SecurityMonitoringCriticalAssetUpdateRequest" description: New definition of the critical asset. Supports partial updates. required: true responses: "200": content: application/json: examples: default: value: data: attributes: enabled: true query: security:monitoring rule_query: type:log_detection source:cloudtrail severity: increase version: 1 id: 4e2435a5-6670-4b8f-baff-46083cd1c250 type: critical_assets schema: $ref: "#/components/schemas/SecurityMonitoringCriticalAssetResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConcurrentModificationResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_critical_assets_write summary: Update a critical asset tags: - Security Monitoring /api/v2/security_monitoring/configuration/integration_config: get: description: |- List the entity context sync configurations for Cloud SIEM. Each configuration connects Cloud SIEM to an external source that provides entities (for example, users from an identity provider) for use in signals and the entity explorer. operationId: ListSecurityMonitoringIntegrationConfigs parameters: - description: Filter the entity context sync configurations by source type. in: query name: filter[integration_type] required: false schema: $ref: "#/components/schemas/SecurityMonitoringIntegrationType" responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2026-05-01T12:00:00Z" domain: siem-test.com enabled: true integration_type: GOOGLE_WORKSPACE modified_at: "2026-05-01T12:00:00Z" name: My GWS Integration settings: setting1: value1 state: valid id: 11111111-2222-3333-4444-555555555555 type: integration_config schema: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigsResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - integrations_read summary: List entity context sync configurations tags: ["Security Monitoring"] x-permission: operator: OR permissions: - integrations_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Create a new entity context sync configuration so Cloud SIEM can ingest entities from an external source. The credentials provided in `secrets` are validated against the source before the configuration is stored and never returned in subsequent responses. operationId: CreateSecurityMonitoringIntegrationConfig requestBody: content: application/json: examples: default: value: data: attributes: domain: siem-test.com integration_type: GOOGLE_WORKSPACE name: My GWS Integration secrets: admin_email: test@example.com settings: setting1: value1 type: integration_config schema: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigCreateRequest" description: The definition of the new integration configuration. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-05-01T12:00:00Z" domain: siem-test.com enabled: true integration_type: GOOGLE_WORKSPACE modified_at: "2026-05-01T12:00:00Z" name: My GWS Integration settings: setting1: value1 id: 11111111-2222-3333-4444-555555555555 type: integration_config schema: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - manage_integrations summary: Create an entity context sync configuration tags: ["Security Monitoring"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/configuration/integration_config/entra_id/azure_app_registrations: get: description: |- Get the Azure App Registrations discovered for the organization and whether at least one of them has resource collection enabled, which is a prerequisite for activating the Entra ID entity context sync integration. operationId: GetEntraIdAzureAppRegistrations responses: "200": content: application/json: examples: default: value: data: attributes: azure_app_registrations: - client_id: 66666666-7777-8888-9999-000000000000 error_count: 0 resource_collection_enabled: true subscription_count: 3 tenant_id: 11111111-2222-3333-4444-555555555555 has_valid_prerequisite: true integration_id: 11111111-2222-3333-4444-555555555555 is_enabled: true subscribed_at: "2026-05-01T12:00:00Z" id: "123456" type: entra_id_azure_app_registrations schema: $ref: "#/components/schemas/SecurityMonitoringEntraIdAzureAppRegistrationsResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - integrations_read summary: Get Entra ID Azure App Registration prerequisites tags: ["Security Monitoring"] x-permission: operator: OR permissions: - integrations_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/configuration/integration_config/validate: post: description: |- Validate a set of credentials against the external entity source before creating a sync configuration. Returns a 200 status code if the credentials are valid. operationId: ValidateSecurityMonitoringIntegrationCredentials requestBody: content: application/json: examples: default: value: data: attributes: domain: siem-test.com integration_type: GOOGLE_WORKSPACE secrets: admin_email: test@example.com type: integration_config schema: $ref: "#/components/schemas/SecurityMonitoringIntegrationCredentialsValidateRequest" description: The credentials to validate. required: true responses: "200": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - integrations_read summary: Validate entity context sync credentials tags: ["Security Monitoring"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - integrations_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/configuration/integration_config/{integration_config_id}: delete: description: |- Delete an entity context sync configuration. Cloud SIEM stops ingesting entities from this source, and the credentials stored for the configuration are removed from the secrets store. operationId: DeleteSecurityMonitoringIntegrationConfig parameters: - $ref: "#/components/parameters/SecurityMonitoringIntegrationConfigID" responses: "204": description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - manage_integrations summary: Delete an entity context sync configuration tags: ["Security Monitoring"] x-permission: operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get the details of a specific entity context sync configuration. operationId: GetSecurityMonitoringIntegrationConfig parameters: - $ref: "#/components/parameters/SecurityMonitoringIntegrationConfigID" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-05-01T12:00:00Z" domain: siem-test.com enabled: true integration_type: GOOGLE_WORKSPACE modified_at: "2026-05-01T12:00:00Z" name: My GWS Integration settings: setting1: value1 state: valid id: 11111111-2222-3333-4444-555555555555 type: integration_config schema: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - integrations_read summary: Get an entity context sync configuration tags: ["Security Monitoring"] x-permission: operator: OR permissions: - integrations_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update an existing entity context sync configuration. Supports partial updates; only the fields provided in the request body are modified. operationId: UpdateSecurityMonitoringIntegrationConfig parameters: - $ref: "#/components/parameters/SecurityMonitoringIntegrationConfigID" requestBody: content: application/json: examples: default: value: data: attributes: enabled: false name: My GWS Integration (renamed) type: integration_config schema: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigUpdateRequest" description: The fields to update on the integration configuration. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-05-01T12:00:00Z" domain: siem-test.com enabled: false integration_type: GOOGLE_WORKSPACE modified_at: "2026-05-08T12:00:00Z" name: My GWS Integration (renamed) settings: setting1: value1 state: valid id: 11111111-2222-3333-4444-555555555555 type: integration_config schema: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - manage_integrations summary: Update an entity context sync configuration tags: ["Security Monitoring"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/configuration/integration_config/{integration_config_id}/validate: post: description: |- Validate the credentials currently stored on an existing entity context sync configuration. Returns a 200 status code if the credentials are still valid against the external entity source. operationId: ValidateSecurityMonitoringIntegrationConfig parameters: - $ref: "#/components/parameters/SecurityMonitoringIntegrationConfigID" responses: "200": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - integrations_read summary: Validate an entity context sync configuration tags: ["Security Monitoring"] x-permission: operator: OR permissions: - integrations_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/configuration/integration_config/{integration_type}/activate: post: description: |- Activate an entity context sync integration for a source type that does not require manually supplied credentials (for example, Entra ID). If an integration of this type already exists, it is returned (re-enabling it first if it was disabled) instead of creating a duplicate. operationId: ActivateIntegration parameters: - description: The integration type to activate (for example, `entra_id`). in: path name: integration_type required: true schema: example: entra_id type: string requestBody: content: application/json: examples: default: value: data: attributes: name: My Entra ID Integration type: activate_entra_id_request schema: $ref: "#/components/schemas/SecurityMonitoringIntegrationActivateRequest" description: Optional configuration overrides for the integration to activate. required: false responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-05-01T12:00:00Z" domain: default enabled: true integration_type: ENTRA_ID modified_at: "2026-05-01T12:00:00Z" name: My Entra ID Integration state: valid id: 11111111-2222-3333-4444-555555555555 type: integration_config schema: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - manage_integrations summary: Activate an entity context sync integration tags: ["Security Monitoring"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/configuration/integration_config/{integration_type}/deactivate: post: description: Deactivate all active entity context sync integrations of the given source type (for example, Entra ID). operationId: DeactivateIntegration parameters: - description: The integration type to deactivate (for example, `entra_id`). in: path name: integration_type required: true schema: example: entra_id type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2026-05-01T12:00:00Z" domain: default enabled: false integration_type: ENTRA_ID modified_at: "2026-05-08T12:00:00Z" name: My Entra ID Integration state: valid id: 11111111-2222-3333-4444-555555555555 type: integration_config schema: $ref: "#/components/schemas/SecurityMonitoringIntegrationConfigResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - manage_integrations summary: Deactivate an entity context sync integration tags: ["Security Monitoring"] x-permission: operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/configuration/notification_rules/send_notification_preview: post: description: Send a notification preview to test that a notification rule's targets are properly configured. operationId: SendSecurityMonitoringNotificationPreview requestBody: content: application/json: examples: default: value: data: attributes: enabled: true name: Rule 1 selectors: query: env:prod rule_types: - log_detection severities: - critical trigger_source: security_signals targets: - "@john.doe@email.com" type: notification_rules schema: $ref: "#/components/schemas/CreateNotificationRuleParameters" required: true responses: "200": content: application/json: examples: default: value: data: attributes: preview_results: - notification_status: DEFAULT rule_type: log_detection id: rka-loa-zwu type: notification_preview_response schema: $ref: "#/components/schemas/NotificationRulePreviewResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_notification_profiles_write summary: Test a notification rule tags: - Security Monitoring x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_notification_profiles_write /api/v2/security_monitoring/configuration/security_filters: get: description: Get the list of configured security filters with their definitions. operationId: ListSecurityFilters responses: "200": content: "application/json": examples: default: value: data: - attributes: exclusion_filters: - name: Exclude staging query: source:staging filtered_data_type: logs is_builtin: false is_enabled: true name: Custom security filter query: service:api version: 1 id: 3dd-0uc-h1s type: security_filters schema: $ref: "#/components/schemas/SecurityFiltersResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_filters_read summary: Get all security filters tags: ["Security Monitoring"] "x-permission": operator: OR permissions: - security_monitoring_filters_read post: description: |- Create a security filter. See the [security filter guide](https://docs.datadoghq.com/security_platform/guide/how-to-setup-security-filters-using-security-monitoring-api/) for more examples. operationId: CreateSecurityFilter requestBody: content: application/json: examples: default: value: data: attributes: exclusion_filters: - name: Exclude staging query: source:staging filtered_data_type: logs is_enabled: true name: Custom security filter query: service:api type: security_filters schema: $ref: "#/components/schemas/SecurityFilterCreateRequest" description: The definition of the new security filter. required: true responses: "200": content: "application/json": examples: default: value: data: attributes: exclusion_filters: - name: Exclude staging query: source:staging filtered_data_type: logs is_builtin: false is_enabled: true name: Custom security filter query: service:api version: 1 id: 3dd-0uc-h1s type: security_filters schema: $ref: "#/components/schemas/SecurityFilterResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_filters_write summary: Create a security filter tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_filters_write /api/v2/security_monitoring/configuration/security_filters/versions: get: description: |- Get the configured security filters at each historical version of the configuration. Each entry in the response represents the set of all security filters at a given version, ordered from the most recent version to the oldest. operationId: ListSecurityFilterVersions responses: "200": content: application/json: examples: default: value: data: - attributes: date: 1758177253469 filters: - exclusion_filters: [] filtered_data_type: logs id: "123" is_builtin: false is_enabled: true name: Test Security Filter query: source:test version: 1 version: 1 id: "1" type: security_filters_configuration schema: $ref: "#/components/schemas/SecurityFilterVersionsResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_filters_read summary: Get the version history of security filters tags: ["Security Monitoring"] x-permission: operator: OR permissions: - security_monitoring_filters_read /api/v2/security_monitoring/configuration/security_filters/{security_filter_id}: delete: description: Delete a specific security filter. operationId: DeleteSecurityFilter parameters: - $ref: "#/components/parameters/SecurityFilterID" responses: "204": description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_filters_write summary: Delete a security filter tags: ["Security Monitoring"] "x-permission": operator: OR permissions: - security_monitoring_filters_write get: description: |- Get the details of a specific security filter. See the [security filter guide](https://docs.datadoghq.com/security_platform/guide/how-to-setup-security-filters-using-security-monitoring-api/) for more examples. operationId: GetSecurityFilter parameters: - $ref: "#/components/parameters/SecurityFilterID" responses: "200": content: application/json: examples: default: value: data: attributes: exclusion_filters: - name: Exclude staging query: source:staging filtered_data_type: logs is_builtin: false is_enabled: true name: Custom security filter query: service:api version: 1 id: 3dd-0uc-h1s type: security_filters schema: $ref: "#/components/schemas/SecurityFilterResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_filters_read summary: Get a security filter tags: ["Security Monitoring"] "x-permission": operator: OR permissions: - security_monitoring_filters_read patch: description: |- Update a specific security filter. Returns the security filter object when the request is successful. operationId: UpdateSecurityFilter parameters: - $ref: "#/components/parameters/SecurityFilterID" requestBody: content: application/json: examples: default: value: data: attributes: exclusion_filters: [] filtered_data_type: logs is_enabled: true name: Custom security filter query: service:api version: 1 type: security_filters schema: $ref: "#/components/schemas/SecurityFilterUpdateRequest" description: New definition of the security filter. required: true responses: "200": content: application/json: examples: default: value: data: attributes: exclusion_filters: - name: Exclude staging query: source:staging filtered_data_type: logs is_builtin: false is_enabled: true name: Custom security filter query: service:api version: 1 id: 3dd-0uc-h1s type: security_filters schema: $ref: "#/components/schemas/SecurityFilterResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConcurrentModificationResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_filters_write summary: Update a security filter tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_filters_write /api/v2/security_monitoring/configuration/suppressions: get: description: Get the list of all suppression rules. operationId: ListSecurityMonitoringSuppressions parameters: - description: Query string. in: query name: query required: false schema: type: string - description: Attribute used to sort the list of suppression rules. Prefix with `-` to sort in descending order. in: query name: sort required: false schema: $ref: "#/components/schemas/SecurityMonitoringSuppressionSort" - description: Size for a given page. Use `-1` to return all items. in: query name: page[size] required: false schema: default: -1 example: 10 format: int64 type: integer - $ref: "#/components/parameters/PageNumber" responses: "200": content: application/json: examples: default: value: data: - attributes: editable: true enabled: true name: Custom suppression rule_query: type:log_detection source:cloudtrail suppression_query: env:staging status:low version: 1 id: 3dd-0uc-h1s type: suppressions meta: page: pageNumber: 0 pageSize: 10 totalCount: 1 schema: $ref: "#/components/schemas/SecurityMonitoringPaginatedSuppressionsResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_suppressions_read summary: Get all suppression rules tags: - Security Monitoring post: description: Create a new suppression rule. operationId: CreateSecurityMonitoringSuppression requestBody: content: application/json: examples: default: value: data: attributes: data_exclusion_query: source:cloudtrail account_id:12345 description: This rule suppresses low-severity signals in staging environments. enabled: true expiration_date: 1703187336000 name: Custom suppression rule_query: type:log_detection source:cloudtrail start_date: 1703187336000 suppression_query: env:staging status:low tags: - technique:T1110-brute-force - source:cloudtrail type: suppressions schema: $ref: "#/components/schemas/SecurityMonitoringSuppressionCreateRequest" description: The definition of the new suppression rule. required: true responses: "200": content: "application/json": examples: default: value: data: attributes: enabled: true name: Custom suppression rule_query: type:log_detection source:cloudtrail suppression_query: env:staging status:low id: abc-123 type: suppressions schema: $ref: "#/components/schemas/SecurityMonitoringSuppressionResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_suppressions_write summary: Create a suppression rule tags: - Security Monitoring x-codegen-request-body-name: body /api/v2/security_monitoring/configuration/suppressions/rules: post: description: Get the list of suppressions that would affect a rule. operationId: GetSuppressionsAffectingFutureRule requestBody: content: "application/json": examples: default: value: calculatedFields: - expression: "@request_end_timestamp - @request_start_timestamp" name: response_time cases: [] filters: - action: require groupSignalsBy: - service hasExtendedTitle: true isEnabled: true message: "" name: My security monitoring rule. options: anomalyDetectionOptions: bucketDuration: 300 detectionTolerance: 5 instantaneousBaseline: false complianceRuleOptions: regoRule: policy: "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}" resourceTypes: - gcp_iam_service_account - gcp_iam_policy resourceType: aws_acm decreaseCriticalityBasedOnEnv: false detectionMethod: threshold hardcodedEvaluatorType: log4shell impossibleTravelOptions: baselineUserLocations: true baselineUserLocationsDuration: 7 newValueOptions: instantaneousBaseline: false learningMethod: duration thirdPartyRuleOptions: defaultStatus: critical rootQueries: - query: source:cloudtrail queries: [] schedulingOptions: rrule: FREQ=HOURLY;INTERVAL=1; start: "2025-07-14T12:00:00" timezone: America/New_York tags: - env:prod - team:security thirdPartyCases: [] type: api_security schema: $ref: "#/components/schemas/SecurityMonitoringRuleCreatePayload" required: true responses: "200": content: application/json: examples: default: value: data: - attributes: enabled: true name: Custom suppression rule_query: type:log_detection source:cloudtrail suppression_query: env:staging status:low id: abc-123 type: suppressions schema: $ref: "#/components/schemas/SecurityMonitoringSuppressionsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_suppressions_read summary: Get suppressions affecting future rule tags: - Security Monitoring /api/v2/security_monitoring/configuration/suppressions/rules/{rule_id}: get: description: Get the list of suppressions that affect a specific existing rule by its ID. operationId: GetSuppressionsAffectingRule parameters: - $ref: "#/components/parameters/SecurityMonitoringRuleID" responses: "200": content: application/json: examples: default: value: data: - attributes: editable: true enabled: true name: Custom suppression rule_query: type:log_detection source:cloudtrail suppression_query: env:staging status:low version: 1 id: 3dd-0uc-h1s type: suppressions schema: $ref: "#/components/schemas/SecurityMonitoringSuppressionsResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_suppressions_read summary: Get suppressions affecting a specific rule tags: - Security Monitoring /api/v2/security_monitoring/configuration/suppressions/validation: post: description: Validate a suppression rule. operationId: ValidateSecurityMonitoringSuppression requestBody: content: "application/json": examples: default: value: data: attributes: data_exclusion_query: source:cloudtrail account_id:12345 description: This rule suppresses low-severity signals in staging environments. enabled: true expiration_date: 1703187336000 name: Custom suppression rule_query: type:log_detection source:cloudtrail start_date: 1703187336000 suppression_query: env:staging status:low tags: - technique:T1110-brute-force - source:cloudtrail type: suppressions schema: $ref: "#/components/schemas/SecurityMonitoringSuppressionCreateRequest" required: true responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_suppressions_write summary: Validate a suppression rule tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_suppressions_write /api/v2/security_monitoring/configuration/suppressions/{suppression_id}: delete: description: Delete a specific suppression rule. operationId: DeleteSecurityMonitoringSuppression parameters: - $ref: "#/components/parameters/SecurityMonitoringSuppressionID" responses: "204": description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_suppressions_write summary: Delete a suppression rule tags: - Security Monitoring get: description: Get the details of a specific suppression rule. operationId: GetSecurityMonitoringSuppression parameters: - $ref: "#/components/parameters/SecurityMonitoringSuppressionID" responses: "200": content: application/json: examples: default: value: data: attributes: editable: true enabled: true name: Custom suppression rule_query: type:log_detection source:cloudtrail suppression_query: env:staging status:low version: 1 id: 3dd-0uc-h1s type: suppressions schema: $ref: "#/components/schemas/SecurityMonitoringSuppressionResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_suppressions_read summary: Get a suppression rule tags: - Security Monitoring patch: description: Update a specific suppression rule. operationId: UpdateSecurityMonitoringSuppression parameters: - $ref: "#/components/parameters/SecurityMonitoringSuppressionID" requestBody: content: application/json: examples: default: value: data: attributes: data_exclusion_query: source:cloudtrail account_id:12345 description: This rule suppresses low-severity signals in staging environments. enabled: true expiration_date: 1703187336000 name: Custom suppression rule_query: type:log_detection source:cloudtrail start_date: 1703187336000 suppression_query: env:staging status:low tags: - technique:T1110-brute-force - source:cloudtrail type: suppressions schema: $ref: "#/components/schemas/SecurityMonitoringSuppressionUpdateRequest" description: New definition of the suppression rule. Supports partial updates. required: true responses: "200": content: application/json: examples: default: value: data: attributes: editable: true enabled: true name: Custom suppression rule_query: type:log_detection source:cloudtrail suppression_query: env:staging status:low version: 1 id: 3dd-0uc-h1s type: suppressions schema: $ref: "#/components/schemas/SecurityMonitoringSuppressionResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConcurrentModificationResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_suppressions_write summary: Update a suppression rule tags: - Security Monitoring /api/v2/security_monitoring/configuration/suppressions/{suppression_id}/version_history: get: description: Get a suppression's version history. operationId: GetSuppressionVersionHistory parameters: - $ref: "#/components/parameters/SecurityMonitoringSuppressionID" - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" responses: "200": content: application/json: examples: default: value: data: attributes: count: 1 data: "1": changes: [] suppression: enabled: true name: Custom suppression rule_query: type:log_detection source:cloudtrail version: 1 id: 3dd-0uc-h1s type: suppression_version_history schema: $ref: "#/components/schemas/GetSuppressionVersionHistoryResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_suppressions_read summary: Get a suppression's version history tags: - Security Monitoring /api/v2/security_monitoring/content_packs/states: get: description: |- Get the activation state, integration status, and log collection status for all Cloud SIEM content packs. operationId: GetContentPacksStates responses: "200": content: application/json: examples: default: value: data: - attributes: details: cp_activation: activated data_last_seen: within_24_hours filters_configured: true integration_installed_status: installed logs_seen_from_any_index: true siem_index_incorrect: false type: logs status: active id: aws-cloudtrail type: content_pack_state meta: cloud_siem_index_incorrect: false sku: add_on_2024 schema: $ref: "#/components/schemas/SecurityMonitoringContentPackStatesResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_filters_read summary: Get content pack states tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_filters_read - logs_read_index_data x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/content_packs/{content_pack_id}/activate: put: description: |- Activate a Cloud SIEM content pack. This operation configures the necessary log filters or security filters depending on the pricing model and updates the content pack activation state. operationId: ActivateContentPack parameters: - description: The ID of the content pack to activate (for example, `aws-cloudtrail`). in: path name: content_pack_id required: true schema: example: aws-cloudtrail type: string responses: "202": description: Accepted "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_filters_write summary: Activate content pack tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_filters_write - logs_modify_indexes x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/content_packs/{content_pack_id}/deactivate: put: description: |- Deactivate a Cloud SIEM content pack. This operation removes the content pack's configuration from log filters or security filters and updates the content pack activation state. operationId: DeactivateContentPack parameters: - description: The ID of the content pack to deactivate (for example, `aws-cloudtrail`). in: path name: content_pack_id required: true schema: example: aws-cloudtrail type: string responses: "202": description: Accepted "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_filters_write summary: Deactivate content pack tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_filters_write - logs_modify_indexes x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/datasets: get: description: |- List all Cloud SIEM datasets available to the organization, including both customer-defined datasets and Datadog out-of-the-box datasets. operationId: ListSecurityMonitoringDatasets parameters: - description: Size for a given page. The maximum allowed value is 100. in: query name: page[size] required: false schema: default: 50 example: 50 format: int64 type: integer - description: Specific page number to return. in: query name: page[number] required: false schema: default: 1 example: 1 format: int64 type: integer - description: Attribute used to sort datasets. Prefix with `-` to sort in descending order. in: query name: sort required: false schema: example: name type: string - description: A search query to filter datasets by name or description. in: query name: filter[query] required: false schema: example: sample_dataset type: string responses: "200": content: application/json: examples: default: value: data: - attributes: createdAt: "2025-03-20T10:00:00Z" createdByHandle: bruce.lee createdByName: Bruce Lee definition: columns: - column: message type: string data_source: logs indexes: - main name: sample_dataset search: query: "*" description: A sample dataset used for detection rules. id: 123e4567-e89b-12d3-a456-426614174000 isDefault: false isDeprecated: false modifiedAt: "2025-03-20T10:00:00Z" name: sample_dataset updatedByHandle: updatedByName: version: 1 id: 123e4567-e89b-12d3-a456-426614174000 type: dataset meta: totalCount: 1 schema: $ref: "#/components/schemas/SecurityMonitoringDatasetsListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read summary: List datasets tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_rules_read - security_monitoring_dataset_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Create a new Cloud SIEM dataset. A dataset bundles a data source, a set of indexes, and a search query that can be referenced from detection rules. operationId: CreateSecurityMonitoringDataset requestBody: content: application/json: examples: default: value: data: attributes: definition: columns: - column: message type: string data_source: logs indexes: - main name: sample_dataset search: query: "*" description: A sample dataset used for detection rules. type: datasetCreate schema: $ref: "#/components/schemas/SecurityMonitoringDatasetCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: id: 123e4567-e89b-12d3-a456-426614174000 type: dataset schema: $ref: "#/components/schemas/SecurityMonitoringDatasetCreateResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Create a dataset tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_rules_write - security_monitoring_dataset_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/datasets/dependencies: post: description: |- Return, for each of the requested datasets, the list of detection rules that depend on it. Useful for understanding the impact of updating or deleting a dataset. operationId: BatchGetSecurityMonitoringDatasetDependencies requestBody: content: application/json: examples: default: value: data: attributes: datasetIds: - 123e4567-e89b-12d3-a456-426614174000 schema: $ref: "#/components/schemas/SecurityMonitoringDatasetDependenciesRequest" required: true responses: "200": content: application/json: examples: default: value: data: - attributes: count: 0 datasetId: 123e4567-e89b-12d3-a456-426614174000 ids: [] resource_type: security_detection_rule id: 123e4567-e89b-12d3-a456-426614174000 type: datasetDependents schema: $ref: "#/components/schemas/SecurityMonitoringDatasetDependenciesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read summary: Get dataset dependencies tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_rules_read - security_monitoring_dataset_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/datasets/{dataset_id}: delete: description: |- Delete a Cloud SIEM dataset. Out-of-the-box datasets cannot be deleted and deleting a dataset that is referenced by a detection rule is rejected. operationId: DeleteSecurityMonitoringDataset parameters: - $ref: "#/components/parameters/SecurityMonitoringDatasetID" responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Delete a dataset tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_rules_write - security_monitoring_dataset_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get the current version of a Cloud SIEM dataset by ID. operationId: GetSecurityMonitoringDataset parameters: - $ref: "#/components/parameters/SecurityMonitoringDatasetID" responses: "200": content: application/json: examples: default: value: data: attributes: createdAt: "2025-03-20T10:00:00Z" createdByHandle: bruce.lee createdByName: Bruce Lee definition: columns: - column: message type: string data_source: logs indexes: - main name: sample_dataset search: query: "*" description: A sample dataset used for detection rules. id: 123e4567-e89b-12d3-a456-426614174000 isDefault: false isDeprecated: false modifiedAt: "2025-03-20T10:00:00Z" name: sample_dataset updatedByHandle: updatedByName: version: 1 id: 123e4567-e89b-12d3-a456-426614174000 type: dataset schema: $ref: "#/components/schemas/SecurityMonitoringDatasetResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read summary: Get a dataset tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_rules_read - security_monitoring_dataset_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: |- Update an existing Cloud SIEM dataset. The current version of the dataset can be provided to detect concurrent modifications. operationId: UpdateSecurityMonitoringDataset parameters: - $ref: "#/components/parameters/SecurityMonitoringDatasetID" requestBody: content: application/json: examples: default: value: data: attributes: definition: columns: - column: message type: string data_source: logs indexes: - main name: sample_dataset search: query: "*" description: An updated description for the dataset. version: 1 type: datasetUpdate schema: $ref: "#/components/schemas/SecurityMonitoringDatasetUpdateRequest" required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Update a dataset tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_rules_write - security_monitoring_dataset_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/datasets/{dataset_id}/version/{version}: get: description: Retrieve a specific historical version of a Cloud SIEM dataset. operationId: GetSecurityMonitoringDatasetByVersion parameters: - $ref: "#/components/parameters/SecurityMonitoringDatasetID" - description: The version number of the dataset to retrieve. in: path name: version required: true schema: example: 1 format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: createdAt: "2025-03-20T10:00:00Z" createdByHandle: bruce.lee createdByName: Bruce Lee definition: columns: - column: message type: string data_source: logs indexes: - main name: sample_dataset search: query: "*" description: A sample dataset used for detection rules. id: 123e4567-e89b-12d3-a456-426614174000 isDefault: false isDeprecated: false modifiedAt: "2025-03-20T10:00:00Z" name: sample_dataset updatedByHandle: updatedByName: version: 1 id: 123e4567-e89b-12d3-a456-426614174000 type: dataset schema: $ref: "#/components/schemas/SecurityMonitoringDatasetResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read summary: Get a dataset at a specific version tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_rules_read - security_monitoring_dataset_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/datasets/{dataset_id}/version_history: get: description: Retrieve the version history of a Cloud SIEM dataset, including the changes made at each version. operationId: GetSecurityMonitoringDatasetVersionHistory parameters: - $ref: "#/components/parameters/SecurityMonitoringDatasetID" - description: Size for a given page. The maximum allowed value is 100. in: query name: page[size] required: false schema: default: 10 example: 10 format: int64 type: integer - description: Specific page number to return. in: query name: page[number] required: false schema: default: 0 example: 0 format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: count: 1 data: "1": changes: [] dataset: createdAt: "2025-03-20T10:00:00Z" createdByHandle: bruce.lee createdByName: Bruce Lee definition: columns: - column: message type: string data_source: logs indexes: - main name: sample_dataset search: query: "*" description: A sample dataset used for detection rules. id: 123e4567-e89b-12d3-a456-426614174000 isDefault: false isDeprecated: false modifiedAt: "2025-03-20T10:00:00Z" name: sample_dataset updatedByHandle: updatedByName: version: 1 id: 123e4567-e89b-12d3-a456-426614174000 type: dataset_version_history schema: $ref: "#/components/schemas/SecurityMonitoringDatasetVersionHistoryResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read summary: Get the version history of a dataset tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_rules_read - security_monitoring_dataset_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/entity_context: get: description: |- Search the Cloud SIEM entity context store for entities that match a query, and return the historical revisions of each entity in the requested time range. The endpoint can either return revisions across an interval (`from` / `to`) or the snapshot of each entity at a single point in time (`as_of`); the two modes are mutually exclusive. operationId: GetEntityContext parameters: - description: A free-text query (for example, an email address or principal ID) used to filter the entities returned. example: user@example.com in: query name: query required: false schema: type: string - description: |- The type of entity to retrieve. Only `siem_entity_identity` is currently supported. Defaults to `siem_entity_identity`. example: siem_entity_identity in: query name: entity_type required: false schema: $ref: "#/components/schemas/EntityContextEntityType" - description: |- The start of the time range to query, as an RFC3339 timestamp or a relative time (for example, `now-7d`). Defaults to `now-7d`. Ignored when `as_of` is set. in: query name: from required: false schema: default: now-7d example: now-7d type: string - description: |- The end of the time range to query, as an RFC3339 timestamp or a relative time (for example, `now`). Defaults to `now`. Ignored when `as_of` is set. in: query name: to required: false schema: default: now example: now type: string - description: |- A point in time at which to query the entity revisions, as an RFC3339 timestamp, a Unix timestamp (in seconds), or a relative time (for example, `now-1d`). When set, `from` and `to` are ignored. Cannot be combined with custom `from` / `to` values. example: now-1d in: query name: as_of required: false schema: type: string - description: The maximum number of entities to return. in: query name: limit required: false schema: default: 250 example: 100 format: int64 type: integer - description: An opaque token used to fetch the next page of results, as returned in `meta.page.next_token` of a previous response. in: query name: page_token required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: revisions: - attributes: accounts: - linked-account-123 display_name: Test User email: user@example.com principal_id: user@example.com first_seen_at: "2026-04-01T00:00:00Z" last_seen_at: "2026-05-01T00:00:00Z" id: user@example.com type: siem_entity_identity meta: page: next_token: "" total_count: 1 schema: $ref: "#/components/schemas/EntityContextResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - siem_entities_read summary: Get entity context tags: ["Security Monitoring"] x-permission: operator: OR permissions: - siem_entities_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/entity_context/recently_updated: get: description: |- Get the entities with the most recent updates in the Cloud SIEM entity context store. Entities are ranked by the time of their most recent revision in the requested time range, and the top `limit` entities are returned in that order. This endpoint is not paginated. operationId: GetEntityContextRecentlyUpdated parameters: - description: A free-text query (for example, an email address or principal ID) used to filter the entities returned. example: user@example.com in: query name: query required: false schema: type: string - description: |- The type of entity to retrieve. Only `siem_entity_identity` is currently supported. Defaults to `siem_entity_identity`. example: siem_entity_identity in: query name: entity_type required: false schema: $ref: "#/components/schemas/EntityContextEntityType" - description: |- The start of the time range to query, as an RFC3339 timestamp or a relative time (for example, `now-7d`). Defaults to `now-7d`. in: query name: from required: false schema: default: now-7d example: now-7d type: string - description: |- The end of the time range to query, as an RFC3339 timestamp or a relative time (for example, `now`). Defaults to `now`. Entities are ranked by their most recent revision within `[from, to]`. in: query name: to required: false schema: default: now example: now type: string - description: The number of entities to return. Must be between 1 and 100. example: 50 in: query name: limit required: false schema: default: 50 format: int64 maximum: 100 minimum: 1 type: integer - description: |- Which revisions to return for each entity: `latest` returns only the latest revision of each entity as of `to`, and `all` returns every revision in the requested time range. example: latest in: query name: revisions required: false schema: $ref: "#/components/schemas/EntityContextRevisionsMode" responses: "200": content: application/json: examples: default: value: data: - attributes: revisions: - attributes: accounts: - linked-account-123 display_name: Test User email: user@example.com principal_id: user@example.com first_seen_at: "2026-04-01T00:00:00Z" last_seen_at: "2026-05-01T00:00:00Z" id: user@example.com type: siem_entity_identity schema: $ref: "#/components/schemas/RecentlyUpdatedEntitiesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - siem_entities_read summary: Get recently updated entity context tags: ["Security Monitoring"] x-permission: operator: OR permissions: - siem_entities_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/entity_context/{id}: get: description: |- Get a single entity from the Cloud SIEM entity context store by its identifier, returning the historical revisions of the entity in the requested time range. The endpoint can either return revisions across an interval (`from` / `to`) or the snapshot of the entity at a single point in time (`as_of`); the two modes are mutually exclusive. operationId: GetSingleEntityContext parameters: - description: The unique identifier of the entity to retrieve. in: path name: id required: true schema: example: user@example.com type: string - description: |- The type of entity to retrieve. Only `siem_entity_identity` is currently supported. Defaults to `siem_entity_identity`. example: siem_entity_identity in: query name: entity_type required: false schema: $ref: "#/components/schemas/EntityContextEntityType" - description: |- The start of the time range to query, as an RFC3339 timestamp or a relative time (for example, `now-7d`). Defaults to `now-7d`. Ignored when `as_of` is set. in: query name: from required: false schema: default: now-7d example: now-7d type: string - description: |- The end of the time range to query, as an RFC3339 timestamp or a relative time (for example, `now`). Defaults to `now`. Ignored when `as_of` is set. in: query name: to required: false schema: default: now example: now type: string - description: |- A point in time at which to query the entity revisions, as an RFC3339 timestamp, a Unix timestamp (in seconds), or a relative time (for example, `now-1d`). When set, `from` and `to` are ignored. Cannot be combined with custom `from` / `to` values. example: now-1d in: query name: as_of required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: revisions: - attributes: accounts: - linked-account-123 display_name: Test User email: user@example.com principal_id: user@example.com first_seen_at: "2026-04-01T00:00:00Z" last_seen_at: "2026-05-01T00:00:00Z" id: user@example.com type: siem_entity_identity schema: $ref: "#/components/schemas/SingleEntityContextResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - siem_entities_read summary: Get a single entity context tags: ["Security Monitoring"] x-permission: operator: OR permissions: - siem_entities_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/events/{event_id}/matching_signals: get: description: Returns the list of security signals that match a given event on the given track. operationId: GetMatchingSignals parameters: - description: The ID of the event to find matching signals for. in: path name: event_id required: true schema: type: string - description: The product track that the event belongs to. in: query name: track required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: event_tracker_id: AAAAAWgOAX0mtsWfeQAAAABzX1RyYWNrZXJfMTIzNDU2Nzg5MA severity: high title: Unusual login activity detected trigger_time_ms: 1707393746000 id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: matching_signal schema: $ref: "#/components/schemas/MatchingSignalsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_signals_read summary: Get signals matching an event tags: ["Security Monitoring"] x-permission: operator: OR permissions: - security_monitoring_signals_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/rules: get: description: List rules. operationId: ListSecurityMonitoringRules parameters: - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - description: A search query to filter security rules. You can filter by attributes such as `type`, `source`, `tags`. example: "type:signal_correlation source:cloudtrail" in: query name: query required: false schema: type: string - description: Attribute used to sort rules. Prefix with `-` to sort in descending order. in: query name: sort required: false schema: $ref: "#/components/schemas/SecurityMonitoringRuleSort" responses: "200": content: "application/json": examples: default: value: data: - id: abc-123 isEnabled: true name: My security monitoring rule. type: log_detection meta: {} schema: $ref: "#/components/schemas/SecurityMonitoringListRulesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read summary: List rules tags: ["Security Monitoring"] "x-permission": operator: OR permissions: - security_monitoring_rules_read post: description: Create a detection rule. operationId: CreateSecurityMonitoringRule requestBody: content: "application/json": examples: default: value: cases: - condition: "a > 0" name: "" notifications: [] status: info filters: [] hasExtendedTitle: true isEnabled: true message: Test rule name: My security monitoring rule. options: evaluationWindow: 900 keepAlive: 3600 maxSignalDuration: 86400 queries: - aggregation: count distinctFields: [] groupByFields: [] metric: "" query: "@test:true" referenceTables: - checkPresence: true columnName: value logFieldPath: testtag ruleQueryName: a tableName: synthetics_test_reference_table_dont_delete tags: [] type: log_detection schema: $ref: "#/components/schemas/SecurityMonitoringRuleCreatePayload" required: true responses: "200": content: "application/json": examples: default: value: cases: - condition: "a > 0" name: "" notifications: [] status: info id: abc-123 isEnabled: true message: Test rule name: My security monitoring rule. tags: [] type: log_detection schema: $ref: "#/components/schemas/SecurityMonitoringRuleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Create a detection rule tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_rules_write /api/v2/security_monitoring/rules/bulk_delete: delete: description: |- Delete multiple security monitoring rules in a single request. Default rules cannot be deleted. operationId: BulkDeleteSecurityMonitoringRules requestBody: content: application/json: examples: default: value: data: attributes: ruleIds: - abc-000-u7q - abc-000-7dd id: bulk_delete type: bulk_delete_rules schema: $ref: "#/components/schemas/SecurityMonitoringRuleBulkDeletePayload" required: true responses: "200": content: "application/json": examples: default: value: data: attributes: deletedRules: - abc-000-u7q - abc-000-7dd failedRules: [] id: bulk_delete_response type: bulk_delete_response schema: $ref: "#/components/schemas/SecurityMonitoringRuleBulkDeleteResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Bulk delete security monitoring rules tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_rules_write /api/v2/security_monitoring/rules/bulk_export: post: description: |- Export a list of security monitoring rules as a ZIP file containing JSON rule definitions. The endpoint accepts a list of rule IDs and returns a ZIP archive where each rule is saved as a separate JSON file named after the rule. operationId: BulkExportSecurityMonitoringRules requestBody: content: "application/json": examples: default: value: data: attributes: ruleIds: - def-000-u7q - def-000-7dd id: bulk_export type: security_monitoring_rules_bulk_export schema: $ref: "#/components/schemas/SecurityMonitoringRuleBulkExportPayload" required: true responses: "200": content: application/zip: examples: default: value: "" schema: format: binary type: string description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read summary: Bulk export security monitoring rules tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_rules_read /api/v2/security_monitoring/rules/convert: post: description: |- Convert a rule that doesn't (yet) exist from JSON to Terraform for Datadog provider resource `datadog_security_monitoring_rule`. You can do so for the following rule types: - App and API Protection - Cloud SIEM (log detection and signal correlation) - Workload Protection You can convert Cloud Security configuration rules using Terraform's [Datadog Cloud Configuration Rule resource](https://registry.terraform.io/providers/DataDog/datadog/latest/docs/resources/cloud_configuration_rule). operationId: ConvertSecurityMonitoringRuleFromJSONToTerraform requestBody: content: "application/json": examples: default: value: calculatedFields: - expression: "@request_end_timestamp - @request_start_timestamp" name: response_time cases: - condition: a > 0 name: "" notifications: [] status: info filters: [] groupSignalsBy: - service hasExtendedTitle: true isEnabled: true message: My security monitoring rule. name: My security monitoring rule. options: anomalyDetectionOptions: bucketDuration: 300 detectionTolerance: 5 instantaneousBaseline: false complianceRuleOptions: regoRule: policy: "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}" resourceTypes: - gcp_iam_service_account - gcp_iam_policy resourceType: aws_acm decreaseCriticalityBasedOnEnv: false detectionMethod: threshold evaluationWindow: 900 hardcodedEvaluatorType: log4shell impossibleTravelOptions: baselineUserLocations: true baselineUserLocationsDuration: 7 keepAlive: 3600 maxSignalDuration: 86400 newValueOptions: instantaneousBaseline: false learningMethod: duration thirdPartyRuleOptions: defaultStatus: critical rootQueries: - query: source:cloudtrail queries: - aggregation: count distinctFields: [] groupByFields: [] query: source:cloudtrail schedulingOptions: rrule: FREQ=HOURLY;INTERVAL=1; start: "2025-07-14T12:00:00" timezone: America/New_York tags: - env:prod - team:security thirdPartyCases: [] type: log_detection schema: $ref: "#/components/schemas/SecurityMonitoringRuleConvertPayload" required: true responses: "200": content: "application/json": examples: default: value: ruleId: abc-123 terraformContent: 'resource "datadog_security_monitoring_rule" "example" {}' schema: $ref: "#/components/schemas/SecurityMonitoringRuleConvertResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/ConcurrentModificationResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Convert a rule from JSON to Terraform tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_rules_write /api/v2/security_monitoring/rules/convert/bulk: post: description: |- Convert a list of existing security monitoring rules to Terraform for the Datadog provider resource `datadog_security_monitoring_rule`. Returns a ZIP archive containing one Terraform file per rule. You can convert rules for the following types: - App and API Protection - Cloud SIEM (log detection and signal correlation) - Workload Protection operationId: BulkConvertExistingSecurityMonitoringRules requestBody: content: "application/json": examples: default: value: data: attributes: ruleIds: - def-000-u7q - def-000-7dd id: convert_bulk type: security_monitoring_rules_convert_bulk schema: $ref: "#/components/schemas/SecurityMonitoringRuleConvertBulkPayload" required: true responses: "200": content: application/zip: examples: default: value: "" schema: format: binary type: string description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read summary: Bulk convert rules to Terraform tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_rules_read /api/v2/security_monitoring/rules/proposals: post: description: |- Start generating a proposed Cloud SIEM detection rule from a natural-language description, or from an SPL or KQL rule. The proposal is based on your organization's log sources, log fields, and existing detection rules. When logs from the matching source are available, the proposed query is tested against your recent logs. The proposed rule is generated asynchronously. This endpoint returns a proposal `id` with the status `pending`. To get the proposed rule, pass this `id` to the get-a-rule-proposal endpoint and poll the endpoint until the status is `completed` or `failed`. A proposal usually takes a few minutes, and up to 10 minutes. This endpoint does not create or modify any detection rules in Cloud SIEM. To translate many rules at once, use batch migrations instead. operationId: StartSecurityMonitoringRuleProposal requestBody: content: application/json: schema: $ref: "#/components/schemas/SecurityMonitoringRuleProposalStartRequest" required: true responses: "202": content: application/json: examples: default: value: data: attributes: status: pending id: c968cf83-56c2-4d54-a993-6c86dfb83527 type: rule_proposals schema: $ref: "#/components/schemas/SecurityMonitoringRuleProposalStartResponse" description: Accepted "400": $ref: "#/components/responses/SecurityMonitoringRuleProposalBadRequestResponse" "401": $ref: "#/components/responses/SecurityMonitoringRuleProposalUnauthorizedResponse" "403": $ref: "#/components/responses/SecurityMonitoringRuleProposalForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Start a rule proposal tags: - Security Monitoring x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_rules_write x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. /api/v2/security_monitoring/rules/proposals/{proposal_id}: get: description: |- Get the status of a rule proposal started with the start-a-rule-proposal endpoint. While the status is `pending` or `in_progress`, the proposed rule is still being generated. Poll this endpoint again later. If the status is `completed`, the response's `rule` field contains the proposed Cloud SIEM detection rule. If the status is `failed`, the response's `error` field contains the reason a rule could not be generated. This endpoint does not create or modify any detection rules in Cloud SIEM. To create the proposed rule, use the create-a-detection-rule endpoint. operationId: GetSecurityMonitoringRuleProposal parameters: - $ref: "#/components/parameters/SecurityMonitoringRuleProposalID" responses: "200": content: application/json: examples: default: value: data: attributes: rule: cases: - condition: failed_login > 5 && successful_login > 0 name: Successful login after repeated failures status: medium isEnabled: false message: Repeated failed Okta logins were followed by a successful login from the same IP. name: Successful Okta login after repeated failures options: detectionMethod: threshold evaluationWindow: 900 keepAlive: 3600 maxSignalDuration: 86400 queries: - aggregation: count groupByFields: - "@network.client.ip" name: failed_login query: source:okta @evt.name:user.session.start @evt.outcome:FAILURE - aggregation: count groupByFields: - "@network.client.ip" name: successful_login query: source:okta @evt.name:user.session.start @evt.outcome:SUCCESS tags: - source:okta type: log_detection status: completed id: c968cf83-56c2-4d54-a993-6c86dfb83527 type: rule_proposals failed: value: data: attributes: error: kind: translation_error message: No log source matches the described activity. type: NoRuleProduced status: failed id: c968cf83-56c2-4d54-a993-6c86dfb83527 type: rule_proposals schema: $ref: "#/components/schemas/SecurityMonitoringRuleProposalResponse" description: OK "400": $ref: "#/components/responses/SecurityMonitoringRuleProposalBadRequestResponse" "401": $ref: "#/components/responses/SecurityMonitoringRuleProposalUnauthorizedResponse" "403": $ref: "#/components/responses/SecurityMonitoringRuleProposalForbiddenResponse" "404": $ref: "#/components/responses/SecurityMonitoringRuleProposalNotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read summary: Get a rule proposal tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_rules_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. /api/v2/security_monitoring/rules/test: post: description: |- Test a rule. operationId: TestSecurityMonitoringRule requestBody: content: "application/json": examples: default: value: rule: calculatedFields: - expression: "@request_end_timestamp - @request_start_timestamp" name: response_time cases: - condition: a > 0 name: "" notifications: [] status: info filters: - action: require groupSignalsBy: - service hasExtendedTitle: true isEnabled: true message: My security monitoring rule message. name: My security monitoring rule. options: anomalyDetectionOptions: bucketDuration: 300 detectionTolerance: 5 instantaneousBaseline: false complianceRuleOptions: resourceType: aws_acm decreaseCriticalityBasedOnEnv: false detectionMethod: threshold evaluationWindow: 0 hardcodedEvaluatorType: log4shell impossibleTravelOptions: baselineUserLocations: true baselineUserLocationsDuration: 7 keepAlive: 0 maxSignalDuration: 0 newValueOptions: instantaneousBaseline: false learningMethod: duration thirdPartyRuleOptions: defaultStatus: critical queries: - aggregation: count distinctFields: [] groupByFields: - "@userIdentity.assumed_role" name: "" query: source:cloudtrail schedulingOptions: rrule: FREQ=HOURLY;INTERVAL=1; start: "2025-07-14T12:00:00" timezone: America/New_York tags: - env:prod - team:security thirdPartyCases: [] type: log_detection ruleQueryPayloads: - expectedResult: true index: 0 payload: ddsource: nginx ddtags: env:staging,version:5.1 hostname: i-012345678 message: 2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World service: payment schema: $ref: "#/components/schemas/SecurityMonitoringRuleTestRequest" required: true responses: "200": content: "application/json": examples: default: value: results: - true schema: $ref: "#/components/schemas/SecurityMonitoringRuleTestResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/ConcurrentModificationResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Test a rule tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_rules_write /api/v2/security_monitoring/rules/validation: post: description: Validate a detection rule. operationId: ValidateSecurityMonitoringRule requestBody: content: "application/json": examples: default: value: calculatedFields: - expression: "@request_end_timestamp - @request_start_timestamp" name: response_time cases: - condition: a > 0 name: "" notifications: [] status: info filters: - action: require groupSignalsBy: - service hasExtendedTitle: