openapi: 3.0.0 info: contact: email: support@datadoghq.com name: Datadog Support url: https://www.datadoghq.com/support/ description: The Datadog API is an HTTP REST API. The API uses resource-oriented URLs to call the API, uses status codes to indicate the success or failure of requests, returns JSON from all requests, and uses standard HTTP response codes. Use the Datadog API to access the Datadog platform programmatically. title: Datadog Account Create API version: '1.0' servers: - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: The regional site for Datadog customers. enum: - datadoghq.com - us3.datadoghq.com - us5.datadoghq.com - ap1.datadoghq.com - datadoghq.eu - ddog-gov.com subdomain: default: api description: The subdomain where the API is deployed. - url: '{protocol}://{name}' variables: name: default: api.datadoghq.com description: Full site DNS name. protocol: default: https description: The protocol for accessing the API. - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: Any Datadog deployment. subdomain: default: api description: The subdomain where the API is deployed. security: - apiKeyAuth: [] appKeyAuth: [] tags: - name: Create paths: /api/v2/actions/connections: post: description: Create a new Action Connection operationId: CreateActionConnection requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateActionConnectionRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/CreateActionConnectionResponse' description: Successfully created Action Connection '400': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Forbidden '429': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Too Many Request summary: Datadog Create a New Action Connection tags: - Create x-given: action_connection: parameters: - name: body value: "{\n \"data\": {\n \"type\": \"action_connection\",\n \"attributes\": {\n \"name\": \"Cassette Connection {{ unique_lower_alnum }}\",\n \"integration\": {\n \"type\": \"AWS\",\n \"credentials\": {\n \"type\": \"AWSAssumeRole\",\n \"role\": \"MyRole\",\n \"account_id\": \"123456789123\"\n }\n }\n }\n }\n}" step: there is a valid "action_connection" in the system x-menu-order: 2 x-undo: operationId: DeleteActionConnection parameters: - name: connection_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/api_keys: x-merge-override: post: true post: description: Create an API key. operationId: CreateAPIKey requestBody: content: application/json: schema: $ref: '#/components/schemas/APIKeyCreateRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/APIKeyResponse' description: Created '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create an Api Key tags: - Create x-codegen-request-body-name: body x-given: api_key: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"name\": \"{{ unique }}\"\n },\n \"type\": \"api_keys\"\n }\n}" step: there is a valid "api_key" in the system x-menu-order: 4 x-permission: operator: OR permissions: - api_keys_write x-undo: operationId: DeleteAPIKey parameters: - name: api_key_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/apicatalog/openapi: post: deprecated: true description: 'Create a new API from the [OpenAPI](https://spec.openapis.org/oas/latest.html) specification given. See the [API Catalog documentation](https://docs.datadoghq.com/api_catalog/add_metadata/) for additional information about the possible metadata. It returns the created API ID. ' operationId: CreateOpenAPI requestBody: content: multipart/form-data: schema: $ref: '#/components/schemas/OpenAPIFile' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/CreateOpenAPIResponse' description: API created successfully '400': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Bad request '403': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_api_catalog_write summary: Datadog Create a New Api tags: - Create x-given: managed_api: parameters: - name: openapi_spec_file value: '"openapi-spec.yaml"' step: there is a valid "managed_api" in the system x-menu-order: 1 x-permission: operator: OR permissions: - apm_api_catalog_write x-undo: operationId: DeleteOpenAPI parameters: - name: id source: data.id type: unsafe x-unstable: '**Note**: This endpoint is deprecated.' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/apm/config/metrics: post: description: 'Create a metric based on your ingested spans in your organization. Returns the span-based metric object from the request body when the request is successful.' operationId: CreateSpansMetric requestBody: content: application/json: schema: $ref: '#/components/schemas/SpansMetricCreateRequest' description: The definition of the new span-based metric. required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/SpansMetricResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a Span-based Metric tags: - Create x-codegen-request-body-name: body x-given: spans_metric: parameters: - name: body value: "{\n \"data\": {\n \"id\": \"{{ unique }}\",\n \"attributes\": {\n \"filter\": {\n \"query\": \"source:{{ unique }}\"\n },\n \"compute\": {\n \"aggregation_type\": \"distribution\",\n \"path\": \"@duration\",\n \"include_percentiles\": false\n },\n \"group_by\": [\n {\n \"path\": \"resource_name\",\n \"tag_name\": \"resource_name\"\n }\n ]\n },\n \"type\": \"spans_metrics\"\n }\n}" step: there is a valid "spans_metric" in the system x-menu-order: 2 x-permission: operator: OR permissions: - apm_generate_metrics x-undo: operationId: DeleteSpansMetric parameters: - name: metric_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/apm/config/retention-filters: post: description: 'Create a retention filter to index spans in your organization. Returns the retention filter definition when the request is successful. Default filters with types spans-errors-sampling-processor and spans-appsec-sampling-processor cannot be created.' operationId: CreateApmRetentionFilter requestBody: content: application/json: schema: $ref: '#/components/schemas/RetentionFilterCreateRequest' description: The definition of the new retention filter. required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/RetentionFilterCreateResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a Retention Filter tags: - Create x-codegen-request-body-name: body x-given: retention_filter: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"name\": \"demo retention filter\",\n \"rate\": 0.90,\n \"filter\": {\n \"query\": \"@_top_level:1 test:service-demo\"\n },\n \"enabled\": true,\n \"filter_type\": \"spans-sampling-processor\"\n },\n \"type\": \"apm_retention_filter\"\n }\n}" step: there is a valid "retention_filter" in the system x-menu-order: 2 x-permission: operator: OR permissions: - apm_retention_filter_write - apm_pipelines_write x-undo: operationId: DeleteApmRetentionFilter parameters: - name: filter_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/app-builder/apps: post: description: Create a new app, returning the app ID. operationId: CreateApp requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateAppRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/CreateAppResponse' description: Created '400': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create App tags: - Create x-given: app: parameters: - name: body value: '{"data":{"type":"appDefinitions","attributes":{"rootInstanceName":"grid0","components":[{"name":"grid0","type":"grid","properties":{"children":[{"type":"gridCell","name":"gridCell0","properties":{"children":[{"name":"text0","type":"text","properties":{"content":"# Cat Facts","contentType":"markdown","textAlign":"left","verticalAlign":"top","isVisible":true},"events":[]}],"isVisible":"true","layout":{"default":{"x":0,"y":0,"width":4,"height":5}}},"events":[]},{"type":"gridCell","name":"gridCell2","properties":{"children":[{"name":"table0","type":"table","properties":{"data":"${fetchFacts?.outputs?.body?.data}","columns":[{"dataPath":"fact","header":"fact","isHidden":false,"id":"0ae2ae9e-0280-4389-83c6-1c5949f7e674"},{"dataPath":"length","header":"length","isHidden":true,"id":"c9048611-0196-4a00-9366-1ef9e3ec0408"},{"id":"8fa9284b-7a58-4f13-9959-57b7d8a7fe8f","dataPath":"Due Date","header":"Unused Old Column","disableSortBy":false,"formatter":{"type":"formatted_time","format":"LARGE_WITHOUT_TIME"},"isDeleted":true}],"summary":true,"pageSize":"${pageSize?.value}","paginationType":"server_side","isLoading":"${fetchFacts?.isLoading}","rowButtons":[],"isWrappable":false,"isScrollable":"vertical","isSubRowsEnabled":false,"globalFilter":false,"isVisible":true,"totalCount":"${fetchFacts?.outputs?.body?.total}"},"events":[]}],"isVisible":"true","layout":{"default":{"x":0,"y":5,"width":12,"height":96}}},"events":[]},{"type":"gridCell","name":"gridCell1","properties":{"children":[{"name":"text1","type":"text","properties":{"content":"## Random Fact\n\n${randomFact?.outputs?.fact}","contentType":"markdown","textAlign":"left","verticalAlign":"top","isVisible":true},"events":[]}],"isVisible":"true","layout":{"default":{"x":0,"y":101,"width":12,"height":16}}},"events":[]},{"type":"gridCell","name":"gridCell3","properties":{"children":[{"name":"button0","type":"button","properties":{"label":"Increase Page Size","level":"default","isPrimary":true,"isBorderless":false,"isLoading":false,"isDisabled":false,"isVisible":true,"iconLeft":"angleUp","iconRight":""},"events":[{"variableName":"pageSize","value":"${pageSize?.value + 1}","name":"click","type":"setStateVariableValue"}]}],"isVisible":"true","layout":{"default":{"x":10,"y":134,"width":2,"height":4}}},"events":[]},{"type":"gridCell","name":"gridCell4","properties":{"children":[{"name":"button1","type":"button","properties":{"label":"Decrease Page Size","level":"default","isPrimary":true,"isBorderless":false,"isLoading":false,"isDisabled":false,"isVisible":true,"iconLeft":"angleDown","iconRight":""},"events":[{"variableName":"pageSize","value":"${pageSize?.value - 1}","name":"click","type":"setStateVariableValue"}]}],"isVisible":"true","layout":{"default":{"x":10,"y":138,"width":2,"height":4}}},"events":[]}],"backgroundColor":"default"},"events":[]}],"queries":[{"id":"92ff0bb8-553b-4f31-87c7-ef5bd16d47d5","type":"action","name":"fetchFacts","events":[],"properties":{"spec":{"fqn":"com.datadoghq.http.request","connectionId":"5e63f4a8-4ce6-47de-ba11-f6617c1d54f3","inputs":{"verb":"GET","url":"https://catfact.ninja/facts","urlParams":[{"key":"limit","value":"${pageSize.value.toString()}"},{"key":"page","value":"${(table0.pageIndex + 1).toString()}"}]}}}},{"type":"stateVariable","name":"pageSize","properties":{"defaultValue":"${20}"},"id":"afd03c81-4075-4432-8618-ba09d52d2f2d"},{"type":"dataTransform","name":"randomFact","properties":{"outputs":"${(() => {const facts = fetchFacts.outputs.body.data\nreturn facts[Math.floor(Math.random()*facts.length)]\n})()}"},"id":"0fb22859-47dc-4137-9e41-7b67d04c525c"}],"name":"Example Cat Facts Viewer","description":"This is a slightly complicated example app that fetches and displays cat facts"}}}' step: there is a valid "app" in the system x-menu-order: 2 x-permission: operator: AND permissions: - apps_write - connections_resolve - workflows_run x-undo: operationId: DeleteApp parameters: - name: app_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/authn_mappings: x-merge-override: get: false post: false post: description: Create an AuthN Mapping. operationId: CreateAuthNMapping requestBody: content: application/json: schema: $ref: '#/components/schemas/AuthNMappingCreateRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/AuthNMappingResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication Error '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Found '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create an Authn Mapping tags: - Create x-codegen-request-body-name: body x-given: authn_mapping: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"attribute_key\": \"{{ unique_lower_alnum }}\",\n \"attribute_value\": \"{{ unique }}\"\n },\n \"relationships\": {\n \"role\": {\n \"data\": {\n \"id\": \"{{ role.data.id }}\",\n \"type\": \"{{ role.data.type }}\"\n }\n }\n },\n \"type\": \"authn_mappings\"\n }\n}" step: there is a valid "authn_mapping" in the system x-menu-order: 5 x-permission: operator: OR permissions: - user_access_manage x-undo: operationId: DeleteAuthNMapping parameters: - name: authn_mapping_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/cases: post: description: Create a Case operationId: CreateCase requestBody: content: application/json: schema: $ref: '#/components/schemas/CaseCreateRequest' description: Case payload required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/CaseResponse' description: CREATED '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Datadog Create a Case tags: - Create x-given: case: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"title\": \"My new case\",\n \"type\": \"STANDARD\",\n \"priority\": \"P4\"\n },\n \"relationships\": {\n \"project\": {\n \"data\": {\n \"id\": \"d4bbe1af-f36e-42f1-87c1-493ca35c320e\",\n \"type\": \"project\"\n }\n }\n },\n \"type\": \"case\"\n }\n}" source: data step: there is a valid "case" in the system x-menu-order: 2 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/cases/projects: post: description: Create a project. operationId: CreateProject requestBody: content: application/json: schema: $ref: '#/components/schemas/ProjectCreateRequest' description: Project payload required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/ProjectResponse' description: CREATED '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cases_write summary: Datadog Create a Project tags: - Create x-menu-order: 1 x-undo: operationId: DeleteProject parameters: - name: project_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/catalog/entity: post: description: Create or update entities in Software Catalog. operationId: UpsertCatalogEntity requestBody: content: application/json: schema: $ref: '#/components/schemas/UpsertCatalogEntityRequest' description: Entity YAML or JSON. required: true responses: '202': content: application/json: schema: $ref: '#/components/schemas/UpsertCatalogEntityResponse' description: ACCEPTED '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_write summary: Datadog Create or Update Entities tags: - Create x-codegen-request-body-name: body x-given: entity: parameters: - name: body value: "{\n \"apiVersion\": \"v3\",\n \"kind\": \"service\",\n \"metadata\": {\n \"name\": \"service-{{ unique_lower_alnum }}\",\n \"displayName\": \"Shopping Cart\",\n \"inheritFrom\": \"service:otherService\",\n \"tags\": [\n \"tag:value\"\n ],\n \"links\": [\n {\n \"name\": \"shopping-cart runbook\",\n \"type\": \"runbook\",\n \"url\": \"https://runbook/shopping-cart\"\n },\n {\n \"name\": \"shopping-cart architecture\",\n \"provider\": \"gdoc\",\n \"url\": \"https://google.drive/shopping-cart-architecture\",\n \"type\": \"doc\"\n },\n {\n \"name\": \"shopping-cart Wiki\",\n \"provider\": \"wiki\",\n \"url\": \"https://wiki/shopping-cart\",\n \"type\": \"doc\"\n },\n {\n \"name\": \"shopping-cart source code\",\n \"provider\": \"github\",\n \"url\": \"http://github/shopping-cart\",\n \"type\": \"repo\"\n }\n ],\n \"contacts\": [\n {\n \"name\": \"Support Email\",\n \"type\": \"email\",\n \"contact\": \"team@shopping.com\"\n },\n {\n \"name\": \"Support Slack\",\n \"type\": \"slack\",\n \"contact\": \"https://www.slack.com/archives/shopping-cart\"\n }\n ],\n \"owner\": \"myteam\",\n \"additionalOwners\": [\n {\n \"name\": \"opsTeam\",\n \"type\": \"operator\"\n }\n ]\n },\n \"integrations\": {\n \"pagerduty\": {\n \"serviceURL\": \"https://www.pagerduty.com/service-directory/Pshopping-cart\"\n },\n \"opsgenie\": {\n \"serviceURL\": \"https://www.opsgenie.com/service/shopping-cart\",\n \"region\": \"US\"\n }\n },\n \"extensions\": {\n \"datadoghq.com/shopping-cart\": {\n \"customField\": \"customValue\"\n }\n },\n \"spec\": {\n \"lifecycle\": \"production\",\n \"tier\": \"1\",\n \"type\": \"web\",\n \"languages\": [\n \"go\",\n \"python\"\n ],\n \"dependsOn\": [\n \"service:serviceA\",\n \"service:serviceB\"\n ]\n },\n \"datadog\": {\n \"performanceData\": {\n \"tags\": [\n \"service:shopping-cart\",\n \"hostname:shopping-cart\"\n ]\n },\n \"events\": [\n {\n \"name\": \"deployment events\",\n \"query\": \"app:myapp AND type:github\"\n },\n {\n \"name\": \"event type B\",\n \"query\": \"app:myapp AND type:github\"\n }\n ],\n \"logs\": [\n {\n \"name\": \"critical logs\",\n \"query\": \"app:myapp AND type:github\"\n },\n {\n \"name\": \"ops logs\",\n \"query\": \"app:myapp AND type:github\"\n }\n ],\n \"pipelines\": {\n \"fingerprints\": [\n \"fp1\",\n \"fp2\"\n ]\n },\n \"codeLocations\": [\n {\n \"repositoryURL\": \"http://github/shopping-cart.git\",\n \"paths\": [\n \"baz/*.c\",\n \"bat/**/*\",\n \"../plop/*.java\"\n ]\n },\n {\n \"repositoryURL\": \"http://github/shopping-cart-2.git\",\n \"paths\": [\n \"baz/*.c\",\n \"bat/**/*\",\n \"../plop/*.java\"\n ]\n }\n ]\n }\n}" step: there is a valid entity in the system x-menu-order: 2 x-undo: operationId: DeleteCatalogEntity parameters: - name: entity_id source: data[0].id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/cloud_security_management/custom_frameworks: post: description: Create a custom framework. operationId: CreateCustomFramework requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateCustomFrameworkRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/CreateCustomFrameworkResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' '500': $ref: '#/components/responses/BadRequestResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_read - security_monitoring_rules_write summary: Datadog Create a Custom Framework tags: - Create x-codegen-request-body-name: body x-given: custom_framework: parameters: - name: body value: "{\n \"data\": {\n \"type\":\"custom_framework\",\n \"attributes\":{\n \"name\":\"name\",\n \"handle\":\"create-framework-new\",\n \"version\":\"10\",\n \"icon_url\":\"test-url\",\n \"requirements\":[{\n \"name\":\"requirement\",\n \"controls\":[{\n \"name\":\"control\",\n \"rules_id\":\n [\"def-000-be9\"]\n }]\n }]\n }\n }\n}" step: there is a valid "custom_framework" in the system x-menu-order: 4 x-permission: operator: AND permissions: - security_monitoring_rules_read - security_monitoring_rules_write x-undo: operationId: DeleteCustomFramework parameters: - name: handle source: data.attributes.handle - name: version source: data.attributes.version type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/cost/aws_cur_config: post: description: Create a Cloud Cost Management account for an AWS CUR config. operationId: CreateCostAWSCURConfig requestBody: content: application/json: schema: $ref: '#/components/schemas/AwsCURConfigPostRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/AwsCURConfigResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Datadog Create Cloud Cost Management Aws Cur Config tags: - Create x-menu-order: 3 x-permission: operator: OR permissions: - cloud_cost_management_write x-undo: type: idempotent x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/cost/azure_uc_config: post: description: Create a Cloud Cost Management account for an Azure config. operationId: CreateCostAzureUCConfigs requestBody: content: application/json: schema: $ref: '#/components/schemas/AzureUCConfigPostRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/AzureUCConfigPairsResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Datadog Create Cloud Cost Management Azure Configs tags: - Create x-menu-order: 8 x-permission: operator: OR permissions: - cloud_cost_management_write x-undo: type: idempotent x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/cost/budget: put: description: Create a new budget or update an existing one. operationId: UpsertBudget requestBody: content: application/json: schema: $ref: '#/components/schemas/BudgetWithEntries' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/BudgetWithEntries' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - cloud_cost_management_write summary: Datadog Create or Update a Budget tags: - Create x-menu-order: 14 x-undo: operationId: DeleteBudget parameters: - name: budget_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/current_user/application_keys: post: description: Create an application key for current user operationId: CreateCurrentUserApplicationKey requestBody: content: application/json: schema: $ref: '#/components/schemas/ApplicationKeyCreateRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/ApplicationKeyResponse' description: Created '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create an Application Key for Current User tags: - Create x-codegen-request-body-name: body x-given: application_key: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"name\": \"{{ unique }}\"\n },\n \"type\": \"application_keys\"\n }\n}" step: there is a valid "application_key" in the system x-menu-order: 4 x-permission: operator: OR permissions: - user_app_keys x-undo: operationId: DeleteCurrentUserApplicationKey parameters: - name: app_key_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/incidents: post: description: Create an incident. operationId: CreateIncident requestBody: content: application/json: schema: $ref: '#/components/schemas/IncidentCreateRequest' description: Incident payload. required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/IncidentResponse' description: CREATED '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Datadog Create an Incident tags: - Create x-codegen-request-body-name: body x-given: incident: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"title\": \"{{ unique }}\",\n \"customer_impacted\": false\n },\n \"type\": \"incidents\"\n }\n}" step: there is a valid "incident" in the system x-menu-order: 1 x-permission: operator: OR permissions: - incident_write x-undo: operationId: DeleteIncident parameters: - name: incident_id source: data.id type: unsafe x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/incidents/config/types: post: description: Create an incident type. operationId: CreateIncidentType requestBody: content: application/json: schema: $ref: '#/components/schemas/IncidentTypeCreateRequest' description: Incident type payload. required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/IncidentTypeResponse' description: CREATED '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Datadog Create an Incident Type tags: - Create x-codegen-request-body-name: body x-given: incident_type: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"name\": \"Security Incident\",\n \"description\": \"Any incidents that harm (or have the potential to) the confidentiality, integrity, or availability of our data.\",\n \"is_default\": false\n },\n \"type\": \"incident_types\"\n }\n}" step: there is a valid "incident_type" in the system x-menu-order: 19 x-permission: operator: OR permissions: - incident_settings_write x-undo: operationId: DeleteIncidentType parameters: - name: incident_type_id source: data.id type: unsafe x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/incidents/{incident_id}/attachments: patch: description: The bulk update endpoint for creating, updating, and deleting attachments for a given incident. operationId: UpdateIncidentAttachments parameters: - $ref: '#/components/parameters/IncidentIDPathParameter' - $ref: '#/components/parameters/IncidentAttachmentIncludeQueryParameter' requestBody: content: application/json: schema: $ref: '#/components/schemas/IncidentAttachmentUpdateRequest' description: Incident Attachment Payload. required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/IncidentAttachmentUpdateResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create, Update, and Delete Incident Attachments tags: - Create x-codegen-request-body-name: body x-given: incident_attachment: parameters: - name: incident_id source: incident.data.id - name: body value: "{\n \"data\": [\n {\n \"attributes\": {\n \"attachment_type\": \"link\",\n \"attachment\": {\n \"documentUrl\": \"https://www.example.com/doc\",\n \"title\": \"Important Doc\"\n }\n },\n \"type\": \"incident_attachments\"\n }\n ]\n}" step: the "incident" has an "incident_attachment" x-menu-order: 8 x-permission: operator: OR permissions: - incident_write x-undo: type: idempotent x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/incidents/{incident_id}/relationships/integrations: post: description: Create an incident integration metadata. operationId: CreateIncidentIntegration parameters: - $ref: '#/components/parameters/IncidentIDPathParameter' requestBody: content: application/json: schema: $ref: '#/components/schemas/IncidentIntegrationMetadataCreateRequest' description: Incident integration metadata payload. required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/IncidentIntegrationMetadataResponse' description: CREATED '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Datadog Create an Incident Integration Metadata tags: - Create x-codegen-request-body-name: body x-given: incident_integration_metadata: parameters: - name: incident_id source: incident.data.id - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"integration_type\": 1,\n \"incident_id\": \"{{ incident.data.id }}\",\n \"status\": 2,\n \"metadata\": {\n \"channels\": [\n {\n \"channel_id\": \"C0123456789\",\n \"team_id\": \"T01234567\",\n \"channel_name\": \"#example-channel-name\",\n \"redirect_url\": \"https://slack.com/app_redirect?channel=C0123456789&team=T01234567\"\n }\n ]\n }\n },\n \"type\": \"incident_integrations\"\n }\n}" step: the "incident" has an "incident_integration_metadata" x-menu-order: 10 x-permission: operator: OR permissions: - incident_write x-undo: operationId: DeleteIncidentIntegration parameters: - name: incident_id source: data.attributes.incident_id - name: integration_metadata_id source: data.id type: unsafe x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/incidents/{incident_id}/relationships/todos: post: description: Create an incident todo. operationId: CreateIncidentTodo parameters: - $ref: '#/components/parameters/IncidentIDPathParameter' requestBody: content: application/json: schema: $ref: '#/components/schemas/IncidentTodoCreateRequest' description: Incident todo payload. required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/IncidentTodoResponse' description: CREATED '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_write summary: Datadog Create an Incident Todo tags: - Create x-codegen-request-body-name: body x-given: incident_todo: parameters: - name: incident_id source: incident.data.id - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"content\": \"Follow up with customer about the impact they saw.\",\n \"assignees\": [\n \"@test.user@test.com\",\n {\n \"icon\": \"https://a.slack-edge.com/80588/img/slackbot_48.png\",\n \"id\": \"USLACKBOT\",\n \"name\": \"Slackbot\",\n \"source\": \"slack\"\n }\n ]\n },\n \"type\": \"incident_todos\"\n }\n}" step: the "incident" has an "incident_todo" x-menu-order: 15 x-permission: operator: OR permissions: - incident_write x-undo: operationId: DeleteIncidentTodo parameters: - name: incident_id source: data.attributes.incident_id - name: todo_id source: data.id type: unsafe x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integration/aws/accounts: post: description: Create a new AWS Account Integration Config. operationId: CreateAWSAccount requestBody: content: application/json: schema: $ref: '#/components/schemas/AWSAccountCreateRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/AWSAccountResponse' description: AWS Account object '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create an Aws Integration tags: - Create x-codegen-request-body-name: body x-given: aws_account_v2: parameters: - name: body value: "{\n \"data\": {\n \"type\": \"account\",\n \"attributes\": {\n \"account_tags\": [\n \"key:value\"\n ],\n \"auth_config\": {\n \"role_name\": \"DatadogIntegrationRole\"\n },\n \"aws_account_id\": \"123456789012\",\n \"aws_partition\": \"aws\",\n \"aws_regions\": {\n \"include_only\": [\n \"us-east-1\"\n ]\n },\n \"logs_config\": {\n \"lambda_forwarder\": {\n \"lambdas\": [\n \"arn:aws:lambda:us-east-1:123456789012:function:DatadogLambdaLogForwarder\"\n ],\n \"sources\": [\n \"s3\"\n ]\n }\n },\n \"metrics_config\": {\n \"enabled\": true,\n \"automute_enabled\": true,\n \"collect_custom_metrics\": false,\n \"collect_cloudwatch_alarms\": false,\n \"tag_filters\": [\n {\n \"namespace\": \"AWS/EC2\",\n \"tags\": [\n \"key:value\"\n ]\n }\n ],\n \"namespace_filters\": {\n \"include_only\": [\n \"AWS/EC2\"\n ]\n }\n },\n \"resources_config\": {\n \"cloud_security_posture_management_collection\": false,\n \"extended_collection\": false\n },\n \"traces_config\": {\n \"xray_services\": {\n \"include_only\": [\n \"AWS/AppSync\"\n ]\n }\n }\n }\n }\n}" step: there is a valid "aws_account_v2" in the system x-menu-order: 2 x-permission: operator: OR permissions: - aws_configurations_manage x-undo: operationId: DeleteAWSAccount parameters: - name: aws_account_config_id source: data.id type: unsafe x-unstable: '**Note: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).**' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integration/gcp/accounts: x-merge-override: get: false post: false post: description: Create a new entry within Datadog for your STS enabled service account. operationId: CreateGCPSTSAccount requestBody: content: application/json: schema: $ref: '#/components/schemas/GCPSTSServiceAccountCreateRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/GCPSTSServiceAccountResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a New Entry for Your Service Account tags: - Create x-codegen-request-body-name: body x-given: gcp_sts_account: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"client_email\": \"Test-{{ unique_hash }}@example.com\",\n \"host_filters\": []\n },\n \"type\": \"gcp_service_account\"\n }\n}" step: there is a valid "gcp_sts_account" in the system x-menu-order: 2 x-permission: operator: OR permissions: - gcp_configurations_manage x-undo: operationId: DeleteGCPSTSAccount parameters: - name: account_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integration/gcp/sts_delegate: post: description: Create a Datadog GCP principal. operationId: MakeGCPSTSDelegate requestBody: content: application/json: schema: example: {} type: object description: Create a delegate service account within Datadog. required: false responses: '200': content: application/json: schema: $ref: '#/components/schemas/GCPSTSDelegateAccountResponse' description: OK '403': $ref: '#/components/responses/NotAuthorizedResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a Datadog Gcp Principal tags: - Create x-codegen-request-body-name: body x-menu-order: 5 x-permission: operator: OR permissions: - gcp_configuration_edit x-undo: type: idempotent x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integration/ms-teams/configuration/tenant-based-handles: x-merge-override: get: true post: true post: description: Create a tenant-based handle in the Datadog Microsoft Teams integration. operationId: CreateTenantBasedHandle requestBody: content: application/json: schema: $ref: '#/components/schemas/MicrosoftTeamsCreateTenantBasedHandleRequest' description: Tenant-based handle payload. required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleResponse' description: CREATED '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '409': $ref: '#/components/responses/ConflictResponse' '412': $ref: '#/components/responses/PreconditionFailedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create Tenant-based Handle tags: - Create x-codegen-request-body-name: body x-given: tenant_based_handle: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"name\": \"{{ unique }}\",\n \"tenant_id\": \"4d3bac44-0230-4732-9e70-cc00736f0a97\",\n \"team_id\": \"e5f50a58-c929-4fb3-8866-e2cd836de3c2\",\n \"channel_id\": \"19:iD_D2xy_sAa-JV851JJYwIa6mlW9F9Nxm3SLyZq68qY1@thread.tacv2\"\n },\n \"type\": \"tenant-based-handle\"\n }\n}" step: there is a valid "tenant_based_handle" in the system x-menu-order: 1 x-undo: operationId: DeleteTenantBasedHandle parameters: - name: handle_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integration/ms-teams/configuration/workflows-webhook-handles: post: description: Create a Workflows webhook handle in the Datadog Microsoft Teams integration. operationId: CreateWorkflowsWebhookHandle requestBody: content: application/json: schema: $ref: '#/components/schemas/MicrosoftTeamsCreateWorkflowsWebhookHandleRequest' description: Workflows Webhook handle payload. required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleResponse' description: CREATED '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '409': $ref: '#/components/responses/ConflictResponse' '412': $ref: '#/components/responses/PreconditionFailedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create Workflows Webhook Handle tags: - Create x-codegen-request-body-name: body x-given: workflows_webhook_handle: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"name\": \"{{ unique }}\",\n \"url\": \"https://prod-100.westus.logic.azure.com:443/workflows/abcd1234\"\n },\n \"type\": \"workflows-webhook-handle\"\n }\n}" step: there is a valid "workflows_webhook_handle" in the system x-menu-order: 1 x-undo: operationId: DeleteWorkflowsWebhookHandle parameters: - name: handle_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/integration/opsgenie/services: x-merge-override: get: true post: true post: description: Create a new service object in the Opsgenie integration. operationId: CreateOpsgenieService requestBody: content: application/json: schema: $ref: '#/components/schemas/OpsgenieServiceCreateRequest' description: Opsgenie service payload required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/OpsgenieServiceResponse' description: CREATED '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a New Service Object tags: - Create x-codegen-request-body-name: body x-given: opsgenie_service: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"name\": \"{{ unique }}\",\n \"opsgenie_api_key\": \"00000000-0000-0000-0000-000000000000\",\n \"region\": \"us\"\n },\n \"type\": \"opsgenie-service\"\n }\n}" step: there is a valid "opsgenie_service" in the system x-menu-order: 2 x-permission: operator: OR permissions: - manage_integrations x-undo: operationId: DeleteOpsgenieService parameters: - name: integration_service_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/logs/config/archives: post: description: Create an archive in your organization. operationId: CreateLogsArchive requestBody: content: application/json: schema: $ref: '#/components/schemas/LogsArchiveCreateRequest' description: The definition of the new archive. required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/LogsArchive' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create an Archive tags: - Create x-codegen-request-body-name: body x-menu-order: 2 x-permission: operator: OR permissions: - logs_write_archives x-undo: operationId: DeleteLogsArchive parameters: - name: archive_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/logs/config/custom-destinations: post: description: Create a custom destination in your organization. operationId: CreateLogsCustomDestination requestBody: content: application/json: schema: $ref: '#/components/schemas/CustomDestinationCreateRequest' description: The definition of the new custom destination. required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/CustomDestinationResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a Custom Destination tags: - Create x-codegen-request-body-name: body x-given: custom_destination: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"name\": \"{{ unique }}\",\n \"query\": \"source:nginx\",\n \"enabled\": false,\n \"forwarder_destination\": {\n \"type\": \"http\",\n \"endpoint\": \"https://example.com\",\n \"auth\": {\n \"type\": \"basic\",\n \"username\": \"my-username\",\n \"password\": \"my-password\"\n }\n },\n \"forward_tags_restriction_list_type\": \"BLOCK_LIST\",\n \"forward_tags_restriction_list\": [\"host\"],\n \"forward_tags\": false\n },\n \"type\": \"custom_destination\"\n }\n}" step: there is a valid "custom_destination" in the system x-menu-order: 2 x-permission: operator: OR permissions: - logs_write_forwarding_rules x-undo: operationId: DeleteLogsCustomDestination parameters: - name: custom_destination_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/logs/config/metrics: post: description: 'Create a metric based on your ingested logs in your organization. Returns the log-based metric object from the request body when the request is successful.' operationId: CreateLogsMetric requestBody: content: application/json: schema: $ref: '#/components/schemas/LogsMetricCreateRequest' description: The definition of the new log-based metric. required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/LogsMetricResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a Log-based Metric tags: - Create x-codegen-request-body-name: body x-given: logs_metric: parameters: - name: body value: "{\n \"data\": {\n \"id\": \"{{ unique }}\",\n \"attributes\": {\n \"filter\": {\n \"query\": \"source:{{ unique }}\"\n },\n \"compute\": {\n \"aggregation_type\": \"count\"\n }\n },\n \"type\": \"logs_metrics\"\n }\n}" step: there is a valid "logs_metric" in the system logs_metric_percentile: parameters: - name: body value: "{\n \"data\": {\n \"id\": \"{{ unique }}\",\n \"attributes\": {\n \"filter\": {\n \"query\": \"source:{{ unique }}\"\n },\n \"compute\": {\n \"aggregation_type\": \"distribution\",\n \"path\": \"@duration\",\n \"include_percentiles\": true\n }\n },\n \"type\": \"logs_metrics\"\n }\n}" step: there is a valid "logs_metric_percentile" in the system x-menu-order: 2 x-permission: operator: OR permissions: - logs_generate_metrics x-undo: operationId: DeleteLogsMetric parameters: - name: metric_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/logs/config/restriction_queries: post: description: Create a new restriction query for your organization. operationId: CreateRestrictionQuery requestBody: content: application/json: schema: $ref: '#/components/schemas/RestrictionQueryCreatePayload' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/RestrictionQueryWithoutRelationshipsResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication error '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a Restriction Query tags: - Create x-codegen-request-body-name: body x-menu-order: 2 x-permission: operator: OR permissions: - user_access_manage x-undo: operationId: DeleteRestrictionQuery parameters: - name: restriction_query_id source: data.id type: unsafe x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/metrics/{metric_name}/tags: post: description: 'Create and define a list of queryable tag keys for an existing count/gauge/rate/distribution metric. Optionally, include percentile aggregations on any distribution metric. By setting `exclude_tags_mode` to true, the behavior is changed from an allow-list to a deny-list, and tags in the defined list are not queryable. Can only be used with application keys of users with the `Manage Tags for Metrics` permission.' operationId: CreateTagConfiguration parameters: - $ref: '#/components/parameters/MetricName' requestBody: content: application/json: schema: $ref: '#/components/schemas/MetricTagConfigurationCreateRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/MetricTagConfigurationResponse' description: Created '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '409': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Conflict '429': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Too Many Requests summary: Datadog Create a Tag Configuration tags: - Create x-codegen-request-body-name: body x-given: metric_tag_configuration: parameters: - name: metric_name value: '"{{ unique_alnum }}"' - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"tags\":[\"app\", \"datacenter\", \"{{ unique_alnum }}\"],\n \"metric_type\":\"gauge\"\n },\n \"type\": \"manage_tags\",\n \"id\": \"{{ unique_alnum }}\"\n }\n}" step: there is a valid "metric_tag_configuration" in the system x-menu-order: 1 x-permission: operator: OR permissions: - metric_tags_write x-undo: operationId: DeleteTagConfiguration parameters: - name: metric_name source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/monitor/notification_rule: post: description: Creates a monitor notification rule. operationId: CreateMonitorNotificationRule requestBody: content: application/json: schema: $ref: '#/components/schemas/MonitorNotificationRuleCreateRequest' description: Request body to create a monitor notification rule. required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/MonitorNotificationRuleResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - monitor_config_policy_write summary: Datadog Create a Monitor Notification Rule tags: - Create x-given: monitor_notification_rule: parameters: - name: body value: "{\n \"data\": {\n \"type\": \"monitor-notification-rule\",\n \"attributes\": {\n \"name\":\"test rule\",\n \"filter\": {\n \"tags\": [\n \"app:{{ unique_lower }}\"\n ]\n },\n \"recipients\":[\n \"slack-monitor-app\"\n ]\n }\n }\n}" step: there is a valid "monitor_notification_rule" in the system x-menu-order: 16 x-permission: operator: OR permissions: - monitor_config_policy_write x-undo: operationId: DeleteMonitorNotificationRule parameters: - name: rule_id source: data.id type: unsafe x-unstable: '**Note**: This endpoint is in Preview. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/monitor/policy: post: description: Create a monitor configuration policy. operationId: CreateMonitorConfigPolicy requestBody: content: application/json: schema: $ref: '#/components/schemas/MonitorConfigPolicyCreateRequest' description: Create a monitor configuration policy request body. required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/MonitorConfigPolicyResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a Monitor Configuration Policy tags: - Create x-codegen-request-body-name: body x-given: monitor_configuration_policy: parameters: - name: body value: "{\n \"data\": {\n \"type\": \"monitor-config-policy\",\n \"attributes\": {\n \"policy_type\": \"tag\",\n \"policy\": {\n \"tag_key\": \"{{ unique_lower_alnum }}\", \"tag_key_required\": false, \"valid_tag_values\": [\"prod\", \"staging\"]\n }\n }\n }\n}" step: there is a valid "monitor_configuration_policy" in the system x-menu-order: 11 x-permission: operator: OR permissions: - monitor_config_policy_write x-undo: operationId: DeleteMonitorConfigPolicy parameters: - name: policy_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/on-call/escalation-policies: post: description: Create a new On-Call escalation policy operationId: CreateOnCallEscalationPolicy parameters: - description: 'Comma-separated list of included relationships to be returned. Allowed values: `teams`, `steps`, `steps.targets`.' in: query name: include schema: type: string example: example_value requestBody: content: application/json: schema: $ref: '#/components/schemas/EscalationPolicyCreateRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/EscalationPolicy' description: Created '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Datadog Create On-call Escalation Policy tags: - Create x-given: escalation_policy: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"name\": \"{{ unique }}\",\n \"resolve_page_on_policy_end\": true,\n \"retries\": 2,\n \"steps\": [\n {\n \"assignment\": \"default\",\n \"escalate_after_seconds\": 3600,\n \"targets\": [\n {\n \"id\": \"{{ dd_team.data.id }}\",\n \"type\": \"teams\"\n },\n {\n \"id\": \"{{ schedule.data.id }}\",\n \"type\": \"schedules\"\n },\n {\n \"id\": \"{{ user.data.id }}\",\n \"type\": \"users\"\n }\n ]\n },\n {\n \"assignment\": \"round-robin\",\n \"escalate_after_seconds\": 3600,\n \"targets\": [\n {\n \"id\": \"{{ dd_team.data.id }}\",\n \"type\": \"teams\"\n }\n ]\n }\n ]\n },\n \"relationships\": {\n \"teams\": {\n \"data\": [\n {\n \"id\": \"{{ dd_team.data.id }}\",\n \"type\": \"teams\"\n }\n ]\n }\n },\n \"type\": \"policies\"\n }\n}" step: there is a valid "escalation_policy" in the system x-menu-order: 5 x-permission: operator: AND permissions: - on_call_write x-undo: operationId: DeleteOnCallEscalationPolicy parameters: - name: policy_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/on-call/pages: post: description: 'Trigger a new On-Call Page. ' operationId: CreateOnCallPage requestBody: content: application/json: schema: $ref: '#/components/schemas/CreatePageRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/CreatePageResponse' description: OK. '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] servers: - url: https://{site} variables: site: default: navy.oncall.datadoghq.com description: The globally available endpoint for On-Call. enum: - saffron.oncall.datadoghq.com - navy.oncall.datadoghq.com - coral.oncall.datadoghq.com - teal.oncall.datadoghq.com - beige.oncall.datadoghq.eu - url: '{protocol}://{name}' variables: name: default: api.datadoghq.com description: Full site DNS name. protocol: default: https description: The protocol for accessing the API. - url: https://{subdomain}.{site} variables: site: default: datadoghq.com description: Any Datadog deployment. subdomain: default: api description: The subdomain where the API is deployed. summary: Datadog Create On-call Page tags: - Create x-menu-order: 1 x-undo: parameters: [] type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/on-call/schedules: post: description: Create a new On-Call schedule operationId: CreateOnCallSchedule parameters: - description: 'Comma-separated list of included relationships to be returned. Allowed values: `teams`, `layers`, `layers.members`, `layers.members.user`.' in: query name: include schema: type: string example: example_value requestBody: content: application/json: schema: $ref: '#/components/schemas/ScheduleCreateRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/Schedule' description: Created '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: [] summary: Datadog Create On-call Schedule tags: - Create x-given: schedule: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"layers\": [\n {\n \"effective_date\": \"{{ timeISO('now - 10d') }}\",\n \"end_date\": \"{{ timeISO('now + 10d') }}\",\n \"interval\": {\n \"days\": 1\n },\n \"members\": [\n {\n \"user\": {\n \"id\": \"{{ user.data.id }}\"\n }\n }\n ],\n \"name\": \"Layer 1\",\n \"restrictions\": [\n {\n \"end_day\": \"friday\",\n \"end_time\": \"17:00:00\",\n \"start_day\": \"monday\",\n \"start_time\": \"09:00:00\"\n }\n ],\n \"rotation_start\": \"{{ timeISO('now - 5d') }}\"\n }\n ],\n \"name\": \"{{ unique }}\",\n \"time_zone\": \"America/New_York\"\n },\n \"relationships\": {\n \"teams\": {\n \"data\": [\n {\n \"id\": \"65aea9d0-941c-4607-bf8a-14fc0dac2820\",\n \"type\": \"teams\"\n }\n ]\n }\n },\n \"type\": \"schedules\"\n }\n}" step: there is a valid "schedule" in the system x-menu-order: 1 x-permission: operator: AND permissions: - on_call_write x-undo: operationId: DeleteOnCallSchedule parameters: - name: schedule_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/powerpacks: post: description: Create a powerpack. operationId: CreatePowerpack requestBody: content: application/json: schema: $ref: '#/components/schemas/Powerpack' description: Create a powerpack request body. required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/PowerpackResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - dashboards_write summary: Datadog Create a New Powerpack tags: - Create x-codegen-request-body-name: body x-given: powerpack: parameters: - file: powerpack_payload.json name: body step: there is a valid "powerpack" in the system x-menu-order: 2 x-permission: operator: OR permissions: - dashboards_write x-undo: operationId: DeletePowerpack parameters: - name: powerpack_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/remote_config/products/asm/waf/custom_rules: post: description: Create a new WAF custom rule with the given parameters. operationId: CreateApplicationSecurityWafCustomRule requestBody: content: application/json: schema: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCreateRequest' description: The definition of the new WAF Custom Rule. required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleResponse' description: Created '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '409': $ref: '#/components/responses/ConcurrentModificationResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a Waf Custom Rule tags: - Create x-codegen-request-body-name: body x-given: custom_rule: parameters: - name: body value: "{\n \"data\": {\n \"type\": \"custom_rule\",\n \"attributes\": {\n \"blocking\": false,\n \"conditions\": [\n {\n \"operator\": \"match_regex\",\n \"parameters\": {\n \"inputs\": [\n {\n \"address\": \"server.request.query\",\n \"key_path\": [\n \"id\"\n ]\n }\n ],\n \"regex\": \"badactor\"\n }\n }\n ],\n \"enabled\": true,\n \"name\": \"test\",\n \"path_glob\": \"/test\",\n \"scope\": [\n {\n \"env\": \"test\",\n \"service\": \"test\"\n }\n ],\n \"tags\": {\n \"category\": \"attack_attempt\",\n \"type\": \"test\"\n }\n }\n }\n}" step: there is a valid "custom_rule" in the system x-menu-order: 12 x-undo: operationId: DeleteApplicationSecurityWafCustomRule parameters: - name: custom_rule_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/remote_config/products/asm/waf/exclusion_filters: post: description: 'Create a new WAF exclusion filter with the given parameters. A request matched by an exclusion filter will be ignored by the Application Security WAF product. Go to https://app.datadoghq.com/security/appsec/passlist to review existing exclusion filters (also called passlist entries).' operationId: CreateApplicationSecurityWafExclusionFilter requestBody: content: application/json: schema: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterCreateRequest' description: The definition of the new WAF exclusion filter. required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '409': $ref: '#/components/responses/ConcurrentModificationResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a Waf Exclusion Filter tags: - Create x-codegen-request-body-name: body x-given: exclusion_filter: parameters: - name: body value: "{\n \"data\": {\n \"type\": \"exclusion_filter\",\n \"attributes\": {\n \"description\": \"My Exclusion Filter\",\n \"enabled\": true,\n \"path_glob\": \"*\",\n \"parameters\": [\n \"list.search.query\"\n ],\n \"rules_target\": [\n {\n \"tags\": {\n \"category\":\"attack_attempt\",\n \"type\":\"xss\"\n }\n }\n ],\n \"scope\": [\n {\n \"env\": \"staging\",\n \"service\": \"event-query\"\n }\n ]\n }\n }\n}" step: there is a valid "exclusion_filter" in the system x-menu-order: 2 x-permission: operator: AND permissions: - appsec_protect_write x-terraform-resource: appsec_waf_exclusion_filter x-undo: operationId: DeleteApplicationSecurityWafExclusionFilter parameters: - name: exclusion_filter_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/remote_config/products/cws/agent_rules: post: description: 'Create a new Workload Protection agent rule with the given parameters. **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.' operationId: CreateCSMThreatsAgentRule requestBody: content: application/json: schema: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleCreateRequest' description: The definition of the new agent rule required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a Workload Protection Agent Rule tags: - Create x-codegen-request-body-name: body x-given: agent_rule: parameters: - name: body value: "{\n \"data\": {\n \"type\": \"agent_rule\",\n \"attributes\": {\n \"name\": \"{{ unique_lower_alnum }}\",\n \"description\": \"My Agent rule\",\n \"expression\": \"exec.file.name == \\\"sh\\\"\",\n \"enabled\": true,\n \"product_tags\": [\"security:attack\", \"technique:T1059\"],\n \"actions\": [{\"set\": {\"name\": \"test_set\", \"value\": \"test_value\", \"scope\": \"process\"}}],\n \"policy_id\": \"{{ policy.data.id }}\"\n }\n }\n}" step: there is a valid "agent_rule_rc" in the system x-menu-order: 3 x-undo: operationId: DeleteCSMThreatsAgentRule parameters: - name: agent_rule_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/remote_config/products/cws/policy: post: description: 'Create a new Workload Protection policy with the given parameters. **Note**: This endpoint is not available for the Government (US1-FED) site. Please reference the (US1-FED) specific resource below.' operationId: CreateCSMThreatsAgentPolicy requestBody: content: application/json: schema: $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyCreateRequest' description: The definition of the new Agent policy required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a Workload Protection Policy tags: - Create x-codegen-request-body-name: body x-given: policy: parameters: - name: body value: "{\n \"data\": {\n \"type\": \"policy\",\n \"attributes\": {\n \"name\": \"{{ unique_lower_alnum }}\",\n \"description\": \"My agent policy\",\n \"hostTags\": [\"env:staging\"],\n \"enabled\": true\n }\n }\n}" step: there is a valid "policy_rc" in the system x-menu-order: 8 x-undo: operationId: DeleteCSMThreatsAgentPolicy parameters: - name: policy_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/remote_config/products/obs_pipelines/pipelines: post: description: Create a new pipeline. operationId: CreatePipeline requestBody: content: application/json: schema: $ref: '#/components/schemas/ObservabilityPipelineSpec' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/ObservabilityPipeline' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a New Pipeline tags: - Create x-given: pipeline: parameters: - name: body value: "{\n \"data\":{\n \"attributes\":{\n \"config\":{\n \"destinations\":[\n {\n \"id\":\"datadog-logs-destination\",\n \"inputs\":[\n \"filter-processor\"\n ],\n \"type\":\"datadog_logs\"\n }\n ],\n \"processors\":[\n {\n \"id\":\"filter-processor\",\n \"include\":\"service:my-service\",\n \"inputs\":[\n \"datadog-agent-source\"\n ],\n \"type\":\"filter\"\n }\n ],\n \"sources\":[\n {\n \"id\":\"datadog-agent-source\",\n \"type\":\"datadog_agent\"\n }\n ]\n },\n \"name\":\"Main Observability Pipeline\"\n },\n \"type\":\"pipelines\"\n }\n}" step: there is a valid "pipeline" in the system x-menu-order: 1 x-permission: operator: OR permissions: - observability_pipelines_deploy x-undo: operationId: DeletePipeline parameters: - name: pipeline_id source: data.id type: unsafe x-unstable: '**Note**: This endpoint is in Preview.' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/roles: post: description: Create a new role for your organization. operationId: CreateRole requestBody: content: application/json: schema: $ref: '#/components/schemas/RoleCreateRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/RoleCreateResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication error '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_manage summary: Datadog Create Role tags: - Create x-codegen-request-body-name: body x-given: role: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"name\": \"{{ unique }}\"\n },\n \"type\": \"roles\"\n }\n}" step: there is a valid "role" in the system x-menu-order: 2 x-permission: operator: OR permissions: - user_access_manage x-undo: operationId: DeleteRole parameters: - name: role_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/roles/{role_id}/clone: x-merge-override: post: true post: description: Clone an existing role operationId: CloneRole parameters: - $ref: '#/components/parameters/RoleID' requestBody: content: application/json: schema: $ref: '#/components/schemas/RoleCloneRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/RoleResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication error '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not found '409': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Conflict '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_manage summary: Datadog Create a New Role by Cloning an Existing Role tags: - Create x-codegen-request-body-name: body x-menu-order: 12 x-permission: operator: OR permissions: - user_access_manage x-undo: operationId: DeleteRole parameters: - name: role_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/rum/applications: x-merge-override: get: false post: false post: description: Create a new RUM application in your organization. operationId: CreateRUMApplication requestBody: content: application/json: schema: $ref: '#/components/schemas/RUMApplicationCreateRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/RUMApplicationResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a New Rum Application tags: - Create x-codegen-request-body-name: body x-given: rum_application: parameters: - name: body value: "{ \"data\": {\n \"type\": \"rum_application_create\",\n \"attributes\": {\n \"name\": \"test-rum-{{ unique_hash }}\",\n \"type\": \"ios\"\n }\n }\n}" step: there is a valid "rum_application" in the system x-menu-order: 7 x-permission: operator: OR permissions: - rum_apps_write x-undo: operationId: DeleteRUMApplication parameters: - name: id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/rum/applications/{app_id}/retention_filters: post: description: 'Create a RUM retention filter for a RUM application. Returns RUM retention filter objects from the request body when the request is successful.' operationId: CreateRetentionFilter parameters: - $ref: '#/components/parameters/RumApplicationIDParameter' requestBody: content: application/json: schema: $ref: '#/components/schemas/RumRetentionFilterCreateRequest' description: The definition of the new RUM retention filter. required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/RumRetentionFilterResponse' description: Created '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a Rum Retention Filter tags: - Create x-codegen-request-body-name: body x-menu-order: 3 x-undo: type: safe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/rum/config/metrics: post: description: 'Create a metric based on your organization''s RUM data. Returns the rum-based metric object from the request body when the request is successful.' operationId: CreateRumMetric requestBody: content: application/json: schema: $ref: '#/components/schemas/RumMetricCreateRequest' description: The definition of the new rum-based metric. required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/RumMetricResponse' description: Created '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a Rum-based Metric tags: - Create x-codegen-request-body-name: body x-given: rum_metric: parameters: - name: body value: "{\n \"data\": {\n \"id\": \"{{ unique_lower_alnum }}\",\n \"type\": \"rum_metrics\",\n \"attributes\": {\n \"event_type\": \"session\",\n \"compute\": {\n \"aggregation_type\": \"distribution\",\n \"include_percentiles\": true,\n \"path\": \"@duration\"\n },\n \"filter\": {\n \"query\": \"source:{{ unique }}\"\n },\n \"group_by\": [{\n \"path\": \"@browser.name\",\n \"tag_name\": \"browser_name\"\n }],\n \"uniqueness\": {\n \"when\": \"match\"\n }\n }\n }\n}" step: there is a valid "rum_metric" in the system x-menu-order: 2 x-undo: operationId: DeleteRumMetric parameters: - name: metric_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/scim/Groups: post: description: 'Create a new group. The group may contain members.' operationId: CreateSCIMGroup requestBody: content: application/json: examples: json-request-body: value: displayName: Group 1 externalId: group1 members: - $ref: https://app.datadoghq.com/api/scim/v2/Users/d34a5f93-5690-4d3f-a293-f2ad5c7a82a4 display: John Doe type: User value: d34a5f93-5690-4d3f-a293-f2ad5c7a82a4 - $ref: https://app.datadoghq.com/api/scim/v2/Users/429ebce5-8ed3-4da9-9f1e-662f2dbc2fe6 display: Jane Doe type: User value: 429ebce5-8ed3-4da9-9f1e-662f2dbc2fe6 schemas: - urn:ietf:params:scim:schemas:core:2.0:Group schema: $ref: '#/components/schemas/ExternalUserGroup' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/ExternalUserGroup' description: Created '400': $ref: '#/components/responses/BadRequestResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - bearerAuth: [] summary: Datadog Create Group tags: - Create x-menu-order: 8 x-permission: operator: AND permissions: - user_access_invite - user_access_manage x-undo: operationId: DeleteSCIMGroup parameters: - name: group_id source: type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/scim/Users: post: description: Create a new user. operationId: CreateSCIMUser requestBody: content: application/json: examples: json-request-body: value: active: true emails: - primary: true type: work value: john.doe@datadoghq.com name: formatted: John Doe schemas: - urn:ietf:params:scim:schemas:core:2.0:User title: Mr. userName: john.doe@datadoghq.com schema: $ref: '#/components/schemas/ExternalUser' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/ExternalUser' description: Created '400': $ref: '#/components/responses/BadRequestResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - bearerAuth: [] summary: Datadog Create User tags: - Create x-menu-order: 2 x-permission: operator: AND permissions: - user_access_invite - user_access_manage x-undo: operationId: DeleteSCIMUser parameters: - name: user_uuid source: type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/scorecard/outcomes/batch: post: description: Sets multiple service-rule outcomes in a single batched request. operationId: CreateScorecardOutcomesBatch requestBody: content: application/json: schema: $ref: '#/components/schemas/OutcomesBatchRequest' description: Set of scorecard outcomes. required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/OutcomesBatchResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_write summary: Datadog Create Outcomes Batch tags: - Create x-codegen-request-body-name: body x-menu-order: 1 x-undo: type: idempotent x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/scorecard/rules: post: description: Creates a new rule. operationId: CreateScorecardRule requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateRuleRequest' description: Rule attributes. required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/CreateRuleResponse' description: Created '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_write summary: Datadog Create a New Rule tags: - Create x-codegen-request-body-name: body x-given: create_scorecard_rule: parameters: - name: body value: "{\n \"data\": {\n \"type\": \"rule\",\n \"attributes\": {\n \"name\": \"{{ unique }}\",\n \"enabled\": true,\n \"owner\": \"Datadog\",\n \"scorecard_name\": \"OpenAPI Spec Test Best Practices\"\n }\n }\n}" step: there is a valid "create_scorecard_rule" in the system x-menu-order: 1 x-undo: operationId: DeleteScorecardRule parameters: - name: rule_id source: data.id type: unsafe x-unstable: '**Note**: This endpoint is in public beta. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security/signals/notification_rules: post: description: Create a new notification rule for security signals and return the created rule. operationId: CreateSignalNotificationRule requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateNotificationRuleParameters' description: 'The body of the create notification rule request is composed of the rule type and the rule attributes: the rule name, the selectors, the notification targets, and the rule enabled status. ' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/NotificationRuleResponse' description: Successfully created the notification rule. '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_notification_profiles_write summary: Datadog Create a New Signal-based Notification Rule tags: - Create x-codegen-request-body-name: body x-given: valid_signal_notification_rule: parameters: - name: body value: "{\n \"data\": {\n \"type\": \"notification_rules\",\n \"attributes\": {\n \"name\": \"{{ unique }}\",\n \"selectors\": {\n \"rule_types\": [\"signal_correlation\"],\n \"trigger_source\": \"security_signals\",\n \"severities\": [\"critical\"],\n \"query\": \"env:test\"\n },\n \"targets\": [\"@email@email.com\"],\n \"enabled\": true\n }\n }\n}" step: there is a valid "valid_signal_notification_rule" in the system x-menu-order: 16 x-permission: operator: OR permissions: - security_monitoring_notification_profiles_write x-undo: operationId: DeleteSignalNotificationRule parameters: - name: id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security/vulnerabilities/notification_rules: post: description: Create a new notification rule for security vulnerabilities and return the created rule. operationId: CreateVulnerabilityNotificationRule requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateNotificationRuleParameters' description: 'The body of the create notification rule request is composed of the rule type and the rule attributes: the rule name, the selectors, the notification targets, and the rule enabled status. ' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/NotificationRuleResponse' description: Successfully created the notification rule. '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_notification_profiles_write summary: Datadog Create a New Vulnerability-based Notification Rule tags: - Create x-codegen-request-body-name: body x-given: valid_vulnerability_notification_rule: parameters: - name: body value: "{\n \"data\": {\n \"type\": \"notification_rules\",\n \"attributes\": {\n \"name\": \"{{ unique }}\",\n \"selectors\": {\n \"rule_types\": [\"misconfiguration\", \"attack_path\"],\n \"trigger_source\": \"security_findings\",\n \"severities\": [\"critical\"],\n \"query\": \"env:test\"\n },\n \"time_aggregation\": 86400,\n \"targets\": [\"@email@email.com\"],\n \"enabled\": true\n }\n }\n}" step: there is a valid "valid_vulnerability_notification_rule" in the system x-menu-order: 16 x-permission: operator: OR permissions: - security_monitoring_notification_profiles_write x-undo: operationId: DeleteVulnerabilityNotificationRule parameters: - name: id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security_monitoring/cloud_workload_security/agent_rules: post: description: 'Create a new agent rule with the given parameters. **Note**: This endpoint should only be used for the Government (US1-FED) site.' operationId: CreateCloudWorkloadSecurityAgentRule requestBody: content: application/json: schema: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleCreateRequest' description: The definition of the new agent rule required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a Workload Protection Agent Rule (us1-fed) tags: - Create x-codegen-request-body-name: body x-given: agent_rule: parameters: - name: body value: "{\n \"data\": {\n \"type\": \"agent_rule\",\n \"attributes\": {\n \"name\": \"{{ unique_lower_alnum }}\",\n \"description\": \"My Agent rule\",\n \"expression\": \"exec.file.name == \\\"sh\\\"\",\n \"enabled\": true\n }\n }\n}" step: there is a valid "agent_rule" in the system x-menu-order: 14 x-permission: operator: OR permissions: - security_monitoring_cws_agent_rules_write x-undo: operationId: DeleteCloudWorkloadSecurityAgentRule parameters: - name: agent_rule_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security_monitoring/configuration/security_filters: post: description: 'Create a security filter. See the [security filter guide](https://docs.datadoghq.com/security_platform/guide/how-to-setup-security-filters-using-security-monitoring-api/) for more examples.' operationId: CreateSecurityFilter requestBody: content: application/json: schema: $ref: '#/components/schemas/SecurityFilterCreateRequest' description: The definition of the new security filter. required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/SecurityFilterResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_filters_write summary: Datadog Create a Security Filter tags: - Create x-codegen-request-body-name: body x-given: security_filter: parameters: - name: body value: "{\n \"data\": {\n \"type\": \"security_filters\",\n \"attributes\": {\n \"name\": \"{{ unique }}\",\n \"query\": \"service:{{ unique_alnum }}\",\n \"exclusion_filters\":[\n {\n \"name\": \"Exclude logs from staging\",\n \"query\": \"source:staging\"\n }\n ],\n \"filtered_data_type\":\"logs\",\n \"is_enabled\": true\n }\n }\n}" step: there is a valid "security_filter" in the system x-menu-order: 17 x-permission: operator: OR permissions: - security_monitoring_filters_write x-undo: operationId: DeleteSecurityFilter parameters: - name: security_filter_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security_monitoring/configuration/suppressions: post: description: Create a new suppression rule. operationId: CreateSecurityMonitoringSuppression requestBody: content: application/json: schema: $ref: '#/components/schemas/SecurityMonitoringSuppressionCreateRequest' description: The definition of the new suppression rule. required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/SecurityMonitoringSuppressionResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_suppressions_write summary: Datadog Create a Suppression Rule tags: - Create x-codegen-request-body-name: body x-given: suppression: parameters: - name: body value: "{\n \"data\": {\n \"type\": \"suppressions\",\n \"attributes\": {\n \"enabled\": true,\n \"name\": \"{{ unique }}\",\n \"description\": \"{{ unique }}\",\n \"rule_query\": \"source:cloudtrail\",\n \"suppression_query\": \"env:test\"\n }\n }\n}" step: there is a valid "suppression" in the system x-menu-order: 0 x-undo: operationId: DeleteSecurityMonitoringSuppression parameters: - name: suppression_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/security_monitoring/rules: post: description: Create a detection rule. operationId: CreateSecurityMonitoringRule requestBody: content: application/json: schema: $ref: '#/components/schemas/SecurityMonitoringRuleCreatePayload' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/SecurityMonitoringRuleResponse' description: OK '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/NotAuthorizedResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - security_monitoring_rules_write summary: Datadog Create a Detection Rule tags: - Create x-codegen-request-body-name: body x-given: cloud_configuration_rule: parameters: - name: body value: "{\n \"name\": \"{{ unique }}_cloud\",\n \"tags\": [\"a:tag\"],\n \"type\": \"cloud_configuration\",\n \"isEnabled\": false,\n \"message\": \"Cloud configuration rule\",\n \"options\": {\n \"complianceRuleOptions\": {\n \"resourceType\": \"gcp_compute_disk\",\n \"regoRule\": {\n \"policy\": \"package datadog\\n\\nimport data.datadog.output as dd_output\\n\\nimport future.keywords.contains\\nimport future.keywords.if\\nimport future.keywords.in\\n\\nmilliseconds_in_a_day := ((1000 * 60) * 60) * 24\\n\\neval(iam_service_account_key) = \\\"skip\\\" if {\\n\\tiam_service_account_key.disabled\\n} else = \\\"pass\\\" if {\\n\\t(iam_service_account_key.resource_seen_at / milliseconds_in_a_day) - (iam_service_account_key.valid_after_time / milliseconds_in_a_day) <= 90\\n} else = \\\"fail\\\"\\n\\n# This part remains unchanged for all rules\\nresults contains result if {\\n\\tsome resource in input.resources[input.main_resource_type]\\n\\tresult := dd_output.format(resource, eval(resource))\\n}\\n\",\n \"resourceTypes\": [\n \"gcp_compute_disk\"\n ]\n },\n \"complexRule\": false\n }\n },\n \"complianceSignalOptions\": {\n \"userActivationStatus\": true,\n \"userGroupByFields\": [\"@account_id\"]\n },\n \"cases\": [\n {\n \"status\": \"info\",\n \"notifications\": [\"channel\"]\n }\n ]\n}" step: there is a valid "cloud_configuration_rule" in the system security_rule: parameters: - name: body value: "{\n \"name\": \"{{ unique }}\",\n \"queries\": [{\n \"query\": \"@test:true\",\n \"aggregation\": \"count\",\n \"groupByFields\": [],\n \"distinctFields\": [],\n \"metrics\": []\n }],\n \"filters\": [],\n \"cases\": [{\n \"name\": \"\",\n \"status\": \"info\",\n \"condition\": \"a > 0\",\n \"notifications\": []\n }],\n \"options\": {\n \"evaluationWindow\": 900,\n \"keepAlive\": 3600,\n \"maxSignalDuration\": 86400\n },\n \"message\": \"Test rule\",\n \"tags\": [],\n \"isEnabled\": true,\n \"type\": \"log_detection\"\n}" step: there is a valid "security_rule" in the system security_rule_bis: parameters: - name: body value: "{\n \"name\": \"{{ unique }}_bis\",\n \"queries\": [{\n \"query\": \"@test:false\",\n \"aggregation\": \"count\",\n \"groupByFields\": [],\n \"distinctFields\": [],\n \"metrics\": []\n }],\n \"filters\": [],\n \"cases\": [{\n \"name\": \"\",\n \"status\": \"info\",\n \"condition\": \"a > 0\",\n \"notifications\": []\n }],\n \"options\": {\n \"evaluationWindow\": 900,\n \"keepAlive\": 3600,\n \"maxSignalDuration\": 86400\n },\n \"message\": \"Test rule Bis\",\n \"tags\": [],\n \"isEnabled\": true,\n \"type\": \"log_detection\"\n}" step: there is a valid "security_rule_bis" in the system x-menu-order: 4 x-permission: operator: OR permissions: - security_monitoring_rules_write x-undo: operationId: DeleteSecurityMonitoringRule parameters: - name: rule_id source: id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/sensitive-data-scanner/config/groups: post: description: 'Create a scanning group. The request MAY include a configuration relationship. A rules relationship can be omitted entirely, but if it is included it MUST be null or an empty array (rules cannot be created at the same time). The new group will be ordered last within the configuration.' operationId: CreateScanningGroup requestBody: content: application/json: schema: $ref: '#/components/schemas/SensitiveDataScannerGroupCreateRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/SensitiveDataScannerCreateGroupResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication Error '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create Scanning Group tags: - Create x-codegen-request-body-name: body x-given: group: parameters: - name: body value: "{\n \"data\": {\n \"type\": \"sensitive_data_scanner_group\",\n \"attributes\": {\n \"name\": \"my-test-group\",\n \"is_enabled\": false,\n \"product_list\": [\n \"logs\"\n ],\n \"filter\": {\n \"query\": \"*\"\n }\n },\n \"relationships\": {\n \"configuration\": {\n \"data\": {\n \"id\": \"{{ configuration.data.id }}\",\n \"type\": \"{{ configuration.data.type }}\"\n }\n },\n \"rules\": {\n \"data\": []\n }\n }\n },\n \"meta\": {}\n}" step: there is a valid "scanning_group" in the system x-menu-order: 4 x-permission: operator: OR permissions: - data_scanner_write x-undo: operationId: DeleteScanningGroup parameters: - name: group_id source: data.id - name: body template: "{\n \"meta\": {}\n}" type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/sensitive-data-scanner/config/rules: post: description: 'Create a scanning rule in a sensitive data scanner group, ordered last. The posted rule MUST include a group relationship. It MUST include either a standard_pattern relationship or a regex attribute, but not both. If included_attributes is empty or missing, we will scan all attributes except excluded_attributes. If both are missing, we will scan the whole event.' operationId: CreateScanningRule requestBody: content: application/json: schema: $ref: '#/components/schemas/SensitiveDataScannerRuleCreateRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/SensitiveDataScannerCreateRuleResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication Error '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create Scanning Rule tags: - Create x-codegen-request-body-name: body x-given: rule: parameters: - name: body value: "{\n \"data\": {\n \"type\": \"sensitive_data_scanner_rule\",\n \"attributes\": {\n \"name\": \"{{ unique }}\",\n \"pattern\": \"pattern\",\n \"namespaces\": [\"admin.email\"],\n \"text_replacement\": {\n \"type\": \"none\"\n },\n \"tags\":[\n \"sensitive_data:true\"\n ],\n \"is_enabled\":true\n },\n \"relationships\": {\n \"group\": {\n \"data\": {\n \"id\": \"{{ group.data.id }}\",\n \"type\": \"{{ group.data.type }}\"\n }\n }\n }\n },\n \"meta\": {}\n}" step: the "scanning_group" has a "scanning_rule" x-menu-order: 7 x-permission: operator: OR permissions: - data_scanner_write x-undo: operationId: DeleteScanningRule parameters: - name: rule_id source: data.id - name: body template: "{\n \"meta\": {}\n}" type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/service_accounts: post: description: Create a service account for your organization. operationId: CreateServiceAccount requestBody: content: application/json: schema: $ref: '#/components/schemas/ServiceAccountCreateRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/UserResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication error '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create a Service Account tags: - Create x-codegen-request-body-name: body x-given: service_account_user: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"email\": \"{{ unique }}@datadoghq.com\",\n \"title\": \"user title\",\n \"service_account\": true\n },\n \"type\": \"users\"\n }\n}" step: there is a valid "service_account_user" in the system x-menu-order: 1 x-permission: operator: OR permissions: - service_account_write x-undo: operationId: DisableUser parameters: - name: user_id source: data.id tag: Users type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/service_accounts/{service_account_id}/application_keys: x-merge-override: get: false post: description: Create an application key for this service account. operationId: CreateServiceAccountApplicationKey parameters: - $ref: '#/components/parameters/ServiceAccountID' requestBody: content: application/json: schema: $ref: '#/components/schemas/ApplicationKeyCreateRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/ApplicationKeyResponse' description: Created '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' summary: Datadog Create an Application Key for This Service Account tags: - Create x-codegen-request-body-name: body x-given: service_account_application_key: parameters: - name: service_account_id value: '"{{ service_account_user.data.id }}"' - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"name\": \"{{ unique }}\"\n },\n \"type\": \"application_keys\"\n }\n}" step: there is a valid "service_account_application_key" for "service_account_user" x-menu-order: 5 x-permission: operator: OR permissions: - service_account_write x-undo: operationId: DeleteServiceAccountApplicationKey parameters: - name: app_key_id source: data.id - name: service_account_id source: data.relationships.owned_by.data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/services: post: deprecated: true description: Creates a new incident service. operationId: CreateIncidentService requestBody: content: application/json: schema: $ref: '#/components/schemas/IncidentServiceCreateRequest' description: Incident Service Payload. required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/IncidentServiceResponse' description: CREATED '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Datadog Create a New Incident Service tags: - Create x-codegen-request-body-name: body x-given: service: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"name\": \"{{ unique }}\"\n },\n \"type\": \"services\"\n }\n}" step: there is a valid "service" in the system x-menu-order: 5 x-permission: operator: OR permissions: - incident_settings_write x-undo: operationId: DeleteIncidentService parameters: - name: service_id source: data.id type: unsafe x-unstable: '**Note**: This endpoint is deprecated.' