arazzo: 1.0.1
info:
  title: Datadog Create a Service Account and Application Key
  summary: Create a service account, mint an application key for it, then read the key back.
  description: >-
    An automation-provisioning pattern on the Datadog v2 Service Accounts API,
    substituted for a v1-only mute-host flow that this v2 specification does not
    expose. The workflow creates a service-account user, mints an application key
    owned by that service account, and reads the key back by id to confirm it
    exists. Every step spells out its request inline so the flow can be read and
    executed without opening the underlying OpenAPI description.
  version: 1.0.0
sourceDescriptions:
- name: datadogApi
  url: ../openapi/datadog-api-openapi.yml
  type: openapi
workflows:
- workflowId: create-service-account-key
  summary: Create a service account, create an application key, then get the key.
  description: >-
    Creates a service-account user with the supplied email, mints an application
    key owned by that service account, and reads the key back by id.
  inputs:
    type: object
    required:
    - email
    - keyName
    properties:
      email:
        type: string
        description: The email address of the service account to create.
      title:
        type: string
        description: Optional title of the service account.
      keyName:
        type: string
        description: Name of the application key to mint for the service account.
  steps:
  - stepId: createServiceAccount
    description: Create a service-account user with the supplied email.
    operationId: CreateServiceAccount
    requestBody:
      contentType: application/json
      payload:
        data:
          type: users
          attributes:
            email: $inputs.email
            title: $inputs.title
            service_account: true
    successCriteria:
    - condition: $statusCode == 201
    outputs:
      serviceAccountId: $response.body#/data/id
  - stepId: createApplicationKey
    description: Mint an application key owned by the new service account.
    operationId: CreateServiceAccountApplicationKey
    parameters:
    - name: service_account_id
      in: path
      value: $steps.createServiceAccount.outputs.serviceAccountId
    requestBody:
      contentType: application/json
      payload:
        data:
          type: application_keys
          attributes:
            name: $inputs.keyName
    successCriteria:
    - condition: $statusCode == 201
    outputs:
      appKeyId: $response.body#/data/id
      appKeyValue: $response.body#/data/attributes/key
  - stepId: getApplicationKey
    description: Fetch the minted application key by id to confirm it exists.
    operationId: GetServiceAccountApplicationKey
    parameters:
    - name: service_account_id
      in: path
      value: $steps.createServiceAccount.outputs.serviceAccountId
    - name: app_key_id
      in: path
      value: $steps.createApplicationKey.outputs.appKeyId
    successCriteria:
    - condition: $statusCode == 200
    outputs:
      appKeyName: $response.body#/data/attributes/name
  outputs:
    serviceAccountId: $steps.createServiceAccount.outputs.serviceAccountId
    appKeyId: $steps.createApplicationKey.outputs.appKeyId
    appKeyName: $steps.getApplicationKey.outputs.appKeyName