true isEnabled: true message: My security monitoring rule name: My security monitoring rule. options: anomalyDetectionOptions: bucketDuration: 300 detectionTolerance: 5 instantaneousBaseline: false complianceRuleOptions: regoRule: policy: "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}" resourceTypes: - gcp_iam_service_account - gcp_iam_policy resourceType: aws_acm decreaseCriticalityBasedOnEnv: false detectionMethod: threshold evaluationWindow: 1800 hardcodedEvaluatorType: log4shell impossibleTravelOptions: baselineUserLocations: true baselineUserLocationsDuration: 7 keepAlive: 1800 maxSignalDuration: 1800 newValueOptions: instantaneousBaseline: false learningMethod: duration thirdPartyRuleOptions: defaultStatus: critical rootQueries: - query: source:cloudtrail queries: - aggregation: count distinctFields: [] groupByFields: - "@userIdentity.assumed_role" name: "" query: source:cloudtrail schedulingOptions: rrule: FREQ=HOURLY;INTERVAL=1; start: "2025-07-14T12:00:00" timezone: America/New_York tags: - env:prod - team:security thirdPartyCases: [] type: log_detection schema: $ref: "#/components/schemas/SecurityMonitoringRuleValidatePayload" required: true responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Validate a detection rule tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_rules_write /api/v2/security_monitoring/rules/{rule_id}: delete: description: |- Delete an existing rule. Default rules cannot be deleted. operationId: DeleteSecurityMonitoringRule parameters: - $ref: "#/components/parameters/SecurityMonitoringRuleID" responses: "204": description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Delete an existing rule tags: ["Security Monitoring"] "x-permission": operator: OR permissions: - security_monitoring_rules_write get: description: Get a rule's details. operationId: GetSecurityMonitoringRule parameters: - $ref: "#/components/parameters/SecurityMonitoringRuleID" responses: "200": content: "application/json": examples: default: value: cases: - condition: "a > 0" name: "" notifications: [] status: info id: abc-123 isEnabled: true message: Test rule name: My security monitoring rule. tags: [] type: log_detection schema: $ref: "#/components/schemas/SecurityMonitoringRuleResponse" description: OK "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read summary: Get a rule's details tags: ["Security Monitoring"] "x-permission": operator: OR permissions: - security_monitoring_rules_read put: description: |- Update an existing rule. When updating `cases`, `queries` or `options`, the whole field must be included. For example, when modifying a query all queries must be included. Default rules can only be updated to be enabled, to change notifications, or to update the tags (default tags cannot be removed). operationId: UpdateSecurityMonitoringRule parameters: - $ref: "#/components/parameters/SecurityMonitoringRuleID" requestBody: content: "application/json": examples: default: value: cases: - condition: "a > 0" name: "" notifications: [] status: info filters: [] isEnabled: true message: Test rule name: My security monitoring rule. options: evaluationWindow: 900 keepAlive: 3600 maxSignalDuration: 86400 queries: - aggregation: count distinctFields: [] groupByFields: [] metrics: [] query: "@test:true" tags: [] schema: $ref: "#/components/schemas/SecurityMonitoringRuleUpdatePayload" required: true responses: "200": content: "application/json": examples: default: value: cases: - condition: "a > 0" name: "" notifications: [] status: info id: abc-123 isEnabled: true message: Test rule name: My security monitoring rule. tags: [] type: log_detection schema: $ref: "#/components/schemas/SecurityMonitoringRuleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/ConcurrentModificationResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Update an existing rule tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_rules_write /api/v2/security_monitoring/rules/{rule_id}/convert: get: description: |- Convert an existing rule from JSON to Terraform for Datadog provider resource `datadog_security_monitoring_rule`. You can do so for the following rule types: - App and API Protection - Cloud SIEM (log detection and signal correlation) - Workload Protection You can convert Cloud Security configuration rules using Terraform's [Datadog Cloud Configuration Rule resource](https://registry.terraform.io/providers/DataDog/datadog/latest/docs/resources/cloud_configuration_rule). operationId: ConvertExistingSecurityMonitoringRule parameters: - $ref: "#/components/parameters/SecurityMonitoringRuleID" responses: "200": content: "application/json": examples: default: value: ruleId: abc-123 terraformContent: 'resource "datadog_security_monitoring_rule" "example" {}' schema: $ref: "#/components/schemas/SecurityMonitoringRuleConvertResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read summary: Convert an existing rule from JSON to Terraform tags: ["Security Monitoring"] "x-permission": operator: OR permissions: - security_monitoring_rules_read /api/v2/security_monitoring/rules/{rule_id}/restore/{version}: post: description: |- Restores a custom detection rule to a previously saved historical version. Only custom rules can be restored. Default and partner rules return 400. The restore creates a new version entry; it does not overwrite history. operationId: RestoreSecurityMonitoringRule parameters: - $ref: "#/components/parameters/SecurityMonitoringRuleID" - $ref: "#/components/parameters/SecurityMonitoringRuleVersion" responses: "200": content: "application/json": examples: default: value: cases: - condition: "a > 0" name: "" notifications: [] status: info id: abc-123 isEnabled: true message: Test rule name: My security monitoring rule. tags: [] type: log_detection schema: $ref: "#/components/schemas/SecurityMonitoringRuleResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Restore a rule to a historical version tags: ["Security Monitoring"] "x-permission": operator: OR permissions: - security_monitoring_rules_write /api/v2/security_monitoring/rules/{rule_id}/test: post: description: |- Test an existing rule. operationId: TestExistingSecurityMonitoringRule parameters: - $ref: "#/components/parameters/SecurityMonitoringRuleID" requestBody: content: "application/json": examples: default: value: rule: cases: - condition: "a > 0" name: "" notifications: [] status: info hasExtendedTitle: true isEnabled: true message: My security monitoring rule message. name: My security monitoring rule. options: decreaseCriticalityBasedOnEnv: false detectionMethod: threshold evaluationWindow: 0 keepAlive: 0 maxSignalDuration: 0 queries: - aggregation: count distinctFields: [] groupByFields: - "@userIdentity.assumed_role" name: "" query: "source:source_here" tags: - "env:prod" - "team:security" type: log_detection ruleQueryPayloads: - expectedResult: true index: 0 payload: ddsource: source_here ddtags: "env:staging,version:5.1" hostname: i-012345678 message: "2019-11-19T14:37:58,995 INFO [process.name][20081] Hello World" service: payment userIdentity: assumed_role: fake assumed_role schema: $ref: "#/components/schemas/SecurityMonitoringRuleTestRequest" required: true responses: "200": content: "application/json": examples: default: value: results: - true schema: $ref: "#/components/schemas/SecurityMonitoringRuleTestResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/ConcurrentModificationResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Test an existing rule tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_rules_write /api/v2/security_monitoring/rules/{rule_id}/version_history: get: description: Get a rule's version history. operationId: GetRuleVersionHistory parameters: - $ref: "#/components/parameters/SecurityMonitoringRuleID" - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" responses: "200": content: "application/json": examples: default: value: data: attributes: count: 1 data: {} id: abc-123 type: GetRuleVersionHistoryResponse schema: $ref: "#/components/schemas/GetRuleVersionHistoryResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a rule's version history tags: ["Security Monitoring"] "x-permission": operator: OR permissions: - security_monitoring_rules_read /api/v2/security_monitoring/sample_log_generation/subscriptions: get: description: |- Get the sample log generation subscriptions for the organization. Sample log generation injects representative example logs for a given Cloud SIEM content pack into the Logs platform, which can be used to test detection rules without onboarding the underlying integration first. **Availability**: this endpoint is restricted to Cloud SIEM trial organizations on an eligible pricing model. Other organizations receive a `403 Forbidden` (non-trial orgs) or a `400 Bad Request` (feature disabled), and legacy pricing tiers receive a response with `status: not_available`. operationId: ListSampleLogGenerationSubscriptions parameters: - description: |- Filter the subscriptions by status. Use `active` to return only currently active subscriptions, or `all` to return every subscription including expired ones. Ignored when `start_timestamp` is provided. Defaults to `active`. in: query name: status required: false schema: $ref: "#/components/schemas/SampleLogGenerationSubscriptionsStatusFilter" - description: |- The start of the time range, as an RFC3339 timestamp. When provided, the response includes every subscription that was active at any point in `[start_timestamp, end_timestamp]`, and the `status` filter is ignored. example: "2026-05-01T00:00:00Z" in: query name: start_timestamp required: false schema: format: date-time type: string - description: |- The end of the time range, as an RFC3339 timestamp. Ignored unless `start_timestamp` is set. Defaults to the current time when `start_timestamp` is provided. example: "2026-05-08T00:00:00Z" in: query name: end_timestamp required: false schema: format: date-time type: string responses: "200": content: application/json: examples: default: value: data: - attributes: content_pack_id: aws-cloudtrail created_at: "2026-05-08T20:02:13.77481Z" expires_at: "2026-05-11T20:02:13.77481Z" is_active: true status: subscribed id: "999" type: subscriptions meta: total_subscriptions: 1 schema: $ref: "#/components/schemas/SampleLogGenerationSubscriptionsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_filters_read - logs_read_index_data summary: Get sample log generation subscriptions tags: ["Security Monitoring"] x-permission: operator: OR permissions: - security_monitoring_filters_read - logs_read_index_data x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Subscribe to sample log generation for a Cloud SIEM content pack. Sample logs for the requested content pack are injected into the Logs platform for the duration of the subscription, so detection rules can be exercised without onboarding the underlying integration first. **Availability**: this endpoint is restricted to Cloud SIEM trial organizations on an eligible pricing model. Non-trial orgs receive `403 Forbidden`, the feature flag may also reject requests with `400 Bad Request`, and legacy pricing tiers receive a response with `status: not_available`. operationId: CreateSampleLogGenerationSubscription requestBody: content: application/json: examples: default: value: data: attributes: content_pack_id: aws-cloudtrail duration: 3d type: subscription_requests schema: $ref: "#/components/schemas/SampleLogGenerationSubscriptionCreateRequest" description: The content pack to subscribe to and the desired duration of the subscription. required: true responses: "200": content: application/json: examples: default: value: data: attributes: content_pack_id: aws-cloudtrail created_at: "2026-05-08T20:02:13.77481Z" expires_at: "2026-05-11T20:02:13.77481Z" is_active: true status: subscribed id: "789" type: subscriptions schema: $ref: "#/components/schemas/SampleLogGenerationSubscriptionResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_filters_write - logs_modify_indexes summary: Subscribe to sample log generation tags: ["Security Monitoring"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - security_monitoring_filters_write - logs_modify_indexes x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/sample_log_generation/subscriptions/bulk: post: description: |- Subscribe to sample log generation for multiple Cloud SIEM content packs in a single call. Each requested content pack is processed independently; the response includes a per-item status so partial successes can be inspected. **Availability**: this endpoint is restricted to Cloud SIEM trial organizations on an eligible pricing model. Non-trial orgs receive `403 Forbidden`, the feature flag may also reject requests with `400 Bad Request`, and legacy pricing tiers receive per-item responses with `status: not_available`. operationId: BulkCreateSampleLogGenerationSubscriptions requestBody: content: application/json: examples: default: value: data: attributes: content_pack_ids: - aws-cloudtrail duration: 3d type: bulk_subscription_requests schema: $ref: "#/components/schemas/SampleLogGenerationBulkSubscriptionRequest" description: The content packs to subscribe to and the desired duration of the subscriptions. required: true responses: "200": content: application/json: examples: default: value: data: - attributes: content_pack_id: aws-cloudtrail created_at: "2026-05-08T20:02:13.655716Z" expires_at: "2026-05-11T20:02:13.655716Z" is_active: true status: subscribed id: "123" meta: status: 200 type: subscriptions schema: $ref: "#/components/schemas/SampleLogGenerationBulkSubscriptionResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_filters_write - logs_modify_indexes summary: Bulk subscribe to sample log generation tags: ["Security Monitoring"] x-codegen-request-body-name: body x-permission: operator: OR permissions: - security_monitoring_filters_write - logs_modify_indexes x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/sample_log_generation/subscriptions/{content_pack_id}: delete: description: |- Unsubscribe from sample log generation for a Cloud SIEM content pack. After unsubscribing, no more sample logs are generated for the requested content pack. **Availability**: this endpoint is restricted to Cloud SIEM trial organizations on an eligible pricing model. Non-trial orgs receive `403 Forbidden`, the feature flag may also reject requests with `400 Bad Request`, and legacy pricing tiers receive a response with `status: not_available`. operationId: DeleteSampleLogGenerationSubscription parameters: - $ref: "#/components/parameters/SampleLogGenerationContentPackID" responses: "200": content: application/json: examples: default: value: data: attributes: content_pack_id: aws-cloudtrail created_at: "2026-05-08T20:02:13.77481Z" expires_at: "2026-05-08T20:30:00Z" is_active: false status: unsubscribed id: "789" type: subscriptions schema: $ref: "#/components/schemas/SampleLogGenerationSubscriptionResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_filters_write - logs_modify_indexes summary: Unsubscribe from sample log generation tags: ["Security Monitoring"] x-permission: operator: OR permissions: - security_monitoring_filters_write - logs_modify_indexes x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/security_agent/investigations: get: description: |- List Bits Security Analyst investigations. Without `filter[signal_id]`, returns the latest investigation of each signal, filtered, sorted, and paginated. With `filter[signal_id]`, returns every investigation of that signal, newest first. When the signal has no investigation, the first page carries `meta.reason`, which says why. operationId: ListSecurityAgentInvestigations parameters: - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterSignalID" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterTitle" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterFrom" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterTo" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterVerdict" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterState" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterRuleID" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterRuleType" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterSignalSeverity" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterSignalSource" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterTags" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterEntity" - $ref: "#/components/parameters/SecurityAgentInvestigationsSort" - $ref: "#/components/parameters/SecurityAgentInvestigationsPageNumber" - $ref: "#/components/parameters/SecurityAgentInvestigationsPageSize" responses: "200": content: application/json: examples: default: summary: The latest investigation of each signal value: data: - attributes: created_at: "2026-10-30T14:02:40Z" is_latest: true rule_id: abc-def-ghi signal: severity: medium sources: - okta tactic: TA0001-initial-access tags: - "source:okta" - "tactic:TA0001-initial-access" - "technique:T1078-valid-accounts" technique: T1078-valid-accounts timestamp: "2026-10-30T14:02:11Z" title: Unusual login location for a user signal_id: AQAAAaGNHjq4XzqcIQAAAABBWm8xY0wybUFBQmNYSjl1QUFBQUFBQUE state: completed updated_at: "2026-10-30T14:15:02Z" verdict: benign id: 7f3c9a2e-5d14-4e8b-9c61-2a0b4f8d1e53 type: investigations meta: total_count: 1 investigation_not_started: summary: A signal with no investigation yet value: data: [] meta: reason: investigation_not_started total_count: 0 not_investigated: summary: A signal that won't be investigated value: data: [] meta: reason: not_investigated total_count: 0 schema: $ref: "#/components/schemas/SecurityAgentInvestigationsListResponse" description: OK headers: Retry-After: description: |- Present when `meta.reason` is `investigation_not_started`: the number of seconds to wait before listing the signal's investigations again. schema: description: Seconds to wait. example: 60 format: int64 type: integer "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_signals_read summary: List Bits Security Analyst investigations tags: - Bits Security Analyst "x-permission": operator: OR permissions: - security_monitoring_signals_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. /api/v2/security_monitoring/security_agent/investigations/count: get: description: |- Count completed Bits Security Analyst investigations by the values of one field. Buckets are sorted by ascending count. With `field=entity` or `field=signal_source`, an investigation counts in the bucket of each of its entities or sources. operationId: CountSecurityAgentInvestigations parameters: - $ref: "#/components/parameters/SecurityAgentInvestigationsCountField" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterTitle" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterFrom" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterTo" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterVerdict" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterRuleID" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterRuleType" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterSignalSeverity" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterSignalSource" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterTags" - $ref: "#/components/parameters/SecurityAgentInvestigationsFilterEntity" responses: "200": content: application/json: examples: default: value: data: attributes: counts: - count: 3 value: malicious - count: 41 value: suspicious - count: 1250 value: benign id: verdict type: investigation_counts schema: $ref: "#/components/schemas/SecurityAgentInvestigationCountsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_signals_read summary: Count Bits Security Analyst investigations tags: - Bits Security Analyst "x-permission": operator: OR permissions: - security_monitoring_signals_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. /api/v2/security_monitoring/security_agent/investigations/{investigation_id}: get: description: |- Get a Bits Security Analyst investigation by its ID, with its verdict, conclusion, evidence, steps, and response suggestions. While the investigation is running, the response has a `Retry-After` header. operationId: GetSecurityAgentInvestigation parameters: - $ref: "#/components/parameters/SecurityAgentInvestigationID" - $ref: "#/components/parameters/SecurityAgentInvestigationFields" responses: "200": content: application/json: examples: default: value: data: attributes: conclusion: The login came from a location the user travels to regularly, on a known device. created_at: "2026-10-30T14:02:40Z" key_entities: actors: - type: user value: jane.doe@example.com targets: - sub_type: okta_app type: application value: Corporate VPN key_evidence: - category: Authentication finding: The user logged in from the same country three times in the last 30 days. source_steps: - Has the user logged in from this location before? response_suggestions: mitigation_suggestions: - actions: - applied: false fqn: com.datadoghq.okta.suspend_user id: action-1 name: Suspend user source: okta source_connected: true target: jane.doe@example.com id: mitigation-1 rationale: Only needed if the user doesn't confirm the login. recommended: false scope_note: jane.doe@example.com step: 1 title: Suspend the user rule_tuning_suggestions: occurrence_window_days: 30 reasoning: Most signals from this rule in the last 30 days were benign travel. rule_id: abc-def-ghi rule_name: Unusual login location for a user rule_signal_total: 120 suggestions: - action_type: create_suppression conditions: - field: "@usr.device.id" value: 4b8f2c1e-9a7d-4e3b-8c5f-1d2e3f4a5b6c description: Don't generate signals for logins from devices the user has used before. estimated_silenced_count: 85 id: suggestion-1 match_logic: AND recommended: true rule_id: abc-def-ghi title: Suppress logins from known devices warning: A stolen known device would no longer trigger this rule. why: The user's known devices accounted for most benign signals. summary: The rule fires often for users who travel to known locations. rule_id: abc-def-ghi signal: severity: medium sources: - okta tactic: TA0001-initial-access tags: - "source:okta" - "tactic:TA0001-initial-access" - "technique:T1078-valid-accounts" technique: T1078-valid-accounts timestamp: "2026-10-30T14:02:11Z" title: Unusual login location for a user signal_id: AQAAAaGNHjq4XzqcIQAAAABBWm8xY0wybUFBQmNYSjl1QUFBQUFBQUE state: completed steps: - name: Has the user logged in from this location before? summary: Three earlier logins from the same country, on the same device. updated_at: "2026-10-30T14:15:02Z" verdict: benign id: 7f3c9a2e-5d14-4e8b-9c61-2a0b4f8d1e53 type: investigations schema: $ref: "#/components/schemas/SecurityAgentInvestigationResponse" description: OK headers: Retry-After: description: |- Present while `state` is `investigating`: the number of seconds to wait before getting the investigation again. schema: description: Seconds to wait. example: 300 format: int64 type: integer "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_signals_read summary: Get a Bits Security Analyst investigation tags: - Bits Security Analyst "x-permission": operator: OR permissions: - security_monitoring_signals_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. To request access, contact [Datadog support](https://docs.datadoghq.com/help/) or your Customer Success Manager. /api/v2/security_monitoring/signals: get: description: |- The list endpoint returns security signals that match a search query. Both this endpoint and the POST endpoint can be used interchangeably when listing security signals. operationId: ListSecurityMonitoringSignals parameters: - $ref: "#/components/parameters/QueryFilterSearch" - $ref: "#/components/parameters/QueryFilterFrom" - $ref: "#/components/parameters/QueryFilterTo" - $ref: "#/components/parameters/QuerySort" - $ref: "#/components/parameters/QueryPageCursor" - $ref: "#/components/parameters/QueryPageLimit" responses: "200": content: application/json: examples: default: value: data: - attributes: tags: - "source:cloudtrail" id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: signal links: next: "" meta: page: after: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== schema: $ref: "#/components/schemas/SecurityMonitoringSignalsListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_signals_read summary: Get a quick list of security signals tags: ["Security Monitoring"] x-pagination: cursorParam: page[cursor] cursorPath: meta.page.after limitParam: page[limit] resultsPath: data "x-permission": operator: OR permissions: - security_monitoring_signals_read /api/v2/security_monitoring/signals/bulk/assignee: patch: description: |- Change the triage assignees of multiple security signals at once. The maximum number of signals that can be updated in a single request is 199. operationId: BulkEditSecurityMonitoringSignalsAssignee requestBody: content: application/json: examples: default: value: data: - attributes: assignee: 773b045d-ccf8-4808-bd3b-955ef6a8c940 id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: signal schema: $ref: "#/components/schemas/SecurityMonitoringSignalsBulkAssigneeUpdateRequest" description: Attributes describing the signal assignee updates. required: true responses: "200": content: application/json: examples: default: value: result: count: 1 events: - event: assignee: uuid: 00000000-0000-0000-0000-000000000001 id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA incident_ids: [] state: archived id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA status: done type: status schema: $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageUpdateResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Bulk update triage assignee of security signals tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_signals_write /api/v2/security_monitoring/signals/bulk/state: patch: description: |- Change the triage states of multiple security signals at once. The maximum number of signals that can be updated in a single request is 199. operationId: BulkEditSecurityMonitoringSignalsState requestBody: content: application/json: examples: default: value: data: - attributes: archive_reason: none state: archived id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: signal schema: $ref: "#/components/schemas/SecurityMonitoringSignalsBulkStateUpdateRequest" description: Attributes describing the signal state updates. required: true responses: "200": content: application/json: examples: default: value: result: count: 1 events: - event: assignee: uuid: 00000000-0000-0000-0000-000000000001 id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA incident_ids: [] state: archived id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA status: done type: status schema: $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageUpdateResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Bulk update triage state of security signals tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_signals_write /api/v2/security_monitoring/signals/bulk/update: patch: description: |- Update the triage state or assignee of multiple security signals at once. The maximum number of signals that can be updated in a single request is 199. operationId: BulkEditSecurityMonitoringSignals requestBody: content: application/json: examples: default: value: data: - attributes: archive_reason: none state: archived id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: signal schema: $ref: "#/components/schemas/SecurityMonitoringSignalsBulkUpdateRequest" description: Attributes describing the signal updates. required: true responses: "200": content: application/json: examples: default: value: result: count: 1 events: - event: assignee: uuid: 00000000-0000-0000-0000-000000000001 id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA incident_ids: [] state: archived id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA status: done type: status schema: $ref: "#/components/schemas/SecurityMonitoringSignalsBulkTriageUpdateResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Bulk update security signals tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_signals_write /api/v2/security_monitoring/signals/search: post: description: |- Returns security signals that match a search query. Both this endpoint and the GET endpoint can be used interchangeably for listing security signals. operationId: SearchSecurityMonitoringSignals requestBody: content: "application/json": examples: default: value: filter: from: "2019-01-02T09:42:36.320Z" query: security:attack status:high to: "2019-01-03T09:42:36.320Z" page: cursor: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== limit: 25 sort: timestamp schema: $ref: "#/components/schemas/SecurityMonitoringSignalListRequest" required: false responses: "200": content: application/json: examples: default: value: data: - attributes: attributes: workflow: rule: id: 0f5-e0c-805 name: "Brute Force Attack Grouped By User" version: 12 tags: - "source:cloudtrail" id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: signal links: next: "" meta: elapsed: 132 page: after: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== request_id: example-request-id status: done schema: $ref: "#/components/schemas/SecurityMonitoringSignalsListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_signals_read summary: Get a list of security signals tags: ["Security Monitoring"] x-codegen-request-body-name: body x-pagination: cursorParam: body.page.cursor cursorPath: meta.page.after limitParam: body.page.limit resultsPath: data "x-permission": operator: OR permissions: - security_monitoring_signals_read /api/v2/security_monitoring/signals/{signal_id}: get: description: Get a signal's details. operationId: GetSecurityMonitoringSignal parameters: - $ref: "#/components/parameters/SignalID" responses: "200": content: "application/json": examples: default: value: data: attributes: tags: - "source:cloudtrail" id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: signal schema: $ref: "#/components/schemas/SecurityMonitoringSignalResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_signals_read summary: Get a signal's details tags: ["Security Monitoring"] "x-permission": operator: OR permissions: - security_monitoring_signals_read /api/v2/security_monitoring/signals/{signal_id}/assignee: patch: description: |- Modify the triage assignee of a security signal. operationId: EditSecurityMonitoringSignalAssignee parameters: - $ref: "#/components/parameters/SignalID" requestBody: content: application/json: examples: default: value: data: attributes: assignee: uuid: 773b045d-ccf8-4808-bd3b-955ef6a8c940 schema: $ref: "#/components/schemas/SecurityMonitoringSignalAssigneeUpdateRequest" description: Attributes describing the signal update. required: true responses: "200": content: application/json: examples: default: value: data: attributes: assignee: uuid: 00000000-0000-0000-0000-000000000001 incident_ids: [] state: archived id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: signal_metadata schema: $ref: "#/components/schemas/SecurityMonitoringSignalTriageUpdateResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Modify the triage assignee of a security signal tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_signals_write /api/v2/security_monitoring/signals/{signal_id}/entities: get: description: Get the list of entities related to a security signal, captured at the signal's timestamp. operationId: GetSignalEntities parameters: - $ref: "#/components/parameters/SignalID" - description: The maximum number of entities to return. in: query name: limit required: false schema: default: 10 example: 10 format: int32 maximum: 1000 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: identities: - display_name: Test User principal_id: user@example.com id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: entities schema: $ref: "#/components/schemas/SignalEntitiesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_signals_read summary: Get entities related to a signal tags: ["Security Monitoring"] x-permission: operator: OR permissions: - security_monitoring_signals_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/security_monitoring/signals/{signal_id}/incidents: patch: description: |- Change the related incidents for a security signal. operationId: EditSecurityMonitoringSignalIncidents parameters: - $ref: "#/components/parameters/SignalID" requestBody: content: application/json: examples: default: value: data: attributes: incident_ids: - 2066 schema: $ref: "#/components/schemas/SecurityMonitoringSignalIncidentsUpdateRequest" description: Attributes describing the signal update. required: true responses: "200": content: application/json: examples: default: value: data: attributes: assignee: uuid: 00000000-0000-0000-0000-000000000001 incident_ids: [] state: archived id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: signal_metadata schema: $ref: "#/components/schemas/SecurityMonitoringSignalTriageUpdateResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Change the related incidents of a security signal tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_signals_write /api/v2/security_monitoring/signals/{signal_id}/investigation_queries: get: description: Get the list of investigation log queries available for a given security signal. operationId: GetInvestigationLogQueriesMatchingSignal parameters: - $ref: "#/components/parameters/SignalID" responses: "200": content: application/json: example: data: - attributes: name: Cloudtrail events for user ARN query_filter: 'source:cloudtrail @userIdentity.arn:"foo"' template_variables: "@userIdentity.arn": - foo url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22 id: w00-t10-992 type: investigation_log_queries - attributes: title: Monitor Okta logs to track system access and unusual activity url: https://www.datadoghq.com/blog/monitor-activity-with-okta/ id: bxy-o8v-i1a type: recommended_blog_posts schema: $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionsResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read - security_monitoring_signals_read summary: Get investigation queries for a signal tags: ["Security Monitoring"] x-permission: operator: AND permissions: - security_monitoring_rules_read - security_monitoring_signals_read /api/v2/security_monitoring/signals/{signal_id}/state: patch: description: |- Change the triage state of a security signal. operationId: EditSecurityMonitoringSignalState parameters: - $ref: "#/components/parameters/SignalID" requestBody: content: application/json: examples: default: value: data: attributes: archive_reason: none state: archived type: signal_metadata schema: $ref: "#/components/schemas/SecurityMonitoringSignalStateUpdateRequest" description: Attributes describing the signal update. required: true responses: "200": content: application/json: examples: default: value: data: attributes: assignee: uuid: 00000000-0000-0000-0000-000000000001 incident_ids: [] state: archived id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: signal_metadata schema: $ref: "#/components/schemas/SecurityMonitoringSignalTriageUpdateResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Change the triage state of a security signal tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_signals_write /api/v2/security_monitoring/signals/{signal_id}/suggested_actions: get: description: Get the list of suggested actions for a given security signal. operationId: GetSuggestedActionsMatchingSignal parameters: - $ref: "#/components/parameters/SignalID" responses: "200": content: application/json: example: data: - attributes: name: Cloudtrail events for user ARN query_filter: 'source:cloudtrail @userIdentity.arn:"foo"' template_variables: "@userIdentity.arn": - foo url: /logs?query=source%3Acloudtrail+%40userIdentity.arn%3A%22foo%22 id: w00-t10-992 type: investigation_log_queries - attributes: title: Monitor Okta logs to track system access and unusual activity url: https://www.datadoghq.com/blog/monitor-activity-with-okta/ id: bxy-o8v-i1a type: recommended_blog_posts schema: $ref: "#/components/schemas/SecurityMonitoringSignalSuggestedActionsResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read - security_monitoring_signals_read summary: Get suggested actions for a signal tags: ["Security Monitoring"] x-permission: operator: AND permissions: - security_monitoring_rules_read - security_monitoring_signals_read /api/v2/security_monitoring/signals/{signal_id}/update: patch: description: |- Update the triage state or assignee of a security signal. operationId: EditSecurityMonitoringSignal parameters: - $ref: "#/components/parameters/SignalID" requestBody: content: application/json: examples: default: value: data: attributes: archive_reason: none state: archived type: signal_metadata schema: $ref: "#/components/schemas/SecurityMonitoringSignalUpdateRequest" description: Attributes describing the signal triage state or assignee update. required: true responses: "200": content: application/json: examples: default: value: data: attributes: assignee: uuid: 00000000-0000-0000-0000-000000000001 incident_ids: [] state: archived id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: signal_metadata schema: $ref: "#/components/schemas/SecurityMonitoringSignalTriageUpdateResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update security signal triage state or assignee tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_signals_write /api/v2/security_monitoring/terraform/{resource_type}/bulk: post: description: |- Export multiple security monitoring resources to Terraform, packaged as a zip archive. The `resource_type` path parameter specifies the type of resources to export and must be one of `suppressions`, `critical_assets`, `security_filters`, or `rules`. A maximum of 1000 resources can be exported in a single request. For `rules`, partner rules cannot be exported and return a 400 error. operationId: BulkExportSecurityMonitoringTerraformResources parameters: - $ref: "#/components/parameters/SecurityMonitoringTerraformResourceType" requestBody: content: application/json: examples: default: value: data: attributes: resource_ids: - abc-123-def type: bulk_export_resources schema: $ref: "#/components/schemas/SecurityMonitoringTerraformBulkExportRequest" description: The resource IDs to export. required: true responses: "200": content: application/zip: examples: default: value: "" schema: format: binary type: string description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_suppressions_read - AuthZ: - security_monitoring_rules_read - AuthZ: - security_monitoring_filters_read summary: Export security monitoring resources to Terraform tags: - Security Monitoring x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_suppressions_read - security_monitoring_rules_read - security_monitoring_filters_read x-unstable: "**Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." /api/v2/security_monitoring/terraform/{resource_type}/convert: post: description: |- Convert a security monitoring resource that doesn't (yet) exist from JSON to Terraform. The `resource_type` path parameter specifies the type of resource to convert and must be one of `suppressions`, `critical_assets`, `security_filters`, or `rules`. operationId: ConvertSecurityMonitoringTerraformResource parameters: - $ref: "#/components/parameters/SecurityMonitoringTerraformResourceType" requestBody: content: application/json: examples: default: value: data: attributes: resource_json: enabled: true name: Example-Security-Monitoring rule_query: "source:cloudtrail" suppression_query: "env:test" id: abc-123 type: convert_resource schema: $ref: "#/components/schemas/SecurityMonitoringTerraformConvertRequest" description: The resource JSON to convert. required: true responses: "200": content: application/json: examples: default: value: data: attributes: output: 'resource "datadog_security_monitoring_suppression" "abc-123" {}' resource_id: abc-123 type_name: datadog_security_monitoring_suppression id: datadog_security_monitoring_suppression|abc-123 type: format_resource schema: $ref: "#/components/schemas/SecurityMonitoringTerraformExportResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_suppressions_read - AuthZ: - security_monitoring_rules_read - AuthZ: - security_monitoring_filters_read summary: Convert security monitoring resource to Terraform tags: - Security Monitoring x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_suppressions_read - security_monitoring_rules_read - security_monitoring_filters_read x-unstable: "**Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." /api/v2/security_monitoring/terraform/{resource_type}/{resource_id}: get: description: |- Export a security monitoring resource to a Terraform configuration. The `resource_type` path parameter specifies the type of resource to export and must be one of `suppressions`, `critical_assets`, `security_filters`, or `rules`. For `rules`, partner rules cannot be exported and return a 400 error. operationId: ExportSecurityMonitoringTerraformResource parameters: - $ref: "#/components/parameters/SecurityMonitoringTerraformResourceType" - $ref: "#/components/parameters/SecurityMonitoringTerraformResourceId" responses: "200": content: application/json: examples: default: value: data: attributes: output: 'resource "datadog_security_monitoring_suppression" "abc-123" {}' resource_id: abc-123 type_name: datadog_security_monitoring_suppression id: datadog_security_monitoring_suppression|abc-123 type: format_resource schema: $ref: "#/components/schemas/SecurityMonitoringTerraformExportResponse" description: OK "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_suppressions_read - AuthZ: - security_monitoring_rules_read - AuthZ: - security_monitoring_filters_read summary: Export security monitoring resource to Terraform tags: - Security Monitoring "x-permission": operator: OR permissions: - security_monitoring_suppressions_read - security_monitoring_rules_read - security_monitoring_filters_read x-unstable: "**Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." /api/v2/sensitive-data-scanner/config: get: description: List all the Scanning groups in your organization. operationId: ListScanningGroups responses: "200": content: application/json: examples: default: value: data: attributes: {} id: abc-123 relationships: groups: data: - id: group-abc-123 type: sensitive_data_scanner_group type: sensitive_data_scanner_configuration included: - attributes: description: "" filter: query: "*" is_enabled: true name: My scanning group product_list: - logs samplings: - product: logs rate: 100.0 id: group-abc-123 relationships: configuration: data: id: abc-123 type: sensitive_data_scanner_configuration rules: data: - id: rule-abc-123 type: sensitive_data_scanner_rule type: sensitive_data_scanner_group - attributes: description: Detects credit card numbers in various formats excluded_namespaces: - admin.name included_keyword_configuration: character_count: 35 keywords: - credit card is_enabled: true name: Credit Card Rule namespaces: - admin priority: 1 tags: - sensitive_data:true text_replacement: type: none id: rule-abc-123 relationships: group: data: id: group-abc-123 type: sensitive_data_scanner_group type: sensitive_data_scanner_rule meta: {} schema: $ref: "#/components/schemas/SensitiveDataScannerGetConfigResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Scanning Groups tags: - Sensitive Data Scanner "x-permission": operator: OR permissions: - data_scanner_read patch: description: Reorder the list of groups. operationId: ReorderScanningGroups requestBody: content: application/json: examples: default: value: data: relationships: groups: data: - id: a796feff-a0cc-4a9f-8c61-16c4d5e44964 type: sensitive_data_scanner_group type: sensitive_data_scanner_configuration meta: version: 0 schema: $ref: "#/components/schemas/SensitiveDataScannerConfigRequest" required: true responses: "200": content: application/json: examples: default: value: meta: {} schema: $ref: "#/components/schemas/SensitiveDataScannerReorderGroupsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Reorder Groups tags: - Sensitive Data Scanner x-codegen-request-body-name: body "x-permission": operator: OR permissions: - data_scanner_write /api/v2/sensitive-data-scanner/config/groups: post: description: |- Create a scanning group. The request MAY include a configuration relationship. A rules relationship can be omitted entirely, but if it is included it MUST be null or an empty array (rules cannot be created at the same time). The new group will be ordered last within the configuration. operationId: CreateScanningGroup requestBody: content: application/json: examples: default: value: data: attributes: filter: query: "*" is_enabled: false product_list: - logs samplings: - product: logs rate: 100.0 relationships: configuration: data: type: sensitive_data_scanner_configuration type: sensitive_data_scanner_group meta: version: 0 schema: $ref: "#/components/schemas/SensitiveDataScannerGroupCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: description: "" filter: query: "*" is_enabled: false name: My scanning group product_list: - logs samplings: - product: logs rate: 100.0 id: group-abc-123 relationships: configuration: data: id: abc-123 type: sensitive_data_scanner_configuration rules: data: [] type: sensitive_data_scanner_group meta: {} schema: $ref: "#/components/schemas/SensitiveDataScannerCreateGroupResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create Scanning Group tags: - Sensitive Data Scanner x-codegen-request-body-name: body "x-permission": operator: OR permissions: - data_scanner_write /api/v2/sensitive-data-scanner/config/groups/{group_id}: delete: description: Delete a given group. operationId: DeleteScanningGroup parameters: - $ref: "#/components/parameters/SensitiveDataScannerGroupID" requestBody: content: application/json: examples: default: value: meta: version: 0 schema: $ref: "#/components/schemas/SensitiveDataScannerGroupDeleteRequest" required: true responses: "200": content: application/json: examples: default: value: data: meta: {} schema: $ref: "#/components/schemas/SensitiveDataScannerGroupDeleteResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete Scanning Group tags: - Sensitive Data Scanner x-codegen-request-body-name: body "x-permission": operator: OR permissions: - data_scanner_write patch: description: |- Update a group, including the order of the rules. Rules within the group are reordered by including a rules relationship. If the rules relationship is present, its data section MUST contain linkages for all of the rules currently in the group, and MUST NOT contain any others. operationId: UpdateScanningGroup parameters: - $ref: "#/components/parameters/SensitiveDataScannerGroupID" requestBody: content: application/json: examples: default: value: data: attributes: filter: query: "*" is_enabled: false product_list: - logs samplings: - product: logs rate: 100.0 relationships: configuration: data: type: sensitive_data_scanner_configuration type: sensitive_data_scanner_group meta: version: 0 schema: $ref: "#/components/schemas/SensitiveDataScannerGroupUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: meta: {} schema: $ref: "#/components/schemas/SensitiveDataScannerGroupUpdateResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update Scanning Group tags: - Sensitive Data Scanner x-codegen-request-body-name: body "x-permission": operator: OR permissions: - data_scanner_write /api/v2/sensitive-data-scanner/config/rules: post: description: |- Create a scanning rule in a sensitive data scanner group, ordered last. The posted rule MUST include a group relationship. It MUST include either a standard_pattern relationship or a regex attribute, but not both. If included_attributes is empty or missing, we will scan all attributes except excluded_attributes. If both are missing, we will scan the whole event. operationId: CreateScanningRule requestBody: content: application/json: examples: default: value: data: attributes: excluded_namespaces: - admin.name included_keyword_configuration: character_count: 30 keywords: - email - address - login is_enabled: true namespaces: - admin suppressions: ends_with: - "@example.com" - another.example.com exact_match: - admin@example.com - user@example.com starts_with: - admin - user tags: - sensitive_data:true text_replacement: type: none relationships: group: data: type: sensitive_data_scanner_group standard_pattern: data: type: sensitive_data_scanner_standard_pattern type: sensitive_data_scanner_rule meta: version: 0 schema: $ref: "#/components/schemas/SensitiveDataScannerRuleCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: description: Detects credit card numbers in various formats excluded_namespaces: - admin.name included_keyword_configuration: character_count: 35 keywords: - credit card is_enabled: true name: Credit Card Rule namespaces: - admin priority: 1 tags: - sensitive_data:true text_replacement: type: none id: rule-abc-123 relationships: group: data: id: group-abc-123 type: sensitive_data_scanner_group type: sensitive_data_scanner_rule meta: {} schema: $ref: "#/components/schemas/SensitiveDataScannerCreateRuleResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create Scanning Rule tags: - Sensitive Data Scanner x-codegen-request-body-name: body "x-permission": operator: OR permissions: - data_scanner_write /api/v2/sensitive-data-scanner/config/rules/{rule_id}: delete: description: Delete a given rule. operationId: DeleteScanningRule parameters: - $ref: "#/components/parameters/SensitiveDataScannerRuleID" requestBody: content: application/json: examples: default: value: meta: version: 0 schema: $ref: "#/components/schemas/SensitiveDataScannerRuleDeleteRequest" required: true responses: "200": content: application/json: examples: default: value: meta: {} schema: $ref: "#/components/schemas/SensitiveDataScannerRuleDeleteResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete Scanning Rule tags: - Sensitive Data Scanner x-codegen-request-body-name: body "x-permission": operator: OR permissions: - data_scanner_write patch: description: |- Update a scanning rule. The request body MUST NOT include a standard_pattern relationship, as that relationship is non-editable. Trying to edit the regex attribute of a rule with a standard_pattern relationship will also result in an error. operationId: UpdateScanningRule parameters: - $ref: "#/components/parameters/SensitiveDataScannerRuleID" requestBody: content: application/json: examples: default: value: data: attributes: excluded_namespaces: - admin.name included_keyword_configuration: character_count: 30 keywords: - email - address - login is_enabled: true namespaces: - admin suppressions: ends_with: - "@example.com" - another.example.com exact_match: - admin@example.com - user@example.com starts_with: - admin - user tags: - sensitive_data:true text_replacement: type: none relationships: group: data: type: sensitive_data_scanner_group standard_pattern: data: type: sensitive_data_scanner_standard_pattern type: sensitive_data_scanner_rule meta: version: 0 schema: $ref: "#/components/schemas/SensitiveDataScannerRuleUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: meta: {} schema: $ref: "#/components/schemas/SensitiveDataScannerRuleUpdateResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update Scanning Rule tags: - Sensitive Data Scanner x-codegen-request-body-name: body "x-permission": operator: OR permissions: - data_scanner_write /api/v2/sensitive-data-scanner/config/standard-patterns: get: description: Returns all standard patterns. operationId: ListStandardPatterns responses: "200": content: application/json: examples: default: value: data: - attributes: description: Detects credit card numbers in various formats included_keywords: - credit card - card number name: Credit Card Number priority: 1 tags: - card_number id: abc-123 type: sensitive_data_scanner_standard_pattern schema: $ref: "#/components/schemas/SensitiveDataScannerStandardPatternsResponseData" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication Error "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List standard patterns tags: - Sensitive Data Scanner "x-permission": operator: OR permissions: - data_scanner_read /api/v2/series: post: description: |- The metrics end-point allows you to post time-series data that can be graphed on Datadog’s dashboards. The maximum payload size is 500 kilobytes (512000 bytes). Compressed payloads must have a decompressed size of less than 5 megabytes (5242880 bytes). If you’re submitting metrics directly to the Datadog API without using DogStatsD, expect: - 64 bits for the timestamp - 64 bits for the value - 20 bytes for the metric names - 50 bytes for the timeseries - The full payload is approximately 100 bytes. Host name is one of the resources in the Resources field. operationId: SubmitMetrics parameters: - description: HTTP header used to compress the media-type. in: header name: Content-Encoding required: false schema: $ref: "#/components/schemas/MetricContentEncoding" requestBody: content: application/json: examples: default: value: series: - metric: system.load.1 points: - timestamp: 1636629071 value: 1.1 resources: - name: dummyhost type: host type: 0 dynamic-points: description: Post time-series data that can be graphed on Datadog’s dashboards. externalValue: examples/metrics/dynamic-points.json.sh summary: Dynamic Points x-variables: NOW: $(date +%s) schema: $ref: "#/components/schemas/MetricPayload" required: true responses: "202": content: application/json: examples: default: value: errors: [] schema: $ref: "#/components/schemas/IntakePayloadAccepted" description: Payload accepted "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "408": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Request timeout "413": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Payload too large "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] summary: Submit metrics tags: - Metrics x-codegen-request-body-name: body /api/v2/service_accounts: post: description: Create a service account for your organization. operationId: CreateServiceAccount requestBody: content: application/json: examples: default: value: data: attributes: email: jane.doe@example.com service_account: true relationships: roles: data: - id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: users schema: $ref: "#/components/schemas/ServiceAccountCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: email: test@example.com service_account: true id: 00000000-0000-0000-0000-000000000001 type: users schema: $ref: "#/components/schemas/UserResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a service account tags: - Service Accounts x-codegen-request-body-name: body "x-permission": operator: OR permissions: - service_account_write /api/v2/service_accounts/{service_account_id}/access_tokens: get: description: List all access tokens for a specific service account. operationId: ListServiceAccountAccessTokens parameters: - $ref: "#/components/parameters/ServiceAccountID" - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - $ref: "#/components/parameters/PersonalAccessTokensSortParameter" - $ref: "#/components/parameters/PersonalAccessTokensFilterParameter" - $ref: "#/components/parameters/PersonalAccessTokensFilterLeakedParameter" - $ref: "#/components/parameters/PersonalAccessTokensIncludeParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" expires_at: "2025-12-31T23:59:59+00:00" name: My Service Access Token public_portion: ddsat_abc123 scopes: - dashboards_read id: 00000000-0000-0000-0000-000000000005 type: service_access_tokens meta: page: total_filtered_count: 1 schema: $ref: "#/components/schemas/ListServiceAccessTokensResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List access tokens for a service account tags: - Service Accounts "x-permission": operator: OR permissions: - service_account_write post: description: Create an access token for a service account. operationId: CreateServiceAccountAccessToken parameters: - $ref: "#/components/parameters/ServiceAccountID" requestBody: content: application/json: examples: default: value: data: attributes: name: Service Account Access Token scopes: - dashboards_read - dashboards_write type: service_access_tokens schema: $ref: "#/components/schemas/ServiceAccountAccessTokenCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" expires_at: "2025-12-31T23:59:59+00:00" key: "" name: My Service Access Token public_portion: ddsat_abc123 scopes: - dashboards_read id: 00000000-0000-0000-0000-000000000006 type: service_access_tokens schema: $ref: "#/components/schemas/ServiceAccessTokenCreateResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create an access token for a service account tags: - Service Accounts x-codegen-request-body-name: body "x-permission": operator: OR permissions: - service_account_write /api/v2/service_accounts/{service_account_id}/access_tokens/{token_id}: delete: description: Revoke a specific access token for a service account. operationId: RevokeServiceAccountAccessToken parameters: - $ref: "#/components/parameters/ServiceAccountID" - $ref: "#/components/parameters/AccessTokenID" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Revoke an access token for a service account tags: - Service Accounts "x-permission": operator: OR permissions: - service_account_write get: description: Get a specific access token for a service account by its ID. operationId: GetServiceAccountAccessToken parameters: - $ref: "#/components/parameters/ServiceAccountID" - $ref: "#/components/parameters/AccessTokenID" - $ref: "#/components/parameters/PersonalAccessTokensIncludeParameter" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" expires_at: "2025-12-31T23:59:59+00:00" name: My Service Access Token public_portion: ddsat_abc123 scopes: - dashboards_read id: 00000000-0000-0000-0000-000000000007 type: service_access_tokens schema: $ref: "#/components/schemas/ServiceAccessTokenResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get an access token for a service account tags: - Service Accounts "x-permission": operator: OR permissions: - service_account_write patch: description: Update a specific access token for a service account. operationId: UpdateServiceAccountAccessToken parameters: - $ref: "#/components/parameters/ServiceAccountID" - $ref: "#/components/parameters/AccessTokenID" requestBody: content: application/json: examples: default: value: data: attributes: name: Updated Service Access Token scopes: - dashboards_read - dashboards_write id: 00112233-4455-6677-8899-aabbccddeeff type: service_access_tokens schema: $ref: "#/components/schemas/ServiceAccountAccessTokenUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" expires_at: "2025-12-31T23:59:59+00:00" name: My Service Access Token public_portion: ddsat_abc123 scopes: - dashboards_read id: 00000000-0000-0000-0000-000000000008 type: service_access_tokens schema: $ref: "#/components/schemas/UpdatedServiceAccessTokenResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update an access token for a service account tags: - Service Accounts x-codegen-request-body-name: body "x-permission": operator: OR permissions: - service_account_write /api/v2/service_accounts/{service_account_id}/application_keys: get: description: List all application keys available for this service account. operationId: ListServiceAccountApplicationKeys parameters: - $ref: "#/components/parameters/ServiceAccountID" - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - $ref: "#/components/parameters/ApplicationKeysSortParameter" - $ref: "#/components/parameters/ApplicationKeyFilterParameter" - $ref: "#/components/parameters/ApplicationKeyFilterCreatedAtStartParameter" - $ref: "#/components/parameters/ApplicationKeyFilterCreatedAtEndParameter" responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" name: Application Key for managing dashboards id: 00000000-0000-0000-0000-000000000002 type: application_keys schema: $ref: "#/components/schemas/ListApplicationKeysResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List application keys for this service account tags: - Service Accounts "x-permission": operator: OR permissions: - service_account_write post: description: Create an application key for this service account. operationId: CreateServiceAccountApplicationKey parameters: - $ref: "#/components/parameters/ServiceAccountID" requestBody: content: application/json: examples: default: value: data: attributes: name: Application Key for managing dashboards scopes: - dashboards_read - dashboards_write - dashboards_public_share type: application_keys schema: $ref: "#/components/schemas/ApplicationKeyCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" name: Application Key for managing dashboards id: 00000000-0000-0000-0000-000000000003 type: application_keys schema: $ref: "#/components/schemas/ApplicationKeyResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create an application key for this service account tags: - Service Accounts x-codegen-request-body-name: body "x-permission": operator: OR permissions: - service_account_write /api/v2/service_accounts/{service_account_id}/application_keys/{app_key_id}: delete: description: Delete an application key owned by this service account. operationId: DeleteServiceAccountApplicationKey parameters: - $ref: "#/components/parameters/ServiceAccountID" - $ref: "#/components/parameters/ApplicationKeyID" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an application key for this service account tags: - Service Accounts "x-permission": operator: OR permissions: - service_account_write get: description: Get an application key owned by this service account. operationId: GetServiceAccountApplicationKey parameters: - $ref: "#/components/parameters/ServiceAccountID" - $ref: "#/components/parameters/ApplicationKeyID" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" name: Application Key for managing dashboards id: 00000000-0000-0000-0000-000000000004 type: application_keys schema: $ref: "#/components/schemas/PartialApplicationKeyResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get one application key for this service account tags: - Service Accounts "x-permission": operator: OR permissions: - service_account_write patch: description: Edit an application key owned by this service account. operationId: UpdateServiceAccountApplicationKey parameters: - $ref: "#/components/parameters/ServiceAccountID" - $ref: "#/components/parameters/ApplicationKeyID" requestBody: content: application/json: examples: default: value: data: attributes: name: Application Key for managing dashboards scopes: - dashboards_read - dashboards_write - dashboards_public_share id: 00112233-4455-6677-8899-aabbccddeeff type: application_keys schema: $ref: "#/components/schemas/ApplicationKeyUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" name: Application Key for managing dashboards id: 00000000-0000-0000-0000-000000000005 type: application_keys schema: $ref: "#/components/schemas/PartialApplicationKeyResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Edit an application key for this service account tags: - Service Accounts x-codegen-request-body-name: body "x-permission": operator: OR permissions: - service_account_write /api/v2/services/definitions: get: description: Get a list of all service definitions from the Datadog Service Catalog. operationId: ListServiceDefinitions parameters: - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - $ref: "#/components/parameters/SchemaVersion" responses: "200": content: application/json: examples: default: value: data: - attributes: schema: dd-service: test-service schema-version: v2.2 team: my-team id: test-service type: service_definitions schema: $ref: "#/components/schemas/ServiceDefinitionsListResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_read summary: Get all service definitions tags: - Service Definition x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data "x-permission": operator: OR permissions: - apm_service_catalog_read post: description: Create or update service definition in the Datadog Service Catalog. operationId: CreateOrUpdateServiceDefinitions requestBody: content: application/json: examples: default: value: application: my-app ci-pipeline-fingerprints: - j88xdEy0J5lc - eZ7LMljCk8vo contacts: - contact: https://teams.microsoft.com/myteam name: My team channel type: slack dd-service: my-service description: My service description extensions: myorg/extension: extensionValue integrations: opsgenie: region: US service-url: https://my-org.opsgenie.com/service/123e4567-e89b-12d3-a456-426614174000 pagerduty: service-url: https://my-org.pagerduty.com/service-directory/PMyService languages: - dotnet - go - java - js - php - python - ruby - c++ lifecycle: sandbox links: - name: Runbook provider: Github type: runbook url: https://my-runbook schema-version: v2.2 tags: - my:tag - service:tag team: my-team tier: High type: web schema: $ref: "#/components/schemas/ServiceDefinitionsCreateRequest" description: Service Definition YAML/JSON. required: true responses: "200": content: application/json: examples: default: value: data: - attributes: schema: dd-service: my-service schema-version: v2.2 id: abc-123 type: service_definitions schema: $ref: "#/components/schemas/ServiceDefinitionCreateResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_write summary: Create or update service definition tags: - Service Definition x-codegen-request-body-name: body "x-permission": operator: OR permissions: - apm_service_catalog_write /api/v2/services/definitions/{service_name}: delete: description: Delete a single service definition in the Datadog Service Catalog. operationId: DeleteServiceDefinition parameters: - $ref: "#/components/parameters/ServiceName" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_write summary: Delete a single service definition tags: - Service Definition "x-permission": operator: OR permissions: - apm_service_catalog_write get: description: Get a single service definition from the Datadog Service Catalog. operationId: GetServiceDefinition parameters: - $ref: "#/components/parameters/ServiceName" - $ref: "#/components/parameters/SchemaVersion" responses: "200": content: application/json: examples: default: value: data: attributes: schema: dd-service: test-service schema-version: v2.2 team: my-team id: test-service type: service_definitions schema: $ref: "#/components/schemas/ServiceDefinitionGetResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_read summary: Get a single service definition tags: - Service Definition "x-permission": operator: OR permissions: - apm_service_catalog_read /api/v2/siem-historical-detections/histsignals: get: description: List hist signals. operationId: ListSecurityMonitoringHistsignals parameters: - $ref: "#/components/parameters/QueryFilterSearch" - $ref: "#/components/parameters/QueryFilterFrom" - $ref: "#/components/parameters/QueryFilterTo" - $ref: "#/components/parameters/QuerySort" - $ref: "#/components/parameters/QueryPageCursor" - $ref: "#/components/parameters/QueryPageLimit" responses: "200": content: application/json: examples: default: value: data: - attributes: message: A large number of failed login attempts. tags: - source:production timestamp: "2024-01-01T00:00:00+00:00" id: abc-123 type: signal schema: $ref: "#/components/schemas/SecurityMonitoringSignalsListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_signals_read summary: List hist signals tags: ["Security Monitoring"] "x-permission": operator: OR permissions: - security_monitoring_signals_read x-unstable: |- **Note**: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates. /api/v2/siem-historical-detections/histsignals/search: post: description: Search hist signals. operationId: SearchSecurityMonitoringHistsignals requestBody: content: "application/json": examples: default: value: filter: from: "2019-01-02T09:42:36.320Z" query: "security:attack status:high" to: "2019-01-03T09:42:36.320Z" page: limit: 25 sort: timestamp schema: $ref: "#/components/schemas/SecurityMonitoringSignalListRequest" required: false responses: "200": content: application/json: examples: default: value: data: - attributes: message: A large number of failed login attempts. tags: - source:production timestamp: "2024-01-01T00:00:00+00:00" id: abc-123 type: signal schema: $ref: "#/components/schemas/SecurityMonitoringSignalsListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_signals_read summary: Search hist signals tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_signals_read x-unstable: |- **Note**: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates. /api/v2/siem-historical-detections/histsignals/{histsignal_id}: get: description: Get a hist signal's details. operationId: GetSecurityMonitoringHistsignal parameters: - $ref: "#/components/parameters/HistoricalSignalID" responses: "200": content: "application/json": examples: default: value: data: attributes: message: A large number of failed login attempts. tags: - source:production timestamp: "2024-01-01T00:00:00+00:00" id: abc-123 type: signal schema: $ref: "#/components/schemas/SecurityMonitoringSignalResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_signals_read summary: Get a hist signal's details tags: ["Security Monitoring"] "x-permission": operator: OR permissions: - security_monitoring_signals_read x-unstable: |- **Note**: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates. /api/v2/siem-historical-detections/jobs: get: description: List historical jobs. operationId: ListHistoricalJobs parameters: - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - description: The order of the jobs in results. example: "status" in: query name: sort required: false schema: type: string - description: Query used to filter items from the fetched list. example: "security:attack status:high" in: query name: filter[query] required: false schema: type: string responses: "200": content: "application/json": examples: default: value: data: - attributes: createdAt: "2024-01-01T00:00:00+00:00" createdByHandle: example-handle createdByName: Example Name jobName: Example Job jobStatus: COMPLETED id: abc-123 type: historicalDetectionsJob meta: totalCount: 1 schema: $ref: "#/components/schemas/ListHistoricalJobsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: List historical jobs tags: ["Security Monitoring"] x-unstable: |- **Note**: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates. post: description: |- Run a historical job. operationId: RunHistoricalJob requestBody: content: "application/json": examples: default: value: data: attributes: jobDefinition: cases: - condition: "a > 1" name: Condition 1 notifications: [] status: info from: 1730387522611 index: main message: "A large number of failed login attempts." name: "Excessive number of failed attempts." options: evaluationWindow: 900 keepAlive: 3600 maxSignalDuration: 86400 queries: - aggregation: count distinctFields: [] groupByFields: [] query: "source:non_existing_src_weekend" tags: [] to: 1730391122611 type: log_detection type: historicalDetectionsJobCreate schema: $ref: "#/components/schemas/RunHistoricalJobRequest" required: true responses: "201": content: "application/json": examples: default: value: data: id: abc-123 type: historicalDetectionsJob schema: $ref: "#/components/schemas/JobCreateResponse" description: Status created "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/ConcurrentModificationResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Run a historical job tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_rules_write x-unstable: |- **Note**: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates. /api/v2/siem-historical-detections/jobs/signal_convert: post: description: |- Convert a job result to a signal. operationId: ConvertJobResultToSignal requestBody: content: "application/json": examples: default: value: data: attributes: jobResultIds: - "" notifications: - "" signalMessage: A large number of failed login attempts. signalSeverity: critical type: historicalDetectionsJobResultSignalConversion schema: $ref: "#/components/schemas/ConvertJobResultsToSignalsRequest" required: true responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/ConcurrentModificationResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Convert a job result to a signal tags: ["Security Monitoring"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - security_monitoring_signals_write x-unstable: |- **Note**: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates. /api/v2/siem-historical-detections/jobs/{job_id}: delete: description: |- Delete an existing job. operationId: DeleteHistoricalJob parameters: - $ref: "#/components/parameters/HistoricalJobID" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/ConcurrentModificationResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete an existing job tags: ["Security Monitoring"] x-unstable: |- **Note**: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates. get: description: Get a job's details. operationId: GetHistoricalJob parameters: - $ref: "#/components/parameters/HistoricalJobID" responses: "200": content: "application/json": examples: default: value: data: attributes: createdAt: "2024-01-01T00:00:00+00:00" createdByHandle: example-handle createdByName: Example Name jobName: Example Job jobStatus: COMPLETED modifiedAt: "2024-01-01T00:00:00+00:00" signalOutput: false id: abc-123 type: historicalDetectionsJob schema: $ref: "#/components/schemas/HistoricalJobResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read summary: Get a job's details tags: ["Security Monitoring"] "x-permission": operator: OR permissions: - security_monitoring_rules_read x-unstable: |- **Note**: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates. /api/v2/siem-historical-detections/jobs/{job_id}/cancel: patch: description: Cancel a historical job. operationId: CancelHistoricalJob parameters: - $ref: "#/components/parameters/HistoricalJobID" responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "401": $ref: "#/components/responses/ConcurrentModificationResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Cancel a historical job tags: ["Security Monitoring"] "x-permission": operator: OR permissions: - security_monitoring_rules_write x-unstable: |- **Note**: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates. /api/v2/siem-historical-detections/jobs/{job_id}/histsignals: get: description: Get a job's hist signals. operationId: GetSecurityMonitoringHistsignalsByJobId parameters: - $ref: "#/components/parameters/HistoricalJobID" - $ref: "#/components/parameters/QueryFilterSearch" - $ref: "#/components/parameters/QueryFilterFrom" - $ref: "#/components/parameters/QueryFilterTo" - $ref: "#/components/parameters/QuerySort" - $ref: "#/components/parameters/QueryPageCursor" - $ref: "#/components/parameters/QueryPageLimit" responses: "200": content: application/json: examples: default: value: data: - attributes: message: A large number of failed login attempts. tags: - source:production timestamp: "2024-01-01T00:00:00+00:00" id: abc-123 type: signal schema: $ref: "#/components/schemas/SecurityMonitoringSignalsListResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_signals_read summary: Get a job's hist signals tags: ["Security Monitoring"] "x-permission": operator: OR permissions: - security_monitoring_signals_read x-unstable: |- **Note**: This endpoint is in beta and may be subject to changes. Please check the documentation regularly for updates. /api/v2/slo/report: post: deprecated: true description: |- Create a job to generate an SLO report. The report job is processed asynchronously and eventually results in a CSV report being available for download. Check the status of the job and download the CSV report using the returned `report_id`. operationId: CreateSLOReportJob requestBody: content: application/json: examples: default: value: data: attributes: from_ts: 1690901870 interval: weekly query: slo_type:metric timezone: America/New_York to_ts: 1706803070 schema: $ref: "#/components/schemas/SloReportCreateRequest" description: Create SLO report job request body. required: true responses: "200": content: application/json: examples: default: value: data: id: 00000000-0000-0000-0000-000000000001 type: report_id schema: $ref: "#/components/schemas/SLOReportPostResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - slos_read summary: Create a new SLO report tags: - Service Level Objectives x-codegen-request-body-name: body "x-permission": operator: OR permissions: - slos_read x-sunset: "2027-01-25" x-unstable: |- **Note**: This feature is in private beta and is no longer accepting requests for access. /api/v2/slo/report/{report_id}/download: get: deprecated: true description: |- Download an SLO report. This can only be performed after the report job has completed. Reports are not guaranteed to exist indefinitely. Datadog recommends that you download the report as soon as it is available. operationId: GetSLOReport parameters: - $ref: "#/components/parameters/ReportID" responses: "200": content: text/csv: examples: default: value: "slo_name,slo_id,sli,error_budget_remaining\nMy SLO,abc-123,99.95,99.5" schema: type: string description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - slos_read summary: Get SLO report tags: - Service Level Objectives x-sunset: "2027-01-25" x-unstable: |- **Note**: This feature is in private beta and is no longer accepting requests for access. /api/v2/slo/report/{report_id}/status: get: deprecated: true description: Get the status of the SLO report job. operationId: GetSLOReportJobStatus parameters: - $ref: "#/components/parameters/ReportID" responses: "200": content: application/json: examples: default: value: data: attributes: status: completed id: 00000000-0000-0000-0000-000000000002 type: report_id schema: $ref: "#/components/schemas/SLOReportStatusGetResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - slos_read summary: Get SLO report status tags: - Service Level Objectives x-sunset: "2027-01-25" x-unstable: |- **Note**: This feature is in private beta and is no longer accepting requests for access. /api/v2/slo/{slo_id}/status: get: description: |- Get the status of a Service Level Objective (SLO) for a given time period. This endpoint returns the current SLI value, error budget remaining, and other status information for the specified SLO. operationId: GetSloStatus parameters: - $ref: "#/components/parameters/SloID" - $ref: "#/components/parameters/FromTimestamp" - $ref: "#/components/parameters/ToTimestamp" - $ref: "#/components/parameters/DisableCorrections" responses: "200": content: application/json: examples: default: value: data: attributes: error_budget_remaining: 99.5 raw_error_budget_remaining: unit: seconds value: 86400.5 sli: 99.95 span_precision: 2 state: ok id: "00000000-0000-0000-0000-000000000000" type: slo_status schema: $ref: "#/components/schemas/SloStatusResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - slos_read summary: Get SLO status tags: - Service Level Objectives "x-permission": operator: OR permissions: - slos_read x-unstable: |- **Note**: This endpoint is in public beta and it's subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/snapshot: post: description: Create a snapshot of a graph widget. The snapshot is rendered asynchronously; the returned URL can be polled until the image is ready. operationId: CreateSnapshot requestBody: content: application/json: schema: $ref: "#/components/schemas/CreateSnapshotRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: url: https://app.datadoghq.com/api/v2/snapshot/view/public/60d/00000000-0000-0000-0000-000000000000/1692464400000-12345678-1234-5678-9abc-def123456789.png id: 12345678-1234-5678-9abc-def123456789 type: create_snapshot schema: $ref: "#/components/schemas/CreateSnapshotResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a graph snapshot tags: - Reporting And Sharing x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/sourcemaps: delete: description: |- Deletes source maps matching the specified filter criteria. Supports dry-run mode to preview which source maps would be deleted without performing the actual deletion. operationId: DeleteSourcemaps parameters: - description: |- The type of source map. Valid values are `js`, `jvm`, `ios`, `react`, `flutter`, `elf`, `ndk`, `il2cpp`, `wasm`, `portable_pdb`. in: query name: mapkind required: true schema: $ref: "#/components/schemas/SourcemapMapKind" - description: |- WASM symbol representation. Only supported for `mapkind=wasm`. Defaults to `dwarf`, which requires `filter[build_id]`. `sourcemap` requires `filter[service]` and `filter[version]`. in: query name: symbol_type schema: $ref: "#/components/schemas/SourcemapSymbolType" - description: |- When set to `true`, returns the source maps that would be deleted without performing the actual deletion. When set to `false`, performs the deletion. in: query name: dry_run required: true schema: example: true type: boolean - description: |- Filter by service names (multiple values allowed). Required for `js`, `jvm`, `react`, and `flutter` map kinds, and for `wasm` with `symbol_type=sourcemap`. explode: true in: query name: filter[service] schema: example: - my-web-service items: type: string type: array style: form - description: |- Filter by version values (multiple values allowed, maximum 10). Required for `js`, `jvm`, `react`, and `flutter` map kinds, and for `wasm` with `symbol_type=sourcemap`. explode: true in: query name: filter[version] schema: example: - 1.0.0 items: type: string type: array style: form - description: Filter by variant values (multiple values allowed). Supported for `jvm`. explode: true in: query name: filter[variant] schema: items: type: string type: array style: form - description: Filter by source map ID values (multiple values allowed). Supported for all map kinds. explode: true in: query name: filter[id] schema: items: type: string type: array style: form - description: |- Filter by build ID values (multiple values allowed). Supported for `jvm`, `ndk`, `il2cpp`, `wasm`, and `portable_pdb`. Required for `wasm` with `symbol_type=dwarf`. explode: true in: query name: filter[build_id] schema: items: type: string type: array style: form - description: Filter by UUID values (multiple values allowed). Supported for `ios`. explode: true in: query name: filter[uuid] schema: items: type: string type: array style: form - description: Filter by platform values (multiple values allowed). Supported for `react`. explode: true in: query name: filter[platform] schema: items: type: string type: array style: form - description: Filter by build number values (multiple values allowed). Supported for `react`. explode: true in: query name: filter[build_number] schema: items: type: string type: array style: form - description: Filter by bundle name values (multiple values allowed). Supported for `react`. explode: true in: query name: filter[bundle_name] schema: items: type: string type: array style: form - description: |- Filter by architecture values (multiple values allowed). Supported for `flutter`, `elf`, and `ndk`. explode: true in: query name: filter[arch] schema: items: type: string type: array style: form - description: Filter by symbol source values (multiple values allowed). Supported for `elf`. explode: true in: query name: filter[symbol_source] schema: items: type: string type: array style: form - description: Filter by origin values (multiple values allowed). Supported for `elf`. explode: true in: query name: filter[origin] schema: items: type: string type: array style: form - description: Filter by origin version values (multiple values allowed). Supported for `elf`. explode: true in: query name: filter[origin_version] schema: items: type: string type: array style: form - description: Filter by filename (single value). Supported for `js`, `elf`, `ndk`, `wasm`, and `portable_pdb`. in: query name: filter[filename] schema: type: string - description: Filter by debug ID (single value). Supported for `react`. in: query name: filter[debug_id] schema: type: string - description: Filter by GNU build ID (single value). Supported for `elf`. in: query name: filter[gnu_build_id] schema: type: string - description: Filter by Go build ID (single value). Supported for `elf`. in: query name: filter[go_build_id] schema: type: string - description: Filter by file hash (single value). Supported for `elf`. in: query name: filter[file_hash] schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: absolute_path: /js/bundle.min.js created_at: "2024-01-01T00:00:00Z" mapkind: js service: my-web-service size: 1024 version: 1.0.0 id: "5" type: sourcemaps schema: $ref: "#/components/schemas/SourcemapsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Delete source maps tags: - RUM x-permission: operator: OR permissions: - rum_delete_data x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: |- Retrieves the content of a specific JavaScript source map file. Provide either `debug_id` with a UUID, or all three of `filename`, `service`, and `version`. When `debug_id` is provided, filename, service, and version are not required and are ignored. **Examples:** the following commands use the US1 API host. Replace the host with the API host for your site, and the filename, service, version, and debug ID with values from your organization. Use `--get` so curl sends the parameters in the query string. **1. Retrieve a source map by debug ID** Provide `debug_id` with a UUID. No filename, service, or version is required. ```bash curl -sS --get "https://api.datadoghq.com/api/v2/sourcemaps" \ -H "Accept: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" \ --data-urlencode "debug_id=00000000-0000-4000-8000-000000000001" ``` **2. Retrieve a source map by service and version** Provide `filename` together with `service` and `version`. ```bash curl -sS --get "https://api.datadoghq.com/api/v2/sourcemaps" \ -H "Accept: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" \ --data-urlencode "filename=js/bundle.min.js.map" \ --data-urlencode "service=my-web-service" \ --data-urlencode "version=1.0.0" ``` operationId: GetSourcemaps parameters: - description: |- The debug ID of the JavaScript source map, in UUID format. When provided, filename, service, and version are not required and are ignored. in: query name: debug_id schema: example: 00000000-0000-4000-8000-000000000001 format: uuid type: string - description: The path to the source map file. Required when `debug_id` is omitted. in: query name: filename schema: example: js/bundle.min.js.map type: string - description: The service name associated with the source map. Required when `debug_id` is omitted. in: query name: service schema: example: my-web-service type: string - description: The version of the service associated with the source map. Required when `debug_id` is omitted. in: query name: version schema: example: 1.0.0 type: string responses: "200": content: application/json: examples: default: value: data: attributes: file: bundle.js mappings: AAAA,OAAO,CAAC,GAAG minifiedLineLengths: - 50 - 30 names: - console - log sourceRoot: / sources: - src/index.js - src/utils.js sourcesContent: - "console.log('index');" - "export function util() {}" version: 3 id: path/to/sourcemap.js.map type: sourcemap_files schema: $ref: "#/components/schemas/SourcemapFileResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Get a JavaScript source map tags: - RUM x-permission: operator: OR permissions: - rum_apps_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/sourcemaps/list: get: description: |- Retrieves a paginated list of source maps. Send filters as query parameters, not in a JSON request body. `mapkind` defaults to `js`. For JavaScript source maps, choose one of the three request shapes below. **Examples:** the following commands use the US1 API host. Replace the host with the API host for your site, and the service, version, debug ID, and cursor with values from your organization. Use `--get` so curl sends the filters in the query string; `-X GET` with `--data-urlencode` sends them in the request body instead. **1. List by service and version** Provide both `filter[service]` and `filter[version]` to search source maps indexed by service and version. Omit `search_by`. **Pagination:** prefer cursor pagination. Omit `page[after]` and `page[number]` on the first request. To get the next page, pass `meta.page.next_cursor` as `page[after]`, keeping the same filters. Continue until `meta.page.has_more_results` is `false`. Do not decode or modify the cursor. Legacy page-number pagination is also supported, starting at `page[number]=1`. ```bash curl -sS --get "https://api.datadoghq.com/api/v2/sourcemaps/list" \ -H "Accept: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" \ --data-urlencode "mapkind=js" \ --data-urlencode "filter[service]=my-web-service" \ --data-urlencode "filter[version]=1.0.0" \ --data-urlencode "page[size]=10" ``` **2. Find a specific JavaScript debug ID** Provide `filter[debug_id]` with a UUID. Service and version filters are not required. Omit `search_by`. **Pagination:** the lookup returns at most one result, so no pagination is needed. `page[after]` is not supported. ```bash curl -sS --get "https://api.datadoghq.com/api/v2/sourcemaps/list" \ -H "Accept: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" \ --data-urlencode "mapkind=js" \ --data-urlencode "filter[debug_id]=00000000-0000-4000-8000-000000000001" ``` **3. Browse source maps indexed by debug ID** Set `search_by=debug_id` without specifying a debug ID. Do not send service, version, or filename filters in this mode. **Pagination:** this mode requires cursor pagination; `page[number]` is not supported. Omit `page[after]` on the first request. To get the next page, pass `meta.page.next_cursor` as `page[after]`, keeping the same search mode and filters. Continue until `meta.page.has_more_results` is `false`. Do not decode or modify the cursor. First page: ```bash curl -sS --get "https://api.datadoghq.com/api/v2/sourcemaps/list" \ -H "Accept: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" \ --data-urlencode "mapkind=js" \ --data-urlencode "search_by=debug_id" \ --data-urlencode "page[size]=10" ``` Next page: ```bash curl -sS --get "https://api.datadoghq.com/api/v2/sourcemaps/list" \ -H "Accept: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" \ --data-urlencode "mapkind=js" \ --data-urlencode "search_by=debug_id" \ --data-urlencode "page[size]=10" \ --data-urlencode "page[after]=" ``` For other map kinds, use `page[number]`, starting at 1. operationId: ListSourcemaps parameters: - description: |- Set to `debug_id` to browse JavaScript source maps indexed by debug ID. Only supported for `mapkind=js`. Omit for service/version searches or a specific `filter[debug_id]` lookup. In debug-ID browse mode, service, version, and filename filters are not supported. example: debug_id in: query name: search_by schema: $ref: "#/components/schemas/SourcemapSearchBy" x-docs-curl-required: true - description: The type of source map. Defaults to `js`. in: query name: mapkind schema: $ref: "#/components/schemas/SourcemapMapKind" - description: |- WASM symbol representation. Only supported for `mapkind=wasm`. Defaults to `dwarf`, which requires `filter[build_id]`. `sourcemap` requires `filter[service]` and `filter[version]`. in: query name: symbol_type schema: $ref: "#/components/schemas/SourcemapSymbolType" - description: |- Cursor for the next page of a JavaScript listing. Use the value from `meta.page.next_cursor` and keep the same search mode and filters. Omit on the first request. Not supported for other map kinds or for a specific `filter[debug_id]` lookup without `search_by=debug_id`. in: query name: page[after] schema: type: string - description: The number of results per page. Defaults to 100. Must be at least 1; values above 1000 are capped at 1000. in: query name: page[size] schema: default: 100 example: 10 format: int64 minimum: 1 type: integer - description: |- Legacy page number, starting from 1. Prefer `page[after]` for JavaScript listings. Not supported with `search_by=debug_id`. Other map kinds default to page 1 when pagination parameters are omitted. in: query name: page[number] schema: example: 1 format: int64 minimum: 1 type: integer - description: |- Filter by service names (multiple values allowed). Required for `jvm`, `react`, and `flutter` map kinds, and for `wasm` with `symbol_type=sourcemap`. Also required for `js` unless searching by `filter[debug_id]` or browsing with `search_by=debug_id`. explode: true in: query name: filter[service] schema: example: - my-web-service items: type: string type: array style: form - description: |- Filter by version values (multiple values allowed). Required for `jvm`, `react`, and `flutter` map kinds, and for `wasm` with `symbol_type=sourcemap`. Also required for `js` unless searching by `filter[debug_id]` or browsing with `search_by=debug_id`. explode: true in: query name: filter[version] schema: example: - 1.0.0 items: type: string type: array style: form - description: Filter by variant values (multiple values allowed). Supported for `jvm`. explode: true in: query name: filter[variant] schema: items: type: string type: array style: form - description: Filter by source map ID values (multiple values allowed). Supported for all map kinds. explode: true in: query name: filter[id] schema: items: type: string type: array style: form - description: |- Filter by build ID values (multiple values allowed). Supported for `jvm`, `ndk`, `il2cpp`, `wasm`, and `portable_pdb`. Required for `wasm` with `symbol_type=dwarf`. explode: true in: query name: filter[build_id] schema: items: type: string type: array style: form - description: Filter by UUID values (multiple values allowed). Supported for `ios`. explode: true in: query name: filter[uuid] schema: items: type: string type: array style: form - description: Filter by platform values (multiple values allowed). Supported for `react`. explode: true in: query name: filter[platform] schema: items: type: string type: array style: form - description: Filter by build number values (multiple values allowed). Supported for `react`. explode: true in: query name: filter[build_number] schema: items: type: string type: array style: form - description: Filter by bundle name values (multiple values allowed). Supported for `react`. explode: true in: query name: filter[bundle_name] schema: items: type: string type: array style: form - description: |- Filter by architecture values (multiple values allowed). Supported for `flutter`, `elf`, and `ndk`. explode: true in: query name: filter[arch] schema: items: type: string type: array style: form - description: Filter by symbol source values (multiple values allowed). Supported for `elf`. explode: true in: query name: filter[symbol_source] schema: items: type: string type: array style: form - description: Filter by origin values (multiple values allowed). Supported for `elf`. explode: true in: query name: filter[origin] schema: items: type: string type: array style: form - description: Filter by origin version values (multiple values allowed). Supported for `elf`. explode: true in: query name: filter[origin_version] schema: items: type: string type: array style: form - description: Filter by filename (single value). Supported for `js`, `elf`, `ndk`, `wasm`, and `portable_pdb`. in: query name: filter[filename] schema: type: string - description: |- Filter by a single debug ID in UUID format. Supported for `js` and `react`. For `js`, the lookup returns at most one result and does not require service/version filters. For `react`, service/version filters remain required. in: query name: filter[debug_id] schema: format: uuid type: string - description: Filter by GNU build ID (single value). Supported for `elf`. in: query name: filter[gnu_build_id] schema: type: string - description: Filter by Go build ID (single value). Supported for `elf`. in: query name: filter[go_build_id] schema: type: string - description: Filter by file hash (single value). Supported for `elf`. in: query name: filter[file_hash] schema: type: string responses: "200": content: application/json: examples: debug_id_listing: summary: Browse JavaScript source maps by debug ID value: data: - attributes: created_at: "2024-01-01T00:00:00Z" debug_id: 00000000-0000-4000-8000-000000000001 mapkind: js size: 1024 id: "7" type: sourcemaps meta: page: has_more_results: true next_cursor: opaque-debug-id-cursor total_filtered_count: 0 default: value: data: - attributes: absolute_path: /js/bundle.min.js created_at: "2024-01-01T00:00:00Z" mapkind: js service: my-web-service size: 1024 version: 1.0.0 id: "5" type: sourcemaps meta: page: has_more_results: false total_filtered_count: 1 schema: $ref: "#/components/schemas/ListSourcemapsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "413": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Request Entity Too Large "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: List source maps tags: - RUM x-permission: operator: OR permissions: - rum_apps_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/sourcemaps/restore: patch: description: |- Restores previously deleted source maps matching the specified filter criteria. Supports dry-run mode to preview which source maps would be restored without performing the actual restoration. operationId: RestoreSourcemaps parameters: - description: |- The type of source map. Valid values are `js`, `jvm`, `ios`, `react`, `flutter`, `elf`, `ndk`, `il2cpp`, `wasm`, `portable_pdb`. in: query name: mapkind required: true schema: $ref: "#/components/schemas/SourcemapMapKind" - description: |- WASM symbol representation. Only supported for `mapkind=wasm`. Defaults to `dwarf`, which requires `filter[build_id]`. `sourcemap` requires `filter[service]` and `filter[version]`. in: query name: symbol_type schema: $ref: "#/components/schemas/SourcemapSymbolType" - description: |- When set to `true`, returns the source maps that would be restored without performing the actual restoration. When set to `false`, performs the restoration. in: query name: dry_run required: true schema: example: true type: boolean - description: |- Filter by service names (multiple values allowed). Required for `js`, `jvm`, `react`, and `flutter` map kinds, and for `wasm` with `symbol_type=sourcemap`. explode: true in: query name: filter[service] schema: example: - my-web-service items: type: string type: array style: form - description: |- Filter by version values (multiple values allowed, maximum 10). Required for `js`, `jvm`, `react`, and `flutter` map kinds, and for `wasm` with `symbol_type=sourcemap`. explode: true in: query name: filter[version] schema: example: - 1.0.0 items: type: string type: array style: form - description: Filter by variant values (multiple values allowed). Supported for `jvm`. explode: true in: query name: filter[variant] schema: items: type: string type: array style: form - description: Filter by source map ID values (multiple values allowed). Supported for all map kinds. explode: true in: query name: filter[id] schema: items: type: string type: array style: form - description: |- Filter by build ID values (multiple values allowed). Supported for `jvm`, `ndk`, `il2cpp`, `wasm`, and `portable_pdb`. Required for `wasm` with `symbol_type=dwarf`. explode: true in: query name: filter[build_id] schema: items: type: string type: array style: form - description: Filter by UUID values (multiple values allowed). Supported for `ios`. explode: true in: query name: filter[uuid] schema: items: type: string type: array style: form - description: Filter by platform values (multiple values allowed). Supported for `react`. explode: true in: query name: filter[platform] schema: items: type: string type: array style: form - description: Filter by build number values (multiple values allowed). Supported for `react`. explode: true in: query name: filter[build_number] schema: items: type: string type: array style: form - description: Filter by bundle name values (multiple values allowed). Supported for `react`. explode: true in: query name: filter[bundle_name] schema: items: type: string type: array style: form - description: |- Filter by architecture values (multiple values allowed). Supported for `flutter`, `elf`, and `ndk`. explode: true in: query name: filter[arch] schema: items: type: string type: array style: form - description: Filter by symbol source values (multiple values allowed). Supported for `elf`. explode: true in: query name: filter[symbol_source] schema: items: type: string type: array style: form - description: Filter by origin values (multiple values allowed). Supported for `elf`. explode: true in: query name: filter[origin] schema: items: type: string type: array style: form - description: Filter by origin version values (multiple values allowed). Supported for `elf`. explode: true in: query name: filter[origin_version] schema: items: type: string type: array style: form - description: Filter by filename (single value). Supported for `js`, `elf`, `ndk`, `wasm`, and `portable_pdb`. in: query name: filter[filename] schema: type: string - description: Filter by debug ID (single value). Supported for `react`. in: query name: filter[debug_id] schema: type: string - description: Filter by GNU build ID (single value). Supported for `elf`. in: query name: filter[gnu_build_id] schema: type: string - description: Filter by Go build ID (single value). Supported for `elf`. in: query name: filter[go_build_id] schema: type: string - description: Filter by file hash (single value). Supported for `elf`. in: query name: filter[file_hash] schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: absolute_path: /js/bundle.min.js created_at: "2024-01-01T00:00:00Z" mapkind: js service: my-web-service size: 1024 version: 1.0.0 id: "5" type: sourcemaps schema: $ref: "#/components/schemas/SourcemapsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Restore source maps tags: - RUM x-permission: operator: OR permissions: - rum_delete_data x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/sourcemaps/service_repository_info: post: description: |- Returns the repository URL and commit SHA associated with a debug ID or a given service and version. Provide either `debug_id`, or both `service` and `version`. When `debug_id` is set, it takes precedence. operationId: GetServiceRepositoryInfo requestBody: content: application/json: examples: default: value: data: attributes: service: my-web-service version: 1.0.0 type: service_repository_info schema: $ref: "#/components/schemas/ServiceRepositoryInfoRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: commit_sha: abc123def456789 repository_url: https://github.com/my-org/my-repo status: success id: my-web-service:1.0.0 type: service_repository_info schema: $ref: "#/components/schemas/ServiceRepositoryInfoResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Get service repository information tags: - RUM x-codegen-request-body-name: body x-permission: operator: OR permissions: - rum_apps_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/spans/analytics/aggregate: post: description: |- The API endpoint to aggregate spans into buckets and compute metrics and timeseries. This endpoint is rate limited to `50` requests per minute per organization. A request can generate at most 10,000 groups across all `group_by` entries, or 400,000 groups including time buckets when a `timeseries` compute is used. Set `limit` on each `group_by` entry to stay within these bounds. Requests over long time ranges or with many groups are more resource-intensive and can fail. To reduce load, narrow the time range or lower the `limit` on each `group_by` entry. operationId: AggregateSpans requestBody: content: "application/json": examples: default: value: data: attributes: compute: - aggregation: pc90 interval: 5m metric: "@duration" type: timeseries filter: from: now-15m query: service:web* AND @http.status_code:[200 TO 299] to: now group_by: - facet: service limit: 20 sort: aggregation: pc90 metric: "@duration" order: desc type: measure options: timezone: GMT type: aggregate_request schema: $ref: "#/components/schemas/SpansAggregateRequest" required: true responses: "200": content: application/json: examples: default: value: data: - attributes: by: host: my-hostname computes: c0: 19 id: abc-123 type: bucket meta: elapsed: 132 status: done schema: $ref: "#/components/schemas/SpansAggregateResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_read summary: Aggregate spans tags: ["Spans"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - apm_read /api/v2/spans/events: get: description: |- List endpoint returns spans that match a span search query. [Results are paginated][1]. Use this endpoint to see your latest spans. This endpoint is rate limited to `50` requests per minute per organization. [1]: /logs/guide/collect-multiple-logs-with-pagination?tab=v2api operationId: ListSpansGet parameters: - description: Search query following spans syntax. example: "@datacenter:us @role:db" in: query name: filter[query] required: false schema: type: string - description: Minimum timestamp for requested spans. Supports date-time ISO8601, date math, and regular timestamps (milliseconds). example: "2023-01-02T09:42:36.320Z" in: query name: filter[from] required: false schema: type: string - description: Maximum timestamp for requested spans. Supports date-time ISO8601, date math, and regular timestamps (milliseconds). example: "2023-01-03T09:42:36.320Z" in: query name: filter[to] required: false schema: type: string - description: Order of spans in results. in: query name: sort required: false schema: $ref: "#/components/schemas/SpansSort" - description: |- List following results with a cursor provided in the previous query. example: "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ==" in: query name: page[cursor] required: false schema: type: string - description: Maximum number of spans in the response. example: 25 in: query name: page[limit] required: false schema: default: 10 format: int32 maximum: 1000 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: service: web-store id: abc-123 type: spans schema: $ref: "#/components/schemas/SpansListResponse" description: OK "400": $ref: "#/components/responses/SpansBadRequestResponse" "403": $ref: "#/components/responses/SpansForbiddenResponse" "422": $ref: "#/components/responses/SpansUnprocessableEntityResponse" "429": $ref: "#/components/responses/SpansTooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_read summary: Get a list of spans tags: ["Spans"] x-pagination: cursorParam: page[cursor] cursorPath: meta.page.after limitParam: page[limit] resultsPath: data /api/v2/spans/events/search: post: description: |- List endpoint returns spans that match a span search query. [Results are paginated][1]. Use this endpoint to build complex spans filtering and search. This endpoint is rate limited to `50` requests per minute per organization. [1]: /logs/guide/collect-multiple-logs-with-pagination?tab=v2api operationId: ListSpans requestBody: content: "application/json": examples: default: value: data: attributes: filter: from: now-15m query: service:web* AND @http.status_code:[200 TO 299] to: now options: timezone: GMT page: cursor: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== limit: 25 sort: timestamp type: search_request schema: $ref: "#/components/schemas/SpansListRequest" required: true responses: "200": content: application/json: examples: default: value: data: - attributes: env: prod service: test-service id: AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA type: spans meta: elapsed: 132 status: done schema: $ref: "#/components/schemas/SpansListResponse" description: OK "400": $ref: "#/components/responses/SpansBadRequestResponse" "403": $ref: "#/components/responses/SpansForbiddenResponse" "422": $ref: "#/components/responses/SpansUnprocessableEntityResponse" "429": $ref: "#/components/responses/SpansTooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_read summary: Search spans tags: ["Spans"] x-codegen-request-body-name: body x-pagination: cursorParam: body.data.attributes.page.cursor cursorPath: meta.page.after limitParam: body.data.attributes.page.limit resultsPath: data /api/v2/static-analysis-sca/dependencies: post: operationId: CreateSCAResult requestBody: content: application/json: examples: default: value: data: type: scarequests schema: $ref: "#/components/schemas/ScaRequest" required: true responses: "200": description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - code_analysis_read summary: Post dependencies for analysis tags: - Static Analysis x-unstable: "**Note**: This endpoint may be subject to changes." /api/v2/static-analysis-sca/dependencies/scan: post: operationId: CreateSCAScan requestBody: content: application/json: examples: default: value: data: attributes: commit_hash: 0e9fc8de83eaabecd722e1cd0ed44fb489fe15fc libraries: - exclusions: [] is_dev: false is_direct: true package_manager: nuget purl: pkg:nuget/Newtonsoft.Json@13.0.1 target_frameworks: - net8.0 resource_name: my-org/my-repo type: mcpscanrequest schema: $ref: "#/components/schemas/McpScanRequest" required: true responses: "202": content: application/json: examples: default: value: data: attributes: job_id: 0190a3d4-1234-7000-8000-000000000000 id: 0190a3d4-1234-7000-8000-000000000000 type: mcpscanrequestresponse schema: $ref: "#/components/schemas/McpScanRequestResponse" description: Accepted "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - code_analysis_read summary: Submit libraries for vulnerability scanning tags: - Static Analysis x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/static-analysis-sca/dependencies/scan/{job_id}: get: operationId: GetSCAScan parameters: - description: The job identifier returned when the scan was submitted. in: path name: job_id required: true schema: example: 0190a3d4-1234-7000-8000-000000000000 type: string responses: "200": content: application/json: examples: default: value: vulnerabilities: [] schema: $ref: "#/components/schemas/ScanResultResponse" description: OK "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - code_analysis_read summary: Retrieve a dependency scan result tags: - Static Analysis x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/static-analysis-sca/licenses/list: get: operationId: ListSCALicenses responses: "200": content: application/json: examples: default: value: data: attributes: licenses: - display_name: MIT License identifier: MIT short_name: MIT id: 0190a3d4-1234-7000-8000-000000000000 type: licenserequest schema: $ref: "#/components/schemas/LicensesListResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get the list of SPDX licenses tags: - Static Analysis x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/static-analysis-sca/vulnerabilities/resolve-vulnerable-symbols: post: operationId: CreateSCAResolveVulnerableSymbols requestBody: content: application/json: examples: default: value: data: type: resolve-vulnerable-symbols-request schema: $ref: "#/components/schemas/ResolveVulnerableSymbolsRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: results: - purl: "pkg:npm/lodash@4.17.20" vulnerable_symbols: [] id: abc-123 type: resolve-vulnerable-symbols-response schema: $ref: "#/components/schemas/ResolveVulnerableSymbolsResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - code_analysis_read summary: POST request to resolve vulnerable symbols tags: - Static Analysis x-unstable: "**Note**: This endpoint may be subject to changes." /api/v2/static-analysis/ai/memory: get: description: Get all AI memory violation results for the authenticated organization. operationId: ListAiMemoryViolationResults responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" created_by: example-handle line: 10 message: This is a false positive. name: src/main.py repository_id: my-repo rule: my-ai-ruleset/my-ai-rule sha: abc123def456789012345678901234567890abcd type: FP id: "42" type: ai_memory_violation_result schema: $ref: "#/components/schemas/AiMemoryViolationResultsResponse" description: Successful response "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: List AI memory violation results tags: - Static Analysis x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Add a new AI memory violation result for the authenticated organization. operationId: CreateAiMemoryViolationResult requestBody: content: application/json: examples: default: value: data: attributes: line: 10 message: This is a false positive. name: src/main.py repository_id: my-repo rule: my-ai-ruleset/my-ai-rule sha: abc123def456789012345678901234567890abcd type: FP id: violation-abc type: ai_memory_violation_result schema: $ref: "#/components/schemas/AiMemoryViolationResultRequest" required: true responses: "200": description: Successfully created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Create an AI memory violation result tags: - Static Analysis x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/static-analysis/ai/memory/{id}: delete: description: Delete an AI memory violation result by its numeric identifier. operationId: DeleteAiMemoryViolationResult parameters: - description: The numeric identifier of the memory violation result. in: path name: id required: true schema: example: "42" type: string responses: "200": description: Successfully deleted "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Memory violation result not found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Delete an AI memory violation result tags: - Static Analysis x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/static-analysis/ai/prompts: get: description: Get all AI prompts, including default prompts and custom AI rule prompts for the authenticated organization. operationId: ListAiPrompts responses: "200": content: application/json: examples: default: value: data: - attributes: category: SECURITY checksum: abc123 content: Ruleset content cwe: "79" description: Ruleset description directories: [] execution_mode: auto file_search_keywords: [] globs: - "**/*.py" is_default: false is_testing: false language: PYTHON result_keywords_exclude: [] rule_version: "1" severity: ERROR short_description: Ruleset short description id: my-ai-ruleset/my-ai-rule type: ai_prompt schema: $ref: "#/components/schemas/AiPromptsResponse" description: Successful response "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: List AI prompts tags: - Static Analysis x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/static-analysis/ai/rulesets: get: description: Get all AI custom rulesets for the authenticated organization. operationId: ListAiCustomRulesets parameters: - description: The offset for pagination. in: query name: page[offset] required: false schema: default: 0 format: int64 type: integer - description: The maximum number of rulesets to return. in: query name: page[limit] required: false schema: default: 100 format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" created_by: example-handle description: Ruleset description name: my-ai-ruleset rules: [] short_description: Ruleset short description id: my-ai-ruleset type: ai_ruleset schema: $ref: "#/components/schemas/AiCustomRulesetsResponse" description: Successful response "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: List AI custom rulesets tags: - Static Analysis x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a new AI custom ruleset for the authenticated organization. operationId: CreateAiCustomRuleset requestBody: content: application/json: examples: default: value: data: attributes: description: Ruleset description name: my-ai-ruleset short_description: Ruleset short description id: my-ai-ruleset type: ai_ruleset schema: $ref: "#/components/schemas/AiCustomRulesetRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" created_by: example-handle description: Ruleset description name: my-ai-ruleset rules: [] short_description: Ruleset short description id: my-ai-ruleset type: ai_ruleset schema: $ref: "#/components/schemas/AiCustomRulesetResponse" description: Successfully created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict - ruleset already exists "412": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Precondition Failed - validation error "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Create an AI custom ruleset tags: - Static Analysis x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/static-analysis/ai/rulesets/{ruleset_name}: delete: description: Delete an AI custom ruleset by name. operationId: DeleteAiCustomRuleset parameters: - description: The ruleset name. in: path name: ruleset_name required: true schema: example: my-ai-ruleset type: string responses: "200": description: Successfully deleted "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Ruleset not found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Delete an AI custom ruleset tags: - Static Analysis x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get an AI custom ruleset by name. operationId: GetAiCustomRuleset parameters: - description: The ruleset name. in: path name: ruleset_name required: true schema: example: my-ai-ruleset type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" created_by: example-handle description: Ruleset description name: my-ai-ruleset rules: [] short_description: Ruleset short description id: my-ai-ruleset type: ai_ruleset schema: $ref: "#/components/schemas/AiCustomRulesetResponse" description: Successful response "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Ruleset not found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Get an AI custom ruleset tags: - Static Analysis x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: Update the description of an existing AI custom ruleset. operationId: UpdateAiCustomRuleset parameters: - description: The ruleset name. in: path name: ruleset_name required: true schema: example: my-ai-ruleset type: string requestBody: content: application/json: examples: default: value: data: attributes: description: Ruleset description name: my-ai-ruleset short_description: Ruleset short description id: my-ai-ruleset type: ai_ruleset schema: $ref: "#/components/schemas/AiCustomRulesetUpdateRequest" required: true responses: "200": description: Successfully updated "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "412": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Precondition Failed - validation error or ruleset not found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Update an AI custom ruleset tags: - Static Analysis x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/static-analysis/ai/rulesets/{ruleset_name}/rules: post: description: Create a new AI custom rule within a ruleset. operationId: CreateAiCustomRule parameters: - description: The ruleset name. in: path name: ruleset_name required: true schema: example: my-ai-ruleset type: string requestBody: content: application/json: examples: default: value: data: attributes: name: my-ai-rule type: ai_rule schema: $ref: "#/components/schemas/AiCustomRuleRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" created_by: example-handle last_revision: name: my-ai-rule id: my-ai-rule type: ai_rule schema: $ref: "#/components/schemas/AiCustomRuleResponse" description: Successfully created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict - rule already exists "412": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Precondition Failed - validation error or ruleset not found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Create an AI custom rule tags: - Static Analysis x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/static-analysis/ai/rulesets/{ruleset_name}/rules/{rule_name}: delete: description: Delete an AI custom rule by name within a ruleset. operationId: DeleteAiCustomRule parameters: - description: The ruleset name. in: path name: ruleset_name required: true schema: example: my-ai-ruleset type: string - description: The rule name. in: path name: rule_name required: true schema: example: my-ai-rule type: string responses: "200": description: Successfully deleted "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Rule not found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Delete an AI custom rule tags: - Static Analysis x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get an AI custom rule by name within a ruleset. operationId: GetAiCustomRule parameters: - description: The ruleset name. in: path name: ruleset_name required: true schema: example: my-ai-ruleset type: string - description: The rule name. in: path name: rule_name required: true schema: example: my-ai-rule type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" created_by: example-handle last_revision: name: my-ai-rule id: my-ai-rule type: ai_rule schema: $ref: "#/components/schemas/AiCustomRuleResponse" description: Successful response "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Rule not found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Get an AI custom rule tags: - Static Analysis x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/static-analysis/ai/rulesets/{ruleset_name}/rules/{rule_name}/revisions: get: description: Get all revisions for an AI custom rule. operationId: ListAiCustomRuleRevisions parameters: - description: The ruleset name. in: path name: ruleset_name required: true schema: example: my-ai-ruleset type: string - description: The rule name. in: path name: rule_name required: true schema: example: my-ai-rule type: string - description: The offset for pagination. in: query name: page[offset] required: false schema: default: 0 format: int64 type: integer - description: The maximum number of revisions to return. in: query name: page[limit] required: false schema: default: 100 format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: category: SECURITY checksum: abc123 content: Content created_at: "2024-01-01T00:00:00+00:00" created_by: example-handle cwe: description: Ruleset description directories: [] execution_mode: auto globs: - "**/*.py" is_default: false is_published: false is_testing: false severity: ERROR short_description: Ruleset short description version_id: 1 id: revision-abc-123 type: ai_rule_revision schema: $ref: "#/components/schemas/AiCustomRuleRevisionsResponse" description: Successful response "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Rule not found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: List AI custom rule revisions tags: - Static Analysis x-pagination: limitParam: page[limit] pageOffsetParam: page[offset] resultsPath: data x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a new revision for an AI custom rule. operationId: CreateAiCustomRuleRevision parameters: - description: The ruleset name. in: path name: ruleset_name required: true schema: example: my-ai-ruleset type: string - description: The rule name. in: path name: rule_name required: true schema: example: my-ai-rule type: string requestBody: content: application/json: examples: default: value: data: attributes: category: SECURITY content: Content description: Ruleset description directories: [] execution_mode: auto globs: - "**/*.py" is_published: false is_testing: false severity: ERROR short_description: Ruleset short description version_id: 1 id: revision-abc-123 type: ai_rule_revision schema: $ref: "#/components/schemas/AiCustomRuleRevisionRequest" required: true responses: "200": description: Successfully created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Rule not found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Create an AI custom rule revision tags: - Static Analysis x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/static-analysis/ai/rulesets/{ruleset_name}/rules/{rule_name}/revisions/{id}: get: description: Get a specific revision of an AI custom rule. operationId: GetAiCustomRuleRevision parameters: - description: The ruleset name. in: path name: ruleset_name required: true schema: example: my-ai-ruleset type: string - description: The rule name. in: path name: rule_name required: true schema: example: my-ai-rule type: string - description: The revision identifier. in: path name: id required: true schema: example: revision-abc-123 type: string responses: "200": content: application/json: examples: default: value: data: attributes: category: SECURITY checksum: abc123 content: Content created_at: "2024-01-01T00:00:00+00:00" created_by: example-handle cwe: description: Ruleset description directories: [] execution_mode: auto globs: - "**/*.py" is_default: false is_published: false is_testing: false severity: ERROR short_description: Ruleset short description version_id: 1 id: revision-abc-123 type: ai_rule_revision schema: $ref: "#/components/schemas/AiCustomRuleRevisionResponse" description: Successful response "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Revision not found "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error summary: Get an AI custom rule revision tags: - Static Analysis x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/static-analysis/codegen/rulesets: get: description: Get the rulesets relevant for code generation for the authenticated user. operationId: ListStaticAnalysisCodegenRulesets responses: "200": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/SastRulesetsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - code_analysis_read summary: List codegen rulesets tags: - "Security Monitoring" x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/static-analysis/custom/rulesets: get: description: Get all custom rulesets for the authenticated organization. operationId: ListCustomRulesets responses: "200": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/CustomRulesetListResponse" description: OK "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - code_analysis_read summary: List Custom Rulesets tags: - Static Analysis x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). put: description: Create a new custom ruleset for the authenticated organization. operationId: CreateCustomRuleset requestBody: content: application/json: examples: default: value: data: attributes: description: My custom ruleset. name: my-custom-ruleset id: my-custom-ruleset type: custom_ruleset schema: $ref: "#/components/schemas/CustomRulesetRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" created_by: example-handle description: Example ruleset description name: my-custom-ruleset rules: [] short_description: Short description id: my-custom-ruleset type: custom_ruleset schema: $ref: "#/components/schemas/CustomRulesetResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "412": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Precondition Failed "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - code_analysis_read summary: Create Custom Ruleset tags: - Static Analysis x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/static-analysis/custom/rulesets/{ruleset_name}: delete: description: Delete a custom ruleset operationId: DeleteCustomRuleset parameters: - description: The ruleset name in: path name: ruleset_name required: true schema: type: string responses: "200": description: Successfully deleted "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized - custom rules not enabled "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Ruleset not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete Custom Ruleset tags: - Static Analysis x-unstable: "This endpoint is in Preview and may introduce breaking changes.