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/services/definitions: post: description: Create or update service definition in the Datadog Service Catalog. operationId: CreateOrUpdateServiceDefinitions requestBody: content: application/json: schema: $ref: '#/components/schemas/ServiceDefinitionsCreateRequest' description: Service Definition YAML/JSON. required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/ServiceDefinitionCreateResponse' description: CREATED '400': $ref: '#/components/responses/BadRequestResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '409': $ref: '#/components/responses/ConflictResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - apm_service_catalog_write summary: Datadog Create or Update Service Definition tags: - Create x-codegen-request-body-name: body x-given: service_definition: parameters: - name: body value: "{\n \"dd-service\": \"service-{{ unique_lower_alnum }}\",\n \"dd-team\": \"my-team\",\n \"docs\": [{\"name\": \"Architecture\",\n \"provider\": \"google drive\",\n \"url\": \"https://gdrive/mygivedoc\"}],\n \"extensions\": {\"frogextension\": \"extensionfrogvalue\"},\n \"integrations\": {\"opsgenie\": {\"region\": \"US\",\n \"service-url\": \"https://my-org.opsgenie.com/service/123e4567-e89b-12d3-a456-426614174000\"},\n \"pagerduty\": \"https://my-org.pagerduty.com/service-directory/PMyService\"},\n \"links\": [{\"name\": \"Runbook\", \"type\": \"runbook\", \"url\": \"https://my-runbook\"}],\n \"repos\": [{\"name\": \"Source Code\",\n \"provider\": \"GitHub\",\n \"url\": \"https://github.com/DataDog/given\"}],\n \"schema-version\": \"v2\",\n \"tags\": [\"this:tag\", \"service:tag\"],\n \"team\": \"super-team\"\n}" step: there is a valid "service_definition" in the system x-menu-order: 2 x-permission: operator: OR permissions: - apm_service_catalog_write x-undo: operationId: DeleteServiceDefinition parameters: - name: service_name source: data[0].attributes.schema.dd-service type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/slo/report: post: description: 'Create a job to generate an SLO report. The report job is processed asynchronously and eventually results in a CSV report being available for download. Check the status of the job and download the CSV report using the returned `report_id`.' operationId: CreateSLOReportJob requestBody: content: application/json: schema: $ref: '#/components/schemas/SloReportCreateRequest' description: Create SLO report job request body. required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/SLOReportPostResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - slos_read summary: Datadog Create a New Slo Report tags: - Create x-codegen-request-body-name: body x-given: report: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"query\": \"slo_type:metric \\\"SLO Reporting Test\\\"\",\n \"interval\": \"monthly\",\n \"from_ts\": {{ timestamp(\"now - 21d\") }},\n \"to_ts\": {{ timestamp(\"now\") }}\n }\n }\n}" step: there is a valid "report" in the system x-menu-order: 101 x-permission: operator: OR permissions: - slos_read x-undo: type: safe x-unstable: '**Note**: This feature is in private beta. To request access, use the request access form in the [Service Level Objectives](https://docs.datadoghq.com/service_management/service_level_objectives/#slo-csv-export) docs.' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/team: x-merge-override: get: false post: false post: description: 'Create a new team. User IDs passed through the `users` relationship field are added to the team.' operationId: CreateTeam requestBody: content: application/json: schema: $ref: '#/components/schemas/TeamCreateRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/TeamResponse' description: CREATED '403': $ref: '#/components/responses/ForbiddenResponse' '409': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: API error response. '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read - teams_manage summary: Datadog Create a Team tags: - Create x-codegen-request-body-name: body x-given: dd_team: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"handle\": \"test-handle-{{ unique_hash }}\",\n \"name\": \"test-name-{{ unique_hash }}\"\n },\n \"type\": \"team\"\n }\n}" step: there is a valid "dd_team" in the system x-menu-order: 2 x-permission: operator: AND permissions: - teams_read - teams_manage x-undo: operationId: DeleteTeam parameters: - name: team_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/team/{team_id}/links: post: description: Add a new link to a team. operationId: CreateTeamLink parameters: - description: None in: path name: team_id required: true schema: type: string example: abc-123-def requestBody: content: application/json: schema: $ref: '#/components/schemas/TeamLinkCreateRequest' required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/TeamLinkResponse' description: OK '403': $ref: '#/components/responses/ForbiddenResponse' '404': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: API error response. '422': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: API error response. '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - teams_read summary: Datadog Create a Team Link tags: - Create x-codegen-request-body-name: body x-given: team_link: parameters: - name: team_id source: dd_team.data.id - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"label\": \"{{unique}}\",\n \"url\": \"https://example.com\",\n \"position\": 0\n },\n \"type\": \"team_links\"\n }\n}" step: there is a valid "team_link" in the system x-menu-order: 11 x-permission: operator: OR permissions: - teams_read x-undo: operationId: DeleteTeamLink parameters: - name: team_id source: data.attributes.team_id - name: link_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/teams: post: deprecated: true description: Creates a new incident team. operationId: CreateIncidentTeam requestBody: content: application/json: schema: $ref: '#/components/schemas/IncidentTeamCreateRequest' description: Incident Team Payload. required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/IncidentTeamResponse' description: CREATED '400': $ref: '#/components/responses/BadRequestResponse' '401': $ref: '#/components/responses/UnauthorizedResponse' '403': $ref: '#/components/responses/ForbiddenResponse' '404': $ref: '#/components/responses/NotFoundResponse' '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - incident_settings_write summary: Datadog Create a New Incident Team tags: - Create x-codegen-request-body-name: body x-given: team: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"name\": \"{{ unique }}\"\n },\n \"type\": \"teams\"\n }\n}" step: there is a valid "team" in the system x-menu-order: 5 x-permission: operator: OR permissions: - incident_settings_write x-undo: operationId: DeleteIncidentTeam parameters: - name: team_id source: data.id type: unsafe x-unstable: '**Note**: This endpoint is deprecated. See the [Teams API endpoints](https://docs.datadoghq.com/api/latest/teams/).' x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/users: post: description: Create a user for your organization. operationId: CreateUser requestBody: content: application/json: schema: $ref: '#/components/schemas/UserCreateRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/UserResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request '403': content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Authentication error '429': $ref: '#/components/responses/TooManyRequestsResponse' security: - apiKeyAuth: [] appKeyAuth: [] - AuthZ: - user_access_invite summary: Datadog Create a User tags: - Create x-codegen-request-body-name: body x-given: user: parameters: - name: body value: "{\n \"data\": {\n \"attributes\": {\n \"email\": \"{{ unique }}@datadoghq.com\",\n \"title\": \"user title\"\n },\n \"type\": \"users\"\n }\n}" step: there is a valid "user" in the system x-menu-order: 2 x-permission: operator: OR permissions: - user_access_invite x-undo: operationId: DisableUser parameters: - name: user_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK /api/v2/workflows: post: description: Create a new workflow, returning the workflow ID. This API requires an application key scoped with the `workflows_write` permission. operationId: CreateWorkflow requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateWorkflowRequest' required: true responses: '201': content: application/json: schema: $ref: '#/components/schemas/CreateWorkflowResponse' description: Successfully created a workflow. '400': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Bad request '403': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Forbidden '429': content: application/json: schema: $ref: '#/components/schemas/JSONAPIErrorResponse' description: Too many requests summary: Datadog Create a Workflow tags: - Create x-given: workflow: parameters: - name: body value: "{\n \"data\": {\n \"type\": \"workflows\",\n \"attributes\": {\n \"name\": \"Cassette Workflow x-given\",\n \"spec\": {\n \"triggers\": [\n {\n \"startStepNames\": [\"No_op\"],\n \"workflowTrigger\": {}\n }\n ],\n \"steps\": [\n {\n \"name\": \"No_op\",\n \"actionId\": \"com.datadoghq.core.noop\"\n }\n ]\n }\n }\n }\n}" step: there is a valid "workflow" in the system x-menu-order: 2 x-permission: operator: OR permissions: - workflows_write x-undo: operationId: DeleteWorkflow parameters: - name: workflow_id source: data.id type: unsafe x-api-evangelist-processing: PascalCaseOperationSummaries: true ChooseTags: true x-microcks-operation: delay: 0 dispatcher: FALLBACK components: schemas: ServiceDefinitionV2: description: Service definition V2 for providing service metadata and integrations. properties: contacts: description: A list of contacts related to the services. items: $ref: '#/components/schemas/ServiceDefinitionV2Contact' type: array dd-service: description: Unique identifier of the service. Must be unique across all services and is used to match with a service in Datadog. example: my-service type: string dd-team: description: Experimental feature. A Team handle that matches a Team in the Datadog Teams product. example: my-team type: string docs: description: A list of documentation related to the services. items: $ref: '#/components/schemas/ServiceDefinitionV2Doc' type: array extensions: additionalProperties: {} description: Extensions to V2 schema. example: myorg/extension: extensionValue type: object integrations: $ref: '#/components/schemas/ServiceDefinitionV2Integrations' links: description: A list of links related to the services. items: $ref: '#/components/schemas/ServiceDefinitionV2Link' type: array repos: description: A list of code repositories related to the services. items: $ref: '#/components/schemas/ServiceDefinitionV2Repo' type: array schema-version: $ref: '#/components/schemas/ServiceDefinitionV2Version' tags: description: A set of custom tags. example: - my:tag - service:tag items: type: string type: array team: description: Team that owns the service. example: my-team type: string required: - schema-version - dd-service type: object ScheduleMemberRelationshipsUserDataType: default: users description: Users resource type. enum: - users example: users type: string x-enum-varnames: - USERS LogsArchiveDestinationAzure: description: The Azure archive destination. properties: container: description: The container where the archive will be stored. example: container-name type: string integration: $ref: '#/components/schemas/LogsArchiveIntegrationAzure' path: description: The archive path. type: string example: example_value region: description: The region where the archive will be stored. type: string example: example_value storage_account: description: The associated storage account. example: account-name type: string type: $ref: '#/components/schemas/LogsArchiveDestinationAzureType' required: - storage_account - container - integration - type type: object ActionQueryCondition: description: Whether to run this query. If specified, the query will only run if this condition evaluates to `true` in JavaScript and all other conditions are also met. oneOf: - type: boolean - example: ${true} type: string OrganizationAttributes: description: Attributes of the organization. properties: created_at: description: Creation time of the organization. format: date-time type: string example: example_value description: description: Description of the organization. type: string example: example_value disabled: description: Whether or not the organization is disabled. type: boolean example: true modified_at: description: Time of last organization modification. format: date-time type: string example: example_value name: description: Name of the organization. type: string example: Example Monitor public_id: description: Public ID of the organization. type: string example: abc-123-def sharing: description: Sharing type of the organization. type: string example: example_value url: description: URL of the site that this organization exists at. type: string example: https://app.datadoghq.com type: object ServiceDefinitionV2Dot1SlackType: description: Contact type. enum: - slack example: slack type: string x-enum-varnames: - SLACK ObservabilityPipelineSensitiveDataScannerProcessorActionHashAction: description: Action type that replaces the matched sensitive data with a hashed representation, preserving structure while securing content. enum: - hash example: hash type: string x-enum-varnames: - HASH RelationshipToRuleDataObject: description: Rule relationship data. properties: id: description: The unique ID for a scorecard. example: q8MQxk8TCqrHnWkp type: string type: $ref: '#/components/schemas/ScorecardType' type: object RelationshipToTeamLinks: description: Relationship between a team and a team link properties: data: description: Related team links items: $ref: '#/components/schemas/RelationshipToTeamLinkData' type: array links: $ref: '#/components/schemas/TeamRelationshipsLinks' type: object x-merge-override: required: false SpansMetricGroupBy: description: A group by rule. properties: path: description: The path to the value the span-based metric will be aggregated over. example: resource_name type: string tag_name: description: Eventual name of the tag that gets created. By default, the path attribute is used as the tag name. example: resource_name type: string required: - path type: object AccountFilteringConfig: description: The account filtering configuration. properties: excluded_accounts: description: The AWS account IDs to be excluded from your billing dataset. This field is used when `include_new_accounts` is `true`. example: - '123456789123' - '123456789143' items: type: string type: array include_new_accounts: description: Whether or not to automatically include new member accounts by default in your billing dataset. example: true type: boolean included_accounts: description: The AWS account IDs to be included in your billing dataset. This field is used when `include_new_accounts` is `false`. example: - '123456789123' - '123456789143' items: type: string type: array type: object EntityToOncalls: description: Entity to oncalls relationship. properties: data: $ref: '#/components/schemas/RelationshipArray' type: object IncidentTodoCreateData: description: Incident todo data for a create request. properties: attributes: $ref: '#/components/schemas/IncidentTodoAttributes' type: $ref: '#/components/schemas/IncidentTodoType' required: - type - attributes type: object ApplicationSecurityWafExclusionFilterCreateData: description: Object for creating a single WAF exclusion filter. properties: attributes: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterCreateAttributes' type: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterType' required: - attributes - type type: object Version: description: Version of the notification rule. It is updated when the rule is modified. example: 1 format: int64 type: integer GCPSTSDelegateAccountAttributes: description: Your delegate account attributes. properties: delegate_account_email: description: Your organization's Datadog principal email address. example: ddgci-1a19n28hb1a812221893@datadog-gci-sts-us5-prod.iam.gserviceaccount.com type: string type: object ServiceNowTicket: description: ServiceNow ticket attached to case nullable: true properties: result: $ref: '#/components/schemas/ServiceNowTicketResult' status: $ref: '#/components/schemas/Case3rdPartyTicketStatus' readOnly: true type: object TeamRelationships: description: Resources related to a team properties: team_links: $ref: '#/components/schemas/RelationshipToTeamLinks' user_team_permissions: $ref: '#/components/schemas/RelationshipToUserTeamPermission' type: object ObservabilityPipelineDedupeProcessorMode: description: The deduplication mode to apply to the fields. enum: - match - ignore example: match type: string x-enum-varnames: - MATCH - IGNORE CaseCreateRelationships: description: Relationships formed with the case on creation properties: assignee: $ref: '#/components/schemas/NullableUserRelationship' project: $ref: '#/components/schemas/ProjectRelationship' required: - project type: object OutcomesBatchResponseAttributes: description: The JSON:API attributes for an outcome. properties: created_at: description: Creation time of the rule outcome. format: date-time type: string example: example_value modified_at: description: Time of last rule outcome modification. format: date-time type: string example: example_value remarks: description: Any remarks regarding the scorecard rule's evaluation, and supports HTML hyperlinks. example: 'See: Services' type: string service_name: description: The unique name for a service in the catalog. example: my-service type: string state: $ref: '#/components/schemas/State' type: object EntityV3DatastoreDatadog: additionalProperties: false description: Datadog product integrations for the datastore entity. properties: events: $ref: '#/components/schemas/EntityV3DatadogEvents' logs: $ref: '#/components/schemas/EntityV3DatadogLogs' performanceData: $ref: '#/components/schemas/EntityV3DatadogPerformance' type: object x-ignore-duplicate-object: true AzureStorageDestinationType: default: azure_storage description: The destination type. The value should always be `azure_storage`. enum: - azure_storage example: azure_storage type: string x-enum-varnames: - AZURE_STORAGE CloudWorkloadSecurityAgentRuleUpdaterAttributes: description: The attributes of the user who last updated the Agent rule properties: handle: description: The handle of the user example: datadog.user@example.com type: string name: description: The name of the user example: Datadog User nullable: true type: string type: object ObservabilityPipelineMetadataEntry: description: A custom metadata entry. properties: name: description: The metadata key. example: environment type: string value: description: The metadata value. example: production type: string required: - name - value type: object PowerpackGroupWidgetDefinition: description: Powerpack group widget object. properties: layout_type: description: Layout type of widgets. example: ordered type: string show_title: description: Boolean indicating whether powerpack group title should be visible or not. example: true type: boolean title: description: Name for the group widget. example: Sample Powerpack type: string type: description: Type of widget, must be group. example: group type: string widgets: description: Widgets inside the powerpack. example: - definition: content: example type: note layout: height: 5 width: 10 x: 0 y: 0 items: $ref: '#/components/schemas/PowerpackInnerWidgets' type: array required: - widgets - layout_type - type type: object Permission: description: Permission object. properties: attributes: $ref: '#/components/schemas/PermissionAttributes' id: description: ID of the permission. type: string example: abc-123-def type: $ref: '#/components/schemas/PermissionsType' required: - type type: object CreateAppResponse: description: The response object after a new app is successfully created, with the app ID. properties: data: $ref: '#/components/schemas/CreateAppResponseData' type: object CustomDestinationHttpDestinationAuthCustomHeader: description: Custom header access authentication. properties: header_name: description: The header name of the authentication. example: CUSTOM-HEADER-NAME type: string header_value: description: The header value of the authentication. This field is not returned by the API. example: CUSTOM-HEADER-AUTHENTICATION-VALUE type: string writeOnly: true type: $ref: '#/components/schemas/CustomDestinationHttpDestinationAuthCustomHeaderType' required: - type - header_name - header_value type: object TeamReference: description: Provides a reference to a team, including ID, type, and basic attributes/relationships. properties: attributes: $ref: '#/components/schemas/TeamReferenceAttributes' id: description: The team's unique identifier. type: string example: abc-123-def type: $ref: '#/components/schemas/TeamReferenceType' required: - type type: object LogsArchiveIntegrationGCS: description: The GCS archive's integration destination. properties: client_email: description: A client email. example: youremail@example.com type: string project_id: description: A project ID. example: project-id type: string required: - client_email type: object GCPSTSServiceAccountAttributes: description: Attributes associated with your service account. properties: account_tags: description: Tags to be associated with GCP metrics and service checks from your account. items: description: Account Level Tag type: string type: array automute: description: Silence monitors for expected GCE instance shutdowns. type: boolean example: true client_email: description: Your service account email address. example: datadog-service-account@test-project.iam.gserviceaccount.com type: string cloud_run_revision_filters: description: 'List of filters to limit the Cloud Run revisions that are pulled into Datadog by using tags. Only Cloud Run revision resources that apply to specified filters are imported into Datadog.' example: - $KEY:$VALUE items: description: Cloud Run Filters type: string type: array host_filters: description: Your Host Filters. items: description: Host Filters type: string type: array is_cspm_enabled: description: 'When enabled, Datadog will activate the Cloud Security Monitoring product for this service account. Note: This requires resource_collection_enabled to be set to true.' type: boolean example: true is_per_project_quota_enabled: default: false description: When enabled, Datadog applies the `X-Goog-User-Project` header, attributing Google Cloud billing and quota usage to the project being monitored rather than the default service account project. example: true type: boolean is_resource_change_collection_enabled: default: false description: When enabled, Datadog scans for all resource change data in your Google Cloud environment. example: true type: boolean is_security_command_center_enabled: default: false description: 'When enabled, Datadog will attempt to collect Security Command Center Findings. Note: This requires additional permissions on the service account.' example: true type: boolean metric_namespace_configs: description: Configurations for GCP metric namespaces. example: - disabled: true id: aiplatform items: $ref: '#/components/schemas/GCPMetricNamespaceConfig' type: array resource_collection_enabled: description: When enabled, Datadog scans for all resources in your GCP environment. type: boolean example: true type: object x-merge-override: required: false ServiceDefinitionV2Dot2: description: Service definition v2.2 for providing service metadata and integrations. properties: application: description: Identifier for a group of related services serving a product feature, which the service is a part of. example: my-app type: string ci-pipeline-fingerprints: description: A set of CI fingerprints. example: - j88xdEy0J5lc - eZ7LMljCk8vo items: type: string type: array contacts: description: A list of contacts related to the services. items: $ref: '#/components/schemas/ServiceDefinitionV2Dot2Contact' type: array dd-service: description: Unique identifier of the service. Must be unique across all services and is used to match with a service in Datadog. example: my-service type: string description: description: A short description of the service. example: My service description type: string extensions: additionalProperties: {} description: Extensions to v2.2 schema. example: myorg/extension: extensionValue type: object integrations: $ref: '#/components/schemas/ServiceDefinitionV2Dot2Integrations' languages: description: 'The service''s programming language. Datadog recognizes the following languages: `dotnet`, `go`, `java`, `js`, `php`, `python`, `ruby`, and `c++`.' example: - dotnet - go - java - js - php - python - ruby - c++ items: type: string type: array lifecycle: description: The current life cycle phase of the service. example: sandbox type: string links: description: A list of links related to the services. items: $ref: '#/components/schemas/ServiceDefinitionV2Dot2Link' type: array schema-version: $ref: '#/components/schemas/ServiceDefinitionV2Dot2Version' tags: description: A set of custom tags. example: - my:tag - service:tag items: type: string type: array team: description: Team that owns the service. It is used to locate a team defined in Datadog Teams if it exists. example: my-team type: string tier: description: Importance of the service. example: High type: string type: $ref: '#/components/schemas/ServiceDefinitionV2Dot2Type' required: - schema-version - dd-service type: object AzureUCConfigPair: description: Azure config pair. properties: attributes: $ref: '#/components/schemas/AzureUCConfigPairAttributes' id: description: The ID of Cloud Cost Management account. format: int64 type: integer example: 42 type: $ref: '#/components/schemas/AzureUCConfigPairType' required: - attributes - type type: object x-merge-override: required: false ObservabilityPipelineSyslogNgDestinationType: default: syslog_ng description: The destination type. The value should always be `syslog_ng`. enum: - syslog_ng example: syslog_ng type: string x-enum-varnames: - SYSLOG_NG PowerpackAttributes: description: Powerpack attribute object. properties: description: description: Description of this powerpack. example: Powerpack for ABC type: string group_widget: $ref: '#/components/schemas/PowerpackGroupWidget' name: description: Name of the powerpack. example: Sample Powerpack type: string tags: description: List of tags to identify this powerpack. example: - tag:foo1 items: maxLength: 80 type: string maxItems: 8 type: array template_variables: description: List of template variables for this powerpack. example: - defaults: - '*' name: test items: $ref: '#/components/schemas/PowerpackTemplateVariable' type: array required: - group_widget - name type: object ObservabilityPipelineEnrichmentTableFileEncodingType: description: Specifies the encoding format (e.g., CSV) used for enrichment tables. enum: - csv example: csv type: string x-enum-varnames: - CSV AuthNMappingRelationships: description: All relationships associated with AuthN Mapping. properties: role: $ref: '#/components/schemas/RelationshipToRole' saml_assertion_attribute: $ref: '#/components/schemas/RelationshipToSAMLAssertionAttribute' team: $ref: '#/components/schemas/RelationshipToTeam' type: object ServiceDefinitionsCreateRequest: description: Create service definitions request. oneOf: - $ref: '#/components/schemas/ServiceDefinitionV2Dot2' - $ref: '#/components/schemas/ServiceDefinitionV2Dot1' - $ref: '#/components/schemas/ServiceDefinitionV2' - $ref: '#/components/schemas/ServiceDefinitionRaw' ObservabilityPipelineFluentdSourceType: default: fluentd description: The source type. The value should always be `fluentd. enum: - fluentd example: fluentd type: string x-enum-varnames: - FLUENTD TokenType: description: The definition of `TokenType` object. enum: - SECRET example: SECRET type: string x-enum-varnames: - SECRET ObservabilityPipelineOcsfMapperProcessorMappingMapping: description: Defines a single mapping rule for transforming logs into the OCSF schema. oneOf: - $ref: '#/components/schemas/ObservabilityPipelineOcsfMappingLibrary' IncidentTimelineCellCreateAttributes: description: The timeline cell's attributes for a create request. oneOf: - $ref: '#/components/schemas/IncidentTimelineCellMarkdownCreateAttributes' XRayServicesIncludeAll: description: Include all services. properties: include_all: description: Include all services. example: false type: boolean required: - include_all type: object RoleCreateAttributes: description: Attributes of the created role. properties: created_at: description: Creation time of the role. format: date-time readOnly: true type: string example: example_value modified_at: description: Time of last role modification. format: date-time readOnly: true type: string example: example_value name: description: Name of the role. example: developers type: string required: - name type: object MSTeamsIntegrationMetadataTeamsItem: description: Item in the Microsoft Teams integration metadata teams array. properties: ms_channel_id: description: Microsoft Teams channel ID. example: 19:abc00abcdef00a0abcdef0abcdef0a@thread.tacv2 type: string ms_channel_name: description: Microsoft Teams channel name. example: incident-0001-example type: string ms_tenant_id: description: Microsoft Teams tenant ID. example: 00000000-abcd-0005-0000-000000000000 type: string redirect_url: description: URL redirecting to the Microsoft Teams channel. example: https://teams.microsoft.com/l/channel/19%3Aabc00abcdef00a0abcdef0abcdef0a%40thread.tacv2/conversations?groupId=12345678-abcd-dcba-abcd-1234567890ab&tenantId=00000000-abcd-0005-0000-000000000000 type: string required: - ms_tenant_id - ms_channel_id - ms_channel_name - redirect_url type: object CreateAppRequest: description: A request object for creating a new app. example: data: attributes: components: - events: [] name: grid0 properties: children: - events: [] name: gridCell0 properties: children: - events: [] name: calloutValue0 properties: isDisabled: false isLoading: false isVisible: true label: CPU Usage size: sm style: vivid_yellow unit: kB value: '42' type: calloutValue isVisible: 'true' layout: default: height: 8 width: 2 x: 0 y: 0 type: gridCell type: grid description: This is a simple example app name: Example App queries: [] rootInstanceName: grid0 type: appDefinitions properties: data: $ref: '#/components/schemas/CreateAppRequestData' type: object State: description: The state of the rule evaluation. enum: - pass - fail - skip example: pass type: string x-enum-varnames: - PASS - FAIL - SKIP LogsArchiveEncryptionS3: description: The S3 encryption settings. properties: key: description: An Amazon Resource Name (ARN) used to identify an AWS KMS key. example: arn:aws:kms:us-east-1:012345678901:key/DatadogIntegrationRoleKms type: string type: $ref: '#/components/schemas/LogsArchiveEncryptionS3Type' required: - type type: object AWSNamespaceTagFilter: description: 'AWS Metrics Collection tag filters list. Defaults to `[]`. The array of custom AWS resource tags (in the form `key:value`) defines a filter that Datadog uses when collecting metrics from a specified service. Wildcards, such as `?` (match a single character) and `*` (match multiple characters), and exclusion using `!` before the tag are supported. For EC2, only hosts that match one of the defined tags will be imported into Datadog. The rest will be ignored. For example, `env:production,instance-type:c?.*,!region:us-east-1`.' properties: namespace: description: The AWS service for which the tag filters defined in `tags` will be applied. example: AWS/EC2 type: string tags: description: The AWS resource tags to filter on for the service specified by `namespace`. items: description: Tag in the form `key:value`. example: datadog:true type: string nullable: true type: array type: object ObservabilityPipelineGoogleCloudStorageDestinationType: default: google_cloud_storage description: The destination type. Always `google_cloud_storage`. enum: - google_cloud_storage example: google_cloud_storage type: string x-enum-varnames: - GOOGLE_CLOUD_STORAGE FrameworkHandleAndVersionResponseData: description: Contains type and attributes for custom frameworks. properties: attributes: $ref: '#/components/schemas/CustomFrameworkDataHandleAndVersion' id: description: The ID of the custom framework. example: handle-version type: string type: $ref: '#/components/schemas/CustomFrameworkType' required: - id - type - attributes type: object DataRelationshipsTeamsDataItems: description: Relates a team to this schedule, identified by `id` and `type` (must be `teams`). properties: id: description: The unique identifier of the team in this relationship. example: 00000000-da3a-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/DataRelationshipsTeamsDataItemsType' required: - type - id type: object MetricTagConfigurationCreateData: description: Object for a single metric to be configure tags on. example: attributes: include_percentiles: false metric_type: distribution tags: - app - datacenter id: http.endpoint.request type: manage_tags properties: attributes: $ref: '#/components/schemas/MetricTagConfigurationCreateAttributes' id: $ref: '#/components/schemas/MetricName' type: $ref: '#/components/schemas/MetricTagConfigurationType' required: - id - type type: object SensitiveDataScannerConfigurationData: description: A Sensitive Data Scanner configuration data. properties: data: $ref: '#/components/schemas/SensitiveDataScannerConfiguration' type: object ApplicationSecurityWafExclusionFilterScope: description: Deploy on services based on their environment and/or service name. properties: env: description: Deploy on this environment. example: www type: string service: description: Deploy on this service. example: prod type: string type: object AnnotationDisplayBounds: description: The definition of `AnnotationDisplayBounds` object. properties: height: description: The `bounds` `height`. format: double type: number example: 95.5 width: description: The `bounds` `width`. format: double type: number example: 95.5 x: description: The `bounds` `x`. format: double type: number example: 95.5 y: description: The `bounds` `y`. format: double type: number example: 95.5 type: object IncidentTodoAssigneeHandle: description: Assignee's @-handle. example: '@test.user@test.com' type: string BudgetWithEntriesData: description: A budget and all its entries. properties: attributes: $ref: '#/components/schemas/BudgetAttributes' id: description: The `BudgetWithEntriesData` `id`. example: 00000000-0a0a-0a0a-aaa0-00000000000a type: string type: description: The type of the object, must be `budget`. type: string example: metric alert type: object LogsArchiveState: description: The state of the archive. enum: - UNKNOWN - WORKING - FAILING - WORKING_AUTH_LEGACY example: WORKING type: string x-enum-varnames: - UNKNOWN - WORKING - FAILING - WORKING_AUTH_LEGACY ObservabilityPipelineQuotaProcessorLimitEnforceType: description: Unit for quota enforcement in bytes for data size or events for count. enum: - bytes - events example: bytes type: string x-enum-varnames: - BYTES - EVENTS SecurityMonitoringRuleNewValueOptionsLearningDuration: default: 0 description: 'The duration in days during which values are learned, and after which signals will be generated for values that weren''t learned. If set to 0, a signal will be generated for all new values after the first value is learned.' enum: - 0 - 1 - 7 format: int32 type: integer x-enum-varnames: - ZERO_DAYS - ONE_DAY - SEVEN_DAYS SlackTriggerWrapper: description: Schema for a Slack-based trigger. properties: slackTrigger: description: Trigger a workflow from Slack. The workflow must be published. type: object startStepNames: $ref: '#/components/schemas/StartStepNames' required: - slackTrigger type: object Selectors: description: 'Selectors are used to filter security issues for which notifications should be generated. Users can specify rule severities, rule types, a query to filter security issues on tags and attributes, and the trigger source. Only the trigger_source field is required.' properties: query: $ref: '#/components/schemas/NotificationRuleQuery' rule_types: $ref: '#/components/schemas/RuleTypes' severities: description: The security rules severities to consider. items: $ref: '#/components/schemas/RuleSeverity' type: array trigger_source: $ref: '#/components/schemas/TriggerSource' required: - trigger_source type: object ObservabilityPipelineRsyslogDestinationType: default: rsyslog description: The destination type. The value should always be `rsyslog`. enum: - rsyslog example: rsyslog type: string x-enum-varnames: - RSYSLOG RetentionFilterAttributes: description: The attributes of the retention filter. properties: created_at: description: The creation timestamp of the retention filter. format: int64 type: integer example: 42 created_by: description: The creator of the retention filter. type: string example: example_value editable: description: Shows whether the filter can be edited. example: true type: boolean enabled: description: The status of the retention filter (Enabled/Disabled). example: true type: boolean execution_order: description: The execution order of the retention filter. format: int64 type: integer example: 42 filter: $ref: '#/components/schemas/SpansFilter' filter_type: $ref: '#/components/schemas/RetentionFilterType' modified_at: description: The modification timestamp of the retention filter. format: int64 type: integer example: 42 modified_by: description: The modifier of the retention filter. type: string example: example_value name: description: The name of the retention filter. example: my retention filter type: string rate: description: 'Sample rate to apply to spans going through this retention filter. A value of 1.0 keeps all spans matching the query.' example: 1 format: double type: number trace_rate: description: 'Sample rate to apply to traces containing spans going through this retention filter. A value of 1.0 keeps all traces with spans matching the query.' example: 1 format: double type: number type: object MonitorNotificationRuleFilter: description: Filter used to associate the notification rule with monitors. oneOf: - $ref: '#/components/schemas/MonitorNotificationRuleFilterTags' ErrorHandler: description: Used to handle errors in an action. properties: fallbackStepName: description: The `ErrorHandler` `fallbackStepName`. example: '' type: string retryStrategy: $ref: '#/components/schemas/RetryStrategy' required: - retryStrategy - fallbackStepName type: object SloReportCreateRequestData: description: The data portion of the SLO report request. properties: attributes: $ref: '#/components/schemas/SloReportCreateRequestAttributes' required: - attributes type: object SpansMetricCompute: description: The compute rule to compute the span-based metric. properties: aggregation_type: $ref: '#/components/schemas/SpansMetricComputeAggregationType' include_percentiles: $ref: '#/components/schemas/SpansMetricComputeIncludePercentiles' path: description: The path to the value the span-based metric will aggregate on (only used if the aggregation type is a "distribution"). example: '@duration' type: string required: - aggregation_type type: object ApplicationSecurityWafCustomRuleCreateData: description: Object for a single WAF custom rule. properties: attributes: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCreateAttributes' type: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleType' required: - attributes - type type: object ObservabilityPipelineParseGrokProcessorType: default: parse_grok description: The processor type. The value should always be `parse_grok`. enum: - parse_grok example: parse_grok type: string x-enum-varnames: - PARSE_GROK TeamTarget: description: Represents a team target for an escalation policy step, including the team's ID and resource type. properties: id: description: Specifies the unique identifier of the team resource. example: 00000000-aba1-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/TeamTargetType' required: - type - id type: object ObservabilityPipelineAmazonOpenSearchDestinationType: default: amazon_opensearch description: The destination type. The value should always be `amazon_opensearch`. enum: - amazon_opensearch example: amazon_opensearch type: string x-enum-varnames: - AMAZON_OPENSEARCH SecurityMonitoringRuleCaseActionOptionsUserBehaviorName: description: Used with the case action of type 'user_behavior'. The value specified in this field is applied as a risk tag to all users affected by the rule. type: string RestrictionQueryAttributes: description: Attributes of the restriction query. properties: created_at: description: Creation time of the restriction query. example: '2020-03-17T21:06:44.000Z' format: date-time readOnly: true type: string modified_at: description: Time of last restriction query modification. example: '2020-03-17T21:15:15.000Z' format: date-time readOnly: true type: string restriction_query: description: The query that defines the restriction. Only the content matching the query can be returned. example: env:sandbox type: string type: object ObservabilityPipelineGeneratedMetric: description: 'Defines a log-based custom metric, including its name, type, filter, value computation strategy, and optional grouping fields. ' properties: group_by: description: Optional fields used to group the metric series. example: - service - env items: type: string type: array include: description: Datadog filter query to match logs for metric generation. example: service:billing type: string metric_type: $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricMetricType' name: description: Name of the custom metric to be created. example: logs.processed type: string value: $ref: '#/components/schemas/ObservabilityPipelineMetricValue' required: - name - include - metric_type - value type: object LogsMetricCreateAttributes: description: The object describing the Datadog log-based metric to create. properties: compute: $ref: '#/components/schemas/LogsMetricCompute' filter: $ref: '#/components/schemas/LogsMetricFilter' group_by: description: The rules for the group by. items: $ref: '#/components/schemas/LogsMetricGroupBy' type: array required: - compute type: object AWSRegionsIncludeAll: description: Include all regions. Defaults to `true`. properties: include_all: description: Include all regions. example: true type: boolean required: - include_all type: object ObservabilityPipelineGoogleChronicleDestination: description: The `google_chronicle` destination sends logs to Google Chronicle. properties: auth: $ref: '#/components/schemas/ObservabilityPipelineGcpAuth' customer_id: description: The Google Chronicle customer ID. example: abcdefg123456789 type: string encoding: $ref: '#/components/schemas/ObservabilityPipelineGoogleChronicleDestinationEncoding' id: description: The unique identifier for this component. example: google-chronicle-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - parse-json-processor items: type: string type: array log_type: description: The log type metadata associated with the Chronicle destination. example: nginx_logs type: string type: $ref: '#/components/schemas/ObservabilityPipelineGoogleChronicleDestinationType' required: - id - type - inputs - auth - customer_id type: object LogsArchiveStorageClassS3Type: default: STANDARD description: The storage class where the archive will be stored. enum: - STANDARD - STANDARD_IA - ONEZONE_IA - INTELLIGENT_TIERING - GLACIER_IR example: STANDARD type: string x-enum-varnames: - STANDARD - STANDARD_IA - ONEZONE_IA - INTELLIGENT_TIERING - GLACIER_IR MicrosoftTeamsTenantBasedHandleType: default: tenant-based-handle description: Specifies the tenant-based handle resource type. enum: - tenant-based-handle example: tenant-based-handle type: string x-enum-varnames: - TENANT_BASED_HANDLE LayerAttributesInterval: description: Defines how often the rotation repeats, using a combination of days and optional seconds. properties: days: description: The number of days in each rotation cycle. example: 1 format: int32 maximum: 400 type: integer seconds: description: Any additional seconds for the rotation cycle (up to 30 days). example: 300 format: int64 maximum: 2592000 type: integer type: object AWSRegions: description: AWS Regions to collect data from. Defaults to `include_all`. oneOf: - $ref: '#/components/schemas/AWSRegionsIncludeAll' - $ref: '#/components/schemas/AWSRegionsIncludeOnly' ObservabilityPipelineKafkaSource: description: The `kafka` source ingests data from Apache Kafka topics. properties: group_id: description: Consumer group ID used by the Kafka client. example: consumer-group-0 type: string id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: kafka-source type: string librdkafka_options: description: Optional list of advanced Kafka client configuration options, defined as key-value pairs. items: $ref: '#/components/schemas/ObservabilityPipelineKafkaSourceLibrdkafkaOption' type: array sasl: $ref: '#/components/schemas/ObservabilityPipelineKafkaSourceSasl' tls: $ref: '#/components/schemas/ObservabilityPipelineTls' topics: description: A list of Kafka topic names to subscribe to. The source ingests messages from each topic specified. example: - topic1 - topic2 items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineKafkaSourceType' required: - id - type - group_id - topics type: object ObservabilityPipelineSplunkTcpSource: description: 'The `splunk_tcp` source receives logs from a Splunk Universal Forwarder over TCP. TLS is supported for secure transmission. ' properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: splunk-tcp-source type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineSplunkTcpSourceType' required: - id - type type: object ActionQueryMockedOutputsObject: description: The mocked outputs of the action query. properties: enabled: $ref: '#/components/schemas/ActionQueryMockedOutputsEnabled' outputs: description: The mocked outputs of the action query, serialized as JSON. example: '{"status": "success"}' type: string required: - enabled type: object OpenAPIEndpoint: description: Endpoint info extracted from an `OpenAPI` specification. properties: method: description: The endpoint method. type: string example: example_value path: description: The endpoint path. type: string example: example_value type: object UserTeamPermissionType: default: user_team_permissions description: User team permission type enum: - user_team_permissions example: user_team_permissions type: string x-enum-varnames: - USER_TEAM_PERMISSIONS LogsMetricResponseGroupBy: description: A group by rule. properties: path: description: The path to the value the log-based metric will be aggregated over. example: '@http.status_code' type: string tag_name: description: Eventual name of the tag that gets created. By default, the path attribute is used as the tag name. example: status_code type: string type: object IncidentAttachmentUpdateRequest: description: The update request for an incident's attachments. properties: data: description: 'An array of incident attachments. An attachment object without an "id" key indicates that you want to create that attachment. An attachment object without an "attributes" key indicates that you want to delete that attachment. An attachment object with both the "id" key and a populated "attributes" object indicates that you want to update that attachment.' example: - attributes: attachment: documentUrl: https://app.datadoghq.com/notebook/123 title: Postmortem IR-123 attachment_type: postmortem id: 00000000-abcd-0002-0000-000000000000 type: incident_attachments - attributes: attachment: documentUrl: https://www.example.com/webstore-failure-runbook title: Runbook for webstore service failures attachment_type: link type: incident_attachments - id: 00000000-abcd-0003-0000-000000000000 type: incident_attachments items: $ref: '#/components/schemas/IncidentAttachmentUpdateData' type: array required: - data type: object IncidentTeamResponseAttributes: description: The incident team's attributes from a response. properties: created: description: Timestamp of when the incident team was created. format: date-time readOnly: true type: string example: example_value modified: description: Timestamp of when the incident team was modified. format: date-time readOnly: true type: string example: example_value name: description: Name of the incident team. example: team name type: string type: object IncidentTypeObject: description: Incident type response data. properties: attributes: $ref: '#/components/schemas/IncidentTypeAttributes' id: description: The incident type's ID. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/IncidentTypeType' required: - id - type type: object ActionQueryDebounceInMs: description: The minimum time in milliseconds that must pass before the query can be triggered again. This is useful for preventing accidental double-clicks from triggering the query multiple times. oneOf: - example: 310.5 format: double type: number - description: If this is a string, it must be a valid JavaScript expression that evaluates to a number. example: ${1000} type: string ScheduleCreateRequest: description: The top-level request body for schedule creation, wrapping a `data` object. example: data: attributes: layers: - effective_date: '2025-02-03T05:00:00Z' end_date: '2025-12-31T00:00:00Z' interval: days: 1 members: - user: id: 00000000-aba1-0000-0000-000000000000 name: Layer 1 restrictions: - end_day: friday end_time: '17:00:00' start_day: monday start_time: 09:00:00 rotation_start: '2025-02-01T00:00:00Z' name: On-Call Schedule time_zone: America/New_York relationships: teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: schedules properties: data: $ref: '#/components/schemas/ScheduleCreateRequestData' required: - data type: object CloudConfigurationRuleCreatePayload: description: Create a new cloud configuration rule. properties: cases: description: 'Description of generated findings and signals (severity and channels to be notified in case of a signal). Must contain exactly one item. ' items: $ref: '#/components/schemas/CloudConfigurationRuleCaseCreate' type: array complianceSignalOptions: $ref: '#/components/schemas/CloudConfigurationRuleComplianceSignalOptions' filters: description: Additional queries to filter matched events before they are processed. items: $ref: '#/components/schemas/SecurityMonitoringFilter' type: array isEnabled: description: Whether the rule is enabled. example: true type: boolean message: description: Message in markdown format for generated findings and signals. example: '#Description Explanation of the rule. #Remediation How to fix the security issue. ' type: string name: description: The name of the rule. example: My security monitoring rule. type: string options: $ref: '#/components/schemas/CloudConfigurationRuleOptions' tags: description: Tags for generated findings and signals. example: - env:prod - team:security items: description: Tag. type: string type: array type: $ref: '#/components/schemas/CloudConfigurationRuleType' required: - name - isEnabled - options - complianceSignalOptions - cases - message type: object AppBuilderEvent: additionalProperties: {} description: An event on a UI component that triggers a response or action in an app. properties: name: $ref: '#/components/schemas/AppBuilderEventName' type: $ref: '#/components/schemas/AppBuilderEventType' type: object ApplicationSecurityWafCustomRuleData: description: Object for a single WAF custom rule. properties: attributes: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleAttributes' id: description: The ID of the custom rule. example: 2857c47d-1e3a-4300-8b2f-dc24089c084b readOnly: true type: string type: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleType' type: object TriggerSource: description: 'The type of security issues on which the rule applies. Notification rules based on security signals need to use the trigger source "security_signals", while notification rules based on security vulnerabilities need to use the trigger source "security_findings".' enum: - security_findings - security_signals example: security_findings type: string x-enum-varnames: - SECURITY_FINDINGS - SECURITY_SIGNALS EscalationPolicyStepTargetType: description: Specifies the type of escalation target (example `users`, `schedules`, or `teams`). enum: - users - schedules - teams example: users type: string x-enum-varnames: - USERS - SCHEDULES - TEAMS TeamType: default: team description: Team type enum: - team example: team type: string x-enum-varnames: - TEAM SAMLAssertionAttributeAttributes: description: Key/Value pair of attributes used in SAML assertion attributes. properties: attribute_key: description: Key portion of a key/value pair of the attribute sent from the Identity Provider. example: member-of type: string attribute_value: description: Value portion of a key/value pair of the attribute sent from the Identity Provider. example: Development type: string type: object IncidentCreateAttributes: description: The incident's attributes for a create request. properties: customer_impact_scope: description: Required if `customer_impacted:"true"`. A summary of the impact customers experienced during the incident. example: Example customer impact scope type: string customer_impacted: description: A flag indicating whether the incident caused customer impact. example: false type: boolean fields: additionalProperties: $ref: '#/components/schemas/IncidentFieldAttributes' description: A condensed view of the user-defined fields for which to create initial selections. example: severity: type: dropdown value: SEV-5 type: object incident_type_uuid: description: A unique identifier that represents an incident type. The default incident type will be used if this property is not provided. example: 00000000-0000-0000-0000-000000000000 type: string initial_cells: description: An array of initial timeline cells to be placed at the beginning of the incident timeline. items: $ref: '#/components/schemas/IncidentTimelineCellCreateAttributes' type: array notification_handles: description: Notification handles that will be notified of the incident at creation. example: - display_name: Jane Doe handle: '@user@email.com' - display_name: Slack Channel handle: '@slack-channel' - display_name: Incident Workflow handle: '@workflow-from-incident' items: $ref: '#/components/schemas/IncidentNotificationHandle' type: array title: description: The title of the incident, which summarizes what happened. example: A test incident title type: string required: - title - customer_impacted type: object EntityV3QueueDatadog: additionalProperties: false description: Datadog product integrations for the datastore entity. properties: events: $ref: '#/components/schemas/EntityV3DatadogEvents' logs: $ref: '#/components/schemas/EntityV3DatadogLogs' performanceData: $ref: '#/components/schemas/EntityV3DatadogPerformance' type: object x-ignore-duplicate-object: true IncidentTypeResponse: description: Incident type response data. properties: data: $ref: '#/components/schemas/IncidentTypeObject' required: - data type: object ObservabilityPipelineSentinelOneDestination: description: The `sentinel_one` destination sends logs to SentinelOne. properties: id: description: The unique identifier for this component. example: sentinelone-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array region: $ref: '#/components/schemas/ObservabilityPipelineSentinelOneDestinationRegion' type: $ref: '#/components/schemas/ObservabilityPipelineSentinelOneDestinationType' required: - id - type - inputs - region type: object Case: description: A case properties: attributes: $ref: '#/components/schemas/CaseAttributes' id: description: Case's identifier example: aeadc05e-98a8-11ec-ac2c-da7ad0900001 type: string relationships: $ref: '#/components/schemas/CaseRelationships' type: $ref: '#/components/schemas/CaseResourceType' required: - id - type - attributes type: object UserCreateAttributes: description: Attributes of the created user. properties: email: description: The email of the user. example: jane.doe@example.com type: string name: description: The name of the user. type: string example: Example Monitor title: description: The title of the user. type: string example: Example Monitor required: - email type: object ScheduleDataType: default: schedules description: Schedules resource type. enum: - schedules example: schedules type: string x-enum-varnames: - SCHEDULES ServiceDefinitionV2Opsgenie: description: Opsgenie integration for the service. properties: region: $ref: '#/components/schemas/ServiceDefinitionV2OpsgenieRegion' service-url: description: Opsgenie service url. example: https://my-org.opsgenie.com/service/123e4567-e89b-12d3-a456-426614174000 type: string required: - service-url type: object MonitorNotificationRuleCreateRequestData: description: Object to create a monitor notification rule. properties: attributes: $ref: '#/components/schemas/MonitorNotificationRuleAttributes' type: $ref: '#/components/schemas/MonitorNotificationRuleResourceType' required: - attributes type: object ObservabilityPipelineAmazonOpenSearchDestinationAuthStrategy: description: The authentication strategy to use. enum: - basic - aws example: aws type: string x-enum-varnames: - BASIC - AWS CustomFrameworkType: default: custom_framework description: The type of the resource. The value must be `custom_framework`. enum: - custom_framework example: custom_framework type: string x-enum-varnames: - CUSTOM_FRAMEWORK MicrosoftSentinelDestination: description: The `microsoft_sentinel` destination forwards logs to Microsoft Sentinel. properties: client_id: description: Azure AD client ID used for authentication. example: a1b2c3d4-5678-90ab-cdef-1234567890ab type: string dcr_immutable_id: description: The immutable ID of the Data Collection Rule (DCR). example: dcr-uuid-1234 type: string id: description: The unique identifier for this component. example: sentinel-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array table: description: The name of the Log Analytics table where logs are sent. example: CustomLogsTable type: string tenant_id: description: Azure AD tenant ID. example: abcdef12-3456-7890-abcd-ef1234567890 type: string type: $ref: '#/components/schemas/MicrosoftSentinelDestinationType' required: - id - type - inputs - client_id - tenant_id - dcr_immutable_id - table type: object CloudConfigurationRegoRule: description: Rule details. properties: policy: description: 'The policy written in `rego`, see: https://www.openpolicyagent.org/docs/latest/policy-language/' example: "package datadog\n\nimport data.datadog.output as dd_output\nimport future.keywords.contains\nimport future.keywords.if\nimport future.keywords.in\n\neval(resource) = \"skip\" if {\n # Logic that evaluates to true if the resource should be skipped\n true\n} else = \"pass\" {\n # Logic that evaluates to true if the resource is compliant\n true\n} else = \"fail\" {\n # Logic that evaluates to true if the resource is not compliant\n true\n}\n\n# This part remains unchanged for all rules\nresults contains result if {\n some resource in input.resources[input.main_resource_type]\n result := dd_output.format(resource, eval(resource))\n}\n" type: string resourceTypes: description: List of resource types that will be evaluated upon. Must have at least one element. example: - gcp_iam_service_account - gcp_iam_policy items: type: string type: array required: - policy - resourceTypes type: object CompletionConditionOperator: description: The definition of `CompletionConditionOperator` object. enum: - OPERATOR_EQUAL - OPERATOR_NOT_EQUAL - OPERATOR_GREATER_THAN - OPERATOR_LESS_THAN - OPERATOR_GREATER_THAN_OR_EQUAL_TO - OPERATOR_LESS_THAN_OR_EQUAL_TO - OPERATOR_CONTAINS - OPERATOR_DOES_NOT_CONTAIN - OPERATOR_IS_NULL - OPERATOR_IS_NOT_NULL - OPERATOR_IS_EMPTY - OPERATOR_IS_NOT_EMPTY example: OPERATOR_EQUAL type: string x-enum-varnames: - OPERATOR_EQUAL - OPERATOR_NOT_EQUAL - OPERATOR_GREATER_THAN - OPERATOR_LESS_THAN - OPERATOR_GREATER_THAN_OR_EQUAL_TO - OPERATOR_LESS_THAN_OR_EQUAL_TO - OPERATOR_CONTAINS - OPERATOR_DOES_NOT_CONTAIN - OPERATOR_IS_NULL - OPERATOR_IS_NOT_NULL - OPERATOR_IS_EMPTY - OPERATOR_IS_NOT_EMPTY MicrosoftTeamsWorkflowsWebhookHandleType: default: workflows-webhook-handle description: Specifies the Workflows webhook handle resource type. enum: - workflows-webhook-handle example: workflows-webhook-handle type: string x-enum-varnames: - WORKFLOWS_WEBHOOK_HANDLE AzureUCConfigPostRequest: description: Azure config Post Request. properties: data: $ref: '#/components/schemas/AzureUCConfigPostData' required: - data type: object OutcomesBatchRequest: description: Scorecard outcomes batch request. properties: data: $ref: '#/components/schemas/OutcomesBatchRequestData' type: object ObservabilityPipelineSensitiveDataScannerProcessorScopeExclude: description: Excludes specific fields from sensitive data scanning. properties: options: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions' target: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeExcludeTarget' required: - target - options type: object AzureUCConfigPairsResponse: description: Response of Azure config pair. properties: data: $ref: '#/components/schemas/AzureUCConfigPair' type: object ServiceDefinitionV2Pagerduty: description: PagerDuty service URL for the service. example: https://my-org.pagerduty.com/service-directory/PMyService type: string IncidentTeamResponseData: description: Incident Team data from a response. properties: attributes: $ref: '#/components/schemas/IncidentTeamResponseAttributes' id: description: The incident team's ID. example: 00000000-7ea3-0000-000a-000000000000 type: string relationships: $ref: '#/components/schemas/IncidentTeamRelationships' type: $ref: '#/components/schemas/IncidentTeamType' type: object CustomDestinationHttpDestinationAuthBasic: description: Basic access authentication. properties: password: description: The password of the authentication. This field is not returned by the API. example: datadog-custom-destination-password type: string writeOnly: true type: $ref: '#/components/schemas/CustomDestinationHttpDestinationAuthBasicType' username: description: The username of the authentication. This field is not returned by the API. example: datadog-custom-destination-username type: string writeOnly: true required: - type - username - password type: object Connection: description: The definition of `Connection` object. properties: connectionId: description: The `Connection` `connectionId`. example: '' type: string label: description: The `Connection` `label`. example: '' type: string required: - connectionId - label type: object IncidentNonDatadogCreator: description: Incident's non Datadog creator. nullable: true properties: image_48_px: description: Non Datadog creator `48px` image. type: string example: example_value name: description: Non Datadog creator name. type: string example: Example Monitor type: object RetentionFilterCreateAttributes: description: The object describing the configuration of the retention filter to create/update. properties: enabled: description: Enable/Disable the retention filter. example: true type: boolean filter: $ref: '#/components/schemas/SpansFilterCreate' filter_type: $ref: '#/components/schemas/RetentionFilterType' name: description: The name of the retention filter. example: my retention filter type: string rate: description: 'Sample rate to apply to spans going through this retention filter. A value of 1.0 keeps all spans matching the query.' example: 1 format: double type: number trace_rate: description: 'Sample rate to apply to traces containing spans going through this retention filter. A value of 1.0 keeps all traces with spans matching the query.' example: 1 format: double type: number required: - name - filter - enabled - filter_type - rate type: object ScheduleUserAttributes: description: Provides basic user information for a schedule, including a name and email address. properties: email: description: The user's email address. example: jane.doe@example.com type: string name: description: The user's name. example: Jane Doe type: string status: $ref: '#/components/schemas/UserAttributesStatus' type: object EntityV3DatadogEvents: additionalProperties: false description: Events associations. items: $ref: '#/components/schemas/EntityV3DatadogEventItem' type: array ObservabilityPipelineDatadogLogsDestination: description: The `datadog_logs` destination forwards logs to Datadog Log Management. properties: id: description: The unique identifier for this component. example: datadog-logs-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineDatadogLogsDestinationType' required: - id - type - inputs type: object IncidentIntegrationMetadataResponse: description: Response with an incident integration metadata. properties: data: $ref: '#/components/schemas/IncidentIntegrationMetadataResponseData' included: description: Included related resources that the user requested. items: $ref: '#/components/schemas/IncidentIntegrationMetadataResponseIncludedItem' readOnly: true type: array required: - data type: object Team: description: A team properties: attributes: $ref: '#/components/schemas/TeamAttributes' id: description: The team's identifier example: aeadc05e-98a8-11ec-ac2c-da7ad0900001 type: string relationships: $ref: '#/components/schemas/TeamRelationships' type: $ref: '#/components/schemas/TeamType' required: - attributes - id - type type: object x-merge-override: required: false ObservabilityPipelineAddEnvVarsProcessor: description: The `add_env_vars` processor adds environment variable values to log events. properties: id: description: The unique identifier for this component. Used to reference this processor in the pipeline. example: add-env-vars-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the input for this processor. example: - datadog-agent-source items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineAddEnvVarsProcessorType' variables: description: A list of environment variable mappings to apply to log fields. items: $ref: '#/components/schemas/ObservabilityPipelineAddEnvVarsProcessorVariable' type: array required: - id - type - include - inputs - variables type: object MonitorNotificationRuleAttributes: additionalProperties: false description: Attributes of the monitor notification rule. properties: filter: $ref: '#/components/schemas/MonitorNotificationRuleFilter' name: $ref: '#/components/schemas/MonitorNotificationRuleName' recipients: $ref: '#/components/schemas/MonitorNotificationRuleRecipients' required: - name - recipients type: object ObservabilityPipelineSensitiveDataScannerProcessorPattern: description: Pattern detection configuration for identifying sensitive data using either a custom regex or a library reference. oneOf: - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPattern' - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorLibraryPattern' ObservabilityPipelineSensitiveDataScannerProcessorActionRedact: description: Configuration for completely redacting matched sensitive data. properties: action: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionRedactAction' options: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionRedactOptions' required: - action - options type: object RelationshipToOutcomeData: description: The JSON:API relationship to an outcome, which returns the related rule id. properties: id: $ref: '#/components/schemas/RuleId' type: $ref: '#/components/schemas/RuleType' type: object ApplicationSecurityWafExclusionFilterRulesTarget: description: Target WAF rules based either on an identifier or tags. properties: rule_id: description: Target a single WAF rule based on its identifier. example: dog-913-009 type: string tags: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterRulesTargetTags' type: object MonitorTriggerWrapper: description: Schema for a Monitor-based trigger. properties: monitorTrigger: $ref: '#/components/schemas/MonitorTrigger' startStepNames: $ref: '#/components/schemas/StartStepNames' required: - monitorTrigger type: object LogsMetricComputeIncludePercentiles: description: 'Toggle to include or exclude percentile aggregations for distribution metrics. Only present when the `aggregation_type` is `distribution`.' example: true type: boolean AWSAccountPartition: description: 'AWS partition your AWS account is scoped to. Defaults to `aws`. See [Partitions](https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/partitions.html) in the AWS documentation for more information.' enum: - aws - aws-cn - aws-us-gov example: aws type: string x-enum-varnames: - AWS - AWS_CN - AWS_US_GOV MicrosoftTeamsTenantBasedHandleRequestAttributes: description: Tenant-based handle attributes. properties: channel_id: description: Channel id. example: fake-channel-id maxLength: 255 type: string name: description: Tenant-based handle name. example: fake-handle-name maxLength: 255 type: string team_id: description: Team id. example: 00000000-0000-0000-0000-000000000000 maxLength: 255 type: string tenant_id: description: Tenant id. example: 00000000-0000-0000-0000-000000000001 maxLength: 255 type: string required: - name - channel_id - team_id - tenant_id type: object x-merge-override: required: false EntityData: description: Entity data. properties: attributes: $ref: '#/components/schemas/EntityAttributes' id: description: Entity ID. type: string example: abc-123-def meta: $ref: '#/components/schemas/EntityMeta' relationships: $ref: '#/components/schemas/EntityRelationships' type: description: Entity. type: string example: metric alert type: object ServiceAccountCreateRequest: description: Create a service account. properties: data: $ref: '#/components/schemas/ServiceAccountCreateData' required: - data type: object ServiceDefinitionV2MSTeamsType: description: Contact type. enum: - microsoft-teams example: microsoft-teams type: string x-enum-varnames: - MICROSOFT_TEAMS SensitiveDataScannerStandardPattern: description: Data containing the standard pattern id. properties: id: description: ID of the standard pattern. type: string example: abc-123-def type: $ref: '#/components/schemas/SensitiveDataScannerStandardPatternType' type: object ApplicationSecurityWafCustomRuleTagsCategory: description: The category of the WAF Rule, can be either `business_logic`, `attack_attempt` or `security_response`. enum: - attack_attempt - business_logic - security_response example: business_logic type: string x-enum-varnames: - ATTACK_ATTEMPT - BUSINESS_LOGIC - SECURITY_RESPONSE CustomDestinationForwardDestinationSplunk: description: The Splunk HTTP Event Collector (HEC) destination. properties: access_token: description: Access token of the Splunk HTTP Event Collector. This field is not returned by the API. example: splunk_access_token type: string writeOnly: true endpoint: description: 'The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.' example: https://example.com type: string type: $ref: '#/components/schemas/CustomDestinationForwardDestinationSplunkType' required: - type - endpoint - access_token type: object IncidentTodoResponseIncludedItem: description: An object related to an incident todo that is included in the response. oneOf: - $ref: '#/components/schemas/User' ObservabilityPipelineSumoLogicSource: description: The `sumo_logic` source receives logs from Sumo Logic collectors. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: sumo-logic-source type: string type: $ref: '#/components/schemas/ObservabilityPipelineSumoLogicSourceType' required: - id - type type: object OutputSchemaParametersType: description: The definition of `OutputSchemaParametersType` object. enum: - STRING - NUMBER - BOOLEAN - OBJECT - ARRAY_STRING - ARRAY_NUMBER - ARRAY_BOOLEAN - ARRAY_OBJECT example: STRING type: string x-enum-varnames: - STRING - NUMBER - BOOLEAN - OBJECT - ARRAY_STRING - ARRAY_NUMBER - ARRAY_BOOLEAN - ARRAY_OBJECT EntityV3APIVersion: description: The schema version of entity type. The field is known as schema-version in the previous version. enum: - v3 example: v3 type: string x-enum-varnames: - V3 ObservabilityPipelineHttpClientSourceAuthStrategy: description: Optional authentication strategy for HTTP requests. enum: - basic - bearer example: basic type: string x-enum-varnames: - BASIC - BEARER SecurityMonitoringSuppressionID: description: The ID of the suppression rule. example: 3dd-0uc-h1s type: string TeamLinkCreateRequest: description: Team link create request properties: data: $ref: '#/components/schemas/TeamLinkCreate' required: - data type: object APIKeyCreateRequest: description: Request used to create an API key. properties: data: $ref: '#/components/schemas/APIKeyCreateData' required: - data type: object ObservabilityPipelineOcsfMapperProcessorMapping: description: Defines how specific events are transformed to OCSF using a mapping configuration. properties: include: description: A Datadog search query used to select the logs that this mapping should apply to. example: service:my-service type: string mapping: $ref: '#/components/schemas/ObservabilityPipelineOcsfMapperProcessorMappingMapping' required: - include - mapping type: object MicrosoftSentinelDestinationType: default: microsoft_sentinel description: The destination type. The value should always be `microsoft_sentinel`. enum: - microsoft_sentinel example: microsoft_sentinel type: string x-enum-varnames: - MICROSOFT_SENTINEL ObservabilityPipelineQuotaProcessorLimit: description: The maximum amount of data or number of events allowed before the quota is enforced. Can be specified in bytes or events. properties: enforce: $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorLimitEnforceType' limit: description: The limit for quota enforcement. example: 1000 format: int64 type: integer required: - enforce - limit type: object ActionConnectionAttributes: description: The definition of `ActionConnectionAttributes` object. properties: integration: $ref: '#/components/schemas/ActionConnectionIntegration' name: description: Name of the connection example: My AWS Connection type: string required: - name - integration type: object APIKeyResponseIncludedItem: description: An object related to an API key. oneOf: - $ref: '#/components/schemas/User' - $ref: '#/components/schemas/LeakedKey' DataRelationshipsTeams: description: Associates teams with this schedule in a data structure. properties: data: description: An array of team references for this schedule. items: $ref: '#/components/schemas/DataRelationshipsTeamsDataItems' type: array type: object ServiceDefinitionV2Dot1Integrations: description: Third party integrations that Datadog supports. properties: opsgenie: $ref: '#/components/schemas/ServiceDefinitionV2Dot1Opsgenie' pagerduty: $ref: '#/components/schemas/ServiceDefinitionV2Dot1Pagerduty' type: object OpsgenieServiceResponse: description: Response of an Opsgenie service. properties: data: $ref: '#/components/schemas/OpsgenieServiceResponseData' required: - data type: object RelationshipToIncidentImpacts: description: Relationship to impacts. properties: data: description: An array of incident impacts. items: $ref: '#/components/schemas/RelationshipToIncidentImpactData' type: array required: - data type: object EntityToRelatedEntities: description: Entity to related entities relationship. properties: data: $ref: '#/components/schemas/RelationshipArray' type: object IncidentAttachmentPostmortemAttributes: description: The attributes object for a postmortem attachment. properties: attachment: $ref: '#/components/schemas/IncidentAttachmentsPostmortemAttributesAttachmentObject' attachment_type: $ref: '#/components/schemas/IncidentAttachmentPostmortemAttachmentType' required: - attachment_type - attachment type: object CreateRuleResponse: description: Created rule in response. properties: data: $ref: '#/components/schemas/CreateRuleResponseData' type: object ComponentProperties: additionalProperties: {} description: Properties of a UI component. Different component types can have their own additional unique properties. See the [components documentation](https://docs.datadoghq.com/service_management/app_builder/components/) for more detail on each component type and its properties. properties: children: description: The child components of the UI component. items: $ref: '#/components/schemas/Component' type: array isVisible: $ref: '#/components/schemas/ComponentPropertiesIsVisible' type: object EscalationPolicyUser: description: Represents a user object in the context of an escalation policy, including their `id`, type, and basic attributes. properties: attributes: $ref: '#/components/schemas/EscalationPolicyUserAttributes' id: description: The unique user identifier. type: string example: abc-123-def type: $ref: '#/components/schemas/EscalationPolicyUserType' required: - type type: object MicrosoftTeamsWorkflowsWebhookHandleRequestAttributes: description: Workflows Webhook handle attributes. properties: name: description: Workflows Webhook handle name. example: fake-handle-name maxLength: 255 type: string url: description: Workflows Webhook URL. example: https://fake.url.com maxLength: 255 type: string required: - name - url type: object SecurityMonitoringRuleCaseActionType: description: The action type. enum: - block_ip - block_user - user_behavior type: string x-enum-varnames: - BLOCK_IP - BLOCK_USER - USER_BEHAVIOR ObservabilityPipelineSampleProcessor: description: The `sample` processor allows probabilistic sampling of logs at a fixed rate. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components). example: sample-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - datadog-agent-source items: type: string type: array percentage: description: The percentage of logs to sample. example: 10 format: double type: number rate: description: Number of events to sample (1 in N). example: 10 format: int64 minimum: 1 type: integer type: $ref: '#/components/schemas/ObservabilityPipelineSampleProcessorType' required: - id - type - include - inputs type: object ObservabilityPipelineData: description: Contains the pipeline’s ID, type, and configuration attributes. properties: attributes: $ref: '#/components/schemas/ObservabilityPipelineDataAttributes' id: description: Unique identifier for the pipeline. example: 3fa85f64-5717-4562-b3fc-2c963f66afa6 type: string type: default: pipelines description: The resource type identifier. For pipeline resources, this should always be set to `pipelines`. example: pipelines type: string required: - id - type - attributes type: object ServiceDefinitionV2Dot1Version: default: v2.1 description: Schema version being used. enum: - v2.1 example: v2.1 type: string x-enum-varnames: - V2_1 HTTPIntegration: description: The definition of `HTTPIntegration` object. properties: base_url: description: Base HTTP url for the integration example: http://datadoghq.com type: string credentials: $ref: '#/components/schemas/HTTPCredentials' type: $ref: '#/components/schemas/HTTPIntegrationType' required: - type - base_url - credentials type: object CustomDestinationCreateRequestAttributes: description: The attributes associated with the custom destination. properties: enabled: default: true description: Whether logs matching this custom destination should be forwarded or not. example: true type: boolean forward_tags: default: true description: Whether tags from the forwarded logs should be forwarded or not. example: true type: boolean forward_tags_restriction_list: default: [] description: 'List of [keys of tags](https://docs.datadoghq.com/getting_started/tagging/#define-tags) to be filtered. An empty list represents no restriction is in place and either all or no tags will be forwarded depending on `forward_tags_restriction_list_type` parameter.' example: - datacenter - host items: description: The [key part of a tag](https://docs.datadoghq.com/getting_started/tagging/#define-tags). type: string maxItems: 10 minItems: 0 type: array forward_tags_restriction_list_type: $ref: '#/components/schemas/CustomDestinationAttributeTagsRestrictionListType' forwarder_destination: $ref: '#/components/schemas/CustomDestinationForwardDestination' name: description: The custom destination name. example: Nginx logs type: string query: default: '' description: The custom destination query and filter. Logs matching this query are forwarded to the destination. example: source:nginx type: string required: - name - forwarder_destination type: object RuleType: default: rule description: The JSON:API type for scorecard rules. enum: - rule example: rule type: string x-enum-varnames: - RULE AnnotationDisplay: description: The definition of `AnnotationDisplay` object. properties: bounds: $ref: '#/components/schemas/AnnotationDisplayBounds' type: object CreatePageResponse: description: The full response object after creating a new On-Call Page. example: data: id: 15e74b8b-f865-48d0-bcc5-453323ed2c8f type: pages properties: data: $ref: '#/components/schemas/CreatePageResponseData' type: object AWSCredentials: description: The definition of `AWSCredentials` object. oneOf: - $ref: '#/components/schemas/AWSAssumeRole' AuthNMappingRelationshipToRole: description: Relationship of AuthN Mapping to a Role. properties: role: $ref: '#/components/schemas/RelationshipToRole' required: - role type: object CustomDestinationForwardDestinationElasticsearchType: default: elasticsearch description: Type of the Elasticsearch destination. enum: - elasticsearch example: elasticsearch type: string x-enum-varnames: - ELASTICSEARCH BillConfig: description: Bill config. properties: export_name: description: The name of the configured Azure Export. example: dd-actual-export type: string export_path: description: The path where the Azure Export is saved. example: dd-export-path type: string storage_account: description: The name of the storage account where the Azure Export is saved. example: dd-storage-account type: string storage_container: description: The name of the storage container where the Azure Export is saved. example: dd-storage-container type: string required: - export_name - export_path - storage_account - storage_container type: object ObservabilityPipelineDedupeProcessor: description: The `dedupe` processor removes duplicate fields in log events. properties: fields: description: A list of log field paths to check for duplicates. example: - log.message - log.error items: type: string type: array id: description: The unique identifier for this processor. example: dedupe-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the input for this processor. example: - parse-json-processor items: type: string type: array mode: $ref: '#/components/schemas/ObservabilityPipelineDedupeProcessorMode' type: $ref: '#/components/schemas/ObservabilityPipelineDedupeProcessorType' required: - id - type - include - inputs - fields - mode type: object SensitiveDataScannerRuleCreateRequest: description: Create rule request. properties: data: $ref: '#/components/schemas/SensitiveDataScannerRuleCreate' meta: $ref: '#/components/schemas/SensitiveDataScannerMetaVersionOnly' required: - data - meta type: object MSTeamsIntegrationMetadata: description: Incident integration metadata for the Microsoft Teams integration. properties: teams: description: Array of Microsoft Teams in this integration metadata. example: [] items: $ref: '#/components/schemas/MSTeamsIntegrationMetadataTeamsItem' type: array required: - teams type: object SensitiveDataScannerGroupCreate: description: Data related to the creation of a group. properties: attributes: $ref: '#/components/schemas/SensitiveDataScannerGroupAttributes' relationships: $ref: '#/components/schemas/SensitiveDataScannerGroupRelationships' type: $ref: '#/components/schemas/SensitiveDataScannerGroupType' required: - type - attributes type: object MicrosoftTeamsCreateTenantBasedHandleRequest: description: Create tenant-based handle request. properties: data: $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleRequestData' required: - data type: object RelationshipToRuleData: description: Relationship data for a rule. properties: data: $ref: '#/components/schemas/RelationshipToRuleDataObject' type: object RoleCreateResponse: description: Response containing information about a created role. properties: data: $ref: '#/components/schemas/RoleCreateResponseData' type: object LogsArchiveDestinationAzureType: default: azure description: Type of the Azure archive destination. enum: - azure example: azure type: string x-enum-varnames: - AZURE RuleTypes: description: Security rule types used as filters in security rules. example: - misconfiguration - attack_path items: $ref: '#/components/schemas/RuleTypesItems' type: array LogsArchiveIntegrationS3: description: The S3 Archive's integration destination. properties: account_id: description: The account ID for the integration. example: '123456789012' type: string role_name: description: The path of the integration. example: role-name type: string required: - role_name - account_id type: object CloudWorkloadSecurityAgentRuleCreatorAttributes: description: The attributes of the user who created the Agent rule properties: handle: description: The handle of the user example: datadog.user@example.com type: string name: description: The name of the user example: Datadog User nullable: true type: string type: object ObservabilityPipelineGeneratedMetricIncrementByOne: description: Strategy that increments a generated metric by one for each matching event. properties: strategy: $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByOneStrategy' required: - strategy type: object OutcomesBatchAttributes: description: The JSON:API attributes for a batched set of scorecard outcomes. properties: results: description: Set of scorecard outcomes to update. items: $ref: '#/components/schemas/OutcomesBatchRequestItem' type: array type: object SecurityMonitoringSignalRuleResponseQuery: description: Query for matching rule on signals. properties: aggregation: $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation' correlatedByFields: description: Fields to correlate by. items: description: Field. type: string type: array correlatedQueryIndex: description: Index of the rule query used to retrieve the correlated field. format: int32 maximum: 9 type: integer example: 42 defaultRuleId: description: Default Rule ID to match on signals. example: d3f-ru1-e1d type: string distinctFields: description: Field for which the cardinality is measured. Sent as an array. items: description: Field. type: string type: array groupByFields: description: Fields to group by. items: description: Field. type: string type: array metrics: description: Group of target fields to aggregate over. items: description: Field. type: string type: array name: description: Name of the query. type: string example: Example Monitor ruleId: description: Rule ID to match on signals. example: org-ru1-e1d type: string type: object EntityV3APIKind: description: The definition of Entity V3 API Kind object. enum: - api example: api type: string x-enum-varnames: - API ObservabilityPipelineEnrichmentTableFileEncoding: description: File encoding format. properties: delimiter: description: The `encoding` `delimiter`. example: ',' type: string includes_headers: description: The `encoding` `includes_headers`. example: true type: boolean type: $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileEncodingType' required: - type - delimiter - includes_headers type: object ApplicationSecurityWafExclusionFilterCreateRequest: description: Request object for creating a single WAF exclusion filter. properties: data: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterCreateData' required: - data type: object UserResponse: description: Response containing information about a single user. properties: data: $ref: '#/components/schemas/User' included: description: Array of objects related to the user. items: $ref: '#/components/schemas/UserResponseIncludedItem' type: array type: object EntityV3APIDatadog: additionalProperties: false description: Datadog product integrations for the API entity. properties: codeLocations: $ref: '#/components/schemas/EntityV3DatadogCodeLocations' events: $ref: '#/components/schemas/EntityV3DatadogEvents' logs: $ref: '#/components/schemas/EntityV3DatadogLogs' performanceData: $ref: '#/components/schemas/EntityV3DatadogPerformance' pipelines: $ref: '#/components/schemas/EntityV3DatadogPipelines' type: object ScorecardType: default: scorecard description: The JSON:API type for scorecard. enum: - scorecard example: scorecard type: string x-enum-varnames: - SCORECARD EscalationPolicyDataRelationships: description: Represents the relationships for an escalation policy, including references to steps and teams. properties: steps: $ref: '#/components/schemas/EscalationPolicyDataRelationshipsSteps' teams: $ref: '#/components/schemas/DataRelationshipsTeams' required: - steps type: object ExternalUserNameType: description: The components of user's real name properties: formatted: description: The full name, including all middle names, titles, and suffixes as appropriate, formatted for display. type: string example: example_value type: object MonitorNotificationRuleCreateRequest: description: Request for creating a monitor notification rule. properties: data: $ref: '#/components/schemas/MonitorNotificationRuleCreateRequestData' required: - data type: object NullableUserRelationshipData: description: Relationship to user object. nullable: true properties: id: description: A unique identifier that represents the user. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/UserResourceType' required: - id - type type: object SlackIntegrationMetadataChannelItem: description: Item in the Slack integration metadata channel array. properties: channel_id: description: Slack channel ID. example: C0123456789 type: string channel_name: description: Name of the Slack channel. example: '#example-channel-name' type: string redirect_url: description: URL redirecting to the Slack channel. example: https://slack.com/app_redirect?channel=C0123456789&team=T01234567 type: string team_id: description: Slack team ID. example: T01234567 type: string required: - channel_id - channel_name - redirect_url type: object AWSIntegrationType: description: The definition of `AWSIntegrationType` object. enum: - AWS example: AWS type: string x-enum-varnames: - AWS EntityV3DatadogCodeLocationItem: additionalProperties: false description: Code location item. properties: paths: description: The paths (glob) to the source code of the service. items: type: string type: array repositoryURL: description: The repository path of the source code of the entity. type: string example: https://app.datadoghq.com type: object ComponentPropertiesIsVisible: description: Whether the UI component is visible. If this is a string, it must be a valid JavaScript expression that evaluates to a boolean. oneOf: - type: boolean - description: If this is a string, it must be a valid JavaScript expression that evaluates to a boolean. example: ${true} type: string ServiceDefinitionV1Info: description: Basic information about a service. properties: dd-service: description: Unique identifier of the service. Must be unique across all services and is used to match with a service in Datadog. example: myservice type: string description: description: A short description of the service. example: A shopping cart service type: string display-name: description: A friendly name of the service. example: My Service type: string service-tier: description: Service tier. example: Tier 1 type: string required: - dd-service type: object OutcomeType: default: outcome description: The JSON:API type for an outcome. enum: - outcome example: outcome type: string x-enum-varnames: - OUTCOME CustomFrameworkData: description: Contains type and attributes for custom frameworks. properties: attributes: $ref: '#/components/schemas/CustomFrameworkDataAttributes' type: $ref: '#/components/schemas/CustomFrameworkType' required: - type - attributes type: object APIKeyCreateAttributes: description: Attributes used to create an API Key. properties: category: description: The APIKeyCreateAttributes category. type: string example: example_value name: description: Name of the API key. example: API Key for submitting metrics type: string remote_config_read_enabled: description: The APIKeyCreateAttributes remote_config_read_enabled. type: boolean example: true required: - name type: object SecurityFilter: description: The security filter's properties. properties: attributes: $ref: '#/components/schemas/SecurityFilterAttributes' id: $ref: '#/components/schemas/SecurityFilterID' type: $ref: '#/components/schemas/SecurityFilterType' type: object ObservabilityPipelineSensitiveDataScannerProcessorActionRedactOptions: description: Configuration for fully redacting sensitive data. properties: replace: description: The `ObservabilityPipelineSensitiveDataScannerProcessorActionRedactOptions` `replace`. example: '***' type: string required: - replace type: object WorkflowUserRelationship: description: The definition of `WorkflowUserRelationship` object. properties: data: $ref: '#/components/schemas/WorkflowUserRelationshipData' type: object SecurityFilterCreateData: description: Object for a single security filter. properties: attributes: $ref: '#/components/schemas/SecurityFilterCreateAttributes' type: $ref: '#/components/schemas/SecurityFilterType' required: - type - attributes type: object RuleAttributes: description: Details of a rule. properties: category: deprecated: true description: The scorecard name to which this rule must belong. type: string example: example_value created_at: description: Creation time of the rule outcome. format: date-time type: string example: example_value custom: description: Defines if the rule is a custom rule. type: boolean example: true description: description: Explanation of the rule. type: string example: example_value enabled: description: If enabled, the rule is calculated as part of the score. example: true type: boolean modified_at: description: Time of the last rule outcome modification. format: date-time type: string example: example_value name: description: Name of the rule. example: Team Defined type: string owner: description: Owner of the rule. type: string example: example_value scorecard_name: description: The scorecard name to which this rule must belong. example: Deployments automated via Deployment Trains type: string type: object IncidentTypeType: default: incident_types description: Incident type resource type. enum: - incident_types example: incident_types type: string x-enum-varnames: - INCIDENT_TYPES LogsMetricFilter: description: The log-based metric filter. Logs matching this filter will be aggregated in this metric. properties: query: default: '*' description: The search query - following the log search syntax. example: service:web* AND @http.status_code:[200 TO 299] type: string type: object ServiceDefinitionV2MSTeams: description: Service owner's Microsoft Teams. properties: contact: description: Contact value. example: https://teams.microsoft.com/myteam type: string name: description: Contact Microsoft Teams. example: My team channel type: string type: $ref: '#/components/schemas/ServiceDefinitionV2MSTeamsType' required: - type - contact type: object EscalationPolicyDataRelationshipsSteps: description: Defines the relationship to a collection of steps within an escalation policy. Contains an array of step data references. properties: data: description: An array of references to the steps defined in this escalation policy. items: $ref: '#/components/schemas/EscalationPolicyDataRelationshipsStepsDataItems' type: array type: object UserCreateData: description: Object to create a user. properties: attributes: $ref: '#/components/schemas/UserCreateAttributes' relationships: $ref: '#/components/schemas/UserRelationships' type: $ref: '#/components/schemas/UsersType' required: - attributes - type type: object x-merge-override: required: false Spec: description: The spec defines what the workflow does. properties: annotations: description: A list of annotations used in the workflow. These are like sticky notes for your workflow! items: $ref: '#/components/schemas/Annotation' type: array connectionEnvs: description: A list of connections or connection groups used in the workflow. items: $ref: '#/components/schemas/ConnectionEnv' type: array handle: description: Unique identifier used to trigger workflows automatically in Datadog. type: string example: example_value inputSchema: $ref: '#/components/schemas/InputSchema' outputSchema: $ref: '#/components/schemas/OutputSchema' steps: description: A `Step` is a sub-component of a workflow. Each `Step` performs an action. items: $ref: '#/components/schemas/Step' type: array triggers: description: The list of triggers that activate this workflow. At least one trigger is required, and each trigger type may appear at most once. items: $ref: '#/components/schemas/Trigger' type: array type: object AWSAuthConfigRole: description: AWS Authentication config to integrate your account using an IAM role. properties: external_id: description: AWS IAM External ID for associated role. type: string example: abc-123-def role_name: description: AWS IAM Role name. example: DatadogIntegrationRole maxLength: 576 minLength: 1 type: string required: - role_name type: object SecurityMonitoringRuleTypeRead: description: The rule type. enum: - log_detection - infrastructure_configuration - workload_security - cloud_configuration - application_security type: string x-enum-varnames: - LOG_DETECTION - INFRASTRUCTURE_CONFIGURATION - WORKLOAD_SECURITY - CLOUD_CONFIGURATION - APPLICATION_SECURITY CloudWorkloadSecurityAgentPolicyCreateRequest: description: Request object that includes the Agent policy to create properties: data: $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyCreateData' required: - data type: object CloudWorkloadSecurityAgentRuleActionSet: description: The set action applied on the scope matching the rule properties: append: description: Whether the value should be appended to the field type: boolean example: true field: description: The field of the set action type: string example: example_value name: description: The name of the set action type: string example: Example Monitor scope: description: The scope of the set action type: string example: example_value size: description: The size of the set action format: int64 type: integer example: 42 ttl: description: The time to live of the set action format: int64 type: integer example: 42 value: description: The value of the set action type: string example: example_value type: object MonitorNotificationRuleRelationships: description: All relationships associated with monitor notification rule. properties: created_by: $ref: '#/components/schemas/MonitorNotificationRuleRelationshipsCreatedBy' type: object ObservabilityPipelineHttpServerSourceAuthStrategy: description: HTTP authentication method. enum: - none - plain example: plain type: string x-enum-varnames: - NONE - PLAIN ObservabilityPipelineFluentdSource: description: The `fluentd` source ingests logs from a Fluentd-compatible service. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components). example: fluent-source type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineFluentdSourceType' required: - id - type type: object SecurityMonitoringRuleMaxSignalDuration: description: 'A signal will "close" regardless of the query being matched once the time exceeds the maximum duration. This time is calculated from the first seen timestamp.' enum: - 0 - 60 - 300 - 600 - 900 - 1800 - 3600 - 7200 - 10800 - 21600 - 43200 - 86400 format: int32 type: integer x-enum-varnames: - ZERO_MINUTES - ONE_MINUTE - FIVE_MINUTES - TEN_MINUTES - FIFTEEN_MINUTES - THIRTY_MINUTES - ONE_HOUR - TWO_HOURS - THREE_HOURS - SIX_HOURS - TWELVE_HOURS - ONE_DAY EntityRaw: description: Entity definition in raw JSON or YAML representation. example: "apiVersion: v3\nkind: service\nmetadata:\n name: myservice\n" type: string StateVariableType: default: stateVariable description: The state variable type. enum: - stateVariable example: stateVariable type: string x-enum-varnames: - STATEVARIABLE ObservabilityPipelineFluentBitSource: description: The `fluent_bit` source ingests logs from Fluent Bit. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components). example: fluent-source type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineFluentBitSourceType' required: - id - type type: object IncidentIntegrationRelationships: description: The incident's integration relationships from a response. properties: created_by_user: $ref: '#/components/schemas/RelationshipToUser' last_modified_by_user: $ref: '#/components/schemas/RelationshipToUser' type: object ServiceDefinitionV2Dot1LinkType: description: Link type. enum: - doc - repo - runbook - dashboard - other example: runbook type: string x-enum-varnames: - DOC - REPO - RUNBOOK - DASHBOARD - OTHER MetricCustomAggregation: description: A time and space aggregation combination for use in query. example: space: sum time: sum properties: space: $ref: '#/components/schemas/MetricCustomSpaceAggregation' time: $ref: '#/components/schemas/MetricCustomTimeAggregation' required: - time - space type: object ScheduleDataAttributes: description: Provides core properties of a schedule object such as its name and time zone. properties: name: description: A short name for the schedule. example: Primary On-Call type: string time_zone: description: The time zone in which this schedule operates. example: America/New_York type: string type: object SecurityMonitoringRuleResponse: description: Create a new rule. oneOf: - $ref: '#/components/schemas/SecurityMonitoringStandardRuleResponse' - $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponse' CreateWorkflowResponse: description: The response object after creating a new workflow. properties: data: $ref: '#/components/schemas/WorkflowData' required: - data type: object OpsgenieServiceCreateData: description: Opsgenie service data for a create request. properties: attributes: $ref: '#/components/schemas/OpsgenieServiceCreateAttributes' type: $ref: '#/components/schemas/OpsgenieServiceType' required: - type - attributes type: object AppTriggerWrapper: description: Schema for an App-based trigger. properties: appTrigger: description: Trigger a workflow from an App. type: object startStepNames: $ref: '#/components/schemas/StartStepNames' required: - appTrigger type: object MonitorConfigPolicyTagPolicy: description: Tag attributes of a monitor configuration policy. properties: tag_key: description: The key of the tag. example: datacenter maxLength: 255 type: string tag_key_required: description: If a tag key is required for monitor creation. example: true type: boolean valid_tag_values: description: Valid values for the tag. example: - prod - staging items: maxLength: 255 type: string type: array type: object IncidentAttachmentType: default: incident_attachments description: The incident attachment resource type. enum: - incident_attachments example: incident_attachments type: string x-enum-varnames: - INCIDENT_ATTACHMENTS IncidentUserAttributes: description: Attributes of user object returned by the API. properties: email: description: Email of the user. type: string example: user@example.com handle: description: Handle of the user. type: string example: example_value icon: description: URL of the user's icon. type: string example: example_value name: description: Name of the user. nullable: true type: string example: Example Monitor uuid: description: UUID of the user. type: string example: abc-123-def type: object BudgetAttributes: description: The attributes of a budget. properties: created_at: description: The timestamp when the budget was created. example: 1738258683590 format: int64 type: integer created_by: description: The id of the user that created the budget. example: 00000000-0a0a-0a0a-aaa0-00000000000a type: string end_month: description: The month when the budget ends. example: 202502 format: int64 type: integer entries: description: The entries of the budget. items: $ref: '#/components/schemas/BudgetEntry' type: array metrics_query: description: The cost query used to track against the budget. example: aws.cost.amortized{service:ec2} by {service} type: string name: description: The name of the budget. example: my budget type: string org_id: description: The id of the org the budget belongs to. example: 123 format: int64 type: integer start_month: description: The month when the budget starts. example: 202501 format: int64 type: integer total_amount: description: The sum of all budget entries' amounts. example: 1000 format: double type: number updated_at: description: The timestamp when the budget was last updated. example: 1738258683590 format: int64 type: integer updated_by: description: The id of the user that created the budget. example: 00000000-0a0a-0a0a-aaa0-00000000000a type: string type: object FullApplicationKey: description: Datadog application key. properties: attributes: $ref: '#/components/schemas/FullApplicationKeyAttributes' id: description: ID of the application key. type: string example: abc-123-def relationships: $ref: '#/components/schemas/ApplicationKeyRelationships' type: $ref: '#/components/schemas/ApplicationKeysType' type: object x-merge-override: required: false WorkflowTriggerWrapper: description: Schema for a Workflow-based trigger. properties: startStepNames: $ref: '#/components/schemas/StartStepNames' workflowTrigger: description: Trigger a workflow from the Datadog UI. Only required if no other trigger exists. type: object required: - workflowTrigger type: object LayerAttributes: description: Describes key properties of a Layer, including rotation details, name, start/end times, and any restrictions. properties: effective_date: description: When the layer becomes active (ISO 8601). format: date-time type: string example: '2026-04-17T12:00:00Z' end_date: description: When the layer ceases to be active (ISO 8601). format: date-time type: string example: '2026-04-17T12:00:00Z' interval: $ref: '#/components/schemas/LayerAttributesInterval' name: description: The name of this layer. example: Weekend Layer type: string restrictions: description: An optional list of time restrictions for when this layer is in effect. items: $ref: '#/components/schemas/TimeRestriction' type: array rotation_start: description: The date/time when the rotation starts (ISO 8601). format: date-time type: string example: example_value type: object TeamCreate: description: Team create properties: attributes: $ref: '#/components/schemas/TeamCreateAttributes' relationships: $ref: '#/components/schemas/TeamCreateRelationships' type: $ref: '#/components/schemas/TeamType' required: - attributes - type type: object ObservabilityPipelineKafkaSourceSasl: description: Specifies the SASL mechanism for authenticating with a Kafka cluster. properties: mechanism: $ref: '#/components/schemas/ObservabilityPipelinePipelineKafkaSourceSaslMechanism' type: object ObservabilityPipelineSplunkHecDestination: description: 'The `splunk_hec` destination forwards logs to Splunk using the HTTP Event Collector (HEC). ' properties: auto_extract_timestamp: description: 'If `true`, Splunk tries to extract timestamps from incoming log events. If `false`, Splunk assigns the time the event was received. ' example: true type: boolean encoding: $ref: '#/components/schemas/ObservabilityPipelineSplunkHecDestinationEncoding' id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: splunk-hec-destination type: string index: description: Optional name of the Splunk index where logs are written. example: main type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array sourcetype: description: The Splunk sourcetype to assign to log events. example: custom_sourcetype type: string type: $ref: '#/components/schemas/ObservabilityPipelineSplunkHecDestinationType' required: - id - type - inputs type: object StepDisplay: description: The definition of `StepDisplay` object. properties: bounds: $ref: '#/components/schemas/StepDisplayBounds' type: object RelationshipToUserData: description: Relationship to user object. properties: id: description: A unique identifier that represents the user. example: 00000000-0000-0000-2345-000000000000 type: string type: $ref: '#/components/schemas/UsersType' required: - id - type type: object x-merge-override: required: false SecurityMonitoringStandardDataSource: default: logs description: Source of events, either logs, audit trail, or Datadog events. enum: - logs - audit - app_sec_spans - spans - security_runtime - network - events example: logs type: string x-enum-varnames: - LOGS - AUDIT - APP_SEC_SPANS - SPANS - SECURITY_RUNTIME - NETWORK - EVENTS ServiceDefinitionV1Version: default: v1 description: Schema version being used. enum: - v1 example: v1 type: string x-enum-varnames: - V1 DataRelationshipsTeamsDataItemsType: default: teams description: Teams resource type. enum: - teams example: teams type: string x-enum-varnames: - TEAMS Query: description: A data query used by an app. This can take the form of an external action, a data transformation, or a state variable. oneOf: - $ref: '#/components/schemas/ActionQuery' - $ref: '#/components/schemas/DataTransform' - $ref: '#/components/schemas/StateVariable' ActionQuerySpec: description: The definition of the action query. oneOf: - type: string - $ref: '#/components/schemas/ActionQuerySpecObject' ConnectionEnvEnv: description: The definition of `ConnectionEnvEnv` object. enum: - default example: default type: string x-enum-varnames: - DEFAULT IncidentAttachmentLinkAttributes: description: The attributes object for a link attachment. properties: attachment: $ref: '#/components/schemas/IncidentAttachmentLinkAttributesAttachmentObject' attachment_type: $ref: '#/components/schemas/IncidentAttachmentLinkAttachmentType' modified: description: Timestamp when the incident attachment link was last modified. format: date-time readOnly: true type: string example: example_value required: - attachment_type - attachment type: object IncidentUserData: description: User object returned by the API. properties: attributes: $ref: '#/components/schemas/IncidentUserAttributes' id: description: ID of the user. type: string example: abc-123-def type: $ref: '#/components/schemas/UsersType' type: object ObservabilityPipelineQuotaProcessorOverride: description: Defines a custom quota limit that applies to specific log events based on matching field values. properties: fields: description: A list of field matchers used to apply a specific override. If an event matches all listed key-value pairs, the corresponding override limit is enforced. items: $ref: '#/components/schemas/ObservabilityPipelineFieldValue' type: array limit: $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorLimit' required: - fields - limit type: object ApplicationKeyCreateData: description: Object used to create an application key. properties: attributes: $ref: '#/components/schemas/ApplicationKeyCreateAttributes' type: $ref: '#/components/schemas/ApplicationKeysType' required: - attributes - type type: object x-merge-override: required: false AWSAssumeRoleType: description: The definition of `AWSAssumeRoleType` object. enum: - AWSAssumeRole example: AWSAssumeRole type: string x-enum-varnames: - AWSASSUMEROLE AppBuilderEventName: description: The triggering action for the event. enum: - pageChange - tableRowClick - _tableRowButtonClick - change - submit - click - toggleOpen - close - open - executionFinished example: click type: string x-enum-varnames: - PAGECHANGE - TABLEROWCLICK - TABLEROWBUTTONCLICK - CHANGE - SUBMIT - CLICK - TOGGLEOPEN - CLOSE - OPEN - EXECUTIONFINISHED EntityV3DatadogPerformance: additionalProperties: false description: Performance stats association. properties: tags: description: A list of APM entity tags that associates the APM Stats data with the entity. items: type: string type: array type: object AzureUCConfig: description: Azure config. properties: account_id: description: The tenant ID of the azure account. example: 1234abcd-1234-abcd-1234-1234abcd1234 type: string client_id: description: The client ID of the Azure account. example: 1234abcd-1234-abcd-1234-1234abcd1234 type: string created_at: description: The timestamp when the Azure config was created. pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$ type: string x-merge-override: format: false example: example_value dataset_type: description: The dataset type of the Azure config. example: actual type: string error_messages: description: The error messages for the Azure config. items: type: string type: array export_name: description: The name of the configured Azure Export. example: dd-actual-export type: string export_path: description: The path where the Azure Export is saved. example: dd-export-path type: string id: description: The ID of the Azure config. format: int64 type: integer example: 42 months: deprecated: true description: The number of months the report has been backfilled. format: int32 maximum: 36 type: integer example: 42 scope: description: The scope of your observed subscription. example: /subscriptions/1234abcd-1234-abcd-1234-1234abcd1234 type: string status: description: The status of the Azure config. example: active type: string status_updated_at: description: The timestamp when the Azure config status was last updated. pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$ type: string x-merge-override: format: false example: OK storage_account: description: The name of the storage account where the Azure Export is saved. example: dd-storage-account type: string storage_container: description: The name of the storage container where the Azure Export is saved. example: dd-storage-container type: string updated_at: description: The timestamp when the Azure config was last updated. pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$ type: string x-merge-override: format: false example: '2026-04-17T12:00:00Z' required: - account_id - client_id - dataset_type - export_name - export_path - scope - status - storage_account - storage_container type: object x-merge-override: required: false SpansFilter: description: The spans filter used to index spans. properties: query: description: The search query - following the [span search syntax](https://docs.datadoghq.com/tracing/trace_explorer/query_syntax/). example: '@http.status_code:200 service:my-service' type: string type: object TeamReferenceAttributes: description: Encapsulates the basic attributes of a Team reference, such as name, handle, and an optional avatar or description. properties: avatar: description: URL or reference for the team's avatar (if available). type: string example: example_value description: description: A short text describing the team. type: string example: example_value handle: description: A unique handle/slug for the team. type: string example: example_value name: description: The full, human-readable name of the team. type: string example: Example Monitor type: object CustomDestinationResponseHttpDestinationAuthCustomHeaderType: default: custom_header description: Type of the custom header access authentication. enum: - custom_header example: custom_header type: string x-enum-varnames: - CUSTOM_HEADER MonitorNotificationRuleData: description: Monitor notification rule data. properties: attributes: $ref: '#/components/schemas/MonitorNotificationRuleResponseAttributes' id: $ref: '#/components/schemas/MonitorNotificationRuleId' relationships: $ref: '#/components/schemas/MonitorNotificationRuleRelationships' type: $ref: '#/components/schemas/MonitorNotificationRuleResourceType' type: object ApplicationKeysType: default: application_keys description: Application Keys resource type. enum: - application_keys example: application_keys type: string x-enum-varnames: - APPLICATION_KEYS ObservabilityPipelineAmazonS3Source: description: 'The `amazon_s3` source ingests logs from an Amazon S3 bucket. It supports AWS authentication and TLS encryption. ' properties: auth: $ref: '#/components/schemas/ObservabilityPipelineAwsAuth' id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: aws-s3-source type: string region: description: AWS region where the S3 bucket resides. example: us-east-1 type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineAmazonS3SourceType' required: - id - type - region type: object SecurityFilterExclusionFilter: description: Exclusion filter for the security filter. example: name: Exclude staging query: source:staging properties: name: description: Exclusion filter name. example: Exclude staging type: string query: description: Exclusion filter query. Logs that match this query are excluded from the security filter. example: source:staging type: string required: - name - query type: object RumMetricComputeIncludePercentiles: description: 'Toggle to include or exclude percentile aggregations for distribution metrics. Only present when `aggregation_type` is `distribution`.' example: true type: boolean RelationshipToUserTeamPermissionData: description: Related user team permission data properties: id: description: The ID of the user team permission example: UserTeamPermissions-aeadc05e-98a8-11ec-ac2c-da7ad0900001-416595 type: string type: $ref: '#/components/schemas/UserTeamPermissionType' required: - id - type type: object x-merge-override: required: false ObservabilityPipelineAmazonS3Destination: description: The `amazon_s3` destination sends your logs in Datadog-rehydratable format to an Amazon S3 bucket for archiving. properties: auth: $ref: '#/components/schemas/ObservabilityPipelineAwsAuth' bucket: description: S3 bucket name. example: error-logs type: string id: description: Unique identifier for the destination component. example: amazon-s3-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - datadog-agent-source items: type: string type: array key_prefix: description: Optional prefix for object keys. type: string example: example_value region: description: AWS region of the S3 bucket. example: us-east-1 type: string storage_class: $ref: '#/components/schemas/ObservabilityPipelineAmazonS3DestinationStorageClass' tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineAmazonS3DestinationType' required: - id - type - inputs - bucket - region - storage_class type: object ServiceDefinitionV2Dot2Type: description: The type of service. example: web type: string TimeAggregation: description: 'Time aggregation period (in seconds) is used to aggregate the results of the notification rule evaluation. Results are aggregated over a selected time frame using a rolling window, which updates with each new evaluation. Notifications are only sent for new issues discovered during the window. Time aggregation is only available for vulnerability-based notification rules. When omitted or set to 0, no aggregation is done.' example: 86400 format: int64 type: integer AWSNamespaceFiltersExcludeOnly: description: 'Exclude only these namespaces from metrics collection. Defaults to `["AWS/SQS", "AWS/ElasticMapReduce"]`. `AWS/SQS` and `AWS/ElasticMapReduce` are excluded by default to reduce your AWS CloudWatch costs from `GetMetricData` API calls.' properties: exclude_only: description: 'Exclude only these namespaces from metrics collection. Defaults to `["AWS/SQS", "AWS/ElasticMapReduce"]`. `AWS/SQS` and `AWS/ElasticMapReduce` are excluded by default to reduce your AWS CloudWatch costs from `GetMetricData` API calls.' example: - AWS/SQS - AWS/ElasticMapReduce items: example: AWS/SQS type: string type: array required: - exclude_only type: object ObservabilityPipelineFieldValue: description: Represents a static key-value pair used in various processors. properties: name: description: The field name. example: field_name type: string value: description: The field value. example: field_value type: string required: - name - value type: object CaseResponse: description: Case response properties: data: $ref: '#/components/schemas/Case' type: object ObservabilityPipelineDataAttributes: description: Defines the pipeline’s name and its components (sources, processors, and destinations). properties: config: $ref: '#/components/schemas/ObservabilityPipelineConfig' name: description: Name of the pipeline. example: Main Observability Pipeline type: string required: - name - config type: object Date: description: Date as Unix timestamp in milliseconds. example: 1722439510282 format: int64 type: integer EntityV3Service: additionalProperties: false description: Schema for service entities. properties: apiVersion: $ref: '#/components/schemas/EntityV3APIVersion' datadog: $ref: '#/components/schemas/EntityV3ServiceDatadog' extensions: additionalProperties: {} description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field. type: object x-ignore-duplicate-object: true integrations: $ref: '#/components/schemas/EntityV3Integrations' kind: $ref: '#/components/schemas/EntityV3ServiceKind' metadata: $ref: '#/components/schemas/EntityV3Metadata' spec: $ref: '#/components/schemas/EntityV3ServiceSpec' required: - apiVersion - kind - metadata type: object EntityResponseIncludedSchemaType: description: Schema type. enum: - schema type: string x-enum-varnames: - SCHEMA SpansMetricResponseGroupBy: description: A group by rule. properties: path: description: The path to the value the span-based metric will be aggregated over. example: resource_name type: string tag_name: description: Eventual name of the tag that gets created. By default, the path attribute is used as the tag name. example: resource_name type: string type: object ObservabilityPipelineDatadogAgentSourceType: default: datadog_agent description: The source type. The value should always be `datadog_agent`. enum: - datadog_agent example: datadog_agent type: string x-enum-varnames: - DATADOG_AGENT IncidentResponseIncludedItem: description: An object related to an incident that is included in the response. oneOf: - $ref: '#/components/schemas/IncidentUserData' - $ref: '#/components/schemas/IncidentAttachmentData' ObservabilityPipelineFluentBitSourceType: default: fluent_bit description: The source type. The value should always be `fluent_bit`. enum: - fluent_bit example: fluent_bit type: string x-enum-varnames: - FLUENT_BIT WorkflowDataType: description: The definition of `WorkflowDataType` object. enum: - workflows example: workflows type: string x-enum-varnames: - WORKFLOWS RoleCloneRequest: description: Request to create a role by cloning an existing role. properties: data: $ref: '#/components/schemas/RoleClone' required: - data type: object MonitorConfigPolicyResourceType: default: monitor-config-policy description: Monitor configuration policy resource type. enum: - monitor-config-policy example: monitor-config-policy type: string x-enum-varnames: - MONITOR_CONFIG_POLICY RelationshipToTeamLinkData: description: Relationship between a link and a team properties: id: description: The team link's identifier example: f9bb8444-af7f-11ec-ac2c-da7ad0900001 type: string type: $ref: '#/components/schemas/TeamLinkType' required: - id - type type: object x-merge-override: required: false RumMetricResponse: description: The rum-based metric object. properties: data: $ref: '#/components/schemas/RumMetricResponseData' type: object ActionQuerySpecInput: additionalProperties: {} description: The inputs to the action query. See the [Actions Catalog](https://docs.datadoghq.com/actions/actions_catalog/) for more detail on each action and its inputs. type: object RUMApplication: description: RUM application. properties: attributes: $ref: '#/components/schemas/RUMApplicationAttributes' id: description: RUM application ID. example: abcd1234-0000-0000-abcd-1234abcd5678 type: string x-merge-override: format: false type: $ref: '#/components/schemas/RUMApplicationType' required: - attributes - id - type type: object ServiceDefinitionV1ResourceType: description: Link type. enum: - doc - wiki - runbook - url - repo - dashboard - oncall - code - link example: runbook type: string x-enum-varnames: - DOC - WIKI - RUNBOOK - URL - REPO - DASHBOARD - ONCALL - CODE - LINK CaseStatus: description: Case status enum: - OPEN - IN_PROGRESS - CLOSED example: OPEN type: string x-enum-varnames: - OPEN - IN_PROGRESS - CLOSED TeamLinkType: default: team_links description: Team link type enum: - team_links example: team_links type: string x-enum-varnames: - TEAM_LINKS ServiceDefinitionV2Dot2Contact: description: Service owner's contacts information. properties: contact: description: Contact value. example: https://teams.microsoft.com/myteam type: string name: description: Contact Name. example: My team channel type: string type: description: 'Contact type. Datadog recognizes the following types: `email`, `slack`, and `microsoft-teams`.' example: slack type: string required: - type - contact type: object BudgetEntry: description: The entry of a budget. properties: amount: description: The `amount` of the budget entry. example: 500 format: double type: number month: description: The `month` of the budget entry. example: 202501 format: int64 type: integer tag_filters: description: The `tag_filters` of the budget entry. items: $ref: '#/components/schemas/TagFilter' type: array type: object CustomDestinationHttpDestinationAuth: description: Authentication method of the HTTP requests. oneOf: - $ref: '#/components/schemas/CustomDestinationHttpDestinationAuthBasic' - $ref: '#/components/schemas/CustomDestinationHttpDestinationAuthCustomHeader' AuthNMappingTeamAttributes: description: Team attributes. properties: avatar: description: Unicode representation of the avatar for the team, limited to a single grapheme example: 🥑 nullable: true type: string banner: description: Banner selection for the team format: int64 nullable: true type: integer example: 42 handle: description: The team's identifier example: example-team maxLength: 195 type: string link_count: description: The number of links belonging to the team format: int32 maximum: 2147483647 readOnly: true type: integer example: 42 name: description: The name of the team example: Example Team maxLength: 200 type: string summary: description: A brief summary of the team, derived from the `description` maxLength: 120 nullable: true type: string example: example_value user_count: description: The number of users belonging to the team format: int32 maximum: 2147483647 readOnly: true type: integer example: 42 type: object MicrosoftTeamsWorkflowsWebhookHandleResponse: description: Response of a Workflows webhook handle. properties: data: $ref: '#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleResponseData' required: - data type: object MonitorConfigPolicyAttributeCreateRequest: description: Policy and policy type for a monitor configuration policy. properties: policy: $ref: '#/components/schemas/MonitorConfigPolicyPolicyCreateRequest' policy_type: $ref: '#/components/schemas/MonitorConfigPolicyType' required: - policy_type - policy type: object EntityV3ServiceKind: description: The definition of Entity V3 Service Kind object. enum: - service example: service type: string x-enum-varnames: - SERVICE ObservabilityPipelineSensitiveDataScannerProcessorScopeAll: description: Applies scanning across all available fields. properties: target: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeAllTarget' required: - target type: object SecurityMonitoringStandardRuleCreatePayload: description: Create a new rule. properties: cases: description: Cases for generating signals. example: [] items: $ref: '#/components/schemas/SecurityMonitoringRuleCaseCreate' type: array filters: description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. items: $ref: '#/components/schemas/SecurityMonitoringFilter' type: array groupSignalsBy: description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. example: - service items: description: Field to group by. type: string type: array hasExtendedTitle: description: Whether the notifications include the triggering group-by values in their title. example: true type: boolean isEnabled: description: Whether the rule is enabled. example: true type: boolean message: description: Message for generated signals. example: '' type: string name: description: The name of the rule. example: My security monitoring rule. type: string options: $ref: '#/components/schemas/SecurityMonitoringRuleOptions' queries: description: Queries for selecting logs which are part of the rule. example: [] items: $ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery' type: array referenceTables: description: Reference tables for the rule. items: $ref: '#/components/schemas/SecurityMonitoringReferenceTable' type: array tags: description: Tags for generated signals. example: - env:prod - team:security items: description: Tag. type: string type: array thirdPartyCases: description: Cases for generating signals from third-party rules. Only available for third-party rules. example: [] items: $ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCaseCreate' type: array type: $ref: '#/components/schemas/SecurityMonitoringRuleTypeCreate' required: - name - isEnabled - queries - options - cases - message type: object CloudWorkloadSecurityAgentRuleType: default: agent_rule description: The type of the resource, must always be `agent_rule` enum: - agent_rule example: agent_rule type: string x-enum-varnames: - AGENT_RULE EntityV3DatadogIntegrationPagerduty: additionalProperties: false description: A PagerDuty integration schema. properties: serviceURL: description: The service URL for the PagerDuty integration. example: https://www.pagerduty.com/service-directory/Pshopping-cart minLength: 1 type: string required: - serviceURL type: object ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions: description: Fields to which the scope rule applies. properties: fields: description: The `ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions` `fields`. example: - '' items: type: string type: array required: - fields type: object RoleCreateRequest: description: Create a role. properties: data: $ref: '#/components/schemas/RoleCreateData' required: - data type: object AWSMetricsConfig: description: AWS Metrics Collection config. properties: automute_enabled: description: Enable EC2 automute for AWS metrics. Defaults to `true`. example: true type: boolean collect_cloudwatch_alarms: description: Enable CloudWatch alarms collection. Defaults to `false`. example: false type: boolean collect_custom_metrics: description: Enable custom metrics collection. Defaults to `false`. example: false type: boolean enabled: description: Enable AWS metrics collection. Defaults to `true`. example: true type: boolean namespace_filters: $ref: '#/components/schemas/AWSNamespaceFilters' tag_filters: description: AWS Metrics collection tag filters list. Defaults to `[]`. items: $ref: '#/components/schemas/AWSNamespaceTagFilter' type: array type: object ObservabilityPipelineSplunkHecDestinationEncoding: description: Encoding format for log events. enum: - json - raw_message example: json type: string x-enum-varnames: - JSON - RAW_MESSAGE RelationshipToIncidentUserDefinedFields: description: Relationship to incident user defined fields. properties: data: description: An array of user defined fields. items: $ref: '#/components/schemas/RelationshipToIncidentUserDefinedFieldData' type: array required: - data type: object OutcomesBatchResponseData: description: List of rule outcomes which were affected during the bulk operation. items: $ref: '#/components/schemas/OutcomesResponseDataItem' type: array DataTransform: description: A data transformer, which is custom JavaScript code that executes and transforms data when its inputs change. properties: id: description: The ID of the data transformer. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string name: description: A unique identifier for this data transformer. This name is also used to access the transformer's result throughout the app. example: combineTwoOrders type: string properties: $ref: '#/components/schemas/DataTransformProperties' type: $ref: '#/components/schemas/DataTransformType' required: - id - name - type - properties type: object UserResponseIncludedItem: description: An object related to a user. oneOf: - $ref: '#/components/schemas/Organization' - $ref: '#/components/schemas/Permission' - $ref: '#/components/schemas/Role' LayerType: default: layers description: Layers resource type. enum: - layers example: layers type: string x-enum-varnames: - LAYERS ObservabilityPipelineRsyslogSourceType: default: rsyslog description: The source type. The value should always be `rsyslog`. enum: - rsyslog example: rsyslog type: string x-enum-varnames: - RSYSLOG ObservabilityPipelineOcsfMappingLibrary: description: Predefined library mappings for common log formats. enum: - CloudTrail Account Change - GCP Cloud Audit CreateBucket - GCP Cloud Audit CreateSink - GCP Cloud Audit SetIamPolicy - GCP Cloud Audit UpdateSink - Github Audit Log API Activity - Google Workspace Admin Audit addPrivilege - Microsoft 365 Defender Incident - Microsoft 365 Defender UserLoggedIn - Okta System Log Authentication - Palo Alto Networks Firewall Traffic example: CloudTrail Account Change type: string x-enum-varnames: - CLOUDTRAIL_ACCOUNT_CHANGE - GCP_CLOUD_AUDIT_CREATEBUCKET - GCP_CLOUD_AUDIT_CREATESINK - GCP_CLOUD_AUDIT_SETIAMPOLICY - GCP_CLOUD_AUDIT_UPDATESINK - GITHUB_AUDIT_LOG_API_ACTIVITY - GOOGLE_WORKSPACE_ADMIN_AUDIT_ADDPRIVILEGE - MICROSOFT_365_DEFENDER_INCIDENT - MICROSOFT_365_DEFENDER_USERLOGGEDIN - OKTA_SYSTEM_LOG_AUTHENTICATION - PALO_ALTO_NETWORKS_FIREWALL_TRAFFIC ScheduleCreateRequestDataAttributesLayersItems: description: Describes a schedule layer, including rotation intervals, members, restrictions, and timeline settings. properties: effective_date: description: The date/time when this layer becomes active (in ISO 8601). example: '2025-01-01T00:00:00Z' format: date-time type: string end_date: description: The date/time after which this layer no longer applies (in ISO 8601). format: date-time type: string example: '2026-04-17T12:00:00Z' interval: $ref: '#/components/schemas/LayerAttributesInterval' members: description: A list of members who participate in this layer's rotation. items: $ref: '#/components/schemas/ScheduleRequestDataAttributesLayersItemsMembersItems' type: array name: description: The name of this layer. example: Primary On-Call Layer type: string restrictions: description: Zero or more time-based restrictions (for example, only weekdays, during business hours). items: $ref: '#/components/schemas/TimeRestriction' type: array rotation_start: description: The date/time when the rotation for this layer starts (in ISO 8601). example: '2025-01-01T00:00:00Z' format: date-time type: string required: - name - interval - rotation_start - effective_date - members type: object RuleSeverity: description: Severity of a security rule. enum: - critical - high - medium - low - unknown - info example: critical type: string x-enum-varnames: - CRITICAL - HIGH - MEDIUM - LOW - UNKNOWN - INFO CreateNotificationRuleParametersData: description: 'Data of the notification rule create request: the rule type, and the rule attributes. All fields are required.' properties: attributes: $ref: '#/components/schemas/CreateNotificationRuleParametersDataAttributes' type: $ref: '#/components/schemas/NotificationRulesType' required: - attributes - type type: object ActionQueryOnlyTriggerManually: description: Determines when this query is executed. If set to `false`, the query will run when the app loads and whenever any query arguments change. If set to `true`, the query will only run when manually triggered from elsewhere in the app. oneOf: - type: boolean - description: If this is a string, it must be a valid JavaScript expression that evaluates to a boolean. example: ${true} type: string IncidentTeamCreateRequest: description: Create request with an incident team payload. properties: data: $ref: '#/components/schemas/IncidentTeamCreateData' required: - data type: object CreateRuleResponseData: description: Create rule response data. properties: attributes: $ref: '#/components/schemas/RuleAttributes' id: $ref: '#/components/schemas/RuleId' relationships: $ref: '#/components/schemas/RelationshipToRule' type: $ref: '#/components/schemas/RuleType' type: object EscalationPolicyUserAttributes: description: Provides basic user information for an escalation policy, including a name and email address. properties: email: description: The user's email address. example: jane.doe@example.com type: string name: description: The user's name. example: Jane Doe type: string status: $ref: '#/components/schemas/UserAttributesStatus' type: object MicrosoftTeamsTenantBasedHandleResponse: description: Response of a tenant-based handle. properties: data: $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleResponseData' required: - data type: object CreateCustomFrameworkResponse: description: Response object to create a custom framework. properties: data: $ref: '#/components/schemas/FrameworkHandleAndVersionResponseData' required: - data type: object RestrictionQueryCreatePayload: description: Create a restriction query. properties: data: $ref: '#/components/schemas/RestrictionQueryCreateData' type: object ActionConnectionDataType: description: The definition of `ActionConnectionDataType` object. enum: - action_connection example: action_connection type: string x-enum-varnames: - ACTION_CONNECTION EscalationPolicyIncluded: description: Represents included related resources when retrieving an escalation policy, such as teams, steps, or targets. oneOf: - $ref: '#/components/schemas/TeamReference' - $ref: '#/components/schemas/EscalationPolicyStep' - $ref: '#/components/schemas/EscalationPolicyUser' - $ref: '#/components/schemas/ScheduleData' ServiceDefinitionV2Version: default: v2 description: Schema version being used. enum: - v2 example: v2 type: string x-enum-varnames: - V2 SecurityMonitoringSignalRuleQuery: description: Query for matching rule on signals. properties: aggregation: $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation' correlatedByFields: description: Fields to group by. items: description: Field. type: string type: array correlatedQueryIndex: description: Index of the rule query used to retrieve the correlated field. format: int32 maximum: 9 type: integer example: 42 metrics: description: Group of target fields to aggregate over. items: description: Field. type: string type: array name: description: Name of the query. type: string example: Example Monitor ruleId: description: Rule ID to match on signals. example: org-ru1-e1d type: string required: - ruleId type: object SecurityTriggerWrapper: description: Schema for a Security-based trigger. properties: securityTrigger: $ref: '#/components/schemas/SecurityTrigger' startStepNames: $ref: '#/components/schemas/StartStepNames' required: - securityTrigger type: object ScheduleDataRelationships: description: Groups the relationships for a schedule object, referencing layers and teams. properties: layers: $ref: '#/components/schemas/ScheduleDataRelationshipsLayers' teams: $ref: '#/components/schemas/DataRelationshipsTeams' type: object NotificationRuleResponse: description: Response object which includes a notification rule. properties: data: $ref: '#/components/schemas/NotificationRule' type: object RumRetentionFilterResponse: description: The RUM retention filter object. properties: data: $ref: '#/components/schemas/RumRetentionFilterData' type: object LogsRestrictionQueriesType: default: logs_restriction_queries description: Restriction query resource type. enum: - logs_restriction_queries example: logs_restriction_queries type: string x-enum-varnames: - LOGS_RESTRICTION_QUERIES EntityAttributes: description: Entity attributes. properties: apiVersion: description: The API version. type: string example: example_value description: description: The description. type: string example: example_value displayName: description: The display name. type: string example: Example Monitor kind: description: The kind. type: string example: example_value name: description: The name. type: string example: Example Monitor namespace: description: The namespace. type: string example: Example Monitor owner: description: The owner. type: string example: example_value tags: description: The tags. items: type: string type: array type: object MonitorConfigPolicyTagPolicyCreateRequest: description: Tag attributes of a monitor configuration policy. properties: tag_key: description: The key of the tag. example: datacenter maxLength: 255 type: string tag_key_required: description: If a tag key is required for monitor creation. example: true type: boolean valid_tag_values: description: Valid values for the tag. example: - prod - staging items: maxLength: 255 type: string type: array required: - tag_key - tag_key_required - valid_tag_values type: object ServiceDefinitionV2Dot1MSTeamsType: description: Contact type. enum: - microsoft-teams example: microsoft-teams type: string x-enum-varnames: - MICROSOFT_TEAMS APIErrorResponse: description: API error response. properties: errors: description: A list of errors. example: - Bad Request items: description: A list of items. example: Bad Request type: string type: array required: - errors type: object ObservabilityPipelineAmazonOpenSearchDestination: description: The `amazon_opensearch` destination writes logs to Amazon OpenSearch. properties: auth: $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestinationAuth' bulk_index: description: The index to write logs to. example: logs-index type: string id: description: The unique identifier for this component. example: elasticsearch-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestinationType' required: - id - type - inputs - auth type: object LogsMetricID: description: The name of the log-based metric. example: logs.page.load.count type: string ActionQueryRequiresConfirmation: description: Whether to prompt the user to confirm this query before it runs. oneOf: - type: boolean - description: If this is a string, it must be a valid JavaScript expression that evaluates to a boolean. example: ${true} type: string ObservabilityPipelineEnrichmentTableGeoIp: description: Uses a GeoIP database to enrich logs based on an IP field. properties: key_field: description: Path to the IP field in the log. example: log.source.ip type: string locale: description: Locale used to resolve geographical names. example: en type: string path: description: Path to the GeoIP database file. example: /etc/geoip/GeoLite2-City.mmdb type: string required: - key_field - locale - path type: object LayerRelationshipsMembersDataItemsType: default: members description: Members resource type. enum: - members example: members type: string x-enum-varnames: - MEMBERS OpenAPIFile: description: Object for API data in an `OpenAPI` format as a file. properties: openapi_spec_file: description: Binary `OpenAPI` spec file format: binary type: string example: example_value type: object RunRetentionFilterName: description: The name of a RUM retention filter. example: Retention filter for session type: string IncidentResponseAttributes: description: The incident's attributes from a response. properties: archived: description: Timestamp of when the incident was archived. format: date-time nullable: true readOnly: true type: string example: example_value case_id: description: The incident case id. format: int64 nullable: true type: integer example: 42 created: description: Timestamp when the incident was created. format: date-time readOnly: true type: string example: example_value customer_impact_duration: description: 'Length of the incident''s customer impact in seconds. Equals the difference between `customer_impact_start` and `customer_impact_end`.' format: int64 readOnly: true type: integer example: 42 customer_impact_end: description: Timestamp when customers were no longer impacted by the incident. format: date-time nullable: true type: string example: example_value customer_impact_scope: description: A summary of the impact customers experienced during the incident. example: An example customer impact scope nullable: true type: string customer_impact_start: description: Timestamp when customers began being impacted by the incident. format: date-time nullable: true type: string example: example_value customer_impacted: description: A flag indicating whether the incident caused customer impact. example: false type: boolean detected: description: Timestamp when the incident was detected. format: date-time nullable: true type: string example: example_value fields: additionalProperties: $ref: '#/components/schemas/IncidentFieldAttributes' description: A condensed view of the user-defined fields attached to incidents. example: severity: type: dropdown value: SEV-5 type: object incident_type_uuid: description: A unique identifier that represents an incident type. example: 00000000-0000-0000-0000-000000000000 type: string modified: description: Timestamp when the incident was last modified. format: date-time readOnly: true type: string example: example_value non_datadog_creator: $ref: '#/components/schemas/IncidentNonDatadogCreator' notification_handles: description: Notification handles that will be notified of the incident during update. example: - display_name: Jane Doe handle: '@user@email.com' - display_name: Slack Channel handle: '@slack-channel' - display_name: Incident Workflow handle: '@workflow-from-incident' items: $ref: '#/components/schemas/IncidentNotificationHandle' nullable: true type: array public_id: description: The monotonically increasing integer ID for the incident. example: 1 format: int64 type: integer resolved: description: Timestamp when the incident's state was last changed from active or stable to resolved or completed. format: date-time nullable: true type: string example: example_value severity: $ref: '#/components/schemas/IncidentSeverity' state: description: The state incident. nullable: true type: string example: example_value time_to_detect: description: 'The amount of time in seconds to detect the incident. Equals the difference between `customer_impact_start` and `detected`.' format: int64 readOnly: true type: integer example: 42 time_to_internal_response: description: The amount of time in seconds to call incident after detection. Equals the difference of `detected` and `created`. format: int64 readOnly: true type: integer example: 42 time_to_repair: description: The amount of time in seconds to resolve customer impact after detecting the issue. Equals the difference between `customer_impact_end` and `detected`. format: int64 readOnly: true type: integer example: 42 time_to_resolve: description: The amount of time in seconds to resolve the incident after it was created. Equals the difference between `created` and `resolved`. format: int64 readOnly: true type: integer example: 42 title: description: The title of the incident, which summarizes what happened. example: A test incident title type: string visibility: description: The incident visibility status. nullable: true type: string example: example_value required: - title type: object RetentionFilterType: default: spans-sampling-processor description: The type of retention filter. The value should always be spans-sampling-processor. enum: - spans-sampling-processor example: spans-sampling-processor type: string x-enum-varnames: - SPANS_SAMPLING_PROCESSOR BudgetWithEntries: description: The definition of the `BudgetWithEntries` object. properties: data: $ref: '#/components/schemas/BudgetWithEntriesData' type: object EntityV3MetadataAdditionalOwnersItems: description: The definition of Entity V3 Metadata Additional Owners Items object. properties: name: description: Team name. example: '' type: string type: description: Team type. type: string example: metric alert required: - name type: object ApplicationSecurityWafCustomRuleActionParameters: description: The definition of `ApplicationSecurityWafCustomRuleActionParameters` object. properties: location: description: The location to redirect to when the WAF custom rule triggers. example: /blocking type: string status_code: default: 403 description: The status code to return when the WAF custom rule triggers. example: 403 format: int64 type: integer type: object RetentionFilterCreateResponse: description: The retention filters definition. properties: data: $ref: '#/components/schemas/RetentionFilter' type: object ProjectCreate: description: Project create properties: attributes: $ref: '#/components/schemas/ProjectCreateAttributes' type: $ref: '#/components/schemas/ProjectResourceType' required: - attributes - type type: object ServiceDefinitionV2Dot1MSTeams: description: Service owner's Microsoft Teams. properties: contact: description: Contact value. example: https://teams.microsoft.com/myteam type: string name: description: Contact Microsoft Teams. example: My team channel type: string type: $ref: '#/components/schemas/ServiceDefinitionV2Dot1MSTeamsType' required: - type - contact type: object SensitiveDataScannerRuleType: default: sensitive_data_scanner_rule description: Sensitive Data Scanner rule type. enum: - sensitive_data_scanner_rule example: sensitive_data_scanner_rule type: string x-enum-varnames: - SENSITIVE_DATA_SCANNER_RULE RelationshipToSAMLAssertionAttribute: description: AuthN Mapping relationship to SAML Assertion Attribute. properties: data: $ref: '#/components/schemas/RelationshipToSAMLAssertionAttributeData' required: - data type: object AWSNamespaceFilters: description: AWS Metrics namespace filters. Defaults to `exclude_only`. oneOf: - $ref: '#/components/schemas/AWSNamespaceFiltersExcludeOnly' - $ref: '#/components/schemas/AWSNamespaceFiltersIncludeOnly' ReadinessGate: description: Used to merge multiple branches into a single branch. properties: thresholdType: $ref: '#/components/schemas/ReadinessGateThresholdType' required: - thresholdType type: object AuthNMappingCreateRequest: description: Request for creating an AuthN Mapping. properties: data: $ref: '#/components/schemas/AuthNMappingCreateData' required: - data type: object EntityV3DatadogPipelines: additionalProperties: false description: CI Pipelines association. properties: fingerprints: description: A list of CI Fingerprints that associate CI Pipelines with the entity. items: type: string type: array type: object EntityV3System: additionalProperties: false description: Schema for system entities. properties: apiVersion: $ref: '#/components/schemas/EntityV3APIVersion' datadog: $ref: '#/components/schemas/EntityV3SystemDatadog' extensions: additionalProperties: {} description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field. type: object x-ignore-duplicate-object: true integrations: $ref: '#/components/schemas/EntityV3Integrations' kind: $ref: '#/components/schemas/EntityV3SystemKind' metadata: $ref: '#/components/schemas/EntityV3Metadata' spec: $ref: '#/components/schemas/EntityV3SystemSpec' required: - apiVersion - kind - metadata type: object EscalationPolicyData: description: Represents the data for a single escalation policy, including its attributes, ID, relationships, and resource type. properties: attributes: $ref: '#/components/schemas/EscalationPolicyDataAttributes' id: description: Specifies the unique identifier of the escalation policy. example: ab000000-0000-0000-0000-000000000000 type: string relationships: $ref: '#/components/schemas/EscalationPolicyDataRelationships' type: $ref: '#/components/schemas/EscalationPolicyDataType' required: - type type: object EntityV3MetadataLinksItems: additionalProperties: false description: The definition of Entity V3 Metadata Links Items object. properties: name: description: Link name. example: mylink type: string provider: description: Link provider. type: string example: abc-123-def type: default: other description: Link type. example: link type: string url: description: Link URL. example: https://mylink type: string required: - name - type - url type: object RelationshipToOrganizations: description: Relationship to organizations. properties: data: description: Relationships to organization objects. example: [] items: $ref: '#/components/schemas/RelationshipToOrganizationData' type: array required: - data type: object LeakedKeyType: default: leaked_keys description: The definition of LeakedKeyType object. enum: - leaked_keys example: leaked_keys type: string x-enum-varnames: - LEAKED_KEYS WorkflowData: description: Data related to the workflow. properties: attributes: $ref: '#/components/schemas/WorkflowDataAttributes' id: description: The workflow identifier readOnly: true type: string example: abc-123-def relationships: $ref: '#/components/schemas/WorkflowDataRelationships' type: $ref: '#/components/schemas/WorkflowDataType' required: - type - attributes type: object EscalationPolicyCreateRequestDataAttributesStepsItems: description: Defines a single escalation step within an escalation policy creation request. Contains assignment strategy, escalation timeout, and a list of targets. properties: assignment: $ref: '#/components/schemas/EscalationPolicyStepAttributesAssignment' escalate_after_seconds: description: Defines how many seconds to wait before escalating to the next step. example: 3600 format: int64 type: integer targets: description: Specifies the collection of escalation targets for this step. example: - users items: $ref: '#/components/schemas/EscalationPolicyStepTarget' type: array required: - targets type: object RUMApplicationCreate: description: RUM application creation. properties: attributes: $ref: '#/components/schemas/RUMApplicationCreateAttributes' type: $ref: '#/components/schemas/RUMApplicationCreateType' required: - attributes - type type: object x-merge-override: required: false SecurityFilterType: default: security_filters description: The type of the resource. The value should always be `security_filters`. enum: - security_filters example: security_filters type: string x-enum-varnames: - SECURITY_FILTERS WorkflowUserRelationshipData: description: The definition of `WorkflowUserRelationshipData` object. properties: id: description: The user identifier example: '' type: string type: $ref: '#/components/schemas/WorkflowUserRelationshipType' required: - type - id type: object NullableRelationshipToUser: description: Relationship to user. nullable: true properties: data: $ref: '#/components/schemas/NullableRelationshipToUserData' required: - data type: object IncidentTriggerWrapper: description: Schema for an Incident-based trigger. properties: incidentTrigger: $ref: '#/components/schemas/IncidentTrigger' startStepNames: $ref: '#/components/schemas/StartStepNames' required: - incidentTrigger type: object SecurityMonitoringRuleNewValueOptions: description: Options on new value detection method. properties: forgetAfter: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsForgetAfter' learningDuration: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningDuration' learningMethod: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningMethod' learningThreshold: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptionsLearningThreshold' type: object SensitiveDataScannerRule: description: Rule item included in the group. properties: id: description: ID of the rule. type: string example: abc-123-def type: $ref: '#/components/schemas/SensitiveDataScannerRuleType' type: object ServiceDefinitionV1: deprecated: true description: Deprecated - Service definition V1 for providing additional service metadata and integrations. properties: contact: $ref: '#/components/schemas/ServiceDefinitionV1Contact' extensions: additionalProperties: {} description: Extensions to V1 schema. example: myorg/extension: extensionValue type: object external-resources: description: A list of external links related to the services. items: $ref: '#/components/schemas/ServiceDefinitionV1Resource' type: array info: $ref: '#/components/schemas/ServiceDefinitionV1Info' integrations: $ref: '#/components/schemas/ServiceDefinitionV1Integrations' org: $ref: '#/components/schemas/ServiceDefinitionV1Org' schema-version: $ref: '#/components/schemas/ServiceDefinitionV1Version' tags: description: A set of custom tags. example: - my:tag - service:tag items: type: string type: array required: - schema-version - info type: object HTTPToken: description: The definition of `HTTPToken` object. properties: name: description: The `HTTPToken` `name`. example: MyToken pattern: ^[A-Za-z][A-Za-z\\d]*$ type: string type: $ref: '#/components/schemas/TokenType' value: description: The `HTTPToken` `value`. example: Some Token Value type: string required: - name - value - type type: object ObservabilityPipelineSumoLogicDestinationEncoding: description: The output encoding format. enum: - json - raw_message - logfmt example: json type: string x-enum-varnames: - JSON - RAW_MESSAGE - LOGFMT LogsArchiveCreateRequestAttributes: description: The attributes associated with the archive. properties: destination: $ref: '#/components/schemas/LogsArchiveCreateRequestDestination' include_tags: default: false description: 'To store the tags in the archive, set the value "true". If it is set to "false", the tags will be deleted when the logs are sent to the archive.' example: false type: boolean name: description: The archive name. example: Nginx Archive type: string query: description: The archive query/filter. Logs matching this query are included in the archive. example: source:nginx type: string rehydration_max_scan_size_in_gb: description: Maximum scan size for rehydration from this archive. example: 100 format: int64 nullable: true type: integer rehydration_tags: description: An array of tags to add to rehydrated logs from an archive. example: - team:intake - team:app items: description: A given tag in the `:` format. type: string type: array required: - name - query - destination type: object AWSAccountConfigID: description: 'Unique Datadog ID of the AWS Account Integration Config. To get the config ID for an account, use the [List all AWS integrations](https://docs.datadoghq.com/api/latest/aws-integration/#list-all-aws-integrations) endpoint and query by AWS Account ID.' example: 00000000-abcd-0001-0000-000000000000 type: string ExternalUserGroupMeta: description: Metadata associated with a group. properties: created: description: The date and time the group was created. example: '2024-10-17T12:53:35.793Z' format: date-time type: string lastModified: description: The date and time the group was last changed. example: '2024-10-19T12:53:35.793Z' format: date-time type: string location: description: URL identifying the resource. example: https://app.datadoghq.com/api/scim/v2/Groups/429ebce5-8ed3-4da9-9f1e-662f2dbc2fe6 type: string resourceType: description: Type of resource. example: Group type: string type: object CustomDestinationForwardDestinationHttp: description: The HTTP destination. properties: auth: $ref: '#/components/schemas/CustomDestinationHttpDestinationAuth' endpoint: description: 'The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.' example: https://example.com type: string type: $ref: '#/components/schemas/CustomDestinationForwardDestinationHttpType' required: - type - endpoint - auth type: object Project: description: A Project properties: attributes: $ref: '#/components/schemas/ProjectAttributes' id: description: The Project's identifier example: aeadc05e-98a8-11ec-ac2c-da7ad0900001 type: string relationships: $ref: '#/components/schemas/ProjectRelationships' type: $ref: '#/components/schemas/ProjectResourceType' required: - id - type - attributes type: object DataTransformType: default: dataTransform description: The data transform type. enum: - dataTransform example: dataTransform type: string x-enum-varnames: - DATATRANSFORM ExternalUserGroupMembersItems: description: The definition of a member belonging to a group. properties: $ref: description: The URI corresponding to a SCIM resource that is a member of this group. example: https://app.datadoghq.com/api/scim/v2/Users/429ebce5-8ed3-4da9-9f1e-662f2dbc2fe6 type: string display: description: A human-readable name for the group member. example: John Doe type: string type: description: A label indicating the type of resource. example: User type: string value: description: The identifier of the member of this group. example: 429ebce5-8ed3-4da9-9f1e-662f2dbc2fe6 type: string type: object IncidentAttachmentRelatedObject: description: The object related to an incident attachment. enum: - users type: string x-enum-varnames: - USERS JSONAPIErrorItem: description: API error response body properties: detail: description: A human-readable explanation specific to this occurrence of the error. example: Missing required attribute in body type: string meta: additionalProperties: {} description: Non-standard meta-information about the error type: object source: $ref: '#/components/schemas/JSONAPIErrorItemSource' status: description: Status code of the response. example: '400' type: string title: description: Short human-readable summary of the error. example: Bad Request type: string type: object CustomDestinationResponseHttpDestinationAuthCustomHeader: description: Custom header access authentication. properties: header_name: description: The header name of the authentication. example: CUSTOM-HEADER-NAME type: string type: $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuthCustomHeaderType' required: - type - header_name type: object SensitiveDataScannerRuleCreate: description: Data related to the creation of a rule. properties: attributes: $ref: '#/components/schemas/SensitiveDataScannerRuleAttributes' relationships: $ref: '#/components/schemas/SensitiveDataScannerRuleRelationships' type: $ref: '#/components/schemas/SensitiveDataScannerRuleType' required: - type - attributes - relationships type: object MetricCustomAggregations: description: Deprecated. You no longer need to configure specific time and space aggregations for Metrics Without Limits. example: - space: sum time: sum - space: sum time: count items: $ref: '#/components/schemas/MetricCustomAggregation' type: array LeakedKeyAttributes: description: The definition of LeakedKeyAttributes object. properties: date: description: The LeakedKeyAttributes date. example: '2017-07-21T17:32:28Z' format: date-time type: string leak_source: description: The LeakedKeyAttributes leak_source. type: string example: example_value required: - date type: object AuthNMappingResponse: description: AuthN Mapping response from the API. properties: data: $ref: '#/components/schemas/AuthNMapping' included: description: Included data in the AuthN Mapping response. items: $ref: '#/components/schemas/AuthNMappingIncluded' type: array type: object SecurityMonitoringStandardRuleQuery: description: Query for matching rule. properties: aggregation: $ref: '#/components/schemas/SecurityMonitoringRuleQueryAggregation' dataSource: $ref: '#/components/schemas/SecurityMonitoringStandardDataSource' distinctFields: description: Field for which the cardinality is measured. Sent as an array. items: description: Field. type: string type: array groupByFields: description: Fields to group by. items: description: Field. type: string type: array hasOptionalGroupByFields: description: When false, events without a group-by value are ignored by the rule. When true, events with missing group-by fields are processed with `N/A`, replacing the missing values. example: false readOnly: true type: boolean metric: deprecated: true description: '(Deprecated) The target field to aggregate over when using the sum or max aggregations. `metrics` field should be used instead.' type: string example: example_value metrics: description: Group of target fields to aggregate over when using the sum, max, geo data, or new value aggregations. The sum, max, and geo data aggregations only accept one value in this list, whereas the new value aggregation accepts up to five values. items: description: Field. type: string type: array name: description: Name of the query. type: string example: Example Monitor query: description: Query to run on logs. example: a > 3 type: string type: object ScheduleMemberRelationshipsUser: description: Wraps the user data reference for a schedule member. properties: data: $ref: '#/components/schemas/ScheduleMemberRelationshipsUserData' required: - data type: object AzureUCConfigPostData: description: Azure config Post data. properties: attributes: $ref: '#/components/schemas/AzureUCConfigPostRequestAttributes' type: $ref: '#/components/schemas/AzureUCConfigPostRequestType' required: - attributes - type type: object PageUrgency: default: high description: On-Call Page urgency level. enum: - low - high example: high type: string x-enum-varnames: - LOW - HIGH MetricCustomSpaceAggregation: description: A space aggregation for use in query. enum: - avg - max - min - sum example: sum type: string x-enum-varnames: - AVG - MAX - MIN - SUM EntityV3MetadataContactsItems: additionalProperties: false description: The definition of Entity V3 Metadata Contacts Items object. properties: contact: description: Contact value. example: https://slack/ type: string name: description: Contact name. minLength: 2 type: string example: Example Monitor type: description: Contact type. example: slack type: string required: - type - contact type: object ObservabilityPipelineElasticsearchDestination: description: The `elasticsearch` destination writes logs to an Elasticsearch cluster. properties: api_version: $ref: '#/components/schemas/ObservabilityPipelineElasticsearchDestinationApiVersion' bulk_index: description: The index to write logs to in Elasticsearch. example: logs-index type: string id: description: The unique identifier for this component. example: elasticsearch-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineElasticsearchDestinationType' required: - id - type - inputs type: object ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternType: description: Indicates a custom regular expression is used for matching. enum: - custom example: custom type: string x-enum-varnames: - CUSTOM CreateOpenAPIResponseAttributes: description: Attributes for `CreateOpenAPI`. properties: failed_endpoints: description: List of endpoints which couldn't be parsed. items: $ref: '#/components/schemas/OpenAPIEndpoint' type: array type: object ObservabilityPipelineGcpAuth: description: 'GCP credentials used to authenticate with Google Cloud Storage. ' properties: credentials_file: description: Path to the GCP service account key file. example: /var/secrets/gcp-credentials.json type: string required: - credentials_file type: object ObservabilityPipelineRenameFieldsProcessor: description: The `rename_fields` processor changes field names. properties: fields: description: A list of rename rules specifying which fields to rename in the event, what to rename them to, and whether to preserve the original fields. items: $ref: '#/components/schemas/ObservabilityPipelineRenameFieldsProcessorField' type: array id: description: A unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: rename-fields-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - datadog-agent-source items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineRenameFieldsProcessorType' required: - id - type - include - fields - inputs type: object IncidentTeamIncludedItems: description: An object related to an incident team which is present in the included payload. oneOf: - $ref: '#/components/schemas/User' ProjectResponse: description: Project response properties: data: $ref: '#/components/schemas/Project' type: object ObservabilityPipelineThrottleProcessorType: default: throttle description: The processor type. The value should always be `throttle`. enum: - throttle example: throttle type: string x-enum-varnames: - THROTTLE ObservabilityPipelineSampleProcessorType: default: sample description: The processor type. The value should always be `sample`. enum: - sample example: sample type: string x-enum-varnames: - SAMPLE ObservabilityPipelineEnrichmentTableProcessorType: default: enrichment_table description: The processor type. The value should always be `enrichment_table`. enum: - enrichment_table example: enrichment_table type: string x-enum-varnames: - ENRICHMENT_TABLE RelationshipArray: description: Relationships. items: $ref: '#/components/schemas/RelationshipItem' type: array SecurityMonitoringRuleSeverity: description: Severity of the Security Signal. enum: - info - low - medium - high - critical example: critical type: string x-enum-varnames: - INFO - LOW - MEDIUM - HIGH - CRITICAL ObservabilityPipelineSyslogSourceMode: description: Protocol used by the syslog source to receive messages. enum: - tcp - udp example: tcp type: string x-enum-varnames: - TCP - UDP OpsgenieServiceResponseAttributes: description: The attributes from an Opsgenie service response. properties: custom_url: description: The custom URL for a custom region. example: null nullable: true type: string name: description: The name for the Opsgenie service. example: fake-opsgenie-service-name maxLength: 100 type: string region: $ref: '#/components/schemas/OpsgenieServiceRegionType' type: object x-merge-override: required: false ObservabilityPipelineSplunkHecDestinationType: default: splunk_hec description: The destination type. Always `splunk_hec`. enum: - splunk_hec example: splunk_hec type: string x-enum-varnames: - SPLUNK_HEC SensitiveDataScannerGroupData: description: A scanning group data. properties: data: $ref: '#/components/schemas/SensitiveDataScannerGroup' type: object IncidentCreateRelationships: description: The relationships the incident will have with other resources once created. properties: commander_user: $ref: '#/components/schemas/NullableRelationshipToUser' required: - commander_user type: object SpansMetricCreateRequest: description: The new span-based metric body. properties: data: $ref: '#/components/schemas/SpansMetricCreateData' required: - data type: object RumRetentionFilterQuery: description: The query string for a RUM retention filter. example: '@session.has_replay:true' type: string SensitiveDataScannerGroupAttributes: description: Attributes of the Sensitive Data Scanner group. properties: description: description: Description of the group. type: string example: example_value filter: $ref: '#/components/schemas/SensitiveDataScannerFilter' is_enabled: description: Whether or not the group is enabled. type: boolean example: true name: description: Name of the group. type: string example: Example Monitor product_list: description: List of products the scanning group applies. items: $ref: '#/components/schemas/SensitiveDataScannerProduct' type: array type: object RestrictionQueryCreateAttributes: description: Attributes of the created restriction query. properties: restriction_query: description: The restriction query. example: env:sandbox type: string type: object IncidentAttachmentUpdateData: description: A single incident attachment. properties: attributes: $ref: '#/components/schemas/IncidentAttachmentUpdateAttributes' id: description: A unique identifier that represents the incident attachment. example: 00000000-abcd-0001-0000-000000000000 type: string type: $ref: '#/components/schemas/IncidentAttachmentType' required: - type type: object ServiceDefinitionV2Dot1Email: description: Service owner's email. properties: contact: description: Contact value. example: contact@datadoghq.com type: string name: description: Contact email. example: Team Email type: string type: $ref: '#/components/schemas/ServiceDefinitionV2Dot1EmailType' required: - type - contact type: object SensitiveDataScannerRuleRelationships: description: Relationships of a scanning rule. properties: group: $ref: '#/components/schemas/SensitiveDataScannerGroupData' standard_pattern: $ref: '#/components/schemas/SensitiveDataScannerStandardPatternData' type: object ApplicationKeyCreateRequest: description: Request used to create an application key. properties: data: $ref: '#/components/schemas/ApplicationKeyCreateData' required: - data type: object CreateNotificationRuleParametersDataAttributes: description: Attributes of the notification rule create request. properties: enabled: $ref: '#/components/schemas/Enabled' name: $ref: '#/components/schemas/RuleName' selectors: $ref: '#/components/schemas/Selectors' targets: $ref: '#/components/schemas/Targets' time_aggregation: $ref: '#/components/schemas/TimeAggregation' required: - selectors - name - targets type: object RoleResponseRelationships: description: Relationships of the role object returned by the API. properties: permissions: $ref: '#/components/schemas/RelationshipToPermissions' type: object EntityV3ServiceSpec: additionalProperties: false description: The definition of Entity V3 Service Spec object. properties: componentOf: description: A list of components the service is a part of items: type: string type: array dependsOn: description: A list of components the service depends on. items: type: string type: array languages: description: The service's programming language. items: type: string type: array lifecycle: description: The lifecycle state of the component. minLength: 1 type: string example: example_value tier: description: The importance of the component. minLength: 1 type: string example: example_value type: description: The type of service. type: string example: metric alert type: object InputSchemaParameters: description: The definition of `InputSchemaParameters` object. properties: defaultValue: description: The `InputSchemaParameters` `defaultValue`. example: example_value description: description: The `InputSchemaParameters` `description`. type: string example: example_value label: description: The `InputSchemaParameters` `label`. type: string example: example_value name: description: The `InputSchemaParameters` `name`. example: '' type: string type: $ref: '#/components/schemas/InputSchemaParametersType' required: - name - type type: object ObservabilityPipelineAddEnvVarsProcessorVariable: description: Defines a mapping between an environment variable and a log field. properties: field: description: The target field in the log event. example: log.environment.region type: string name: description: The name of the environment variable to read. example: AWS_REGION type: string required: - field - name type: object EntityV3Queue: additionalProperties: false description: Schema for queue entities. properties: apiVersion: $ref: '#/components/schemas/EntityV3APIVersion' datadog: $ref: '#/components/schemas/EntityV3QueueDatadog' extensions: additionalProperties: {} description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field. type: object x-ignore-duplicate-object: true integrations: $ref: '#/components/schemas/EntityV3Integrations' kind: $ref: '#/components/schemas/EntityV3QueueKind' metadata: $ref: '#/components/schemas/EntityV3Metadata' spec: $ref: '#/components/schemas/EntityV3QueueSpec' required: - apiVersion - kind - metadata type: object SecurityFilterExclusionFilterResponse: description: A single exclusion filter. properties: name: description: The exclusion filter name. example: Exclude staging type: string query: description: The exclusion filter query. example: source:staging type: string type: object IncidentRespondersType: description: The incident responders type. enum: - incident_responders example: incident_responders type: string x-enum-varnames: - INCIDENT_RESPONDERS ApmRetentionFilterType: default: apm_retention_filter description: The type of the resource. enum: - apm_retention_filter example: apm_retention_filter type: string x-enum-varnames: - apm_retention_filter RelationshipToIncidentAttachmentData: description: The attachment relationship data. properties: id: description: A unique identifier that represents the attachment. example: 00000000-0000-abcd-1000-000000000000 type: string type: $ref: '#/components/schemas/IncidentAttachmentType' required: - id - type type: object x-merge-override: required: false ObservabilityPipelineQuotaProcessorType: default: quota description: The processor type. The value should always be `quota`. enum: - quota example: quota type: string x-enum-varnames: - QUOTA JiraIssue: description: Jira issue attached to case nullable: true properties: result: $ref: '#/components/schemas/JiraIssueResult' status: $ref: '#/components/schemas/Case3rdPartyTicketStatus' readOnly: true type: object ApplicationSecurityWafExclusionFilterType: default: exclusion_filter description: Type of the resource. The value should always be `exclusion_filter`. enum: - exclusion_filter example: exclusion_filter type: string x-enum-varnames: - EXCLUSION_FILTER ObservabilityPipelineReduceProcessorType: default: reduce description: The processor type. The value should always be `reduce`. enum: - reduce example: reduce type: string x-enum-varnames: - REDUCE EscalationPolicyDataAttributes: description: Defines the main attributes of an escalation policy, such as its name and behavior on policy end. properties: name: description: Specifies the name of the escalation policy. example: On-Call Escalation Policy type: string resolve_page_on_policy_end: description: Indicates whether the page is automatically resolved when the policy ends. type: boolean example: true retries: description: Specifies how many times the escalation sequence is retried if there is no response. format: int64 type: integer example: 42 required: - name type: object ObservabilityPipelineTls: description: Configuration for enabling TLS encryption between the pipeline component and external services. properties: ca_file: description: Path to the Certificate Authority (CA) file used to validate the server’s TLS certificate. type: string example: example_value crt_file: description: Path to the TLS client certificate file used to authenticate the pipeline component with upstream or downstream services. example: /path/to/cert.crt type: string key_file: description: Path to the private key file associated with the TLS client certificate. Used for mutual TLS authentication. type: string example: example_value required: - crt_file type: object EntityRelationships: description: Entity relationships. properties: incidents: $ref: '#/components/schemas/EntityToIncidents' oncall: $ref: '#/components/schemas/EntityToOncalls' rawSchema: $ref: '#/components/schemas/EntityToRawSchema' relatedEntities: $ref: '#/components/schemas/EntityToRelatedEntities' schema: $ref: '#/components/schemas/EntityToSchema' type: object ServiceDefinitionV2Dot1Contact: description: Service owner's contacts information. oneOf: - $ref: '#/components/schemas/ServiceDefinitionV2Dot1Email' - $ref: '#/components/schemas/ServiceDefinitionV2Dot1Slack' - $ref: '#/components/schemas/ServiceDefinitionV2Dot1MSTeams' LogsArchiveDestinationS3: description: The S3 archive destination. properties: bucket: description: The bucket where the archive will be stored. example: bucket-name type: string encryption: $ref: '#/components/schemas/LogsArchiveEncryptionS3' integration: $ref: '#/components/schemas/LogsArchiveIntegrationS3' path: description: The archive path. type: string example: example_value storage_class: $ref: '#/components/schemas/LogsArchiveStorageClassS3Type' type: $ref: '#/components/schemas/LogsArchiveDestinationS3Type' required: - bucket - integration - type type: object ObservabilityPipelineEnrichmentTableFileSchemaItemsType: description: Declares allowed data types for enrichment table columns. enum: - string - boolean - integer - float - date - timestamp example: string type: string x-enum-varnames: - STRING - BOOLEAN - INTEGER - FLOAT - DATE - TIMESTAMP ObservabilityPipelineRenameFieldsProcessorField: description: Defines how to rename a field in log events. properties: destination: description: The field name to assign the renamed value to. example: destination_field type: string preserve_source: description: Indicates whether the original field, that is received from the source, should be kept (`true`) or removed (`false`) after renaming. example: false type: boolean source: description: The original field name in the log event that should be renamed. example: source_field type: string required: - source - destination - preserve_source type: object MetricTagConfiguration: description: Object for a single metric tag configuration. example: attributes: aggregations: - space: avg time: avg created_at: '2020-03-25T09:48:37.463835Z' metric_type: gauge modified_at: '2020-04-25T09:48:37.463835Z' tags: - app - datacenter id: http.request.latency type: manage_tags properties: attributes: $ref: '#/components/schemas/MetricTagConfigurationAttributes' id: $ref: '#/components/schemas/MetricName' type: $ref: '#/components/schemas/MetricTagConfigurationType' type: object IncidentServiceResponse: description: Response with an incident service payload. properties: data: $ref: '#/components/schemas/IncidentServiceResponseData' included: description: Included objects from relationships. items: $ref: '#/components/schemas/IncidentServiceIncludedItems' readOnly: true type: array required: - data type: object SecurityMonitoringRuleNewValueOptionsLearningMethod: default: duration description: The learning method used to determine when signals should be generated for values that weren't learned. enum: - duration - threshold type: string x-enum-varnames: - DURATION - THRESHOLD SensitiveDataScannerGroupRelationships: description: Relationships of the group. properties: configuration: $ref: '#/components/schemas/SensitiveDataScannerConfigurationData' rules: $ref: '#/components/schemas/SensitiveDataScannerRuleData' type: object ServiceDefinitionV2Dot2Link: description: Service's external links. properties: name: description: Link name. example: Runbook type: string provider: description: Link provider. example: Github type: string type: description: 'Link type. Datadog recognizes the following types: `runbook`, `doc`, `repo`, `dashboard`, and `other`.' example: runbook type: string url: description: Link URL. example: https://my-runbook type: string required: - name - type - url type: object GCPSTSServiceAccountResponse: description: The account creation response. properties: data: $ref: '#/components/schemas/GCPSTSServiceAccount' type: object ObservabilityPipelineOcsfMapperProcessor: description: The `ocsf_mapper` processor transforms logs into the OCSF schema using a predefined mapping configuration. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline. example: ocsf-mapper-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the `input` for this processor. example: - filter-processor items: type: string type: array mappings: description: A list of mapping rules to convert events to the OCSF format. items: $ref: '#/components/schemas/ObservabilityPipelineOcsfMapperProcessorMapping' type: array type: $ref: '#/components/schemas/ObservabilityPipelineOcsfMapperProcessorType' required: - id - type - include - inputs - mappings type: object AwsCURConfigPostRequestType: default: aws_cur_config_post_request description: Type of AWS CUR config Post Request. enum: - aws_cur_config_post_request example: aws_cur_config_post_request type: string x-enum-varnames: - AWS_CUR_CONFIG_POST_REQUEST RumRetentionFilterData: description: The RUM retention filter. properties: attributes: $ref: '#/components/schemas/RumRetentionFilterAttributes' id: $ref: '#/components/schemas/RumRetentionFilterID' type: $ref: '#/components/schemas/RumRetentionFilterType' type: object CloudConfigurationRuleCaseCreate: description: Description of signals. properties: notifications: description: Notification targets for each rule case. items: description: Notification. type: string type: array status: $ref: '#/components/schemas/SecurityMonitoringRuleSeverity' required: - status type: object CloudWorkloadSecurityAgentRuleCreateAttributes: description: Create a new Cloud Workload Security Agent rule. properties: actions: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions' blocking: description: The blocking policies that the rule belongs to items: type: string type: array description: description: The description of the Agent rule. example: My Agent rule type: string disabled: description: The disabled policies that the rule belongs to items: type: string type: array enabled: description: Whether the Agent rule is enabled example: true type: boolean expression: description: The SECL expression of the Agent rule. example: exec.file.name == "sh" type: string filters: description: The platforms the Agent rule is supported on items: type: string type: array monitoring: description: The monitoring policies that the rule belongs to items: type: string type: array name: description: The name of the Agent rule. example: my_agent_rule type: string policy_id: description: The ID of the policy where the Agent rule is saved example: a8c8e364-6556-434d-b798-a4c23de29c0b type: string product_tags: description: The list of product tags associated with the rule items: type: string type: array required: - name - expression type: object RelationshipToPermissions: description: Relationship to multiple permissions objects. properties: data: description: Relationships to permission objects. items: $ref: '#/components/schemas/RelationshipToPermissionData' type: array type: object x-merge-override: required: false IncidentTeamRelationships: description: The incident team's relationships. properties: created_by: $ref: '#/components/schemas/RelationshipToUser' last_modified_by: $ref: '#/components/schemas/RelationshipToUser' readOnly: true type: object ObservabilityPipelineGoogleCloudStorageDestinationStorageClass: description: Storage class used for objects stored in GCS. enum: - STANDARD - NEARLINE - COLDLINE - ARCHIVE example: STANDARD type: string x-enum-varnames: - STANDARD - NEARLINE - COLDLINE - ARCHIVE PowerpackRelationships: description: Powerpack relationship object. properties: author: $ref: '#/components/schemas/RelationshipToUser' type: object ObservabilityPipelineRemoveFieldsProcessorType: default: remove_fields description: The processor type. The value should always be `remove_fields`. enum: - remove_fields example: remove_fields type: string x-enum-varnames: - REMOVE_FIELDS SensitiveDataScannerConfiguration: description: A Sensitive Data Scanner configuration. properties: id: description: ID of the configuration. type: string example: abc-123-def type: $ref: '#/components/schemas/SensitiveDataScannerConfigurationType' type: object AwsCURConfigType: default: aws_cur_config description: Type of AWS CUR config. enum: - aws_cur_config example: aws_cur_config type: string x-enum-varnames: - AWS_CUR_CONFIG CasePriority: default: NOT_DEFINED description: Case priority enum: - NOT_DEFINED - P1 - P2 - P3 - P4 - P5 example: NOT_DEFINED type: string x-enum-varnames: - NOT_DEFINED - P1 - P2 - P3 - P4 - P5 LogsArchiveDestination: description: An archive's destination. nullable: true oneOf: - $ref: '#/components/schemas/LogsArchiveDestinationAzure' - $ref: '#/components/schemas/LogsArchiveDestinationGCS' - $ref: '#/components/schemas/LogsArchiveDestinationS3' type: object ActionQueryShowToastOnError: description: Whether to display a toast to the user when the query returns an error. oneOf: - type: boolean - description: If this is a string, it must be a valid JavaScript expression that evaluates to a boolean. example: ${true} type: string EntityV3DatadogEventItem: additionalProperties: false description: Events association item. properties: name: description: The name of the query. type: string example: Example Monitor query: description: The query to run. type: string example: avg:system.cpu.user{*} type: object IncidentAttachmentRelationships: description: The incident attachment's relationships. properties: last_modified_by_user: $ref: '#/components/schemas/RelationshipToUser' type: object RumMetricType: default: rum_metrics description: The type of the resource. The value should always be rum_metrics. enum: - rum_metrics example: rum_metrics type: string x-enum-varnames: - RUM_METRICS SecurityMonitoringRuleThirdPartyOptions: description: Options on third party detection method. properties: defaultNotifications: description: Notification targets for the logs that do not correspond to any of the cases. items: description: Notification. type: string type: array defaultStatus: $ref: '#/components/schemas/SecurityMonitoringRuleSeverity' rootQueries: description: Queries to be combined with third party case queries. Each of them can have different group by fields, to aggregate differently based on the type of alert. items: $ref: '#/components/schemas/SecurityMonitoringThirdPartyRootQuery' type: array signalTitleTemplate: description: A template for the signal title; if omitted, the title is generated based on the case name. type: string example: Example Monitor type: object CaseAttributes: description: Case attributes properties: archived_at: description: Timestamp of when the case was archived format: date-time nullable: true readOnly: true type: string example: example_value closed_at: description: Timestamp of when the case was closed format: date-time nullable: true readOnly: true type: string example: example_value created_at: description: Timestamp of when the case was created format: date-time readOnly: true type: string example: example_value description: description: Description type: string example: example_value jira_issue: $ref: '#/components/schemas/JiraIssue' key: description: Key example: CASEM-4523 type: string modified_at: description: Timestamp of when the case was last modified format: date-time nullable: true readOnly: true type: string example: example_value priority: $ref: '#/components/schemas/CasePriority' service_now_ticket: $ref: '#/components/schemas/ServiceNowTicket' status: $ref: '#/components/schemas/CaseStatus' title: description: Title example: Memory leak investigation on API type: string type: $ref: '#/components/schemas/CaseType' type: object RumMetricComputeAggregationType: description: The type of aggregation to use. enum: - count - distribution example: distribution type: string x-enum-varnames: - COUNT - DISTRIBUTION EntityV3ServiceDatadog: additionalProperties: false description: Datadog product integrations for the service entity. properties: codeLocations: $ref: '#/components/schemas/EntityV3DatadogCodeLocations' events: $ref: '#/components/schemas/EntityV3DatadogEvents' logs: $ref: '#/components/schemas/EntityV3DatadogLogs' performanceData: $ref: '#/components/schemas/EntityV3DatadogPerformance' pipelines: $ref: '#/components/schemas/EntityV3DatadogPipelines' type: object RelationshipToIncidentResponderData: description: Relationship to impact object. properties: id: description: A unique identifier that represents the responder. example: 00000000-0000-0000-2345-000000000000 type: string type: $ref: '#/components/schemas/IncidentRespondersType' required: - id - type type: object x-merge-override: required: false ApplicationSecurityWafCustomRuleConditionOperator: description: Operator to use for the WAF Condition. enum: - match_regex - '!match_regex' - phrase_match - '!phrase_match' - is_xss - is_sqli - exact_match - '!exact_match' - ip_match - '!ip_match' - capture_data example: match_regex type: string x-enum-varnames: - MATCH_REGEX - NOT_MATCH_REGEX - PHRASE_MATCH - NOT_PHRASE_MATCH - IS_XSS - IS_SQLI - EXACT_MATCH - NOT_EXACT_MATCH - IP_MATCH - NOT_IP_MATCH - CAPTURE_DATA ScheduleMemberRelationships: description: Defines relationships for a schedule member, primarily referencing a single user. properties: user: $ref: '#/components/schemas/ScheduleMemberRelationshipsUser' type: object UpsertCatalogEntityRequest: description: Create or update entity request. oneOf: - $ref: '#/components/schemas/EntityV3' - $ref: '#/components/schemas/EntityRaw' CustomDestinationResponseHttpDestinationAuth: description: Authentication method of the HTTP requests. oneOf: - $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuthBasic' - $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuthCustomHeader' IncidentServiceCreateAttributes: description: The incident service's attributes for a create request. properties: name: description: Name of the incident service. example: an example service name type: string required: - name type: object MonitorConfigPolicyCreateRequest: description: Request for creating a monitor configuration policy. properties: data: $ref: '#/components/schemas/MonitorConfigPolicyCreateData' required: - data type: object RelationshipToRole: description: Relationship to role. properties: data: $ref: '#/components/schemas/RelationshipToRoleData' type: object x-merge-override: required: false ServiceDefinitionMeta: description: Metadata about a service definition. properties: github-html-url: description: GitHub HTML URL. type: string example: https://app.datadoghq.com ingested-schema-version: description: Ingestion schema version. type: string example: example_value ingestion-source: description: Ingestion source of the service definition. type: string example: example_value last-modified-time: description: Last modified time of the service definition. type: string example: '2026-04-17T12:00:00Z' origin: description: User defined origin of the service definition. type: string example: example_value origin-detail: description: User defined origin's detail of the service definition. type: string example: example_value warnings: description: A list of schema validation warnings. items: $ref: '#/components/schemas/ServiceDefinitionMetaWarnings' type: array type: object SecurityMonitoringUser: description: A user. properties: handle: description: The handle of the user. example: john.doe@datadoghq.com type: string name: description: The name of the user. example: John Doe nullable: true type: string type: object EscalationPolicyDataRelationshipsStepsDataItemsType: default: steps description: Indicates that the resource is of type `steps`. enum: - steps example: steps type: string x-enum-varnames: - STEPS MetricTagConfigurationAttributes: description: Object containing the definition of a metric tag configuration attributes. properties: aggregations: $ref: '#/components/schemas/MetricCustomAggregations' created_at: description: Timestamp when the tag configuration was created. example: '2020-03-25T09:48:37.463835Z' format: date-time type: string exclude_tags_mode: description: 'When set to true, the configuration will exclude the configured tags and include any other submitted tags. When set to false, the configuration will include the configured tags and exclude any other submitted tags. Defaults to false. Requires `tags` property.' type: boolean example: true include_percentiles: description: 'Toggle to include or exclude percentile aggregations for distribution metrics. Only present when the `metric_type` is `distribution`.' example: true type: boolean metric_type: $ref: '#/components/schemas/MetricTagConfigurationMetricTypes' modified_at: description: Timestamp when the tag configuration was last modified. example: '2020-03-25T09:48:37.463835Z' format: date-time type: string tags: description: List of tag keys on which to group. example: - app - datacenter items: description: Tag keys to group by. type: string type: array type: object ApplicationKeyResponse: description: Response for retrieving an application key. properties: data: $ref: '#/components/schemas/FullApplicationKey' included: description: Array of objects related to the application key. items: $ref: '#/components/schemas/ApplicationKeyResponseIncludedItem' type: array type: object GCPSTSServiceAccountData: description: Additional metadata on your generated service account. properties: attributes: $ref: '#/components/schemas/GCPSTSServiceAccountAttributes' type: $ref: '#/components/schemas/GCPServiceAccountType' type: object x-merge-override: required: false ScheduleTarget: description: Represents a schedule target for an escalation policy step, including its ID and resource type. properties: id: description: Specifies the unique identifier of the schedule resource. example: 00000000-aba1-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/ScheduleTargetType' required: - type - id type: object SensitiveDataScannerProduct: default: logs description: Datadog product onto which Sensitive Data Scanner can be activated. enum: - logs - rum - events - apm type: string x-enum-varnames: - LOGS - RUM - EVENTS - APM ObservabilityPipelineSensitiveDataScannerProcessorScopeExcludeTarget: description: Excludes specific fields from processing. enum: - exclude example: exclude type: string x-enum-varnames: - EXCLUDE IncidentTodoCreateRequest: description: Create request for an incident todo. properties: data: $ref: '#/components/schemas/IncidentTodoCreateData' required: - data type: object ServiceDefinitionV2Email: description: Service owner's email. properties: contact: description: Contact value. example: contact@datadoghq.com type: string name: description: Contact email. example: Team Email type: string type: $ref: '#/components/schemas/ServiceDefinitionV2EmailType' required: - type - contact type: object IncidentFieldAttributesSingleValue: description: A field with a single value selected. properties: type: $ref: '#/components/schemas/IncidentFieldAttributesSingleValueType' value: description: The single value selected for this field. example: SEV-1 nullable: true type: string type: object CreatePageRequestDataType: default: pages description: The type of resource used when creating an On-Call Page. enum: - pages example: pages type: string x-enum-varnames: - PAGES MicrosoftTeamsTenantBasedHandleRequestData: description: Tenant-based handle data from a response. properties: attributes: $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleRequestAttributes' type: $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleType' required: - type - attributes type: object x-merge-override: required: false ServiceDefinitionCreateResponse: description: Create service definitions response. properties: data: description: Create service definitions response payload. items: $ref: '#/components/schemas/ServiceDefinitionData' type: array type: object EscalationTargets: description: A list of escalation targets for a step properties: data: description: The `EscalationTargets` `data`. items: $ref: '#/components/schemas/EscalationTarget' type: array type: object AuthNMappingTeam: description: Team. properties: attributes: $ref: '#/components/schemas/AuthNMappingTeamAttributes' id: description: The ID of the Team. example: f9bb8444-af7f-11ec-ac2c-da7ad0900001 type: string type: $ref: '#/components/schemas/TeamType' type: object WorkflowDataRelationships: description: The definition of `WorkflowDataRelationships` object. properties: creator: $ref: '#/components/schemas/WorkflowUserRelationship' owner: $ref: '#/components/schemas/WorkflowUserRelationship' readOnly: true type: object ApplicationSecurityWafCustomRuleMetadata: description: Metadata associated with the WAF Custom Rule. properties: added_at: description: The date and time the WAF custom rule was created. example: '2021-01-01T00:00:00Z' format: date-time type: string added_by: description: The handle of the user who created the WAF custom rule. example: john.doe@datadoghq.com type: string added_by_name: description: The name of the user who created the WAF custom rule. example: John Doe type: string modified_at: description: The date and time the WAF custom rule was last updated. example: '2021-01-01T00:00:00Z' format: date-time type: string modified_by: description: The handle of the user who last updated the WAF custom rule. example: john.doe@datadoghq.com type: string modified_by_name: description: The name of the user who last updated the WAF custom rule. example: John Doe type: string readOnly: true type: object UserResponseRelationships: description: Relationships of the user object returned by the API. properties: org: $ref: '#/components/schemas/RelationshipToOrganization' other_orgs: $ref: '#/components/schemas/RelationshipToOrganizations' other_users: $ref: '#/components/schemas/RelationshipToUsers' roles: $ref: '#/components/schemas/RelationshipToRoles' type: object x-merge-override: properties: false RumMetricGroupBy: description: A group by rule. properties: path: description: The path to the value the rum-based metric will be aggregated over. example: '@browser.name' type: string tag_name: description: Eventual name of the tag that gets created. By default, `path` is used as the tag name. example: browser_name type: string required: - path type: object ScheduleCreateRequestDataAttributes: description: Describes the main attributes for creating a new schedule, including name, layers, and time zone. properties: layers: description: The layers of On-Call coverage that define rotation intervals and restrictions. items: $ref: '#/components/schemas/ScheduleCreateRequestDataAttributesLayersItems' type: array name: description: A human-readable name for the new schedule. example: Team A On-Call type: string time_zone: description: The time zone in which the schedule is defined. example: America/New_York type: string required: - name - time_zone - layers type: object MonitorNotificationRuleFilterTags: additionalProperties: false description: Filter monitors by tags. Monitors must match all tags. properties: tags: description: A list of monitor tags. example: - team:product - host:abc items: maxLength: 255 type: string maxItems: 20 minItems: 1 type: array uniqueItems: true required: - tags type: object Parameter: description: The definition of `Parameter` object. properties: name: description: The `Parameter` `name`. example: '' type: string value: description: The `Parameter` `value`. example: example_value required: - name - value type: object ActionConnectionData: description: Data related to the connection. properties: attributes: $ref: '#/components/schemas/ActionConnectionAttributes' id: description: The connection identifier readOnly: true type: string example: abc-123-def type: $ref: '#/components/schemas/ActionConnectionDataType' required: - type - attributes type: object ObservabilityPipelineSyslogNgDestination: description: The `syslog_ng` destination forwards logs to an external `syslog-ng` server over TCP or UDP using the syslog protocol. properties: id: description: The unique identifier for this component. example: syslog-ng-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array keepalive: description: Optional socket keepalive duration in milliseconds. example: 60000 format: int64 minimum: 0 type: integer tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineSyslogNgDestinationType' required: - id - type - inputs type: object ObservabilityPipelineEnrichmentTableFileKeyItems: description: Defines how to map log fields to enrichment table columns during lookups. properties: column: description: The `items` `column`. example: user_id type: string comparison: $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileKeyItemsComparison' field: description: The `items` `field`. example: log.user.id type: string required: - column - comparison - field type: object EntityV3APISpecInterface: additionalProperties: false description: The API definition. oneOf: - $ref: '#/components/schemas/EntityV3APISpecInterfaceFileRef' - $ref: '#/components/schemas/EntityV3APISpecInterfaceDefinition' CustomDestinationResponseHttpDestinationAuthBasicType: default: basic description: Type of the basic access authentication. enum: - basic example: basic type: string x-enum-varnames: - BASIC SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations: description: 'If true, signals are suppressed for the first 24 hours. In that time, Datadog learns the user''s regular access locations. This can be helpful to reduce noise and infer VPN usage or credentialed API access.' example: true type: boolean ObservabilityPipelineDatadogAgentSource: description: The `datadog_agent` source collects logs from the Datadog Agent. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: datadog-agent-source type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineDatadogAgentSourceType' required: - id - type type: object AuthNMappingCreateRelationships: description: Relationship of AuthN Mapping create object to a Role or Team. oneOf: - $ref: '#/components/schemas/AuthNMappingRelationshipToRole' - $ref: '#/components/schemas/AuthNMappingRelationshipToTeam' RelationshipToUsers: description: Relationship to users. properties: data: description: Relationships to user objects. example: [] items: $ref: '#/components/schemas/RelationshipToUserData' type: array required: - data type: object ActionConnectionIntegration: description: The definition of `ActionConnectionIntegration` object. oneOf: - $ref: '#/components/schemas/AWSIntegration' - $ref: '#/components/schemas/HTTPIntegration' ChangeEventTriggerWrapper: description: Schema for a Change Event-based trigger. properties: changeEventTrigger: description: Trigger a workflow from a Change Event. type: object startStepNames: $ref: '#/components/schemas/StartStepNames' required: - changeEventTrigger type: object CloudWorkloadSecurityAgentRuleResponse: description: Response object that includes an Agent rule properties: data: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleData' type: object PermissionsType: default: permissions description: Permissions resource type. enum: - permissions example: permissions type: string x-enum-varnames: - PERMISSIONS LogsMetricCreateData: description: The new log-based metric properties. properties: attributes: $ref: '#/components/schemas/LogsMetricCreateAttributes' id: $ref: '#/components/schemas/LogsMetricID' type: $ref: '#/components/schemas/LogsMetricType' required: - id - type - attributes type: object RelationshipItem: description: Relationship entry. properties: id: description: Associated data ID. type: string example: abc-123-def type: description: Relationship type. type: string example: metric alert type: object IncidentTeamCreateAttributes: description: The incident team's attributes for a create request. properties: name: description: Name of the incident team. example: team name type: string required: - name type: object SloReportCreateRequest: description: The SLO report request body. properties: data: $ref: '#/components/schemas/SloReportCreateRequestData' required: - data type: object ComponentGridType: default: grid description: The grid component type. enum: - grid example: grid type: string x-enum-varnames: - GRID CustomFrameworkRequirement: description: Framework Requirement. properties: controls: description: Requirement Controls. items: $ref: '#/components/schemas/CustomFrameworkControl' type: array name: description: Requirement Name. example: criteria type: string required: - name - controls type: object MetricTagConfigurationResponse: description: Response object which includes a single metric's tag configuration. properties: data: $ref: '#/components/schemas/MetricTagConfiguration' readOnly: true type: object RumMetricCreateData: description: The new rum-based metric properties. properties: attributes: $ref: '#/components/schemas/RumMetricCreateAttributes' id: $ref: '#/components/schemas/RumMetricID' type: $ref: '#/components/schemas/RumMetricType' required: - id - type - attributes type: object IncidentServiceResponseData: description: Incident Service data from responses. properties: attributes: $ref: '#/components/schemas/IncidentServiceResponseAttributes' id: description: The incident service's ID. example: 00000000-0000-0000-0000-000000000000 type: string relationships: $ref: '#/components/schemas/IncidentServiceRelationships' type: $ref: '#/components/schemas/IncidentServiceType' required: - id - type type: object StateVariable: description: A variable, which can be set and read by other components in the app. properties: id: description: The ID of the state variable. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string name: description: A unique identifier for this state variable. This name is also used to access the variable's value throughout the app. example: ordersToSubmit type: string properties: $ref: '#/components/schemas/StateVariableProperties' type: $ref: '#/components/schemas/StateVariableType' required: - id - name - type - properties type: object SpansMetricComputeIncludePercentiles: description: 'Toggle to include or exclude percentile aggregations for distribution metrics. Only present when the `aggregation_type` is `distribution`.' example: false type: boolean CloudConfigurationRuleType: description: The rule type. enum: - cloud_configuration type: string x-enum-varnames: - CLOUD_CONFIGURATION AWSLogsConfig: description: AWS Logs Collection config. properties: lambda_forwarder: $ref: '#/components/schemas/AWSLambdaForwarderConfig' type: object RelationshipToSAMLAssertionAttributeData: description: Data of AuthN Mapping relationship to SAML Assertion Attribute. properties: id: description: The ID of the SAML assertion attribute. example: '0' type: string type: $ref: '#/components/schemas/SAMLAssertionAttributesType' required: - id - type type: object x-merge-override: required: false LogsMetricResponseAttributes: description: The object describing a Datadog log-based metric. properties: compute: $ref: '#/components/schemas/LogsMetricResponseCompute' filter: $ref: '#/components/schemas/LogsMetricResponseFilter' group_by: description: The rules for the group by. items: $ref: '#/components/schemas/LogsMetricResponseGroupBy' type: array type: object NotificationRuleAttributes: description: Attributes of the notification rule. properties: created_at: $ref: '#/components/schemas/Date' created_by: $ref: '#/components/schemas/RuleUser' enabled: $ref: '#/components/schemas/Enabled' modified_at: $ref: '#/components/schemas/Date' modified_by: $ref: '#/components/schemas/RuleUser' name: $ref: '#/components/schemas/RuleName' selectors: $ref: '#/components/schemas/Selectors' targets: $ref: '#/components/schemas/Targets' time_aggregation: $ref: '#/components/schemas/TimeAggregation' version: $ref: '#/components/schemas/Version' required: - created_at - created_by - enabled - modified_at - modified_by - name - selectors - targets - version type: object RumMetricUniqueness: description: The rule to count updatable events. Is only set if `event_type` is `sessions` or `views`. properties: when: $ref: '#/components/schemas/RumMetricUniquenessWhen' required: - when type: object SensitiveDataScannerIncludedKeywordConfiguration: description: 'Object defining a set of keywords and a number of characters that help reduce noise. You can provide a list of keywords you would like to check within a defined proximity of the matching pattern. If any of the keywords are found within the proximity check, the match is kept. If none are found, the match is discarded.' properties: character_count: description: 'The number of characters behind a match detected by Sensitive Data Scanner to look for the keywords defined. `character_count` should be greater than the maximum length of a keyword defined for a rule.' example: 30 format: int64 maximum: 50 minimum: 1 type: integer keywords: description: 'Keyword list that will be checked during scanning in order to validate a match. The number of keywords in the list must be less than or equal to 30.' example: - credit card - cc items: type: string type: array use_recommended_keywords: description: 'Should the rule use the underlying standard pattern keyword configuration. If set to `true`, the rule must be tied to a standard pattern. If set to `false`, the specified keywords and `character_count` are applied.' type: boolean example: true required: - keywords - character_count type: object EscalationTarget: description: Represents an escalation target, which can be a team, user, or schedule. oneOf: - $ref: '#/components/schemas/TeamTarget' - $ref: '#/components/schemas/UserTarget' - $ref: '#/components/schemas/ScheduleTarget' ApplicationSecurityWafCustomRuleCondition: description: One condition of the WAF Custom Rule. properties: operator: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionOperator' parameters: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionParameters' required: - operator - parameters type: object CreateCustomFrameworkRequest: description: Request object to create a custom framework. properties: data: $ref: '#/components/schemas/CustomFrameworkData' required: - data type: object ObservabilityPipelineOpenSearchDestinationType: default: opensearch description: The destination type. The value should always be `opensearch`. enum: - opensearch example: opensearch type: string x-enum-varnames: - OPENSEARCH AuthNMapping: description: The AuthN Mapping object returned by API. properties: attributes: $ref: '#/components/schemas/AuthNMappingAttributes' id: description: ID of the AuthN Mapping. example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string relationships: $ref: '#/components/schemas/AuthNMappingRelationships' type: $ref: '#/components/schemas/AuthNMappingsType' required: - id - type type: object x-merge-override: required: false CreateAppResponseData: description: The data object containing the app ID. properties: id: description: The ID of the created app. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string type: $ref: '#/components/schemas/AppDefinitionType' required: - id - type type: object ObservabilityPipelineSpec: description: Input schema representing an observability pipeline configuration. Used in create and validate requests. properties: data: $ref: '#/components/schemas/ObservabilityPipelineSpecData' required: - data type: object AppDefinitionType: default: appDefinitions description: The app definition type. enum: - appDefinitions example: appDefinitions type: string x-enum-varnames: - APPDEFINITIONS IncidentTodoAssignee: description: A todo assignee. example: '@test.user@test.com' oneOf: - $ref: '#/components/schemas/IncidentTodoAssigneeHandle' - $ref: '#/components/schemas/IncidentTodoAnonymousAssignee' SensitiveDataScannerMetaVersionOnly: description: Meta payload containing information about the API. properties: version: description: Version of the API (optional). example: 0 format: int64 minimum: 0 type: integer type: object IncidentTodoAssigneeArray: description: Array of todo assignees. example: - '@test.user@test.com' items: $ref: '#/components/schemas/IncidentTodoAssignee' type: array MicrosoftTeamsWorkflowsWebhookHandleResponseData: description: Workflows Webhook handle data from a response. properties: attributes: $ref: '#/components/schemas/MicrosoftTeamsWorkflowsWebhookResponseAttributes' id: description: The ID of the Workflows webhook handle. example: 596da4af-0563-4097-90ff-07230c3f9db3 maxLength: 100 minLength: 1 type: string type: $ref: '#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleType' type: object CustomDestinationResponseHttpDestinationAuthBasic: description: Basic access authentication. properties: type: $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuthBasicType' required: - type type: object DatabaseMonitoringTriggerWrapper: description: Schema for a Database Monitoring-based trigger. properties: databaseMonitoringTrigger: description: Trigger a workflow from Database Monitoring. type: object startStepNames: $ref: '#/components/schemas/StartStepNames' required: - databaseMonitoringTrigger type: object RUMApplicationResponse: description: RUM application response. properties: data: $ref: '#/components/schemas/RUMApplication' type: object CloudWorkloadSecurityAgentPolicyCreateData: description: Object for a single Agent rule properties: attributes: $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyCreateAttributes' type: $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyType' required: - attributes - type type: object ActionQueryMockedOutputsEnabled: description: Whether to enable the mocked outputs for testing. oneOf: - type: boolean - description: If this is a string, it must be a valid JavaScript expression that evaluates to a boolean. example: ${true} type: string ObservabilityPipelineSumoLogicDestination: description: The `sumo_logic` destination forwards logs to Sumo Logic. properties: encoding: $ref: '#/components/schemas/ObservabilityPipelineSumoLogicDestinationEncoding' header_custom_fields: description: A list of custom headers to include in the request to Sumo Logic. items: $ref: '#/components/schemas/ObservabilityPipelineSumoLogicDestinationHeaderCustomFieldsItem' type: array header_host_name: description: Optional override for the host name header. example: host-123 type: string header_source_category: description: Optional override for the source category header. example: source-category type: string header_source_name: description: Optional override for the source name header. example: source-name type: string id: description: The unique identifier for this component. example: sumo-logic-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineSumoLogicDestinationType' required: - id - type - inputs type: object EntityResponseIncludedSchemaAttributes: description: Included schema. properties: schema: $ref: '#/components/schemas/EntityV3' type: object RuleOutcomeRelationships: description: The JSON:API relationship to a scorecard rule. properties: rule: $ref: '#/components/schemas/RelationshipToOutcome' type: object MonitorNotificationRuleResponse: description: A monitor notification rule. properties: data: $ref: '#/components/schemas/MonitorNotificationRuleData' included: description: Array of objects related to the monitor notification rule that the user requested. items: $ref: '#/components/schemas/MonitorNotificationRuleResponseIncludedItem' type: array type: object SensitiveDataScannerConfigurationType: default: sensitive_data_scanner_configuration description: Sensitive Data Scanner configuration type. enum: - sensitive_data_scanner_configuration example: sensitive_data_scanner_configuration type: string x-enum-varnames: - SENSITIVE_DATA_SCANNER_CONFIGURATIONS CaseRelationships: description: Resources related to a case properties: assignee: $ref: '#/components/schemas/NullableUserRelationship' created_by: $ref: '#/components/schemas/NullableUserRelationship' modified_by: $ref: '#/components/schemas/NullableUserRelationship' project: $ref: '#/components/schemas/ProjectRelationship' type: object Schedule: description: Top-level container for a schedule object, including both the `data` payload and any related `included` resources (such as teams, layers, or members). example: data: attributes: name: On-Call Schedule time_zone: America/New_York id: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d relationships: layers: data: - id: 00000000-0000-0000-0000-000000000001 type: layers teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: schedules included: - attributes: avatar: '' description: Team 1 description handle: team1 name: Team 1 id: 00000000-da3a-0000-0000-000000000000 type: teams - attributes: effective_date: '2025-02-03T05:00:00Z' end_date: '2025-12-31T00:00:00Z' interval: days: 1 name: Layer 1 restrictions: - end_day: friday end_time: '17:00:00' start_day: monday start_time: 09:00:00 rotation_start: '2025-02-01T00:00:00Z' id: 00000000-0000-0000-0000-000000000001 relationships: members: data: - id: 00000000-0000-0000-0000-000000000002 type: members type: layers - id: 00000000-0000-0000-0000-000000000002 relationships: user: data: id: 00000000-aba1-0000-0000-000000000000 type: users type: members - attributes: email: foo@bar.com name: User 1 id: 00000000-aba1-0000-0000-000000000000 type: users properties: data: $ref: '#/components/schemas/ScheduleData' included: description: Any additional resources related to this schedule, such as teams and layers. items: $ref: '#/components/schemas/ScheduleDataIncludedItem' type: array type: object EntityToIncidents: description: Entity to incidents relationship. properties: data: $ref: '#/components/schemas/RelationshipArray' type: object LogsArchiveCreateRequestDestination: description: An archive's destination. oneOf: - $ref: '#/components/schemas/LogsArchiveDestinationAzure' - $ref: '#/components/schemas/LogsArchiveDestinationGCS' - $ref: '#/components/schemas/LogsArchiveDestinationS3' ObservabilityPipelineRemoveFieldsProcessor: description: The `remove_fields` processor deletes specified fields from logs. properties: fields: description: A list of field names to be removed from each log event. example: - field1 - field2 items: type: string type: array id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: remove-fields-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: The `PipelineRemoveFieldsProcessor` `inputs`. example: - datadog-agent-source items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineRemoveFieldsProcessorType' required: - id - type - include - fields - inputs type: object WorkflowDataAttributes: description: The definition of `WorkflowDataAttributes` object. properties: createdAt: description: When the workflow was created. format: date-time readOnly: true type: string example: example_value description: description: Description of the workflow. type: string example: example_value name: description: Name of the workflow. example: '' type: string published: description: Set the workflow to published or unpublished. Workflows in an unpublished state will only be executable via manual runs. Automatic triggers such as Schedule will not execute the workflow until it is published. type: boolean example: true spec: $ref: '#/components/schemas/Spec' tags: description: Tags of the workflow. items: type: string type: array updatedAt: description: When the workflow was last updated. format: date-time readOnly: true type: string example: '2026-04-17T12:00:00Z' webhookSecret: description: If a Webhook trigger is defined on this workflow, a webhookSecret is required and should be provided here. type: string writeOnly: true example: example_value required: - name - spec type: object RUMApplicationCreateType: default: rum_application_create description: RUM application creation type. enum: - rum_application_create example: rum_application_create type: string x-enum-varnames: - RUM_APPLICATION_CREATE AnnotationMarkdownTextAnnotation: description: The definition of `AnnotationMarkdownTextAnnotation` object. properties: text: description: The `markdownTextAnnotation` `text`. type: string example: example_value type: object OutputSchemaParameters: description: The definition of `OutputSchemaParameters` object. properties: defaultValue: description: The `OutputSchemaParameters` `defaultValue`. example: example_value description: description: The `OutputSchemaParameters` `description`. type: string example: example_value label: description: The `OutputSchemaParameters` `label`. type: string example: example_value name: description: The `OutputSchemaParameters` `name`. example: '' type: string type: $ref: '#/components/schemas/OutputSchemaParametersType' value: description: The `OutputSchemaParameters` `value`. example: example_value required: - name - type type: object RumMetricResponseGroupBy: description: A group by rule. properties: path: description: The path to the value the rum-based metric will be aggregated over. example: '@http.status_code' type: string tag_name: description: Eventual name of the tag that gets created. By default, `path` is used as the tag name. example: status_code type: string type: object EntityV3QueueSpec: additionalProperties: false description: The definition of Entity V3 Queue Spec object. properties: componentOf: description: A list of components the queue is a part of items: type: string type: array lifecycle: description: The lifecycle state of the queue. minLength: 1 type: string example: example_value tier: description: The importance of the queue. minLength: 1 type: string example: example_value type: description: The type of queue. type: string example: metric alert type: object ServiceDefinitionV1Pagerduty: description: PagerDuty service URL for the service. example: https://my-org.pagerduty.com/service-directory/PMyService type: string ApplicationKeyCreateAttributes: description: Attributes used to create an application Key. properties: name: description: Name of the application key. example: Application Key for managing dashboards type: string scopes: description: Array of scopes to grant the application key. example: - dashboards_read - dashboards_write - dashboards_public_share items: description: Name of scope. type: string nullable: true type: array required: - name type: object x-merge-override: properties: false ObservabilityPipelineAddFieldsProcessor: description: The `add_fields` processor adds static key-value fields to logs. properties: fields: description: A list of static fields (key-value pairs) that is added to each log event processed by this component. items: $ref: '#/components/schemas/ObservabilityPipelineFieldValue' type: array id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components). example: add-fields-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - datadog-agent-source items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineAddFieldsProcessorType' required: - id - type - include - fields - inputs type: object ObservabilityPipelineLogstashSource: description: The `logstash` source ingests logs from a Logstash forwarder. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: logstash-source type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineLogstashSourceType' required: - id - type type: object CloudWorkloadSecurityAgentPolicyResponse: description: Response object that includes an Agent policy properties: data: $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyData' type: object CustomFrameworkControl: description: Framework Control. properties: name: description: Control Name. example: A1.2 type: string rules_id: description: Rule IDs. example: - '["def-000-abc"]' items: type: string type: array required: - name - rules_id type: object ScheduleUserType: default: users description: Users resource type. enum: - users example: users type: string x-enum-varnames: - USERS ObservabilityPipelineAddFieldsProcessorType: default: add_fields description: The processor type. The value should always be `add_fields`. enum: - add_fields example: add_fields type: string x-enum-varnames: - ADD_FIELDS GCPSTSDelegateAccountType: default: gcp_sts_delegate description: The type of account. enum: - gcp_sts_delegate example: gcp_sts_delegate type: string x-enum-varnames: - GCP_STS_DELEGATE MetricTagConfigurationCreateRequest: description: Request object that includes the metric that you would like to configure tags for. properties: data: $ref: '#/components/schemas/MetricTagConfigurationCreateData' required: - data type: object RumRetentionFilterCreateRequest: description: The RUM retention filter body to create. properties: data: $ref: '#/components/schemas/RumRetentionFilterCreateData' required: - data type: object IncidentIntegrationMetadataCreateData: description: Incident integration metadata data for a create request. properties: attributes: $ref: '#/components/schemas/IncidentIntegrationMetadataAttributes' type: $ref: '#/components/schemas/IncidentIntegrationMetadataType' required: - type - attributes type: object ServiceDefinitionV2Doc: description: Service documents. properties: name: description: Document name. example: Architecture type: string provider: description: Document provider. example: google drive type: string url: description: Document URL. example: https://gdrive/mydoc type: string required: - name - url type: object MicrosoftTeamsTenantBasedHandleResponseData: description: Tenant-based handle data from a response. properties: attributes: $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleAttributes' id: description: The ID of the tenant-based handle. example: 596da4af-0563-4097-90ff-07230c3f9db3 maxLength: 100 minLength: 1 type: string type: $ref: '#/components/schemas/MicrosoftTeamsTenantBasedHandleType' type: object x-merge-override: required: false ObservabilityPipelineEnrichmentTableProcessor: description: The `enrichment_table` processor enriches logs using a static CSV file or GeoIP database. properties: file: $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFile' geoip: $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableGeoIp' id: description: The unique identifier for this processor. example: enrichment-table-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: source:my-source type: string inputs: description: A list of component IDs whose output is used as the input for this processor. example: - add-fields-processor items: type: string type: array target: description: Path where enrichment results should be stored in the log. example: enriched.geoip type: string type: $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableProcessorType' required: - id - type - include - inputs - target type: object SpansMetricID: description: The name of the span-based metric. example: my.metric type: string ServiceDefinitionV2Repo: description: Service code repositories. properties: name: description: Repository name. example: Source Code type: string provider: description: Repository provider. example: GitHub type: string url: description: Repository URL. example: https://github.com/DataDog/schema type: string required: - name - url type: object ServiceDefinitionV1Resource: description: Service's external links. properties: name: description: Link name. example: Runbook type: string type: $ref: '#/components/schemas/ServiceDefinitionV1ResourceType' url: description: Link URL. example: https://my-runbook type: string required: - name - type - url type: object IncidentImpactsType: description: The incident impacts type. enum: - incident_impacts example: incident_impacts type: string x-enum-varnames: - INCIDENT_IMPACTS RelationshipToRoleData: description: Relationship to role object. properties: id: description: The unique identifier of the role. example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string type: $ref: '#/components/schemas/RolesType' type: object x-merge-override: required: false SecurityFilterCreateRequest: description: Request object that includes the security filter that you would like to create. properties: data: $ref: '#/components/schemas/SecurityFilterCreateData' required: - data type: object EntityV3SystemDatadog: additionalProperties: false description: Datadog product integrations for the service entity. properties: events: $ref: '#/components/schemas/EntityV3DatadogEvents' logs: $ref: '#/components/schemas/EntityV3DatadogLogs' performanceData: $ref: '#/components/schemas/EntityV3DatadogPerformance' pipelines: $ref: '#/components/schemas/EntityV3DatadogPipelines' type: object ExternalUser: description: Definition of a user. properties: active: description: A Boolean value indicating the User's administrative status. type: boolean example: true emails: description: Email addresses for the user. items: $ref: '#/components/schemas/ExternalUserEmailType' type: array id: description: The identifier of the resource. Not required when creating a user. type: string example: abc-123-def meta: $ref: '#/components/schemas/ExternalUserMeta' name: $ref: '#/components/schemas/ExternalUserNameType' schemas: description: User JSON Schemas. example: - urn:ietf:params:scim:schemas:core:2.0:User items: type: string type: array title: description: The user's title. type: string example: Example Monitor userName: description: Unique identifier for the User. type: string example: Example Monitor type: object OutcomesBatchResponse: description: Scorecard outcomes batch response. properties: data: $ref: '#/components/schemas/OutcomesBatchResponseData' meta: $ref: '#/components/schemas/OutcomesBatchResponseMeta' required: - data - meta type: object ObservabilityPipelineAmazonOpenSearchDestinationAuth: description: 'Authentication settings for the Amazon OpenSearch destination. The `strategy` field determines whether basic or AWS-based authentication is used. ' properties: assume_role: description: The ARN of the role to assume (used with `aws` strategy). type: string example: example_value aws_region: description: AWS region type: string example: example_value external_id: description: External ID for the assumed role (used with `aws` strategy). type: string example: abc-123-def session_name: description: Session name for the assumed role (used with `aws` strategy). type: string example: Example Monitor strategy: $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestinationAuthStrategy' required: - strategy type: object SpansMetricResponseData: description: The span-based metric properties. properties: attributes: $ref: '#/components/schemas/SpansMetricResponseAttributes' id: $ref: '#/components/schemas/SpansMetricID' type: $ref: '#/components/schemas/SpansMetricType' type: object AWSTracesConfig: description: AWS Traces Collection config. properties: xray_services: $ref: '#/components/schemas/XRayServicesList' type: object CloudWorkloadSecurityAgentPolicyUpdaterAttributes: description: The attributes of the user who last updated the policy properties: handle: description: The handle of the user example: datadog.user@example.com type: string name: description: The name of the user example: Datadog User nullable: true type: string type: object CloudWorkloadSecurityAgentRuleCreateData: description: Object for a single Agent rule properties: attributes: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleCreateAttributes' type: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleType' required: - attributes - type type: object AWSRegionsIncludeOnly: description: Include only these regions. properties: include_only: description: Include only these regions. example: - us-east-1 items: example: us-east-1 type: string type: array required: - include_only type: object SensitiveDataScannerRuleData: description: Rules included in the group. properties: data: description: Rules included in the group. The order is important. items: $ref: '#/components/schemas/SensitiveDataScannerRule' type: array type: object CustomDestinationResponseForwardDestinationSplunk: description: The Splunk HTTP Event Collector (HEC) destination. properties: endpoint: description: 'The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.' example: https://example.com type: string type: $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationSplunkType' required: - type - endpoint type: object TokenName: description: Name for tokens. example: MyTokenName pattern: ^[A-Za-z][A-Za-z\\d]*$ type: string ID: description: The ID of a notification rule. example: aaa-bbb-ccc type: string SensitiveDataScannerGroupType: default: sensitive_data_scanner_group description: Sensitive Data Scanner group type. enum: - sensitive_data_scanner_group example: sensitive_data_scanner_group type: string x-enum-varnames: - SENSITIVE_DATA_SCANNER_GROUP SensitiveDataScannerGroupResponse: description: Response data related to the creation of a group. properties: attributes: $ref: '#/components/schemas/SensitiveDataScannerGroupAttributes' id: description: ID of the group. type: string example: abc-123-def relationships: $ref: '#/components/schemas/SensitiveDataScannerGroupRelationships' type: $ref: '#/components/schemas/SensitiveDataScannerGroupType' type: object MicrosoftTeamsWorkflowsWebhookHandleRequestData: description: Workflows Webhook handle data from a response. properties: attributes: $ref: '#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleRequestAttributes' type: $ref: '#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleType' required: - type - attributes type: object PowerpackResponse: description: Response object which includes a single powerpack configuration. properties: data: $ref: '#/components/schemas/PowerpackData' included: description: Array of objects related to the users. items: $ref: '#/components/schemas/User' type: array readOnly: true type: object ServiceDefinitionRaw: description: Service Definition in raw JSON/YAML representation. example: '--- schema-version: v2 dd-service: my-service ' type: string ServiceDefinitionV2Dot1Opsgenie: description: Opsgenie integration for the service. properties: region: $ref: '#/components/schemas/ServiceDefinitionV2Dot1OpsgenieRegion' service-url: description: Opsgenie service url. example: https://my-org.opsgenie.com/service/123e4567-e89b-12d3-a456-426614174000 type: string required: - service-url type: object ActionQueryProperties: description: The properties of the action query. properties: condition: $ref: '#/components/schemas/ActionQueryCondition' debounceInMs: $ref: '#/components/schemas/ActionQueryDebounceInMs' mockedOutputs: $ref: '#/components/schemas/ActionQueryMockedOutputs' onlyTriggerManually: $ref: '#/components/schemas/ActionQueryOnlyTriggerManually' outputs: description: The post-query transformation function, which is a JavaScript function that changes the query's `.outputs` property after the query's execution. example: ${((outputs) => {return outputs.body.data})(self.rawOutputs)} type: string pollingIntervalInMs: $ref: '#/components/schemas/ActionQueryPollingIntervalInMs' requiresConfirmation: $ref: '#/components/schemas/ActionQueryRequiresConfirmation' showToastOnError: $ref: '#/components/schemas/ActionQueryShowToastOnError' spec: $ref: '#/components/schemas/ActionQuerySpec' required: - spec type: object SecurityMonitoringStandardRuleResponse: description: Rule. properties: cases: description: Cases for generating signals. items: $ref: '#/components/schemas/SecurityMonitoringRuleCase' type: array complianceSignalOptions: $ref: '#/components/schemas/CloudConfigurationRuleComplianceSignalOptions' createdAt: description: When the rule was created, timestamp in milliseconds. format: int64 type: integer example: 42 creationAuthorId: description: User ID of the user who created the rule. format: int64 type: integer example: 42 defaultTags: description: Default Tags for default rules (included in tags) example: - security:attacks items: description: Default Tag. type: string type: array deprecationDate: description: When the rule will be deprecated, timestamp in milliseconds. format: int64 type: integer example: 42 filters: description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. items: $ref: '#/components/schemas/SecurityMonitoringFilter' type: array groupSignalsBy: description: Additional grouping to perform on top of the existing groups in the query section. Must be a subset of the existing groups. example: - service items: description: Field to group by. type: string type: array hasExtendedTitle: description: Whether the notifications include the triggering group-by values in their title. type: boolean example: true id: description: The ID of the rule. type: string example: abc-123-def isDefault: description: Whether the rule is included by default. type: boolean example: true isDeleted: description: Whether the rule has been deleted. type: boolean example: true isEnabled: description: Whether the rule is enabled. type: boolean example: true message: description: Message for generated signals. type: string example: CPU usage is high on {{host.name}} name: description: The name of the rule. type: string example: Example Monitor options: $ref: '#/components/schemas/SecurityMonitoringRuleOptions' queries: description: Queries for selecting logs which are part of the rule. items: $ref: '#/components/schemas/SecurityMonitoringStandardRuleQuery' type: array referenceTables: description: Reference tables for the rule. items: $ref: '#/components/schemas/SecurityMonitoringReferenceTable' type: array tags: description: Tags for generated signals. items: description: Tag. type: string type: array thirdPartyCases: description: Cases for generating signals from third-party rules. Only available for third-party rules. example: [] items: $ref: '#/components/schemas/SecurityMonitoringThirdPartyRuleCase' type: array type: $ref: '#/components/schemas/SecurityMonitoringRuleTypeRead' updateAuthorId: description: User ID of the user who updated the rule. format: int64 type: integer example: 42 updatedAt: description: The date the rule was last updated, in milliseconds. format: int64 type: integer example: 42 version: description: The version of the rule. format: int64 type: integer example: 42 type: object CloudConfigurationRuleOptions: description: Options on cloud configuration rules. properties: complianceRuleOptions: $ref: '#/components/schemas/CloudConfigurationComplianceRuleOptions' required: - complianceRuleOptions type: object PowerpackInnerWidgets: description: Powerpack group widget definition of individual widgets. properties: definition: additionalProperties: {} description: Information about widget. example: definition: content: example type: note type: object layout: $ref: '#/components/schemas/PowerpackInnerWidgetLayout' required: - definition type: object UserTargetType: default: users description: Indicates that the resource is of type `users`. enum: - users example: users type: string x-enum-varnames: - USERS SecurityMonitoringRuleDetectionMethod: description: The detection method. enum: - threshold - new_value - anomaly_detection - impossible_travel - hardcoded - third_party - anomaly_threshold type: string x-enum-varnames: - THRESHOLD - NEW_VALUE - ANOMALY_DETECTION - IMPOSSIBLE_TRAVEL - HARDCODED - THIRD_PARTY - ANOMALY_THRESHOLD ObservabilityPipelineQuotaProcessor: description: The Quota Processor measures logging traffic for logs that match a specified filter. When the configured daily quota is met, the processor can drop or alert. properties: drop_events: description: If set to `true`, logs that matched the quota filter and sent after the quota has been met are dropped; only logs that did not match the filter query continue through the pipeline. example: false type: boolean id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components). example: quota-processor type: string ignore_when_missing_partitions: description: If `true`, the processor skips quota checks when partition fields are missing from the logs. type: boolean example: true include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - datadog-agent-source items: type: string type: array limit: $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorLimit' name: description: Name of the quota. example: MyQuota type: string overflow_action: $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorOverflowAction' overrides: description: A list of alternate quota rules that apply to specific sets of events, identified by matching field values. Each override can define a custom limit. items: $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorOverride' type: array partition_fields: description: A list of fields used to segment log traffic for quota enforcement. Quotas are tracked independently by unique combinations of these field values. items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessorType' required: - id - type - include - name - drop_events - limit - inputs type: object Annotation: description: A list of annotations used in the workflow. These are like sticky notes for your workflow! properties: display: $ref: '#/components/schemas/AnnotationDisplay' id: description: The `Annotation` `id`. example: '' type: string markdownTextAnnotation: $ref: '#/components/schemas/AnnotationMarkdownTextAnnotation' required: - id - display - markdownTextAnnotation type: object SecurityMonitoringRuleNewValueOptionsLearningThreshold: default: 0 description: A number of occurrences after which signals will be generated for values that weren't learned. enum: - 0 - 1 format: int32 type: integer x-enum-varnames: - ZERO_OCCURRENCES - ONE_OCCURRENCE EntityV3: description: Entity schema v3. oneOf: - $ref: '#/components/schemas/EntityV3Service' - $ref: '#/components/schemas/EntityV3Datastore' - $ref: '#/components/schemas/EntityV3Queue' - $ref: '#/components/schemas/EntityV3System' - $ref: '#/components/schemas/EntityV3API' ComponentType: description: The UI component type. enum: - table - textInput - textArea - button - text - select - modal - schemaForm - checkbox - tabs - vegaChart - radioButtons - numberInput - fileInput - jsonInput - gridCell - dateRangePicker - search - container - calloutValue example: text type: string x-enum-varnames: - TABLE - TEXTINPUT - TEXTAREA - BUTTON - TEXT - SELECT - MODAL - SCHEMAFORM - CHECKBOX - TABS - VEGACHART - RADIOBUTTONS - NUMBERINPUT - FILEINPUT - JSONINPUT - GRIDCELL - DATERANGEPICKER - SEARCH - CONTAINER - CALLOUTVALUE GithubWebhookTrigger: description: Trigger a workflow from a GitHub webhook. To trigger a workflow from GitHub, you must set a `webhookSecret`. In your GitHub Webhook Settings, set the Payload URL to "base_url"/api/v2/workflows/"workflow_id"/webhook?orgId="org_id", select application/json for the content type, and be highly recommend enabling SSL verification for security. The workflow must be published. properties: rateLimit: $ref: '#/components/schemas/TriggerRateLimit' type: object APIKeyResponse: description: Response for retrieving an API key. properties: data: $ref: '#/components/schemas/FullAPIKey' included: description: Array of objects related to the API key. items: $ref: '#/components/schemas/APIKeyResponseIncludedItem' type: array x-merge-override: items: false type: object IncidentIntegrationMetadataType: default: incident_integrations description: Integration metadata resource type. enum: - incident_integrations example: incident_integrations type: string x-enum-varnames: - INCIDENT_INTEGRATIONS TeamLink: description: Team link properties: attributes: $ref: '#/components/schemas/TeamLinkAttributes' id: description: The team link's identifier example: b8626d7e-cedd-11eb-abf5-da7ad0900001 type: string type: $ref: '#/components/schemas/TeamLinkType' required: - attributes - id - type type: object x-merge-override: required: false FullAPIKey: description: Datadog API key. properties: attributes: $ref: '#/components/schemas/FullAPIKeyAttributes' id: description: ID of the API key. type: string example: abc-123-def relationships: $ref: '#/components/schemas/APIKeyRelationships' type: $ref: '#/components/schemas/APIKeysType' type: object x-merge-override: required: false ObservabilityPipelineSensitiveDataScannerProcessorRule: description: Defines a rule for detecting sensitive data, including matching pattern, scope, and the action to take. properties: keyword_options: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorKeywordOptions' name: description: A name identifying the rule. example: Redact Credit Card Numbers type: string on_match: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorAction' pattern: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorPattern' scope: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScope' tags: description: Tags assigned to this rule for filtering and classification. example: - pii - ccn items: type: string type: array required: - name - tags - pattern - scope - on_match type: object UserAttributesStatus: description: The user's status. enum: - active - deactivated - pending type: string x-enum-varnames: - ACTIVE - DEACTIVATED - PENDING WidgetLiveSpan: description: The available timeframes depend on the widget you are using. enum: - 1m - 5m - 10m - 15m - 30m - 1h - 4h - 1d - 2d - 1w - 1mo - 3mo - 6mo - 1y - alert example: 5m type: string x-enum-varnames: - PAST_ONE_MINUTE - PAST_FIVE_MINUTES - PAST_TEN_MINUTES - PAST_FIFTEEN_MINUTES - PAST_THIRTY_MINUTES - PAST_ONE_HOUR - PAST_FOUR_HOURS - PAST_ONE_DAY - PAST_TWO_DAYS - PAST_ONE_WEEK - PAST_ONE_MONTH - PAST_THREE_MONTHS - PAST_SIX_MONTHS - PAST_ONE_YEAR - ALERT EscalationPolicyStepAttributesAssignment: description: Specifies how this escalation step will assign targets (example `default` or `round-robin`). enum: - default - round-robin type: string x-enum-varnames: - DEFAULT - ROUND_ROBIN LogsMetricCreateRequest: description: The new log-based metric body. properties: data: $ref: '#/components/schemas/LogsMetricCreateData' required: - data type: object SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv: description: 'If true, signals in non-production environments have a lower severity than what is defined by the rule case, which can reduce signal noise. The severity is decreased by one level: `CRITICAL` in production becomes `HIGH` in non-production, `HIGH` becomes `MEDIUM` and so on. `INFO` remains `INFO`. The decrement is applied when the environment tag of the signal starts with `staging`, `test` or `dev`.' example: false type: boolean JiraIntegrationMetadataIssuesItem: description: Item in the Jira integration metadata issue array. properties: account: description: URL of issue's Jira account. example: https://example.atlassian.net type: string issue_key: description: Jira issue's issue key. example: PROJ-123 type: string issuetype_id: description: Jira issue's issue type. example: '1000' type: string project_key: description: Jira issue's project keys. example: PROJ type: string redirect_url: description: URL redirecting to the Jira issue. example: https://example.atlassian.net/browse/PROJ-123 type: string required: - project_key - account type: object ApplicationSecurityWafCustomRuleConditionInputAddress: description: Input from the request on which the condition should apply. enum: - server.db.statement - server.io.fs.file - server.io.net.url - server.sys.shell.cmd - server.request.method - server.request.uri.raw - server.request.path_params - server.request.query - server.request.headers.no_cookies - server.request.cookies - server.request.trailers - server.request.body - server.response.status - server.response.headers.no_cookies - server.response.trailers - grpc.server.request.metadata - grpc.server.request.message - grpc.server.method - graphql.server.all_resolvers - usr.id - http.client_ip example: server.db.statement type: string x-enum-varnames: - SERVER_DB_STATEMENT - SERVER_IO_FS_FILE - SERVER_IO_NET_URL - SERVER_SYS_SHELL_CMD - SERVER_REQUEST_METHOD - SERVER_REQUEST_URI_RAW - SERVER_REQUEST_PATH_PARAMS - SERVER_REQUEST_QUERY - SERVER_REQUEST_HEADERS_NO_COOKIES - SERVER_REQUEST_COOKIES - SERVER_REQUEST_TRAILERS - SERVER_REQUEST_BODY - SERVER_RESPONSE_STATUS - SERVER_RESPONSE_HEADERS_NO_COOKIES - SERVER_RESPONSE_TRAILERS - GRPC_SERVER_REQUEST_METADATA - GRPC_SERVER_REQUEST_MESSAGE - GRPC_SERVER_METHOD - GRAPHQL_SERVER_ALL_RESOLVERS - USR_ID - HTTP_CLIENT_IP EscalationPolicyUserType: default: users description: Users resource type. enum: - users example: users type: string x-enum-varnames: - USERS RelationshipToUser: description: Relationship to user. properties: data: $ref: '#/components/schemas/RelationshipToUserData' required: - data type: object RelationshipToTeamData: description: Relationship to Team object. properties: id: description: The unique identifier of the team. example: f9bb8444-af7f-11ec-ac2c-da7ad0900001 type: string type: $ref: '#/components/schemas/TeamType' type: object x-merge-override: required: false AuthNMappingCreateData: description: Data for creating an AuthN Mapping. properties: attributes: $ref: '#/components/schemas/AuthNMappingCreateAttributes' relationships: $ref: '#/components/schemas/AuthNMappingCreateRelationships' type: $ref: '#/components/schemas/AuthNMappingsType' required: - type type: object AWSAccountID: description: AWS Account ID. example: '123456789012' type: string ObservabilityPipelineGeneratedMetricIncrementByFieldStrategy: description: Uses a numeric field in the log event as the metric increment. enum: - increment_by_field example: increment_by_field type: string x-enum-varnames: - INCREMENT_BY_FIELD IncidentFieldAttributesSingleValueType: default: dropdown description: Type of the single value field definitions. enum: - dropdown - textbox example: dropdown type: string x-enum-varnames: - DROPDOWN - TEXTBOX SensitiveDataScannerStandardPatternData: description: A standard pattern. properties: data: $ref: '#/components/schemas/SensitiveDataScannerStandardPattern' type: object ComponentGridProperties: description: Properties of a grid component. properties: backgroundColor: default: default description: The background color of the grid. type: string example: example_value children: description: The child components of the grid. items: $ref: '#/components/schemas/Component' type: array isVisible: $ref: '#/components/schemas/ComponentGridPropertiesIsVisible' type: object TriggerRateLimit: description: Defines a rate limit for a trigger. properties: count: description: The `TriggerRateLimit` `count`. format: int64 type: integer example: 42 interval: description: The `TriggerRateLimit` `interval`. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s type: string example: example_value type: object ObservabilityPipelineAmazonDataFirehoseSource: description: The `amazon_data_firehose` source ingests logs from AWS Data Firehose. properties: auth: $ref: '#/components/schemas/ObservabilityPipelineAwsAuth' id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: amazon-firehose-source type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineAmazonDataFirehoseSourceType' required: - id - type type: object SpansMetricResponseCompute: description: The compute rule to compute the span-based metric. properties: aggregation_type: $ref: '#/components/schemas/SpansMetricComputeAggregationType' include_percentiles: $ref: '#/components/schemas/SpansMetricComputeIncludePercentiles' path: description: The path to the value the span-based metric will aggregate on (only used if the aggregation type is a "distribution"). example: '@duration' type: string type: object ObservabilityPipelineRsyslogDestination: description: The `rsyslog` destination forwards logs to an external `rsyslog` server over TCP or UDP using the syslog protocol. properties: id: description: The unique identifier for this component. example: rsyslog-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array keepalive: description: Optional socket keepalive duration in milliseconds. example: 60000 format: int64 minimum: 0 type: integer tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineRsyslogDestinationType' required: - id - type - inputs type: object Targets: description: 'List of recipients to notify when a notification rule is triggered. Many different target types are supported, such as email addresses, Slack channels, and PagerDuty services. The appropriate integrations need to be properly configured to send notifications to the specified targets.' example: - '@john.doe@email.com' items: description: Recipients to notify. type: string type: array ObservabilityPipelineSensitiveDataScannerProcessorActionHash: description: Configuration for hashing matched sensitive values. properties: action: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionHashAction' options: description: The `ObservabilityPipelineSensitiveDataScannerProcessorActionHash` `options`. type: object required: - action type: object ServiceDefinitionV2Dot2Version: default: v2.2 description: Schema version being used. enum: - v2.2 example: v2.2 type: string x-enum-varnames: - V2_2 EscalationPolicy: description: Represents a complete escalation policy response, including policy data and optionally included related resources. example: data: attributes: name: Escalation Policy 1 resolve_page_on_policy_end: true retries: 2 id: 00000000-aba1-0000-0000-000000000000 relationships: steps: data: - id: 00000000-aba1-0000-0000-000000000000 type: steps teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: policies included: - attributes: avatar: '' description: Team 1 description handle: team1 name: Team 1 id: 00000000-da3a-0000-0000-000000000000 type: teams - attributes: assignment: default escalate_after_seconds: 3600 id: 00000000-aba1-0000-0000-000000000000 relationships: targets: data: - id: 00000000-aba1-0000-0000-000000000000 type: users - id: 00000000-aba2-0000-0000-000000000000 type: schedules - id: 00000000-aba3-0000-0000-000000000000 type: teams type: steps - id: 00000000-aba1-0000-0000-000000000000 type: users - id: 00000000-aba2-0000-0000-000000000000 type: schedules - id: 00000000-aba3-0000-0000-000000000000 type: teams properties: data: $ref: '#/components/schemas/EscalationPolicyData' included: description: Provides any included related resources, such as steps or targets, returned with the policy. items: $ref: '#/components/schemas/EscalationPolicyIncluded' type: array type: object ObservabilityPipelineSensitiveDataScannerProcessorKeywordOptions: description: Configuration for keywords used to reinforce sensitive data pattern detection. properties: keywords: description: A list of keywords to match near the sensitive pattern. example: - ssn - card - account items: type: string type: array proximity: description: Maximum number of tokens between a keyword and a sensitive value match. example: 5 format: int64 type: integer required: - keywords - proximity type: object ObservabilityPipelineSumoLogicSourceType: default: sumo_logic description: The source type. The value should always be `sumo_logic`. enum: - sumo_logic example: sumo_logic type: string x-enum-varnames: - SUMO_LOGIC RetentionFilterCreateRequest: description: The body of the retention filter to be created. properties: data: $ref: '#/components/schemas/RetentionFilterCreateData' required: - data type: object SpansMetricResponseFilter: description: The span-based metric filter. Spans matching this filter will be aggregated in this metric. properties: query: description: The search query - following the span search syntax. example: '@http.status_code:200 service:my-service' type: string type: object SensitiveDataScannerRuleResponse: description: Response data related to the creation of a rule. properties: attributes: $ref: '#/components/schemas/SensitiveDataScannerRuleAttributes' id: description: ID of the rule. type: string example: abc-123-def relationships: $ref: '#/components/schemas/SensitiveDataScannerRuleRelationships' type: $ref: '#/components/schemas/SensitiveDataScannerRuleType' type: object AuthNMappingCreateAttributes: description: Key/Value pair of attributes used for create request. properties: attribute_key: description: Key portion of a key/value pair of the attribute sent from the Identity Provider. example: member-of type: string attribute_value: description: Value portion of a key/value pair of the attribute sent from the Identity Provider. example: Development type: string type: object ApplicationSecurityWafCustomRuleConditionInput: description: Input from the request on which the condition should apply. properties: address: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionInputAddress' key_path: description: Specific path for the input. items: type: string type: array required: - address type: object ObservabilityPipelineSentinelOneDestinationType: default: sentinel_one description: The destination type. The value should always be `sentinel_one`. enum: - sentinel_one example: sentinel_one type: string x-enum-varnames: - SENTINEL_ONE ApplicationSecurityWafCustomRuleScope: description: The scope of the WAF custom rule. properties: env: description: The environment scope for the WAF custom rule. example: prod type: string service: description: The service scope for the WAF custom rule. example: billing-service type: string required: - service - env type: object ActionQuerySpecConnectionGroup: description: The connection group to use for an action query. properties: id: description: The ID of the connection group. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string tags: description: The tags of the connection group. items: type: string type: array type: object AWSAuthConfigKeys: description: AWS Authentication config to integrate your account using an access key pair. properties: access_key_id: description: AWS Access Key ID. example: AKIAIOSFODNN7EXAMPLE type: string secret_access_key: description: AWS Secret Access Key. example: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY minLength: 1 type: string writeOnly: true required: - access_key_id type: object XRayServicesList: description: AWS X-Ray services to collect traces from. Defaults to `include_only`. oneOf: - $ref: '#/components/schemas/XRayServicesIncludeAll' - $ref: '#/components/schemas/XRayServicesIncludeOnly' MonitorNotificationRuleResponseIncludedItem: description: An object related to a monitor notification rule. oneOf: - $ref: '#/components/schemas/User' SecurityMonitoringThirdPartyRuleCase: description: Case when signal is generated by a third party rule. properties: name: description: Name of the case. type: string example: Example Monitor notifications: description: Notification targets for each rule case. items: description: Notification. type: string type: array query: description: A query to map a third party event to this case. type: string example: avg:system.cpu.user{*} status: $ref: '#/components/schemas/SecurityMonitoringRuleSeverity' type: object OpsgenieServiceType: default: opsgenie-service description: Opsgenie service resource type. enum: - opsgenie-service example: opsgenie-service type: string x-enum-varnames: - OPSGENIE_SERVICE IncidentFieldAttributes: description: Dynamic fields for which selections can be made, with field names as keys. oneOf: - $ref: '#/components/schemas/IncidentFieldAttributesSingleValue' - $ref: '#/components/schemas/IncidentFieldAttributesMultipleValue' IncidentTypeCreateData: description: Incident type data for a create request. properties: attributes: $ref: '#/components/schemas/IncidentTypeAttributes' type: $ref: '#/components/schemas/IncidentTypeType' required: - type - attributes type: object APITriggerWrapper: description: Schema for an API-based trigger. properties: apiTrigger: $ref: '#/components/schemas/APITrigger' startStepNames: $ref: '#/components/schemas/StartStepNames' required: - apiTrigger type: object CaseCreateAttributes: description: Case creation attributes properties: description: description: Description type: string example: example_value priority: $ref: '#/components/schemas/CasePriority' title: description: Title example: Security breach investigation type: string type: $ref: '#/components/schemas/CaseType' required: - title - type type: object ObservabilityPipelineSumoLogicDestinationHeaderCustomFieldsItem: description: Single key-value pair used as a custom log header for Sumo Logic. properties: name: description: The header field name. example: X-Sumo-Category type: string value: description: The header field value. example: my-app-logs type: string required: - name - value type: object RuleId: description: The unique ID for a scorecard rule. example: q8MQxk8TCqrHnWkx type: string HTTPTokenAuthType: description: The definition of `HTTPTokenAuthType` object. enum: - HTTPTokenAuth example: HTTPTokenAuth type: string x-enum-varnames: - HTTPTOKENAUTH TeamRelationshipsLinks: description: Links attributes. properties: related: description: Related link. example: /api/v2/team/c75a4a8e-20c7-11ee-a3a5-da7ad0900002/links type: string type: object AWSResourcesConfig: description: AWS Resources Collection config. properties: cloud_security_posture_management_collection: description: Enable Cloud Security Management to scan AWS resources for vulnerabilities, misconfigurations, identity risks, and compliance violations. Defaults to `false`. Requires `extended_collection` to be set to `true`. example: false type: boolean extended_collection: description: Whether Datadog collects additional attributes and configuration information about the resources in your AWS account. Defaults to `true`. Required for `cloud_security_posture_management_collection`. example: true type: boolean type: object AWSAccountResponseAttributes: description: AWS Account response attributes. properties: account_tags: $ref: '#/components/schemas/AWSAccountTags' auth_config: $ref: '#/components/schemas/AWSAuthConfig' aws_account_id: $ref: '#/components/schemas/AWSAccountID' aws_partition: $ref: '#/components/schemas/AWSAccountPartition' aws_regions: $ref: '#/components/schemas/AWSRegions' created_at: description: Timestamp of when the account integration was created. format: date-time readOnly: true type: string example: example_value logs_config: $ref: '#/components/schemas/AWSLogsConfig' metrics_config: $ref: '#/components/schemas/AWSMetricsConfig' modified_at: description: Timestamp of when the account integration was updated. format: date-time readOnly: true type: string example: example_value resources_config: $ref: '#/components/schemas/AWSResourcesConfig' traces_config: $ref: '#/components/schemas/AWSTracesConfig' required: - aws_account_id type: object CreatePageRequestDataAttributesTarget: description: Information about the target to notify (such as a team or user). properties: identifier: description: Identifier for the target (for example, team handle or user ID). type: string example: abc-123-def type: $ref: '#/components/schemas/OnCallPageTargetType' type: object IncidentTypeCreateRequest: description: Create request for an incident type. properties: data: $ref: '#/components/schemas/IncidentTypeCreateData' required: - data type: object CreateNotificationRuleParameters: description: Body of the notification rule create request. properties: data: $ref: '#/components/schemas/CreateNotificationRuleParametersData' type: object CompletionGate: description: Used to create conditions before running subsequent actions. properties: completionCondition: $ref: '#/components/schemas/CompletionCondition' retryStrategy: $ref: '#/components/schemas/RetryStrategy' required: - completionCondition - retryStrategy type: object ObservabilityPipelineSensitiveDataScannerProcessorScopeAllTarget: description: Applies the rule to all fields. enum: - all example: all type: string x-enum-varnames: - ALL ApplicationSecurityWafCustomRuleType: default: custom_rule description: The type of the resource. The value should always be `custom_rule`. enum: - custom_rule example: custom_rule type: string x-enum-varnames: - CUSTOM_RULE LogsMetricResponseFilter: description: The log-based metric filter. Logs matching this filter will be aggregated in this metric. properties: query: description: The search query - following the log search syntax. example: service:web* AND @http.status_code:[200 TO 299] type: string type: object PowerpackTemplateVariable: description: Powerpack template variables. properties: available_values: description: The list of values that the template variable drop-down is limited to. example: - my-host - host1 - host2 items: description: Template variable value. type: string nullable: true type: array defaults: description: One or many template variable default values within the saved view, which are unioned together using `OR` if more than one is specified. items: description: One or many default values of the template variable. minLength: 1 type: string type: array name: description: The name of the variable. example: datacenter type: string prefix: description: The tag prefix associated with the variable. Only tags with this prefix appear in the variable drop-down. example: host nullable: true type: string required: - name type: object RestrictionQueryWithoutRelationships: description: Restriction query object returned by the API. properties: attributes: $ref: '#/components/schemas/RestrictionQueryAttributes' id: description: ID of the restriction query. example: 79a0e60a-644a-11ea-ad29-43329f7f58b5 type: string type: default: logs_restriction_queries description: Restriction queries type. example: logs_restriction_queries readOnly: true type: string type: object ObservabilityPipelineRsyslogSource: description: The `rsyslog` source listens for logs over TCP or UDP from an `rsyslog` server using the syslog protocol. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: rsyslog-source type: string mode: $ref: '#/components/schemas/ObservabilityPipelineSyslogSourceMode' tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineRsyslogSourceType' required: - id - type - mode type: object APITrigger: description: Trigger a workflow from an API request. The workflow must be published. properties: rateLimit: $ref: '#/components/schemas/TriggerRateLimit' type: object IncidentAttachmentAttributes: description: The attributes object for an attachment. oneOf: - $ref: '#/components/schemas/IncidentAttachmentPostmortemAttributes' - $ref: '#/components/schemas/IncidentAttachmentLinkAttributes' AuthNMappingIncluded: description: Included data in the AuthN Mapping response. oneOf: - $ref: '#/components/schemas/SAMLAssertionAttribute' - $ref: '#/components/schemas/Role' - $ref: '#/components/schemas/AuthNMappingTeam' RUMApplicationCreateRequest: description: RUM application creation request attributes. properties: data: $ref: '#/components/schemas/RUMApplicationCreate' required: - data type: object RuleTypesItems: description: 'Security rule type which can be used in security rules. Signal-based notification rules can filter signals based on rule types application_security, log_detection, workload_security, signal_correlation, cloud_configuration and infrastructure_configuration. Vulnerability-based notification rules can filter vulnerabilities based on rule types application_code_vulnerability, application_library_vulnerability, attack_path, container_image_vulnerability, identity_risk, misconfiguration, and api_security.' enum: - application_security - log_detection - workload_security - signal_correlation - cloud_configuration - infrastructure_configuration - application_code_vulnerability - application_library_vulnerability - attack_path - container_image_vulnerability - identity_risk - misconfiguration - api_security type: string x-enum-varnames: - APPLICATION_SECURITY - LOG_DETECTION - WORKLOAD_SECURITY - SIGNAL_CORRELATION - CLOUD_CONFIGURATION - INFRASTRUCTURE_CONFIGURATION - APPLICATION_CODE_VULNERABILITY - APPLICATION_LIBRARY_VULNERABILITY - ATTACK_PATH - CONTAINER_IMAGE_VULNERABILITY - IDENTITY_RISK - MISCONFIGURATION - API_SECURITY ServiceDefinitionSchema: description: Service definition schema. oneOf: - $ref: '#/components/schemas/ServiceDefinitionV1' - $ref: '#/components/schemas/ServiceDefinitionV2' - $ref: '#/components/schemas/ServiceDefinitionV2Dot1' - $ref: '#/components/schemas/ServiceDefinitionV2Dot2' SensitiveDataScannerRuleAttributes: description: Attributes of the Sensitive Data Scanner rule. properties: description: description: Description of the rule. type: string example: example_value excluded_namespaces: description: Attributes excluded from the scan. If namespaces is provided, it has to be a sub-path of the namespaces array. example: - admin.name items: type: string type: array included_keyword_configuration: $ref: '#/components/schemas/SensitiveDataScannerIncludedKeywordConfiguration' is_enabled: description: Whether or not the rule is enabled. type: boolean example: true name: description: Name of the rule. type: string example: Example Monitor namespaces: description: 'Attributes included in the scan. If namespaces is empty or missing, all attributes except excluded_namespaces are scanned. If both are missing the whole event is scanned.' example: - admin items: type: string type: array pattern: description: Not included if there is a relationship to a standard pattern. type: string example: example_value priority: description: Integer from 1 (high) to 5 (low) indicating rule issue severity. format: int64 maximum: 5 minimum: 1 type: integer example: 42 tags: description: List of tags. items: type: string type: array text_replacement: $ref: '#/components/schemas/SensitiveDataScannerTextReplacement' type: object ActionQuerySpecInputs: description: The inputs to the action query. These are the values that are passed to the action when it is triggered. oneOf: - type: string - $ref: '#/components/schemas/ActionQuerySpecInput' MonitorNotificationRuleId: description: The ID of the monitor notification rule. example: 00000000-0000-1234-0000-000000000000 type: string StepDisplayBounds: description: The definition of `StepDisplayBounds` object. properties: x: description: The `bounds` `x`. format: double type: number example: 95.5 y: description: The `bounds` `y`. format: double type: number example: 95.5 type: object MetricTagConfigurationType: default: manage_tags description: The metric tag configuration resource type. enum: - manage_tags example: manage_tags type: string x-enum-varnames: - MANAGE_TAGS IncidentTodoAnonymousAssigneeSource: default: slack description: The source of the anonymous assignee. enum: - slack - microsoft_teams example: slack type: string x-enum-varnames: - SLACK - MICROSOFT_TEAMS ApiID: description: API identifier. example: 90646597-5fdb-4a17-a240-647003f8c028 format: uuid type: string ObservabilityPipelineEnrichmentTableFileKeyItemsComparison: description: Defines how to compare key fields for enrichment table lookups. enum: - equals example: equals type: string x-enum-varnames: - EQUALS SecurityMonitoringSignalRuleResponse: description: Rule. properties: cases: description: Cases for generating signals. items: $ref: '#/components/schemas/SecurityMonitoringRuleCase' type: array createdAt: description: When the rule was created, timestamp in milliseconds. format: int64 type: integer example: 42 creationAuthorId: description: User ID of the user who created the rule. format: int64 type: integer example: 42 deprecationDate: description: When the rule will be deprecated, timestamp in milliseconds. format: int64 type: integer example: 42 filters: description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. items: $ref: '#/components/schemas/SecurityMonitoringFilter' type: array hasExtendedTitle: description: Whether the notifications include the triggering group-by values in their title. type: boolean example: true id: description: The ID of the rule. type: string example: abc-123-def isDefault: description: Whether the rule is included by default. type: boolean example: true isDeleted: description: Whether the rule has been deleted. type: boolean example: true isEnabled: description: Whether the rule is enabled. type: boolean example: true message: description: Message for generated signals. type: string example: CPU usage is high on {{host.name}} name: description: The name of the rule. type: string example: Example Monitor options: $ref: '#/components/schemas/SecurityMonitoringRuleOptions' queries: description: Queries for selecting logs which are part of the rule. items: $ref: '#/components/schemas/SecurityMonitoringSignalRuleResponseQuery' type: array tags: description: Tags for generated signals. items: description: Tag. type: string type: array type: $ref: '#/components/schemas/SecurityMonitoringSignalRuleType' updateAuthorId: description: User ID of the user who updated the rule. format: int64 type: integer example: 42 version: description: The version of the rule. format: int64 type: integer example: 42 type: object EntityV3APISpecInterfaceDefinition: additionalProperties: false description: The definition of `EntityV3APISpecInterfaceDefinition` object. properties: definition: description: The API definition. type: object type: object ObservabilityPipelineParseGrokProcessorRuleMatchRule: description: 'Defines a Grok parsing rule, which extracts structured fields from log content using named Grok patterns. Each rule must have a unique name and a valid Datadog Grok pattern that will be applied to the source field. ' properties: name: description: The name of the rule. example: MyParsingRule type: string rule: description: The definition of the Grok rule. example: '%{word:user} connected on %{date("MM/dd/yyyy"):date}' type: string required: - name - rule type: object AWSLambdaForwarderConfig: description: 'Log Autosubscription configuration for Datadog Forwarder Lambda functions. Automatically set up triggers for existing and new logs for some services, ensuring no logs from new resources are missed and saving time spent on manual configuration.' properties: lambdas: description: List of Datadog Lambda Log Forwarder ARNs in your AWS account. Defaults to `[]`. items: example: arn:aws:lambda:us-east-1:123456789012:function:DatadogLambdaLogForwarder type: string type: array sources: description: 'List of service IDs set to enable automatic log collection. Discover the list of available services with the [Get list of AWS log ready services](https://docs.datadoghq.com/api/latest/aws-logs-integration/#get-list-of-aws-log-ready-services) endpoint.' items: example: s3 type: string type: array type: object ObservabilityPipelineParseJSONProcessor: description: The `parse_json` processor extracts JSON from a specified field and flattens it into the event. This is useful when logs contain embedded JSON as a string. properties: field: description: The name of the log field that contains a JSON string. example: message type: string id: description: A unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: parse-json-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - datadog-agent-source items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineParseJSONProcessorType' required: - id - type - include - field - inputs type: object APIKeysType: default: api_keys description: API Keys resource type. enum: - api_keys example: api_keys type: string x-enum-varnames: - API_KEYS RelationshipToOrganization: description: Relationship to an organization. properties: data: $ref: '#/components/schemas/RelationshipToOrganizationData' required: - data type: object SpansMetricCreateAttributes: description: The object describing the Datadog span-based metric to create. properties: compute: $ref: '#/components/schemas/SpansMetricCompute' filter: $ref: '#/components/schemas/SpansMetricFilter' group_by: description: The rules for the group by. items: $ref: '#/components/schemas/SpansMetricGroupBy' type: array required: - compute type: object IncidentAttachmentLinkAttachmentType: default: link description: The type of link attachment attributes. enum: - link example: link type: string x-enum-varnames: - LINK ComponentGridPropertiesIsVisible: description: Whether the grid component and its children are visible. If a string, it must be a valid JavaScript expression that evaluates to a boolean. oneOf: - type: string - default: true type: boolean IncidentTodoRelationships: description: The incident's relationships from a response. properties: created_by_user: $ref: '#/components/schemas/RelationshipToUser' last_modified_by_user: $ref: '#/components/schemas/RelationshipToUser' type: object ObservabilityPipelineReduceProcessorMergeStrategy: description: Defines how a specific field should be merged across grouped events. properties: path: description: The field path in the log event. example: log.user.roles type: string strategy: $ref: '#/components/schemas/ObservabilityPipelineReduceProcessorMergeStrategyStrategy' required: - path - strategy type: object ServiceDefinitionV2Integrations: description: Third party integrations that Datadog supports. properties: opsgenie: $ref: '#/components/schemas/ServiceDefinitionV2Opsgenie' pagerduty: $ref: '#/components/schemas/ServiceDefinitionV2Pagerduty' type: object GCPSTSDelegateAccount: description: Datadog principal service account info. properties: attributes: $ref: '#/components/schemas/GCPSTSDelegateAccountAttributes' id: description: The ID of the delegate service account. example: ddgci-1a19n28hb1a812221893@datadog-gci-sts-us5-prod.iam.gserviceaccount.com type: string type: $ref: '#/components/schemas/GCPSTSDelegateAccountType' type: object ObservabilityPipelineAmazonDataFirehoseSourceType: default: amazon_data_firehose description: The source type. The value should always be `amazon_data_firehose`. enum: - amazon_data_firehose example: amazon_data_firehose type: string x-enum-varnames: - AMAZON_DATA_FIREHOSE MetricTagConfigurationCreateAttributes: description: Object containing the definition of a metric tag configuration to be created. properties: aggregations: $ref: '#/components/schemas/MetricCustomAggregations' exclude_tags_mode: description: 'When set to true, the configuration will exclude the configured tags and include any other submitted tags. When set to false, the configuration will include the configured tags and exclude any other submitted tags. Defaults to false. Requires `tags` property.' type: boolean example: true include_percentiles: description: 'Toggle to include/exclude percentiles for a distribution metric. Defaults to false. Can only be applied to metrics that have a `metric_type` of `distribution`.' example: true type: boolean metric_type: $ref: '#/components/schemas/MetricTagConfigurationMetricTypes' tags: default: [] description: A list of tag keys that will be queryable for your metric. example: - app - datacenter items: description: Tag keys to group by. type: string type: array required: - tags - metric_type type: object SensitiveDataScannerGroupCreateRequest: description: Create group request. properties: data: $ref: '#/components/schemas/SensitiveDataScannerGroupCreate' meta: $ref: '#/components/schemas/SensitiveDataScannerMetaVersionOnly' type: object EntityResponseData: description: List of entity data. items: $ref: '#/components/schemas/EntityData' type: array MonitorConfigPolicyCreateData: description: A monitor configuration policy data. properties: attributes: $ref: '#/components/schemas/MonitorConfigPolicyAttributeCreateRequest' type: $ref: '#/components/schemas/MonitorConfigPolicyResourceType' required: - type - attributes type: object ReadinessGateThresholdType: description: The definition of `ReadinessGateThresholdType` object. enum: - ANY - ALL example: ANY type: string x-enum-varnames: - ANY - ALL SecurityMonitoringRuleKeepAlive: description: 'Once a signal is generated, the signal will remain "open" if a case is