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." get: description: Get a custom ruleset by name operationId: GetCustomRuleset parameters: - description: The ruleset name in: path name: ruleset_name required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" created_by: example-handle description: Example ruleset description name: my-ruleset rules: [] short_description: Short description id: my-ruleset type: custom_ruleset schema: $ref: "#/components/schemas/CustomRulesetResponse" description: Successful response "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized - custom rules not enabled "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Ruleset not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Show Custom Ruleset tags: - Static Analysis x-unstable: "This endpoint is in Preview and may introduce breaking changes.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." patch: description: Update an existing custom ruleset operationId: UpdateCustomRuleset parameters: - description: The ruleset name in: path name: ruleset_name required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: name: my-ruleset rules: - id: my-rule last_revision: creation_message: Initial revision name: my-rule id: my-ruleset type: custom_ruleset schema: $ref: "#/components/schemas/CustomRulesetRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" created_by: example-handle description: Example ruleset description name: my-ruleset rules: [] short_description: Short description id: my-ruleset type: custom_ruleset schema: $ref: "#/components/schemas/CustomRulesetResponse" description: Successfully updated "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized - custom rules not enabled "412": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Precondition failed - validation error or ruleset not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update Custom Ruleset tags: - Static Analysis x-unstable: "This endpoint is in Preview and may introduce breaking changes.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." /api/v2/static-analysis/custom/rulesets/{ruleset_name}/rules: put: description: Create a new custom rule within a ruleset operationId: CreateCustomRule parameters: - description: The ruleset name in: path name: ruleset_name required: true schema: type: string requestBody: content: application/json: examples: default: value: data: type: custom_rule schema: $ref: "#/components/schemas/CustomRuleRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" created_by: example-handle last_revision: arguments: [] category: SECURITY checksum: 8a66c4e4e631099ad71be3c1ea3ea8fc2d57193e56db2c296e2dd8a508b26b99 code: Y29uZHVjdG9yOgogICAgLSBkZXBsb3lfb25seTogdHJ1ZQ== created_at: "2024-01-01T00:00:00+00:00" created_by: example-handle creation_message: Initial revision description: Example ruleset description id: revision-abc-123 is_published: true is_testing: false language: PYTHON severity: ERROR short_description: Short description should_use_ai_fix: false tags: [] tests: [] tree_sitter_query: Y29uZHVjdG9yOgogICAgLSBkZXBsb3lfb25seTogdHJ1ZQ== version_id: 1 name: my-rule revisions: [] id: my-rule type: custom_rule schema: $ref: "#/components/schemas/CustomRuleResponse" description: Successfully created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized - custom rules not enabled "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict - rule already exists "412": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Precondition failed - validation error or ruleset not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create Custom Rule tags: - Static Analysis x-unstable: "This endpoint is in Preview and may introduce breaking changes.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." /api/v2/static-analysis/custom/rulesets/{ruleset_name}/rules/{rule_name}: delete: description: Delete a custom rule operationId: DeleteCustomRule parameters: - description: The ruleset name in: path name: ruleset_name required: true schema: type: string - description: The rule name in: path name: rule_name required: true schema: type: string responses: "200": description: Successfully deleted "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized - custom rules not enabled "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Rule not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete Custom Rule tags: - Static Analysis x-unstable: "This endpoint is in Preview and may introduce breaking changes.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." get: description: Get a custom rule by name operationId: GetCustomRule parameters: - description: The ruleset name in: path name: ruleset_name required: true schema: type: string - description: The rule name in: path name: rule_name required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" created_by: example-handle last_revision: arguments: [] category: SECURITY checksum: 8a66c4e4e631099ad71be3c1ea3ea8fc2d57193e56db2c296e2dd8a508b26b99 code: Y29uZHVjdG9yOgogICAgLSBkZXBsb3lfb25seTogdHJ1ZQ== created_at: "2024-01-01T00:00:00+00:00" created_by: example-handle creation_message: Initial revision description: Example ruleset description id: revision-abc-123 is_published: true is_testing: false language: PYTHON severity: ERROR short_description: Short description should_use_ai_fix: false tags: [] tests: [] tree_sitter_query: Y29uZHVjdG9yOgogICAgLSBkZXBsb3lfb25seTogdHJ1ZQ== version_id: 1 name: my-rule revisions: [] id: my-rule type: custom_rule schema: $ref: "#/components/schemas/CustomRuleResponse" description: Successful response "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized - custom rules not enabled "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Rule not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Show Custom Rule tags: - Static Analysis x-unstable: "This endpoint is in Preview and may introduce breaking changes.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." /api/v2/static-analysis/custom/rulesets/{ruleset_name}/rules/{rule_name}/revisions: get: description: Get all revisions for a custom rule operationId: ListCustomRuleRevisions parameters: - description: The ruleset name in: path name: ruleset_name required: true schema: type: string - description: The rule name in: path name: rule_name required: true schema: type: string - description: Pagination offset in: query name: page[offset] required: false schema: default: 0 format: int64 type: integer - description: Pagination limit in: query name: page[limit] required: false schema: default: 10 format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: arguments: [] category: SECURITY checksum: 8a66c4e4e631099ad71be3c1ea3ea8fc2d57193e56db2c296e2dd8a508b26b99 code: Y29uZHVjdG9yOgogICAgLSBkZXBsb3lfb25seTogdHJ1ZQ== created_at: "2024-01-01T00:00:00+00:00" created_by: example-handle creation_message: Initial revision description: Example ruleset description is_published: false is_testing: false language: PYTHON severity: ERROR short_description: Short description should_use_ai_fix: false tags: [] tests: [] tree_sitter_query: Y29uZHVjdG9yOgogICAgLSBkZXBsb3lfb25seTogdHJ1ZQ== version_id: 1 id: revision-123 type: custom_rule_revision schema: $ref: "#/components/schemas/CustomRuleRevisionsResponse" description: Successful response "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized - custom rules not enabled "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Rule not found "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too many requests summary: List Custom Rule Revisions tags: - Static Analysis x-pagination: limitParam: page[limit] pageOffsetParam: page[offset] resultsPath: data x-unstable: "This endpoint is in Preview and may introduce breaking changes.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." put: description: Create a new revision for a custom rule operationId: CreateCustomRuleRevision parameters: - description: The ruleset name in: path name: ruleset_name required: true schema: type: string - description: The rule name in: path name: rule_name required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: arguments: - description: Maximum call depth to analyze name: max_depth category: SECURITY code: "def rule(node): return node.type == 'call'" creation_message: Initial revision cve: CVE-2024-1234 cwe: CWE-79 description: Detects insecure coding patterns that may lead to vulnerabilities documentation_url: https://docs.example.com/rules/my-rule is_published: false is_testing: false language: PYTHON severity: ERROR short_description: Rule to detect insecure patterns should_use_ai_fix: false tags: - security - custom tests: - annotation_count: 1 code: "result = insecure_function()" filename: test.yaml tree_sitter_query: "(call_expression) @call" type: custom_rule_revision schema: $ref: "#/components/schemas/CustomRuleRevisionRequest" required: true responses: "200": description: Successfully created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized - custom rules not enabled "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Rule not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create Custom Rule Revision tags: - Static Analysis x-unstable: "This endpoint is in Preview and may introduce breaking changes.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." /api/v2/static-analysis/custom/rulesets/{ruleset_name}/rules/{rule_name}/revisions/revert: post: description: Revert a custom rule to a previous revision operationId: RevertCustomRuleRevision parameters: - description: The ruleset name in: path name: ruleset_name required: true schema: type: string - description: The rule name in: path name: rule_name required: true schema: type: string requestBody: content: application/json: examples: default: value: data: type: revert_custom_rule_revision_request schema: $ref: "#/components/schemas/RevertCustomRuleRevisionRequest" required: true responses: "200": description: Successfully reverted "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized - custom rules not enabled "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Revert Custom Rule Revision tags: - Static Analysis x-unstable: "This endpoint is in Preview and may introduce breaking changes.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." /api/v2/static-analysis/custom/rulesets/{ruleset_name}/rules/{rule_name}/revisions/{id}: get: description: Get a specific revision of a custom rule operationId: GetCustomRuleRevision parameters: - description: The ruleset name in: path name: ruleset_name required: true schema: type: string - description: The rule name in: path name: rule_name required: true schema: type: string - description: The revision ID in: path name: id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: arguments: [] category: SECURITY checksum: 8a66c4e4e631099ad71be3c1ea3ea8fc2d57193e56db2c296e2dd8a508b26b99 code: Y29uZHVjdG9yOgogICAgLSBkZXBsb3lfb25seTogdHJ1ZQ== created_at: "2024-01-01T00:00:00+00:00" created_by: example-handle creation_message: Initial revision description: Example ruleset description is_published: false is_testing: false language: PYTHON severity: ERROR short_description: Short description should_use_ai_fix: false tags: [] tests: [] tree_sitter_query: Y29uZHVjdG9yOgogICAgLSBkZXBsb3lfb25seTogdHJ1ZQ== version_id: 1 id: revision-123 type: custom_rule_revision schema: $ref: "#/components/schemas/CustomRuleRevisionResponse" description: Successful response "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized - custom rules not enabled "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Revision not found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Show Custom Rule Revision tags: - Static Analysis x-unstable: "This endpoint is in Preview and may introduce breaking changes.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." /api/v2/static-analysis/default-rulesets/{language}: get: description: Get the default SAST ruleset names for a given programming language. operationId: GetStaticAnalysisDefaultRulesets parameters: - description: The programming language for which to retrieve the default rulesets. in: path name: language required: true schema: example: python type: string responses: "200": content: application/json: examples: default: value: data: attributes: rulesets: - python-best-practices id: python type: defaultRulesetsPerLanguage schema: $ref: "#/components/schemas/DefaultRulesetsPerLanguageResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - code_analysis_read summary: Get default rulesets for a language tags: - "Security Monitoring" x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/static-analysis/rulesets: post: description: Get rules for multiple rulesets in batch. operationId: ListMultipleRulesets requestBody: content: application/json: examples: default: value: data: type: get_multiple_rulesets_request schema: $ref: "#/components/schemas/GetMultipleRulesetsRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: rulesets: [] id: abc-123 type: get_multiple_rulesets_response schema: $ref: "#/components/schemas/GetMultipleRulesetsResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - code_analysis_read summary: Ruleset get multiple tags: - "Security Monitoring" x-unstable: "**Note**: This endpoint may be subject to changes." /api/v2/static-analysis/rulesets/{ruleset_name}: get: description: Get a SAST ruleset by name, including all its rules. operationId: GetStaticAnalysisRuleset parameters: - description: The name of the ruleset to retrieve. in: path name: ruleset_name required: true schema: example: python-best-practices type: string - description: When true, test cases for each rule are included in the response. in: query name: include_tests required: false schema: type: boolean - description: When true, rules that are in testing mode are included in the response. in: query name: include_testing_rules required: false schema: type: boolean responses: "200": content: application/json: examples: default: value: data: attributes: description: A collection of Python best practice rules. name: python-best-practices rules: [] short_description: Python best practices. id: python-best-practices type: rulesets schema: $ref: "#/components/schemas/SastRulesetResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - code_analysis_read summary: Get a SAST ruleset tags: - "Security Monitoring" x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/static-analysis/secrets/rules: get: description: |- Returns a list of Secrets rules with ID, Pattern, Description, Priority, and SDS ID. operationId: GetSecretsRules responses: "200": content: application/json: examples: default: value: data: - attributes: description: "Detects example secrets" name: "Example Secret Rule" pattern: "[A-Za-z0-9]{32}" priority: "1" id: abc-123 type: secret_rule schema: $ref: "#/components/schemas/SecretRuleArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - code_analysis_read summary: Returns a list of Secrets rules tags: - "Security Monitoring" x-unstable: "**Note**: This endpoint may be subject to changes." /api/v2/static-analysis/static-analysis-server/analyze: post: description: Run static analysis rules against a source code file and return violations found. operationId: CreateStaticAnalysisServerAnalysis requestBody: content: application/json: examples: default: value: data: attributes: code: aW1wb3J0IHN5cw== file_encoding: utf-8 filename: test.py language: python rules: [] type: analysis_request schema: $ref: "#/components/schemas/AnalysisRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: errors: [] rule_responses: [] id: abc-123 type: server_request schema: $ref: "#/components/schemas/AnalysisResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - code_analysis_read summary: Analyze code tags: - Security Monitoring x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/static-analysis/static-analysis-server/get-ast: post: description: Parse source code into an abstract syntax tree (AST) for the specified language. operationId: CreateStaticAnalysisAst requestBody: content: application/json: examples: default: value: data: attributes: code: aW1wb3J0IHN5cw== file_encoding: utf-8 language: python type: get_ast_request schema: $ref: "#/components/schemas/GetAstRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: result: ast_type: module children: [] end: col: 11 line: 1 start: col: 1 line: 1 id: abc-123 type: get_ast_response schema: $ref: "#/components/schemas/GetAstResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - code_analysis_read summary: Get AST for source code tags: - Security Monitoring x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/static-analysis/static-analysis-server/node-types/{language}: get: description: Retrieve tree-sitter node type definitions for a given programming language. operationId: GetStaticAnalysisNodeTypes parameters: - description: The programming language for which to retrieve node type definitions. in: path name: language required: true schema: example: python type: string responses: "200": content: application/json: examples: default: value: data: attributes: node_types: [] id: python type: get_node_types_response schema: $ref: "#/components/schemas/NodeTypesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - code_analysis_read summary: Get node types for a language tags: - Security Monitoring x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/static-analysis/static-analysis-server/tree-sitter-wasm/{file}: get: description: Download the WebAssembly binary for a tree-sitter grammar by file name. operationId: GetStaticAnalysisTreeSitterWasm parameters: - description: The name of the WASM file to download. in: path name: file required: true schema: example: tree-sitter-python.wasm type: string responses: "200": content: application/octet-stream: examples: default: value: "" schema: format: binary type: string description: BLOB with the content of the WASM file "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - code_analysis_read summary: Get tree-sitter WASM file tags: - Security Monitoring x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/statuspages: get: description: Lists all status pages for the organization. operationId: ListStatusPages parameters: - description: Offset to use as the start of the page. in: query name: page[offset] schema: default: 0 format: int64 type: integer - description: The number of status pages to return per page. in: query name: page[limit] schema: default: 50 format: int64 type: integer - description: Filter status pages by exact domain prefix match. Returns at most one result. in: query name: filter[domain_prefix] schema: type: string - description: Filter status pages by name with case-insensitive substring matching. in: query name: filter[name] schema: type: string - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user." in: query name: include schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: components: [] domain_prefix: status-page-us1 enabled: true name: Status Page US1 subscriptions_enabled: true type: public visualization_type: bars_and_uptime_percentage id: 00000000-0000-0000-0000-000000000001 type: status_pages schema: $ref: "#/components/schemas/StatusPageArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_read summary: List status pages tags: - Status Pages x-permission: operator: AND permissions: - status_pages_settings_read post: description: "Creates a new status page in an unpublished state. Use the dedicated [publish](#publish-status-page) status page endpoint to publish the page after creation." operationId: CreateStatusPage parameters: - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user." in: query name: include schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: company_logo: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAIKMMMM components: - name: API position: 0 type: component - components: - name: Login position: 0 type: component - name: Settings position: 1 type: component name: Web App position: 1 type: group - name: Webhooks position: 2 type: component domain_prefix: status-page-us1 email_header_image: data:image/png;base64,pQSLAw0KGgoAAAANSUhEUgAAAQ4AASJKFF favicon: data:image/png;base64,kWMRNw0KGgoAAAANSUhEUgAAAEAAAABACA name: Status Page US1 subscriptions_enabled: true type: public visualization_type: bars_and_uptime_percentage type: status_pages schema: $ref: "#/components/schemas/CreateStatusPageRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: components: [] domain_prefix: status-page-us1 enabled: false name: Status Page US1 subscriptions_enabled: true type: public visualization_type: bars_and_uptime_percentage id: 00000000-0000-0000-0000-000000000002 type: status_pages schema: $ref: "#/components/schemas/StatusPage" description: Created "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_write summary: Create status page tags: - Status Pages x-permission: operator: AND permissions: - status_pages_settings_write /api/v2/statuspages/degradations: get: description: Lists all degradations for the organization. Optionally filter by status and page. operationId: ListDegradations parameters: - description: Optional page id filter. in: query name: filter[page_id] schema: type: string - description: Offset to use as the start of the page. in: query name: page[offset] schema: default: 0 format: int64 type: integer - description: The number of degradations to return per page. in: query name: page[limit] schema: default: 50 format: int64 type: integer - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page." in: query name: include schema: type: string - description: "Optional degradation status filter. Supported values: investigating, identified, monitoring, resolved." in: query name: filter[status] schema: type: string - description: "Sort order. Prefix with '-' for descending. Supported values: created_at, -created_at, modified_at, -modified_at." in: query name: sort schema: type: string - description: Optional source ID filter. Returns only degradations whose source matches this ID (for example, an incident ID). in: query name: filter[source_id] schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: components_affected: [] created_at: "2024-01-01T00:00:00+00:00" description: Our API is experiencing elevated latency. modified_at: "2024-01-01T00:00:00+00:00" status: investigating title: Elevated API Latency updates: [] id: 00000000-0000-0000-0000-000000000005 type: degradations schema: $ref: "#/components/schemas/DegradationArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_read summary: List degradations tags: - Status Pages x-permission: operator: AND permissions: - status_pages_settings_read /api/v2/statuspages/maintenances: get: description: Lists all maintenances for the organization. Optionally filter by status and page. operationId: ListMaintenances parameters: - description: Optional page id filter. in: query name: filter[page_id] schema: type: string - description: Offset to use as the start of the page. in: query name: page[offset] schema: default: 0 format: int64 type: integer - description: The number of maintenances to return per page. in: query name: page[limit] schema: default: 50 format: int64 type: integer - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page." in: query name: include schema: type: string - description: "Optional maintenance status filter. Supported values: scheduled, in_progress, completed." in: query name: filter[status] schema: type: string - description: "Sort order. Prefix with '-' for descending. Supported values: created_at, -created_at, start_date, -start_date." in: query name: sort schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: completed_date: "2024-01-01T01:00:00+00:00" completed_description: We have completed maintenance on the API. components_affected: [] in_progress_description: We are currently performing maintenance on the API. scheduled_description: We will be performing maintenance on the API. start_date: "2024-01-01T00:00:00+00:00" status: scheduled title: API Maintenance id: 00000000-0000-0000-0000-000000000016 type: maintenances schema: $ref: "#/components/schemas/MaintenanceArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_read summary: List maintenances tags: - Status Pages x-permission: operator: AND permissions: - status_pages_settings_read /api/v2/statuspages/{page_id}: delete: description: Deletes a status page by its ID. operationId: DeleteStatusPage parameters: - description: The ID of the status page. in: path name: page_id required: true schema: example: 1234abcd-12ab-34cd-56ef-123456abcdef format: uuid type: string responses: "204": description: No Content "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_write summary: Delete status page tags: - Status Pages x-permission: operator: AND permissions: - status_pages_settings_write get: description: Retrieves a specific status page by its ID. operationId: GetStatusPage parameters: - description: The ID of the status page. in: path name: page_id required: true schema: example: 1234abcd-12ab-34cd-56ef-123456abcdef format: uuid type: string - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user." in: query name: include schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: components: [] domain_prefix: status-page-us1 enabled: true name: Status Page US1 subscriptions_enabled: true type: public visualization_type: bars_and_uptime_percentage id: 00000000-0000-0000-0000-000000000007 type: status_pages schema: $ref: "#/components/schemas/StatusPage" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_read summary: Get status page tags: - Status Pages x-permission: operator: AND permissions: - status_pages_settings_read patch: description: "Updates an existing status page's attributes. To publish and unpublish status pages, use the dedicated [publish](#publish-status-page) and [unpublish](#unpublish-status-page) status page endpoints." operationId: UpdateStatusPage parameters: - description: Whether to delete existing subscribers when updating a status page's type. in: query name: delete_subscribers schema: default: false type: boolean - description: The ID of the status page. in: path name: page_id required: true schema: example: 1234abcd-12ab-34cd-56ef-123456abcdef format: uuid type: string - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user." in: query name: include schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: company_logo: data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAIKMMMM domain_prefix: status-page-us1-east email_header_image: data:image/png;base64,pQSLAw0KGgoAAAANSUhEUgAAAQ4AASJKFF favicon: data:image/png;base64,kWMRNw0KGgoAAAANSUhEUgAAAEAAAABACA name: Status Page US1 East subscriptions_enabled: false type: internal visualization_type: bars_only id: 1234abcd-12ab-34cd-56ef-123456abcdef type: status_pages schema: $ref: "#/components/schemas/PatchStatusPageRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: components: [] domain_prefix: status-page-us1-east enabled: false name: Status Page US1 East subscriptions_enabled: false type: internal visualization_type: bars_only id: 00000000-0000-0000-0000-000000000006 type: status_pages schema: $ref: "#/components/schemas/StatusPage" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_write summary: Update status page tags: - Status Pages x-permission: operator: AND permissions: - status_pages_settings_write /api/v2/statuspages/{page_id}/components: get: description: Lists all components for a status page. operationId: ListComponents parameters: - description: The ID of the status page. in: path name: page_id required: true schema: example: 1234abcd-12ab-34cd-56ef-123456abcdef format: uuid type: string - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page, group." in: query name: include schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: name: Metrics Intake position: 0 status: operational type: component id: 00000000-0000-0000-0000-000000000008 type: components schema: $ref: "#/components/schemas/StatusPagesComponentArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_read summary: List components tags: - Status Pages x-permission: operator: AND permissions: - status_pages_settings_read post: description: Creates a new component. operationId: CreateComponent parameters: - description: The ID of the status page. in: path name: page_id required: true schema: example: 1234abcd-12ab-34cd-56ef-123456abcdef format: uuid type: string - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page, group." in: query name: include schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: name: Metrics Intake position: 0 type: component relationships: group: data: type: components schema: $ref: "#/components/schemas/CreateComponentRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: name: Metrics Intake position: 0 status: operational type: component id: 00000000-0000-0000-0000-000000000009 type: components schema: $ref: "#/components/schemas/StatusPagesComponent" description: Created "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_write summary: Create component tags: - Status Pages x-permission: operator: AND permissions: - status_pages_settings_write /api/v2/statuspages/{page_id}/components/{component_id}: delete: description: Deletes a component by its ID. operationId: DeleteComponent parameters: - description: The ID of the status page. in: path name: page_id required: true schema: example: 1234abcd-12ab-34cd-56ef-123456abcdef format: uuid type: string - description: The ID of the component. in: path name: component_id required: true schema: example: 1234abcd-12ab-34cd-56ef-123456abcdef format: uuid type: string responses: "204": description: No Content "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_write summary: Delete component tags: - Status Pages x-permission: operator: AND permissions: - status_pages_settings_write get: description: Retrieves a specific component by its ID. operationId: GetComponent parameters: - description: The ID of the status page. in: path name: page_id required: true schema: example: 1234abcd-12ab-34cd-56ef-123456abcdef format: uuid type: string - description: The ID of the component. in: path name: component_id required: true schema: example: 1234abcd-12ab-34cd-56ef-123456abcdef format: uuid type: string - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page, group." in: query name: include schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: name: Metrics Intake position: 0 status: operational type: component id: 00000000-0000-0000-0000-000000000012 type: components schema: $ref: "#/components/schemas/StatusPagesComponent" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_read summary: Get component tags: - Status Pages x-permission: operator: AND permissions: - status_pages_settings_read patch: description: Updates an existing component's attributes. operationId: UpdateComponent parameters: - description: The ID of the status page. in: path name: page_id required: true schema: example: 1234abcd-12ab-34cd-56ef-123456abcdef format: uuid type: string - description: The ID of the component. in: path name: component_id required: true schema: example: 1234abcd-12ab-34cd-56ef-123456abcdef format: uuid type: string - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page, group." in: query name: include schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: name: Metrics Intake Service position: 4 id: 1234abcd-12ab-34cd-56ef-123456abcdef type: components schema: $ref: "#/components/schemas/PatchComponentRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: name: Metrics Intake Service position: 4 status: operational type: component id: 00000000-0000-0000-0000-000000000011 type: components schema: $ref: "#/components/schemas/StatusPagesComponent" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_write summary: Update component tags: - Status Pages x-permission: operator: AND permissions: - status_pages_settings_write /api/v2/statuspages/{page_id}/degradation_templates: get: description: Lists all degradation templates for a status page. operationId: ListDegradationTemplates parameters: - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page." in: query name: include schema: type: string - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string responses: "200": content: application/json: examples: default: value: data: - attributes: components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: degraded degradation_title: Elevated API Latency name: Elevated API Latency updates: - message: We are investigating the issue. status: investigating id: 00000000-0000-0000-0000-000000000003 type: degradation_templates schema: $ref: "#/components/schemas/DegradationTemplateArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_read summary: List degradation templates tags: - Status Pages post: description: Creates a new degradation template. operationId: CreateDegradationTemplate parameters: - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page." in: query name: include schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: degraded degradation_title: Elevated API Latency name: Elevated API Latency updates: - message: We are investigating the issue. status: investigating type: degradation_templates schema: $ref: "#/components/schemas/CreateDegradationTemplateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: degraded degradation_title: Elevated API Latency name: Elevated API Latency updates: - message: We are investigating the issue. status: investigating id: 00000000-0000-0000-0000-000000000003 type: degradation_templates schema: $ref: "#/components/schemas/DegradationTemplate" description: Created "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_write summary: Create degradation template tags: - Status Pages /api/v2/statuspages/{page_id}/degradation_templates/{template_id}: delete: description: Deletes a degradation template by its ID (soft delete). operationId: DeleteDegradationTemplate parameters: - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string - description: The ID of the degradation or maintenance template. in: path name: template_id required: true schema: format: uuid type: string responses: "204": description: No Content "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_write summary: Delete degradation template tags: - Status Pages get: description: Retrieves a specific degradation template by its ID. operationId: GetDegradationTemplate parameters: - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string - description: The ID of the degradation or maintenance template. in: path name: template_id required: true schema: format: uuid type: string - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page." in: query name: include schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: degraded degradation_title: Elevated API Latency name: Elevated API Latency updates: - message: We are investigating the issue. status: investigating id: 00000000-0000-0000-0000-000000000003 type: degradation_templates schema: $ref: "#/components/schemas/DegradationTemplate" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_read summary: Get degradation template tags: - Status Pages patch: description: Updates an existing degradation template's attributes. operationId: UpdateDegradationTemplate parameters: - description: The ID of the degradation or maintenance template. in: path name: template_id required: true schema: format: uuid type: string - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page." in: query name: include schema: type: string - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: degradation_title: Elevated API Latency for 40 minutes name: Elevated API Latency id: 00000000-0000-0000-0000-000000000003 type: degradation_templates schema: $ref: "#/components/schemas/PatchDegradationTemplateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: degraded degradation_title: Elevated API Latency for 40 minutes name: Elevated API Latency updates: - message: We are investigating the issue. status: investigating id: 00000000-0000-0000-0000-000000000003 type: degradation_templates schema: $ref: "#/components/schemas/DegradationTemplate" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_write summary: Update degradation template tags: - Status Pages /api/v2/statuspages/{page_id}/degradations: post: description: Creates a new degradation. operationId: CreateDegradation parameters: - description: The ID of the status page. in: path name: page_id required: true schema: example: 1234abcd-12ab-34cd-56ef-123456abcdef format: uuid type: string - description: Whether to notify page subscribers of the degradation. in: query name: notify_subscribers schema: default: true type: boolean - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page." in: query name: include schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: degraded description: Our API is experiencing elevated latency. We are investigating the issue. status: investigating title: Elevated API Latency type: degradations schema: $ref: "#/components/schemas/CreateDegradationRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: components_affected: - id: 00000000-0000-0000-0000-000000000019 status: degraded created_at: "2024-01-01T00:00:00+00:00" description: Our API is experiencing elevated latency. We are investigating the issue. modified_at: "2024-01-01T00:00:00+00:00" status: investigating title: Elevated API Latency updates: [] id: 00000000-0000-0000-0000-000000000010 type: degradations schema: $ref: "#/components/schemas/Degradation" description: Created "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_incident_write summary: Create degradation tags: - Status Pages x-permission: operator: AND permissions: - status_pages_incident_write /api/v2/statuspages/{page_id}/degradations/backfill: post: description: Creates a backfilled degradation with predefined updates. operationId: CreateBackfilledDegradation parameters: - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page." in: query name: include schema: type: string - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: title: Past API Outage updates: - components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: degraded description: We detected elevated error rates in the API. started_at: "2026-04-27T13:37:31Z" status: investigating - components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: operational description: The issue has been resolved. started_at: "2026-04-27T14:37:31Z" status: resolved type: degradations schema: $ref: "#/components/schemas/CreateBackfilledDegradationRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: operational created_at: "2026-04-27T13:37:31+00:00" description: The issue has been resolved. modified_at: "2026-04-27T14:37:31+00:00" status: resolved title: Past API Outage updates: [] id: 00000000-0000-0000-0000-000000000010 type: degradations schema: $ref: "#/components/schemas/Degradation" description: Created "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_incident_write summary: Create backfilled degradation tags: - Status Pages x-permission: operator: AND permissions: - status_pages_incident_write /api/v2/statuspages/{page_id}/degradations/{degradation_id}: delete: description: Deletes a degradation by its ID. operationId: DeleteDegradation parameters: - description: The ID of the status page. in: path name: page_id required: true schema: example: 1234abcd-12ab-34cd-56ef-123456abcdef format: uuid type: string - description: The ID of the degradation. in: path name: degradation_id required: true schema: example: 1234abcd-12ab-34cd-56ef-123456abcdef format: uuid type: string responses: "204": description: No Content "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_incident_write summary: Delete degradation tags: - Status Pages x-permission: operator: AND permissions: - status_pages_incident_write get: description: Retrieves a specific degradation by its ID. operationId: GetDegradation parameters: - description: The ID of the status page. in: path name: page_id required: true schema: example: 1234abcd-12ab-34cd-56ef-123456abcdef format: uuid type: string - description: The ID of the degradation. in: path name: degradation_id required: true schema: example: 1234abcd-12ab-34cd-56ef-123456abcdef format: uuid type: string - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page." in: query name: include schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: components_affected: - id: 00000000-0000-0000-0000-000000000018 status: degraded created_at: "2024-01-01T00:00:00+00:00" description: Our API is experiencing elevated latency. We are investigating the issue. modified_at: "2024-01-01T00:00:00+00:00" status: investigating title: Elevated API Latency updates: [] id: 00000000-0000-0000-0000-000000000004 type: degradations schema: $ref: "#/components/schemas/Degradation" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_read summary: Get degradation tags: - Status Pages x-permission: operator: AND permissions: - status_pages_settings_read patch: description: Updates an existing degradation's attributes. operationId: UpdateDegradation parameters: - description: The ID of the status page. in: path name: page_id required: true schema: example: 1234abcd-12ab-34cd-56ef-123456abcdef format: uuid type: string - description: Whether to notify page subscribers of the degradation. in: query name: notify_subscribers schema: default: true type: boolean - description: The ID of the degradation. in: path name: degradation_id required: true schema: example: 1234abcd-12ab-34cd-56ef-123456abcdef format: uuid type: string - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page." in: query name: include schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: operational description: We've deployed a fix and latency has returned to normal. This issue has been resolved. status: resolved title: Elevated API Latency in US1 id: 1234abcd-12ab-34cd-56ef-123456abcdef type: degradations schema: $ref: "#/components/schemas/PatchDegradationRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: components_affected: - id: 00000000-0000-0000-0000-000000000017 status: operational created_at: "2024-01-01T00:00:00+00:00" description: We've deployed a fix and latency has returned to normal. modified_at: "2024-01-01T00:00:00+00:00" status: resolved title: Elevated API Latency updates: [] id: 00000000-0000-0000-0000-000000000003 type: degradations schema: $ref: "#/components/schemas/Degradation" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_incident_write summary: Update degradation tags: - Status Pages x-permission: operator: AND permissions: - status_pages_incident_write /api/v2/statuspages/{page_id}/degradations/{degradation_id}/updates/{update_id}: delete: description: Soft-deletes a degradation update. operationId: SoftDeleteDegradationUpdate parameters: - description: The ID of the degradation. in: path name: degradation_id required: true schema: format: uuid type: string - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string - description: The ID of the degradation update. in: path name: update_id required: true schema: format: uuid type: string responses: "204": description: No Content "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_incident_write summary: Soft delete degradation update tags: - Status Pages patch: description: Edits a specific degradation update. operationId: EditDegradationUpdate parameters: - description: The ID of the degradation. in: path name: degradation_id required: true schema: format: uuid type: string - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, degradation, status_page." in: query name: include schema: type: string - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string - description: The ID of the degradation update. in: path name: update_id required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: description: We've identified the source of the latency increase and are deploying a fix. status: identified id: 00000000-0000-0000-0000-000000000000 type: degradation_updates schema: $ref: "#/components/schemas/PatchDegradationUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: description: We've identified the source of the latency increase and are deploying a fix. status: identified id: 00000000-0000-0000-0000-000000000000 type: degradation_updates schema: $ref: "#/components/schemas/DegradationUpdate" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_incident_write summary: Edit degradation update tags: - Status Pages /api/v2/statuspages/{page_id}/maintenance_templates: get: description: Lists all maintenance templates for a status page. operationId: ListMaintenanceTemplates parameters: - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page." in: query name: include schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: completed_description: We have completed maintenance on the API to improve performance. component_ids: - 1234abcd-12ab-34cd-56ef-123456abcdef in_progress_description: We are currently performing maintenance on the API to improve performance. maintenance_title: API Maintenance name: API Maintenance scheduled_description: We will be performing maintenance on the API to improve performance. id: 00000000-0000-0000-0000-000000000004 type: maintenance_templates schema: $ref: "#/components/schemas/MaintenanceTemplateArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_read summary: List maintenance templates tags: - Status Pages post: description: Creates a new maintenance template. operationId: CreateMaintenanceTemplate parameters: - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page." in: query name: include schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: completed_description: We have completed maintenance on the API to improve performance. component_ids: - 1234abcd-12ab-34cd-56ef-123456abcdef in_progress_description: We are currently performing maintenance on the API to improve performance. maintenance_title: API Maintenance name: API Maintenance scheduled_description: We will be performing maintenance on the API to improve performance. type: maintenance_templates schema: $ref: "#/components/schemas/CreateMaintenanceTemplateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: completed_description: We have completed maintenance on the API to improve performance. component_ids: - 1234abcd-12ab-34cd-56ef-123456abcdef in_progress_description: We are currently performing maintenance on the API to improve performance. maintenance_title: API Maintenance name: API Maintenance scheduled_description: We will be performing maintenance on the API to improve performance. id: 00000000-0000-0000-0000-000000000004 type: maintenance_templates schema: $ref: "#/components/schemas/MaintenanceTemplate" description: Created "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_write summary: Create maintenance template tags: - Status Pages /api/v2/statuspages/{page_id}/maintenance_templates/{template_id}: delete: description: Deletes a maintenance template by its ID (soft delete). operationId: DeleteMaintenanceTemplate parameters: - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string - description: The ID of the degradation or maintenance template. in: path name: template_id required: true schema: format: uuid type: string responses: "204": description: No Content "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_write summary: Delete maintenance template tags: - Status Pages get: description: Retrieves a specific maintenance template by its ID. operationId: GetMaintenanceTemplate parameters: - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string - description: The ID of the degradation or maintenance template. in: path name: template_id required: true schema: format: uuid type: string - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page." in: query name: include schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: completed_description: We have completed maintenance on the API to improve performance. component_ids: - 1234abcd-12ab-34cd-56ef-123456abcdef in_progress_description: We are currently performing maintenance on the API to improve performance. maintenance_title: API Maintenance name: API Maintenance scheduled_description: We will be performing maintenance on the API to improve performance. id: 00000000-0000-0000-0000-000000000004 type: maintenance_templates schema: $ref: "#/components/schemas/MaintenanceTemplate" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_read summary: Get maintenance template tags: - Status Pages patch: description: Updates an existing maintenance template's attributes. operationId: UpdateMaintenanceTemplate parameters: - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string - description: The ID of the degradation or maintenance template. in: path name: template_id required: true schema: format: uuid type: string - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page." in: query name: include schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: completed_description: We have completed maintenance on the API to improve performance. in_progress_description: We are currently performing maintenance on the API to improve performance for 40 minutes. maintenance_title: API Maintenance scheduled_description: We will be performing maintenance on the API to improve performance for 40 minutes. id: 00000000-0000-0000-0000-000000000004 type: maintenance_templates schema: $ref: "#/components/schemas/PatchMaintenanceTemplateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: completed_description: We have completed maintenance on the API to improve performance. component_ids: - 1234abcd-12ab-34cd-56ef-123456abcdef in_progress_description: We are currently performing maintenance on the API to improve performance for 40 minutes. maintenance_title: API Maintenance name: API Maintenance scheduled_description: We will be performing maintenance on the API to improve performance for 40 minutes. id: 00000000-0000-0000-0000-000000000004 type: maintenance_templates schema: $ref: "#/components/schemas/MaintenanceTemplate" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_write summary: Update maintenance template tags: - Status Pages /api/v2/statuspages/{page_id}/maintenances: post: description: Schedules a new maintenance. operationId: CreateMaintenance parameters: - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string - description: Whether to notify page subscribers of the maintenance. in: query name: notify_subscribers schema: default: true type: boolean - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page." in: query name: include schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: completed_date: "2026-02-18T19:51:13.332360075Z" completed_description: We have completed maintenance on the API to improve performance. components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: operational in_progress_description: We are currently performing maintenance on the API to improve performance. scheduled_description: We will be performing maintenance on the API to improve performance. start_date: "2026-02-18T19:21:13.332360075Z" title: API Maintenance type: maintenances schema: $ref: "#/components/schemas/CreateMaintenanceRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: completed_date: "2024-01-01T01:00:00+00:00" completed_description: We have completed maintenance on the API to improve performance. components_affected: [] in_progress_description: We are currently performing maintenance on the API to improve performance. scheduled_description: We will be performing maintenance on the API to improve performance. start_date: "2024-01-01T00:00:00+00:00" status: scheduled title: API Maintenance id: 00000000-0000-0000-0000-000000000015 type: maintenances schema: $ref: "#/components/schemas/Maintenance" description: Created "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_incident_write summary: Schedule maintenance tags: - Status Pages x-permission: operator: AND permissions: - status_pages_incident_write /api/v2/statuspages/{page_id}/maintenances/backfill: post: description: Creates a backfilled maintenance with predefined updates. operationId: CreateBackfilledMaintenance parameters: - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page." in: query name: include schema: type: string - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: title: Past Database Maintenance updates: - components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: maintenance description: Database maintenance is in progress. started_at: "2026-04-27T13:37:31Z" status: in_progress - components_affected: - id: 1234abcd-12ab-34cd-56ef-123456abcdef status: operational description: Database maintenance has been completed. started_at: "2026-04-27T14:37:31Z" status: completed type: maintenances schema: $ref: "#/components/schemas/CreateBackfilledMaintenanceRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: completed_date: "2026-04-27T14:37:31+00:00" completed_description: "" components_affected: [] in_progress_description: "" scheduled_description: "" start_date: "2026-04-27T13:37:31+00:00" status: completed title: Past Database Maintenance id: 00000000-0000-0000-0000-000000000015 type: maintenances schema: $ref: "#/components/schemas/Maintenance" description: Created "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_incident_write summary: Create backfilled maintenance tags: - Status Pages x-permission: operator: AND permissions: - status_pages_incident_write /api/v2/statuspages/{page_id}/maintenances/{maintenance_id}: get: description: Retrieves a specific maintenance by its ID. operationId: GetMaintenance parameters: - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string - description: The ID of the maintenance. in: path name: maintenance_id required: true schema: format: uuid type: string - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page." in: query name: include schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: completed_date: "2024-01-01T01:00:00+00:00" completed_description: We have completed maintenance on the API. components_affected: [] in_progress_description: We are currently performing maintenance on the API. scheduled_description: We will be performing maintenance on the API. start_date: "2024-01-01T00:00:00+00:00" status: scheduled title: API Maintenance id: 00000000-0000-0000-0000-000000000013 type: maintenances schema: $ref: "#/components/schemas/Maintenance" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_settings_read summary: Get maintenance tags: - Status Pages x-permission: operator: AND permissions: - status_pages_settings_read patch: description: Updates an existing maintenance's attributes. operationId: UpdateMaintenance parameters: - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string - description: Whether to notify page subscribers of the maintenance. in: query name: notify_subscribers schema: default: true type: boolean - description: The ID of the maintenance. in: path name: maintenance_id required: true schema: format: uuid type: string - description: "Comma-separated list of resources to include. Supported values: created_by_user, last_modified_by_user, status_page." in: query name: include schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: completed_date: "2026-02-18T20:01:13.332360075Z" in_progress_description: We are currently performing maintenance on the API to improve performance for 40 minutes. scheduled_description: We will be performing maintenance on the API to improve performance for 40 minutes. start_date: "2026-02-18T19:21:13.332360075Z" title: API Maintenance id: 1234abcd-12ab-34cd-56ef-123456abcdef type: maintenances schema: $ref: "#/components/schemas/PatchMaintenanceRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: completed_date: "2024-01-01T01:00:00+00:00" completed_description: We have completed maintenance on the API. components_affected: [] in_progress_description: We are currently performing maintenance on the API to improve performance for 40 minutes. scheduled_description: We will be performing maintenance on the API to improve performance for 40 minutes. start_date: "2024-01-01T00:00:00+00:00" status: scheduled title: API Maintenance id: 00000000-0000-0000-0000-000000000014 type: maintenances schema: $ref: "#/components/schemas/Maintenance" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_incident_write summary: Update maintenance tags: - Status Pages x-permission: operator: AND permissions: - status_pages_incident_write /api/v2/statuspages/{page_id}/maintenances/{maintenance_id}/updates/{update_id}: patch: description: Edits the message of a specific maintenance update. Editing is allowed regardless of the parent maintenance's status, including completed and canceled maintenances. operationId: PatchMaintenanceUpdate parameters: - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string - description: The ID of the maintenance. in: path name: maintenance_id required: true schema: format: uuid type: string - description: The ID of the maintenance update. in: path name: update_id required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: description: We have completed maintenance on the API to improve performance. id: 00000000-0000-0000-0000-000000000000 type: maintenance_updates schema: $ref: "#/components/schemas/PatchMaintenanceUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: components_affected: [] created_at: "2026-04-27T13:37:31+00:00" description: We have completed maintenance on the API to improve performance. manual_transition: true modified_at: "2026-04-27T14:37:31+00:00" started_at: "2026-04-27T13:37:31+00:00" status: completed id: 00000000-0000-0000-0000-000000000000 type: maintenance_updates schema: $ref: "#/components/schemas/MaintenanceUpdate" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_incident_write summary: Edit maintenance update tags: - Status Pages x-permission: operator: AND permissions: - status_pages_incident_write /api/v2/statuspages/{page_id}/publish: post: description: Publishes a status page. For pages of type `public`, makes the status page available on the public internet and requires the `status_pages_public_page_publish` permission. For pages of type `internal`, makes the status page available under the `status-pages/$domain_prefix/view` route within the Datadog organization and requires the `status_pages_internal_page_publish` permission. operationId: PublishStatusPage parameters: - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string responses: "204": description: No Content "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_internal_page_publish - status_pages_public_page_publish summary: Publish status page tags: - Status Pages x-permission: operator: OR permissions: - status_pages_public_page_publish - status_pages_internal_page_publish /api/v2/statuspages/{page_id}/unpublish: post: description: Unpublishes a status page. For pages of type `public`, removes the status page from the public internet and requires the `status_pages_public_page_publish` permission. For pages of type `internal`, removes the `status-pages/$domain_prefix/view` route from the Datadog organization and requires the `status_pages_internal_page_publish` permission. operationId: UnpublishStatusPage parameters: - description: The ID of the status page. in: path name: page_id required: true schema: format: uuid type: string responses: "204": description: No Content "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - status_pages_internal_page_publish - status_pages_public_page_publish summary: Unpublish status page tags: - Status Pages x-permission: operator: OR permissions: - status_pages_public_page_publish - status_pages_internal_page_publish /api/v2/stegadography/get-widgets: post: description: |- Extracts watermarks from a PNG image and returns the cached widget data associated with each watermark found. The image must be uploaded as a `multipart/form-data` request with the file in the `image` field. Only widgets belonging to the authenticated organization are returned. operationId: GetStegadographyWidgets requestBody: content: multipart/form-data: examples: default: value: image: "screenshot.png" schema: $ref: "#/components/schemas/StegadographyGetWidgetsRequest" description: PNG image to extract watermarks from. required: true responses: "200": content: application/json: examples: default: value: data: - attributes: locationx: 100 locationy: 200 rawData: '{"widgetType":"timeseries","requests":[]}' watermark: "0123456789abcdef" id: "abc123:0123456789abcdef" type: widget schema: $ref: "#/components/schemas/StegadographyGetWidgetsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "415": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unsupported Media Type "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get widgets from an image tags: - Stegadography /api/v2/synthetics/api-multistep/subtests/{public_id}: get: description: |- Get the list of API tests that can be added as subtests to a given API multistep test. The current test is excluded from the list since a test cannot be a subtest of itself. operationId: GetApiMultistepSubtests parameters: - description: The public ID of the API multistep test. in: path name: public_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/SyntheticsApiMultistepSubtestsResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_read summary: Get available subtests for a multistep test tags: - Synthetics x-permission: operator: OR permissions: - synthetics_read /api/v2/synthetics/api-multistep/subtests/{public_id}/parents: get: description: |- Get the list of API multistep tests that include a given subtest, along with their monitor status. operationId: GetApiMultistepSubtestParents parameters: - description: The public ID of the subtest. in: path name: public_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/SyntheticsApiMultistepParentTestsResponse" description: OK "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_read summary: Get parent tests for a subtest tags: - Synthetics x-permission: operator: OR permissions: - synthetics_read /api/v2/synthetics/downtimes: get: description: Get a list of all Synthetics downtimes for your organization. operationId: ListSyntheticsDowntimes parameters: - description: Comma-separated list of Synthetics test public IDs to filter downtimes by. in: query name: filter[test_ids] required: false schema: example: abc-def-123,xyz-uvw-456 type: string - description: If set to `true`, return only downtimes that are currently active. in: query name: filter[active] required: false schema: example: "true" type: string responses: "200": content: application/json: examples: default: value: data: - attributes: createdAt: "2024-01-15T10:30:00Z" createdBy: "00000000-0000-0000-0000-000000000003" createdByName: Jane Doe description: Scheduled weekly maintenance window. isEnabled: true name: Weekly maintenance tags: [] testIds: - abc-def-123 timeSlots: - duration: 3600 id: "00000000-0000-0000-0000-000000000002" start: day: 15 hour: 10 minute: 30 month: 1 year: 2024 timezone: Europe/Paris updatedAt: "2024-01-15T10:30:00Z" updatedBy: "00000000-0000-0000-0000-000000000003" updatedByName: Jane Doe id: "00000000-0000-0000-0000-000000000001" type: downtime schema: $ref: "#/components/schemas/SyntheticsDowntimesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List Synthetics downtimes tags: - Synthetics x-permission: operator: AND permissions: - synthetics_read post: description: Create a new Synthetics downtime. operationId: CreateSyntheticsDowntime requestBody: content: application/json: examples: default: value: data: attributes: isEnabled: true name: Weekly maintenance testIds: - abc-def-123 timeSlots: - duration: 3600 start: day: 15 hour: 10 minute: 30 month: 1 year: 2024 timezone: Europe/Paris type: downtime schema: $ref: "#/components/schemas/SyntheticsDowntimeRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: createdAt: "2024-01-15T10:30:00Z" createdBy: "00000000-0000-0000-0000-000000000003" createdByName: Jane Doe description: Scheduled weekly maintenance window. isEnabled: true name: Weekly maintenance tags: [] testIds: - abc-def-123 timeSlots: - duration: 3600 id: "00000000-0000-0000-0000-000000000002" start: day: 15 hour: 10 minute: 30 month: 1 year: 2024 timezone: Europe/Paris updatedAt: "2024-01-15T10:30:00Z" updatedBy: "00000000-0000-0000-0000-000000000003" updatedByName: Jane Doe id: "00000000-0000-0000-0000-000000000001" type: downtime schema: $ref: "#/components/schemas/SyntheticsDowntimeResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a Synthetics downtime tags: - Synthetics x-permission: operator: AND permissions: - synthetics_write - synthetics_default_settings_write /api/v2/synthetics/downtimes/{downtime_id}: delete: description: Delete a Synthetics downtime by its ID. operationId: DeleteSyntheticsDowntime parameters: - description: The ID of the downtime to delete. in: path name: downtime_id required: true schema: example: "00000000-0000-0000-0000-000000000001" type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a Synthetics downtime tags: - Synthetics x-permission: operator: AND permissions: - synthetics_write - synthetics_default_settings_write get: description: Get a Synthetics downtime by its ID. operationId: GetSyntheticsDowntime parameters: - description: The ID of the downtime to retrieve. in: path name: downtime_id required: true schema: example: "00000000-0000-0000-0000-000000000001" type: string responses: "200": content: application/json: examples: default: value: data: attributes: createdAt: "2024-01-15T10:30:00Z" createdBy: "00000000-0000-0000-0000-000000000003" createdByName: Jane Doe description: Scheduled weekly maintenance window. isEnabled: true name: Weekly maintenance tags: [] testIds: - abc-def-123 timeSlots: - duration: 3600 id: "00000000-0000-0000-0000-000000000002" start: day: 15 hour: 10 minute: 30 month: 1 year: 2024 timezone: Europe/Paris updatedAt: "2024-01-15T10:30:00Z" updatedBy: "00000000-0000-0000-0000-000000000003" updatedByName: Jane Doe id: "00000000-0000-0000-0000-000000000001" type: downtime schema: $ref: "#/components/schemas/SyntheticsDowntimeResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a Synthetics downtime tags: - Synthetics x-permission: operator: AND permissions: - synthetics_read put: description: Update a Synthetics downtime by its ID. operationId: UpdateSyntheticsDowntime parameters: - description: The ID of the downtime to update. in: path name: downtime_id required: true schema: example: "00000000-0000-0000-0000-000000000001" type: string requestBody: content: application/json: examples: default: value: data: attributes: isEnabled: true name: Weekly maintenance testIds: - abc-def-123 timeSlots: - duration: 3600 start: day: 15 hour: 10 minute: 30 month: 1 year: 2024 timezone: Europe/Paris type: downtime schema: $ref: "#/components/schemas/SyntheticsDowntimeRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: createdAt: "2024-01-15T10:30:00Z" createdBy: "00000000-0000-0000-0000-000000000003" createdByName: Jane Doe description: Scheduled weekly maintenance window. isEnabled: true name: Weekly maintenance tags: [] testIds: - abc-def-123 timeSlots: - duration: 3600 id: "00000000-0000-0000-0000-000000000002" start: day: 15 hour: 10 minute: 30 month: 1 year: 2024 timezone: Europe/Paris updatedAt: "2024-01-15T10:30:00Z" updatedBy: "00000000-0000-0000-0000-000000000003" updatedByName: Jane Doe id: "00000000-0000-0000-0000-000000000001" type: downtime schema: $ref: "#/components/schemas/SyntheticsDowntimeResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a Synthetics downtime tags: - Synthetics x-permission: operator: AND permissions: - synthetics_write - synthetics_default_settings_write /api/v2/synthetics/downtimes/{downtime_id}/tests/{test_id}: delete: description: Disassociate a Synthetics test from a downtime. operationId: RemoveTestFromSyntheticsDowntime parameters: - description: The ID of the downtime. in: path name: downtime_id required: true schema: example: "00000000-0000-0000-0000-000000000001" type: string - description: The public ID of the Synthetics test to disassociate from the downtime. in: path name: test_id required: true schema: example: abc-def-123 type: string responses: "200": content: application/json: examples: default: value: data: attributes: createdAt: "2024-01-15T10:30:00Z" createdBy: "00000000-0000-0000-0000-000000000003" createdByName: Jane Doe description: Scheduled weekly maintenance window. isEnabled: true name: Weekly maintenance tags: [] testIds: - abc-def-123 timeSlots: - duration: 3600 id: "00000000-0000-0000-0000-000000000002" start: day: 15 hour: 10 minute: 30 month: 1 year: 2024 timezone: Europe/Paris updatedAt: "2024-01-15T10:30:00Z" updatedBy: "00000000-0000-0000-0000-000000000003" updatedByName: Jane Doe id: "00000000-0000-0000-0000-000000000001" type: downtime schema: $ref: "#/components/schemas/SyntheticsDowntimeResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Remove a test from a Synthetics downtime tags: - Synthetics x-permission: operator: AND permissions: - synthetics_write put: description: Associate a Synthetics test with a downtime. operationId: AddTestToSyntheticsDowntime parameters: - description: The ID of the downtime. in: path name: downtime_id required: true schema: example: "00000000-0000-0000-0000-000000000001" type: string - description: The public ID of the Synthetics test to associate with the downtime. in: path name: test_id required: true schema: example: abc-def-123 type: string responses: "200": content: application/json: examples: default: value: data: attributes: createdAt: "2024-01-15T10:30:00Z" createdBy: "00000000-0000-0000-0000-000000000003" createdByName: Jane Doe description: Scheduled weekly maintenance window. isEnabled: true name: Weekly maintenance tags: [] testIds: - abc-def-123 timeSlots: - duration: 3600 id: "00000000-0000-0000-0000-000000000002" start: day: 15 hour: 10 minute: 30 month: 1 year: 2024 timezone: Europe/Paris updatedAt: "2024-01-15T10:30:00Z" updatedBy: "00000000-0000-0000-0000-000000000003" updatedByName: Jane Doe id: "00000000-0000-0000-0000-000000000001" type: downtime schema: $ref: "#/components/schemas/SyntheticsDowntimeResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Add a test to a Synthetics downtime tags: - Synthetics x-permission: operator: AND permissions: - synthetics_write /api/v2/synthetics/settings/on_demand_concurrency_cap: get: description: Get the on-demand concurrency cap. operationId: GetOnDemandConcurrencyCap responses: "200": content: application/json: examples: default: value: data: attributes: on_demand_concurrency_cap: 20 type: on_demand_concurrency_cap schema: $ref: "#/components/schemas/OnDemandConcurrencyCapResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get the on-demand concurrency cap tags: - Synthetics "x-permission": operator: OR permissions: - billing_read post: description: Save new value for on-demand concurrency cap. operationId: SetOnDemandConcurrencyCap requestBody: content: application/json: examples: default: value: on_demand_concurrency_cap: 20 schema: $ref: "#/components/schemas/OnDemandConcurrencyCapAttributes" description: . required: true responses: "200": content: application/json: examples: default: value: data: attributes: on_demand_concurrency_cap: 20 type: on_demand_concurrency_cap schema: $ref: "#/components/schemas/OnDemandConcurrencyCapResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Save new value for on-demand concurrency cap tags: - Synthetics x-codegen-request-body-name: body "x-permission": operator: OR permissions: - billing_edit /api/v2/synthetics/suites: post: operationId: CreateSyntheticsSuite requestBody: content: application/json: examples: default: value: data: attributes: message: Notification message monitor_id: 12345678 name: Example suite name public_id: 123-abc-456 tags: - env:production tests: - alerting_criticality: critical public_id: "" type: suite type: suites schema: $ref: "#/components/schemas/SuiteCreateEditRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: message: Notification message monitor_id: 12345678 name: Example suite name options: alerting_threshold: 0.5 public_id: 123-abc-456 tags: - env:production tests: - alerting_criticality: critical public_id: "" type: suite id: 123-abc-456 type: suites schema: $ref: "#/components/schemas/SyntheticsSuiteResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_write summary: Create a test suite tags: - Synthetics x-permission: operator: OR permissions: - synthetics_write - synthetics_create_edit_trigger /api/v2/synthetics/suites/bulk-delete: post: operationId: DeleteSyntheticsSuites requestBody: content: application/json: examples: default: value: data: attributes: public_ids: - "" type: delete_suites_request schema: $ref: "#/components/schemas/DeletedSuitesRequestDeleteRequest" required: true responses: "200": content: application/json: examples: default: value: data: - attributes: deleted_at: "2024-01-01T00:00:00+00:00" public_id: 123-abc-456 id: 123-abc-456 type: suites schema: $ref: "#/components/schemas/DeletedSuitesResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_write summary: Bulk delete suites tags: - Synthetics x-permission: operator: OR permissions: - synthetics_write /api/v2/synthetics/suites/search: get: description: Search for test suites. operationId: SearchSuites parameters: - description: The search query. in: query name: query required: false schema: type: string - description: The sort order for the results (e.g., `name,asc` or `name,desc`). in: query name: sort required: false schema: default: name,asc type: string - description: If true, return only facets instead of full test details. in: query name: facets_only required: false schema: default: false type: boolean - description: The offset from which to start returning results. in: query name: start required: false schema: default: 0 format: int64 type: integer - description: The maximum number of results to return. in: query name: count required: false schema: default: 50 format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: suites: - monitor_id: 12345678 name: Example suite name options: alerting_threshold: 0.5 public_id: 123-abc-456 tags: - env:production tests: [] type: suite total: 1 id: abc-123 type: suites_search schema: $ref: "#/components/schemas/SyntheticsSuiteSearchResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_read summary: Search test suites tags: - Synthetics "x-permission": operator: OR permissions: - synthetics_read /api/v2/synthetics/suites/{public_id}: get: operationId: GetSyntheticsSuite parameters: - description: The public ID of the suite to get details from. in: path name: public_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: message: Notification message monitor_id: 12345678 name: Example suite name options: alerting_threshold: 0.5 public_id: 123-abc-456 tags: - env:production tests: - alerting_criticality: critical public_id: "" type: suite id: 123-abc-456 type: suites schema: $ref: "#/components/schemas/SyntheticsSuiteResponse" description: OK "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_read summary: Get a suite tags: - Synthetics x-permission: operator: OR permissions: - synthetics_read put: operationId: EditSyntheticsSuite parameters: - description: The public ID of the suite to edit. in: path name: public_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: message: Notification message monitor_id: 12345678 name: Example suite name public_id: 123-abc-456 tags: - env:production tests: - alerting_criticality: critical public_id: "" type: suite type: suites schema: $ref: "#/components/schemas/SuiteCreateEditRequest" description: New suite details to be saved. required: true responses: "200": content: application/json: examples: default: value: data: attributes: message: Notification message monitor_id: 12345678 name: Example suite name options: alerting_threshold: 0.5 public_id: 123-abc-456 tags: - env:production tests: - alerting_criticality: critical public_id: "" type: suite id: 123-abc-456 type: suites schema: $ref: "#/components/schemas/SyntheticsSuiteResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_write summary: Edit a test suite tags: - Synthetics x-permission: operator: OR permissions: - synthetics_write /api/v2/synthetics/suites/{public_id}/jsonpatch: patch: description: |- Patch a Synthetic test suite using JSON Patch (RFC 6902). Use partial updates to modify only specific fields of a test suite. Common operations include: - Replace field values: `{"op": "replace", "path": "/name", "value": "new_name"}` - Add/update tags: `{"op": "add", "path": "/tags/-", "value": "new_tag"}` - Remove fields: `{"op": "remove", "path": "/message"}` operationId: PatchTestSuite parameters: - description: The public ID of the Synthetic test suite to patch. in: path name: public_id required: true schema: example: 123-abc-456 type: string requestBody: content: application/json: examples: default: value: data: attributes: json_patch: - op: add path: /name type: suites_json_patch schema: $ref: "#/components/schemas/SuiteJsonPatchRequest" description: JSON Patch document with operations to apply. required: true responses: "200": content: application/json: examples: default: value: data: attributes: message: Notification message monitor_id: 12345678 name: Example suite name options: alerting_threshold: 0.5 public_id: 123-abc-456 tags: - env:production tests: - alerting_criticality: critical public_id: "" type: suite id: 123-abc-456 type: suites schema: $ref: "#/components/schemas/SyntheticsSuiteResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_write summary: Patch a test suite tags: - Synthetics x-codegen-request-body-name: body x-permission: operator: OR permissions: - synthetics_write - synthetics_create_edit_trigger /api/v2/synthetics/tests/browser/{public_id}/results: get: description: Get the latest result summaries for a given Synthetic browser test. operationId: ListSyntheticsBrowserTestLatestResults parameters: - description: The public ID of the Synthetic browser test for which to search results. in: path name: public_id required: true schema: type: string - description: Timestamp in milliseconds from which to start querying results. in: query name: from_ts required: false schema: format: int64 type: integer - description: Timestamp in milliseconds up to which to query results. in: query name: to_ts required: false schema: format: int64 type: integer - description: Filter results by status. in: query name: status required: false schema: $ref: "#/components/schemas/SyntheticsTestResultStatus" - description: Filter results by run type. in: query name: runType required: false schema: $ref: "#/components/schemas/SyntheticsTestResultRunType" - description: Locations for which to query results. in: query name: probe_dc required: false schema: items: type: string type: array - description: Device IDs for which to query results. in: query name: device_id required: false schema: items: type: string type: array responses: "200": content: application/json: examples: default: value: data: - attributes: device: id: chrome.laptop_large name: "Chrome - Laptop Large" type: browser finished_at: 1679328005200 location: id: aws:eu-west-1 name: "Ireland (AWS)" run_type: scheduled started_at: 1679328000000 status: passed test_type: browser test_version: 2 id: "7291038456723891045" relationships: test: data: id: xyz-abc-789 type: test type: result_summary schema: $ref: "#/components/schemas/SyntheticsTestLatestResultsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_read summary: Get a browser test's latest results tags: - Synthetics x-permission: operator: OR permissions: - synthetics_read /api/v2/synthetics/tests/browser/{public_id}/results/{result_id}: get: description: Get a specific full result from a given Synthetic browser test. operationId: GetSyntheticsBrowserTestResult parameters: - description: The public ID of the Synthetic browser test to which the target result belongs. in: path name: public_id required: true schema: type: string - description: The ID of the result to get. in: path name: result_id required: true schema: type: string - description: The event ID used to look up the result in the event store. in: query name: event_id required: false schema: type: string - description: Timestamp in seconds to look up the result. in: query name: timestamp required: false schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: device: id: chrome.laptop_large name: "Chrome - Laptop Large" type: browser location: id: aws:eu-west-1 name: "Ireland (AWS)" result: duration: 5200.0 finished_at: 1679328005200 id: "7291038456723891045" started_at: 1679328000000 status: passed test_type: browser test_version: 2 id: "7291038456723891045" relationships: test: data: id: xyz-abc-789 type: test type: result schema: $ref: "#/components/schemas/SyntheticsTestResultResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_read summary: Get a browser test result tags: - Synthetics x-permission: operator: OR permissions: - synthetics_read /api/v2/synthetics/tests/bulk-delete: post: operationId: DeleteSyntheticsTests requestBody: content: application/json: examples: default: value: data: attributes: public_ids: - abc-def-123 - xyz-uvw-456 type: delete_tests_request schema: $ref: "#/components/schemas/DeletedTestsRequestDeleteRequest" required: true responses: "200": content: application/json: examples: default: value: data: - id: abc-def-123 type: delete_tests schema: $ref: "#/components/schemas/DeletedTestsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_write summary: Bulk delete tests tags: - Synthetics x-permission: operator: OR permissions: - synthetics_write /api/v2/synthetics/tests/fast/{id}: get: operationId: GetSyntheticsFastTestResult parameters: - description: The UUID of the fast test to retrieve the result for. in: path name: id required: true schema: example: abc12345-1234-1234-1234-abc123456789 type: string responses: "200": content: application/json: examples: default: value: data: attributes: location: id: aws:us-east-1 name: "N. Virginia (AWS)" result: duration: 150.5 finished_at: 1679328001000 id: abc12345-1234-1234-1234-abc123456789 resolved_ip: "1.2.3.4" run_type: fast started_at: 1679328000000 status: passed test_sub_type: http test_type: api test_version: 1 id: abc12345-1234-1234-1234-abc123456789 type: result schema: $ref: "#/components/schemas/SyntheticsFastTestResult" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_read summary: Get a fast test result tags: - Synthetics x-permission: operator: OR permissions: - synthetics_read /api/v2/synthetics/tests/network: post: operationId: CreateSyntheticsNetworkTest requestBody: content: application/json: examples: default: value: data: attributes: config: assertions: - operator: lessThan property: avg target: 500 type: latency request: e2e_queries: 50 host: "" max_ttl: 30 port: 443 tcp_method: prefer_sack traceroute_queries: 3 locations: - aws:us-east-1 - agent:my-agent-name message: Network Path test notification monitor_id: 12345678 name: Example Network Path test options: monitor_options: notification_preset_name: show_all scheduling: timeframes: - day: 1 from: 07:00 to: "16:00" - day: 3 from: 07:00 to: "16:00" timezone: America/New_York public_id: abc-def-123 status: live subtype: tcp tags: - env:production type: network type: network schema: $ref: "#/components/schemas/SyntheticsNetworkTestEditRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: config: {} locations: - aws:us-east-1 message: Network Path test notification name: Example Network Path test options: {} status: live type: network id: abc-def-123 type: network_test schema: $ref: "#/components/schemas/SyntheticsNetworkTestResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_write summary: Create a Network Path test tags: - Synthetics x-permission: operator: OR permissions: - synthetics_write - synthetics_create_edit_trigger /api/v2/synthetics/tests/network/{public_id}: get: operationId: GetSyntheticsNetworkTest parameters: - description: The public ID of the Network Path test to get details from. in: path name: public_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: config: {} locations: - aws:us-east-1 message: Network Path test notification name: Example Network Path test options: {} status: live type: network id: abc-def-123 type: network_test schema: $ref: "#/components/schemas/SyntheticsNetworkTestResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_read summary: Get a Network Path test tags: - Synthetics x-permission: operator: OR permissions: - synthetics_read put: operationId: UpdateSyntheticsNetworkTest parameters: - description: The public ID of the Network Path test to edit. in: path name: public_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: config: assertions: - operator: lessThan property: avg target: 500 type: latency request: e2e_queries: 50 host: "" max_ttl: 30 port: 443 tcp_method: prefer_sack traceroute_queries: 3 locations: - aws:us-east-1 - agent:my-agent-name message: Network Path test notification monitor_id: 12345678 name: Example Network Path test options: monitor_options: notification_preset_name: show_all scheduling: timeframes: - day: 1 from: 07:00 to: "16:00" - day: 3 from: 07:00 to: "16:00" timezone: America/New_York public_id: abc-def-123 status: live subtype: tcp tags: - env:production type: network type: network schema: $ref: "#/components/schemas/SyntheticsNetworkTestEditRequest" description: New Network Path test details to be saved. required: true responses: "200": content: application/json: examples: default: value: data: attributes: config: {} locations: - aws:us-east-1 message: Network Path test notification name: Example Network Path test options: {} status: live type: network id: abc-def-123 type: network_test schema: $ref: "#/components/schemas/SyntheticsNetworkTestResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_write summary: Edit a Network Path test tags: - Synthetics x-permission: operator: OR permissions: - synthetics_write - synthetics_create_edit_trigger /api/v2/synthetics/tests/poll_results: get: description: |- Poll for test results given a list of result IDs. This is typically used after triggering tests with CI/CD to retrieve results once they are available. operationId: PollSyntheticsTestResults parameters: - description: A JSON-encoded array of result IDs to poll for. example: '["id1","id2","id3"]' in: query name: result_ids required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: location: id: aws:us-east-1 name: "N. Virginia (AWS)" result: duration: 150.5 finished_at: 1679328001000 id: "5158904793181869365" started_at: 1679328000000 status: passed test_sub_type: http test_type: api test_version: 3 id: "5158904793181869365" relationships: test: data: id: abc-def-123 type: test type: result schema: $ref: "#/components/schemas/SyntheticsPollTestResultsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_read summary: Poll for test results tags: - Synthetics x-permission: operator: OR permissions: - synthetics_read /api/v2/synthetics/tests/{public_id}/files/download: post: description: |- Get a presigned URL to download a file attached to a Synthetic test. The returned URL is temporary and expires after a short period. operationId: GetTestFileDownloadUrl parameters: - description: The public ID of the Synthetic test. in: path name: public_id required: true schema: example: abc-def-123 type: string requestBody: content: application/json: examples: default: value: bucketKey: api-upload-file/abc-def-123/2024-01-01T00:00:00_uuid.json schema: $ref: "#/components/schemas/SyntheticsTestFileDownloadRequest" required: true responses: "200": content: application/json: examples: default: value: presignedUrl: https://example.com/download schema: $ref: "#/components/schemas/SyntheticsTestFileDownloadResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden. "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_read summary: Get a presigned URL for downloading a test file tags: - Synthetics x-permission: operator: OR permissions: - synthetics_read /api/v2/synthetics/tests/{public_id}/files/multipart-presigned-urls: post: description: |- Get presigned URLs for uploading a file to a Synthetic test using multipart upload. Returns the presigned URLs for each part along with the bucket key that references the file. operationId: GetTestFileMultipartPresignedUrls parameters: - description: The public ID of the Synthetic test. in: path name: public_id required: true schema: example: abc-def-123 type: string requestBody: content: application/json: examples: default: value: bucketKeyPrefix: api-upload-file parts: - md5: 1B2M2Y8AsgTpgAmY7PhCfg== partNumber: 1 schema: $ref: "#/components/schemas/SyntheticsTestFileMultipartPresignedUrlsRequest" required: true responses: "200": content: application/json: examples: default: value: bucketKey: api-upload-file/abc-def-123/file.json presignedUrls: [] schema: $ref: "#/components/schemas/SyntheticsTestFileMultipartPresignedUrlsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden. "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_write summary: Get presigned URLs for uploading a test file tags: - Synthetics x-permission: operator: OR permissions: - synthetics_write - synthetics_create_edit_trigger /api/v2/synthetics/tests/{public_id}/files/multipart-upload-abort: post: description: |- Abort an in-progress multipart file upload for a Synthetic test. This cancels the upload and releases any storage used by already-uploaded parts. operationId: AbortTestFileMultipartUpload parameters: - description: The public ID of the Synthetic test. in: path name: public_id required: true schema: example: abc-def-123 type: string requestBody: content: application/json: examples: default: value: key: org-123/api-upload-file/abc-def-123/2024-01-01T00:00:00_uuid.json uploadId: upload-id-abc123 schema: $ref: "#/components/schemas/SyntheticsTestFileAbortMultipartUploadRequest" required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden. "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_write summary: Abort a multipart upload of a test file tags: - Synthetics x-permission: operator: OR permissions: - synthetics_write - synthetics_create_edit_trigger /api/v2/synthetics/tests/{public_id}/files/multipart-upload-complete: post: description: |- Complete a multipart file upload for a Synthetic test. Call this endpoint after all parts have been uploaded using the presigned URLs obtained from the multipart presigned URLs endpoint. operationId: CompleteTestFileMultipartUpload parameters: - description: The public ID of the Synthetic test. in: path name: public_id required: true schema: example: abc-def-123 type: string requestBody: content: application/json: examples: default: value: key: org-123/api-upload-file/abc-def-123/2024-01-01T00:00:00_uuid.json parts: - ETag: '"d41d8cd98f00b204e9800998ecf8427e"' PartNumber: 1 uploadId: upload-id-abc123 schema: $ref: "#/components/schemas/SyntheticsTestFileCompleteMultipartUploadRequest" required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden. "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_write summary: Complete a multipart upload of a test file tags: - Synthetics x-permission: operator: OR permissions: - synthetics_write - synthetics_create_edit_trigger /api/v2/synthetics/tests/{public_id}/parent-suites: get: description: Get the list of parent suites and their status for a given Synthetic test. operationId: GetTestParentSuites parameters: - description: The public ID of the Synthetic test. in: path name: public_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/SyntheticsTestParentSuitesResponse" description: OK "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_read summary: Get parent suites for a test tags: - Synthetics x-permission: operator: OR permissions: - synthetics_read /api/v2/synthetics/tests/{public_id}/results: get: description: Get the latest result summaries for a given Synthetic test. operationId: ListSyntheticsTestLatestResults parameters: - description: The public ID of the Synthetic test for which to search results. in: path name: public_id required: true schema: type: string - description: Timestamp in milliseconds from which to start querying results. in: query name: from_ts required: false schema: format: int64 type: integer - description: Timestamp in milliseconds up to which to query results. in: query name: to_ts required: false schema: format: int64 type: integer - description: Filter results by status. in: query name: status required: false schema: $ref: "#/components/schemas/SyntheticsTestResultStatus" - description: Filter results by run type. in: query name: runType required: false schema: $ref: "#/components/schemas/SyntheticsTestResultRunType" - description: Locations for which to query results. in: query name: probe_dc required: false schema: items: type: string type: array - description: Device IDs for which to query results. in: query name: device_id required: false schema: items: type: string type: array responses: "200": content: application/json: examples: default: value: data: - attributes: finished_at: 1679328001000 location: id: aws:us-east-1 name: "N. Virginia (AWS)" run_type: scheduled started_at: 1679328000000 status: passed test_sub_type: http test_type: api test_version: 3 id: "5158904793181869365" relationships: test: data: id: abc-def-123 type: test type: result_summary schema: $ref: "#/components/schemas/SyntheticsTestLatestResultsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_read summary: Get a test's latest results tags: - Synthetics x-permission: operator: OR permissions: - synthetics_read /api/v2/synthetics/tests/{public_id}/results/{result_id}: get: description: Get a specific full result from a given Synthetic test. operationId: GetSyntheticsTestResult parameters: - description: The public ID of the Synthetic test to which the target result belongs. in: path name: public_id required: true schema: type: string - description: The ID of the result to get. in: path name: result_id required: true schema: type: string - description: The event ID used to look up the result in the event store. in: query name: event_id required: false schema: type: string - description: Timestamp in seconds to look up the result. in: query name: timestamp required: false schema: format: int64 type: integer responses: "200": content: application/json: examples: default: value: data: attributes: location: id: aws:us-east-1 name: "N. Virginia (AWS)" result: duration: 150.5 finished_at: 1679328001000 id: "5158904793181869365" started_at: 1679328000000 status: passed test_sub_type: http test_type: api test_version: 3 id: "5158904793181869365" relationships: test: data: id: abc-def-123 type: test type: result schema: $ref: "#/components/schemas/SyntheticsTestResultResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_read summary: Get a test result tags: - Synthetics x-permission: operator: OR permissions: - synthetics_read /api/v2/synthetics/tests/{public_id}/version_history: get: description: Get the paginated version history for a Synthetic test. operationId: ListSyntheticsTestVersions parameters: - description: The public ID of the Synthetic test. in: path name: public_id required: true schema: type: string - description: The version number of the last item from the previous page. Omit to get the first page. in: query name: last_version_number required: false schema: format: int64 type: integer - description: Maximum number of version records to return per page. in: query name: limit required: false schema: format: int64 maximum: 50 type: integer responses: "200": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/SyntheticsTestVersionHistoryResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_read summary: Get version history of a test tags: - Synthetics x-permission: operator: OR permissions: - synthetics_read /api/v2/synthetics/tests/{public_id}/version_history/{version_number}: get: description: Get a specific version of a Synthetic test by its version number. operationId: GetSyntheticsTestVersion parameters: - description: The public ID of the Synthetic test. in: path name: public_id required: true schema: type: string - description: The version number to retrieve. in: path name: version_number required: true schema: format: int64 type: integer - description: If `true`, include change metadata in the response. in: query name: include_change_metadata required: false schema: type: boolean - description: |- If `true`, only check whether the version exists without returning its full payload. Returns an empty object if the version exists, or 404 if not. in: query name: only_check_existence required: false schema: type: boolean responses: "200": content: application/json: examples: default: value: data: public_id: abc-def-123 version_number: 1 schema: $ref: "#/components/schemas/SyntheticsTestVersionResponse" description: OK "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - synthetics_read summary: Get a specific version of a test tags: - Synthetics x-permission: operator: OR permissions: - synthetics_read /api/v2/synthetics/variables/{variable_id}/jsonpatch: patch: description: |- Patch a global variable using JSON Patch (RFC 6902). This endpoint allows partial updates to a global variable by specifying only the fields to modify. Common operations include: - Replace field values: `{"op": "replace", "path": "/name", "value": "new_name"}` - Update nested values: `{"op": "replace", "path": "/value/value", "value": "new_value"}` - Add/update tags: `{"op": "add", "path": "/tags/-", "value": "new_tag"}` - Remove fields: `{"op": "remove", "path": "/description"}` operationId: PatchGlobalVariable parameters: - description: The ID of the global variable. in: path name: variable_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: json_patch: - op: add path: /name type: global_variables_json_patch schema: $ref: "#/components/schemas/GlobalVariableJsonPatchRequest" description: JSON Patch document with operations to apply. required: true responses: "200": content: application/json: examples: default: value: data: attributes: description: Example description name: MY_VARIABLE tags: - "team:front" value: secure: false value: example-value id: abc-123 type: global_variables schema: $ref: "#/components/schemas/GlobalVariableResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Patch a global variable tags: - Synthetics x-codegen-request-body-name: body "x-permission": operator: OR permissions: - synthetics_global_variable_write /api/v2/tags/enrichment: get: description: List all tag pipeline rulesets - Retrieve a list of all tag pipeline rulesets for the organization operationId: ListTagPipelinesRulesets responses: "200": content: application/json: examples: default: value: data: - attributes: created: enabled: true last_modified_user_uuid: "" modified: name: Production Cost Allocation Rules position: 0 rules: - enabled: true mapping: metadata: name: AWS Production Account Tagging query: addition: key: environment value: production case_insensitivity: false if_tag_exists: do_not_apply query: billingcurrency:"USD" AND account_name:"prod-account" reference_table: version: 2 id: 00000000-0000-0000-0000-000000000001 type: ruleset schema: $ref: "#/components/schemas/RulesetRespArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: List tag pipeline rulesets tags: - Cloud Cost Management post: description: Create a new tag pipeline ruleset with the specified rules and configuration operationId: CreateTagPipelinesRuleset requestBody: content: application/json: examples: default: value: data: attributes: enabled: true rules: - enabled: true name: Add Cost Center Tag query: addition: key: cost_center value: engineering case_insensitivity: false if_tag_exists: do_not_apply query: account_id:"123456789" AND service:"web-api" id: New Ruleset type: create_ruleset schema: $ref: "#/components/schemas/CreateRulesetRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created: enabled: true last_modified_user_uuid: "" modified: name: Example Ruleset position: 0 rules: - enabled: true mapping: metadata: name: Add Cost Center Tag query: addition: key: cost_center value: engineering case_insensitivity: false if_tag_exists: do_not_apply query: account_id:"123456789" AND service:"web-api" reference_table: version: 1 id: 00000000-0000-0000-0000-000000000002 type: ruleset schema: $ref: "#/components/schemas/RulesetResp" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Create tag pipeline ruleset tags: - Cloud Cost Management /api/v2/tags/enrichment/reorder: post: description: Reorder tag pipeline rulesets - Change the execution order of tag pipeline rulesets operationId: ReorderTagPipelinesRulesets requestBody: content: application/json: examples: default: value: data: - id: 55ef2385-9ae1-4410-90c4-5ac1b60fec10 type: ruleset - id: a7b8c9d0-1234-5678-9abc-def012345678 type: ruleset - id: f1e2d3c4-b5a6-9780-1234-567890abcdef type: ruleset schema: $ref: "#/components/schemas/ReorderRulesetResourceArray" required: true responses: "204": description: Successfully reordered rulesets "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Reorder tag pipeline rulesets tags: - Cloud Cost Management /api/v2/tags/enrichment/status: get: description: List the processing status of all tag pipeline rulesets. Returns only the ID and processing status for each ruleset. operationId: ListTagPipelinesRulesetsStatus responses: "200": content: application/json: examples: default: value: data: - attributes: processing_status: processing id: 55ef2385-9ae1-4410-90c4-5ac1b60fec10 type: ruleset_status - attributes: processing_status: done id: a7b8c9d0-1234-5678-9abc-def012345678 type: ruleset_status schema: $ref: "#/components/schemas/RulesetStatusRespArray" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: List tag pipeline ruleset statuses tags: - Cloud Cost Management /api/v2/tags/enrichment/validate-query: post: description: Validate a tag pipeline query - Validate the syntax and structure of a tag pipeline query operationId: ValidateQuery requestBody: content: application/json: examples: default: value: data: attributes: Query: example:query AND test:true type: validate_query schema: $ref: "#/components/schemas/RulesValidateQueryRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: Canonical: canonical query representation type: validate_response schema: $ref: "#/components/schemas/RulesValidateQueryResponse" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Validate query tags: - Cloud Cost Management /api/v2/tags/enrichment/{ruleset_id}: delete: description: Delete a tag pipeline ruleset - Delete an existing tag pipeline ruleset by its ID operationId: DeleteTagPipelinesRuleset parameters: - description: The unique identifier of the ruleset in: path name: ruleset_id required: true schema: type: string responses: "204": description: No Content "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Delete tag pipeline ruleset tags: - Cloud Cost Management get: description: Get a specific tag pipeline ruleset - Retrieve a specific tag pipeline ruleset by its ID operationId: GetTagPipelinesRuleset parameters: - description: The unique identifier of the ruleset in: path name: ruleset_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: created: enabled: true last_modified_user_uuid: "" modified: name: Example Ruleset position: 0 rules: - enabled: true mapping: metadata: name: Add Cost Center Tag query: addition: key: cost_center value: engineering case_insensitivity: false if_tag_exists: do_not_apply query: account_id:"123456789" AND service:"web-api" reference_table: version: 1 id: 00000000-0000-0000-0000-000000000004 type: ruleset schema: $ref: "#/components/schemas/RulesetResp" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_read summary: Get a tag pipeline ruleset tags: - Cloud Cost Management patch: description: Update a tag pipeline ruleset - Update an existing tag pipeline ruleset with new rules and configuration operationId: UpdateTagPipelinesRuleset parameters: - description: The unique identifier of the ruleset in: path name: ruleset_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: enabled: true last_version: 1 name: Updated Ruleset rules: - enabled: true name: Add Cost Center Tag query: addition: key: cost_center value: engineering case_insensitivity: false if_tag_exists: do_not_apply query: account_id:"123456789" AND service:"web-api" - enabled: true mapping: destination_key: team_owner if_tag_exists: do_not_apply source_keys: - account_name - account_id name: Account Name Mapping query: - enabled: true name: New table rule with new UI query: reference_table: case_insensitivity: true field_pairs: - input_column: status_type output_key: status - input_column: status_description output_key: dess if_tag_exists: append source_keys: - http_status - status_description table_name: http_status_codes type: update_ruleset schema: $ref: "#/components/schemas/UpdateRulesetRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: enabled: true name: Example Ruleset position: 0 rules: - enabled: true name: Example Rule query: addition: key: env value: prod case_insensitivity: false if_tag_exists: do_not_apply query: account_id:"123456789" version: 1 id: 00000000-0000-0000-0000-000000000003 type: ruleset schema: $ref: "#/components/schemas/RulesetResp" description: OK "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Update tag pipeline ruleset tags: - Cloud Cost Management /api/v2/team: get: description: |- Get all teams. Can be used to search for teams using the `filter[keyword]` and `filter[me]` query parameters. operationId: ListTeams parameters: - $ref: "#/components/parameters/PageNumber" - $ref: "#/components/parameters/PageSize" - description: Specifies the order of the returned teams in: query name: sort required: false schema: $ref: "#/components/schemas/ListTeamsSort" - description: |- Included related resources optionally requested. Allowed enum values: `team_links, user_team_permissions` in: query name: include required: false schema: items: $ref: "#/components/schemas/ListTeamsInclude" type: array - description: Search query. Can be team name, team handle, or email of team member in: query name: filter[keyword] required: false schema: type: string - description: When true, only returns teams the current user belongs to in: query name: filter[me] required: false schema: type: boolean - description: List of fields that need to be fetched. explode: false in: query name: fields[team] required: false schema: items: $ref: "#/components/schemas/TeamsField" type: array responses: "200": content: application/json: examples: default: value: data: - attributes: handle: example-team name: Example Team id: 00000000-0000-0000-0000-000000000001 type: team meta: pagination: offset: 0 total: 1 schema: $ref: "#/components/schemas/TeamsResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Get all teams tags: - Teams x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data "x-permission": operator: OR permissions: - teams_read post: description: |- Create a new team. User IDs passed through the `users` relationship field are added to the team. operationId: CreateTeam requestBody: content: application/json: examples: default: value: data: attributes: avatar: 🥑 handle: example-team name: Example Team relationships: users: data: [] type: team schema: $ref: "#/components/schemas/TeamCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: handle: example-team name: Example Team id: 00000000-0000-0000-0000-000000000002 type: team schema: $ref: "#/components/schemas/TeamResponse" description: CREATED "403": $ref: "#/components/responses/ForbiddenResponse" "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read - teams_manage summary: Create a team tags: - Teams x-codegen-request-body-name: body "x-permission": operator: AND permissions: - teams_read - teams_manage /api/v2/team-hierarchy-links: get: description: List all team hierarchy links that match the provided filters. operationId: ListTeamHierarchyLinks parameters: - $ref: "#/components/parameters/PageNumber" - $ref: "#/components/parameters/PageSize" - description: Filter by parent team ID in: query name: filter[parent_team] required: false schema: type: string - description: Filter by sub team ID in: query name: filter[sub_team] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" provisioned_by: system id: b8626d7e-cedd-11eb-abf5-da7ad0900001 type: team_hierarchy_links schema: $ref: "#/components/schemas/TeamHierarchyLinksResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Get team hierarchy links tags: - Teams x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data "x-permission": operator: OR permissions: - teams_read post: description: Create a new team hierarchy link between a parent team and a sub team. operationId: AddTeamHierarchyLink requestBody: content: application/json: examples: default: value: data: relationships: parent_team: data: id: 692e8073-12c4-4c71-8408-5090bd44c9c8 type: team sub_team: data: id: 692e8073-12c4-4c71-8408-5090bd44c9c8 type: team type: team_hierarchy_links schema: $ref: "#/components/schemas/TeamHierarchyLinkCreateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" provisioned_by: system id: 00000000-0000-0000-0000-000000000001 type: team_hierarchy_links schema: $ref: "#/components/schemas/TeamHierarchyLinkResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read - teams_manage summary: Create a team hierarchy link tags: - Teams "x-permission": operator: AND permissions: - teams_read - teams_manage /api/v2/team-hierarchy-links/{link_id}: delete: description: Remove a team hierarchy link by the given link_id. operationId: RemoveTeamHierarchyLink parameters: - description: The team hierarchy link's identifier in: path name: link_id required: true schema: type: string responses: "204": description: No Content "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read - teams_manage summary: Remove a team hierarchy link tags: - Teams "x-permission": operator: AND permissions: - teams_read - teams_manage get: description: Get a single team hierarchy link for the given link_id. operationId: GetTeamHierarchyLink parameters: - description: The team hierarchy link's identifier in: path name: link_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" provisioned_by: system id: b8626d7e-cedd-11eb-abf5-da7ad0900001 type: team_hierarchy_links schema: $ref: "#/components/schemas/TeamHierarchyLinkResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Get a team hierarchy link tags: - Teams "x-permission": operator: OR permissions: - teams_read /api/v2/team/connections: delete: description: Delete multiple team connections. operationId: DeleteTeamConnections requestBody: content: application/json: examples: default: value: data: - id: 12345678-1234-5678-9abc-123456789012 type: team_connection schema: $ref: "#/components/schemas/TeamConnectionDeleteRequest" required: true responses: "204": description: No Content "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Delete team connections tags: - Teams "x-permission": operator: OR permissions: - teams_read get: description: Returns all team connections. operationId: ListTeamConnections parameters: - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - description: Filter team connections by external source systems, such as `github` or `servicenow`. explode: false in: query name: filter[sources] required: false schema: items: example: "github" type: string type: array style: form - description: Filter team connections by Datadog team IDs. explode: false in: query name: filter[team_ids] required: false schema: items: example: "12345678-1234-5678-9abc-123456789012" type: string type: array style: form - description: Filter team connections by connected team IDs from external systems. explode: false in: query name: filter[connected_team_ids] required: false schema: items: example: "@MyGitHubAccount/my-team-name" type: string type: array style: form - description: Filter team connections by connection IDs. explode: false in: query name: filter[connection_ids] required: false schema: items: example: "12345678-1234-5678-9abc-123456789012" type: string type: array style: form responses: "200": content: application/json: examples: default: value: data: - attributes: managed_by: github_sync source: github id: 00000000-0000-0000-0000-000000000001 type: team_connection schema: $ref: "#/components/schemas/TeamConnectionsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: List team connections tags: - Teams x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data "x-permission": operator: OR permissions: - teams_read post: description: Create multiple team connections. operationId: CreateTeamConnections requestBody: content: application/json: examples: default: value: data: - attributes: managed_by: github_sync source: github relationships: connected_team: data: id: "@GitHubOrg/team-handle" type: github_team team: data: id: 87654321-4321-8765-dcba-210987654321 type: team type: team_connection schema: $ref: "#/components/schemas/TeamConnectionCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: - attributes: managed_by: github_sync source: github id: 00000000-0000-0000-0000-000000000002 type: team_connection schema: $ref: "#/components/schemas/TeamConnectionsResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "409": $ref: "#/components/responses/ConflictResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Create team connections tags: - Teams "x-permission": operator: OR permissions: - teams_read /api/v2/team/sync: get: description: |- Get all team synchronization configurations. Returns a list of configurations used for linking or provisioning teams with external sources like GitHub or ServiceNow. operationId: GetTeamSync parameters: - description: Filter by the external source platform for team synchronization in: query name: filter[source] required: true schema: $ref: "#/components/schemas/TeamSyncAttributesSource" responses: "200": content: application/json: examples: default: value: data: - attributes: frequency: once source: github sync_membership: false type: link type: team_sync_bulk schema: $ref: "#/components/schemas/TeamSyncResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Get team sync configurations tags: - Teams x-permission: operator: OR permissions: - teams_read post: description: |- This endpoint configures synchronization between your existing Datadog teams and teams from GitHub or ServiceNow by matching team names. It evaluates all current Datadog teams and compares them against teams in the external source connected to your Datadog account. This operation is read-only on the external source side, no teams will be modified or created there. This only creates new teams in Datadog when type is set to `provision`. Optionally, provide `selection_state` to limit synchronization to specific teams or organizations and their subtrees, instead of syncing all teams. **GitHub**: [A GitHub organization must be connected to your Datadog account](https://docs.datadoghq.com/integrations/github/), and the GitHub App integrated with Datadog must have the `Members Read` permission. Matching is performed by comparing the Datadog team handle to the GitHub team slug (lowercased and kebab-cased) using a normalized exact match; case is ignored and spaces are removed. **ServiceNow**: [The ServiceNow integration must be configured for your Datadog account](https://docs.datadoghq.com/integrations/servicenow/). Active assignment groups from every configured ServiceNow instance are synchronized, and the ServiceNow group hierarchy is preserved. When `sync_membership` is enabled, group members are matched to Datadog users by email address. operationId: SyncTeams requestBody: content: application/json: examples: default: value: data: attributes: source: github type: link type: team_sync_bulk schema: $ref: "#/components/schemas/TeamSyncRequest" required: true responses: "200": description: OK "204": description: No Content "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Internal Server Error - Unexpected error during linking. security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_manage summary: Link teams with external teams tags: - Teams x-codegen-request-body-name: body x-permission: operator: AND permissions: - teams_manage /api/v2/team/{super_team_id}/member_teams: get: deprecated: true description: |- Get all member teams. **Note**: This API is deprecated. For team hierarchy relationships (parent-child teams), use the team hierarchy links API: `GET /api/v2/team-hierarchy-links`. operationId: ListMemberTeams parameters: - description: None in: path name: super_team_id required: true schema: type: string - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - description: List of fields that need to be fetched. explode: false in: query name: fields[team] required: false schema: items: $ref: "#/components/schemas/TeamsField" type: array responses: "200": content: application/json: examples: default: value: data: - attributes: handle: example-team name: Example Team id: 00000000-0000-0000-0000-000000000005 type: team meta: pagination: offset: 0 total: 1 schema: $ref: "#/components/schemas/TeamsResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Get all member teams tags: - Teams x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data x-permission: operator: OR permissions: - teams_read x-sunset: "2026-06-01" x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: deprecated: true description: |- Add a member team. Adds the team given by the `id` in the body as a member team of the super team. **Note**: This API is deprecated. For creating team hierarchy links, use the team hierarchy links API: `POST /api/v2/team-hierarchy-links`. operationId: AddMemberTeam parameters: - description: None in: path name: super_team_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: id: aeadc05e-98a8-11ec-ac2c-da7ad0900001 type: member_teams schema: $ref: "#/components/schemas/AddMemberTeamRequest" required: true responses: "204": description: Added "403": $ref: "#/components/responses/ForbiddenResponse" "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Add a member team tags: - Teams x-permission: operator: OR permissions: - teams_read x-sunset: "2026-06-01" x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/team/{super_team_id}/member_teams/{member_team_id}: delete: deprecated: true description: |- Remove a super team's member team identified by `member_team_id`. **Note**: This API is deprecated. For deleting team hierarchy links, use the team hierarchy links API: `DELETE /api/v2/team-hierarchy-links/{link_id}`. operationId: RemoveMemberTeam parameters: - description: None in: path name: super_team_id required: true schema: type: string - description: None in: path name: member_team_id required: true schema: type: string responses: "204": description: No Content "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Remove a member team tags: - Teams x-permission: operator: OR permissions: - teams_read x-sunset: "2026-06-01" x-unstable: |- **Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/team/{team_id}: delete: description: Remove a team using the team's `id`. operationId: DeleteTeam parameters: - description: None in: path name: team_id required: true schema: type: string responses: "204": description: No Content "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read - teams_manage summary: Remove a team tags: - Teams "x-permission": operator: AND permissions: - teams_read - teams_manage get: description: Get a single team using the team's `id`. operationId: GetTeam parameters: - description: None in: path name: team_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: handle: example-team name: Example Team id: 00000000-0000-0000-0000-000000000003 type: team schema: $ref: "#/components/schemas/TeamResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Get a team tags: - Teams "x-permission": operator: OR permissions: - teams_read patch: description: |- Update a team using the team's `id`. If the `team_links` relationship is present, the associated links are updated to be in the order they appear in the array, and any existing team links not present are removed. operationId: UpdateTeam parameters: - description: None in: path name: team_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: avatar: 🥑 handle: example-team name: Example Team relationships: team_links: data: - id: f9bb8444-af7f-11ec-ac2c-da7ad0900001 links: related: /api/v2/team/c75a4a8e-20c7-11ee-a3a5-da7ad0900002/links type: team schema: $ref: "#/components/schemas/TeamUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: handle: example-team name: Example Team id: 00000000-0000-0000-0000-000000000004 type: team schema: $ref: "#/components/schemas/TeamResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Update a team tags: - Teams x-codegen-request-body-name: body "x-permission": operator: OR permissions: - teams_read /api/v2/team/{team_id}/links: get: description: Get all links for a given team. operationId: GetTeamLinks parameters: - description: None in: path name: team_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: label: Link label position: 0 url: "https://example.com" id: 00000000-0000-0000-0000-000000000001 type: team_links schema: $ref: "#/components/schemas/TeamLinksResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Get links for a team tags: - Teams "x-permission": operator: OR permissions: - teams_read post: description: Add a new link to a team. operationId: CreateTeamLink parameters: - description: None in: path name: team_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: label: Link label position: 0 url: https://example.com type: team_links schema: $ref: "#/components/schemas/TeamLinkCreateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: label: Link label url: https://example.com id: 00000000-0000-0000-0000-000000000002 type: team_links schema: $ref: "#/components/schemas/TeamLinkResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "422": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Create a team link tags: - Teams x-codegen-request-body-name: body "x-permission": operator: OR permissions: - teams_read /api/v2/team/{team_id}/links/{link_id}: delete: description: Remove a link from a team. operationId: DeleteTeamLink parameters: - description: None in: path name: team_id required: true schema: type: string - description: None in: path name: link_id required: true schema: type: string responses: "204": description: No Content "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Remove a team link tags: - Teams "x-permission": operator: OR permissions: - teams_read get: description: Get a single link for a team. operationId: GetTeamLink parameters: - description: None in: path name: team_id required: true schema: type: string - description: None in: path name: link_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: label: Link label position: 0 url: "https://example.com" id: 00000000-0000-0000-0000-000000000003 type: team_links schema: $ref: "#/components/schemas/TeamLinkResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Get a team link tags: - Teams "x-permission": operator: OR permissions: - teams_read patch: description: Update a team link. operationId: UpdateTeamLink parameters: - description: None in: path name: team_id required: true schema: type: string - description: None in: path name: link_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: label: Link label url: https://example.com type: team_links schema: $ref: "#/components/schemas/TeamLinkCreateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: label: Link label position: 0 url: "https://example.com" id: 00000000-0000-0000-0000-000000000004 type: team_links schema: $ref: "#/components/schemas/TeamLinkResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Update a team link tags: - Teams x-codegen-request-body-name: body "x-permission": operator: OR permissions: - teams_read /api/v2/team/{team_id}/members: get: description: |- List the direct and inherited members of a team, deduplicated by user. Members of descendant teams are included unless `filter[is_direct_only]` is true. Datadog support users are always excluded. Use `page[number]` and `page[size]` to paginate through the results. Invalid query parameters return a JSON:API error with status 400. Invalid or unknown team UUIDs return status 404. operationId: ListTeamHierarchyMembers parameters: - description: UUID of the requested root team. in: path name: team_id required: true schema: example: 692e8073-12c4-4c71-8408-5090bd44c9c8 type: string - description: Return only direct members. By default, members inherited from descendant teams are also returned. in: query name: filter[is_direct_only] required: false schema: default: false example: false type: boolean - description: Include service accounts. Datadog support users are always excluded. in: query name: filter[include_service_accounts] required: false schema: default: true example: true type: boolean - description: Filter by a case-insensitive substring of the user name, handle, or email. in: query name: filter[keyword] required: false schema: example: alice type: string - description: "Comma-separated resources to include: `user` and `team`. The included team is the requested team. Whitespace is trimmed, and duplicate or empty entries are ignored." in: query name: include required: false schema: example: user,team pattern: ^\s*((user|team)\s*)?(,\s*((user|team)\s*)?)*$ type: string - description: "Comma-separated sort fields: `name`, `handle`, `is_direct`, and `provisioned_by`. Fields are applied in order, each optionally prefixed with `-` for descending order. By default, team admins come first, followed by other direct members, then inherited members, sorted by name within each group." in: query name: sort required: false schema: example: is_direct,-name type: string - description: Zero-based page number. Negative values become 0. Defaults to 0. in: query name: page[number] required: false schema: default: 0 example: 0 format: int64 type: integer - description: Requested number of members per page. Defaults to and maxes out at 100. in: query name: page[size] required: false schema: default: 100 example: 100 format: int64 type: integer responses: "200": content: application/json: examples: default: summary: Direct and inherited members with number pagination value: data: - attributes: direct_role: admin is_direct: true provisioned_by: manual provisioned_by_id: id: UserTeamRelationship:692e8073-12c4-4c71-8408-5090bd44c9c8:00000000-0000-0000-0000-000000000001 relationships: team: data: id: 692e8073-12c4-4c71-8408-5090bd44c9c8 type: teams user: data: id: 00000000-0000-0000-0000-000000000001 type: users type: user_team_relationship - attributes: direct_role: is_direct: false provisioned_by: provisioned_by_id: id: UserTeamRelationship:692e8073-12c4-4c71-8408-5090bd44c9c8:00000000-0000-0000-0000-000000000002 relationships: team: data: id: 692e8073-12c4-4c71-8408-5090bd44c9c8 type: teams user: data: id: 00000000-0000-0000-0000-000000000002 type: users type: user_team_relationship links: first: https://api.datadoghq.com/api/v2/team/692e8073-12c4-4c71-8408-5090bd44c9c8/members?page%5Bnumber%5D=0&page%5Bsize%5D=100 last: https://api.datadoghq.com/api/v2/team/692e8073-12c4-4c71-8408-5090bd44c9c8/members?page%5Bnumber%5D=0&page%5Bsize%5D=100 self: https://api.datadoghq.com/api/v2/team/692e8073-12c4-4c71-8408-5090bd44c9c8/members?page%5Bnumber%5D=0&page%5Bsize%5D=100 meta: page: first_number: 0 last_number: 0 next_number: number: 0 prev_number: size: 100 total: 2 type: number_size empty: summary: No matching members, with included resources omitted value: data: [] links: first: https://api.datadoghq.com/api/v2/team/692e8073-12c4-4c71-8408-5090bd44c9c8/members?page%5Bnumber%5D=0&page%5Bsize%5D=100 last: https://api.datadoghq.com/api/v2/team/692e8073-12c4-4c71-8408-5090bd44c9c8/members?page%5Bnumber%5D=0&page%5Bsize%5D=100 self: https://api.datadoghq.com/api/v2/team/692e8073-12c4-4c71-8408-5090bd44c9c8/members?page%5Bnumber%5D=0&page%5Bsize%5D=100 meta: page: first_number: 0 last_number: 0 next_number: number: 0 prev_number: size: 100 total: 0 type: number_size included_resources: summary: Users and the team with number pagination value: data: - attributes: direct_role: admin is_direct: true provisioned_by: manual provisioned_by_id: id: UserTeamRelationship:692e8073-12c4-4c71-8408-5090bd44c9c8:00000000-0000-0000-0000-000000000001 relationships: team: data: id: 692e8073-12c4-4c71-8408-5090bd44c9c8 type: teams user: data: id: 00000000-0000-0000-0000-000000000001 type: users type: user_team_relationship - attributes: direct_role: is_direct: false provisioned_by: provisioned_by_id: id: UserTeamRelationship:692e8073-12c4-4c71-8408-5090bd44c9c8:00000000-0000-0000-0000-000000000002 relationships: team: data: id: 692e8073-12c4-4c71-8408-5090bd44c9c8 type: teams user: data: id: 00000000-0000-0000-0000-000000000002 type: users type: user_team_relationship included: - attributes: email: alice@example.com handle: alice@example.com name: Alice title: id: 00000000-0000-0000-0000-000000000001 type: users - attributes: email: bob@example.com handle: bob@example.com name: title: id: 00000000-0000-0000-0000-000000000002 type: users - attributes: handle: platform name: Platform id: 692e8073-12c4-4c71-8408-5090bd44c9c8 type: teams links: first: https://api.datadoghq.com/api/v2/team/692e8073-12c4-4c71-8408-5090bd44c9c8/members?include=user%2Cteam&page%5Bnumber%5D=0&page%5Bsize%5D=100 last: https://api.datadoghq.com/api/v2/team/692e8073-12c4-4c71-8408-5090bd44c9c8/members?include=user%2Cteam&page%5Bnumber%5D=0&page%5Bsize%5D=100 self: https://api.datadoghq.com/api/v2/team/692e8073-12c4-4c71-8408-5090bd44c9c8/members?include=user%2Cteam&page%5Bnumber%5D=0&page%5Bsize%5D=100 meta: page: first_number: 0 last_number: 0 next_number: number: 0 prev_number: size: 100 total: 2 type: number_size schema: $ref: "#/components/schemas/TeamHierarchyMembersResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Get team hierarchy members tags: - Teams x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data x-permission: operator: OR permissions: - teams_read x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/team/{team_id}/memberships: get: description: Get a paginated list of members for a team operationId: GetTeamMemberships parameters: - description: None in: path name: team_id required: true schema: type: string - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - description: Specifies the order of returned team memberships in: query name: sort required: false schema: $ref: "#/components/schemas/GetTeamMembershipsSort" - description: Search query, can be user email or name in: query name: filter[keyword] required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: role: admin id: TeamMembership-aeadc05e-98a8-11ec-ac2c-da7ad0900001-38835 type: team_memberships - attributes: role: id: TeamMembership-b8626d7e-cedd-11eb-abf5-da7ad0900001-38835 type: team_memberships schema: $ref: "#/components/schemas/UserTeamsResponse" description: Represents a user's association to a team "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Get team memberships tags: - Teams x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data "x-permission": operator: OR permissions: - teams_read post: description: |- Add a user to a team. **Note**: Each team has a setting that determines who is allowed to modify membership of the team. The `user_access_manage` permission generally grants access to modify membership of any team. To get the full picture, see [Team Membership documentation](https://docs.datadoghq.com/account_management/teams/manage/#team-membership). operationId: CreateTeamMembership parameters: - description: None in: path name: team_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: role: admin relationships: team: data: id: d7e15d9d-d346-43da-81d8-3d9e71d9a5e9 type: team user: data: id: b8626d7e-cedd-11eb-abf5-da7ad0900001 type: users type: team_memberships schema: $ref: "#/components/schemas/UserTeamRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: role: admin id: 00000000-0000-0000-0000-000000000001 type: team_memberships schema: $ref: "#/components/schemas/UserTeamResponse" description: Represents a user's association to a team "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Add a user to a team tags: - Teams x-codegen-request-body-name: body "x-permission": operator: OR permissions: - teams_read /api/v2/team/{team_id}/memberships/{user_id}: delete: description: |- Remove a user from a team. **Note**: Each team has a setting that determines who is allowed to modify membership of the team. The `user_access_manage` permission generally grants access to modify membership of any team. To get the full picture, see [Team Membership documentation](https://docs.datadoghq.com/account_management/teams/manage/#team-membership). operationId: DeleteTeamMembership parameters: - description: None in: path name: team_id required: true schema: type: string - description: None in: path name: user_id required: true schema: type: string responses: "204": description: No Content "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Remove a user from a team tags: - Teams "x-permission": operator: OR permissions: - teams_read patch: description: |- Update a user's membership attributes on a team. **Note**: Each team has a setting that determines who is allowed to modify membership of the team. The `user_access_manage` permission generally grants access to modify membership of any team. To get the full picture, see [Team Membership documentation](https://docs.datadoghq.com/account_management/teams/manage/#team-membership). operationId: UpdateTeamMembership parameters: - description: None in: path name: team_id required: true schema: type: string - description: None in: path name: user_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: role: admin type: team_memberships schema: $ref: "#/components/schemas/UserTeamUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: role: admin id: TeamMembership-aeadc05e-98a8-11ec-ac2c-da7ad0900001-38835 type: team_memberships schema: $ref: "#/components/schemas/UserTeamResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Update a user's membership attributes on a team tags: - Teams x-codegen-request-body-name: body "x-permission": operator: OR permissions: - teams_read /api/v2/team/{team_id}/notification-rules: get: operationId: GetTeamNotificationRules parameters: - description: None in: path name: team_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: email: enabled: true recipient_email: alerts@example.com servicenow: templates: - incident-template slack: channel: test-channel workspace: Datadog id: 00000000-0000-0000-0000-000000000001 type: team_notification_rules schema: $ref: "#/components/schemas/TeamNotificationRulesResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Get team notification rules tags: - Teams x-permission: operator: OR permissions: - teams_read post: operationId: CreateTeamNotificationRule parameters: - description: None in: path name: team_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: email: enabled: true slack: channel: test-ops workspace: Datadog type: team_notification_rules schema: $ref: "#/components/schemas/TeamNotificationRuleRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: email: enabled: true slack: channel: test-channel workspace: Datadog id: 00000000-0000-0000-0000-000000000002 type: team_notification_rules schema: $ref: "#/components/schemas/TeamNotificationRuleResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "409": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Create team notification rule tags: - Teams x-permission: operator: OR permissions: - teams_read /api/v2/team/{team_id}/notification-rules/{rule_id}: delete: operationId: DeleteTeamNotificationRule parameters: - description: None in: path name: team_id required: true schema: type: string - description: None in: path name: rule_id required: true schema: type: string responses: "204": description: No Content "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Delete team notification rule tags: - Teams x-permission: operator: OR permissions: - teams_read get: operationId: GetTeamNotificationRule parameters: - description: None in: path name: team_id required: true schema: type: string - description: None in: path name: rule_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: email: enabled: true slack: channel: test-channel workspace: Datadog id: 00000000-0000-0000-0000-000000000003 type: team_notification_rules schema: $ref: "#/components/schemas/TeamNotificationRuleResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Get team notification rule tags: - Teams x-permission: operator: OR permissions: - teams_read put: operationId: UpdateTeamNotificationRule parameters: - description: None in: path name: team_id required: true schema: type: string - description: None in: path name: rule_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: pagerduty: service_name: Datadog-prod slack: channel: test-ops workspace: Datadog id: b8626d7e-cedd-11eb-abf5-da7ad0900001 type: team_notification_rules schema: $ref: "#/components/schemas/TeamNotificationRuleRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: email: enabled: true slack: channel: test-channel workspace: Datadog id: 00000000-0000-0000-0000-000000000004 type: team_notification_rules schema: $ref: "#/components/schemas/TeamNotificationRuleResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Update team notification rule tags: - Teams x-permission: operator: OR permissions: - teams_read /api/v2/team/{team_id}/permission-settings: get: description: Get all permission settings for a given team. operationId: GetTeamPermissionSettings parameters: - description: None in: path name: team_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: action: edit editable: true value: admins id: TeamPermission-abc-123-edit type: team_permission_settings schema: $ref: "#/components/schemas/TeamPermissionSettingsResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Get permission settings for a team tags: - Teams "x-permission": operator: OR permissions: - teams_read /api/v2/team/{team_id}/permission-settings/{action}: put: description: Update a team permission setting for a given team. operationId: UpdateTeamPermissionSetting parameters: - description: None in: path name: team_id required: true schema: type: string - description: None in: path name: action required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: value: admins type: team_permission_settings schema: $ref: "#/components/schemas/TeamPermissionSettingUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: action: edit editable: true value: admins id: TeamPermission-abc-123-edit type: team_permission_settings schema: $ref: "#/components/schemas/TeamPermissionSettingResponse" description: OK "403": $ref: "#/components/responses/ForbiddenResponse" "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Update permission setting for team tags: - Teams x-codegen-request-body-name: body "x-permission": operator: OR permissions: - teams_read /api/v2/test/flaky-test-management/tests: patch: description: |- Update the state of multiple flaky tests in Flaky Test Management. operationId: UpdateFlakyTests requestBody: content: "application/json": examples: default: value: data: attributes: tests: - id: 4eb1887a8adb1847 new_state: active type: update_flaky_test_state_request schema: $ref: "#/components/schemas/UpdateFlakyTestsRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: has_errors: false results: - id: 4eb1887a8adb1847 success: true id: abc-123 type: update_flaky_test_state_response schema: $ref: "#/components/schemas/UpdateFlakyTestsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - test_optimization_write summary: Update flaky test states tags: ["Test Optimization"] x-codegen-request-body-name: body "x-permission": operator: OR permissions: - test_optimization_write post: description: |- List endpoint returning flaky tests from Flaky Test Management. Results are paginated. The response includes comprehensive test information including: - Test identification and metadata (module, suite, name) - Flaky state and categorization - First and last flake occurrences (timestamp, branch, commit SHA) - Test execution statistics from the last 7 days (failure rate) - Pipeline impact metrics (failed pipelines count, total lost time) - Complete status change history (optional, ordered from most recent to oldest) Set `include_history` to `true` in the request to receive the status change history for each test. History is disabled by default for better performance. Results support filtering by various facets including service, environment, repository, branch, and test state. operationId: SearchFlakyTests requestBody: content: "application/json": examples: default: value: data: attributes: filter: query: flaky_test_state:active @git.repository.id_v2:"github.com/datadog/test-service" page: cursor: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== limit: 25 sort: failure_rate type: search_flaky_tests_request schema: $ref: "#/components/schemas/FlakyTestsSearchRequest" required: false responses: "200": content: application/json: examples: default: value: data: - attributes: envs: - prod flaky_state: active module: TestModule name: TestName services: - test-service suite: TestSuite id: 4eb1887a8adb1847 type: flaky_test meta: pagination: next_page: eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ== schema: $ref: "#/components/schemas/FlakyTestsSearchResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/NotAuthorizedResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - test_optimization_read summary: Search flaky tests tags: ["Test Optimization"] x-codegen-request-body-name: body x-pagination: cursorParam: body.data.attributes.page.cursor cursorPath: meta.pagination.next_page limitParam: body.data.attributes.page.limit resultsPath: data "x-permission": operator: OR permissions: - test_optimization_read /api/v2/timeseries-anomaly-investigations: post: description: |- Investigates a metrics timeseries request for its most significant anomalies and returns deterministic findings. Metrics queries with or without grouping are supported. This API version accepts exactly one request and returns at most three anomalies. operationId: CreateTimeseriesAnomalyInvestigation requestBody: content: application/json: examples: default: value: data: attributes: requests: - formulas: - formula: query1 from: 1754406000000 queries: - data_source: metrics name: query1 query: "avg:system.cpu.user{env:prod} by {service}" to: 1754423940000 type: timeseries_anomaly_investigation schema: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationRequest" description: Metrics timeseries request to investigate. The request body must not exceed 2 MiB. required: true responses: "200": content: application/json: examples: default: value: data: attributes: results: - anomalies: - anomaly_detection: configuration_source: watchdog_explains_default profile: watchdog_explains_v1 detected_interval: end: 1754406120000 start: 1754406060000 display_interval: end: 1754406150000 start: 1754406030000 findings: - description: "Filtering out service:api flattens the spike." headline: "service:api is the likely cause" tag: influence_type: shape key: service rating: 5.0 synonyms: [] values: - api type: influential_tag maximum_deviation: delta_from_boundary: 7.0 timestamp: 1754406090000 value: 42.0 series: group_tags: - "service:api" label: api query_index: 0 tag_analysis: analyzed_tag_keys: - service - env status: complete tag_keys_analyzed: 2 tag_values_analyzed: 4 type: spike status: complete id: "0" type: timeseries_anomaly_investigation meta: from_date: 1754406000000 interval: 60000 queries: - name: query1 status: done res_type: timeseries_anomaly_investigation results_warnings: [] to_date: 1754423940000 schema: $ref: "#/components/schemas/TimeseriesAnomalyInvestigationResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "413": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Payload Too Large "422": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - timeseries_query - metrics_read summary: Investigate a timeseries anomaly tags: - Timeseries Anomaly Investigations x-codegen-request-body-name: body x-permission: operator: AND permissions: - timeseries_query - metrics_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/trace/{trace_id}: get: description: |- Retrieve a full APM trace by its trace ID, including every span in the trace. Traces are returned from live storage when available and fall back to longer-term storage. A `400 Bad Request` response means the trace ID is malformed. A `404 Not Found` response means no trace with this ID is available, such as when the trace is outside the retention period. This endpoint is rate limited to `60` requests per minute per organization. operationId: GetTraceByID parameters: - $ref: "#/components/parameters/TraceIDPathParameter" - description: |- List of span fields to include in the response. When omitted, every available field is returned. Values may be passed as repeated query parameters or as a single comma-separated value. example: - service - resource in: query name: include_fields required: false schema: items: type: string type: array responses: "200": content: application/json: examples: default: value: data: attributes: is_truncated: false spans: - duration: 500000000 endTime: 1716800000500000000 error: 0 meta: env: production http.method: GET metrics: http.status_code: 200 name: web.request parentID: 0 resource: GET /products service: web-store spanID: 9876543210987654321 startTime: 1716800000000000000 traceID: 12345678901234567890 traceIDFull: 0000000000000000abc1230000000000 type: web id: "0000000000000000abc1230000000000" type: trace schema: $ref: "#/components/schemas/TraceResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "413": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Payload Too Large "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_read summary: Get a trace by ID tags: - APM Trace x-permission: operator: OR permissions: - apm_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/usage/admin/temporary-grant-requests: get: description: List all request statuses within the authenticated organization. Filter by pending status for the review queue. Requires Billing Edit, including for reads. Requires an authenticated human user. Service-account credentials are unsupported. Request status remains approved after expiry, revocation, or replacement. operationId: ListTemporaryGrantRequests parameters: - description: Optional status. Defaults to all statuses. in: query name: filter[status] required: false schema: $ref: "#/components/schemas/TemporaryGrantRequestStatus" - description: Page size, from 1 to 100. in: query name: page[limit] required: false schema: default: 50 format: int64 maximum: 100 minimum: 1 type: integer - description: UUID cursor from meta.page.next_cursor. in: query name: page[cursor] required: false schema: format: uuid type: string - description: Filter by requester UUID within the authenticated organization. in: query name: filter[requested_by_user_id] required: false schema: format: uuid type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2028-02-16T00:00:00Z" entity_key: user_handle:jane@example.com expires_at: "2028-03-01T00:00:00Z" justification: Credits needed to finish the incident investigation. quota_namespace: ai_credits requested_by_user_id: 12345678-1234-1234-1234-123456789012 status: pending total: 200 id: 34567890-3456-3456-3456-345678901234 type: temporary_grant_requests meta: page: {} schema: $ref: "#/components/schemas/TemporaryGrantRequestListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - billing_edit summary: List organization temporary grant requests tags: - Usage Metering x-pagination: cursorParam: page[cursor] cursorPath: meta.page.next_cursor limitParam: page[limit] resultsPath: data x-permission: operator: OR permissions: - billing_edit x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/usage/admin/temporary-grant-requests/{request_id}: get: description: Read an organization request, justification, decision, and linked grant state. Requires Billing Edit. Requires an authenticated human user. Service-account credentials are unsupported. Request status remains approved after expiry, revocation, or replacement. operationId: GetTemporaryGrantRequest parameters: - description: The temporary grant request UUID. in: path name: request_id required: true schema: description: The request UUID. example: 12345678-1234-1234-1234-123456789012 format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2028-02-16T00:00:00Z" entity_key: user_handle:jane@example.com expires_at: "2028-03-01T00:00:00Z" justification: Credits needed to finish the incident investigation. quota_namespace: ai_credits requested_by_user_id: 12345678-1234-1234-1234-123456789012 status: pending total: 200 id: 34567890-3456-3456-3456-345678901234 type: temporary_grant_requests schema: $ref: "#/components/schemas/TemporaryGrantRequestResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - billing_edit summary: Get an organization temporary grant request tags: - Usage Metering x-permission: operator: OR permissions: - billing_edit x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/usage/admin/temporary-grant-requests/{request_id}/decision: post: description: Approve or deny the submitted terms, which are immutable. Approval atomically writes the grant, audit record, and request decision. An expired request can't be approved. Requires the Billing Edit permission. Requires an authenticated human user. Service-account credentials aren't supported. Request status remains approved after the grant's expiry, revocation, or replacement. operationId: UpdateTemporaryGrantRequest parameters: - description: The temporary grant request UUID. in: path name: request_id required: true schema: description: The request UUID. example: 12345678-1234-1234-1234-123456789012 format: uuid type: string requestBody: content: application/json: examples: default: value: data: attributes: decision: approved id: 12345678-1234-1234-1234-123456789012 type: temporary_grant_requests schema: $ref: "#/components/schemas/TemporaryGrantRequestDecisionRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2028-02-16T00:00:00Z" decided_at: "2028-02-16T01:00:00Z" decided_by_user_id: 23456789-2345-2345-2345-234567890123 entity_key: user_handle:jane@example.com expires_at: "2028-03-01T00:00:00Z" justification: Credits needed to finish the incident investigation. quota_namespace: ai_credits requested_by_user_id: 12345678-1234-1234-1234-123456789012 status: approved total: 200 id: 34567890-3456-3456-3456-345678901234 type: temporary_grant_requests schema: $ref: "#/components/schemas/TemporaryGrantRequestResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - billing_edit summary: Decide a temporary grant request tags: - Usage Metering x-permission: operator: OR permissions: - billing_edit x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/usage/admin/temporary-grant-requests/{request_id}/grant: delete: description: Revoke only the grant that's still associated with this approved request. The request and audit history remain. A stale request can't revoke a replacement grant. Requires the Billing Edit permission. Requires an authenticated human user. Service-account credentials aren't supported. Request status remains approved after the grant's expiry, revocation, or replacement. operationId: DeleteRequestedTemporaryGrant parameters: - description: The temporary grant request UUID. in: path name: request_id required: true schema: description: The request UUID. example: 12345678-1234-1234-1234-123456789012 format: uuid type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - billing_edit summary: Revoke a requested temporary grant tags: - Usage Metering x-permission: operator: OR permissions: - billing_edit x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/usage/application_security: get: deprecated: true description: |- Get hourly usage for application security . **Note:** This endpoint has been deprecated. Hourly usage data for all products is now available in the [Get hourly usage by product family API](https://docs.datadoghq.com/api/latest/usage-metering/#get-hourly-usage-by-product-family) operationId: GetUsageApplicationSecurityMonitoring parameters: - description: "Datetime in ISO-8601 format, UTC, precise to hour: `[YYYY-MM-DDThh]` for usage beginning at this hour." in: query name: start_hr required: true schema: format: date-time type: string - description: |- Datetime in ISO-8601 format, UTC, precise to hour: `[YYYY-MM-DDThh]` for usage ending **before** this hour. in: query name: end_hr required: false schema: format: date-time type: string responses: "200": content: application/json;datetime-format=rfc3339: examples: default: value: data: [] schema: $ref: "#/components/schemas/UsageApplicationSecurityMonitoringResponse" description: OK "400": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden - User is not authorized "429": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read summary: Get hourly usage for application security tags: - Usage Metering "x-permission": operator: OR permissions: - usage_read /api/v2/usage/billing_dimension_mapping: get: description: |- Get a mapping of billing dimensions to the corresponding keys for the supported usage metering public API endpoints. Mapping data is updated on a monthly cadence. This endpoint is only accessible to [parent-level organizations](https://docs.datadoghq.com/account_management/multi_organization/). operationId: GetBillingDimensionMapping parameters: - description: "Datetime in ISO-8601 format, UTC, and for mappings beginning this month. Defaults to the current month." in: query name: filter[month] required: false schema: format: date-time type: string - description: "String to specify whether to retrieve active billing dimension mappings for the contract or for all available mappings. Allowed views have the string `active` or `all`. Defaults to `active`." in: query name: filter[view] required: false schema: default: active type: string responses: "200": content: application/json;datetime-format=rfc3339: examples: default: value: data: [] schema: $ref: "#/components/schemas/BillingDimensionsMappingResponse" description: OK "400": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden - User is not authorized "429": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read summary: Get billing dimension mapping for usage endpoints tags: - Usage Metering "x-permission": operator: OR permissions: - usage_read /api/v2/usage/cost_by_org: get: deprecated: true description: |- Get cost across multi-org account. Cost by org data for a given month becomes available no later than the 16th of the following month. **Note:** This endpoint has been deprecated. Please use the new endpoint [`/historical_cost`](https://docs.datadoghq.com/api/latest/usage-metering/#get-historical-cost-across-your-account) instead. This endpoint is only accessible for [parent-level organizations](https://docs.datadoghq.com/account_management/multi_organization/). operationId: GetCostByOrg parameters: - description: "Datetime in ISO-8601 format, UTC, precise to month: `[YYYY-MM]` for cost beginning this month." in: query name: start_month required: true schema: format: date-time type: string - description: "Datetime in ISO-8601 format, UTC, precise to month: `[YYYY-MM]` for cost ending this month." in: query name: end_month required: false schema: format: date-time type: string responses: "200": content: application/json;datetime-format=rfc3339: examples: default: value: data: [] schema: $ref: "#/components/schemas/CostByOrgResponse" description: OK "400": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden - User is not authorized "429": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read - billing_read summary: Get cost across multi-org account tags: - Usage Metering "x-permission": operator: AND permissions: - usage_read - billing_read /api/v2/usage/estimated_cost: get: description: |- Get estimated cost across multi-org and single root-org accounts. Estimated cost data is only available for the current month and previous month and is delayed by up to 72 hours from when it was incurred. To access historical costs prior to this, use the `/historical_cost` endpoint. This endpoint is only accessible for [parent-level organizations](https://docs.datadoghq.com/account_management/multi_organization/). operationId: GetEstimatedCostByOrg parameters: - description: "String to specify whether cost is broken down at a parent-org level or at the sub-org level. Available views are `summary` and `sub-org`. Defaults to `summary`." in: query name: view required: false schema: type: string - description: "Datetime in ISO-8601 format, UTC, precise to month: `[YYYY-MM]` for cost beginning this month. **Either start_month or start_date should be specified, but not both.** (start_month cannot go beyond two months in the past). Provide an `end_month` to view month-over-month cost." in: query name: start_month required: false schema: format: date-time type: string - description: "Datetime in ISO-8601 format, UTC, precise to month: `[YYYY-MM]` for cost ending this month." in: query name: end_month required: false schema: format: date-time type: string - description: "Datetime in ISO-8601 format, UTC, precise to day: `[YYYY-MM-DD]` for cost beginning this day. **Either start_month or start_date should be specified, but not both.** (start_date cannot go beyond two months in the past). Provide an `end_date` to view day-over-day cumulative cost." in: query name: start_date required: false schema: format: date-time type: string - description: "Datetime in ISO-8601 format, UTC, precise to day: `[YYYY-MM-DD]` for cost ending this day." in: query name: end_date required: false schema: format: date-time type: string - description: "Controls how costs are aggregated when using `start_date`. The `cumulative` option returns month-to-date running totals." in: query name: cost_aggregation required: false schema: $ref: "#/components/schemas/CostAggregationType" - description: "Boolean to specify whether to include accounts connected to the current account as partner customers in the Datadog partner network program. Defaults to `false`." in: query name: include_connected_accounts required: false schema: default: false type: boolean responses: "200": content: application/json;datetime-format=rfc3339: examples: default: value: data: [] schema: $ref: "#/components/schemas/CostByOrgResponse" description: OK "400": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden - User is not authorized "429": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read - billing_read summary: Get estimated cost across your account tags: - Usage Metering "x-permission": operator: AND permissions: - usage_read - billing_read /api/v2/usage/historical_cost: get: description: |- Get historical cost across multi-org and single root-org accounts. Cost data for a given month becomes available no later than the 16th of the following month. This endpoint is only accessible for [parent-level organizations](https://docs.datadoghq.com/account_management/multi_organization/). operationId: GetHistoricalCostByOrg parameters: - description: "Datetime in ISO-8601 format, UTC, precise to month: `[YYYY-MM]` for cost beginning this month." in: query name: start_month required: true schema: format: date-time type: string - description: "String to specify whether cost is broken down at a parent-org level or at the sub-org level. Available views are `summary` and `sub-org`. Defaults to `summary`." in: query name: view required: false schema: type: string - description: "Datetime in ISO-8601 format, UTC, precise to month: `[YYYY-MM]` for cost ending this month." in: query name: end_month required: false schema: format: date-time type: string - description: "Boolean to specify whether to include accounts connected to the current account as partner customers in the Datadog partner network program. Defaults to `false`." in: query name: include_connected_accounts required: false schema: default: false type: boolean responses: "200": content: application/json;datetime-format=rfc3339: examples: default: value: data: [] schema: $ref: "#/components/schemas/CostByOrgResponse" description: OK "400": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden - User is not authorized "429": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read - billing_read summary: Get historical cost across your account tags: - Usage Metering "x-permission": operator: AND permissions: - usage_read - billing_read /api/v2/usage/hourly_usage: get: description: Get hourly usage by product family. operationId: GetHourlyUsage parameters: - description: "Datetime in ISO-8601 format, UTC, precise to hour: [YYYY-MM-DDThh] for usage beginning at this hour." in: query name: filter[timestamp][start] required: true schema: format: date-time type: string - description: "Datetime in ISO-8601 format, UTC, precise to hour: [YYYY-MM-DDThh] for usage ending **before** this hour." in: query name: filter[timestamp][end] required: false schema: format: date-time type: string - description: |- Comma separated list of product families to retrieve. Available families are `all`, `ai`, `analyzed_logs`, `application_performance_monitoring`, `application_security`, `audit_trail`, `bits_ai`, `serverless`, `ci_app`, `cloud_cost_management`, `cloud_siem`, `csm_container_enterprise`, `csm_host_enterprise`, `csm_host_pro`, `cspm`, `custom_events`, `cws`, `data_observability`, `dbm`, `digital_experience_management`, `error_tracking`, `fargate`, `infra_hosts`, `incident_management`, `indexed_logs`, `indexed_spans`, `infrastructure_monitoring`, `ingested_spans`, `iot`, `lambda_traced_invocations`, `llm_observability`, `log_management`, `logs`, `network_flows`, `network_hosts`, `network_monitoring`, `observability_pipelines`, `online_archive`, `platform_capabilities`, `product_analytics`, `profiling`, `rum`, `rum_browser_sessions`, `rum_mobile_sessions`, `sds`, `security`, `snmp`, `software_delivery`, `synthetics_api`, `synthetics_browser`, `synthetics_mobile`, `synthetics_parallel_testing`, `timeseries`, `vuln_management` and `workflow_executions`. The following product family has been **deprecated**: `audit_logs`. in: query name: filter[product_families] required: true schema: type: string - description: "Include child org usage in the response. Defaults to false." in: query name: filter[include_descendants] required: false schema: default: false type: boolean - description: "Boolean to specify whether to include accounts connected to the current account as partner customers in the Datadog partner network program. Defaults to false." in: query name: filter[include_connected_accounts] required: false schema: default: false type: boolean - description: "Include breakdown of usage by subcategories where applicable (for product family logs only). Defaults to false." in: query name: filter[include_breakdown] required: false schema: default: false type: boolean - description: |- Comma separated list of product family versions to use in the format `product_family:version`. For example, `infra_hosts:1.0.0`. If this parameter is not used, the API will use the latest version of each requested product family. Currently all families have one version `1.0.0`. in: query name: filter[versions] required: false schema: type: string - description: "Maximum number of results to return (between 1 and 500) - defaults to 500 if limit not specified." in: query name: page[limit] required: false schema: default: 500 format: int32 maximum: 500 minimum: 1 type: integer - description: "List following results with a next_record_id provided in the previous query." in: query name: page[next_record_id] required: false schema: type: string responses: "200": content: application/json;datetime-format=rfc3339: examples: default: value: data: - id: abc-123 type: usage_timeseries schema: $ref: "#/components/schemas/HourlyUsageResponse" description: OK "400": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden - User is not authorized "429": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read summary: Get hourly usage by product family tags: - Usage Metering "x-permission": operator: OR permissions: - usage_read /api/v2/usage/lambda_traced_invocations: get: deprecated: true description: |- Get hourly usage for Lambda traced invocations. **Note:** This endpoint has been deprecated.. Hourly usage data for all products is now available in the [Get hourly usage by product family API](https://docs.datadoghq.com/api/latest/usage-metering/#get-hourly-usage-by-product-family) operationId: GetUsageLambdaTracedInvocations parameters: - description: "Datetime in ISO-8601 format, UTC, precise to hour: `[YYYY-MM-DDThh]` for usage beginning at this hour." in: query name: start_hr required: true schema: format: date-time type: string - description: |- Datetime in ISO-8601 format, UTC, precise to hour: `[YYYY-MM-DDThh]` for usage ending **before** this hour. in: query name: end_hr required: false schema: format: date-time type: string responses: "200": content: application/json;datetime-format=rfc3339: examples: default: value: data: [] schema: $ref: "#/components/schemas/UsageLambdaTracedInvocationsResponse" description: OK "400": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden - User is not authorized "429": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read summary: Get hourly usage for Lambda traced invocations tags: - Usage Metering "x-permission": operator: OR permissions: - usage_read /api/v2/usage/observability_pipelines: get: deprecated: true description: |- Get hourly usage for observability pipelines. **Note:** This endpoint has been deprecated. Hourly usage data for all products is now available in the [Get hourly usage by product family API](https://docs.datadoghq.com/api/latest/usage-metering/#get-hourly-usage-by-product-family) operationId: GetUsageObservabilityPipelines parameters: - description: "Datetime in ISO-8601 format, UTC, precise to hour: `[YYYY-MM-DDThh]` for usage beginning at this hour." in: query name: start_hr required: true schema: format: date-time type: string - description: |- Datetime in ISO-8601 format, UTC, precise to hour: `[YYYY-MM-DDThh]` for usage ending **before** this hour. in: query name: end_hr required: false schema: format: date-time type: string responses: "200": content: application/json;datetime-format=rfc3339: examples: default: value: data: [] schema: $ref: "#/components/schemas/UsageObservabilityPipelinesResponse" description: OK "400": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden - User is not authorized "429": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read summary: Get hourly usage for observability pipelines tags: - Usage Metering "x-permission": operator: OR permissions: - usage_read /api/v2/usage/projected_cost: get: description: |- Get projected cost across multi-org and single root-org accounts. Projected cost data is only available for the current month and becomes available around the 12th of the month. This endpoint is only accessible for [parent-level organizations](https://docs.datadoghq.com/account_management/multi_organization/). operationId: GetProjectedCost parameters: - description: "String to specify whether cost is broken down at a parent-org level or at the sub-org level. Available views are `summary` and `sub-org`. Defaults to `summary`." in: query name: view required: false schema: type: string - description: "Boolean to specify whether to include accounts connected to the current account as partner customers in the Datadog partner network program. Defaults to `false`." in: query name: include_connected_accounts required: false schema: default: false type: boolean responses: "200": content: application/json;datetime-format=rfc3339: examples: default: value: data: [] schema: $ref: "#/components/schemas/ProjectedCostResponse" description: OK "400": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden - User is not authorized "429": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read - billing_read summary: Get projected cost across your account tags: - Usage Metering "x-permission": operator: AND permissions: - usage_read - billing_read /api/v2/usage/quotas/{quota_namespace}: get: description: |- Lists usage quotas for the caller's organization in a quota namespace. You can optionally include descendant organizations in the same datacenter as the caller. Requires the `billing_read` or `billing_edit` permission. operationId: ListQuotas parameters: - description: The product-specific namespace whose usage quotas are being managed. in: path name: quota_namespace required: true schema: example: ai_credits type: string - description: Whether to include quotas configured on descendant organizations in the caller's organization hierarchy. Only descendants in the same datacenter are supported. in: query name: include_descendants required: false schema: default: false type: boolean - description: An opaque cursor from a previous response's `meta.page.next_cursor` used to retrieve the next page. in: query name: page[cursor] required: false schema: type: string - description: The number of usage quotas to return per page. in: query name: page[limit] required: false schema: default: 100 format: int64 maximum: 1000 minimum: 1 type: integer responses: "200": content: application/json: examples: default: value: data: - attributes: enforced: true org_public_id: abcdef12345 scope: user_handle: jane@example.com usage_limit: 100000 id: "MTIzNB9haV9jcmVkaXRzH3VzZXJfaGFuZGxlOmphbmVAZXhhbXBsZS5jb20" type: quotas - attributes: enforced: true org_public_id: abcdef12345 pending_effective_from: "2026-11" pending_usage_limit: 100000 usage_limit: 600000 id: "MTIzNB9haV9jcmVkaXRzH3VzZXJfaGFuZGxlOl9fQUxMX18" type: quotas meta: page: next_cursor: eyJvZmZzZXQiOjEwMH0= schema: $ref: "#/components/schemas/UsageQuotasListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - billing_read - AuthZ: - billing_edit summary: List usage quotas tags: - Usage Metering x-pagination: cursorParam: page[cursor] cursorPath: meta.page.next_cursor limitParam: page[limit] resultsPath: data "x-permission": operator: OR permissions: - billing_read - billing_edit x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: |- Creates or updates one or more usage quotas by scope. If a quota already exists for a supplied scope, it is updated. Otherwise, a quota is created only when `usage_limit` and `enforced` are provided. For the organization-wide quota, `pending_usage_limit` schedules a limit for the next usage period and can accompany an immediate limit or update an existing quota by itself. Scheduled changes follow `include_descendants` like the other fields. Requires the `billing_edit` permission. ### Quota namespaces and scope keys The `quota_namespace` path parameter selects the product whose usage quotas are managed. Each namespace supports its own scope keys, described below. Omit `scope` for the organization-wide quota. #### `ai_credits` scope keys Each item's `scope` contains exactly one of the following keys. **`user_handle`** - **Value:** The handle of a user, for example `jane@example.com`, or `"*"` for the default quota applied to users without a specific quota. User handles are returned in the `data[].attributes.handle` field by the [Users API](https://docs.datadoghq.com/api/latest/users/#list-all-users). - **Validation:** A specific handle must identify an existing user in the caller's organization when `include_descendants` is false. When `include_descendants` is true, the handle must exist in the caller's organization or in at least one targeted descendant organization. The quota is then applied only to the organizations where the handle exists, and the item fails only if the handle exists in none of them. **`role_uuid`** - **Value:** The UUID of a role, for example `12345678-1234-1234-1234-123456789012`. `"*"` is not accepted because there is no default role quota. Role UUIDs are returned in the `data[].id` field by the [Roles API](https://docs.datadoghq.com/api/latest/roles/#list-roles). - **Validation:** The role must exist in the caller's organization. Role UUIDs are unique, so `include_descendants` has no effect on a `role_uuid` scope: the role is validated against the caller's organization only. operationId: CreateQuotas parameters: - description: The product-specific namespace whose usage quotas are being managed. in: path name: quota_namespace required: true schema: example: ai_credits type: string - description: Whether to write every item in the request to the caller's organization and all of its descendant organizations, instead of only the caller's organization. Only descendants in the same datacenter are supported. For a user-handle scope, the quota is applied only to the caller's organization and to descendant organizations where that user handle exists; the item fails only if the handle exists in none of them. in: query name: include_descendants required: false schema: default: false type: boolean requestBody: content: application/json: examples: default: summary: Create or update quotas for the caller's organization. value: data: - attributes: enforced: true scope: user_handle: jane@example.com usage_limit: 100000 type: quotas - attributes: enforced: false scope: user_handle: "*" usage_limit: 250000 type: quotas schedule_reduction: summary: Set a limit and schedule a reduction value: data: - attributes: enforced: true pending_usage_limit: 100000 usage_limit: 600000 type: quotas schema: $ref: "#/components/schemas/UsageQuotasCreateRequest" description: The usage quotas to create or update. required: true responses: "200": content: application/json: examples: default: value: data: - attributes: enforced: true org_public_id: abcdef12345 scope: user_handle: jane@example.com usage_limit: 100000 id: "MTIzNB9haV9jcmVkaXRzH3VzZXJfaGFuZGxlOmphbmVAZXhhbXBsZS5jb20" type: quotas - attributes: error: usage_limit is out of range id: "MTIzNB9haV9jcmVkaXRzH3VzZXJfaGFuZGxlOnVzZXJAZXhhbXBsZS5jb20" type: quotas schema: $ref: "#/components/schemas/UsageQuotasBulkResponse" description: OK. The response includes each item's result; see each item's `error` attribute for any that failed to write. "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request. Returned if the request is malformed, including when an item sets `pending_usage_limit` on a scoped quota, provides `enforced` without `usage_limit`, or provides neither limit. A pending-only item for a quota that does not exist is reported in that item's `error`; when only the caller's organization is targeted, this failure returns `400`. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" "500": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Internal Server Error. Every item in the batch failed to write. security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - billing_edit summary: Create or update usage quotas tags: - Usage Metering "x-permission": operator: OR permissions: - billing_edit x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/usage/quotas/{quota_namespace}/{id}: delete: description: |- Deletes a usage quota by its opaque identifier. The quota must belong to the caller's organization or one of its descendants, and its opaque identifier must belong to the requested quota namespace. Requires the `billing_edit` permission. operationId: DeleteQuota parameters: - description: The product-specific namespace whose usage quotas are being managed. in: path name: quota_namespace required: true schema: example: ai_credits type: string - description: The opaque quota identifier returned by a previous list or create request. Clients must pass this value verbatim. in: path name: id required: true schema: example: "MTIzNB9haV9jcmVkaXRzH3VzZXJfaGFuZGxlOl9fQUxMX18" type: string responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - billing_edit summary: Delete a usage quota tags: - Usage Metering "x-permission": operator: OR permissions: - billing_edit x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). patch: description: |- Updates the supplied fields on a usage quota and leaves omitted fields unchanged. For an organization-wide quota, `pending_usage_limit` schedules a limit for the next usage period. The quota must belong to the caller's organization or one of its descendants, and its opaque identifier must belong to the requested quota namespace. Requires the `billing_edit` permission. operationId: UpdateQuota parameters: - description: The product-specific namespace whose usage quotas are being managed. in: path name: quota_namespace required: true schema: example: ai_credits type: string - description: The opaque quota identifier returned by a previous list or create request. Clients must pass this value verbatim. in: path name: id required: true schema: example: "MTIzNB9haV9jcmVkaXRzH3VzZXJfaGFuZGxlOl9fQUxMX18" type: string requestBody: content: application/json: examples: default: value: data: attributes: enforced: false usage_limit: 120000 id: "MTIzNB9haV9jcmVkaXRzH3VzZXJfaGFuZGxlOl9fQUxMX18" type: quotas schema: $ref: "#/components/schemas/UsageQuotaUpdateRequest" description: The usage quota fields to update. Omitting an attribute leaves its current value unchanged. required: true responses: "200": content: application/json: examples: default: value: data: attributes: enforced: false org_public_id: abcdef12345 usage_limit: 120000 id: "MTIzNB9haV9jcmVkaXRzH3VzZXJfaGFuZGxlOl9fQUxMX18" type: quotas schema: $ref: "#/components/schemas/UsageQuotaResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request. Returned if the request is malformed, if the `id` in the request body does not match the `id` in the request path, if none of `usage_limit`, `enforced`, or `pending_usage_limit` is provided, or if `pending_usage_limit` is set on a scoped quota. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - billing_edit summary: Update a usage quota tags: - Usage Metering "x-permission": operator: OR permissions: - billing_edit x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/usage/quotas/{quota_namespace}/{id}/pending: delete: description: |- Cancels the limit change scheduled to take effect at the start of the next usage period, leaving the usage quota and its current limit unchanged. Returns `404` when the quota does not exist, has no scheduled change, or its scheduled change has already taken effect; in every case the quota is left unchanged. The quota must belong to the caller's organization or one of its descendants, and its opaque identifier must belong to the requested quota namespace. Requires the `billing_edit` permission. operationId: DeletePendingQuota parameters: - description: The product-specific namespace whose usage quotas are being managed. in: path name: quota_namespace required: true schema: example: ai_credits type: string - description: The opaque quota identifier returned by a previous list or create request. Clients must pass this value verbatim. in: path name: id required: true schema: example: "MTIzNB9haV9jcmVkaXRzH3VzZXJfaGFuZGxlOl9fQUxMX18" type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request. Returned if the `id` is malformed or does not belong to the requested quota namespace. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - billing_edit summary: Cancel a scheduled usage quota limit tags: - Usage Metering "x-permission": operator: OR permissions: - billing_edit x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/usage/summary/available_fields: get: description: |- List the field names returned by `GET /api/v1/usage/summary` at each of its three response levels. Each list contains every key the data endpoint emits—both typed fields declared in the OpenAPI spec and untyped keys exposed through `additionalProperties` (the latter used for billing dimensions and usage types added after the v1 schema freeze). This endpoint is only accessible for [parent-level organizations](https://docs.datadoghq.com/account_management/multi_organization/). Go example: ```go fields, _, err := api.GetUsageSummaryAvailableFields(ctx) attr := fields.Data.GetAttributes() // resp is the *UsageSummaryResponse returned by api.GetUsageSummary(ctx, ...) // Layer 1: UsageSummaryResponse for _, key := range attr.GetResponseFields() { if val, ok := resp.AdditionalProperties[key]; ok { fmt.Println(key, val.(json.Number)) } } // Layer 2: UsageSummaryDate (per month) for _, date := range resp.GetUsage() { for _, key := range attr.GetDateFields() { if val, ok := date.AdditionalProperties[key]; ok { fmt.Println(key, val.(json.Number)) } } // Layer 3: UsageSummaryDateOrg (per org per month) for _, org := range date.GetOrgs() { for _, key := range attr.GetDateOrgFields() { if val, ok := org.AdditionalProperties[key]; ok { fmt.Println(key, val.(json.Number)) } } } } ``` operationId: GetUsageSummaryAvailableFields responses: "200": content: application/json;datetime-format=rfc3339: examples: default: value: data: attributes: date_fields: - agent_host_top99p - aws_host_top99p - ccm_anthropic_spend_last date_org_fields: - agent_host_top99p - aws_host_top99p - ccm_anthropic_spend_last response_fields: - agent_host_top99p_sum - aws_host_top99p_sum - ccm_anthropic_spend_last_sum id: all type: usage_summary_available_fields schema: $ref: "#/components/schemas/UsageSummaryAvailableFieldsResponse" description: OK. "403": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden - User is not authorized. "429": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too many requests. security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read summary: Get available fields for usage summary tags: - Usage Metering "x-permission": operator: OR permissions: - usage_read /api/v2/usage/temporary-grant-requests: get: description: List the authenticated user's own requests, including decided requests. Other users' requests are never included. Requires an authenticated human user. Service-account credentials aren't supported. Request status remains approved after the grant's expiry, revocation, or replacement. operationId: ListMyTemporaryGrantRequests parameters: - description: Optional status. Defaults to all statuses. in: query name: filter[status] required: false schema: $ref: "#/components/schemas/TemporaryGrantRequestStatus" - description: Page size, from 1 to 100. in: query name: page[limit] required: false schema: default: 50 format: int64 maximum: 100 minimum: 1 type: integer - description: UUID cursor from meta.page.next_cursor. in: query name: page[cursor] required: false schema: format: uuid type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2028-02-16T00:00:00Z" entity_key: user_handle:jane@example.com expires_at: "2028-03-01T00:00:00Z" justification: Credits needed to finish the incident investigation. quota_namespace: ai_credits requested_by_user_id: 12345678-1234-1234-1234-123456789012 status: pending total: 200 id: 34567890-3456-3456-3456-345678901234 type: temporary_grant_requests meta: page: {} schema: $ref: "#/components/schemas/TemporaryGrantRequestListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - assistant_access - AuthZ: - bits_dev_write - AuthZ: - bits_investigations_write - AuthZ: - bits_security_analyst_write - AuthZ: - agent_builder_run - AuthZ: - billing_edit summary: List your temporary grant requests tags: - Usage Metering x-pagination: cursorParam: page[cursor] cursorPath: meta.page.next_cursor limitParam: page[limit] resultsPath: data x-permission: operator: OR permissions: - assistant_access - bits_dev_write - bits_investigations_write - bits_security_analyst_write - agent_builder_run - billing_edit x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Request a temporary increase to your monthly AI credit limit. Set `total` to the new monthly limit you need, in whole credits, not the number of credits to add. Include a justification and, optionally, an expiry. If you omit the expiry, the grant ends at the next UTC month boundary. A user with the Billing Edit permission approves or denies the request. Requires an authenticated human user. Service-account credentials are unsupported. operationId: CreateTemporaryGrantRequest requestBody: content: application/json: examples: default: value: data: attributes: expires_at: "2028-03-01T00:00:00Z" justification: Credits needed to finish the incident investigation. total: 200 type: temporary_grant_requests schema: $ref: "#/components/schemas/TemporaryGrantRequestCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: created_at: "2028-02-16T00:00:00Z" entity_key: user_handle:jane@example.com expires_at: "2028-03-01T00:00:00Z" justification: Credits needed to finish the incident investigation. quota_namespace: ai_credits requested_by_user_id: 12345678-1234-1234-1234-123456789012 status: pending total: 200 id: 34567890-3456-3456-3456-345678901234 type: temporary_grant_requests schema: $ref: "#/components/schemas/TemporaryGrantRequestResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - assistant_access - AuthZ: - bits_dev_write - AuthZ: - bits_investigations_write - AuthZ: - bits_security_analyst_write - AuthZ: - agent_builder_run - AuthZ: - billing_edit summary: Create a temporary grant request tags: - Usage Metering x-permission: operator: OR permissions: - assistant_access - bits_dev_write - bits_investigations_write - bits_security_analyst_write - agent_builder_run - billing_edit x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/usage/temporary-grant-requests/{request_id}: delete: description: Cancel a pending request that you own. The request history is kept, and no grant is created or revoked. Requires an authenticated human user. Service-account credentials are unsupported. operationId: DeleteTemporaryGrantRequest parameters: - description: The temporary grant request UUID. in: path name: request_id required: true schema: description: The request UUID. example: 12345678-1234-1234-1234-123456789012 format: uuid type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - assistant_access - AuthZ: - bits_dev_write - AuthZ: - bits_investigations_write - AuthZ: - bits_security_analyst_write - AuthZ: - agent_builder_run - AuthZ: - billing_edit summary: Cancel your temporary grant request tags: - Usage Metering x-permission: operator: OR permissions: - assistant_access - bits_dev_write - bits_investigations_write - bits_security_analyst_write - agent_builder_run - billing_edit x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Read an owned request, its decision, and its linked grant state. Requires an authenticated human user. Service-account credentials are unsupported. Request status remains approved after expiry, revocation, or replacement. operationId: GetMyTemporaryGrantRequest parameters: - description: The temporary grant request UUID. in: path name: request_id required: true schema: description: The request UUID. example: 12345678-1234-1234-1234-123456789012 format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2028-02-16T00:00:00Z" entity_key: user_handle:jane@example.com expires_at: "2028-03-01T00:00:00Z" justification: Credits needed to finish the incident investigation. quota_namespace: ai_credits requested_by_user_id: 12345678-1234-1234-1234-123456789012 status: pending total: 200 id: 34567890-3456-3456-3456-345678901234 type: temporary_grant_requests schema: $ref: "#/components/schemas/TemporaryGrantRequestResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "401": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - assistant_access - AuthZ: - bits_dev_write - AuthZ: - bits_investigations_write - AuthZ: - bits_security_analyst_write - AuthZ: - agent_builder_run - AuthZ: - billing_edit summary: Get your temporary grant request tags: - Usage Metering x-permission: operator: OR permissions: - assistant_access - bits_dev_write - bits_investigations_write - bits_security_analyst_write - agent_builder_run - billing_edit x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/usage/usage-attribution-types: get: description: |- Get usage attribution types. operationId: GetUsageAttributionTypes responses: "200": content: application/json;datetime-format=rfc3339: examples: default: value: data: id: abc-123 type: usage_attribution_types schema: $ref: "#/components/schemas/UsageAttributionTypesResponse" description: OK "403": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden - User is not authorized "429": content: application/json;datetime-format=rfc3339: schema: $ref: "#/components/schemas/APIErrorResponse" description: Too many requests security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - usage_read summary: Get usage attribution types tags: - Usage Metering "x-permission": operator: OR permissions: - usage_read /api/v2/user_authorized_clients: get: description: Get a list of all OAuth2 clients authorized by the current user. operationId: ListUserAuthorizedClients parameters: - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - description: Filter results by client name, app title, or app description. in: query name: filter required: false schema: type: string - description: Filter results by the user-level disabled status. in: query name: filter[disabled] required: false schema: type: string - description: "Comma-separated list of related resources to include. Options: `oauth2_client`, `oauth2_client.app`." in: query name: include required: false schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-10T08:00:00+00:00" disabled: false last_exercised: "2024-01-15T10:30:00+00:00" modified_at: "2024-01-10T08:00:00+00:00" org_disabled: false id: "00000000-0000-0000-0000-000000000001" relationships: oauth2_client: data: id: "00000000-0000-0000-0000-000000000010" type: oauth2_clients scopes: data: - id: "example_scope" type: scopes user: data: id: "00000000-0000-9999-0000-000000000001" type: users type: user_authorized_clients meta: page: total_count: 1 total_filtered_count: 1 schema: $ref: "#/components/schemas/UserAuthorizedClientsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authentication error "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - built_in_features summary: List user authorized clients tags: - User Authorized Clients x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data /api/v2/user_authorized_clients/client/{client_id}: delete: description: Disable all authorizations the current user has granted to the specified OAuth2 client. operationId: DeleteUserAuthorizedClientsByClient parameters: - $ref: "#/components/parameters/OAuth2ClientId" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete all user authorized clients for a client tags: - User Authorized Clients /api/v2/user_authorized_clients/{user_authorized_client_id}: delete: description: Disable the current user's authorization for the specified OAuth2 client. operationId: DeleteUserAuthorizedClient parameters: - $ref: "#/components/parameters/UserAuthorizedClientId" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - built_in_features summary: Delete a user authorized client tags: - User Authorized Clients get: description: Get a single OAuth2 client authorization for the current user. operationId: GetUserAuthorizedClient parameters: - $ref: "#/components/parameters/UserAuthorizedClientId" responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-10T08:00:00+00:00" disabled: false last_exercised: "2024-01-15T10:30:00+00:00" modified_at: "2024-01-10T08:00:00+00:00" org_disabled: false id: "00000000-0000-0000-0000-000000000001" relationships: oauth2_client: data: id: "00000000-0000-0000-0000-000000000010" type: oauth2_clients scopes: data: - id: "example_scope" type: scopes user: data: id: "00000000-0000-9999-0000-000000000001" type: users type: user_authorized_clients schema: $ref: "#/components/schemas/UserAuthorizedClientResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - built_in_features summary: Get a user authorized client tags: - User Authorized Clients /api/v2/user_invitations: post: description: Sends emails to one or more users inviting them to join the organization. operationId: SendInvitations requestBody: content: application/json: examples: default: value: data: - relationships: user: data: id: 6cf192b6-d1d9-11ec-ad3d-da7ad0900002 type: users type: user_invitations schema: $ref: "#/components/schemas/UserInvitationsRequest" required: true responses: "201": content: application/json: examples: default: value: data: - attributes: created_at: "2024-01-01T00:00:00+00:00" expires_at: "2024-01-08T00:00:00+00:00" invite_type: email uuid: 00000000-0000-0000-0000-000000000001 id: 00000000-0000-0000-0000-000000000007 type: user_invitations schema: $ref: "#/components/schemas/UserInvitationsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_invite summary: Send invitation emails tags: - Users x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_invite /api/v2/user_invitations/{user_invitation_uuid}: get: description: Returns a single user invitation by its UUID. operationId: GetInvitation parameters: - description: The UUID of the user invitation. in: path name: user_invitation_uuid required: true schema: example: "00000000-0000-0000-3456-000000000000" type: string responses: "200": content: application/json: examples: default: value: data: attributes: invite_type: email uuid: 00000000-0000-0000-0000-000000000001 id: 00000000-0000-0000-0000-000000000008 type: user_invitations schema: $ref: "#/components/schemas/UserInvitationResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_invite summary: Get a user invitation tags: - Users x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_invite /api/v2/users: get: description: |- Get the list of all users in the organization. This list includes all users even if they are deactivated or unverified. operationId: ListUsers parameters: - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" - description: |- User attribute to order results by. Sort order is ascending by default. Sort order is descending if the field is prefixed by a negative sign, for example `sort=-name`. Options: `name`, `modified_at`, `user_count`. in: query name: sort required: false schema: default: name example: name type: string - description: "Direction of sort. Options: `asc`, `desc`." in: query name: sort_dir required: false schema: $ref: "#/components/schemas/QuerySortOrder" - description: Filter all users by the given string. Defaults to no filtering. in: query name: filter required: false schema: type: string - description: |- Filter on status attribute. Comma separated list, with possible values `Active`, `Pending`, and `Disabled`. Defaults to no filtering. in: query name: filter[status] required: false schema: example: Active type: string responses: "200": content: application/json: examples: default: value: data: - attributes: email: test@example.com handle: example-handle name: Example Name status: Active id: 00000000-0000-0000-0000-000000000001 type: users included: [] meta: {} schema: $ref: "#/components/schemas/UsersResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_read summary: List all users tags: - Users x-codegen-request-body-name: body x-pagination: limitParam: page[size] pageParam: page[number] resultsPath: data "x-permission": operator: OR permissions: - user_access_read post: description: Create a user for your organization. operationId: CreateUser requestBody: content: application/json: examples: default: value: data: attributes: email: jane.doe@example.com relationships: roles: data: - id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: users schema: $ref: "#/components/schemas/UserCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: email: test@example.com handle: example-handle name: Example Name status: Active id: 00000000-0000-0000-0000-000000000002 type: users included: [] schema: $ref: "#/components/schemas/UserResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_invite summary: Create a user tags: - Users x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_invite /api/v2/users/{user_id}: delete: description: |- Disable a user. Can only be used with an application key belonging to an administrator user. operationId: DisableUser parameters: - $ref: "#/components/parameters/UserID" responses: "204": description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_manage summary: Disable a user tags: - Users x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_manage - service_account_write get: description: Get a user in the organization specified by the user’s `user_id`. operationId: GetUser parameters: - $ref: "#/components/parameters/UserID" responses: "200": content: application/json: examples: default: value: data: attributes: email: test@example.com handle: example-handle name: Example Name status: Active id: 00000000-0000-0000-0000-000000000003 type: users included: [] schema: $ref: "#/components/schemas/UserResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_read summary: Get user details tags: - Users x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_read patch: description: |- Edit a user. Can only be used with an application key belonging to an administrator user. operationId: UpdateUser parameters: - $ref: "#/components/parameters/UserID" requestBody: content: application/json: examples: default: value: data: id: 00000000-0000-feed-0000-000000000000 type: users schema: $ref: "#/components/schemas/UserUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: email: test@example.com handle: example-handle name: Example Name status: Active id: 00000000-0000-0000-0000-000000000004 type: users included: [] schema: $ref: "#/components/schemas/UserResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "422": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Unprocessable Entity "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_manage summary: Update a user tags: - Users x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_manage - service_account_write /api/v2/users/{user_id}/identity_providers: get: description: |- Get the identity provider overrides for a specific user in the organization. When a user has no overrides set, they use the organization's default identity providers. operationId: GetUserIdentityProviders parameters: - $ref: "#/components/parameters/UserID" responses: "200": content: application/json: examples: default: value: data: - attributes: authentication_method: "SAML" id: "00000000-0000-0000-0000-000000000001" type: identity_providers schema: $ref: "#/components/schemas/UserOverrideIdentityProvidersResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_manage summary: Get identity provider overrides for a user tags: - Users "x-permission": operator: OR permissions: - user_access_manage /api/v2/users/{user_id}/invitations: delete: description: |- Cancel all pending invitations for a specified user. Requires the `user_access_invite` permission. operationId: DeleteUserInvitations parameters: - description: The UUID of the user whose pending invitations should be canceled. in: path name: user_id required: true schema: example: "4dee724d-00cc-11ea-a77b-570c9d03c6c5" format: uuid type: string responses: "200": description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_invite summary: Delete a pending user's invitations tags: - Users "x-permission": operator: OR permissions: - user_access_invite /api/v2/users/{user_id}/orgs: get: description: |- Get a user organization. Returns the user information and all organizations joined by this user. operationId: ListUserOrganizations parameters: - $ref: "#/components/parameters/UserID" responses: "200": content: application/json: examples: default: value: data: attributes: email: test@example.com handle: example-handle name: Example Name status: Active id: 00000000-0000-0000-0000-000000000005 type: users included: [] schema: $ref: "#/components/schemas/UserResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a user organization tags: - Users x-codegen-request-body-name: body "x-permission": operator: OPEN permissions: [] /api/v2/users/{user_id}/permissions: get: description: |- Get a user permission set. Returns a list of the user’s permissions granted by the associated user's roles. operationId: ListUserPermissions parameters: - $ref: "#/components/parameters/UserID" responses: "200": content: application/json: examples: default: value: data: - attributes: display_name: Logs Read Data display_type: read name: logs_read_data restricted: false id: 00000000-0000-0000-0000-000000000006 type: permissions schema: $ref: "#/components/schemas/PermissionsResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_read summary: Get a user permissions tags: - Users x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_read /api/v2/users/{user_id}/relationships/identity_providers: patch: description: |- Set the identity provider overrides for a specific user in the organization. Pass an empty list to remove all overrides, reverting the user to the organization's default identity providers. operationId: UpdateUserIdentityProviders parameters: - $ref: "#/components/parameters/UserID" requestBody: content: application/json: examples: default: value: data: - id: "00000000-0000-0000-0000-000000000001" type: identity_providers schema: $ref: "#/components/schemas/UpdateUserIdentityProvidersRequest" required: true responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Authentication error "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_manage summary: Update identity provider overrides for a user tags: - Users x-codegen-request-body-name: body "x-permission": operator: OR permissions: - user_access_manage /api/v2/users/{user_uuid}/memberships: get: description: Get a list of memberships for a user operationId: GetUserMemberships parameters: - description: None in: path name: user_uuid required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: role: admin id: 00000000-0000-0000-0000-000000000001 type: team_memberships schema: $ref: "#/components/schemas/UserTeamsResponse" description: Represents a user's association to a team "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: API error response. "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Get user memberships tags: - Teams "x-permission": operator: OR permissions: - teams_read /api/v2/validate: get: description: Check if the API key is valid. Returns the organization UUID, API key ID, and associated scopes. operationId: Validate responses: "200": content: application/json: examples: default: value: data: attributes: api_key_id: "a1b2c3d4-e5f6-47a8-b9c0-d1e2f3a4b5c6" api_key_scopes: - "remote_config_read" valid: true id: "550e8400-e29b-41d4-a716-446655440000" type: "validate_v2" schema: $ref: "#/components/schemas/ValidateV2Response" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] summary: Validate API key tags: - Key Management "x-permission": operator: OPEN permissions: [] x-unstable: |- **Note**: This endpoint is in preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/validate_keys: get: description: |- Check that the API key and application key used for the request are both valid. Returns `{"status": "ok"}` on success, `401` or `403` otherwise. Useful as a lightweight authentication probe before issuing other API calls that require full credentials. operationId: ValidateAPIKey responses: "200": content: application/json: examples: default: value: status: ok schema: $ref: "#/components/schemas/ValidateAPIKeyResponse" description: OK "401": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Unauthorized "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Validate API and application keys tags: - Key Management "x-permission": operator: OPEN permissions: [] /api/v2/web-integrations/{integration_name}/accounts: get: description: List accounts for a given web integration. operationId: ListWebIntegrationAccounts parameters: - description: The name of the integration (for example, `databricks`). in: path name: integration_name required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: - attributes: name: my-databricks-account settings: workspace_url: https://example.azuredatabricks.net id: abc123def456 type: Account schema: $ref: "#/components/schemas/WebIntegrationAccountsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List web integration accounts tags: - Web Integrations "x-permission": operator: OR permissions: - integrations_read x-unstable: |- **Note**: This endpoint is for internal Datadog use only and is not part of the public API. It may change without notice. post: description: Create a new account for a given web integration. operationId: CreateWebIntegrationAccount parameters: - description: The name of the integration (for example, `databricks`). in: path name: integration_name required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: name: my-databricks-account secrets: client_secret: my-client-secret settings: workspace_url: https://example.azuredatabricks.net type: Account schema: $ref: "#/components/schemas/WebIntegrationAccountCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: name: my-databricks-account settings: workspace_url: https://example.azuredatabricks.net id: abc123def456 type: Account schema: $ref: "#/components/schemas/WebIntegrationAccountResponse" description: CREATED "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": $ref: "#/components/responses/UnprocessableEntityResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a web integration account tags: - Web Integrations x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is for internal Datadog use only and is not part of the public API. It may change without notice. /api/v2/web-integrations/{integration_name}/accounts/{account_id}: delete: description: Delete an account for a given web integration. operationId: DeleteWebIntegrationAccount parameters: - description: The name of the integration (for example, `databricks`). in: path name: integration_name required: true schema: type: string - description: The unique identifier of the web integration account. in: path name: account_id required: true schema: type: string responses: "204": description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a web integration account tags: - Web Integrations "x-permission": operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is for internal Datadog use only and is not part of the public API. It may change without notice. get: description: Get a single account for a given web integration. operationId: GetWebIntegrationAccount parameters: - description: The name of the integration (for example, `databricks`). in: path name: integration_name required: true schema: type: string - description: The unique identifier of the web integration account. in: path name: account_id required: true schema: type: string responses: "200": content: application/json: examples: default: value: data: attributes: name: my-databricks-account settings: workspace_url: https://example.azuredatabricks.net id: abc123def456 type: Account schema: $ref: "#/components/schemas/WebIntegrationAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a web integration account tags: - Web Integrations "x-permission": operator: OR permissions: - integrations_read x-unstable: |- **Note**: This endpoint is for internal Datadog use only and is not part of the public API. It may change without notice. patch: description: Update an existing account for a given web integration. operationId: UpdateWebIntegrationAccount parameters: - description: The name of the integration (for example, `databricks`). in: path name: integration_name required: true schema: type: string - description: The unique identifier of the web integration account. in: path name: account_id required: true schema: type: string requestBody: content: application/json: examples: default: value: data: attributes: name: my-databricks-account secrets: client_secret: my-new-client-secret settings: workspace_url: https://updated.azuredatabricks.net type: Account schema: $ref: "#/components/schemas/WebIntegrationAccountUpdateRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: name: my-databricks-account settings: workspace_url: https://updated.azuredatabricks.net id: abc123def456 type: Account schema: $ref: "#/components/schemas/WebIntegrationAccountResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "422": $ref: "#/components/responses/UnprocessableEntityResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Update a web integration account tags: - Web Integrations x-codegen-request-body-name: body "x-permission": operator: OR permissions: - manage_integrations x-unstable: |- **Note**: This endpoint is for internal Datadog use only and is not part of the public API. It may change without notice. /api/v2/widgets/{experience_type}: get: description: |- Search and list widgets for a given experience type, with filtering, sorting, and pagination. **Response meta** carries totals scoped to the current filter: - `filtered_total` — widgets matching the filter. - `created_by_you_total` — among the matches, how many the current user created. - `favorited_by_you_total` — among the matches, how many the current user has favorited. - `created_by_anyone_total` — total widgets in the experience type, ignoring filters. Each returned widget includes `is_favorited` reflecting the current user's favorite status. Favoriting itself is performed through the shared favorites API, not this endpoint. operationId: SearchWidgets parameters: - description: The experience type for the widget. in: path name: experience_type required: true schema: $ref: "#/components/schemas/WidgetExperienceType" - description: Filter widgets by widget type. in: query name: filter[widgetType] schema: $ref: "#/components/schemas/WidgetType" - description: Filter widgets by the email handle of the creator. in: query name: filter[creatorHandle] schema: example: "john.doe@example.com" type: string - description: Filter to only widgets favorited by the current user. in: query name: filter[isFavorited] schema: type: boolean - description: Filter widgets by title (substring match). in: query name: filter[title] schema: type: string - description: Filter widgets by tags. Format as bracket-delimited CSV, e.g. `[tag1,tag2]`. in: query name: filter[tags] schema: type: string - description: |- Sort field for the results. **`title`, `created_at`, `modified_at`** — both ascending and descending are supported. Use the bare field name for ascending (e.g. `sort=title`) or prefix with `-` for descending (e.g. `sort=-modified_at`). **`is_favorited`** — returns favorites-first ordering (favorited widgets first, then the rest). Direction is fixed; the `-` prefix is ignored for this field. in: query name: sort schema: default: "-modified_at" example: "-modified_at" type: string - description: Page number for pagination (0-indexed). in: query name: page[number] schema: default: 0 format: int64 minimum: 0 type: integer - description: Number of widgets per page. in: query name: page[size] schema: default: 50 format: int64 maximum: 100 type: integer responses: "200": content: application/json: examples: default: value: data: [] schema: $ref: "#/components/schemas/WidgetListResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Search widgets tags: - Widgets x-permission: operator: OR permissions: - cloud_cost_management_read - generate_log_reports - manage_log_reports - product_analytics_saved_widgets_read post: description: Create a new widget for a given experience type. operationId: CreateWidget parameters: - description: The experience type for the widget. in: path name: experience_type required: true schema: $ref: "#/components/schemas/WidgetExperienceType" requestBody: content: application/json: examples: default: summary: CCM cost summary widget value: data: attributes: definition: graph_options: - type: query_value view: total - type: query_value view: change - display_type: bars type: timeseries - type: cloud_cost_table view: summary requests: - formulas: - formula: query1 queries: - data_source: cloud_cost name: query1 query: sum:aws.cost.amortized{*} by {aws_product}.rollup(sum, daily) response_format: timeseries time: type: live unit: day value: 30 title: AWS spend by service (last 30 days) type: cloud_cost_summary tags: ["finops", "aws"] type: widgets schema: $ref: "#/components/schemas/CreateOrUpdateWidgetRequest" description: |- Widget request body. The `definition` object's required fields vary by `widget.definition.type`: every type requires `requests`, and some types require additional fields (e.g. `cloud_cost_summary` requires `graph_options`, `geomap` requires `style` and `view`). The example below shows a complete `cloud_cost_summary` payload for the `ccm_reports` experience type. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" definition: title: My Widget type: bar_chart is_favorited: false modified_at: "2024-01-01T00:00:00+00:00" tags: - "team:my-team" id: abc-123 type: widgets schema: $ref: "#/components/schemas/WidgetResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Create a widget tags: - Widgets x-codegen-request-body-name: body x-permission: operator: OR permissions: - cloud_cost_management_write - generate_log_reports - manage_log_reports - product_analytics_saved_widgets_write /api/v2/widgets/{experience_type}/{uuid}: delete: description: Soft-delete a widget by its UUID for a given experience type. operationId: DeleteWidget parameters: - description: The experience type for the widget. in: path name: experience_type required: true schema: $ref: "#/components/schemas/WidgetExperienceType" - description: The UUID of the widget. in: path name: uuid required: true schema: format: uuid type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Delete a widget tags: - Widgets x-permission: operator: OR permissions: - cloud_cost_management_write - generate_log_reports - manage_log_reports - product_analytics_saved_widgets_write get: description: Retrieve a widget by its UUID for a given experience type. operationId: GetWidget parameters: - description: The experience type for the widget. in: path name: experience_type required: true schema: $ref: "#/components/schemas/WidgetExperienceType" - description: The UUID of the widget. in: path name: uuid required: true schema: format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" definition: title: My Widget type: bar_chart is_favorited: false modified_at: "2024-01-01T00:00:00+00:00" tags: - "team:my-team" id: abc-123 type: widgets schema: $ref: "#/components/schemas/WidgetResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Get a widget tags: - Widgets x-permission: operator: OR permissions: - cloud_cost_management_read - generate_log_reports - manage_log_reports - product_analytics_saved_widgets_read put: description: Update a widget by its UUID for a given experience type. This performs a full replacement of the widget definition. operationId: UpdateWidget parameters: - description: The experience type for the widget. in: path name: experience_type required: true schema: $ref: "#/components/schemas/WidgetExperienceType" - description: The UUID of the widget. in: path name: uuid required: true schema: format: uuid type: string requestBody: content: application/json: examples: default: summary: CCM cost summary widget value: data: attributes: definition: graph_options: - type: query_value view: total - type: query_value view: change - display_type: bars type: timeseries - type: cloud_cost_table view: summary requests: - formulas: - formula: query1 queries: - data_source: cloud_cost name: query1 query: sum:aws.cost.amortized{*} by {aws_product}.rollup(sum, daily) response_format: timeseries time: type: live unit: day value: 30 title: AWS spend by service (last 30 days) type: cloud_cost_summary tags: ["finops", "aws"] type: widgets schema: $ref: "#/components/schemas/CreateOrUpdateWidgetRequest" description: |- Widget request body. The `definition` object's required fields vary by `widget.definition.type`; see `CreateWidget` above for a complete worked payload. Update is a full replacement of the widget definition. required: true responses: "200": content: application/json: examples: default: value: data: attributes: created_at: "2024-01-01T00:00:00+00:00" definition: title: My Widget type: bar_chart is_favorited: false modified_at: "2024-01-01T00:00:00+00:00" tags: - "team:my-team" id: abc-123 type: widgets schema: $ref: "#/components/schemas/WidgetResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/APIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Update a widget tags: - Widgets x-codegen-request-body-name: body x-permission: operator: OR permissions: - cloud_cost_management_write - generate_log_reports - manage_log_reports - product_analytics_saved_widgets_write /api/v2/wif/aws/intake_mapping: get: description: List AWS cloud authentication intake mappings configured for the organization. operationId: ListAWSCloudAuthIntakeMappings responses: "200": content: application/json: examples: default: value: data: - attributes: arn_pattern: arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/* id: c5c758c6-18c2-4484-ae3f-46b84128404a type: aws_cloud_auth_intake_mapping schema: $ref: "#/components/schemas/AWSCloudAuthIntakeMappingsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List AWS cloud authentication intake mappings tags: - Cloud Authentication x-unstable: "**Note**: This endpoint is in public beta and is subject to change.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." post: description: Create an AWS cloud authentication intake mapping to authorize an AWS ARN pattern for Agent authentication. The AWS account must already be integrated with Datadog, and managed API key rotation must be enabled for the organization. Patterns that conflict with existing intake or persona mappings are rejected. operationId: CreateAWSCloudAuthIntakeMapping requestBody: content: application/json: examples: default: value: data: attributes: arn_pattern: arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/* type: aws_cloud_auth_intake_mapping schema: $ref: "#/components/schemas/AWSCloudAuthIntakeMappingCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: arn_pattern: arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/* id: c5c758c6-18c2-4484-ae3f-46b84128404a type: aws_cloud_auth_intake_mapping schema: $ref: "#/components/schemas/AWSCloudAuthIntakeMappingResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create an AWS cloud authentication intake mapping tags: - Cloud Authentication x-codegen-request-body-name: body x-unstable: "**Note**: This endpoint is in public beta and is subject to change.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." /api/v2/wif/aws/intake_mapping/{intake_mapping_id}: delete: description: Delete an AWS cloud authentication intake mapping by ID. operationId: DeleteAWSCloudAuthIntakeMapping parameters: - $ref: "#/components/parameters/IntakeMappingID" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an AWS cloud authentication intake mapping tags: - Cloud Authentication x-unstable: "**Note**: This endpoint is in public beta and is subject to change.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." get: description: Get an AWS cloud authentication intake mapping by ID. operationId: GetAWSCloudAuthIntakeMapping parameters: - $ref: "#/components/parameters/IntakeMappingID" responses: "200": content: application/json: examples: default: value: data: attributes: arn_pattern: arn:aws:sts::123456789012:assumed-role/DatadogAgentRole/* id: c5c758c6-18c2-4484-ae3f-46b84128404a type: aws_cloud_auth_intake_mapping schema: $ref: "#/components/schemas/AWSCloudAuthIntakeMappingResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get an AWS cloud authentication intake mapping tags: - Cloud Authentication x-unstable: "**Note**: This endpoint is in public beta and is subject to change.\nIf you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/)." /api/v2/wif/aws/persona_mapping: get: description: List all AWS cloud authentication persona mappings. This endpoint retrieves all configured persona mappings that associate AWS IAM principals with Datadog users. operationId: ListAWSCloudAuthPersonaMappings responses: "200": content: application/json: examples: default: value: data: - attributes: account_identifier: test@example.com account_uuid: 00000000-0000-0000-0000-000000000001 arn_pattern: "arn:aws:iam::123456789012:user/testuser" id: abc-123 type: aws_cloud_auth_config schema: $ref: "#/components/schemas/AWSCloudAuthPersonaMappingsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List AWS cloud authentication persona mappings tags: - Cloud Authentication x-unstable: |- **Note**: This endpoint is in public beta and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create an AWS cloud authentication persona mapping. This endpoint associates an AWS IAM principal with a Datadog user. operationId: CreateAWSCloudAuthPersonaMapping requestBody: content: application/json: examples: default: value: data: attributes: account_identifier: test@test.com arn_pattern: arn:aws:iam::123456789012:user/testuser type: aws_cloud_auth_config schema: $ref: "#/components/schemas/AWSCloudAuthPersonaMappingCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: account_identifier: test@example.com account_uuid: 00000000-0000-0000-0000-000000000001 arn_pattern: "arn:aws:iam::123456789012:user/testuser" id: abc-123 type: aws_cloud_auth_config schema: $ref: "#/components/schemas/AWSCloudAuthPersonaMappingResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create an AWS cloud authentication persona mapping tags: - Cloud Authentication x-codegen-request-body-name: body x-unstable: |- **Note**: This endpoint is in public beta and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/wif/aws/persona_mapping/{persona_mapping_id}: delete: description: Delete an AWS cloud authentication persona mapping by ID. This removes the association between an AWS IAM principal and a Datadog user. operationId: DeleteAWSCloudAuthPersonaMapping parameters: - $ref: "#/components/parameters/PersonaMappingID" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete an AWS cloud authentication persona mapping tags: - Cloud Authentication x-unstable: |- **Note**: This endpoint is in public beta and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a specific AWS cloud authentication persona mapping by ID. This endpoint retrieves a single configured persona mapping that associates an AWS IAM principal with a Datadog user. operationId: GetAWSCloudAuthPersonaMapping parameters: - $ref: "#/components/parameters/PersonaMappingID" responses: "200": content: application/json: examples: default: value: data: attributes: account_identifier: test@example.com account_uuid: 00000000-0000-0000-0000-000000000001 arn_pattern: "arn:aws:iam::123456789012:user/testuser" id: abc-123 type: aws_cloud_auth_config schema: $ref: "#/components/schemas/AWSCloudAuthPersonaMappingResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get an AWS cloud authentication persona mapping tags: - Cloud Authentication x-unstable: |- **Note**: This endpoint is in public beta and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/wif/github/intake_mapping: get: description: List all GitHub cloud authentication intake mappings. This endpoint retrieves all configured intake mappings that entitle matching GitHub Actions OIDC principals to request Datadog API keys. operationId: ListGitHubCloudAuthIntakeMappings responses: "200": content: application/json: examples: default: value: data: - attributes: claim_matchers: ref: "refs/heads/main" repository: "test_owner/test_repo" repository_owner: "test_owner" sub: "repo:test_owner/test_repo:(ref:refs/heads/main|pull_request)" id: d6d869d7-29d3-5595-bf40-57c95235cf5b type: github_oidc_auth_intake_mapping schema: $ref: "#/components/schemas/GitHubCloudAuthIntakeMappingsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List GitHub cloud authentication intake mappings tags: - Cloud Authentication x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a GitHub cloud authentication intake mapping. This endpoint entitles a matching GitHub Actions OIDC principal to request Datadog API keys. operationId: CreateGitHubCloudAuthIntakeMapping requestBody: content: application/json: examples: default: value: data: attributes: claim_matchers: ref: "refs/heads/main" repository: "test_owner/test_repo" repository_owner: "test_owner" sub: "repo:test_owner/test_repo:(ref:refs/heads/main|pull_request)" type: github_oidc_auth_intake_mapping schema: $ref: "#/components/schemas/GitHubCloudAuthIntakeMappingCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: claim_matchers: ref: "refs/heads/main" repository: "test_owner/test_repo" repository_owner: "test_owner" sub: "repo:test_owner/test_repo:(ref:refs/heads/main|pull_request)" id: d6d869d7-29d3-5595-bf40-57c95235cf5b type: github_oidc_auth_intake_mapping schema: $ref: "#/components/schemas/GitHubCloudAuthIntakeMappingResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a GitHub cloud auth intake mapping tags: - Cloud Authentication x-codegen-request-body-name: body x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/wif/github/intake_mapping/{intake_mapping_id}: delete: description: Delete a GitHub cloud authentication intake mapping by ID. This removes a GitHub Actions OIDC principal's entitlement to request Datadog API keys. operationId: DeleteGitHubCloudAuthIntakeMapping parameters: - $ref: "#/components/parameters/IntakeMappingID" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a GitHub cloud auth intake mapping tags: - Cloud Authentication x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a specific GitHub cloud authentication intake mapping by ID. This endpoint retrieves a single configured intake mapping that entitles a matching GitHub Actions OIDC principal to request Datadog API keys. operationId: GetGitHubCloudAuthIntakeMapping parameters: - $ref: "#/components/parameters/IntakeMappingID" responses: "200": content: application/json: examples: default: value: data: attributes: claim_matchers: ref: "refs/heads/main" repository: "test_owner/test_repo" repository_owner: "test_owner" sub: "repo:test_owner/test_repo:(ref:refs/heads/main|pull_request)" id: d6d869d7-29d3-5595-bf40-57c95235cf5b type: github_oidc_auth_intake_mapping schema: $ref: "#/components/schemas/GitHubCloudAuthIntakeMappingResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a GitHub cloud authentication intake mapping tags: - Cloud Authentication x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/wif/github/persona_mapping: get: description: List all GitHub cloud authentication persona mappings. This endpoint retrieves all configured persona mappings that associate GitHub Actions OpenID Connect (OIDC) principals with Datadog users. Mapped principals can request impersonation tokens. operationId: ListGitHubCloudAuthPersonaMappings responses: "200": content: application/json: examples: default: value: data: - attributes: account_identifier: "test@example.com" account_uuid: "12bbdc5c-5966-47e0-8733-285f9e44bcf4" claim_matchers: ref: "refs/heads/main" repository: "test_owner/test_repo" repository_owner: "test_owner" sub: "repo:test_owner/test_repo:(ref:refs/heads/main|pull_request)" id: c5c758c6-18c2-4484-ae3f-46b84128404a type: github_oidc_auth_config schema: $ref: "#/components/schemas/GitHubCloudAuthPersonaMappingsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List GitHub cloud authentication persona mappings tags: - Cloud Authentication x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Create a GitHub cloud authentication persona mapping. This endpoint associates a GitHub Actions OIDC principal with a Datadog user. The mapped principal can request an impersonation token. operationId: CreateGitHubCloudAuthPersonaMapping requestBody: content: application/json: examples: default: value: data: attributes: account_identifier: "test@example.com" claim_matchers: ref: "refs/heads/main" repository: "test_owner/test_repo" repository_owner: "test_owner" sub: "repo:test_owner/test_repo:(ref:refs/heads/main|pull_request)" type: github_oidc_auth_config schema: $ref: "#/components/schemas/GitHubCloudAuthPersonaMappingCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: account_identifier: "test@example.com" account_uuid: "12bbdc5c-5966-47e0-8733-285f9e44bcf4" claim_matchers: ref: "refs/heads/main" repository: "test_owner/test_repo" repository_owner: "test_owner" sub: "repo:test_owner/test_repo:(ref:refs/heads/main|pull_request)" id: c5c758c6-18c2-4484-ae3f-46b84128404a type: github_oidc_auth_config schema: $ref: "#/components/schemas/GitHubCloudAuthPersonaMappingResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Create a GitHub cloud auth persona mapping tags: - Cloud Authentication x-codegen-request-body-name: body x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/wif/github/persona_mapping/{persona_mapping_id}: delete: description: Delete a GitHub cloud authentication persona mapping by ID. This removes the association between a GitHub Actions OIDC principal and a Datadog user. operationId: DeleteGitHubCloudAuthPersonaMapping parameters: - $ref: "#/components/parameters/PersonaMappingID" responses: "204": description: No Content "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Delete a GitHub cloud auth persona mapping tags: - Cloud Authentication x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a specific GitHub cloud authentication persona mapping by ID. This endpoint retrieves a single configured persona mapping that associates a GitHub Actions OIDC principal with a Datadog user. The mapped principal can request an impersonation token. operationId: GetGitHubCloudAuthPersonaMapping parameters: - $ref: "#/components/parameters/PersonaMappingID" responses: "200": content: application/json: examples: default: value: data: attributes: account_identifier: "test@example.com" account_uuid: "12bbdc5c-5966-47e0-8733-285f9e44bcf4" claim_matchers: ref: "refs/heads/main" repository: "test_owner/test_repo" repository_owner: "test_owner" sub: "repo:test_owner/test_repo:(ref:refs/heads/main|pull_request)" id: c5c758c6-18c2-4484-ae3f-46b84128404a type: github_oidc_auth_config schema: $ref: "#/components/schemas/GitHubCloudAuthPersonaMappingResponse" description: OK "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Get a GitHub cloud authentication persona mapping tags: - Cloud Authentication x-unstable: |- **Note**: This endpoint is in Preview and is subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/wif/oidc/persona_mapping: get: description: List all Custom OIDC persona mappings in the organization. operationId: ListOIDCCloudAuthPersonaMappings responses: "200": content: application/json: examples: default: value: data: - attributes: account_uuid: 00000000-0000-0000-0000-000000000003 claim_matchers: - claim: sub mode: exact values: - system:serviceaccount:controllers:example-controller provider_id: 00000000-0000-0000-0000-000000000002 id: 00000000-0000-0000-0000-000000000004 type: custom_oidc_identity_mapping schema: $ref: "#/components/schemas/OIDCCloudAuthPersonaMappingsResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - workload_identity_federation_read summary: List all Custom OIDC persona mappings tags: - Cloud Authentication x-permission: operator: OR permissions: - workload_identity_federation_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. Custom OIDC authentication must be enabled for your organization. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Map token claims from a registered Custom OIDC provider to a Datadog user or service account. The caller must be authorized to map to the target account. operationId: CreateOIDCCloudAuthPersonaMapping requestBody: content: application/json: examples: default: value: data: attributes: account_uuid: 00000000-0000-0000-0000-000000000003 claim_matchers: - claim: sub mode: exact values: - system:serviceaccount:controllers:example-controller provider_id: 00000000-0000-0000-0000-000000000002 type: custom_oidc_identity_mapping schema: $ref: "#/components/schemas/OIDCCloudAuthPersonaMappingCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: account_uuid: 00000000-0000-0000-0000-000000000003 claim_matchers: - claim: sub mode: exact values: - system:serviceaccount:controllers:example-controller provider_id: 00000000-0000-0000-0000-000000000002 id: 00000000-0000-0000-0000-000000000004 type: custom_oidc_identity_mapping schema: $ref: "#/components/schemas/OIDCCloudAuthPersonaMappingResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - workload_identity_federation_write summary: Create a Custom OIDC persona mapping tags: - Cloud Authentication x-codegen-request-body-name: body x-permission: operator: OR permissions: - workload_identity_federation_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. Custom OIDC authentication must be enabled for your organization. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/wif/oidc/persona_mapping/{persona_mapping_id}: delete: description: Delete a Custom OIDC persona mapping. operationId: DeleteOIDCCloudAuthPersonaMapping parameters: - description: UUID of the Custom OIDC persona mapping. in: path name: persona_mapping_id required: true schema: format: uuid type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - workload_identity_federation_write summary: Delete a Custom OIDC persona mapping tags: - Cloud Authentication x-permission: operator: OR permissions: - workload_identity_federation_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. Custom OIDC authentication must be enabled for your organization. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a Custom OIDC persona mapping by UUID. operationId: GetOIDCCloudAuthPersonaMapping parameters: - description: UUID of the Custom OIDC persona mapping. in: path name: persona_mapping_id required: true schema: format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: account_uuid: 00000000-0000-0000-0000-000000000003 claim_matchers: - claim: sub mode: exact values: - system:serviceaccount:controllers:example-controller provider_id: 00000000-0000-0000-0000-000000000002 id: 00000000-0000-0000-0000-000000000004 type: custom_oidc_identity_mapping schema: $ref: "#/components/schemas/OIDCCloudAuthPersonaMappingResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - workload_identity_federation_read summary: Get a Custom OIDC persona mapping tags: - Cloud Authentication x-permission: operator: OR permissions: - workload_identity_federation_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. Custom OIDC authentication must be enabled for your organization. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/wif/oidc/provider: get: description: List all Custom OIDC providers in the organization. operationId: ListOIDCCloudAuthProviders responses: "200": content: application/json: examples: default: value: data: - attributes: audiences: - datadog/00000000-0000-0000-0000-000000000001 discovery_type: oidc_discovery issuer_url: https://issuer.example.com org_uuid_source: aud provider_name: example-cluster id: 00000000-0000-0000-0000-000000000004 type: custom_oidc_provider_config schema: $ref: "#/components/schemas/OIDCCloudAuthProvidersResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - workload_identity_federation_read summary: List all Custom OIDC providers tags: - Cloud Authentication x-permission: operator: OR permissions: - workload_identity_federation_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. Custom OIDC authentication must be enabled for your organization. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). post: description: Register an OIDC issuer, signing-key discovery configuration, and accepted audiences. Provider names and issuer URLs must be unique within the organization. operationId: CreateOIDCCloudAuthProvider requestBody: content: application/json: examples: default: value: data: attributes: audiences: - datadog/00000000-0000-0000-0000-000000000001 discovery_type: oidc_discovery issuer_url: https://issuer.example.com org_uuid_source: aud provider_name: example-cluster type: custom_oidc_provider_config schema: $ref: "#/components/schemas/OIDCCloudAuthProviderCreateRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: audiences: - datadog/00000000-0000-0000-0000-000000000001 discovery_type: oidc_discovery issuer_url: https://issuer.example.com org_uuid_source: aud provider_name: example-cluster id: 00000000-0000-0000-0000-000000000004 type: custom_oidc_provider_config schema: $ref: "#/components/schemas/OIDCCloudAuthProviderResponse" description: Created "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - workload_identity_federation_write summary: Create a Custom OIDC provider tags: - Cloud Authentication x-codegen-request-body-name: body x-permission: operator: OR permissions: - workload_identity_federation_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. Custom OIDC authentication must be enabled for your organization. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/wif/oidc/provider/{provider_id}: delete: description: Delete a Custom OIDC provider. Delete all persona and intake mappings referencing it first; otherwise the request returns a conflict. operationId: DeleteOIDCCloudAuthProvider parameters: - description: UUID of the Custom OIDC provider. in: path name: provider_id required: true schema: format: uuid type: string responses: "204": description: No Content "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "409": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Conflict "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - workload_identity_federation_write summary: Delete a Custom OIDC provider tags: - Cloud Authentication x-permission: operator: OR permissions: - workload_identity_federation_write x-unstable: |- **Note**: This endpoint is in preview and is subject to change. Custom OIDC authentication must be enabled for your organization. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). get: description: Get a Custom OIDC provider by UUID. operationId: GetOIDCCloudAuthProvider parameters: - description: UUID of the Custom OIDC provider. in: path name: provider_id required: true schema: format: uuid type: string responses: "200": content: application/json: examples: default: value: data: attributes: audiences: - datadog/00000000-0000-0000-0000-000000000001 discovery_type: oidc_discovery issuer_url: https://issuer.example.com org_uuid_source: aud provider_name: example-cluster id: 00000000-0000-0000-0000-000000000004 type: custom_oidc_provider_config schema: $ref: "#/components/schemas/OIDCCloudAuthProviderResponse" description: OK "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad Request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not Found "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - workload_identity_federation_read summary: Get a Custom OIDC provider tags: - Cloud Authentication x-permission: operator: OR permissions: - workload_identity_federation_read x-unstable: |- **Note**: This endpoint is in preview and is subject to change. Custom OIDC authentication must be enabled for your organization. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/). /api/v2/workflows: get: description: List all workflows in your organization. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). Alternatively, you can configure these permissions [in the UI](https://docs.datadoghq.com/account_management/api-app-keys/#actions-api-access). operationId: ListWorkflows parameters: - description: The maximum number of workflows to return per page. example: 50 in: query name: limit required: false schema: default: 50 format: int64 type: integer - description: The page number to return, starting from 0. example: 0 in: query name: page required: false schema: default: 0 format: int64 type: integer - description: "The sort order for the returned workflows. Provide a comma-separated list of fields, each optionally prefixed with `-` for descending order. Supported fields are `name`, `createdAt`, `updatedAt`, `creatorName`, `ownerName`, and `lastExecutedAt`." example: "-updatedAt" in: query name: sort required: false schema: type: string - description: "A search query used to filter the returned workflows. The query performs a case-insensitive substring match against each workflow's name, creator name, and handle. If the query contains a colon (for example, `team:infra`), the query is treated as a `key:value` tag filter." example: deploy in: query name: filter[query] required: false schema: type: string - description: Filters the returned workflows by one or more trigger types, such as `monitor`, `schedule`, or `githubWebhook`. To specify the multiple types, repeat this parameter. example: - monitor explode: true in: query name: filter[triggerIds] required: false schema: items: type: string type: array - description: Whether to include unpublished workflows in the response. in: query name: filter[includeUnpublished] required: false schema: default: false type: boolean - description: Whether to include the full spec of each workflow in the response. When `false` (the default), each workflow's `spec` is returned as `null`. in: query name: filter[includeSpecs] required: false schema: default: false type: boolean responses: "200": content: application/json: examples: default: value: data: - attributes: createdAt: "2024-01-01T00:00:00+00:00" description: A sample workflow. name: Example Workflow published: true runAsUserMode: owner spec: {} tags: - team:infra updatedAt: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000002 relationships: creator: data: id: 00000000-0000-0000-0000-000000000009 type: users owner: data: id: 00000000-0000-0000-0000-000000000009 type: users type: workflows meta: page: totalCount: 1 totalFilteredCount: 1 schema: $ref: "#/components/schemas/ListWorkflowsResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: List workflows tags: - Workflow Automation x-pagination: limitParam: limit pageParam: page pageStart: 0 resultsPath: data "x-permission": operator: OR permissions: - workflows_read post: description: Create a new workflow, returning the workflow ID. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). Alternatively, you can configure these permissions [in the UI](https://docs.datadoghq.com/account_management/api-app-keys/#actions-api-access). operationId: CreateWorkflow requestBody: content: application/json: examples: default: value: data: attributes: description: A sample workflow. name: Example Workflow published: true runAs: type: owner spec: annotations: - display: bounds: height: 150 width: 300 x: -375 y: -0.5 id: 99999999-9999-9999-9999-999999999999 markdownTextAnnotation: text: Example annotation. connectionEnvs: - connections: - connectionId: e1e64943-c7c5-4487-aece-25aaec7d3aad label: INTEGRATION_DATADOG env: default handle: my-handle inputSchema: parameters: - defaultValue: default name: input type: STRING outputSchema: parameters: - name: output type: ARRAY_OBJECT value: "{{ Steps.Step1 }}" steps: - actionId: com.datadoghq.dd.monitor.listMonitors connectionLabel: INTEGRATION_DATADOG name: Step1 outboundEdges: - branchName: main nextStepName: Step2 parameters: - name: tags value: service:monitoring - actionId: com.datadoghq.core.noop name: Step2 triggers: - monitorTrigger: rateLimit: count: 1 interval: 3600s startStepNames: - Step1 - githubWebhookTrigger: {} startStepNames: - Step1 tags: - team:infra - service:monitoring type: workflows schema: $ref: "#/components/schemas/CreateWorkflowRequest" required: true responses: "201": content: application/json: examples: default: value: data: attributes: name: Example Workflow runAsUserMode: owner spec: {} id: 00000000-0000-0000-0000-000000000001 type: workflows schema: $ref: "#/components/schemas/CreateWorkflowResponse" description: Successfully created a workflow. "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too many requests summary: Create a Workflow tags: - Workflow Automation "x-permission": operator: OR permissions: - workflows_write /api/v2/workflows/{workflow_id}: delete: description: Delete a workflow by ID. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). Alternatively, you can configure these permissions [in the UI](https://docs.datadoghq.com/account_management/api-app-keys/#actions-api-access). operationId: DeleteWorkflow parameters: - $ref: "#/components/parameters/WorkflowId" responses: "204": description: Successfully deleted a workflow. "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not found "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too many requests summary: Delete an existing Workflow tags: - Workflow Automation "x-permission": operator: OR permissions: - workflows_write get: description: Get a workflow by ID. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). Alternatively, you can configure these permissions [in the UI](https://docs.datadoghq.com/account_management/api-app-keys/#actions-api-access). operationId: GetWorkflow parameters: - $ref: "#/components/parameters/WorkflowId" responses: "200": content: application/json: examples: default: value: data: attributes: createdAt: "2024-01-01T00:00:00+00:00" description: A sample workflow. name: Example Workflow published: true runAsUserMode: owner spec: {} tags: - team:infra updatedAt: "2024-01-01T00:00:00+00:00" id: 00000000-0000-0000-0000-000000000002 type: workflows schema: $ref: "#/components/schemas/GetWorkflowResponse" description: Successfully got a workflow. "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not found "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too many requests summary: Get an existing Workflow tags: - Workflow Automation "x-permission": operator: OR permissions: - workflows_read patch: description: Update a workflow by ID. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). Alternatively, you can configure these permissions [in the UI](https://docs.datadoghq.com/account_management/api-app-keys/#actions-api-access). operationId: UpdateWorkflow parameters: - $ref: "#/components/parameters/WorkflowId" requestBody: content: application/json: examples: default: value: data: attributes: description: A sample workflow. name: Example Workflow published: true runAs: type: owner spec: annotations: - display: bounds: height: 150 width: 300 x: -375 y: -0.5 id: 99999999-9999-9999-9999-999999999999 markdownTextAnnotation: text: Example annotation. connectionEnvs: - connections: - connectionId: e1e64943-c7c5-4487-aece-25aaec7d3aad label: INTEGRATION_DATADOG env: default handle: my-handle inputSchema: parameters: - defaultValue: default name: input type: STRING outputSchema: parameters: - name: output type: ARRAY_OBJECT value: "{{ Steps.Step1 }}" steps: - actionId: com.datadoghq.dd.monitor.listMonitors connectionLabel: INTEGRATION_DATADOG name: Step1 outboundEdges: - branchName: main nextStepName: Step2 parameters: - name: tags value: service:monitoring - actionId: com.datadoghq.core.noop name: Step2 triggers: - monitorTrigger: rateLimit: count: 1 interval: 3600s startStepNames: - Step1 - githubWebhookTrigger: {} startStepNames: - Step1 tags: - team:infra - service:monitoring id: 22222222-2222-2222-2222-222222222222 type: workflows schema: $ref: "#/components/schemas/UpdateWorkflowRequest" required: true responses: "200": content: application/json: examples: default: value: data: attributes: name: Example Workflow runAsUserMode: owner id: 00000000-0000-0000-0000-000000000003 type: workflows schema: $ref: "#/components/schemas/UpdateWorkflowResponse" description: Successfully updated a workflow. "400": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Bad request "403": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Forbidden "404": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Not found "429": content: application/json: schema: $ref: "#/components/schemas/JSONAPIErrorResponse" description: Too many requests summary: Update an existing Workflow tags: - Workflow Automation "x-permission": operator: OR permissions: - workflows_write /api/v2/workflows/{workflow_id}/instances: get: description: List all instances of a given workflow. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). Alternatively, you can configure these permissions [in the UI](https://docs.datadoghq.com/account_management/api-app-keys/#actions-api-access). operationId: ListWorkflowInstances parameters: - $ref: "#/components/parameters/WorkflowId" - $ref: "#/components/parameters/PageSize" - $ref: "#/components/parameters/PageNumber" responses: "200": content: application/json: examples: default: value: data: - id: 00000000-0000-0000-0000-000000000004 meta: page: totalCount: 1 schema: $ref: "#/components/schemas/WorkflowListInstancesResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - workflows_read summary: List workflow instances tags: - Workflow Automation "x-permission": operator: OR permissions: - workflows_read post: description: Execute the given workflow. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). Alternatively, you can configure these permissions [in the UI](https://docs.datadoghq.com/account_management/api-app-keys/#actions-api-access). operationId: CreateWorkflowInstance parameters: - $ref: "#/components/parameters/WorkflowId" requestBody: content: application/json: examples: default: value: meta: payload: input: value schema: $ref: "#/components/schemas/WorkflowInstanceCreateRequest" required: true responses: "200": content: application/json: examples: default: value: data: id: 00000000-0000-0000-0000-000000000005 schema: $ref: "#/components/schemas/WorkflowInstanceCreateResponse" description: Created "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - workflows_run summary: Execute a workflow tags: - Workflow Automation x-codegen-request-body-name: body "x-permission": operator: OR permissions: - workflows_run /api/v2/workflows/{workflow_id}/instances/{instance_id}: get: description: Get a specific execution of a given workflow. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). Alternatively, you can configure these permissions [in the UI](https://docs.datadoghq.com/account_management/api-app-keys/#actions-api-access). operationId: GetWorkflowInstance parameters: - $ref: "#/components/parameters/WorkflowId" - $ref: "#/components/parameters/InstanceId" responses: "200": content: application/json: examples: default: value: data: attributes: id: 00000000-0000-0000-0000-000000000006 schema: $ref: "#/components/schemas/WorklflowGetInstanceResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - workflows_read summary: Get a workflow instance tags: - Workflow Automation "x-permission": operator: OR permissions: - workflows_read /api/v2/workflows/{workflow_id}/instances/{instance_id}/cancel: put: description: Cancels a specific execution of a given workflow. This API requires a [registered application key](https://docs.datadoghq.com/api/latest/action-connection/#register-a-new-app-key). Alternatively, you can configure these permissions [in the UI](https://docs.datadoghq.com/account_management/api-app-keys/#actions-api-access). operationId: CancelWorkflowInstance parameters: - $ref: "#/components/parameters/WorkflowId" - $ref: "#/components/parameters/InstanceId" responses: "200": content: application/json: examples: default: value: data: id: 00000000-0000-0000-0000-000000000007 schema: $ref: "#/components/schemas/WorklflowCancelInstanceResponse" description: OK "400": $ref: "#/components/responses/BadRequestResponse" "403": $ref: "#/components/responses/ForbiddenResponse" "404": $ref: "#/components/responses/NotFoundResponse" "429": $ref: "#/components/responses/TooManyRequestsResponse" summary: Cancel a workflow instance tags: - Workflow Automation "x-permission": operator: OR permissions: - workflows_run security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] servers: - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: The regional site for Datadog customers. enum: - datadoghq.com - us3.datadoghq.com - us5.datadoghq.com - ap1.datadoghq.com - ap2.datadoghq.com - uk1.datadoghq.com - datadoghq.eu - ddog-gov.com - us2.ddog-gov.com - uk1.datadoghq.com subdomain: default: api description: The subdomain where the API is deployed. - url: "{protocol}://{name}" variables: name: default: api.datadoghq.com description: Full site DNS name. protocol: default: https description: The protocol for accessing the API. - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: Any Datadog deployment. subdomain: default: api description: The subdomain where the API is deployed. tags: - description: |- AI Gateway routes your applications' LLM requests to the model providers you connect, and applies your organization's routing, access, spending, rate limit, and data capture rules. These endpoints allow you to configure: - Providers: the model providers your organization connects, and the models and pricing each offers. - Routing rules: the named routes your applications call, and the models that serve each one. - Access: inbound routing policies and model groups that decide who can use which models. - Budgets and rate limits: spending caps and request limits, and their current usage. - Data capture and governance: what request data is recorded, and organization-wide controls. name: AI Gateway - description: Evaluate LLM interactions for security threats such as prompt injection and jailbreak attempts. name: AI Guard - description: |- Configure your API endpoints through the Datadog API. name: API Management - description: Observe, troubleshoot, and improve cloud-scale applications with all telemetry in context name: APM - description: |- Manage configuration of [APM retention filters](https://app.datadoghq.com/apm/traces/retention-filters) for your organization. You need an API and application key with Admin rights to interact with this endpoint. See [retention filters](https://docs.datadoghq.com/tracing/trace_pipeline/trace_retention/#retention-filters) on the Trace Retention page for more information. externalDocs: description: Find out more at url: https://docs.datadoghq.com/tracing/trace_pipeline/trace_retention/ name: APM Retention Filters - description: Retrieve full or pruned APM traces by trace ID. name: APM Trace - description: |- Configure your Datadog-AWS integration directly through the Datadog API. For more information, see the [AWS integration page](https://docs.datadoghq.com/integrations/amazon_web_services). name: AWS Integration - description: |- Configure your Datadog-AWS-Logs integration directly through Datadog API. For more information, see the [AWS integration page](https://docs.datadoghq.com/integrations/amazon_web_services/#log-collection). externalDocs: url: https://docs.datadoghq.com/integrations/amazon_web_services/#log-collection name: AWS Logs Integration - description: |- Action connections extend your installed integrations and allow you to take action in your third-party systems (e.g. AWS, GitLab, and Statuspage) with Datadog’s Workflow Automation and App Builder products. Datadog’s Integrations automatically provide authentication for Slack, Microsoft Teams, PagerDuty, Opsgenie, JIRA, GitHub, and Statuspage. You do not need additional connections in order to access these tools within Workflow Automation and App Builder. We offer granular access control for editing and resolving connections. externalDocs: description: Find out more at url: https://docs.datadoghq.com/service_management/workflows/connections/ name: Action Connection - description: |- Leverage the Actions Datastore API to create, modify, and delete items in datastores owned by your organization. externalDocs: url: https://docs.datadoghq.com/actions/datastore name: Actions Datastores - description: View Agent Health issues reported for node Agents and Cluster Agents. name: Agent Health - description: >- Manage Agent Observability spans, data, projects, datasets, dataset records, experiments, prompts, and annotations. name: Agent Observability - description: |- Datadog Agentless Scanning provides visibility into risks and vulnerabilities within your hosts, running containers, and serverless functions—all without requiring teams to install Agents on every host or where Agents cannot be installed. Agentless offers also Sensitive Data Scanning capabilities on your storage. Go to https://www.datadoghq.com/blog/agentless-scanning/ to learn more. name: "Agentless Scanning" - description: Add annotations to dashboards and notebooks to mark events such as deployments, incidents, or other notable moments in time. name: Annotations - description: |- Datadog App Builder provides a low-code solution to rapidly develop and integrate secure, customized applications into your monitoring stack that are built to accelerate remediation at scale. These API endpoints allow you to create, read, update, delete, and publish apps. name: App Builder - description: |- [Datadog Application Security](https://docs.datadoghq.com/security/application_security/) provides protection against application-level attacks that aim to exploit code-level vulnerabilities, such as Server-Side-Request-Forgery (SSRF), SQL injection, Log4Shell, and Reflected Cross-Site-Scripting (XSS). You can monitor and protect apps hosted directly on a server, Docker, Kubernetes, Amazon ECS, and (for supported languages) AWS Fargate. externalDocs: description: Find out more at url: https://docs.datadoghq.com/security/application_security/ name: "Application Security" - description: |- Search your Audit Logs events over HTTP. name: Audit - description: |- [The AuthN Mappings API](https://docs.datadoghq.com/account_management/authn_mapping/?tab=example) is used to automatically map groups of users to roles in Datadog using attributes sent from Identity Providers. Use these endpoints to manage your AuthN Mappings. name: AuthN Mappings - description: |- Use the Bits AI endpoints to retrieve AI-powered investigations. name: Bits AI - description: |- Use the Bits Security Analyst endpoints to find the investigations of your Cloud SIEM signals, read an investigation's verdict and findings, and count investigations. name: Bits Security Analyst - description: |- Manage CI Visibility opt-in status for your GitHub accounts and repositories. See the [CI Visibility GitHub Actions setup page](https://docs.datadoghq.com/continuous_integration/pipelines/github/) for more information. name: CI Visibility GitHub Accounts - description: Send CI job logs over HTTP for CI Visibility. name: CI Visibility Logs - description: |- Search or aggregate your CI Visibility pipeline events and send them to your Datadog site over HTTP. See the [CI Pipeline Visibility in Datadog page](https://docs.datadoghq.com/continuous_integration/pipelines/) for more information. name: CI Visibility Pipelines - description: |- Search or aggregate your CI Visibility test events over HTTP. See the [Test Visibility in Datadog page](https://docs.datadoghq.com/tests/) for more information. name: CI Visibility Tests - description: |- Datadog Cloud Security Management (CSM) delivers real-time threat detection and continuous configuration audits across your entire cloud infrastructure, all in a unified view for seamless collaboration and faster remediation. Go to https://docs.datadoghq.com/security/cloud_security_management to learn more name: "CSM Agents" - description: |- Datadog Cloud Security Management (CSM) delivers real-time threat detection and continuous configuration audits across your entire cloud infrastructure, all in a unified view for seamless collaboration and faster remediation. Go to https://docs.datadoghq.com/security/cloud_security_management to learn more. name: "CSM Coverage Analysis" - description: |- Datadog Cloud Security Management (CSM) Ownership infers the most likely owner for a cloud resource by combining ownership signals from across the platform, and lets you review the inference, inspect its evidence, and submit feedback to persist, override, or correct the inferred owner. For more information, see [Cloud Security Management](https://docs.datadoghq.com/security/cloud_security_management). name: "CSM Ownership" - description: |- Datadog Cloud Security Management (CSM) Settings APIs allow you to list and filter your cloud hosts monitored by CSM, covering both agentless and agent-based discovery. For more information, see [Cloud Security Management](https://docs.datadoghq.com/security/cloud_security_management). name: "CSM Settings" - description: |- Workload Protection monitors file, network, and process activity across your environment to detect real-time threats to your infrastructure. See [Workload Protection](https://docs.datadoghq.com/security/workload_protection/) for more information on setting up Workload Protection. **Note**: These endpoints are split based on whether you are using the US1-FED site or not. Please reference the specific resource for the site you are using. name: "CSM Threats" - description: >- View and manage work items and projects within Work Management. API paths, resource types, and permissions retain `case` terminology. For more information, see [Work Management](https://docs.datadoghq.com/incident_response/work_management/). name: Case Management - description: >- View and configure custom attributes within Work Management. See the [Work Management page](https://docs.datadoghq.com/incident_response/work_management/) for more information. name: Case Management Attribute - description: >- View and configure work item types within Work Management. See the [Work Management page](https://docs.datadoghq.com/incident_response/work_management/) for more information. name: Case Management Type - description: >- View and manage change requests within Change Management. See the [Case Management page](https://docs.datadoghq.com/service_management/case_management/) for more information. name: Change Management - description: |- Configure AWS, GitHub, and Custom OIDC cloud authentication for persona and intake authentication through the Datadog API. name: Cloud Authentication - description: |- The Cloud Cost Management API allows you to set up, edit, and delete Cloud Cost Management accounts for AWS, Azure, and Google Cloud. You can query your cost data by using the [Metrics endpoint](https://docs.datadoghq.com/api/latest/metrics/#query-timeseries-data-across-multiple-products) and the `cloud_cost` data source. For more information, see the [Cloud Cost Management documentation](https://docs.datadoghq.com/cloud_cost_management/). name: Cloud Cost Management - description: |- The Cloud Network Monitoring API allows you to fetch aggregated connections and DNS traffic with their attributes. See the [Cloud Network Monitoring page](https://docs.datadoghq.com/network_monitoring/cloud_network_monitoring/) and [DNS Monitoring page](https://docs.datadoghq.com/network_monitoring/dns/) for more information. name: Cloud Network Monitoring - description: |- Manage your Datadog Cloudflare integration directly through the Datadog API. See the [Cloudflare integration page](https://docs.datadoghq.com/integrations/cloudflare/) for more information. name: Cloudflare Integration - description: |- Retrieve and analyze code coverage data from Code Coverage. See the [Code Coverage page](https://docs.datadoghq.com/code_coverage/) for more information. name: Code Coverage - description: |- Datadog Cloud Security Misconfigurations provides aggregated views of compliance rules and findings across your cloud resources, helping you assess posture against industry frameworks (such as HIPAA, SOC 2, ISO 27001) and custom frameworks. Learn more at https://docs.datadoghq.com/security/cloud_security_management/misconfigurations/#maintain-compliance-with-industry-frameworks-and-benchmarks. name: "Compliance" - description: |- Manage your Datadog Confluent Cloud integration accounts and account resources directly through the Datadog API. See the [Confluent Cloud page](https://docs.datadoghq.com/integrations/confluent_cloud/) for more information. name: Confluent Cloud - description: |- The Container Images API allows you to query Container Image data for your organization. See the [Container Images View page](https://docs.datadoghq.com/infrastructure/containers/container_images/) for more information. name: Container Images - description: |- The Containers API allows you to query container data for your organization. See the [Container Monitoring page](https://docs.datadoghq.com/containers/) for more information. name: Containers - description: |- Programmatic management of a customer's Datadog organization. Use this API to perform self-service organization lifecycle actions such as disabling the authenticated org. name: Customer Org - description: |- Execute DDSQL queries against the Datadog data catalog and poll for their results. Queries are dispatched asynchronously: the initial request may return a `running` state with a `query_id`, and clients poll the fetch endpoint until the response transitions to `completed` with a column-major result set. name: DDSQL - description: Manage Digital Experience Monitoring journeys. name: DEM - description: |- Interact with your dashboard lists through the API to organize, find, and share all of your dashboards with your team and organization. name: Dashboard Lists - description: |- Manage securely embedded Datadog dashboards. Secure embeds use HMAC-SHA256 signed sessions for authentication, enabling customers to embed dashboards in their own applications with server-side auth control. Unlike public dashboards (open URL) or invite dashboards (email-based access), secure embeds provide programmatic access control. **Requirements:** - **Embed** sharing must be enabled under **Organization Settings** > **Public Sharing** > **Shared Dashboards**. - You need [an API key and an application key](https://docs.datadoghq.com/account_management/api-app-keys/) to interact with these endpoints. name: Dashboard Secure Embed - description: Manage dashboard sharing configurations. name: Dashboard Sharing - description: |- Get usage statistics for the dashboards in your organization, including view counts, last-edit times, widget counts, and quality scores. See the [Dashboards documentation](https://docs.datadoghq.com/dashboards/) for more information. name: Dashboards - description: |- The Data Deletion API allows the user to target and delete data from the allowed products. It's enabled for Logs and depends on the `logs_delete_data` permission. name: Data Deletion - description: Manage and run data observability monitors. name: Data Observability - description: |- Manage your Datadog Databricks integration accounts and account resources directly through the Datadog API. See the [Databricks integration page](https://docs.datadoghq.com/integrations/databricks/) for more information. externalDocs: description: Databricks integration. url: https://docs.datadoghq.com/integrations/databricks/ name: Databricks Integration - description: |- Data Access Controls in Datadog is a feature that allows administrators and access managers to regulate access to sensitive data. By defining Restricted Datasets, you can ensure that only specific teams or roles can view certain types of telemetry (for example, logs, traces, metrics, and RUM data). name: Datasets - description: |- Search, send, or delete events for Delivery Performance (formerly DORA Metrics) to measure and improve your software delivery performance. See the [Delivery Performance page](https://docs.datadoghq.com/delivery_performance/) for more information. **Note**: Delivery Performance is not available in the US1-FED site. name: Delivery Performance - description: |- Manage Deployment Gates using this API to reduce the likelihood and impact of incidents caused by deployments. See the [Deployment Gates documentation](https://docs.datadoghq.com/deployment_gates/) for more information. name: Deployment Gates - description: |- Configure your Datadog Email Domain Allowlist directly through the Datadog API. The Email Domain Allowlist controls the domains that certain datadog emails can be sent to. For more information, see the [Domain Allowlist docs page](https://docs.datadoghq.com/account_management/org_settings/domain_allowlist) name: Domain Allowlist - description: |- **Note**: Downtime V2 is currently in private beta. To request access, contact [Datadog support](https://docs.datadoghq.com/help/). [Downtiming](https://docs.datadoghq.com/monitors/notify/downtimes) gives you greater control over monitor notifications by allowing you to globally exclude scopes from alerting. Downtime settings, which can be scheduled with start and end times, prevent all alerting related to specified Datadog tags. name: Downtimes - description: |- Manage your Datadog Elastic Cloud integration accounts and account resources directly through the Datadog API. See the [Elastic Cloud integration page](https://docs.datadoghq.com/integrations/elastic-cloud/) for more information. externalDocs: description: Elastic Cloud integration. url: https://docs.datadoghq.com/integrations/elastic-cloud/ name: Elastic Cloud Integration - description: Manage per-integration configurations for the Internal Developer Portal (IDP). These configurations control which external resources (for example, GitHub repositories, Jira projects, or PagerDuty services) are synced as entities into the Software Catalog. name: Entity Integration Configs - description: Retrieves security risk scores for entities in your organization. name: Entity Risk Scores - description: View and manage issues within Error Tracking. See the [Error Tracking page](https://docs.datadoghq.com/error_tracking/) for more information. name: Error Tracking - description: |- The Event Management API allows you to programmatically post events to the Events Explorer and fetch events from the Events Explorer. See the [Event Management page](https://docs.datadoghq.com/service_management/events/) for more information. **Update to Datadog monitor events `aggregation_key` starting March 1, 2025:** The Datadog monitor events `aggregation_key` is unique to each Monitor ID. Starting March 1st, this key will also include Monitor Group, making it unique per *Monitor ID and Monitor Group*. If you're using monitor events `aggregation_key` in dashboard queries or the Event API, you must migrate to use `@monitor.id`. Reach out to [support](https://www.datadoghq.com/support/) if you have any question. name: Events - description: |- Execution policies control which actions Datadog Action Platform is allowed to run and where. Each policy pairs an effect (allow or deny) with a pattern of actions, and can scope that decision to specific resources. name: Execution Policy - description: Create and manage experiments, metrics, subject types, SQL models, and protocols. name: Experiments - description: |- Manage your Datadog Fastly integration accounts and services directly through the Datadog API. See the [Fastly integration page](https://docs.datadoghq.com/integrations/fastly/) for more information. name: Fastly Integration - description: Manage feature flags and environments. name: Feature Flags - description: |- Manage automated deployments across your fleet of hosts. Fleet Automation provides two types of deployments: Configuration Deployments (`/configure`): - Apply configuration file changes to target hosts - Support merge-patch operations to update specific configuration fields - Support delete operations to remove configuration files - Useful for updating Datadog Agent settings, integration configs, and more Package Upgrade Deployments (`/upgrade`): - Upgrade the Datadog Agent to specific versions name: Fleet Automation - description: |- The Datadog Forms API lets you create and manage forms within the App Builder platform. You can configure form settings, manage versions, and publish forms. name: Forms - description: |- Configure your Datadog-Google Cloud Platform (GCP) integration directly through the Datadog API. Read more about the [Datadog-Google Cloud Platform integration](https://docs.datadoghq.com/integrations/google_cloud_platform). externalDocs: url: https://docs.datadoghq.com/integrations/google_cloud_platform name: GCP Integration - description: |- Configure your [Datadog Google Chat integration](https://docs.datadoghq.com/integrations/google-hangouts-chat/) directly through the Datadog API. externalDocs: description: For more information about the Datadog Google Chat integration, see the integration page. url: https://docs.datadoghq.com/integrations/google-hangouts-chat/ name: Google Chat Integration - description: |- The Governance Console finds issues that build up across a Datadog organization over time, such as API keys nobody uses, users who no longer need access, or custom metrics that are never queried, and tracks them through to a fix. These endpoints allow you to: - Read insights: measures of how your organization uses Datadog, each with the query behind it. - Configure controls: the rules deciding how one kind of issue is found and what is done about it. - Act on detections: the issues a control found. Assign, defer, accept as an exception, or fix. - Manage settings: organization-wide configuration and notification destinations. See the [Governance Console page](https://docs.datadoghq.com/account_management/governance_console/) for more information. name: Governance Console - description: |- Configure High Availability Multi-Region (HAMR) connections between Datadog organizations. HAMR provides disaster recovery capabilities by maintaining synchronized data between primary and secondary organizations across different datacenters. name: High Availability MultiRegion - description: |- The IP allowlist API is used to manage the IP addresses that can access the Datadog API and web UI. It does not block access to intake APIs or public dashboards. This is an enterprise-only feature. Request access by contacting Datadog support, or see the [IP Allowlist page](https://docs.datadoghq.com/account_management/org_settings/ip_allowlist/) for more information. name: IP Allowlist - description: Manage identity providers and user authentication method overrides. name: Identity Providers - description: Manage incident response, as well as associated attachments, metadata, and todos. See the [Incident Management page](https://docs.datadoghq.com/service_management/incident_management/) for more information. name: Incidents - description: |- The Integrations API is used to list available integrations and retrieve information about their installation status. name: Integrations - description: Manage your Jira Integration. Atlassian Jira is a project management and issue tracking tool for teams to coordinate work and handle tasks efficiently. name: Jira Integration - description: |- Manage your Datadog API and application keys. You need an API key and an application key for a user with the required permissions to interact with these endpoints. Consult the following pages to view and manage your keys: - [API Keys](https://app.datadoghq.com/organization-settings/api-keys) - [Application Keys](https://app.datadoghq.com/personal-settings/application-keys) externalDocs: description: Find out more at url: "https://docs.datadoghq.com/account_management/api-app-keys/" name: Key Management - description: |- Search your logs and send them to your Datadog platform over HTTP. See the [Log Management page](https://docs.datadoghq.com/logs/) for more information. name: Logs - description: |- Archive Search queries logs directly from long-term storage archives without prior rehydration and charges only for the data scanned. A search runs in one of two modes. By default, it scans the archive and retains up to 100,000 matching logs for 24 hours on a dedicated results page. Include a `rehydration` object to run a Search & Rehydration instead, which retains the matches for a longer custom retention period and makes them available beyond Log Explorer, such as in Dashboards and Notebooks. A search requires the `logs_write_historical_view` or `logs_write_archive_search` permission. Rehydration requires `logs_write_historical_view`. externalDocs: description: Find out more at url: https://docs.datadoghq.com/logs/explorer/archive_search/ name: Logs Archive Searches - description: |- Archives forward all the logs ingested to a cloud storage system. See the [Archives Page](https://app.datadoghq.com/logs/pipelines/archives) for a list of the archives currently configured in Datadog. externalDocs: description: Find out more at url: https://docs.datadoghq.com/logs/archives/ name: Logs Archives - description: |- Custom Destinations forward all the logs ingested to an external destination. **Note**: Log forwarding is not available for the Government (US1-FED) site. Contact your account representative for more information. See the [Custom Destinations Page](https://app.datadoghq.com/logs/pipelines/log-forwarding/custom-destinations) for a list of the custom destinations currently configured in web UI. externalDocs: description: Find out more at url: https://docs.datadoghq.com/logs/log_configuration/forwarding_custom_destinations/ name: Logs Custom Destinations - description: |- Manage configuration of [log-based metrics](https://app.datadoghq.com/logs/pipelines/generate-metrics) for your organization. externalDocs: description: Find out more at url: https://docs.datadoghq.com/logs/logs_to_metrics/ name: Logs Metrics - description: |- **Note: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).** A Restriction Query is a logs query that restricts which logs the `logs_read_data` permission grants read access to. For users whose roles have Restriction Queries, any log query they make only returns those log events that also match one of their Restriction Queries. This is true whether the user queries log events from any log-related feature, including the log explorer, Live Tail, re-hydration, or a dashboard widget. Restriction Queries currently only support use of the following components of log events: - Reserved attributes - The log message - Tags To restrict read access on log data, add a team tag to log events to indicate which teams own them, and then scope Restriction Queries to the relevant values of the team tag. Tags can be applied to log events in many ways, and a log event can have multiple tags with the same key (like team) and different values. This means the same log event can be visible to roles whose restriction queries are scoped to different team values. See [How to Set Up RBAC for Logs](https://docs.datadoghq.com/logs/guide/logs-rbac/?tab=api#restrict-access-to-logs) for details on how to add restriction queries. name: Logs Restriction Queries - description: |- The metrics endpoint allows you to: - Post metrics data so it can be graphed on Datadog’s dashboards - Query metrics from any time period (timeseries and scalar) - Modify tag configurations for metrics - View tags and volumes for metrics **Note**: A graph can only contain a set number of points and as the timeframe over which a metric is viewed increases, aggregation between points occurs to stay below that set number. The Post, Patch, and Delete `manage_tags` API methods can only be performed by a user who has the `Manage Tags for Metrics` permission. See the [Metrics page](https://docs.datadoghq.com/metrics/) for more information. name: Metrics - description: |- Configure your [Datadog Microsoft Teams integration](https://docs.datadoghq.com/integrations/microsoft_teams/) directly through the Datadog API. Note: These endpoints do not support legacy connector handles. externalDocs: description: For more information about the Datadog Microsoft Teams integration, see the integration page. url: https://docs.datadoghq.com/integrations/microsoft_teams/ name: Microsoft Teams Integration - description: Manage Model Lab projects, runs, artifacts, and facets for ML experiment tracking. name: Model Lab API - description: |- [Monitors](https://docs.datadoghq.com/monitors) allow you to watch a metric or check that you care about and notifies your team when a defined threshold has exceeded. For more information, see [Creating Monitors](https://docs.datadoghq.com/monitors/create/types/) and [Tag Policies](https://docs.datadoghq.com/monitors/settings/). externalDocs: description: Find out more at url: https://docs.datadoghq.com/monitors/create/types/ name: Monitors - description: |- The Network Device Monitoring API allows you to fetch devices and interfaces and their attributes. See the [Network Device Monitoring page](https://docs.datadoghq.com/network_monitoring/) for more information. name: Network Device Monitoring - description: |- Configure OAuth2 clients for Datadog. Supports RFC 7591 Dynamic Client Registration and management of OAuth2 client scopes restrictions. name: OAuth2 Client Public - description: Auto-generated tag OCI Integration name: OCI Integration - description: |- Observability Pipelines allows you to collect and process logs within your own infrastructure, and then route them to downstream integrations. externalDocs: description: Find out more at url: https://docs.datadoghq.com/observability_pipelines/ name: Observability Pipelines - description: |- Configure your [Datadog Okta integration](https://docs.datadoghq.com/integrations/okta/) directly through the Datadog API. name: Okta Integration - description: |- Configure your [Datadog On-Call](https://docs.datadoghq.com/service_management/on-call/) directly through the Datadog API. externalDocs: url: https://docs.datadoghq.com/service_management/on-call/ name: On-Call - description: |- Trigger and manage [Datadog On-Call](https://docs.datadoghq.com/service_management/on-call/) pages directly through the Datadog API. externalDocs: url: https://docs.datadoghq.com/service_management/on-call/ name: On-Call Paging - description: |- Configure your [Datadog Opsgenie integration](https://docs.datadoghq.com/integrations/opsgenie/) directly through the Datadog API. externalDocs: url: https://docs.datadoghq.com/api/latest/opsgenie-integration name: Opsgenie Integration - description: Manage OAuth2 client authorizations at the organization level. name: Org Authorized Clients - description: |- Manage connections between organizations. Org connections allow for controlled sharing of data between different Datadog organizations. See the [Cross-Organization Visibiltiy](https://docs.datadoghq.com/account_management/org_settings/cross_org_visibility/) page for more information. name: Org Connections - description: >- Manage organization groups, memberships, policies, policy overrides, and policy configurations. name: Org Groups - description: Create, edit, and manage your organizations. Read more about [multi-org accounts](https://docs.datadoghq.com/account_management/multi_organization). externalDocs: description: Find out more at url: "https://docs.datadoghq.com/account_management/multi_organization" name: Organizations - description: |- The Powerpack endpoints allow you to: - Get a Powerpack - Create a Powerpack - Delete a Powerpack - Get a list of all Powerpacks The Patch and Delete API methods can only be performed on a Powerpack by a user who has the powerpack create permission for that specific Powerpack. Read [Scale Graphing Expertise with Powerpacks](https://docs.datadoghq.com/dashboards/guide/powerpacks-best-practices/) for more information. name: Powerpack - description: |- The processes API allows you to query processes data for your organization. See the [Live Processes page](https://docs.datadoghq.com/infrastructure/process/) for more information. name: Processes - description: |- Send server-side events to Product Analytics. Server-Side Events Ingestion allows you to collect custom events from any server-side source, and retains events for 15 months. Server-side events are helpful for understanding causes of a funnel drop-off which are external to the client-side (for example, payment processing error). **Note**: Sending server-side events impacts billing. Review the [pricing page](https://www.datadoghq.com/pricing/?product=product-analytics#products) and contact your Customer Success Manager for more information. name: Product Analytics - description: |- Look up the Datadog SKUs that are generally available, together with the public list prices, allotments, and tiered pricing that apply to them on a given date. name: Product Catalog - description: |- Manage your Real User Monitoring (RUM) applications, and search or aggregate your RUM events over HTTP. See the [RUM & Session Replay page](https://docs.datadoghq.com/real_user_monitoring/) for more information name: RUM - description: |- Manage the [Real User Monitoring (RUM)](https://docs.datadoghq.com/real_user_monitoring/) configuration for your organization. externalDocs: description: Find out more at url: https://docs.datadoghq.com/real_user_monitoring/ name: RUM Config - description: |- Get insights into the performance of your Real User Monitoring (RUM) applications over HTTP. See the [RUM & Session Replay page](https://docs.datadoghq.com/real_user_monitoring/) for more information name: RUM Insights - description: >- Configure Managed Archives for RUM applications. Your organization must have Managed Archives enabled. Requires `rum_rehydration_filter_read` to list or get configurations, or `rum_rehydration_filter_write` to create, update, or delete them. name: RUM Managed Archives - description: |- Manage [RUM Operations](https://docs.datadoghq.com/real_user_monitoring/), business transactions detected from RUM events through a configurable journey, and their links to journeys. See the [RUM & Session Replay page](https://docs.datadoghq.com/real_user_monitoring/) for more information. name: RUM Operations - description: >- Search archived RUM sessions and recover individual sessions or query-based batches. Your organization must have Managed Archives enabled. Creating, counting, listing, and canceling batches also require batch recovery enablement. Requires `rum_rehydration_filter_read` for search and request details, or `rum_rehydration_index` to create, estimate recoverable sessions, list batches, or cancel recovery requests. name: RUM Recovery - description: |- Manage [RUM SDK configurations](https://docs.datadoghq.com/real_user_monitoring/) delivered to RUM applications via Remote Configuration. externalDocs: description: Find out more at url: https://docs.datadoghq.com/real_user_monitoring/ name: RUM Remote Config - description: |- Manage RUM retention quota configurations for your organization's RUM applications. name: RUM Retention Quotas - description: View and manage Reference Tables in your organization. name: Reference Tables - description: |- Create and manage scheduled reports. A scheduled report renders a dashboard or integration dashboard on a recurring cadence and delivers it to a set of recipients over email, Slack, or Microsoft Teams. name: Report Schedules - description: |- The Reporting and Sharing endpoints allow you to create snapshots of graph widgets and other shareable resources. name: Reporting And Sharing - description: |- A restriction policy defines the access control rules for a resource, mapping a set of relations (such as editor and viewer) to a set of allowed principals (such as roles, teams, or users). The restriction policy determines who is authorized to perform what actions on the resource. name: Restriction Policies - description: |- The Roles API is used to create and manage Datadog roles, what [global permissions](https://docs.datadoghq.com/account_management/rbac/) they grant, and which users belong to them. Permissions related to specific account assets can be granted to roles in the Datadog application without using this API. For example, granting read access on a specific log index to a role can be done in Datadog from the [Pipelines page](https://app.datadoghq.com/logs/pipelines). Roles can also be managed in bulk through the Datadog UI, which provides the capability to assign a single permission to multiple roles simultaneously. name: Roles - description: Auto-generated tag Rum Audience Management name: Rum Audience Management - description: |- Manage configuration of [RUM-based metrics](https://app.datadoghq.com/rum/generate-metrics) for your organization. externalDocs: description: Find out more at url: https://docs.datadoghq.com/real_user_monitoring/platform/generate_metrics/ name: Rum Metrics - description: Manage heatmap snapshots for RUM replay sessions. Create, update, delete, and retrieve snapshots to visualize user interactions on specific views. name: Rum Replay Heatmaps - description: Create and manage playlists of RUM replay sessions. Organize, categorize, and share collections of replay sessions for analysis and collaboration. name: Rum Replay Playlists - description: |- Retrieve segments for RUM replay sessions. Access session replay data stored in event platform or blob storage. name: Rum Replay Sessions - description: Track and manage RUM replay session viewership. Monitor who watches replay sessions and maintain watch history for audit and analytics purposes. name: Rum Replay Viewership - description: |- Manage retention filters through [Manage Applications](https://app.datadoghq.com/rum/list) of RUM for your organization. name: Rum Retention Filters - description: |- Manage teams ownership mappings between RUM views and the teams that own them. See . name: Rum Teams Ownership - description: |- API to create and update scorecard rules and outcomes. See [Scorecards](https://docs.datadoghq.com/service_catalog/scorecards) for more information. name: Scorecards - description: |- The seats API allows you to view, assign, and unassign seats for your organization. name: Seats - description: |- Create and manage your security rules, signals, filters, and more. See the [Datadog Security page](https://docs.datadoghq.com/security/) for more information. name: "Security Monitoring" - description: Create, update, delete, and retrieve sensitive data scanner groups and rules. See the [Sensitive Data Scanner page](https://docs.datadoghq.com/sensitive_data_scanner/) for more information. name: Sensitive Data Scanner - description: Create, edit, and disable service accounts. See the [Service Accounts page](https://docs.datadoghq.com/account_management/org_settings/service_accounts/) for more information. name: Service Accounts - description: |- API to create, update, retrieve and delete service definitions. Note: Service Catalog [v3.0 schema](https://docs.datadoghq.com/service_catalog/service_definitions/v3-0/) has new API endpoints documented under [Software Catalog](https://docs.datadoghq.com/api/latest/software-catalog/). Use the following Service Definition endpoints for v2.2 and earlier. externalDocs: url: https://docs.datadoghq.com/tracing/service_catalog/ name: Service Definition - description: |- [Service Level Objectives](https://docs.datadoghq.com/monitors/service_level_objectives/#configuration) (SLOs) are a key part of the site reliability engineering toolkit. SLOs provide a framework for defining clear targets around application performance, which ultimately help teams provide a consistent customer experience, balance feature development with platform stability, and improve communication with internal and external users. name: Service Level Objectives - description: Manage your ServiceNow Integration. ServiceNow is a cloud-based platform that helps organizations manage digital workflows for enterprise operations. name: ServiceNow Integration - description: |- Configure your [Datadog Slack integration](https://docs.datadoghq.com/integrations/slack/) directly through the Datadog API. externalDocs: description: For more information about the Datadog Slack integration, see the integration page. url: https://docs.datadoghq.com/integrations/slack/ name: Slack Integration - description: |- Manage your Datadog Snowflake integration accounts directly through the Datadog API. See the [Snowflake integration page](https://docs.datadoghq.com/integrations/snowflake_web/) for more information. externalDocs: description: Snowflake integration. url: https://docs.datadoghq.com/integrations/snowflake_web/ name: Snowflake Integration - description: |- API to create, update, retrieve, and delete Software Catalog entities. externalDocs: url: https://docs.datadoghq.com/service_catalog/service_definitions#metadata-schema-v30-beta name: Software Catalog - description: |- Search and aggregate your spans from your Datadog platform over HTTP. name: Spans - description: |- Manage configuration of [span-based metrics](https://app.datadoghq.com/apm/traces/generate-metrics) for your organization. See [Generate Metrics from Spans](https://docs.datadoghq.com/tracing/trace_pipeline/generate_metrics/) for more information. externalDocs: description: Find out more at url: https://docs.datadoghq.com/tracing/metrics/metrics_namespace/ name: Spans Metrics - description: API for static analysis name: Static Analysis - description: Manage your status pages and communicate service disruptions to stakeholders via Datadog's API. See the [Status Pages documentation](https://docs.datadoghq.com/incident_response/status_pages/) for more information. name: Status Pages - description: |- Configure your [Datadog Statuspage integration](https://docs.datadoghq.com/integrations/statuspage/) directly through the Datadog API. externalDocs: url: https://docs.datadoghq.com/api/latest/statuspage-integration name: Statuspage Integration - description: Extract watermarks embedded in dashboard screenshots to retrieve cached widget state. name: Stegadography - description: |- Enable Storage Management for S3 buckets, GCS buckets, and Azure containers. Each configuration registers the destination that holds inventory reports for the storage being monitored. name: Storage Management - description: |- Synthetic tests use simulated requests and actions so you can monitor the availability and performance of systems and applications. Datadog supports the following types of synthetic tests: - [API tests](https://docs.datadoghq.com/synthetics/api_tests/) - [Browser tests](https://docs.datadoghq.com/synthetics/browser_tests) - [Network Path tests](https://docs.datadoghq.com/synthetics/network_path_tests/) - [Mobile Application tests](https://docs.datadoghq.com/synthetics/mobile_app_testing) You can use the Datadog API to create, manage, and organize tests and test suites programmatically. For more information, see the [Synthetic Monitoring documentation](https://docs.datadoghq.com/synthetics/). name: Synthetics - description: |- Tag Rules define rules that govern which tag values are accepted for a given tag key, scoped to a particular telemetry source (such as logs, spans, or metrics). Rules can be `blocking` (data not matching the rule is rejected) or `surfacing` (matching data is highlighted but not blocked). Each rule reports a compliance `score` derived from how much recent telemetry adheres to the rule. name: Tag Rules - description: View and manage teams within Datadog. See the [Teams page](https://docs.datadoghq.com/account_management/teams/) for more information. name: Teams - description: |- Manage your Datadog Temporal Cloud OpenMetrics integration accounts and account resources directly through the Datadog API. See the [Temporal Cloud OpenMetrics integration page](https://docs.datadoghq.com/integrations/temporal-cloud-openmetrics/) for more information. externalDocs: description: Temporal Cloud OpenMetrics integration. url: https://docs.datadoghq.com/integrations/temporal-cloud-openmetrics/ name: Temporal Cloud OpenMetrics Integration - description: |- Search and manage flaky tests through Test Optimization. See the [Test Optimization page](https://docs.datadoghq.com/tests/) for more information. name: Test Optimization - description: Ingest and manage threat intelligence data for security enrichment and investigation. name: Threat Intelligence - description: Investigate metrics timeseries anomalies and return deterministic findings. name: Timeseries Anomaly Investigations - description: |- Manage your Datadog Twilio integration accounts and account resources directly through the Datadog API. See the [Twilio integration page](https://docs.datadoghq.com/integrations/twilio/) for more information. externalDocs: description: Twilio integration. url: https://docs.datadoghq.com/integrations/twilio/ name: Twilio Integration - description: |- The usage metering API allows you to get hourly, daily, and monthly usage across multiple facets of Datadog. This API is available to all Pro and Enterprise customers. **Note**: Usage data is delayed by up to 72 hours from when it was incurred. It is retained for 15 months. You can retrieve up to 24 hours of hourly usage data for multiple organizations, and up to two months of hourly usage data for a single organization in one request. Learn more on the [usage details documentation](https://docs.datadoghq.com/account_management/billing/usage_details/). externalDocs: description: Find out more at url: "https://docs.datadoghq.com/account_management/billing/usage_details/" name: Usage Metering - description: Manage OAuth2 client authorizations at the user level. name: User Authorized Clients - description: Create, edit, and disable users. externalDocs: url: https://docs.datadoghq.com/account_management/users name: Users - description: |- Manage web integration accounts programmatically through the Datadog API. See the [Web Integrations page](https://app.datadoghq.com/integrations) for more information. name: Web Integrations - description: |- Configure your [Datadog Webhooks integration](https://docs.datadoghq.com/integrations/webhooks/) directly through the Datadog API. externalDocs: url: https://docs.datadoghq.com/api/latest/webhooks-integration name: Webhooks Integration - description: |- Create, read, update, and delete saved widgets. Widgets are reusable visualization components stored independently from any dashboard or notebook, partitioned by experience type and identified by a UUID. name: Widgets - description: |- Datadog Workflow Automation allows you to automate your end-to-end processes by connecting Datadog with the rest of your tech stack. Build workflows to auto-remediate your alerts, streamline your incident and security processes, and reduce manual toil. Workflow Automation supports over 1,000+ OOTB actions, including AWS, JIRA, ServiceNow, GitHub, and OpenAI. Learn more in our Workflow Automation docs [here](https://docs.datadoghq.com/service_management/workflows/). externalDocs: description: Find out more at url: "https://docs.datadoghq.com/service_management/workflows/" name: Workflow Automation x-group-parameters: true