matched at least once within this keep alive window. For third party detection method, this field is not used.' enum: - 0 - 60 - 300 - 600 - 900 - 1800 - 3600 - 7200 - 10800 - 21600 - 43200 - 86400 format: int32 type: integer x-enum-varnames: - ZERO_MINUTES - ONE_MINUTE - FIVE_MINUTES - TEN_MINUTES - FIFTEEN_MINUTES - THIRTY_MINUTES - ONE_HOUR - TWO_HOURS - THREE_HOURS - SIX_HOURS - TWELVE_HOURS - ONE_DAY CaseResourceType: default: case description: Case resource type enum: - case example: case type: string x-enum-varnames: - CASE ObservabilityPipelineDedupeProcessorType: default: dedupe description: The processor type. The value should always be `dedupe`. enum: - dedupe example: dedupe type: string x-enum-varnames: - DEDUPE ServiceDefinitionV2Dot2Pagerduty: description: PagerDuty integration for the service. properties: service-url: description: PagerDuty service url. example: https://my-org.pagerduty.com/service-directory/PMyService type: string type: object x-ignore-duplicate-object: true ObservabilityPipelineSentinelOneDestinationRegion: description: The SentinelOne region to send logs to. enum: - us - eu - ca - data_set_us example: us type: string x-enum-varnames: - US - EU - CA - DATA_SET_US SloReportCreateRequestAttributes: description: The attributes portion of the SLO report request. properties: from_ts: description: The `from` timestamp for the report in epoch seconds. example: 1690901870 format: int64 type: integer interval: $ref: '#/components/schemas/SLOReportInterval' query: description: The query string used to filter SLO results. Some examples of queries include `service:` and `slo-name`. example: slo_type:metric type: string timezone: description: The timezone used to determine the start and end of each interval. For example, weekly intervals start at 12am on Sunday in the specified timezone. example: America/New_York type: string to_ts: description: The `to` timestamp for the report in epoch seconds. example: 1706803070 format: int64 type: integer required: - query - from_ts - to_ts type: object ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptions: description: Controls how partial redaction is applied, including character count and direction. properties: characters: description: The `ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptions` `characters`. example: 4 format: int64 type: integer direction: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptionsDirection' required: - characters - direction type: object ObservabilityPipelineGeneratedMetricIncrementByField: description: Strategy that increments a generated metric based on the value of a log field. properties: field: description: Name of the log field containing the numeric value to increment the metric by. example: errors type: string strategy: $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByFieldStrategy' required: - strategy - field type: object FullAPIKeyAttributes: description: Attributes of a full API key. properties: category: description: The category of the API key. type: string example: example_value created_at: description: Creation date of the API key. example: '2020-11-23T10:00:00.000Z' format: date-time readOnly: true type: string key: description: The API key. readOnly: true type: string x-secret: true example: example_value last4: description: The last four characters of the API key. example: abcd maxLength: 4 minLength: 4 readOnly: true type: string x-secret: true modified_at: description: Date the API key was last modified. example: '2020-11-23T10:00:00.000Z' format: date-time readOnly: true type: string name: description: Name of the API key. example: API Key for submitting metrics type: string remote_config_read_enabled: description: The remote config read enabled status. type: boolean example: true type: object Weekday: description: A day of the week. enum: - monday - tuesday - wednesday - thursday - friday - saturday - sunday type: string x-enum-varnames: - MONDAY - TUESDAY - WEDNESDAY - THURSDAY - FRIDAY - SATURDAY - SUNDAY DataTransformProperties: description: The properties of the data transformer. properties: outputs: description: A JavaScript function that returns the transformed data. example: "${(() => {return {\n allItems: [...fetchOrder1.outputs.items, ...fetchOrder2.outputs.items],\n}})()}" type: string type: object EscalationPolicyStepRelationships: description: Represents the relationship of an escalation policy step to its targets. properties: targets: $ref: '#/components/schemas/EscalationTargets' type: object IncidentFieldAttributesMultipleValue: description: A field with potentially multiple values selected. properties: type: $ref: '#/components/schemas/IncidentFieldAttributesValueType' value: description: The multiple values selected for this field. example: - '1.0' - '1.1' items: description: A value which has been selected for the parent field. example: '1.1' type: string nullable: true type: array type: object LogsMetricGroupBy: description: A group by rule. properties: path: description: The path to the value the log-based metric will be aggregated over. example: '@http.status_code' type: string tag_name: description: Eventual name of the tag that gets created. By default, the path attribute is used as the tag name. example: status_code type: string required: - path type: object ObservabilityPipelineGeneratedMetricMetricType: description: Type of metric to create. enum: - count - gauge - distribution example: count type: string x-enum-varnames: - COUNT - GAUGE - DISTRIBUTION CustomDestinationResponseForwardDestination: description: A custom destination's location to forward logs. oneOf: - $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationHttp' - $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationSplunk' - $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationElasticsearch' RelationshipToRule: description: Scorecard create rule response relationship. properties: scorecard: $ref: '#/components/schemas/RelationshipToRuleData' type: object SecurityMonitoringRuleImpossibleTravelOptions: description: Options on impossible travel detection method. properties: baselineUserLocations: $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptionsBaselineUserLocations' type: object AzureUCConfigPairType: default: azure_uc_configs description: Type of Azure config pair. enum: - azure_uc_configs example: azure_uc_configs type: string x-enum-varnames: - AZURE_UC_CONFIGS CustomDestinationForwardDestination: description: A custom destination's location to forward logs. oneOf: - $ref: '#/components/schemas/CustomDestinationForwardDestinationHttp' - $ref: '#/components/schemas/CustomDestinationForwardDestinationSplunk' - $ref: '#/components/schemas/CustomDestinationForwardDestinationElasticsearch' Case3rdPartyTicketStatus: default: IN_PROGRESS description: Case status enum: - IN_PROGRESS - COMPLETED - FAILED example: COMPLETED readOnly: true type: string x-enum-varnames: - IN_PROGRESS - COMPLETED - FAILED TeamAttributes: description: Team attributes properties: avatar: description: Unicode representation of the avatar for the team, limited to a single grapheme example: 🥑 nullable: true type: string banner: description: Banner selection for the team format: int64 nullable: true type: integer example: 42 created_at: description: Creation date of the team format: date-time type: string example: example_value description: description: Free-form markdown description/content for the team's homepage nullable: true type: string example: example_value handle: description: The team's identifier example: example-team maxLength: 195 type: string hidden_modules: description: Collection of hidden modules for the team items: description: String identifier of the module type: string type: array link_count: description: The number of links belonging to the team format: int32 maximum: 2147483647 readOnly: true type: integer example: 42 modified_at: description: Modification date of the team format: date-time type: string example: example_value name: description: The name of the team example: Example Team maxLength: 200 type: string summary: description: A brief summary of the team, derived from the `description` maxLength: 120 nullable: true type: string example: example_value user_count: description: The number of users belonging to the team format: int32 maximum: 2147483647 readOnly: true type: integer example: 42 visible_modules: description: Collection of visible modules for the team items: description: String identifier of the module type: string type: array required: - handle - name type: object Role: description: Role object returned by the API. properties: attributes: $ref: '#/components/schemas/RoleAttributes' id: description: The unique identifier of the role. type: string example: abc-123-def relationships: $ref: '#/components/schemas/RoleResponseRelationships' type: $ref: '#/components/schemas/RolesType' required: - type type: object x-merge-override: required: false CloudConfigurationComplianceRuleOptions: additionalProperties: {} description: 'Options for cloud_configuration rules. Fields `resourceType` and `regoRule` are mandatory when managing custom `cloud_configuration` rules. ' properties: complexRule: description: 'Whether the rule is a complex one. Must be set to true if `regoRule.resourceTypes` contains more than one item. Defaults to false. ' type: boolean example: true regoRule: $ref: '#/components/schemas/CloudConfigurationRegoRule' resourceType: description: 'Main resource type to be checked by the rule. It should be specified again in `regoRule.resourceTypes`. ' example: aws_acm type: string type: object CustomDestinationResponseElasticsearchDestinationAuth: additionalProperties: description: Basic access authentication. description: Basic access authentication. type: object AuthNMappingsType: default: authn_mappings description: AuthN Mappings resource type. enum: - authn_mappings example: authn_mappings type: string x-enum-varnames: - AUTHN_MAPPINGS ServiceDefinitionV2Dot1Pagerduty: description: PagerDuty integration for the service. properties: service-url: description: PagerDuty service url. example: https://my-org.pagerduty.com/service-directory/PMyService type: string type: object x-ignore-duplicate-object: true RumMetricCompute: description: The compute rule to compute the rum-based metric. properties: aggregation_type: $ref: '#/components/schemas/RumMetricComputeAggregationType' include_percentiles: $ref: '#/components/schemas/RumMetricComputeIncludePercentiles' path: description: 'The path to the value the rum-based metric will aggregate on. Only present when `aggregation_type` is `distribution`.' example: '@duration' type: string required: - aggregation_type type: object OutboundEdge: description: The definition of `OutboundEdge` object. properties: branchName: description: The `OutboundEdge` `branchName`. example: '' type: string nextStepName: description: The `OutboundEdge` `nextStepName`. example: '' type: string required: - nextStepName - branchName type: object IncidentServiceIncludedItems: description: An object related to an incident service which is present in the included payload. oneOf: - $ref: '#/components/schemas/User' ScheduleRequestDataAttributesLayersItemsMembersItems: description: Defines a single member within a schedule layer, including the reference to the underlying user. properties: user: $ref: '#/components/schemas/ScheduleRequestDataAttributesLayersItemsMembersItemsUser' type: object MonitorNotificationRuleRecipients: description: A list of recipients to notify. Uses the same format as the monitor `message` field. Must not start with an '@'. example: - slack-test-channel - jira-test items: description: individual recipient. maxLength: 255 type: string maxItems: 20 minItems: 1 type: array uniqueItems: true ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternOptions: description: Options for defining a custom regex pattern. properties: rule: description: A regular expression used to detect sensitive values. Must be a valid regex. example: \b\d{16}\b type: string required: - rule type: object OutcomesBatchType: default: batched-outcome description: The JSON:API type for scorecard outcomes. enum: - batched-outcome example: batched-outcome type: string x-enum-varnames: - BATCHED_OUTCOME ObservabilityPipelineAwsAuth: description: 'AWS authentication credentials used for accessing AWS services such as S3. If omitted, the system’s default credentials are used (for example, the IAM role and environment variables). ' properties: assume_role: description: The Amazon Resource Name (ARN) of the role to assume. type: string example: example_value external_id: description: A unique identifier for cross-account role assumption. type: string example: abc-123-def session_name: description: A session identifier used for logging and tracing the assumed role session. type: string example: Example Monitor type: object ObservabilityPipelineConfigProcessorItem: description: A processor for the pipeline. oneOf: - $ref: '#/components/schemas/ObservabilityPipelineFilterProcessor' - $ref: '#/components/schemas/ObservabilityPipelineParseJSONProcessor' - $ref: '#/components/schemas/ObservabilityPipelineQuotaProcessor' - $ref: '#/components/schemas/ObservabilityPipelineAddFieldsProcessor' - $ref: '#/components/schemas/ObservabilityPipelineRemoveFieldsProcessor' - $ref: '#/components/schemas/ObservabilityPipelineRenameFieldsProcessor' - $ref: '#/components/schemas/ObservabilityPipelineGenerateMetricsProcessor' - $ref: '#/components/schemas/ObservabilityPipelineSampleProcessor' - $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessor' - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessor' - $ref: '#/components/schemas/ObservabilityPipelineOcsfMapperProcessor' - $ref: '#/components/schemas/ObservabilityPipelineAddEnvVarsProcessor' - $ref: '#/components/schemas/ObservabilityPipelineDedupeProcessor' - $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableProcessor' - $ref: '#/components/schemas/ObservabilityPipelineReduceProcessor' - $ref: '#/components/schemas/ObservabilityPipelineThrottleProcessor' OutcomesBatchRequestData: description: Scorecard outcomes batch request data. properties: attributes: $ref: '#/components/schemas/OutcomesBatchAttributes' type: $ref: '#/components/schemas/OutcomesBatchType' type: object IncidentAttachmentUpdateAttributes: description: Incident attachment attributes. oneOf: - $ref: '#/components/schemas/IncidentAttachmentPostmortemAttributes' - $ref: '#/components/schemas/IncidentAttachmentLinkAttributes' CustomDestinationResponseDefinition: description: The definition of a custom destination. properties: attributes: $ref: '#/components/schemas/CustomDestinationResponseAttributes' id: description: The custom destination ID. example: be5d7a69-d0c8-4d4d-8ee8-bba292d98139 readOnly: true type: string type: $ref: '#/components/schemas/CustomDestinationType' type: object ServiceDefinitionV2LinkType: description: Link type. enum: - doc - wiki - runbook - url - repo - dashboard - oncall - code - link example: runbook type: string x-enum-varnames: - DOC - WIKI - RUNBOOK - URL - REPO - DASHBOARD - ONCALL - CODE - LINK ObservabilityPipelineReduceProcessor: description: The `reduce` processor aggregates and merges logs based on matching keys and merge strategies. properties: group_by: description: A list of fields used to group log events for merging. example: - log.user.id - log.device.id items: type: string type: array id: description: The unique identifier for this processor. example: reduce-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: env:prod type: string inputs: description: A list of component IDs whose output is used as the input for this processor. example: - parse-json-processor items: type: string type: array merge_strategies: description: List of merge strategies defining how values from grouped events should be combined. items: $ref: '#/components/schemas/ObservabilityPipelineReduceProcessorMergeStrategy' type: array type: $ref: '#/components/schemas/ObservabilityPipelineReduceProcessorType' required: - id - type - include - inputs - group_by - merge_strategies type: object RumMetricResponseFilter: description: The rum-based metric filter. RUM events matching this filter will be aggregated in this metric. properties: query: description: The search query - following the RUM search syntax. example: service:web* AND @http.status_code:[200 TO 299] type: string type: object IncidentAttachmentsResponseIncludedItem: description: An object related to an attachment that is included in the response. oneOf: - $ref: '#/components/schemas/User' SecurityMonitoringFilter: description: The rule's suppression filter. properties: action: $ref: '#/components/schemas/SecurityMonitoringFilterAction' query: description: Query for selecting logs to apply the filtering action. type: string example: avg:system.cpu.user{*} type: object AuthNMappingAttributes: description: Attributes of AuthN Mapping. properties: attribute_key: description: Key portion of a key/value pair of the attribute sent from the Identity Provider. example: member-of type: string attribute_value: description: Value portion of a key/value pair of the attribute sent from the Identity Provider. example: Development type: string created_at: description: Creation time of the AuthN Mapping. format: date-time readOnly: true type: string example: example_value modified_at: description: Time of last AuthN Mapping modification. format: date-time readOnly: true type: string example: example_value saml_assertion_attribute_id: description: The ID of the SAML assertion attribute. example: '0' type: string type: object EscalationPolicyCreateRequestDataAttributes: description: Defines the attributes for creating an escalation policy, including its description, name, resolution behavior, retries, and steps. properties: name: description: Specifies the name for the new escalation policy. example: On-Call Escalation Policy type: string resolve_page_on_policy_end: description: Indicates whether the page is automatically resolved when the policy ends. type: boolean example: true retries: description: Specifies how many times the escalation sequence is retried if there is no response. format: int64 type: integer example: 42 steps: description: A list of escalation steps, each defining assignment, escalation timeout, and targets for the new policy. items: $ref: '#/components/schemas/EscalationPolicyCreateRequestDataAttributesStepsItems' type: array required: - name - steps type: object JiraIssueResult: description: Jira issue information properties: issue_id: description: Jira issue ID type: string example: abc-123-def issue_key: description: Jira issue key type: string example: example_value issue_url: description: Jira issue URL type: string example: https://app.datadoghq.com project_key: description: Jira project key type: string example: example_value type: object LogsArchiveDestinationGCSType: default: gcs description: Type of the GCS archive destination. enum: - gcs example: gcs type: string x-enum-varnames: - GCS ScheduleRequestDataAttributesLayersItemsMembersItemsUser: description: Identifies the user participating in this layer as a single object with an `id`. properties: id: description: The user's ID. example: 00000000-aba1-0000-0000-000000000000 type: string type: object TeamLinkAttributes: description: Team link attributes properties: label: description: The link's label example: Link label maxLength: 256 type: string position: description: The link's position, used to sort links for the team format: int32 maximum: 2147483647 type: integer example: 42 team_id: description: ID of the team the link is associated with readOnly: true type: string example: abc-123-def url: description: The URL for the link example: https://example.com type: string required: - label - url type: object ActionQuery: description: An action query. This query type is used to trigger an action, such as sending a HTTP request. properties: events: description: Events to listen for downstream of the action query. items: $ref: '#/components/schemas/AppBuilderEvent' type: array id: description: The ID of the action query. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 format: uuid type: string name: description: A unique identifier for this action query. This name is also used to access the query's result throughout the app. example: fetchPendingOrders type: string properties: $ref: '#/components/schemas/ActionQueryProperties' type: $ref: '#/components/schemas/ActionQueryType' required: - id - name - type - properties type: object CaseCreate: description: Case creation data properties: attributes: $ref: '#/components/schemas/CaseCreateAttributes' relationships: $ref: '#/components/schemas/CaseCreateRelationships' type: $ref: '#/components/schemas/CaseResourceType' required: - attributes - type type: object AwsCURConfigResponse: description: Response of AWS CUR config. properties: data: $ref: '#/components/schemas/AwsCURConfig' type: object PermissionAttributes: description: Attributes of a permission. properties: created: description: Creation time of the permission. format: date-time type: string example: example_value description: description: Description of the permission. type: string example: example_value display_name: description: Displayed name for the permission. type: string example: Example Monitor display_type: description: Display type. type: string example: metric alert group_name: description: Name of the permission group. type: string example: Example Monitor name: description: Name of the permission. type: string example: Example Monitor restricted: description: Whether or not the permission is restricted. type: boolean example: true type: object RelationshipToOutcome: description: The JSON:API relationship to a scorecard outcome. properties: data: $ref: '#/components/schemas/RelationshipToOutcomeData' type: object NotificationRule: description: 'Notification rules allow full control over notifications generated by the various Datadog security products. They allow users to define the conditions under which a notification should be generated (based on rule severities, rule types, rule tags, and so on), and the targets to notify. A notification rule is composed of a rule ID, a rule type, and the rule attributes. All fields are required. ' properties: attributes: $ref: '#/components/schemas/NotificationRuleAttributes' id: $ref: '#/components/schemas/ID' type: $ref: '#/components/schemas/NotificationRulesType' required: - attributes - id - type type: object ActionQueryPollingIntervalInMs: description: If specified, the app will poll the query at the specified interval in milliseconds. The minimum polling interval is 15 seconds. The query will only poll when the app's browser tab is active. oneOf: - example: 30000 format: double minimum: 15000 type: number - description: If this is a string, it must be a valid JavaScript expression that evaluates to a number. example: ${15000} type: string LogsMetricResponse: description: The log-based metric object. properties: data: $ref: '#/components/schemas/LogsMetricResponseData' type: object ApplicationSecurityWafExclusionFilterResponse: description: Response object for a single WAF exclusion filter. properties: data: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterResource' type: object SlackIntegrationMetadata: description: Incident integration metadata for the Slack integration. properties: channels: description: Array of Slack channels in this integration metadata. example: [] items: $ref: '#/components/schemas/SlackIntegrationMetadataChannelItem' type: array required: - channels type: object IncidentTodoResponseData: description: Incident todo response data. properties: attributes: $ref: '#/components/schemas/IncidentTodoAttributes' id: description: The incident todo's ID. example: 00000000-0000-0000-1234-000000000000 type: string relationships: $ref: '#/components/schemas/IncidentTodoRelationships' type: $ref: '#/components/schemas/IncidentTodoType' required: - id - type type: object IncidentIntegrationMetadataCreateRequest: description: Create request for an incident integration metadata. properties: data: $ref: '#/components/schemas/IncidentIntegrationMetadataCreateData' required: - data type: object SensitiveDataScannerTextReplacement: description: Object describing how the scanned event will be replaced. properties: number_of_chars: description: 'Required if type == ''partial_replacement_from_beginning'' or ''partial_replacement_from_end''. It must be > 0.' format: int64 minimum: 0 type: integer example: 42 replacement_string: description: Required if type == 'replacement_string'. type: string example: example_value type: $ref: '#/components/schemas/SensitiveDataScannerTextReplacementType' type: object EscalationPolicyCreateRequest: description: Represents a request to create a new escalation policy, including the policy data. example: data: attributes: name: Escalation Policy 1 resolve_page_on_policy_end: true retries: 2 steps: - assignment: default escalate_after_seconds: 3600 targets: - id: 00000000-aba1-0000-0000-000000000000 type: users - id: 00000000-aba2-0000-0000-000000000000 type: schedules - id: 00000000-aba3-0000-0000-000000000000 type: teams - assignment: round-robin escalate_after_seconds: 3600 targets: - id: 00000000-aba1-0000-0000-000000000000 type: users - id: 00000000-abb1-0000-0000-000000000000 type: users relationships: teams: data: - id: 00000000-da3a-0000-0000-000000000000 type: teams type: policies properties: data: $ref: '#/components/schemas/EscalationPolicyCreateRequestData' required: - data type: object RelationshipToIncidentIntegrationMetadataData: description: A relationship reference for an integration metadata object. example: id: 00000000-abcd-0002-0000-000000000000 type: incident_integrations properties: id: description: A unique identifier that represents the integration metadata. example: 00000000-abcd-0001-0000-000000000000 type: string type: $ref: '#/components/schemas/IncidentIntegrationMetadataType' required: - id - type type: object x-merge-override: required: false CloudWorkloadSecurityAgentRuleData: description: Object for a single Agent rule properties: attributes: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleAttributes' id: description: The ID of the Agent rule example: 3dd-0uc-h1s type: string type: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleType' type: object AWSAccountResponseData: description: AWS Account response data. properties: attributes: $ref: '#/components/schemas/AWSAccountResponseAttributes' id: $ref: '#/components/schemas/AWSAccountConfigID' type: $ref: '#/components/schemas/AWSAccountType' required: - id - type type: object RelationshipToTeam: description: Relationship to team. properties: data: $ref: '#/components/schemas/RelationshipToTeamData' type: object x-merge-override: required: false SecurityMonitoringRuleCreatePayload: description: Create a new rule. oneOf: - $ref: '#/components/schemas/SecurityMonitoringStandardRuleCreatePayload' - $ref: '#/components/schemas/SecurityMonitoringSignalRuleCreatePayload' - $ref: '#/components/schemas/CloudConfigurationRuleCreatePayload' MonitorNotificationRuleRelationshipsCreatedBy: description: The user who created the monitor notification rule. properties: data: $ref: '#/components/schemas/MonitorNotificationRuleRelationshipsCreatedByData' type: object LayerRelationshipsMembers: description: Holds an array of references to the members of a Layer, each containing member IDs. properties: data: description: The list of members who belong to this layer. items: $ref: '#/components/schemas/LayerRelationshipsMembersDataItems' type: array type: object ProjectAttributes: description: Project attributes properties: key: description: The project's key example: CASEM type: string name: description: Project's name type: string example: Example Monitor type: object JSONAPIErrorItemSource: description: References to the source of the error. properties: header: description: A string indicating the name of a single request header which caused the error. example: Authorization type: string parameter: description: A string indicating which URI query parameter caused the error. example: limit type: string pointer: description: A JSON pointer to the value in the request document that caused the error. example: /data/attributes/title type: string type: object ObservabilityPipelineSensitiveDataScannerProcessorScopeInclude: description: Includes only specific fields for sensitive data scanning. properties: options: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeOptions' target: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeIncludeTarget' required: - target - options type: object EntityV3Datastore: additionalProperties: false description: Schema for datastore entities. properties: apiVersion: $ref: '#/components/schemas/EntityV3APIVersion' datadog: $ref: '#/components/schemas/EntityV3DatastoreDatadog' extensions: additionalProperties: {} description: Custom extensions. This is the free-formed field to send client side metadata. No Datadog features are affected by this field. type: object x-ignore-duplicate-object: true integrations: $ref: '#/components/schemas/EntityV3Integrations' kind: $ref: '#/components/schemas/EntityV3DatastoreKind' metadata: $ref: '#/components/schemas/EntityV3Metadata' spec: $ref: '#/components/schemas/EntityV3DatastoreSpec' required: - apiVersion - kind - metadata type: object IncidentServiceType: default: services description: Incident service resource type. enum: - services example: services type: string x-enum-varnames: - SERVICES OutcomesBatchRequestItem: description: Scorecard outcome for a specific rule, for a given service within a batched update. properties: remarks: description: Any remarks regarding the scorecard rule's evaluation, and supports HTML hyperlinks. example: 'See: Services' type: string rule_id: $ref: '#/components/schemas/RuleId' service_name: description: The unique name for a service in the catalog. example: my-service type: string state: $ref: '#/components/schemas/State' required: - rule_id - service_name - state type: object MonitorConfigPolicyPolicyCreateRequest: description: Configuration for the policy. oneOf: - $ref: '#/components/schemas/MonitorConfigPolicyTagPolicyCreateRequest' ApplicationSecurityWafCustomRuleCreateAttributes: description: Create a new WAF custom rule. properties: action: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleAction' blocking: description: Indicates whether the WAF custom rule will block the request. example: false type: boolean conditions: description: 'Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF rule to trigger' items: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCondition' type: array enabled: description: Indicates whether the WAF custom rule is enabled. example: false type: boolean name: description: The Name of the WAF custom rule. example: Block request from a bad useragent type: string path_glob: description: The path glob for the WAF custom rule. example: /api/search/* type: string scope: description: The scope of the WAF custom rule. items: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleScope' type: array tags: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleTags' required: - enabled - blocking - name - tags - conditions type: object SecurityMonitoringSuppressionCreateRequest: description: Request object that includes the suppression rule that you would like to create. properties: data: $ref: '#/components/schemas/SecurityMonitoringSuppressionCreateData' required: - data type: object EntityResponseMeta: description: Entity metadata. properties: count: description: Total entities count. format: int64 type: integer example: 42 includeCount: description: Total included data count. format: int64 type: integer example: 42 type: object MonitorConfigPolicyAttributeResponse: description: Policy and policy type for a monitor configuration policy. properties: policy: $ref: '#/components/schemas/MonitorConfigPolicyPolicy' policy_type: $ref: '#/components/schemas/MonitorConfigPolicyType' type: object LogsArchiveCreateRequestDefinition: description: The definition of an archive. properties: attributes: $ref: '#/components/schemas/LogsArchiveCreateRequestAttributes' type: default: archives description: The type of the resource. The value should always be archives. example: archives type: string required: - type type: object SecurityTrigger: description: Trigger a workflow from a Security Signal or Finding. For automatic triggering a handle must be configured and the workflow must be published. properties: rateLimit: $ref: '#/components/schemas/TriggerRateLimit' type: object AwsCURConfigAttributes: description: Attributes for An AWS CUR config. properties: account_filters: $ref: '#/components/schemas/AccountFilteringConfig' account_id: description: The AWS account ID. example: '123456789123' type: string bucket_name: description: The AWS bucket name used to store the Cost and Usage Report. example: dd-cost-bucket type: string bucket_region: description: The region the bucket is located in. example: us-east-1 type: string created_at: description: The timestamp when the AWS CUR config was created. pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$ type: string x-merge-override: format: false example: example_value error_messages: description: The error messages for the AWS CUR config. items: type: string type: array months: deprecated: true description: The number of months the report has been backfilled. format: int32 maximum: 36 type: integer example: 42 report_name: description: The name of the Cost and Usage Report. example: dd-report-name type: string report_prefix: description: The report prefix used for the Cost and Usage Report. example: dd-report-prefix type: string status: description: The status of the AWS CUR. example: active type: string status_updated_at: description: The timestamp when the AWS CUR config status was updated. pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$ type: string x-merge-override: format: false example: OK updated_at: description: The timestamp when the AWS CUR config status was updated. pattern: ^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}.\d{6}$ type: string x-merge-override: format: false example: '2026-04-17T12:00:00Z' required: - account_id - bucket_name - bucket_region - report_name - report_prefix - status type: object x-merge-override: required: false ServiceDefinitionV2Dot1EmailType: description: Contact type. enum: - email example: email type: string x-enum-varnames: - EMAIL IncidentTodoResponse: description: Response with an incident todo. properties: data: $ref: '#/components/schemas/IncidentTodoResponseData' included: description: Included related resources that the user requested. items: $ref: '#/components/schemas/IncidentTodoResponseIncludedItem' readOnly: true type: array required: - data type: object SensitiveDataScannerCreateGroupResponse: description: Create group response. properties: data: $ref: '#/components/schemas/SensitiveDataScannerGroupResponse' meta: $ref: '#/components/schemas/SensitiveDataScannerMetaVersionOnly' type: object ObservabilityPipelineEnrichmentTableFileSchemaItems: description: Describes a single column and its type in an enrichment table schema. properties: column: description: The `items` `column`. example: region type: string type: $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileSchemaItemsType' required: - column - type type: object ObservabilityPipelineNewRelicDestinationType: default: new_relic description: The destination type. The value should always be `new_relic`. enum: - new_relic example: new_relic type: string x-enum-varnames: - NEW_RELIC HTTPCredentials: description: The definition of `HTTPCredentials` object. oneOf: - $ref: '#/components/schemas/HTTPTokenAuth' ConnectionEnv: description: A list of connections or connection groups used in the workflow. properties: connectionGroups: description: The `ConnectionEnv` `connectionGroups`. items: $ref: '#/components/schemas/ConnectionGroup' type: array connections: description: The `ConnectionEnv` `connections`. items: $ref: '#/components/schemas/Connection' type: array env: $ref: '#/components/schemas/ConnectionEnvEnv' required: - env type: object RumMetricResponseCompute: description: The compute rule to compute the rum-based metric. properties: aggregation_type: $ref: '#/components/schemas/RumMetricComputeAggregationType' include_percentiles: $ref: '#/components/schemas/RumMetricComputeIncludePercentiles' path: description: 'The path to the value the rum-based metric will aggregate on. Only present when `aggregation_type` is `distribution`.' example: '@duration' type: string type: object ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactAction: description: Action type that redacts part of the sensitive data while preserving a configurable number of characters, typically used for masking purposes (e.g., show last 4 digits of a credit card). enum: - partial_redact example: partial_redact type: string x-enum-varnames: - PARTIAL_REDACT ExternalUserMeta: description: Metadata associated with a user. properties: created: description: The date and time the user was created. example: '2024-10-17T12:53:35.793Z' format: date-time type: string lastModified: description: The date and time the user was last changed. example: '2024-10-19T12:53:35.793Z' format: date-time type: string location: description: URL identifying the resource. example: https://app.datadoghq.com/api/scim/v2/Users/13a95654-b76d-478d-8636-157a7e461d7c type: string resourceType: description: Type of resource. example: User type: string type: object IncidentTimelineCellMarkdownCreateAttributesContent: description: The Markdown timeline cell contents. properties: content: description: The Markdown content of the cell. example: An example timeline cell message. nullable: false type: string type: object CustomFrameworkDataAttributes: description: Framework Data Attributes. properties: description: description: Framework Description type: string example: example_value handle: description: Framework Handle example: sec2 type: string icon_url: description: Framework Icon URL type: string example: https://app.datadoghq.com name: description: Framework Name example: security-framework type: string requirements: description: Framework Requirements items: $ref: '#/components/schemas/CustomFrameworkRequirement' type: array version: description: Framework Version example: '2' type: string required: - handle - version - name - requirements type: object ExternalUserGroup: description: Definition of a group. properties: displayName: description: A human-readable name for the group. type: string example: Example Monitor externalId: description: An identifier for the resource as defined by the provisioning client. type: string example: abc-123-def id: description: The identifier of the resource. Not required when creating a group. type: string example: abc-123-def members: description: Members of the group. items: $ref: '#/components/schemas/ExternalUserGroupMembersItems' type: array meta: $ref: '#/components/schemas/ExternalUserGroupMeta' schemas: description: Input JSON Schemas. example: - urn:ietf:params:scim:schemas:core:2.0:Group items: type: string type: array type: object CustomDestinationResponseForwardDestinationHttpType: default: http description: Type of the HTTP destination. enum: - http example: http type: string x-enum-varnames: - HTTP LogsMetricResponseComputeAggregationType: description: The type of aggregation to use. enum: - count - distribution example: distribution type: string x-enum-varnames: - COUNT - DISTRIBUTION EntityToSchema: description: Entity to detail schema relationship. properties: data: $ref: '#/components/schemas/RelationshipItem' type: object SecurityMonitoringSignalRuleType: description: The rule type. enum: - signal_correlation type: string x-enum-varnames: - SIGNAL_CORRELATION ServiceAccountCreateAttributes: description: Attributes of the created user. properties: email: description: The email of the user. example: jane.doe@example.com type: string name: description: The name of the user. type: string example: Example Monitor service_account: description: Whether the user is a service account. Must be true. example: true type: boolean title: description: The title of the user. type: string example: Example Monitor required: - email - service_account type: object IncidentTodoAnonymousAssignee: description: Anonymous assignee entity. properties: icon: description: URL for assignee's icon. example: https://a.slack-edge.com/80588/img/slackbot_48.png type: string id: description: Anonymous assignee's ID. example: USLACKBOT type: string name: description: Assignee's name. example: Slackbot type: string source: $ref: '#/components/schemas/IncidentTodoAnonymousAssigneeSource' required: - id - icon - name - source type: object RetentionFilter: description: The definition of the retention filter. properties: attributes: $ref: '#/components/schemas/RetentionFilterAttributes' id: description: The ID of the retention filter. example: 7RBOb7dLSYWI01yc3pIH8w type: string type: $ref: '#/components/schemas/ApmRetentionFilterType' required: - id - type - attributes type: object SensitiveDataScannerCreateRuleResponse: description: Create rule response. properties: data: $ref: '#/components/schemas/SensitiveDataScannerRuleResponse' meta: $ref: '#/components/schemas/SensitiveDataScannerMetaVersionOnly' type: object UserResourceType: default: user description: User resource type. enum: - user example: user type: string x-enum-varnames: - USER CustomDestinationType: default: custom_destination description: The type of the resource. The value should always be `custom_destination`. enum: - custom_destination example: custom_destination type: string x-enum-varnames: - CUSTOM_DESTINATION PowerpackInnerWidgetLayout: description: Powerpack inner widget layout. properties: height: description: The height of the widget. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer width: description: The width of the widget. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer x: description: The position of the widget on the x (horizontal) axis. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer y: description: The position of the widget on the y (vertical) axis. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer required: - x - y - width - height type: object EntityV3APISpec: additionalProperties: false description: The definition of Entity V3 API Spec object. properties: implementedBy: description: Services which implemented the API. items: type: string type: array interface: $ref: '#/components/schemas/EntityV3APISpecInterface' lifecycle: description: The lifecycle state of the component. minLength: 1 type: string example: example_value tier: description: The importance of the component. minLength: 1 type: string example: example_value type: description: The type of API. type: string example: metric alert type: object RetryStrategy: description: The definition of `RetryStrategy` object. properties: kind: $ref: '#/components/schemas/RetryStrategyKind' linear: $ref: '#/components/schemas/RetryStrategyLinear' required: - kind type: object IncidentAttachmentData: description: A single incident attachment. example: attributes: attachment: documentUrl: '' title: Postmortem IR-123 attachment_type: postmortem id: 00000000-abcd-0002-0000-000000000000 relationships: last_modified_by_user: data: id: 00000000-0000-0000-cccc-000000000000 type: users type: incident_attachments properties: attributes: $ref: '#/components/schemas/IncidentAttachmentAttributes' id: description: A unique identifier that represents the incident attachment. example: 00000000-abcd-0001-0000-000000000000 type: string relationships: $ref: '#/components/schemas/IncidentAttachmentRelationships' type: $ref: '#/components/schemas/IncidentAttachmentType' required: - type - attributes - id - relationships type: object CaseType: description: Case type enum: - STANDARD example: STANDARD type: string x-enum-varnames: - STANDARD RetryStrategyKind: description: The definition of `RetryStrategyKind` object. enum: - RETRY_STRATEGY_LINEAR example: RETRY_STRATEGY_LINEAR type: string x-enum-varnames: - RETRY_STRATEGY_LINEAR CreatePageRequestDataAttributes: description: Details about the On-Call Page you want to create. properties: description: description: A short summary of the issue or context. type: string example: example_value tags: description: Tags to help categorize or filter the page. items: type: string type: array target: $ref: '#/components/schemas/CreatePageRequestDataAttributesTarget' title: description: The title of the page. example: 'Service: Test is down' type: string urgency: $ref: '#/components/schemas/PageUrgency' required: - target - title - urgency type: object MonitorNotificationRuleRelationshipsCreatedByData: description: Data for the user who created the monitor notification rule. nullable: true properties: id: description: User ID of the monitor notification rule creator. example: 00000000-0000-1234-0000-000000000000 type: string type: $ref: '#/components/schemas/UsersType' type: object SecurityFilterResponse: description: Response object which includes a single security filter. properties: data: $ref: '#/components/schemas/SecurityFilter' meta: $ref: '#/components/schemas/SecurityFilterMeta' type: object AWSAccountTags: description: Tags to apply to all hosts and metrics reporting for this account. Defaults to `[]`. items: description: Tag in the form `key:value`. example: env:prod type: string nullable: true type: array IncidentTimelineCellMarkdownContentType: default: markdown description: Type of the Markdown timeline cell. enum: - markdown example: markdown type: string x-enum-varnames: - MARKDOWN ObservabilityPipelineGoogleCloudStorageDestination: description: 'The `google_cloud_storage` destination stores logs in a Google Cloud Storage (GCS) bucket. It requires a bucket name, GCP authentication, and metadata fields. ' properties: acl: $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationAcl' auth: $ref: '#/components/schemas/ObservabilityPipelineGcpAuth' bucket: description: Name of the GCS bucket. example: error-logs type: string id: description: Unique identifier for the destination component. example: gcs-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - datadog-agent-source items: type: string type: array key_prefix: description: Optional prefix for object keys within the GCS bucket. type: string example: example_value metadata: description: Custom metadata to attach to each object uploaded to the GCS bucket. items: $ref: '#/components/schemas/ObservabilityPipelineMetadataEntry' type: array storage_class: $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationStorageClass' type: $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestinationType' required: - id - type - inputs - bucket - auth - storage_class - acl type: object IncidentServiceCreateRequest: description: Create request with an incident service payload. properties: data: $ref: '#/components/schemas/IncidentServiceCreateData' required: - data type: object CreateWorkflowRequest: description: A request object for creating a new workflow. example: data: attributes: description: A sample workflow. name: Example Workflow published: true spec: annotations: - display: bounds: height: 150 width: 300 x: -375 y: -0.5 id: 99999999-9999-9999-9999-999999999999 markdownTextAnnotation: text: Example annotation. connectionEnvs: - connections: - connectionId: 11111111-1111-1111-1111-111111111111 label: INTEGRATION_DATADOG env: default handle: my-handle inputSchema: parameters: - defaultValue: default name: input type: STRING outputSchema: parameters: - name: output type: ARRAY_OBJECT value: '{{ Steps.Step1 }}' steps: - actionId: com.datadoghq.dd.monitor.listMonitors connectionLabel: INTEGRATION_DATADOG name: Step1 outboundEdges: - branchName: main nextStepName: Step2 parameters: - name: tags value: service:monitoring - actionId: com.datadoghq.core.noop name: Step2 triggers: - monitorTrigger: rateLimit: count: 1 interval: 3600s startStepNames: - Step1 - githubWebhookTrigger: {} startStepNames: - Step1 tags: - team:infra - service:monitoring - foo:bar type: workflows properties: data: $ref: '#/components/schemas/WorkflowData' required: - data type: object ServiceDefinitionV1Integrations: description: Third party integrations that Datadog supports. properties: pagerduty: $ref: '#/components/schemas/ServiceDefinitionV1Pagerduty' type: object ObservabilityPipelineSensitiveDataScannerProcessorCustomPattern: description: Defines a custom regex-based pattern for identifying sensitive data in logs. properties: options: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternOptions' type: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorCustomPatternType' required: - type - options type: object CloudWorkloadSecurityAgentRuleKill: description: Kill system call applied on the container matching the rule properties: signal: description: Supported signals for the kill system call type: string example: example_value type: object UserAttributes: description: Attributes of user object returned by the API. properties: created_at: description: Creation time of the user. format: date-time type: string example: example_value disabled: description: Whether the user is disabled. type: boolean example: true email: description: Email of the user. type: string example: user@example.com handle: description: Handle of the user. type: string example: example_value icon: description: URL of the user's icon. type: string example: example_value mfa_enabled: description: If user has MFA enabled. readOnly: true type: boolean example: true modified_at: description: Time that the user was last modified. format: date-time type: string example: example_value name: description: Name of the user. nullable: true type: string example: Example Monitor service_account: description: Whether the user is a service account. type: boolean example: true status: description: Status of the user. type: string example: OK title: description: Title of the user. nullable: true type: string example: Example Monitor verified: description: Whether the user is verified. type: boolean example: true type: object ApplicationSecurityWafCustomRuleConditionParameters: description: The scope of the WAF custom rule. properties: data: description: Identifier of a list of data from the denylist. Can only be used as substitution from the list parameter. example: blocked_users type: string inputs: description: List of inputs on which at least one should match with the given operator. items: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionInput' type: array list: description: 'List of value to use with the condition. Only used with the phrase_match, !phrase_match, exact_match and !exact_match operator.' items: type: string type: array options: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleConditionOptions' regex: description: Regex to use with the condition. Only used with match_regex and !match_regex operator. example: path.* type: string value: description: Store the captured value in the specified tag name. Only used with the capture_data operator. example: custom_tag type: string required: - inputs type: object SensitiveDataScannerTextReplacementType: default: none description: 'Type of the replacement text. None means no replacement. hash means the data will be stubbed. replacement_string means that one can chose a text to replace the data. partial_replacement_from_beginning allows a user to partially replace the data from the beginning, and partial_replacement_from_end on the other hand, allows to replace data from the end.' enum: - none - hash - replacement_string - partial_replacement_from_beginning - partial_replacement_from_end type: string x-enum-varnames: - NONE - HASH - REPLACEMENT_STRING - PARTIAL_REPLACEMENT_FROM_BEGINNING - PARTIAL_REPLACEMENT_FROM_END IncidentType: default: incidents description: Incident resource type. enum: - incidents example: incidents type: string x-enum-varnames: - INCIDENTS Component: description: '[Definition of a UI component in the app](https://docs.datadoghq.com/service_management/app_builder/components/)' properties: events: description: Events to listen for on the UI component. items: $ref: '#/components/schemas/AppBuilderEvent' type: array id: description: The ID of the UI component. This property is deprecated; use `name` to identify individual components instead. nullable: true type: string example: abc-123-def name: description: A unique identifier for this UI component. This name is also visible in the app editor. example: '' type: string properties: $ref: '#/components/schemas/ComponentProperties' type: $ref: '#/components/schemas/ComponentType' required: - name - type - properties type: object SpansMetricFilter: description: The span-based metric filter. Spans matching this filter will be aggregated in this metric. properties: query: default: '*' description: The search query - following the span search syntax. example: '@http.status_code:200 service:my-service' type: string type: object EntityV3DatadogIntegrationOpsgenie: additionalProperties: false description: An Opsgenie integration schema. properties: region: description: The region for the Opsgenie integration. minLength: 1 type: string example: example_value serviceURL: description: The service URL for the Opsgenie integration. example: https://www.opsgenie.com/service/shopping-cart minLength: 1 type: string required: - serviceURL type: object InputSchema: description: A list of input parameters for the workflow. These can be used as dynamic runtime values in your workflow. properties: parameters: description: The `InputSchema` `parameters`. items: $ref: '#/components/schemas/InputSchemaParameters' type: array type: object IncidentIntegrationMetadataResponseData: description: Incident integration metadata from a response. properties: attributes: $ref: '#/components/schemas/IncidentIntegrationMetadataAttributes' id: description: The incident integration metadata's ID. example: 00000000-0000-0000-1234-000000000000 type: string relationships: $ref: '#/components/schemas/IncidentIntegrationRelationships' type: $ref: '#/components/schemas/IncidentIntegrationMetadataType' required: - id - type type: object UserTarget: description: Represents a user target for an escalation policy step, including the user's ID and resource type. properties: id: description: Specifies the unique identifier of the user resource. example: 00000000-aba1-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/UserTargetType' required: - type - id type: object SecurityMonitoringSuppressionResponse: description: Response object containing a single suppression rule. properties: data: $ref: '#/components/schemas/SecurityMonitoringSuppression' type: object SecurityFilterMeta: description: Optional metadata associated to the response. properties: warning: description: A warning message. example: All the security filters are disabled. As a result, no logs are being analyzed. type: string type: object RoleAttributes: description: Attributes of the role. properties: created_at: description: Creation time of the role. format: date-time readOnly: true type: string example: example_value modified_at: description: Time of last role modification. format: date-time readOnly: true type: string example: example_value name: description: The name of the role. The name is neither unique nor a stable identifier of the role. type: string example: Example Monitor user_count: description: Number of users with that role. format: int64 readOnly: true type: integer example: 42 type: object LogsArchiveIntegrationAzure: description: The Azure archive's integration destination. properties: client_id: description: A client ID. example: aaaaaaaa-1a1a-1a1a-1a1a-aaaaaaaaaaaa type: string tenant_id: description: A tenant ID. example: aaaaaaaa-1a1a-1a1a-1a1a-aaaaaaaaaaaa type: string required: - tenant_id - client_id type: object OutcomesBatchResponseMeta: description: Metadata pertaining to the bulk operation. properties: total_received: description: Total number of scorecard results received during the bulk operation. format: int64 type: integer example: 42 total_updated: description: Total number of scorecard results modified during the bulk operation. format: int64 type: integer example: 42 type: object User: description: User object returned by the API. properties: attributes: $ref: '#/components/schemas/UserAttributes' id: description: ID of the user. type: string example: abc-123-def relationships: $ref: '#/components/schemas/UserResponseRelationships' type: $ref: '#/components/schemas/UsersType' type: object x-merge-override: required: false EntityV3DatastoreKind: description: The definition of Entity V3 Datastore Kind object. enum: - datastore example: datastore type: string x-enum-varnames: - DATASTORE ObservabilityPipelineSensitiveDataScannerProcessor: description: The `sensitive_data_scanner` processor detects and optionally redacts sensitive data in log events. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: sensitive-scanner type: string include: description: A Datadog search query used to determine which logs this processor targets. example: source:prod type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - parse-json-processor items: type: string type: array rules: description: A list of rules for identifying and acting on sensitive data patterns. items: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorRule' type: array type: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorType' required: - id - type - include - inputs - rules type: object ObservabilityPipelineDatadogLogsDestinationType: default: datadog_logs description: The destination type. The value should always be `datadog_logs`. enum: - datadog_logs example: datadog_logs type: string x-enum-varnames: - DATADOG_LOGS RelationshipToIncidentAttachment: description: A relationship reference for attachments. properties: data: description: An array of incident attachments. items: $ref: '#/components/schemas/RelationshipToIncidentAttachmentData' type: array required: - data type: object ActionQueryMockedOutputs: description: The mocked outputs of the action query. This is useful for testing the app without actually running the action. oneOf: - type: string - $ref: '#/components/schemas/ActionQueryMockedOutputsObject' EntityV3Integrations: additionalProperties: false description: A base schema for defining third-party integrations. properties: opsgenie: $ref: '#/components/schemas/EntityV3DatadogIntegrationOpsgenie' pagerduty: $ref: '#/components/schemas/EntityV3DatadogIntegrationPagerduty' type: object Powerpack: description: Powerpacks are templated groups of dashboard widgets you can save from an existing dashboard and turn into reusable packs in the widget tray. properties: data: $ref: '#/components/schemas/PowerpackData' type: object CloudWorkloadSecurityAgentPolicyCreateAttributes: description: Create a new Cloud Workload Security Agent policy properties: description: description: The description of the policy example: My agent policy type: string enabled: description: Whether the policy is enabled example: true type: boolean hostTags: description: The host tags defining where this policy is deployed items: type: string type: array hostTagsLists: description: The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR items: items: type: string type: array type: array name: description: The name of the policy example: my_agent_policy type: string required: - name type: object HTTPIntegrationType: description: The definition of `HTTPIntegrationType` object. enum: - HTTP example: HTTP type: string x-enum-varnames: - HTTP EmailTypeType: description: The type of email. enum: - work type: string x-enum-varnames: - WORK ObservabilityPipelineGenerateMetricsProcessor: description: 'The `generate_datadog_metrics` processor creates custom metrics from logs and sends them to Datadog. Metrics can be counters, gauges, or distributions and optionally grouped by log fields. ' properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline. example: generate-metrics-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the `input` for this processor. example: - source-id items: type: string type: array metrics: description: Configuration for generating individual metrics. items: $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetric' type: array type: $ref: '#/components/schemas/ObservabilityPipelineGenerateMetricsProcessorType' required: - id - type - inputs - include - metrics type: object EntityMeta: description: Entity metadata. properties: createdAt: description: The creation time. type: string example: example_value ingestionSource: description: The ingestion source. type: string example: example_value modifiedAt: description: The modification time. type: string example: example_value origin: description: The origin. type: string example: example_value type: object CustomDestinationCreateRequestDefinition: description: The definition of a custom destination. properties: attributes: $ref: '#/components/schemas/CustomDestinationCreateRequestAttributes' type: $ref: '#/components/schemas/CustomDestinationType' required: - type - attributes type: object TeamCreateAttributes: description: Team creation attributes properties: avatar: description: Unicode representation of the avatar for the team, limited to a single grapheme example: 🥑 nullable: true type: string banner: description: Banner selection for the team format: int64 nullable: true type: integer example: 42 description: description: Free-form markdown description/content for the team's homepage type: string example: example_value handle: description: The team's identifier example: example-team maxLength: 195 type: string hidden_modules: description: Collection of hidden modules for the team items: description: String identifier of the module type: string type: array name: description: The name of the team example: Example Team maxLength: 200 type: string visible_modules: description: Collection of visible modules for the team items: description: String identifier of the module type: string type: array required: - handle - name type: object ScheduleTriggerWrapper: description: Schema for a Schedule-based trigger. properties: scheduleTrigger: $ref: '#/components/schemas/ScheduleTrigger' startStepNames: $ref: '#/components/schemas/StartStepNames' required: - scheduleTrigger type: object IncidentResponseData: description: Incident data from a response. properties: attributes: $ref: '#/components/schemas/IncidentResponseAttributes' id: description: The incident's ID. example: 00000000-0000-0000-1234-000000000000 type: string relationships: $ref: '#/components/schemas/IncidentResponseRelationships' type: $ref: '#/components/schemas/IncidentType' required: - id - type type: object x-merge-override: required: false FullApplicationKeyAttributes: description: Attributes of a full application key. properties: created_at: description: Creation date of the application key. example: '2020-11-23T10:00:00.000Z' format: date-time readOnly: true type: string key: description: The application key. readOnly: true type: string x-secret: true example: example_value last4: description: The last four characters of the application key. example: abcd maxLength: 4 minLength: 4 readOnly: true type: string x-secret: true name: description: Name of the application key. example: Application Key for managing dashboards type: string scopes: description: Array of scopes to grant the application key. example: - dashboards_read - dashboards_write - dashboards_public_share items: description: Name of scope. type: string nullable: true type: array type: object x-merge-override: properties: false PowerpackData: description: Powerpack data object. properties: attributes: $ref: '#/components/schemas/PowerpackAttributes' id: description: ID of the powerpack. type: string example: abc-123-def relationships: $ref: '#/components/schemas/PowerpackRelationships' type: description: Type of widget, must be powerpack. example: powerpack type: string type: object x-merge-override: required: false IncidentCreateData: description: Incident data for a create request. properties: attributes: $ref: '#/components/schemas/IncidentCreateAttributes' relationships: $ref: '#/components/schemas/IncidentCreateRelationships' type: $ref: '#/components/schemas/IncidentType' required: - type - attributes type: object x-merge-override: required: false IncidentUserDefinedFieldType: description: The incident user defined fields type. enum: - user_defined_field example: user_defined_field type: string x-enum-varnames: - USER_DEFINED_FIELD MonitorNotificationRuleResourceType: default: monitor-notification-rule description: Monitor notification rule resource type. enum: - monitor-notification-rule example: monitor-notification-rule type: string x-enum-varnames: - MONITOR_NOTIFICATION_RULE AzureUCConfigPostRequestAttributes: description: Attributes for Azure config Post Request. properties: account_id: description: The tenant ID of the azure account. example: 1234abcd-1234-abcd-1234-1234abcd1234 type: string actual_bill_config: $ref: '#/components/schemas/BillConfig' amortized_bill_config: $ref: '#/components/schemas/BillConfig' client_id: description: The client ID of the azure account. example: 1234abcd-1234-abcd-1234-1234abcd1234 type: string is_enabled: description: Whether or not the Cloud Cost Management account is enabled. type: boolean example: true scope: description: The scope of your observed subscription. example: /subscriptions/1234abcd-1234-abcd-1234-1234abcd1234 type: string required: - account_id - actual_bill_config - amortized_bill_config - client_id - scope type: object OrganizationsType: default: orgs description: Organizations resource type. enum: - orgs example: orgs type: string x-enum-varnames: - ORGS ServiceDefinitionV2OpsgenieRegion: description: Opsgenie instance region. enum: - US - EU example: US type: string x-enum-varnames: - US - EU ApplicationSecurityWafCustomRuleConditionOptions: description: Options for the operator of this condition. properties: case_sensitive: default: false description: Evaluate the value as case sensitive. type: boolean example: true min_length: default: 0 description: Only evaluate this condition if the value has a minimum amount of characters. format: int64 type: integer example: 42 type: object CaseTriggerWrapper: description: Schema for a Case-based trigger. properties: caseTrigger: $ref: '#/components/schemas/CaseTrigger' startStepNames: $ref: '#/components/schemas/StartStepNames' required: - caseTrigger type: object ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptionsDirection: description: Indicates whether to redact characters from the first or last part of the matched value. enum: - first - last example: last type: string x-enum-varnames: - FIRST - LAST EntityResponseIncludedSchema: description: Included detail entity schema. properties: attributes: $ref: '#/components/schemas/EntityResponseIncludedSchemaAttributes' id: description: Entity ID. type: string example: abc-123-def type: $ref: '#/components/schemas/EntityResponseIncludedSchemaType' type: object MonitorConfigPolicyType: default: tag description: The monitor configuration policy type. enum: - tag example: tag type: string x-enum-varnames: - TAG AWSAccountCreateRequestAttributes: description: The AWS Account Integration Config to be created. properties: account_tags: $ref: '#/components/schemas/AWSAccountTags' auth_config: $ref: '#/components/schemas/AWSAuthConfig' aws_account_id: $ref: '#/components/schemas/AWSAccountID' aws_partition: $ref: '#/components/schemas/AWSAccountPartition' aws_regions: $ref: '#/components/schemas/AWSRegions' logs_config: $ref: '#/components/schemas/AWSLogsConfig' metrics_config: $ref: '#/components/schemas/AWSMetricsConfig' resources_config: $ref: '#/components/schemas/AWSResourcesConfig' traces_config: $ref: '#/components/schemas/AWSTracesConfig' required: - aws_account_id - aws_partition - auth_config type: object UsersRelationship: description: Relationship to users. properties: data: description: Relationships to user objects. example: [] items: $ref: '#/components/schemas/UserRelationshipData' type: array required: - data type: object RumMetricResponseUniqueness: description: The rule to count updatable events. Is only set if `event_type` is `session` or `view`. properties: when: $ref: '#/components/schemas/RumMetricUniquenessWhen' type: object ObservabilityPipelineElasticsearchDestinationApiVersion: description: The Elasticsearch API version to use. Set to `auto` to auto-detect. enum: - auto - v6 - v7 - v8 example: auto type: string x-enum-varnames: - AUTO - V6 - V7 - V8 WorkflowUserRelationshipType: description: The definition of `WorkflowUserRelationshipType` object. enum: - users example: users type: string x-enum-varnames: - USERS ServiceDefinitionV2Contact: description: Service owner's contacts information. oneOf: - $ref: '#/components/schemas/ServiceDefinitionV2Email' - $ref: '#/components/schemas/ServiceDefinitionV2Slack' - $ref: '#/components/schemas/ServiceDefinitionV2MSTeams' ObservabilityPipelinePipelineKafkaSourceSaslMechanism: description: SASL mechanism used for Kafka authentication. enum: - PLAIN - SCRAM-SHA-256 - SCRAM-SHA-512 type: string x-enum-varnames: - PLAIN - SCRAMNOT_SHANOT_256 - SCRAMNOT_SHANOT_512 SecurityMonitoringSuppressionCreateData: description: Object for a single suppression rule. properties: attributes: $ref: '#/components/schemas/SecurityMonitoringSuppressionCreateAttributes' type: $ref: '#/components/schemas/SecurityMonitoringSuppressionType' required: - type - attributes type: object LogsMetricCompute: description: The compute rule to compute the log-based metric. properties: aggregation_type: $ref: '#/components/schemas/LogsMetricComputeAggregationType' include_percentiles: $ref: '#/components/schemas/LogsMetricComputeIncludePercentiles' path: description: The path to the value the log-based metric will aggregate on (only used if the aggregation type is a "distribution"). example: '@duration' type: string required: - aggregation_type type: object RelationshipToOrganizationData: description: Relationship to organization object. properties: id: description: ID of the organization. example: 00000000-0000-beef-0000-000000000000 type: string type: $ref: '#/components/schemas/OrganizationsType' required: - id - type type: object ObservabilityPipelineSensitiveDataScannerProcessorLibraryPattern: description: Specifies a pattern from Datadog’s sensitive data detection library to match known sensitive data types. properties: options: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternOptions' type: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternType' required: - type - options type: object ObservabilityPipelineSpecData: description: Contains the the pipeline configuration. properties: attributes: $ref: '#/components/schemas/ObservabilityPipelineDataAttributes' type: default: pipelines description: The resource type identifier. For pipeline resources, this should always be set to `pipelines`. example: pipelines type: string required: - type - attributes type: object DashboardTriggerWrapper: description: Schema for a Dashboard-based trigger. properties: dashboardTrigger: description: Trigger a workflow from a Dashboard. type: object startStepNames: $ref: '#/components/schemas/StartStepNames' required: - dashboardTrigger type: object XRayServicesIncludeOnly: description: Include only these services. Defaults to `[]`. nullable: true properties: include_only: description: Include only these services. example: - AWS/AppSync items: example: AWS/AppSync type: string type: array required: - include_only type: object PowerpackGroupWidget: description: Powerpack group widget definition object. properties: definition: $ref: '#/components/schemas/PowerpackGroupWidgetDefinition' layout: $ref: '#/components/schemas/PowerpackGroupWidgetLayout' live_span: $ref: '#/components/schemas/WidgetLiveSpan' required: - definition type: object CustomDestinationResponseAttributes: description: The attributes associated with the custom destination. properties: enabled: default: true description: Whether logs matching this custom destination should be forwarded or not. example: true type: boolean forward_tags: default: true description: Whether tags from the forwarded logs should be forwarded or not. example: true type: boolean forward_tags_restriction_list: default: [] description: 'List of [keys of tags](https://docs.datadoghq.com/getting_started/tagging/#define-tags) to be filtered. An empty list represents no restriction is in place and either all or no tags will be forwarded depending on `forward_tags_restriction_list_type` parameter.' example: - datacenter - host items: description: The [key part of a tag](https://docs.datadoghq.com/getting_started/tagging/#define-tags). type: string maxItems: 10 minItems: 0 type: array forward_tags_restriction_list_type: $ref: '#/components/schemas/CustomDestinationAttributeTagsRestrictionListType' forwarder_destination: $ref: '#/components/schemas/CustomDestinationResponseForwardDestination' name: description: The custom destination name. example: Nginx logs type: string query: default: '' description: The custom destination query filter. Logs matching this query are forwarded to the destination. example: source:nginx type: string type: object SecurityFilterFilteredDataType: description: The filtered data type. enum: - logs example: logs type: string x-enum-varnames: - LOGS OpsgenieServiceRegionType: description: The region for the Opsgenie service. enum: - us - eu - custom example: us type: string x-enum-varnames: - US - EU - CUSTOM CustomDestinationResponseForwardDestinationSplunkType: default: splunk_hec description: Type of the Splunk HTTP Event Collector (HEC) destination. enum: - splunk_hec example: splunk_hec type: string x-enum-varnames: - SPLUNK_HEC ProjectResourceType: default: project description: Project resource type enum: - project example: project type: string x-enum-varnames: - PROJECT IncidentTeamCreateData: description: Incident Team data for a create request. properties: attributes: $ref: '#/components/schemas/IncidentTeamCreateAttributes' relationships: $ref: '#/components/schemas/IncidentTeamRelationships' type: $ref: '#/components/schemas/IncidentTeamType' required: - type type: object RUMApplicationAttributes: description: RUM application attributes. properties: application_id: description: ID of the RUM application. example: abcd1234-0000-0000-abcd-1234abcd5678 type: string x-merge-override: format: false client_token: description: Client token of the RUM application. example: abcd1234efgh5678ijkl90abcd1234efgh0 type: string created_at: description: Timestamp in ms of the creation date. example: 1659479836169 format: int64 type: integer created_by_handle: description: Handle of the creator user. example: john.doe type: string hash: description: Hash of the RUM application. Optional. type: string example: example_value is_active: description: Indicates if the RUM application is active. example: true type: boolean name: description: Name of the RUM application. example: my_rum_application type: string org_id: description: Org ID of the RUM application. example: 999 format: int32 maximum: 2147483647 type: integer type: description: Type of the RUM application. Supported values are `browser`, `ios`, `android`, `react-native`, `flutter`, `roku`, `electron`, `unity`, `kotlin-multiplatform`. example: browser type: string updated_at: description: Timestamp in ms of the last update date. example: 1659479836169 format: int64 type: integer updated_by_handle: description: Handle of the updater user. example: jane.doe type: string required: - application_id - client_token - created_at - created_by_handle - name - org_id - type - updated_at - updated_by_handle type: object ObservabilityPipelineGooglePubSubSource: description: The `google_pubsub` source ingests logs from a Google Cloud Pub/Sub subscription. properties: auth: $ref: '#/components/schemas/ObservabilityPipelineGcpAuth' decoding: $ref: '#/components/schemas/ObservabilityPipelineDecoding' id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: google-pubsub-source type: string project: description: The GCP project ID that owns the Pub/Sub subscription. example: my-gcp-project type: string subscription: description: The Pub/Sub subscription name from which messages are consumed. example: logs-subscription type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineGooglePubSubSourceType' required: - id - type - auth - decoding - project - subscription type: object PowerpackGroupWidgetLayout: description: Powerpack group widget layout. properties: height: description: The height of the widget. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer width: description: The width of the widget. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer x: description: The position of the widget on the x (horizontal) axis. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer y: description: The position of the widget on the y (vertical) axis. Should be a non-negative integer. example: 0 format: int64 minimum: 0 type: integer required: - x - y - width - height type: object RumRetentionFilterCreateData: description: The new RUM retention filter properties to create. properties: attributes: $ref: '#/components/schemas/RumRetentionFilterCreateAttributes' type: $ref: '#/components/schemas/RumRetentionFilterType' required: - type - attributes type: object ObservabilityPipelineOcsfMapperProcessorType: default: ocsf_mapper description: The processor type. The value should always be `ocsf_mapper`. enum: - ocsf_mapper example: ocsf_mapper type: string x-enum-varnames: - OCSF_MAPPER IncidentAttachmentsPostmortemAttributesAttachmentObject: description: The postmortem attachment. properties: documentUrl: description: The URL of this notebook attachment. example: https://app.datadoghq.com/notebook/123 type: string title: description: The title of this postmortem attachment. example: Postmortem IR-123 type: string required: - documentUrl - title type: object ObservabilityPipelineKafkaSourceLibrdkafkaOption: description: Represents a key-value pair used to configure low-level `librdkafka` client options for Kafka sources, such as timeouts, buffer sizes, and security settings. properties: name: description: The name of the `librdkafka` configuration option to set. example: fetch.message.max.bytes type: string value: description: The value assigned to the specified `librdkafka` configuration option. example: '1048576' type: string required: - name - value type: object LayerRelationships: description: Holds references to objects related to the Layer entity, such as its members. properties: members: $ref: '#/components/schemas/LayerRelationshipsMembers' type: object CreateOpenAPIResponse: description: Response for `CreateOpenAPI` operation. properties: data: $ref: '#/components/schemas/CreateOpenAPIResponseData' type: object SpansMetricResponse: description: The span-based metric object. properties: data: $ref: '#/components/schemas/SpansMetricResponseData' type: object ExternalUserEmailType: description: Email address for the user. properties: primary: description: Boolean indicating if this email is the primary email address. type: boolean example: true type: $ref: '#/components/schemas/EmailTypeType' value: description: Email addresses for the user. type: string example: example_value type: object TagFilter: description: Tag filter for the budget's entries. properties: tag_key: description: The key of the tag. example: service type: string tag_value: description: The value of the tag. example: ec2 type: string type: object UpsertCatalogEntityResponse: description: Upsert entity response. properties: data: $ref: '#/components/schemas/EntityResponseData' included: $ref: '#/components/schemas/UpsertCatalogEntityResponseIncluded' meta: $ref: '#/components/schemas/EntityResponseMeta' type: object SecurityMonitoringRuleEvaluationWindow: description: 'A time window is specified to match when at least one of the cases matches true. This is a sliding window and evaluates in real time. For third party detection method, this field is not used.' enum: - 0 - 60 - 300 - 600 - 900 - 1800 - 3600 - 7200 - 10800 - 21600 - 43200 - 86400 format: int32 type: integer x-enum-varnames: - ZERO_MINUTES - ONE_MINUTE - FIVE_MINUTES - TEN_MINUTES - FIFTEEN_MINUTES - THIRTY_MINUTES - ONE_HOUR - TWO_HOURS - THREE_HOURS - SIX_HOURS - TWELVE_HOURS - ONE_DAY RuleName: description: Name of the notification rule. example: Rule 1 type: string ObservabilityPipelineRenameFieldsProcessorType: default: rename_fields description: The processor type. The value should always be `rename_fields`. enum: - rename_fields example: rename_fields type: string x-enum-varnames: - RENAME_FIELDS OnCallPageTargetType: description: The kind of target, `team_id` | `team_handle` | `user_id`. enum: - team_id - team_handle - user_id example: team_id type: string x-enum-varnames: - TEAM_ID - TEAM_HANDLE - USER_ID ObservabilityPipelineHttpClientSourceType: default: http_client description: The source type. The value should always be `http_client`. enum: - http_client example: http_client type: string x-enum-varnames: - HTTP_CLIENT SecurityMonitoringFilterAction: description: The type of filtering action. enum: - require - suppress type: string x-enum-varnames: - REQUIRE - SUPPRESS JSONAPIErrorResponse: description: API error response. properties: errors: description: A list of errors. items: $ref: '#/components/schemas/JSONAPIErrorItem' type: array required: - errors type: object CaseTrigger: description: Trigger a workflow from a Case. For automatic triggering a handle must be configured and the workflow must be published. properties: rateLimit: $ref: '#/components/schemas/TriggerRateLimit' type: object IncidentNotificationHandle: description: A notification handle that will be notified at incident creation. properties: display_name: description: The name of the notified handle. example: Jane Doe type: string handle: description: The handle used for the notification. This includes an email address, Slack channel, or workflow. example: '@test.user@test.com' type: string type: object CustomDestinationForwardDestinationHttpType: default: http description: Type of the HTTP destination. enum: - http example: http type: string x-enum-varnames: - HTTP UserRelationships: description: Relationships of the user object. properties: roles: $ref: '#/components/schemas/RelationshipToRoles' type: object ActionQueryType: default: action description: The action query type. enum: - action example: action type: string x-enum-varnames: - ACTION ScheduleDataRelationshipsLayersDataItems: description: Relates a layer to this schedule, identified by `id` and `type` (must be `layers`). properties: id: description: The unique identifier of the layer in this relationship. example: 00000000-0000-0000-0000-000000000001 type: string type: $ref: '#/components/schemas/ScheduleDataRelationshipsLayersDataItemsType' required: - type - id type: object CreatePageRequestData: description: The main request body, including attributes and resource type. properties: attributes: $ref: '#/components/schemas/CreatePageRequestDataAttributes' type: $ref: '#/components/schemas/CreatePageRequestDataType' required: - type type: object ApplicationSecurityWafExclusionFilterOnMatch: description: The action taken when the exclusion filter matches. When set to `monitor`, security traces are emitted but the requests are not blocked. By default, security traces are not emitted and the requests are not blocked. enum: - monitor type: string x-enum-varnames: - MONITOR ServiceDefinitionV2Link: description: Service's external links. properties: name: description: Link name. example: Runbook type: string type: $ref: '#/components/schemas/ServiceDefinitionV2LinkType' url: description: Link URL. example: https://my-runbook type: string required: - name - type - url type: object ScheduleDataRelationshipsLayersDataItemsType: default: layers description: Layers resource type. enum: - layers example: layers type: string x-enum-varnames: - LAYERS RelationshipToPermissionData: description: Relationship to permission object. properties: id: description: ID of the permission. type: string example: abc-123-def type: $ref: '#/components/schemas/PermissionsType' type: object x-merge-override: required: false RestrictionQueryCreateData: description: Data related to the creation of a restriction query. properties: attributes: $ref: '#/components/schemas/RestrictionQueryCreateAttributes' type: $ref: '#/components/schemas/LogsRestrictionQueriesType' type: object AwsCURConfig: description: AWS CUR config. properties: attributes: $ref: '#/components/schemas/AwsCURConfigAttributes' id: description: The ID of the AWS CUR config. format: int64 type: integer example: 42 type: $ref: '#/components/schemas/AwsCURConfigType' required: - attributes - type type: object x-merge-override: required: false SpansFilterCreate: description: The spans filter. Spans matching this filter will be indexed and stored. properties: query: description: The search query - following the [span search syntax](https://docs.datadoghq.com/tracing/trace_explorer/query_syntax/). example: '@http.status_code:200 service:my-service' type: string required: - query type: object SecurityMonitoringRuleTypeCreate: description: The rule type. enum: - application_security - log_detection - workload_security type: string x-enum-varnames: - APPLICATION_SECURITY - LOG_DETECTION - WORKLOAD_SECURITY CloudWorkloadSecurityAgentRuleAction: description: The action the rule can perform if triggered properties: filter: description: SECL expression used to target the container to apply the action on type: string example: example_value kill: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleKill' metadata: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionMetadata' set: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActionSet' type: object AppBuilderEventType: description: The response to the event. enum: - custom - setComponentState - triggerQuery - openModal - closeModal - openUrl - downloadFile - setStateVariableValue example: triggerQuery type: string x-enum-varnames: - CUSTOM - SETCOMPONENTSTATE - TRIGGERQUERY - OPENMODAL - CLOSEMODAL - OPENURL - DOWNLOADFILE - SETSTATEVARIABLEVALUE SecurityMonitoringRuleCaseActionOptions: additionalProperties: {} description: Options for the rule action properties: duration: description: Duration of the action in seconds. 0 indicates no expiration. example: 0 format: int64 minimum: 0 type: integer userBehaviorName: $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptionsUserBehaviorName' type: object TeamLinkCreate: description: Team link create properties: attributes: $ref: '#/components/schemas/TeamLinkAttributes' type: $ref: '#/components/schemas/TeamLinkType' required: - attributes - type type: object ObservabilityPipelineSensitiveDataScannerProcessorScopeIncludeTarget: description: Applies the rule only to included fields. enum: - include example: include type: string x-enum-varnames: - INCLUDE IncidentCreateRequest: description: Create request for an incident. properties: data: $ref: '#/components/schemas/IncidentCreateData' required: - data type: object RoleRelationships: description: Relationships of the role object. properties: permissions: $ref: '#/components/schemas/RelationshipToPermissions' type: object ObservabilityPipelineFilterProcessor: description: The `filter` processor allows conditional processing of logs based on a Datadog search query. Logs that match the `include` query are passed through; others are discarded. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (for example, as the `input` to downstream components). example: filter-processor type: string include: description: A Datadog search query used to determine which logs should pass through the filter. Logs that match this query continue to downstream components; others are dropped. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - datadog-agent-source items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineFilterProcessorType' required: - id - type - include - inputs type: object JiraIntegrationMetadata: description: Incident integration metadata for the Jira integration. properties: issues: description: Array of Jira issues in this integration metadata. example: [] items: $ref: '#/components/schemas/JiraIntegrationMetadataIssuesItem' type: array required: - issues type: object TeamCreateRequest: description: Request to create a team properties: data: $ref: '#/components/schemas/TeamCreate' required: - data type: object Enabled: description: Field used to enable or disable the rule. example: true type: boolean ApplicationSecurityWafCustomRuleCreateRequest: description: Request object that includes the custom rule to create. properties: data: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCreateData' required: - data type: object OpsgenieServiceCreateRequest: description: Create request for an Opsgenie service. properties: data: $ref: '#/components/schemas/OpsgenieServiceCreateData' required: - data type: object EscalationPolicyStepTarget: description: Defines a single escalation target within a step for an escalation policy creation request. Contains `id` and `type`. properties: id: description: Specifies the unique identifier for this target. example: 00000000-aba1-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/EscalationPolicyStepTargetType' type: object IncidentTypeAttributes: description: Incident type's attributes. properties: createdAt: description: Timestamp when the incident type was created. format: date-time readOnly: true type: string example: example_value createdBy: description: A unique identifier that represents the user that created the incident type. example: 00000000-0000-0000-0000-000000000000 readOnly: true type: string description: description: Text that describes the incident type. example: Any incidents that harm (or have the potential to) the confidentiality, integrity, or availability of our data. type: string is_default: default: false description: If true, this incident type will be used as the default incident type if a type is not specified during the creation of incident resources. example: false type: boolean lastModifiedBy: description: A unique identifier that represents the user that last modified the incident type. example: 00000000-0000-0000-0000-000000000000 readOnly: true type: string modifiedAt: description: Timestamp when the incident type was last modified. format: date-time readOnly: true type: string example: example_value name: description: The name of the incident type. example: Security Incident type: string prefix: description: The string that will be prepended to the incident title across the Datadog app. example: IR readOnly: true type: string required: - name type: object ObservabilityPipelineParseGrokProcessor: description: The `parse_grok` processor extracts structured fields from unstructured log messages using Grok patterns. properties: disable_library_rules: default: false description: If set to `true`, disables the default Grok rules provided by Datadog. example: true type: boolean id: description: A unique identifier for this processor. example: parse-grok-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: service:my-service type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - datadog-agent-source items: type: string type: array rules: description: The list of Grok parsing rules. If multiple matching rules are provided, they are evaluated in order. The first successful match is applied. items: $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessorRule' type: array type: $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessorType' required: - id - type - include - inputs - rules type: object ObservabilityPipelineSumoLogicDestinationType: default: sumo_logic description: The destination type. The value should always be `sumo_logic`. enum: - sumo_logic example: sumo_logic type: string x-enum-varnames: - SUMO_LOGIC SecurityMonitoringReferenceTable: description: Reference tables used in the queries. properties: checkPresence: description: Whether to include or exclude the matched values. type: boolean example: true columnName: description: The name of the column in the reference table. type: string example: Example Monitor logFieldPath: description: The field in the log to match against the reference table. type: string example: example_value ruleQueryName: description: The name of the query to apply the reference table to. type: string example: Example Monitor tableName: description: The name of the reference table. type: string example: Example Monitor type: object ServiceDefinitionDataAttributes: description: Service definition attributes. properties: meta: $ref: '#/components/schemas/ServiceDefinitionMeta' schema: $ref: '#/components/schemas/ServiceDefinitionSchema' type: object ProjectRelationshipData: description: Relationship to project object properties: id: description: A unique identifier that represents the project example: e555e290-ed65-49bd-ae18-8acbfcf18db7 type: string type: $ref: '#/components/schemas/ProjectResourceType' required: - id - type type: object IncidentResponse: description: Response with an incident. properties: data: $ref: '#/components/schemas/IncidentResponseData' included: description: Included related resources that the user requested. items: $ref: '#/components/schemas/IncidentResponseIncludedItem' readOnly: true type: array required: - data type: object RUMApplicationType: default: rum_application description: RUM application response type. enum: - rum_application example: rum_application type: string x-enum-varnames: - RUM_APPLICATION ObservabilityPipelineElasticsearchDestinationType: default: elasticsearch description: The destination type. The value should always be `elasticsearch`. enum: - elasticsearch example: elasticsearch type: string x-enum-varnames: - ELASTICSEARCH RumRetentionFilterType: default: retention_filters description: The type of the resource. The value should always be retention_filters. enum: - retention_filters example: retention_filters type: string x-enum-varnames: - RETENTION_FILTERS ObservabilityPipelineSplunkHecSource: description: 'The `splunk_hec` source implements the Splunk HTTP Event Collector (HEC) API. ' properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: splunk-hec-source type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineSplunkHecSourceType' required: - id - type type: object MicrosoftTeamsCreateWorkflowsWebhookHandleRequest: description: Create Workflows webhook handle request. properties: data: $ref: '#/components/schemas/MicrosoftTeamsWorkflowsWebhookHandleRequestData' required: - data type: object TeamCreateRelationships: description: Relationships formed with the team on creation properties: users: $ref: '#/components/schemas/RelationshipToUsers' type: object ObservabilityPipelineAmazonS3SourceType: default: amazon_s3 description: The source type. Always `amazon_s3`. enum: - amazon_s3 example: amazon_s3 type: string x-enum-varnames: - AMAZON_S3 RoleCreateData: description: Data related to the creation of a role. properties: attributes: $ref: '#/components/schemas/RoleCreateAttributes' relationships: $ref: '#/components/schemas/RoleRelationships' type: $ref: '#/components/schemas/RolesType' required: - attributes type: object x-merge-override: required: false IncidentTodoAttributes: description: Incident todo's attributes. properties: assignees: $ref: '#/components/schemas/IncidentTodoAssigneeArray' completed: description: Timestamp when the todo was completed. example: '2023-03-06T22:00:00.000000+00:00' nullable: true type: string content: description: The follow-up task's content. example: Restore lost data. type: string created: description: Timestamp when the incident todo was created. format: date-time readOnly: true type: string example: example_value due_date: description: Timestamp when the todo should be completed by. example: '2023-07-10T05:00:00.000000+00:00' nullable: true type: string incident_id: description: UUID of the incident this todo is connected to. example: 00000000-aaaa-0000-0000-000000000000 type: string modified: description: Timestamp when the incident todo was last modified. format: date-time readOnly: true type: string example: example_value required: - content - assignees type: object RumMetricEventType: description: The type of RUM events to filter on. enum: - session - view - action - error - resource - long_task - vital example: session type: string x-enum-varnames: - SESSION - VIEW - ACTION - ERROR - RESOURCE - LONG_TASK - VITAL TeamResponse: description: Response with a team properties: data: $ref: '#/components/schemas/Team' type: object CreateAppRequestData: description: The data object containing the app definition. properties: attributes: $ref: '#/components/schemas/CreateAppRequestDataAttributes' type: $ref: '#/components/schemas/AppDefinitionType' required: - type type: object CloudConfigurationRuleComplianceSignalOptions: description: How to generate compliance signals. Useful for cloud_configuration rules only. properties: defaultActivationStatus: description: The default activation status. nullable: true type: boolean example: true defaultGroupByFields: description: The default group by fields. items: type: string nullable: true type: array userActivationStatus: description: Whether signals will be sent. nullable: true type: boolean example: true userGroupByFields: description: Fields to use to group findings by when sending signals. items: type: string nullable: true type: array type: object CustomDestinationForwardDestinationSplunkType: default: splunk_hec description: Type of the Splunk HTTP Event Collector (HEC) destination. enum: - splunk_hec example: splunk_hec type: string x-enum-varnames: - SPLUNK_HEC AwsCURConfigPostRequestAttributes: description: Attributes for AWS CUR config Post Request. properties: account_filters: $ref: '#/components/schemas/AccountFilteringConfig' account_id: description: The AWS account ID. example: '123456789123' type: string bucket_name: description: The AWS bucket name used to store the Cost and Usage Report. example: dd-cost-bucket type: string bucket_region: description: The region the bucket is located in. example: us-east-1 type: string is_enabled: description: Whether or not the Cloud Cost Management account is enabled. type: boolean example: true months: description: The month of the report. format: int32 maximum: 36 type: integer example: 42 report_name: description: The name of the Cost and Usage Report. example: dd-report-name type: string report_prefix: description: The report prefix used for the Cost and Usage Report. example: dd-report-prefix type: string required: - account_id - bucket_name - report_name - report_prefix type: object StateVariableProperties: description: The properties of the state variable. properties: defaultValue: description: The default value of the state variable. example: ${['order_3145', 'order_4920']} type: object LogsMetricComputeAggregationType: description: The type of aggregation to use. enum: - count - distribution example: distribution type: string x-enum-varnames: - COUNT - DISTRIBUTION MonitorConfigPolicyPolicy: description: Configuration for the policy. oneOf: - $ref: '#/components/schemas/MonitorConfigPolicyTagPolicy' LogsArchiveDestinationGCS: description: The GCS archive destination. properties: bucket: description: The bucket where the archive will be stored. example: bucket-name type: string integration: $ref: '#/components/schemas/LogsArchiveIntegrationGCS' path: description: The archive path. type: string example: example_value type: $ref: '#/components/schemas/LogsArchiveDestinationGCSType' required: - bucket - integration - type type: object ObservabilityPipelineThrottleProcessor: description: The `throttle` processor limits the number of events that pass through over a given time window. properties: group_by: description: Optional list of fields used to group events before the threshold has been reached. example: - log.user.id items: type: string type: array id: description: The unique identifier for this processor. example: throttle-processor type: string include: description: A Datadog search query used to determine which logs this processor targets. example: env:prod type: string inputs: description: A list of component IDs whose output is used as the input for this processor. example: - datadog-agent-source items: type: string type: array threshold: description: the number of events allowed in a given time window. Events sent after the threshold has been reached, are dropped. example: 1000 format: int64 type: integer type: $ref: '#/components/schemas/ObservabilityPipelineThrottleProcessorType' window: description: The time window in seconds over which the threshold applies. example: 60 format: double type: number required: - id - type - include - inputs - threshold - window type: object RumRetentionFilterEnabled: description: Whether the retention filter is enabled. example: true type: boolean GCPSTSDelegateAccountResponse: description: Your delegate service account response data. properties: data: $ref: '#/components/schemas/GCPSTSDelegateAccount' type: object IncidentTodoType: default: incident_todos description: Todo resource type. enum: - incident_todos example: incident_todos type: string x-enum-varnames: - INCIDENT_TODOS NullableUserRelationship: description: Relationship to user. nullable: true properties: data: $ref: '#/components/schemas/NullableUserRelationshipData' required: - data type: object RoleCloneAttributes: description: Attributes required to create a new role by cloning an existing one. properties: name: description: Name of the new role that is cloned. example: cloned-role type: string required: - name type: object LogsMetricResponseData: description: The log-based metric properties. properties: attributes: $ref: '#/components/schemas/LogsMetricResponseAttributes' id: $ref: '#/components/schemas/LogsMetricID' type: $ref: '#/components/schemas/LogsMetricType' type: object UpsertCatalogEntityResponseIncludedItem: description: Upsert entity response included item. oneOf: - $ref: '#/components/schemas/EntityResponseIncludedSchema' EscalationPolicyCreateRequestData: description: Represents the data for creating an escalation policy, including its attributes, relationships, and resource type. properties: attributes: $ref: '#/components/schemas/EscalationPolicyCreateRequestDataAttributes' relationships: $ref: '#/components/schemas/EscalationPolicyCreateRequestDataRelationships' type: $ref: '#/components/schemas/EscalationPolicyCreateRequestDataType' required: - type - attributes type: object ObservabilityPipelineQuotaProcessorOverflowAction: description: 'The action to take when the quota is exceeded. Options: - `drop`: Drop the event. - `no_action`: Let the event pass through. - `overflow_routing`: Route to an overflow destination. ' enum: - drop - no_action - overflow_routing example: drop type: string x-enum-varnames: - DROP - NO_ACTION - OVERFLOW_ROUTING CloudWorkloadSecurityAgentPolicyAttributes: description: A Cloud Workload Security Agent policy returned by the API properties: blockingRulesCount: description: The number of rules with the blocking feature in this policy example: 100 format: int32 maximum: 2147483647 type: integer datadogManaged: description: Whether the policy is managed by Datadog example: false type: boolean description: description: The description of the policy example: My agent policy type: string disabledRulesCount: description: The number of rules that are disabled in this policy example: 100 format: int32 maximum: 2147483647 type: integer enabled: description: Whether the Agent policy is enabled example: true type: boolean hostTags: description: The host tags defining where this policy is deployed items: type: string type: array hostTagsLists: description: The host tags defining where this policy is deployed, the inner values are linked with AND, the outer values are linked with OR items: items: type: string type: array type: array monitoringRulesCount: description: The number of rules in the monitoring state in this policy example: 100 format: int32 maximum: 2147483647 type: integer name: description: The name of the policy example: my_agent_policy type: string policyVersion: description: The version of the policy example: '1' type: string priority: description: The priority of the policy example: 10 format: int64 type: integer ruleCount: description: The number of rules in this policy example: 100 format: int32 maximum: 2147483647 type: integer updateDate: description: Timestamp in milliseconds when the policy was last updated example: 1624366480320 format: int64 type: integer updatedAt: description: When the policy was last updated, timestamp in milliseconds example: 1624366480320 format: int64 type: integer updater: $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyUpdaterAttributes' type: object ObservabilityPipelineSplunkHecSourceType: default: splunk_hec description: The source type. Always `splunk_hec`. enum: - splunk_hec example: splunk_hec type: string x-enum-varnames: - SPLUNK_HEC LogsMetricType: default: logs_metrics description: The type of the resource. The value should always be logs_metrics. enum: - logs_metrics example: logs_metrics type: string x-enum-varnames: - LOGS_METRICS EntityV3Metadata: additionalProperties: false description: The definition of Entity V3 Metadata object. properties: additionalOwners: additionalProperties: false description: The additional owners of the entity, usually a team. items: $ref: '#/components/schemas/EntityV3MetadataAdditionalOwnersItems' type: array contacts: additionalProperties: false description: A list of contacts for the entity. items: $ref: '#/components/schemas/EntityV3MetadataContactsItems' type: array description: description: Short description of the entity. The UI can leverage the description for display. type: string example: example_value displayName: description: User friendly name of the entity. The UI can leverage the display name for display. type: string example: Example Monitor id: description: A read-only globally unique identifier for the entity generated by Datadog. User supplied values are ignored. example: 4b163705-23c0-4573-b2fb-f6cea2163fcb minLength: 1 type: string inheritFrom: description: The entity reference from which to inherit metadata example: application:default/myapp type: string links: additionalProperties: false description: A list of links for the entity. items: $ref: '#/components/schemas/EntityV3MetadataLinksItems' type: array managed: additionalProperties: {} description: A read-only set of Datadog managed attributes generated by Datadog. User supplied values are ignored. type: object name: description: Unique name given to an entity under the kind/namespace. example: myService minLength: 1 type: string namespace: description: Namespace is a part of unique identifier. It has a default value of 'default'. example: default minLength: 1 type: string owner: description: The owner of the entity, usually a team. type: string example: example_value tags: description: A set of custom tags. example: - this:tag - that:tag items: type: string type: array required: - name type: object RumMetricCreateRequest: description: The new rum-based metric body. properties: data: $ref: '#/components/schemas/RumMetricCreateData' required: - data type: object Step: description: A Step is a sub-component of a workflow. Each Step performs an action. properties: actionId: description: The unique identifier of an action. example: '' type: string completionGate: $ref: '#/components/schemas/CompletionGate' connectionLabel: description: The unique identifier of a connection defined in the spec. type: string example: example_value display: $ref: '#/components/schemas/StepDisplay' errorHandlers: description: The `Step` `errorHandlers`. items: $ref: '#/components/schemas/ErrorHandler' type: array name: description: Name of the step. example: '' type: string outboundEdges: description: A list of subsequent actions to run. items: $ref: '#/components/schemas/OutboundEdge' type: array parameters: description: A list of inputs for an action. items: $ref: '#/components/schemas/Parameter' type: array readinessGate: $ref: '#/components/schemas/ReadinessGate' required: - name - actionId type: object ProjectRelationships: description: Project relationships properties: member_team: $ref: '#/components/schemas/RelationshipToTeamLinks' member_user: $ref: '#/components/schemas/UsersRelationship' type: object NotificationRuleQuery: description: The query is composed of one or several key:value pairs, which can be used to filter security issues on tags and attributes. example: (source:production_service OR env:prod) type: string ScheduleTrigger: description: Trigger a workflow from a Schedule. The workflow must be published. properties: rruleExpression: description: Recurrence rule expression for scheduling. example: '' type: string required: - rruleExpression type: object SecurityMonitoringRuleNewValueOptionsForgetAfter: description: The duration in days after which a learned value is forgotten. enum: - 1 - 2 - 7 - 14 - 21 - 28 format: int32 type: integer x-enum-varnames: - ONE_DAY - TWO_DAYS - ONE_WEEK - TWO_WEEKS - THREE_WEEKS - FOUR_WEEKS ObservabilityPipelineLogstashSourceType: default: logstash description: The source type. The value should always be `logstash`. enum: - logstash example: logstash type: string x-enum-varnames: - LOGSTASH APIKeyRelationships: description: Resources related to the API key. properties: created_by: $ref: '#/components/schemas/RelationshipToUser' modified_by: $ref: '#/components/schemas/NullableRelationshipToUser' type: object RelationshipToUserTeamPermission: description: Relationship between a user team permission and a team properties: data: $ref: '#/components/schemas/RelationshipToUserTeamPermissionData' links: $ref: '#/components/schemas/TeamRelationshipsLinks' type: object x-merge-override: required: false IncidentResponseRelationships: description: The incident's relationships from a response. properties: attachments: $ref: '#/components/schemas/RelationshipToIncidentAttachment' commander_user: $ref: '#/components/schemas/NullableRelationshipToUser' created_by_user: $ref: '#/components/schemas/RelationshipToUser' impacts: $ref: '#/components/schemas/RelationshipToIncidentImpacts' integrations: $ref: '#/components/schemas/RelationshipToIncidentIntegrationMetadatas' last_modified_by_user: $ref: '#/components/schemas/RelationshipToUser' responders: $ref: '#/components/schemas/RelationshipToIncidentResponders' user_defined_fields: $ref: '#/components/schemas/RelationshipToIncidentUserDefinedFields' type: object CustomDestinationAttributeTagsRestrictionListType: default: ALLOW_LIST description: 'How `forward_tags_restriction_list` parameter should be interpreted. If `ALLOW_LIST`, then only tags whose keys on the forwarded logs match the ones on the restriction list are forwarded. `BLOCK_LIST` works the opposite way. It does not forward the tags matching the ones on the list.' enum: - ALLOW_LIST - BLOCK_LIST example: ALLOW_LIST type: string x-enum-varnames: - ALLOW_LIST - BLOCK_LIST ServiceDefinitionV2EmailType: description: Contact type. enum: - email example: email type: string x-enum-varnames: - EMAIL EscalationPolicyStepType: default: steps description: Indicates that the resource is of type `steps`. enum: - steps example: steps type: string x-enum-varnames: - STEPS AWSAccountResponse: description: AWS Account response body. properties: data: $ref: '#/components/schemas/AWSAccountResponseData' required: - data type: object EntityV3APISpecInterfaceFileRef: additionalProperties: false description: The definition of `EntityV3APISpecInterfaceFileRef` object. properties: fileRef: description: The reference to the API definition file. type: string example: example_value type: object LogsArchiveCreateRequest: description: The logs archive. properties: data: $ref: '#/components/schemas/LogsArchiveCreateRequestDefinition' type: object ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternType: description: Indicates that a predefined library pattern is used. enum: - library example: library type: string x-enum-varnames: - LIBRARY Trigger: description: One of the triggers that can start the execution of a workflow. oneOf: - $ref: '#/components/schemas/APITriggerWrapper' - $ref: '#/components/schemas/AppTriggerWrapper' - $ref: '#/components/schemas/CaseTriggerWrapper' - $ref: '#/components/schemas/ChangeEventTriggerWrapper' - $ref: '#/components/schemas/DatabaseMonitoringTriggerWrapper' - $ref: '#/components/schemas/DashboardTriggerWrapper' - $ref: '#/components/schemas/GithubWebhookTriggerWrapper' - $ref: '#/components/schemas/IncidentTriggerWrapper' - $ref: '#/components/schemas/MonitorTriggerWrapper' - $ref: '#/components/schemas/NotebookTriggerWrapper' - $ref: '#/components/schemas/ScheduleTriggerWrapper' - $ref: '#/components/schemas/SecurityTriggerWrapper' - $ref: '#/components/schemas/SelfServiceTriggerWrapper' - $ref: '#/components/schemas/SlackTriggerWrapper' - $ref: '#/components/schemas/SoftwareCatalogTriggerWrapper' - $ref: '#/components/schemas/WorkflowTriggerWrapper' AwsCURConfigPostRequest: description: AWS CUR config Post Request. properties: data: $ref: '#/components/schemas/AwsCURConfigPostData' required: - data type: object ServiceDefinitionV2SlackType: description: Contact type. enum: - slack example: slack type: string x-enum-varnames: - SLACK ScheduleDataRelationshipsLayers: description: Associates layers with this schedule in a data structure. properties: data: description: An array of layer references for this schedule. items: $ref: '#/components/schemas/ScheduleDataRelationshipsLayersDataItems' type: array type: object ObservabilityPipelineHttpClientSource: description: The `http_client` source scrapes logs from HTTP endpoints at regular intervals. properties: auth_strategy: $ref: '#/components/schemas/ObservabilityPipelineHttpClientSourceAuthStrategy' decoding: $ref: '#/components/schemas/ObservabilityPipelineDecoding' id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: http-client-source type: string scrape_interval_secs: description: The interval (in seconds) between HTTP scrape requests. example: 60 format: int64 type: integer scrape_timeout_secs: description: The timeout (in seconds) for each scrape request. example: 10 format: int64 type: integer tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineHttpClientSourceType' required: - id - type - decoding type: object ApplicationKeyResponseIncludedItem: description: An object related to an application key. oneOf: - $ref: '#/components/schemas/User' - $ref: '#/components/schemas/Role' - $ref: '#/components/schemas/LeakedKey' CreatePageResponseDataType: default: pages description: The type of resource used when creating an On-Call Page. enum: - pages example: pages type: string x-enum-varnames: - PAGES EscalationPolicyDataType: default: policies description: Indicates that the resource is of type `policies`. enum: - policies example: policies type: string x-enum-varnames: - POLICIES RetentionFilterCreateData: description: The body of the retention filter to be created. properties: attributes: $ref: '#/components/schemas/RetentionFilterCreateAttributes' type: $ref: '#/components/schemas/ApmRetentionFilterType' required: - attributes - type type: object ServiceDefinitionV2Dot2Integrations: description: Third party integrations that Datadog supports. properties: opsgenie: $ref: '#/components/schemas/ServiceDefinitionV2Dot2Opsgenie' pagerduty: $ref: '#/components/schemas/ServiceDefinitionV2Dot2Pagerduty' type: object ServiceDefinitionMetaWarnings: description: Schema validation warnings. properties: instance-location: description: The warning instance location. type: string example: example_value keyword-location: description: The warning keyword location. type: string example: example_value message: description: The warning message. type: string example: CPU usage is high on {{host.name}} type: object AWSIntegration: description: The definition of `AWSIntegration` object. properties: credentials: $ref: '#/components/schemas/AWSCredentials' type: $ref: '#/components/schemas/AWSIntegrationType' required: - type - credentials type: object SecurityMonitoringRuleOptions: description: Options. properties: complianceRuleOptions: $ref: '#/components/schemas/CloudConfigurationComplianceRuleOptions' decreaseCriticalityBasedOnEnv: $ref: '#/components/schemas/SecurityMonitoringRuleDecreaseCriticalityBasedOnEnv' detectionMethod: $ref: '#/components/schemas/SecurityMonitoringRuleDetectionMethod' evaluationWindow: $ref: '#/components/schemas/SecurityMonitoringRuleEvaluationWindow' hardcodedEvaluatorType: $ref: '#/components/schemas/SecurityMonitoringRuleHardcodedEvaluatorType' impossibleTravelOptions: $ref: '#/components/schemas/SecurityMonitoringRuleImpossibleTravelOptions' keepAlive: $ref: '#/components/schemas/SecurityMonitoringRuleKeepAlive' maxSignalDuration: $ref: '#/components/schemas/SecurityMonitoringRuleMaxSignalDuration' newValueOptions: $ref: '#/components/schemas/SecurityMonitoringRuleNewValueOptions' thirdPartyRuleOptions: $ref: '#/components/schemas/SecurityMonitoringRuleThirdPartyOptions' type: object CreateRuleRequestData: description: Scorecard create rule request data. properties: attributes: $ref: '#/components/schemas/RuleAttributes' type: $ref: '#/components/schemas/RuleType' type: object LogsArchiveDestinationS3Type: default: s3 description: Type of the S3 archive destination. enum: - s3 example: s3 type: string x-enum-varnames: - S3 ConnectionGroup: description: The definition of `ConnectionGroup` object. properties: connectionGroupId: description: The `ConnectionGroup` `connectionGroupId`. example: '' type: string label: description: The `ConnectionGroup` `label`. example: '' type: string tags: description: The `ConnectionGroup` `tags`. example: - '' items: type: string type: array required: - connectionGroupId - label - tags type: object IncidentAttachmentLinkAttributesAttachmentObject: description: The link attachment. properties: documentUrl: description: The URL of this link attachment. example: https://www.example.com/webstore-failure-runbook type: string title: description: The title of this link attachment. example: Runbook for webstore service failures type: string required: - documentUrl - title type: object RoleResponse: description: Response containing information about a single role. properties: data: $ref: '#/components/schemas/Role' type: object ComponentGrid: description: A grid component. The grid component is the root canvas for an app and contains all other components. properties: events: description: Events to listen for on the grid component. items: $ref: '#/components/schemas/AppBuilderEvent' type: array id: description: The ID of the grid component. This property is deprecated; use `name` to identify individual components instead. type: string example: abc-123-def name: description: A unique identifier for this grid component. This name is also visible in the app editor. example: '' type: string properties: $ref: '#/components/schemas/ComponentGridProperties' type: $ref: '#/components/schemas/ComponentGridType' required: - name - type - properties type: object ScheduleMember: description: Represents a single member entry in a schedule, referencing a specific user. properties: id: description: The unique identifier for this schedule member. type: string example: abc-123-def relationships: $ref: '#/components/schemas/ScheduleMemberRelationships' type: $ref: '#/components/schemas/ScheduleMemberType' required: - type type: object ApplicationKeyRelationships: description: Resources related to the application key. properties: owned_by: $ref: '#/components/schemas/RelationshipToUser' type: object x-merge-override: properties: false LeakedKey: description: The definition of LeakedKey object. properties: attributes: $ref: '#/components/schemas/LeakedKeyAttributes' id: description: The LeakedKey id. example: id type: string type: $ref: '#/components/schemas/LeakedKeyType' required: - attributes - id - type type: object CreateRuleRequest: description: Scorecard create rule request. properties: data: $ref: '#/components/schemas/CreateRuleRequestData' type: object MonitorConfigPolicyResponse: description: Response for retrieving a monitor configuration policy. properties: data: $ref: '#/components/schemas/MonitorConfigPolicyResponseData' type: object ObservabilityPipelineAddEnvVarsProcessorType: default: add_env_vars description: The processor type. The value should always be `add_env_vars`. enum: - add_env_vars example: add_env_vars type: string x-enum-varnames: - ADD_ENV_VARS ApplicationSecurityWafExclusionFilterResource: description: A JSON:API resource for an WAF exclusion filter. properties: attributes: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterAttributes' id: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterID' type: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterType' type: object ObservabilityPipelineGeneratedMetricIncrementByOneStrategy: description: Increments the metric by 1 for each matching event. enum: - increment_by_one example: increment_by_one type: string x-enum-varnames: - INCREMENT_BY_ONE AzureUCConfigPairAttributes: description: Attributes for Azure config pair. properties: configs: description: An Azure config. items: $ref: '#/components/schemas/AzureUCConfig' type: array id: description: The ID of the Azure config pair. format: int64 type: integer example: 42 required: - configs type: object x-merge-override: properties: false SecurityMonitoringSuppressionType: default: suppressions description: The type of the resource. The value should always be `suppressions`. enum: - suppressions example: suppressions type: string x-enum-varnames: - SUPPRESSIONS ObservabilityPipelineSyslogNgSource: description: The `syslog_ng` source listens for logs over TCP or UDP from a `syslog-ng` server using the syslog protocol. properties: id: description: The unique identifier for this component. Used to reference this component in other parts of the pipeline (e.g., as input to downstream components). example: syslog-ng-source type: string mode: $ref: '#/components/schemas/ObservabilityPipelineSyslogSourceMode' tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineSyslogNgSourceType' required: - id - type - mode type: object ServiceAccountCreateData: description: Object to create a service account User. properties: attributes: $ref: '#/components/schemas/ServiceAccountCreateAttributes' relationships: $ref: '#/components/schemas/UserRelationships' type: $ref: '#/components/schemas/UsersType' required: - attributes - type type: object SecurityMonitoringSuppressionAttributes: description: The attributes of the suppression rule. properties: creation_date: description: A Unix millisecond timestamp given the creation date of the suppression rule. format: int64 type: integer example: 42 creator: $ref: '#/components/schemas/SecurityMonitoringUser' data_exclusion_query: description: An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule. example: source:cloudtrail account_id:12345 type: string description: description: A description for the suppression rule. example: This rule suppresses low-severity signals in staging environments. type: string editable: description: Whether the suppression rule is editable. example: true type: boolean enabled: description: Whether the suppression rule is enabled. example: true type: boolean expiration_date: description: A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore. example: 1703187336000 format: int64 type: integer name: description: The name of the suppression rule. example: Custom suppression type: string rule_query: description: The rule query of the suppression rule, with the same syntax as the search bar for detection rules. example: type:log_detection source:cloudtrail type: string start_date: description: A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals. example: 1703187336000 format: int64 type: integer suppression_query: description: The suppression query of the suppression rule. If a signal matches this query, it is suppressed and not triggered. Same syntax as the queries to search signals in the signal explorer. example: env:staging status:low type: string update_date: description: A Unix millisecond timestamp given the update date of the suppression rule. format: int64 type: integer example: 42 updater: $ref: '#/components/schemas/SecurityMonitoringUser' version: description: The version of the suppression rule; it starts at 1, and is incremented at each update. example: 42 format: int32 maximum: 2147483647 type: integer type: object RetryStrategyLinear: description: The definition of `RetryStrategyLinear` object. properties: interval: description: The `RetryStrategyLinear` `interval`. The expected format is the number of seconds ending with an s. For example, 1 day is 86400s example: '' type: string maxRetries: description: The `RetryStrategyLinear` `maxRetries`. example: 0 format: double type: number required: - interval - maxRetries type: object CloudWorkloadSecurityAgentPolicyData: description: Object for a single Agent policy properties: attributes: $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyAttributes' id: description: The ID of the Agent policy example: 6517fcc1-cec7-4394-a655-8d6e9d085255 type: string type: $ref: '#/components/schemas/CloudWorkloadSecurityAgentPolicyType' type: object EscalationPolicyCreateRequestDataRelationships: description: Represents relationships in an escalation policy creation request, including references to teams. properties: teams: $ref: '#/components/schemas/DataRelationshipsTeams' type: object RumMetricResponseAttributes: description: The object describing a Datadog rum-based metric. properties: compute: $ref: '#/components/schemas/RumMetricResponseCompute' event_type: $ref: '#/components/schemas/RumMetricEventType' filter: $ref: '#/components/schemas/RumMetricResponseFilter' group_by: description: The rules for the group by. items: $ref: '#/components/schemas/RumMetricResponseGroupBy' type: array uniqueness: $ref: '#/components/schemas/RumMetricResponseUniqueness' type: object RumRetentionFilterSampleRate: description: The sample rate for a RUM retention filter, between 0 and 100. example: 25 format: int64 maximum: 100 minimum: 0 type: integer CompletionCondition: description: The definition of `CompletionCondition` object. properties: operand1: description: The `CompletionCondition` `operand1`. example: example_value operand2: description: The `CompletionCondition` `operand2`. example: example_value operator: $ref: '#/components/schemas/CompletionConditionOperator' required: - operand1 - operator type: object CreateActionConnectionRequest: description: Request used to create an action connection. properties: data: $ref: '#/components/schemas/ActionConnectionData' required: - data type: object SpansMetricCreateData: description: The new span-based metric properties. properties: attributes: $ref: '#/components/schemas/SpansMetricCreateAttributes' id: $ref: '#/components/schemas/SpansMetricID' type: $ref: '#/components/schemas/SpansMetricType' required: - id - type - attributes type: object ServiceDefinitionV2Dot1OpsgenieRegion: description: Opsgenie instance region. enum: - US - EU example: US type: string x-enum-varnames: - US - EU ProjectRelationship: description: Relationship to project properties: data: $ref: '#/components/schemas/ProjectRelationshipData' required: - data type: object IncidentTeamResponse: description: Response with an incident team payload. properties: data: $ref: '#/components/schemas/IncidentTeamResponseData' included: description: Included objects from relationships. items: $ref: '#/components/schemas/IncidentTeamIncludedItems' readOnly: true type: array required: - data type: object RumRetentionFilterID: description: ID of retention filter in UUID. example: 051601eb-54a0-abc0-03f9-cc02efa18892 type: string ObservabilityPipelineSensitiveDataScannerProcessorScope: description: Determines which parts of the log the pattern-matching rule should be applied to. oneOf: - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeInclude' - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeExclude' - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorScopeAll' UrlParam: description: The definition of `UrlParam` object. properties: name: $ref: '#/components/schemas/TokenName' example: MyUrlParameter value: description: The `UrlParam` `value`. example: Some Url Parameter value type: string required: - name - value type: object APIKeyCreateData: description: Object used to create an API key. properties: attributes: $ref: '#/components/schemas/APIKeyCreateAttributes' type: $ref: '#/components/schemas/APIKeysType' required: - attributes - type type: object x-merge-override: required: false OpsgenieServiceResponseData: description: Opsgenie service data from a response. properties: attributes: $ref: '#/components/schemas/OpsgenieServiceResponseAttributes' id: description: The ID of the Opsgenie service. example: 596da4af-0563-4097-90ff-07230c3f9db3 maxLength: 100 minLength: 1 type: string type: $ref: '#/components/schemas/OpsgenieServiceType' required: - id - type - attributes type: object x-merge-override: required: false SLOReportPostResponse: description: The SLO report response. properties: data: $ref: '#/components/schemas/SLOReportPostResponseData' type: object ApplicationSecurityWafCustomRuleAttributes: description: A WAF custom rule. properties: action: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleAction' blocking: description: Indicates whether the WAF custom rule will block the request. example: false type: boolean conditions: description: 'Conditions for which the WAF Custom Rule will triggers, all conditions needs to match in order for the WAF rule to trigger.' items: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleCondition' type: array enabled: description: Indicates whether the WAF custom rule is enabled. example: false type: boolean metadata: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleMetadata' name: description: The Name of the WAF custom rule. example: Block request from bad useragent type: string path_glob: description: The path glob for the WAF custom rule. example: /api/search/* type: string scope: description: The scope of the WAF custom rule. items: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleScope' type: array tags: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleTags' required: - enabled - blocking - name - tags - conditions type: object ObservabilityPipelineParseJSONProcessorType: default: parse_json description: The processor type. The value should always be `parse_json`. enum: - parse_json example: parse_json type: string x-enum-varnames: - PARSE_JSON CreateOpenAPIResponseData: description: Data envelope for `CreateOpenAPIResponse`. properties: attributes: $ref: '#/components/schemas/CreateOpenAPIResponseAttributes' id: $ref: '#/components/schemas/ApiID' type: object MetricName: description: The metric name for this resource. example: test.metric.latency type: string RuleUser: description: User creating or modifying a rule. properties: handle: description: The user handle. example: john.doe@domain.com type: string name: description: The user name. example: John Doe type: string type: object SAMLAssertionAttributesType: default: saml_assertion_attributes description: SAML assertion attributes resource type. enum: - saml_assertion_attributes example: saml_assertion_attributes type: string x-enum-varnames: - SAML_ASSERTION_ATTRIBUTES OutcomesResponseDataItem: description: A single rule outcome. properties: attributes: $ref: '#/components/schemas/OutcomesBatchResponseAttributes' id: description: The unique ID for a rule outcome. type: string example: abc-123-def relationships: $ref: '#/components/schemas/RuleOutcomeRelationships' type: $ref: '#/components/schemas/OutcomeType' type: object ServiceDefinitionV2Dot2Opsgenie: description: Opsgenie integration for the service. properties: region: $ref: '#/components/schemas/ServiceDefinitionV2Dot2OpsgenieRegion' service-url: description: Opsgenie service url. example: https://my-org.opsgenie.com/service/123e4567-e89b-12d3-a456-426614174000 type: string required: - service-url type: object RelationshipToRoles: description: Relationship to roles. properties: data: description: An array containing type and the unique identifier of a role. items: $ref: '#/components/schemas/RelationshipToRoleData' type: array type: object x-merge-override: required: false NotebookTriggerWrapper: description: Schema for a Notebook-based trigger. properties: notebookTrigger: description: Trigger a workflow from a Notebook. type: object startStepNames: $ref: '#/components/schemas/StartStepNames' required: - notebookTrigger type: object EntityV3SystemKind: description: The definition of Entity V3 System Kind object. enum: - system example: system type: string x-enum-varnames: - SYSTEM ObservabilityPipelineSyslogNgSourceType: default: syslog_ng description: The source type. The value should always be `syslog_ng`. enum: - syslog_ng example: syslog_ng type: string x-enum-varnames: - SYSLOG_NG SecurityMonitoringRuleCaseAction: description: Action to perform when a signal is triggered. Only available for Application Security rule type. properties: options: $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionOptions' type: $ref: '#/components/schemas/SecurityMonitoringRuleCaseActionType' type: object CreateActionConnectionResponse: description: The response for a created connection properties: data: $ref: '#/components/schemas/ActionConnectionData' type: object ObservabilityPipelineGenerateMetricsProcessorType: default: generate_datadog_metrics description: The processor type. Always `generate_datadog_metrics`. enum: - generate_datadog_metrics example: generate_datadog_metrics type: string x-enum-varnames: - GENERATE_DATADOG_METRICS AwsCURConfigPostData: description: AWS CUR config Post data. properties: attributes: $ref: '#/components/schemas/AwsCURConfigPostRequestAttributes' type: $ref: '#/components/schemas/AwsCURConfigPostRequestType' required: - attributes - type type: object ScheduleMemberType: default: members description: Schedule Members resource type. enum: - members example: members type: string x-enum-varnames: - MEMBERS GCPSTSServiceAccount: description: Info on your service account. properties: attributes: $ref: '#/components/schemas/GCPSTSServiceAccountAttributes' id: description: Your service account's unique ID. example: d291291f-12c2-22g4-j290-123456678897 type: string meta: $ref: '#/components/schemas/GCPServiceAccountMeta' type: $ref: '#/components/schemas/GCPServiceAccountType' type: object x-merge-override: required: false ProjectCreateAttributes: description: Project creation attributes properties: key: description: Project's key. Cannot be "CASE" example: SEC type: string name: description: name example: Security Investigation type: string required: - name - key type: object ObservabilityPipelineParseGrokProcessorRuleSupportRule: description: The Grok helper rule referenced in the parsing rules. properties: name: description: The name of the Grok helper rule. example: user type: string rule: description: The definition of the Grok helper rule. example: ' %{word:user.name}' type: string required: - name - rule type: object IncidentAttachmentPostmortemAttachmentType: default: postmortem description: The type of postmortem attachment attributes. enum: - postmortem example: postmortem type: string x-enum-varnames: - POSTMORTEM SecurityMonitoringRuleCase: description: Case when signal is generated. properties: actions: description: Action to perform for each rule case. items: $ref: '#/components/schemas/SecurityMonitoringRuleCaseAction' type: array condition: description: 'A rule case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated based on the event counts in the previously defined queries.' type: string example: example_value name: description: Name of the case. type: string example: Example Monitor notifications: description: Notification targets for each rule case. items: description: Notification. type: string type: array status: $ref: '#/components/schemas/SecurityMonitoringRuleSeverity' type: object EntityV3QueueKind: description: The definition of Entity V3 Queue Kind object. enum: - queue example: queue type: string x-enum-varnames: - QUEUE ObservabilityPipelineSplunkTcpSourceType: default: splunk_tcp description: The source type. Always `splunk_tcp`. enum: - splunk_tcp example: splunk_tcp type: string x-enum-varnames: - SPLUNK_TCP EscalationPolicyDataRelationshipsStepsDataItems: description: Defines a relationship to a single step within an escalation policy. Contains the step's `id` and `type`. properties: id: description: Specifies the unique identifier for the step resource. example: 00000000-aba1-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/EscalationPolicyDataRelationshipsStepsDataItemsType' required: - type - id type: object LogsArchiveEncryptionS3Type: description: Type of S3 encryption for a destination. enum: - NO_OVERRIDE - SSE_S3 - SSE_KMS example: SSE_S3 type: string x-enum-varnames: - NO_OVERRIDE - SSE_S3 - SSE_KMS SpansMetricType: default: spans_metrics description: The type of resource. The value should always be spans_metrics. enum: - spans_metrics example: spans_metrics type: string x-enum-varnames: - SPANS_METRICS RolesType: default: roles description: Roles type. enum: - roles example: roles type: string x-enum-varnames: - ROLES MetricCustomTimeAggregation: description: A time aggregation for use in query. enum: - avg - count - max - min - sum example: sum type: string x-enum-varnames: - AVG - COUNT - MAX - MIN - SUM ObservabilityPipelineKafkaSourceType: default: kafka description: The source type. The value should always be `kafka`. enum: - kafka example: kafka type: string x-enum-varnames: - KAFKA CustomDestinationForwardDestinationElasticsearch: description: The Elasticsearch destination. properties: auth: $ref: '#/components/schemas/CustomDestinationElasticsearchDestinationAuth' endpoint: description: 'The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.' example: https://example.com type: string index_name: description: Name of the Elasticsearch index (must follow [Elasticsearch's criteria](https://www.elastic.co/guide/en/elasticsearch/reference/8.11/indices-create-index.html#indices-create-api-path-params)). example: nginx-logs type: string index_rotation: description: 'Date pattern with US locale and UTC timezone to be appended to the index name after adding `-` (that is, `${index_name}-${indexPattern}`). You can customize the index rotation naming pattern by choosing one of these options: - Hourly: `yyyy-MM-dd-HH` (as an example, it would render: `2022-10-19-09`) - Daily: `yyyy-MM-dd` (as an example, it would render: `2022-10-19`) - Weekly: `yyyy-''W''ww` (as an example, it would render: `2022-W42`) - Monthly: `yyyy-MM` (as an example, it would render: `2022-10`) If this field is missing or is blank, it means that the index name will always be the same (that is, no rotation).' example: yyyy-MM-dd type: string type: $ref: '#/components/schemas/CustomDestinationForwardDestinationElasticsearchType' required: - type - endpoint - auth - index_name type: object RumRetentionFilterCreateAttributes: description: The object describing attributes of a RUM retention filter to create. properties: enabled: $ref: '#/components/schemas/RumRetentionFilterEnabled' event_type: $ref: '#/components/schemas/RumRetentionFilterEventType' name: $ref: '#/components/schemas/RunRetentionFilterName' query: $ref: '#/components/schemas/RumRetentionFilterQuery' sample_rate: $ref: '#/components/schemas/RumRetentionFilterSampleRate' required: - event_type - name - sample_rate type: object ObservabilityPipelineConfig: description: Specifies the pipeline's configuration, including its sources, processors, and destinations. properties: destinations: description: A list of destination components where processed logs are sent. example: - id: datadog-logs-destination inputs: - filter-processor type: datadog_logs items: $ref: '#/components/schemas/ObservabilityPipelineConfigDestinationItem' type: array processors: description: A list of processors that transform or enrich log data. example: - id: filter-processor include: service:my-service inputs: - datadog-agent-source type: filter items: $ref: '#/components/schemas/ObservabilityPipelineConfigProcessorItem' type: array sources: description: A list of configured data sources for the pipeline. example: - id: datadog-agent-source type: datadog_agent items: $ref: '#/components/schemas/ObservabilityPipelineConfigSourceItem' type: array required: - sources - destinations type: object UsersType: default: users description: Users resource type. enum: - users example: users type: string x-enum-varnames: - USERS ServiceDefinitionV1Org: description: Org related information about the service. properties: application: description: App feature this service supports. example: E-Commerce type: string team: description: Team that owns the service. example: my-team type: string type: object StartStepNames: description: A list of steps that run first after a trigger fires. example: - '' items: description: The `StartStepNames` `items`. type: string type: array EntityToRawSchema: description: Entity to raw schema relationship. properties: data: $ref: '#/components/schemas/RelationshipItem' type: object IncidentServiceCreateData: description: Incident Service payload for create requests. properties: attributes: $ref: '#/components/schemas/IncidentServiceCreateAttributes' relationships: $ref: '#/components/schemas/IncidentServiceRelationships' type: $ref: '#/components/schemas/IncidentServiceType' required: - type type: object CustomDestinationElasticsearchDestinationAuth: description: Basic access authentication. properties: password: description: The password of the authentication. This field is not returned by the API. example: datadog-custom-destination-password type: string writeOnly: true username: description: The username of the authentication. This field is not returned by the API. example: datadog-custom-destination-username type: string writeOnly: true required: - username - password type: object UserRelationshipData: description: Relationship to user object. properties: id: description: A unique identifier that represents the user. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/UserResourceType' required: - id - type type: object SpansMetricResponseAttributes: description: The object describing a Datadog span-based metric. properties: compute: $ref: '#/components/schemas/SpansMetricResponseCompute' filter: $ref: '#/components/schemas/SpansMetricResponseFilter' group_by: description: The rules for the group by. items: $ref: '#/components/schemas/SpansMetricResponseGroupBy' type: array type: object RoleClone: description: Data for the clone role request. properties: attributes: $ref: '#/components/schemas/RoleCloneAttributes' type: $ref: '#/components/schemas/RolesType' required: - type - attributes type: object RumRetentionFilterAttributes: description: The object describing attributes of a RUM retention filter. properties: enabled: $ref: '#/components/schemas/RumRetentionFilterEnabled' event_type: $ref: '#/components/schemas/RumRetentionFilterEventType' name: $ref: '#/components/schemas/RunRetentionFilterName' query: $ref: '#/components/schemas/RumRetentionFilterQuery' sample_rate: $ref: '#/components/schemas/RumRetentionFilterSampleRate' type: object IncidentIntegrationMetadataResponseIncludedItem: description: An object related to an incident integration metadata that is included in the response. oneOf: - $ref: '#/components/schemas/User' GithubWebhookTriggerWrapper: description: Schema for a GitHub webhook-based trigger. properties: githubWebhookTrigger: $ref: '#/components/schemas/GithubWebhookTrigger' startStepNames: $ref: '#/components/schemas/StartStepNames' required: - githubWebhookTrigger type: object MetricTagConfigurationMetricTypes: default: gauge description: The metric's type. enum: - gauge - count - rate - distribution example: count type: string x-enum-varnames: - GAUGE - COUNT - RATE - DISTRIBUTION TeamLinkResponse: description: Team link response properties: data: $ref: '#/components/schemas/TeamLink' type: object GCPSTSServiceAccountCreateRequest: description: Data on your newly generated service account. properties: data: $ref: '#/components/schemas/GCPSTSServiceAccountData' type: object x-merge-override: required: false CustomDestinationHttpDestinationAuthCustomHeaderType: default: custom_header description: Type of the custom header access authentication. enum: - custom_header example: custom_header type: string x-enum-varnames: - CUSTOM_HEADER EntityV3API: additionalProperties: false description: Schema for API entities. properties: apiVersion: $ref: '#/components/schemas/EntityV3APIVersion' datadog: $ref: '#/components/schemas/EntityV3APIDatadog' extensions: additionalProperties: {} description: Custom extensions. This is the free-formed field to send client-side metadata. No Datadog features are affected by this field. type: object x-ignore-duplicate-object: true integrations: $ref: '#/components/schemas/EntityV3Integrations' kind: $ref: '#/components/schemas/EntityV3APIKind' metadata: $ref: '#/components/schemas/EntityV3Metadata' spec: $ref: '#/components/schemas/EntityV3APISpec' required: - apiVersion - kind - metadata type: object OpsgenieServiceCreateAttributes: description: The Opsgenie service attributes for a create request. properties: custom_url: description: The custom URL for a custom region. example: https://example.com type: string name: description: The name for the Opsgenie service. example: fake-opsgenie-service-name maxLength: 100 type: string opsgenie_api_key: description: The Opsgenie API key for your Opsgenie service. example: 00000000-0000-0000-0000-000000000000 type: string region: $ref: '#/components/schemas/OpsgenieServiceRegionType' required: - name - opsgenie_api_key - region type: object TimeRestriction: description: Defines a single time restriction rule with start and end times and the applicable weekdays. properties: end_day: $ref: '#/components/schemas/Weekday' end_time: description: Specifies the ending time for this restriction. type: string example: '2026-04-17T12:00:00Z' start_day: $ref: '#/components/schemas/Weekday' start_time: description: Specifies the starting time for this restriction. type: string example: '2026-04-17T12:00:00Z' type: object ApplicationSecurityWafCustomRuleActionAction: default: block_request description: Override the default action to take when the WAF custom rule would block. enum: - redirect_request - block_request example: block_request type: string x-enum-varnames: - REDIRECT_REQUEST - BLOCK_REQUEST ProjectCreateRequest: description: Project create request properties: data: $ref: '#/components/schemas/ProjectCreate' required: - data type: object EntityV3SystemSpec: additionalProperties: false description: The definition of Entity V3 System Spec object. properties: components: description: A list of components belongs to the system. items: type: string type: array lifecycle: description: The lifecycle state of the component. minLength: 1 type: string example: example_value tier: description: An entity reference to the owner of the component. minLength: 1 type: string example: example_value type: object ScheduleDataIncludedItem: description: Any additional resources related to this schedule, such as teams and layers. oneOf: - $ref: '#/components/schemas/TeamReference' - $ref: '#/components/schemas/Layer' - $ref: '#/components/schemas/ScheduleMember' - $ref: '#/components/schemas/ScheduleUser' ObservabilityPipelineGoogleCloudStorageDestinationAcl: description: Access control list setting for objects written to the bucket. enum: - private - project-private - public-read - authenticated-read - bucket-owner-read - bucket-owner-full-control example: private type: string x-enum-varnames: - PRIVATE - PROJECTNOT_PRIVATE - PUBLICNOT_READ - AUTHENTICATEDNOT_READ - BUCKETNOT_OWNERNOT_READ - BUCKETNOT_OWNERNOT_FULLNOT_CONTROL LogsArchiveAttributes: description: The attributes associated with the archive. properties: destination: $ref: '#/components/schemas/LogsArchiveDestination' include_tags: default: false description: 'To store the tags in the archive, set the value "true". If it is set to "false", the tags will be deleted when the logs are sent to the archive.' example: false type: boolean name: description: The archive name. example: Nginx Archive type: string query: description: The archive query/filter. Logs matching this query are included in the archive. example: source:nginx type: string rehydration_max_scan_size_in_gb: description: Maximum scan size for rehydration from this archive. example: 100 format: int64 nullable: true type: integer rehydration_tags: description: An array of tags to add to rehydrated logs from an archive. example: - team:intake - team:app items: description: A given tag in the `:` format. type: string type: array state: $ref: '#/components/schemas/LogsArchiveState' required: - name - query - destination type: object ObservabilityPipelineGoogleChronicleDestinationType: default: google_chronicle description: The destination type. The value should always be `google_chronicle`. enum: - google_chronicle example: google_chronicle type: string x-enum-varnames: - GOOGLE_CHRONICLE ObservabilityPipelineAmazonS3DestinationType: default: amazon_s3 description: The destination type. Always `amazon_s3`. enum: - amazon_s3 example: amazon_s3 type: string x-enum-varnames: - AMAZON_S3 ObservabilityPipelineGoogleChronicleDestinationEncoding: description: The encoding format for the logs sent to Chronicle. enum: - json - raw_message example: json type: string x-enum-varnames: - JSON - RAW_MESSAGE NotificationRulesType: description: The rule type associated to notification rules. enum: - notification_rules example: notification_rules type: string x-enum-varnames: - NOTIFICATION_RULES RelationshipToIncidentUserDefinedFieldData: description: Relationship to impact object. properties: id: description: A unique identifier that represents the responder. example: 00000000-0000-0000-2345-000000000000 type: string type: $ref: '#/components/schemas/IncidentUserDefinedFieldType' required: - id - type type: object x-merge-override: required: false AWSAccountCreateRequest: description: AWS Account Create Request body. properties: data: $ref: '#/components/schemas/AWSAccountCreateRequestData' required: - data type: object ObservabilityPipelineFilterProcessorType: default: filter description: The processor type. The value should always be `filter`. enum: - filter example: filter type: string x-enum-varnames: - FILTER SecurityMonitoringThirdPartyRuleCaseCreate: description: Case when a signal is generated by a third party rule. properties: name: description: Name of the case. type: string example: Example Monitor notifications: description: Notification targets for each case. items: description: Notification. type: string type: array query: description: A query to map a third party event to this case. type: string example: avg:system.cpu.user{*} status: $ref: '#/components/schemas/SecurityMonitoringRuleSeverity' required: - status type: object MicrosoftTeamsTenantBasedHandleAttributes: description: Tenant-based handle attributes. properties: channel_id: description: Channel id. example: fake-channel-id maxLength: 255 type: string name: description: Tenant-based handle name. example: fake-handle-name maxLength: 255 type: string team_id: description: Team id. example: 00000000-0000-0000-0000-000000000000 maxLength: 255 type: string tenant_id: description: Tenant id. example: 00000000-0000-0000-0000-000000000001 maxLength: 255 type: string type: object x-merge-override: required: false ApplicationSecurityWafExclusionFilterRulesTargetTags: additionalProperties: type: string description: Target multiple WAF rules based on their tags. properties: category: description: The category of the targeted WAF rules. example: attack_attempt type: string type: description: The type of the targeted WAF rules. example: lfi type: string type: object ObservabilityPipelineParseGrokProcessorRule: description: 'A Grok parsing rule used in the `parse_grok` processor. Each rule defines how to extract structured fields from a specific log field using Grok patterns. ' properties: match_rules: description: 'A list of Grok parsing rules that define how to extract fields from the source field. Each rule must contain a name and a valid Grok pattern. ' example: - name: MyParsingRule rule: '%{word:user} connected on %{date("MM/dd/yyyy"):date}' items: $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessorRuleMatchRule' type: array source: description: The name of the field in the log event to apply the Grok rules to. example: message type: string support_rules: description: 'A list of Grok helper rules that can be referenced by the parsing rules. ' example: - name: user rule: '%{word:user.name}' items: $ref: '#/components/schemas/ObservabilityPipelineParseGrokProcessorRuleSupportRule' type: array required: - source - match_rules - support_rules type: object CustomDestinationResponse: description: The custom destination. properties: data: $ref: '#/components/schemas/CustomDestinationResponseDefinition' type: object ServiceNowTicketResult: description: ServiceNow ticket information properties: sys_target_link: description: Link to the Incident created on ServiceNow type: string example: example_value type: object SensitiveDataScannerFilter: description: Filter for the Scanning Group. properties: query: description: Query to filter the events. type: string example: avg:system.cpu.user{*} type: object MonitorNotificationRuleName: description: The name of the monitor notification rule. example: A notification rule name maxLength: 1000 minLength: 1 type: string CreatePageResponseData: description: The information returned after successfully creating a page. properties: id: description: The unique ID of the created page. type: string example: abc-123-def type: $ref: '#/components/schemas/CreatePageResponseDataType' required: - type type: object ObservabilityPipelineNewRelicDestinationRegion: description: The New Relic region. enum: - us - eu example: us type: string x-enum-varnames: - US - EU SLOReportInterval: description: The frequency at which report data is to be generated. enum: - daily - weekly - monthly example: weekly type: string x-enum-varnames: - DAILY - WEEKLY - MONTHLY GCPServiceAccountType: default: gcp_service_account description: The type of account. enum: - gcp_service_account example: gcp_service_account type: string x-enum-varnames: - GCP_SERVICE_ACCOUNT IncidentIntegrationMetadataMetadata: description: Incident integration metadata's metadata attribute. oneOf: - $ref: '#/components/schemas/SlackIntegrationMetadata' - $ref: '#/components/schemas/JiraIntegrationMetadata' - $ref: '#/components/schemas/MSTeamsIntegrationMetadata' ScheduleTargetType: default: schedules description: Indicates that the resource is of type `schedules`. enum: - schedules example: schedules type: string x-enum-varnames: - SCHEDULES ActionQuerySpecObject: description: The action query spec object. properties: connectionGroup: $ref: '#/components/schemas/ActionQuerySpecConnectionGroup' connectionId: description: The ID of the custom connection to use for this action query. example: 65bb1f25-52e1-4510-9f8d-22d1516ed693 type: string fqn: description: The fully qualified name of the action type. example: com.datadoghq.http.request type: string inputs: $ref: '#/components/schemas/ActionQuerySpecInputs' required: - fqn type: object GCPServiceAccountMeta: description: Additional information related to your service account. properties: accessible_projects: description: The current list of projects accessible from your service account. items: description: List of GCP projects. type: string type: array type: object ServiceDefinitionV2Dot2OpsgenieRegion: description: Opsgenie instance region. enum: - US - EU example: US type: string x-enum-varnames: - US - EU UpsertCatalogEntityResponseIncluded: description: Upsert entity response included. items: $ref: '#/components/schemas/UpsertCatalogEntityResponseIncludedItem' type: array AuthNMappingRelationshipToTeam: description: Relationship of AuthN Mapping to a Team. properties: team: $ref: '#/components/schemas/RelationshipToTeam' required: - team type: object HTTPTokenAuth: description: The definition of `HTTPTokenAuth` object. properties: body: $ref: '#/components/schemas/HTTPBody' headers: description: The `HTTPTokenAuth` `headers`. items: $ref: '#/components/schemas/HTTPHeader' type: array tokens: description: The `HTTPTokenAuth` `tokens`. items: $ref: '#/components/schemas/HTTPToken' type: array type: $ref: '#/components/schemas/HTTPTokenAuthType' url_parameters: description: The `HTTPTokenAuth` `url_parameters`. items: $ref: '#/components/schemas/UrlParam' type: array required: - type type: object CustomFrameworkDataHandleAndVersion: description: Framework Handle and Version. properties: handle: description: Framework Handle example: sec2 type: string version: description: Framework Version example: '2' type: string type: object CustomDestinationHttpDestinationAuthBasicType: default: basic description: Type of the basic access authentication. enum: - basic example: basic type: string x-enum-varnames: - BASIC ServiceDefinitionV2Slack: description: Service owner's Slack channel. properties: contact: description: Slack Channel. example: https://yourcompany.slack.com/archives/channel123 type: string name: description: Contact Slack. example: Team Slack type: string type: $ref: '#/components/schemas/ServiceDefinitionV2SlackType' required: - type - contact type: object UserCreateRequest: description: Create a user. properties: data: $ref: '#/components/schemas/UserCreateData' required: - data type: object SecurityMonitoringRuleCaseCreate: description: Case when signal is generated. properties: actions: description: Action to perform for each rule case. items: $ref: '#/components/schemas/SecurityMonitoringRuleCaseAction' type: array condition: description: 'A case contains logical operations (`>`,`>=`, `&&`, `||`) to determine if a signal should be generated based on the event counts in the previously defined queries.' type: string example: example_value name: description: Name of the case. type: string example: Example Monitor notifications: description: Notification targets. items: description: Notification. type: string type: array status: $ref: '#/components/schemas/SecurityMonitoringRuleSeverity' required: - status type: object ApplicationSecurityWafExclusionFilterAttributes: description: Attributes describing a WAF exclusion filter. properties: description: description: A description for the exclusion filter. example: Exclude false positives on a path type: string enabled: description: Indicates whether the exclusion filter is enabled. example: true type: boolean event_query: description: The event query matched by the legacy exclusion filter. Cannot be created nor updated. type: string example: avg:system.cpu.user{*} ip_list: description: The client IP addresses matched by the exclusion filter (CIDR notation is supported). items: example: 198.51.100.72 type: string type: array metadata: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterMetadata' on_match: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterOnMatch' parameters: description: A list of parameters matched by the exclusion filter in the HTTP query string and HTTP request body. Nested parameters can be matched by joining fields with a dot character. items: example: list.search.query type: string type: array path_glob: description: The HTTP path glob expression matched by the exclusion filter. example: /accounts/* type: string rules_target: description: The WAF rules targeted by the exclusion filter. items: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterRulesTarget' type: array scope: description: The services where the exclusion filter is deployed. items: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterScope' type: array search_query: description: Generated event search query for traces matching the exclusion filter. readOnly: true type: string example: avg:system.cpu.user{*} type: object RumMetricUniquenessWhen: description: When to count updatable events. `match` when the event is first seen, or `end` when the event is complete. enum: - match - end example: match type: string x-enum-varnames: - WHEN_MATCH - WHEN_END LogsMetricResponseCompute: description: The compute rule to compute the log-based metric. properties: aggregation_type: $ref: '#/components/schemas/LogsMetricResponseComputeAggregationType' include_percentiles: $ref: '#/components/schemas/LogsMetricComputeIncludePercentiles' path: description: The path to the value the log-based metric will aggregate on (only used if the aggregation type is a "distribution"). example: '@duration' type: string type: object RumMetricCreateAttributes: description: The object describing the Datadog rum-based metric to create. properties: compute: $ref: '#/components/schemas/RumMetricCompute' event_type: $ref: '#/components/schemas/RumMetricEventType' filter: $ref: '#/components/schemas/RumMetricFilter' group_by: description: The rules for the group by. items: $ref: '#/components/schemas/RumMetricGroupBy' type: array uniqueness: $ref: '#/components/schemas/RumMetricUniqueness' required: - event_type - compute type: object InputSchemaParametersType: description: The definition of `InputSchemaParametersType` object. enum: - STRING - NUMBER - BOOLEAN - OBJECT - ARRAY_STRING - ARRAY_NUMBER - ARRAY_BOOLEAN - ARRAY_OBJECT example: STRING type: string x-enum-varnames: - STRING - NUMBER - BOOLEAN - OBJECT - ARRAY_STRING - ARRAY_NUMBER - ARRAY_BOOLEAN - ARRAY_OBJECT ApplicationSecurityWafExclusionFilterMetadata: description: Extra information about the exclusion filter. properties: added_at: description: The creation date of the exclusion filter. format: date-time type: string example: example_value added_by: description: The handle of the user who created the exclusion filter. type: string example: example_value added_by_name: description: The name of the user who created the exclusion filter. type: string example: Example Monitor modified_at: description: The last modification date of the exclusion filter. format: date-time type: string example: example_value modified_by: description: The handle of the user who last modified the exclusion filter. type: string example: example_value modified_by_name: description: The name of the user who last modified the exclusion filter. type: string example: Example Monitor readOnly: true type: object ScheduleData: description: Represents the primary data object for a schedule, linking attributes and relationships. properties: attributes: $ref: '#/components/schemas/ScheduleDataAttributes' id: description: The schedule's unique identifier. example: 3653d3c6-0c75-11ea-ad28-fb5701eabc7d type: string relationships: $ref: '#/components/schemas/ScheduleDataRelationships' type: $ref: '#/components/schemas/ScheduleDataType' required: - type type: object Organization: description: Organization object. properties: attributes: $ref: '#/components/schemas/OrganizationAttributes' id: description: ID of the organization. type: string example: abc-123-def type: $ref: '#/components/schemas/OrganizationsType' required: - type type: object RumMetricResponseData: description: The rum-based metric properties. properties: attributes: $ref: '#/components/schemas/RumMetricResponseAttributes' id: $ref: '#/components/schemas/RumMetricID' type: $ref: '#/components/schemas/RumMetricType' type: object IncidentAttachmentUpdateResponse: description: The response object containing the created or updated incident attachments. properties: data: description: 'An array of incident attachments. Only the attachments that were created or updated by the request are returned.' example: - attributes: attachment: documentUrl: '' title: Postmortem IR-123 attachment_type: postmortem id: 00000000-abcd-0002-0000-000000000000 relationships: last_modified_by_user: data: id: 00000000-0000-0000-cccc-000000000000 type: users type: incident_attachments items: $ref: '#/components/schemas/IncidentAttachmentData' type: array included: description: Included related resources that the user requested. items: $ref: '#/components/schemas/IncidentAttachmentsResponseIncludedItem' type: array required: - data type: object ObservabilityPipelineHttpServerSourceType: default: http_server description: The source type. The value should always be `http_server`. enum: - http_server example: http_server type: string x-enum-varnames: - HTTP_SERVER CloudWorkloadSecurityAgentRuleAttributes: description: A Cloud Workload Security Agent rule returned by the API properties: actions: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleActions' agentConstraint: description: The version of the Agent type: string example: example_value blocking: description: The blocking policies that the rule belongs to items: type: string type: array category: description: The category of the Agent rule example: Process Activity type: string creationAuthorUuId: description: The ID of the user who created the rule example: e51c9744-d158-11ec-ad23-da7ad0900002 type: string creationDate: description: When the Agent rule was created, timestamp in milliseconds example: 1624366480320 format: int64 type: integer creator: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleCreatorAttributes' defaultRule: description: Whether the rule is included by default example: false type: boolean description: description: The description of the Agent rule example: My Agent rule type: string disabled: description: The disabled policies that the rule belongs to items: type: string type: array enabled: description: Whether the Agent rule is enabled example: true type: boolean expression: description: The SECL expression of the Agent rule example: exec.file.name == "sh" type: string filters: description: The platforms the Agent rule is supported on items: type: string type: array monitoring: description: The monitoring policies that the rule belongs to items: type: string type: array name: description: The name of the Agent rule example: my_agent_rule type: string product_tags: description: The list of product tags associated with the rule items: type: string type: array updateAuthorUuId: description: The ID of the user who updated the rule example: e51c9744-d158-11ec-ad23-da7ad0900002 type: string updateDate: description: Timestamp in milliseconds when the Agent rule was last updated example: 1624366480320 format: int64 type: integer updatedAt: description: When the Agent rule was last updated, timestamp in milliseconds example: 1624366480320 format: int64 type: integer updater: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleUpdaterAttributes' version: description: The version of the Agent rule example: 23 format: int64 type: integer type: object RestrictionQueryWithoutRelationshipsResponse: description: Response containing information about a single restriction query. properties: data: $ref: '#/components/schemas/RestrictionQueryWithoutRelationships' type: object NullableRelationshipToUserData: description: Relationship to user object. nullable: true properties: id: description: A unique identifier that represents the user. example: 00000000-0000-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/UsersType' required: - id - type type: object x-merge-override: required: false ObservabilityPipelineSensitiveDataScannerProcessorLibraryPatternOptions: description: Options for selecting a predefined library pattern and enabling keyword support. properties: id: description: Identifier for a predefined pattern from the sensitive data scanner pattern library. example: credit_card type: string use_recommended_keywords: description: Whether to augment the pattern with recommended keywords (optional). type: boolean example: true required: - id type: object ObservabilityPipelineAmazonS3DestinationStorageClass: description: S3 storage class. enum: - STANDARD - REDUCED_REDUNDANCY - INTELLIGENT_TIERING - STANDARD_IA - EXPRESS_ONEZONE - ONEZONE_IA - GLACIER - GLACIER_IR - DEEP_ARCHIVE example: STANDARD type: string x-enum-varnames: - STANDARD - REDUCED_REDUNDANCY - INTELLIGENT_TIERING - STANDARD_IA - EXPRESS_ONEZONE - ONEZONE_IA - GLACIER - GLACIER_IR - DEEP_ARCHIVE ObservabilityPipelineDecoding: description: The decoding format used to interpret incoming logs. enum: - bytes - gelf - json - syslog example: json type: string x-enum-varnames: - DECODE_BYTES - DECODE_GELF - DECODE_JSON - DECODE_SYSLOG EntityV3DatadogCodeLocations: additionalProperties: false description: Schema for mapping source code locations to an entity. items: $ref: '#/components/schemas/EntityV3DatadogCodeLocationItem' type: array ScheduleCreateRequestData: description: The core data wrapper for creating a schedule, encompassing attributes, relationships, and the resource type. properties: attributes: $ref: '#/components/schemas/ScheduleCreateRequestDataAttributes' relationships: $ref: '#/components/schemas/ScheduleCreateRequestDataRelationships' type: $ref: '#/components/schemas/ScheduleCreateRequestDataType' required: - type - attributes type: object ServiceDefinitionV1Contact: description: Contact information about the service. properties: email: description: Service owner’s email. example: contact@datadoghq.com type: string slack: description: Service owner’s Slack channel. example: https://yourcompany.slack.com/archives/channel123 type: string type: object CloudWorkloadSecurityAgentPolicyType: default: policy description: The type of the resource, must always be `policy` enum: - policy example: policy type: string x-enum-varnames: - POLICY ServiceDefinitionV2Dot1Link: description: Service's external links. properties: name: description: Link name. example: Runbook type: string provider: description: Link provider. example: Github type: string type: $ref: '#/components/schemas/ServiceDefinitionV2Dot1LinkType' url: description: Link URL. example: https://my-runbook type: string required: - name - type - url type: object RoleCreateResponseData: description: Role object returned by the API. properties: attributes: $ref: '#/components/schemas/RoleCreateAttributes' id: description: The unique identifier of the role. type: string example: abc-123-def relationships: $ref: '#/components/schemas/RoleResponseRelationships' type: $ref: '#/components/schemas/RolesType' required: - type type: object RumMetricFilter: description: The rum-based metric filter. Events matching this filter will be aggregated in this metric. properties: query: default: '*' description: The search query - following the RUM search syntax. example: '@service:web-ui: ' type: string required: - query type: object SLOReportPostResponseData: description: The data portion of the SLO report response. properties: id: description: The ID of the report job. example: dc8d92aa-e0af-11ee-af21-1feeaccaa3a3 type: string type: description: The type of ID. example: report_id type: string type: object MicrosoftTeamsWorkflowsWebhookResponseAttributes: description: Workflows Webhook handle attributes. properties: name: description: Workflows Webhook handle name. example: fake-handle-name maxLength: 255 type: string type: object ObservabilityPipeline: description: Top-level schema representing a pipeline. properties: data: $ref: '#/components/schemas/ObservabilityPipelineData' required: - data type: object IncidentIntegrationMetadataAttributes: description: Incident integration metadata's attributes for a create request. properties: created: description: Timestamp when the incident todo was created. format: date-time readOnly: true type: string example: example_value incident_id: description: UUID of the incident this integration metadata is connected to. example: 00000000-aaaa-0000-0000-000000000000 type: string integration_type: description: 'A number indicating the type of integration this metadata is for. 1 indicates Slack; 8 indicates Jira.' example: 1 format: int32 maximum: 9 type: integer metadata: $ref: '#/components/schemas/IncidentIntegrationMetadataMetadata' modified: description: Timestamp when the incident todo was last modified. format: date-time readOnly: true type: string example: example_value status: description: 'A number indicating the status of this integration metadata. 0 indicates unknown; 1 indicates pending; 2 indicates complete; 3 indicates manually created; 4 indicates manually updated; 5 indicates failed.' format: int32 maximum: 5 type: integer example: 42 required: - integration_type - metadata type: object ObservabilityPipelineConfigDestinationItem: description: A destination for the pipeline. oneOf: - $ref: '#/components/schemas/ObservabilityPipelineDatadogLogsDestination' - $ref: '#/components/schemas/ObservabilityPipelineAmazonS3Destination' - $ref: '#/components/schemas/ObservabilityPipelineGoogleCloudStorageDestination' - $ref: '#/components/schemas/ObservabilityPipelineSplunkHecDestination' - $ref: '#/components/schemas/ObservabilityPipelineSumoLogicDestination' - $ref: '#/components/schemas/ObservabilityPipelineElasticsearchDestination' - $ref: '#/components/schemas/ObservabilityPipelineRsyslogDestination' - $ref: '#/components/schemas/ObservabilityPipelineSyslogNgDestination' - $ref: '#/components/schemas/AzureStorageDestination' - $ref: '#/components/schemas/MicrosoftSentinelDestination' - $ref: '#/components/schemas/ObservabilityPipelineGoogleChronicleDestination' - $ref: '#/components/schemas/ObservabilityPipelineNewRelicDestination' - $ref: '#/components/schemas/ObservabilityPipelineSentinelOneDestination' - $ref: '#/components/schemas/ObservabilityPipelineOpenSearchDestination' - $ref: '#/components/schemas/ObservabilityPipelineAmazonOpenSearchDestination' CustomDestinationCreateRequest: description: The custom destination. properties: data: $ref: '#/components/schemas/CustomDestinationCreateRequestDefinition' type: object SensitiveDataScannerGroup: description: A scanning group. properties: id: description: ID of the group. type: string example: abc-123-def type: $ref: '#/components/schemas/SensitiveDataScannerGroupType' type: object EntityV3DatastoreSpec: additionalProperties: false description: The definition of Entity V3 Datastore Spec object. properties: componentOf: description: A list of components the datastore is a part of items: type: string type: array lifecycle: description: The lifecycle state of the datastore. minLength: 1 type: string example: example_value tier: description: The importance of the datastore. minLength: 1 type: string example: example_value type: description: The type of datastore. type: string example: metric alert type: object ObservabilityPipelineConfigSourceItem: description: A data source for the pipeline. oneOf: - $ref: '#/components/schemas/ObservabilityPipelineKafkaSource' - $ref: '#/components/schemas/ObservabilityPipelineDatadogAgentSource' - $ref: '#/components/schemas/ObservabilityPipelineSplunkTcpSource' - $ref: '#/components/schemas/ObservabilityPipelineSplunkHecSource' - $ref: '#/components/schemas/ObservabilityPipelineAmazonS3Source' - $ref: '#/components/schemas/ObservabilityPipelineFluentdSource' - $ref: '#/components/schemas/ObservabilityPipelineFluentBitSource' - $ref: '#/components/schemas/ObservabilityPipelineHttpServerSource' - $ref: '#/components/schemas/ObservabilityPipelineSumoLogicSource' - $ref: '#/components/schemas/ObservabilityPipelineRsyslogSource' - $ref: '#/components/schemas/ObservabilityPipelineSyslogNgSource' - $ref: '#/components/schemas/ObservabilityPipelineAmazonDataFirehoseSource' - $ref: '#/components/schemas/ObservabilityPipelineGooglePubSubSource' - $ref: '#/components/schemas/ObservabilityPipelineHttpClientSource' - $ref: '#/components/schemas/ObservabilityPipelineLogstashSource' IncidentTeamType: default: teams description: Incident Team resource type. enum: - teams example: teams type: string x-enum-varnames: - TEAMS ObservabilityPipelineSensitiveDataScannerProcessorAction: description: Defines what action to take when sensitive data is matched. oneOf: - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionRedact' - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionHash' - $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedact' SoftwareCatalogTriggerWrapper: description: Schema for a Software Catalog-based trigger. properties: softwareCatalogTrigger: description: Trigger a workflow from Software Catalog. type: object startStepNames: $ref: '#/components/schemas/StartStepNames' required: - softwareCatalogTrigger type: object ObservabilityPipelineNewRelicDestination: description: The `new_relic` destination sends logs to the New Relic platform. properties: id: description: The unique identifier for this component. example: new-relic-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - parse-json-processor items: type: string type: array region: $ref: '#/components/schemas/ObservabilityPipelineNewRelicDestinationRegion' type: $ref: '#/components/schemas/ObservabilityPipelineNewRelicDestinationType' required: - id - type - inputs - region type: object ApplicationSecurityWafCustomRuleAction: description: The definition of `ApplicationSecurityWafCustomRuleAction` object. properties: action: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleActionAction' parameters: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleActionParameters' type: object ApplicationSecurityWafCustomRuleResponse: description: Response object that includes a single WAF custom rule. properties: data: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleData' type: object ScheduleMemberRelationshipsUserData: description: Points to the user data associated with this schedule member, including an ID and type. properties: id: description: The user's unique identifier. example: 00000000-aba1-0000-0000-000000000000 type: string type: $ref: '#/components/schemas/ScheduleMemberRelationshipsUserDataType' required: - type - id type: object EntityV3DatadogLogItem: additionalProperties: false description: Log association item. properties: name: description: The name of the query. type: string example: Example Monitor query: description: The query to run. type: string example: avg:system.cpu.user{*} type: object SecurityMonitoringRuleQueryAggregation: description: The aggregation type. enum: - count - cardinality - sum - max - new_value - geo_data - event_count - none type: string x-enum-varnames: - COUNT - CARDINALITY - SUM - MAX - NEW_VALUE - GEO_DATA - EVENT_COUNT - NONE AzureStorageDestination: description: The `azure_storage` destination forwards logs to an Azure Blob Storage container. properties: blob_prefix: description: Optional prefix for blobs written to the container. example: logs/ type: string container_name: description: The name of the Azure Blob Storage container to store logs in. example: my-log-container type: string id: description: The unique identifier for this component. example: azure-storage-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - processor-id items: type: string type: array type: $ref: '#/components/schemas/AzureStorageDestinationType' required: - id - type - inputs - container_name type: object MonitorNotificationRuleResponseAttributes: additionalProperties: {} description: Attributes of the monitor notification rule. properties: created: description: Creation time of the monitor notification rule. example: '2020-01-02T03:04:00.000Z' format: date-time type: string filter: $ref: '#/components/schemas/MonitorNotificationRuleFilter' modified: description: Time the monitor notification rule was last modified. example: '2020-01-02T03:04:00.000Z' format: date-time type: string name: $ref: '#/components/schemas/MonitorNotificationRuleName' recipients: $ref: '#/components/schemas/MonitorNotificationRuleRecipients' type: object HTTPBody: description: The definition of `HTTPBody` object. properties: content: description: Serialized body content example: '{"some-json": "with-value"}' type: string content_type: description: Content type of the body example: application/json type: string type: object ObservabilityPipelineHttpServerSource: description: The `http_server` source collects logs over HTTP POST from external services. properties: auth_strategy: $ref: '#/components/schemas/ObservabilityPipelineHttpServerSourceAuthStrategy' decoding: $ref: '#/components/schemas/ObservabilityPipelineDecoding' id: description: Unique ID for the HTTP server source. example: http-server-source type: string tls: $ref: '#/components/schemas/ObservabilityPipelineTls' type: $ref: '#/components/schemas/ObservabilityPipelineHttpServerSourceType' required: - id - type - auth_strategy - decoding type: object EscalationPolicyStep: description: Represents a single step in an escalation policy, including its attributes, relationships, and resource type. properties: attributes: $ref: '#/components/schemas/EscalationPolicyStepAttributes' id: description: Specifies the unique identifier of this escalation policy step. type: string example: abc-123-def relationships: $ref: '#/components/schemas/EscalationPolicyStepRelationships' type: $ref: '#/components/schemas/EscalationPolicyStepType' required: - type type: object ServiceDefinitionData: description: Service definition data. properties: attributes: $ref: '#/components/schemas/ServiceDefinitionDataAttributes' id: description: Service definition id. type: string example: abc-123-def type: description: Service definition type. type: string example: metric alert type: object ScheduleCreateRequestDataRelationships: description: Gathers relationship objects for the schedule creation request, including the teams to associate. properties: teams: $ref: '#/components/schemas/DataRelationshipsTeams' type: object RUMApplicationCreateAttributes: description: RUM application creation attributes. properties: name: description: Name of the RUM application. example: my_new_rum_application type: string type: description: Type of the RUM application. Supported values are `browser`, `ios`, `android`, `react-native`, `flutter`, `roku`, `electron`, `unity`, `kotlin-multiplatform`. example: browser type: string required: - name type: object ObservabilityPipelineSensitiveDataScannerProcessorType: default: sensitive_data_scanner description: The processor type. The value should always be `sensitive_data_scanner`. enum: - sensitive_data_scanner example: sensitive_data_scanner type: string x-enum-varnames: - SENSITIVE_DATA_SCANNER IncidentFieldAttributesValueType: default: multiselect description: Type of the multiple value field definitions. enum: - multiselect - textarray - metrictag - autocomplete example: multiselect type: string x-enum-varnames: - MULTISELECT - TEXTARRAY - METRICTAG - AUTOCOMPLETE IncidentServiceRelationships: description: The incident service's relationships. properties: created_by: $ref: '#/components/schemas/RelationshipToUser' last_modified_by: $ref: '#/components/schemas/RelationshipToUser' readOnly: true type: object RelationshipToIncidentIntegrationMetadatas: description: A relationship reference for multiple integration metadata objects. example: data: - id: 00000000-abcd-0005-0000-000000000000 type: incident_integrations - id: 00000000-abcd-0006-0000-000000000000 type: incident_integrations properties: data: description: Integration metadata relationship array example: - id: 00000000-abcd-0003-0000-000000000000 type: incident_integrations - id: 00000000-abcd-0004-0000-000000000000 type: incident_integrations items: $ref: '#/components/schemas/RelationshipToIncidentIntegrationMetadataData' type: array required: - data type: object SecurityMonitoringRuleHardcodedEvaluatorType: description: Hardcoded evaluator type. enum: - log4shell type: string x-enum-varnames: - LOG4SHELL SecurityMonitoringSignalRuleCreatePayload: description: Create a new signal correlation rule. properties: cases: description: Cases for generating signals. example: [] items: $ref: '#/components/schemas/SecurityMonitoringRuleCaseCreate' type: array filters: description: Additional queries to filter matched events before they are processed. This field is deprecated for log detection, signal correlation, and workload security rules. items: $ref: '#/components/schemas/SecurityMonitoringFilter' type: array hasExtendedTitle: description: Whether the notifications include the triggering group-by values in their title. example: true type: boolean isEnabled: description: Whether the rule is enabled. example: true type: boolean message: description: Message for generated signals. example: '' type: string name: description: The name of the rule. example: My security monitoring rule. type: string options: $ref: '#/components/schemas/SecurityMonitoringRuleOptions' queries: description: Queries for selecting signals which are part of the rule. example: [] items: $ref: '#/components/schemas/SecurityMonitoringSignalRuleQuery' type: array tags: description: Tags for generated signals. example: - env:prod - team:security items: description: Tag. type: string type: array type: $ref: '#/components/schemas/SecurityMonitoringSignalRuleType' required: - name - isEnabled - queries - options - cases - message type: object AzureUCConfigPostRequestType: default: azure_uc_config_post_request description: Type of Azure config Post Request. enum: - azure_uc_config_post_request example: azure_uc_config_post_request type: string x-enum-varnames: - AZURE_UC_CONFIG_POST_REQUEST ObservabilityPipelineGooglePubSubSourceType: default: google_pubsub description: The source type. The value should always be `google_pubsub`. enum: - google_pubsub example: google_pubsub type: string x-enum-varnames: - GOOGLE_PUBSUB GCPMetricNamespaceConfig: description: Configuration for a GCP metric namespace. properties: disabled: default: false description: When disabled, Datadog does not collect metrics that are related to this GCP metric namespace. example: true type: boolean id: description: The id of the GCP metric namespace. example: aiplatform type: string type: object TeamTargetType: default: teams description: Indicates that the resource is of type `teams`. enum: - teams example: teams type: string x-enum-varnames: - TEAMS CloudWorkloadSecurityAgentRuleActions: description: The array of actions the rule can perform if triggered items: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleAction' nullable: true type: array ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedact: description: Configuration for partially redacting matched sensitive data. properties: action: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactAction' options: $ref: '#/components/schemas/ObservabilityPipelineSensitiveDataScannerProcessorActionPartialRedactOptions' required: - action - options type: object ObservabilityPipelineMetricValue: description: Specifies how the value of the generated metric is computed. oneOf: - $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByOne' - $ref: '#/components/schemas/ObservabilityPipelineGeneratedMetricIncrementByField' CloudWorkloadSecurityAgentRuleCreateRequest: description: Request object that includes the Agent rule to create properties: data: $ref: '#/components/schemas/CloudWorkloadSecurityAgentRuleCreateData' required: - data type: object ScheduleUser: description: Represents a user object in the context of a schedule, including their `id`, type, and basic attributes. properties: attributes: $ref: '#/components/schemas/ScheduleUserAttributes' id: description: The unique user identifier. type: string example: abc-123-def type: $ref: '#/components/schemas/ScheduleUserType' required: - type type: object SAMLAssertionAttribute: description: SAML assertion attribute. properties: attributes: $ref: '#/components/schemas/SAMLAssertionAttributeAttributes' id: description: The ID of the SAML assertion attribute. example: '0' type: string type: $ref: '#/components/schemas/SAMLAssertionAttributesType' required: - id - type type: object x-merge-override: required: false EscalationPolicyCreateRequestDataType: default: policies description: Indicates that the resource is of type `policies`. enum: - policies example: policies type: string x-enum-varnames: - POLICIES MonitorConfigPolicyResponseData: description: A monitor configuration policy data. properties: attributes: $ref: '#/components/schemas/MonitorConfigPolicyAttributeResponse' id: description: ID of this monitor configuration policy. example: 00000000-0000-1234-0000-000000000000 type: string type: $ref: '#/components/schemas/MonitorConfigPolicyResourceType' type: object ApplicationSecurityWafExclusionFilterCreateAttributes: description: Attributes for creating a WAF exclusion filter. properties: description: description: A description for the exclusion filter. example: Exclude false positives on a path type: string enabled: description: Indicates whether the exclusion filter is enabled. example: true type: boolean ip_list: description: The client IP addresses matched by the exclusion filter (CIDR notation is supported). items: example: 198.51.100.72 type: string type: array on_match: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterOnMatch' parameters: description: A list of parameters matched by the exclusion filter in the HTTP query string and HTTP request body. Nested parameters can be matched by joining fields with a dot character. items: example: list.search.query type: string type: array path_glob: description: The HTTP path glob expression matched by the exclusion filter. example: /accounts/* type: string rules_target: description: The WAF rules targeted by the exclusion filter. items: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterRulesTarget' type: array scope: description: The services where the exclusion filter is deployed. items: $ref: '#/components/schemas/ApplicationSecurityWafExclusionFilterScope' type: array required: - description - enabled type: object CreatePageRequest: description: Full request to trigger an On-Call Page. example: data: attributes: description: Page details. tags: - service:test target: identifier: my-team type: team_handle title: Page title urgency: low type: pages properties: data: $ref: '#/components/schemas/CreatePageRequestData' type: object CaseCreateRequest: description: Case create request properties: data: $ref: '#/components/schemas/CaseCreate' required: - data type: object SecurityFilterID: description: The ID of the security filter. example: 3dd-0uc-h1s type: string IncidentTrigger: description: Trigger a workflow from an Incident. For automatic triggering a handle must be configured and the workflow must be published. properties: rateLimit: $ref: '#/components/schemas/TriggerRateLimit' type: object LogsArchive: description: The logs archive. properties: data: $ref: '#/components/schemas/LogsArchiveDefinition' type: object SecurityMonitoringSuppressionCreateAttributes: description: Object containing the attributes of the suppression rule to be created. properties: data_exclusion_query: description: An exclusion query on the input data of the security rules, which could be logs, Agent events, or other types of data based on the security rule. Events matching this query are ignored by any detection rules referenced in the suppression rule. example: source:cloudtrail account_id:12345 type: string description: description: A description for the suppression rule. example: This rule suppresses low-severity signals in staging environments. type: string enabled: description: Whether the suppression rule is enabled. example: true type: boolean expiration_date: description: A Unix millisecond timestamp giving an expiration date for the suppression rule. After this date, it won't suppress signals anymore. example: 1703187336000 format: int64 type: integer name: description: The name of the suppression rule. example: Custom suppression type: string rule_query: description: The rule query of the suppression rule, with the same syntax as the search bar for detection rules. example: type:log_detection source:cloudtrail type: string start_date: description: A Unix millisecond timestamp giving the start date for the suppression rule. After this date, it starts suppressing signals. example: 1703187336000 format: int64 type: integer suppression_query: description: The suppression query of the suppression rule. If a signal matches this query, it is suppressed and is not triggered. It uses the same syntax as the queries to search signals in the Signals Explorer. example: env:staging status:low type: string required: - name - enabled - rule_query type: object RumMetricID: description: The name of the rum-based metric. example: rum.sessions.webui.count type: string SelfServiceTriggerWrapper: description: Schema for a Self Service-based trigger. properties: selfServiceTrigger: description: Trigger a workflow from Self Service. type: object startStepNames: $ref: '#/components/schemas/StartStepNames' required: - selfServiceTrigger type: object IncidentTimelineCellMarkdownCreateAttributes: description: Timeline cell data for Markdown timeline cells for a create request. properties: cell_type: $ref: '#/components/schemas/IncidentTimelineCellMarkdownContentType' content: $ref: '#/components/schemas/IncidentTimelineCellMarkdownCreateAttributesContent' important: default: false description: A flag indicating whether the timeline cell is important and should be highlighted. example: false type: boolean required: - content - cell_type type: object MonitorTrigger: description: Trigger a workflow from a Monitor. For automatic triggering a handle must be configured and the workflow must be published. properties: rateLimit: $ref: '#/components/schemas/TriggerRateLimit' type: object AWSNamespaceFiltersIncludeOnly: description: Include only these namespaces. properties: include_only: description: Include only these namespaces. example: - AWS/EC2 items: example: AWS/EC2 type: string type: array required: - include_only type: object EntityV3DatadogLogs: additionalProperties: false description: Logs association. items: $ref: '#/components/schemas/EntityV3DatadogLogItem' type: array SecurityMonitoringSuppression: description: The suppression rule's properties. properties: attributes: $ref: '#/components/schemas/SecurityMonitoringSuppressionAttributes' id: $ref: '#/components/schemas/SecurityMonitoringSuppressionID' type: $ref: '#/components/schemas/SecurityMonitoringSuppressionType' type: object ServiceDefinitionV2Dot1: description: Service definition v2.1 for providing service metadata and integrations. properties: application: description: Identifier for a group of related services serving a product feature, which the service is a part of. example: my-app type: string contacts: description: A list of contacts related to the services. items: $ref: '#/components/schemas/ServiceDefinitionV2Dot1Contact' type: array dd-service: description: Unique identifier of the service. Must be unique across all services and is used to match with a service in Datadog. example: my-service type: string description: description: A short description of the service. example: My service description type: string extensions: additionalProperties: {} description: Extensions to v2.1 schema. example: myorg/extension: extensionValue type: object integrations: $ref: '#/components/schemas/ServiceDefinitionV2Dot1Integrations' lifecycle: description: The current life cycle phase of the service. example: sandbox type: string links: description: A list of links related to the services. items: $ref: '#/components/schemas/ServiceDefinitionV2Dot1Link' type: array schema-version: $ref: '#/components/schemas/ServiceDefinitionV2Dot1Version' tags: description: A set of custom tags. example: - my:tag - service:tag items: type: string type: array team: description: Team that owns the service. It is used to locate a team defined in Datadog Teams if it exists. example: my-team type: string tier: description: Importance of the service. example: High type: string required: - schema-version - dd-service type: object RelationshipToIncidentResponders: description: Relationship to incident responders. properties: data: description: An array of incident responders. items: $ref: '#/components/schemas/RelationshipToIncidentResponderData' type: array required: - data type: object ObservabilityPipelineEnrichmentTableFile: description: Defines a static enrichment table loaded from a CSV file. properties: encoding: $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileEncoding' key: description: Key fields used to look up enrichment values. items: $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileKeyItems' type: array path: description: Path to the CSV file. example: /etc/enrichment/lookup.csv type: string schema: description: Schema defining column names and their types. items: $ref: '#/components/schemas/ObservabilityPipelineEnrichmentTableFileSchemaItems' type: array required: - encoding - key - path - schema type: object CloudWorkloadSecurityAgentRuleActionMetadata: description: The metadata action applied on the scope matching the rule properties: image_tag: description: The image tag of the metadata action type: string example: env:production service: description: The service of the metadata action type: string example: example_value short_image: description: The short image of the metadata action type: string example: example_value type: object Layer: description: Encapsulates a layer resource, holding attributes like rotation details, plus relationships to the members covering that layer. properties: attributes: $ref: '#/components/schemas/LayerAttributes' id: description: A unique identifier for this layer. type: string example: abc-123-def relationships: $ref: '#/components/schemas/LayerRelationships' type: $ref: '#/components/schemas/LayerType' required: - type type: object RumRetentionFilterEventType: description: The type of RUM events to filter on. enum: - session - view - action - error - resource - long_task - vital example: session type: string x-enum-varnames: - SESSION - VIEW - ACTION - ERROR - RESOURCE - LONG_TASK - VITAL ApplicationSecurityWafCustomRuleTags: additionalProperties: type: string description: 'Tags associated with the WAF Custom Rule. The concatenation of category and type will form the security activity field associated with the traces.' maxProperties: 32 properties: category: $ref: '#/components/schemas/ApplicationSecurityWafCustomRuleTagsCategory' type: description: The type of the WAF rule, associated with the category will form the security activity. example: users.login.success type: string required: - category - type type: object HTTPHeader: description: The definition of `HTTPHeader` object. properties: name: description: The `HTTPHeader` `name`. example: MyHttpHeader pattern: ^[A-Za-z][A-Za-z\\d\\-\\_]*$ type: string value: description: The `HTTPHeader` `value`. example: Some header value type: string required: - name - value type: object OutputSchema: description: A list of output parameters for the workflow. properties: parameters: description: The `OutputSchema` `parameters`. items: $ref: '#/components/schemas/OutputSchemaParameters' type: array type: object AWSAccountCreateRequestData: description: AWS Account Create Request data. properties: attributes: $ref: '#/components/schemas/AWSAccountCreateRequestAttributes' type: $ref: '#/components/schemas/AWSAccountType' required: - attributes - type type: object LogsArchiveDefinition: description: The definition of an archive. properties: attributes: $ref: '#/components/schemas/LogsArchiveAttributes' id: description: The archive ID. example: a2zcMylnM4OCHpYusxIi3g readOnly: true type: string type: default: archives description: The type of the resource. The value should always be archives. example: archives readOnly: true type: string required: - type type: object AWSAssumeRole: description: The definition of `AWSAssumeRole` object. properties: account_id: description: AWS account the connection is created for example: '111222333444' pattern: ^\d{12}$ type: string external_id: description: External ID used to scope which connection can be used to assume the role example: 33a1011635c44b38a064cf14e82e1d8f readOnly: true type: string principal_id: description: AWS account that will assume the role example: '123456789012' readOnly: true type: string role: description: Role to assume example: my-role type: string type: $ref: '#/components/schemas/AWSAssumeRoleType' required: - type - account_id - role type: object IncidentServiceResponseAttributes: description: The incident service's attributes from a response. properties: created: description: Timestamp of when the incident service was created. format: date-time readOnly: true type: string example: example_value modified: description: Timestamp of when the incident service was modified. format: date-time readOnly: true type: string example: example_value name: description: Name of the incident service. example: service name type: string type: object ServiceDefinitionV2Dot1Slack: description: Service owner's Slack channel. properties: contact: description: Slack Channel. example: https://yourcompany.slack.com/archives/channel123 type: string name: description: Contact Slack. example: Team Slack type: string type: $ref: '#/components/schemas/ServiceDefinitionV2Dot1SlackType' required: - type - contact type: object RelationshipToIncidentImpactData: description: Relationship to impact object. properties: id: description: A unique identifier that represents the impact. example: 00000000-0000-0000-2345-000000000000 type: string type: $ref: '#/components/schemas/IncidentImpactsType' required: - id - type type: object x-merge-override: required: false CustomDestinationResponseForwardDestinationElasticsearch: description: The Elasticsearch destination. properties: auth: $ref: '#/components/schemas/CustomDestinationResponseElasticsearchDestinationAuth' endpoint: description: 'The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.' example: https://example.com type: string index_name: description: Name of the Elasticsearch index (must follow [Elasticsearch's criteria](https://www.elastic.co/guide/en/elasticsearch/reference/8.11/indices-create-index.html#indices-create-api-path-params)). example: nginx-logs type: string index_rotation: description: 'Date pattern with US locale and UTC timezone to be appended to the index name after adding `-` (that is, `${index_name}-${indexPattern}`). You can customize the index rotation naming pattern by choosing one of these options: - Hourly: `yyyy-MM-dd-HH` (as an example, it would render: `2022-10-19-09`) - Daily: `yyyy-MM-dd` (as an example, it would render: `2022-10-19`) - Weekly: `yyyy-''W''ww` (as an example, it would render: `2022-W42`) - Monthly: `yyyy-MM` (as an example, it would render: `2022-10`) If this field is missing or is blank, it means that the index name will always be the same (that is, no rotation).' example: yyyy-MM-dd type: string type: $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationElasticsearchType' required: - type - endpoint - auth - index_name type: object CustomDestinationResponseForwardDestinationElasticsearchType: default: elasticsearch description: Type of the Elasticsearch destination. enum: - elasticsearch example: elasticsearch type: string x-enum-varnames: - ELASTICSEARCH ObservabilityPipelineSensitiveDataScannerProcessorActionRedactAction: description: Action type that completely replaces the matched sensitive data with a fixed replacement string to remove all visibility. enum: - redact example: redact type: string x-enum-varnames: - REDACT AWSAccountType: default: account description: AWS Account resource type. enum: - account example: account type: string x-enum-varnames: - ACCOUNT LayerRelationshipsMembersDataItems: description: 'Represents a single member object in a layer''s `members` array, referencing a unique Datadog user ID.' properties: id: description: The unique user ID of the layer member. example: 00000000-0000-0000-0000-000000000002 type: string type: $ref: '#/components/schemas/LayerRelationshipsMembersDataItemsType' required: - type - id type: object ObservabilityPipelineReduceProcessorMergeStrategyStrategy: description: The merge strategy to apply. enum: - discard - retain - sum - max - min - array - concat - concat_newline - concat_raw - shortest_array - longest_array - flat_unique example: flat_unique type: string x-enum-varnames: - DISCARD - RETAIN - SUM - MAX - MIN - ARRAY - CONCAT - CONCAT_NEWLINE - CONCAT_RAW - SHORTEST_ARRAY - LONGEST_ARRAY - FLAT_UNIQUE SensitiveDataScannerStandardPatternType: default: sensitive_data_scanner_standard_pattern description: Sensitive Data Scanner standard pattern type. enum: - sensitive_data_scanner_standard_pattern example: sensitive_data_scanner_standard_pattern type: string x-enum-varnames: - SENSITIVE_DATA_SCANNER_STANDARD_PATTERN SecurityMonitoringThirdPartyRootQuery: description: A query to be combined with the third party case query. properties: groupByFields: description: Fields to group by. items: description: Field. type: string type: array query: description: Query to run on logs. example: source:cloudtrail type: string type: object ScheduleCreateRequestDataType: default: schedules description: Schedules resource type. enum: - schedules example: schedules type: string x-enum-varnames: - SCHEDULES CustomDestinationResponseForwardDestinationHttp: description: The HTTP destination. properties: auth: $ref: '#/components/schemas/CustomDestinationResponseHttpDestinationAuth' endpoint: description: 'The destination for which logs will be forwarded to. Must have HTTPS scheme and forwarding back to Datadog is not allowed.' example: https://example.com type: string type: $ref: '#/components/schemas/CustomDestinationResponseForwardDestinationHttpType' required: - type - endpoint - auth type: object SecurityFilterCreateAttributes: description: Object containing the attributes of the security filter to be created. properties: exclusion_filters: description: Exclusion filters to exclude some logs from the security filter. example: - name: Exclude staging query: source:staging items: $ref: '#/components/schemas/SecurityFilterExclusionFilter' type: array filtered_data_type: $ref: '#/components/schemas/SecurityFilterFilteredDataType' is_enabled: description: Whether the security filter is enabled. example: true type: boolean name: description: The name of the security filter. example: Custom security filter type: string query: description: The query of the security filter. example: service:api type: string required: - name - query - exclusion_filters - filtered_data_type - is_enabled type: object IncidentSeverity: description: The incident severity. enum: - UNKNOWN - SEV-0 - SEV-1 - SEV-2 - SEV-3 - SEV-4 - SEV-5 example: UNKNOWN type: string x-enum-varnames: - UNKNOWN - SEV_0 - SEV_1 - SEV_2 - SEV_3 - SEV_4 - SEV_5 EscalationPolicyStepAttributes: description: Defines attributes for an escalation policy step, such as assignment strategy and escalation timeout. properties: assignment: $ref: '#/components/schemas/EscalationPolicyStepAttributesAssignment' escalate_after_seconds: description: Specifies how many seconds to wait before escalating to the next step. format: int64 type: integer example: 42 type: object ApplicationSecurityWafExclusionFilterID: description: The identifier of the WAF exclusion filter. example: 3dd-0uc-h1s readOnly: true type: string ObservabilityPipelineOpenSearchDestination: description: The `opensearch` destination writes logs to an OpenSearch cluster. properties: bulk_index: description: The index to write logs to. example: logs-index type: string id: description: The unique identifier for this component. example: opensearch-destination type: string inputs: description: A list of component IDs whose output is used as the `input` for this component. example: - filter-processor items: type: string type: array type: $ref: '#/components/schemas/ObservabilityPipelineOpenSearchDestinationType' required: - id - type - inputs type: object AWSAuthConfig: description: AWS Authentication config. oneOf: - $ref: '#/components/schemas/AWSAuthConfigKeys' - $ref: '#/components/schemas/AWSAuthConfigRole' SecurityFilterAttributes: description: The object describing a security filter. properties: exclusion_filters: description: The list of exclusion filters applied in this security filter. items: $ref: '#/components/schemas/SecurityFilterExclusionFilterResponse' type: array filtered_data_type: $ref: '#/components/schemas/SecurityFilterFilteredDataType' is_builtin: description: Whether the security filter is the built-in filter. example: false type: boolean is_enabled: description: Whether the security filter is enabled. example: false type: boolean name: description: The security filter name. example: Custom security filter type: string query: description: The security filter query. Logs accepted by this query will be accepted by this filter. example: service:api type: string version: description: The version of the security filter. example: 1 format: int32 maximum: 2147483647 type: integer type: object CreateAppRequestDataAttributes: description: App definition attributes such as name, description, and components. properties: components: description: The UI components that make up the app. items: $ref: '#/components/schemas/ComponentGrid' type: array description: description: A human-readable description for the app. type: string example: example_value name: description: The name of the app. type: string example: Example Monitor queries: description: An array of queries, such as external actions and state variables, that the app uses. items: $ref: '#/components/schemas/Query' type: array rootInstanceName: description: The name of the root component of the app. This must be a `grid` component that contains all other components. type: string example: Example Monitor tags: description: A list of tags for the app, which can be used to filter apps. example: - service:webshop-backend - team:webshop items: description: An individual tag for the app. type: string type: array type: object SpansMetricComputeAggregationType: description: The type of aggregation to use. enum: - count - distribution example: distribution type: string x-enum-varnames: - COUNT - DISTRIBUTION TeamReferenceType: default: teams description: Teams resource type. enum: - teams example: teams type: string x-enum-varnames: - TEAMS responses: PreconditionFailedResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Failed Precondition NotAuthorizedResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Authorized ForbiddenResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Forbidden ConcurrentModificationResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Concurrent Modification TooManyRequestsResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Too many requests UnauthorizedResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Unauthorized NotFoundResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Not Found ConflictResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Conflict BadRequestResponse: content: application/json: schema: $ref: '#/components/schemas/APIErrorResponse' description: Bad Request parameters: ServiceAccountID: description: The ID of the service account. in: path name: service_account_id required: true schema: example: 00000000-0000-1234-0000-000000000000 type: string IncidentAttachmentIncludeQueryParameter: description: Specifies which types of related objects are included in the response. explode: false in: query name: include required: false schema: items: $ref: '#/components/schemas/IncidentAttachmentRelatedObject' type: array IncidentIDPathParameter: description: The UUID of the incident. in: path name: incident_id required: true schema: type: string RumApplicationIDParameter: description: RUM application ID. in: path name: app_id required: true schema: type: string RoleID: description: The unique identifier of the role. in: path name: role_id required: true schema: type: string MetricName: description: The name of the metric. example: dist.http.endpoint.request in: path name: metric_name required: true schema: type: string securitySchemes: AuthZ: description: This API uses OAuth 2 with the implicit grant flow. flows: authorizationCode: authorizationUrl: /oauth2/v1/authorize scopes: apm_api_catalog_read: View API catalog and API definitions. apm_api_catalog_write: Add, modify, and delete API catalog definitions. apm_read: Read and query APM and Trace Analytics. apm_service_catalog_read: View service catalog and service definitions. apm_service_catalog_write: Add, modify, and delete service catalog definitions when those definitions are maintained by Datadog. appsec_vm_read: View infrastructure, application code, and library vulnerabilities. This does not restrict API or inventory SQL access to the vulnerability data source. cases_read: View Cases. cases_write: Create and update cases. ci_visibility_pipelines_write: Create CI Visibility pipeline spans using the API. ci_visibility_read: View CI Visibility. cloud_cost_management_read: View Cloud Cost pages and the cloud cost data source in dashboards and notebooks. For more details, see the Cloud Cost Management docs. cloud_cost_management_write: Configure cloud cost accounts and global customizations. For more details, see the Cloud Cost Management docs. code_analysis_read: View Code Analysis. continuous_profiler_pgo_read: Read and query Continuous Profiler data for Profile-Guided Optimization (PGO). create_webhooks: Create webhooks integrations. dashboards_embed_share: Create, modify, and delete shared dashboards with share type 'embed'. dashboards_invite_share: Create, modify, and delete shared dashboards with share type 'invite'. dashboards_public_share: Generate public and authenticated links to share dashboards or embeddable graphs externally. dashboards_read: View dashboards. dashboards_write: Create and change dashboards. data_scanner_read: View Data Scanner configurations. data_scanner_write: Edit Data Scanner configurations. embeddable_graphs_share: Generate public links to share embeddable graphs externally. events_read: Read Events data. hosts_read: List hosts and their attributes. incident_notification_settings_write: Configure Incidents Notification settings. incident_read: View incidents in Datadog. incident_settings_write: Configure Incident Settings. incident_write: Create, view, and manage incidents in Datadog. metrics_read: View custom metrics. monitor_config_policy_write: Edit and delete monitor configuration. monitors_downtime: Set downtimes to suppress alerts from any monitor in an organization. Mute and unmute monitors. The ability to write monitors is not required to set downtimes. monitors_read: View monitors. monitors_write: Edit, delete, and resolve individual monitors. org_management: Edit org configurations, including authentication and certain security preferences such as configuring SAML, renaming an org, configuring allowed login methods, creating child orgs, subscribing & unsubscribing from apps in the marketplace, and enabling & disabling Remote Configuration for the entire organization. security_comments_read: Read comments of vulnerabilities. security_monitoring_filters_read: Read Security Filters. security_monitoring_filters_write: Create, edit, and delete Security Filters. security_monitoring_findings_read: View a list of findings that include both misconfigurations and identity risks. security_monitoring_notification_profiles_read: View Rule Security Notification rules. security_monitoring_notification_profiles_write: Create, edit, and delete Security Notification rules. security_monitoring_rules_read: Read Detection Rules. security_monitoring_rules_write: Create and edit Detection Rules. security_monitoring_signals_read: View Security Signals. security_monitoring_suppressions_read: Read Rule Suppressions. security_monitoring_suppressions_write: Write Rule Suppressions. security_pipelines_read: View Security Pipelines. security_pipelines_write: Create, edit, and delete CSM Security Pipelines. slos_corrections: Apply, edit, and delete SLO status corrections. A user with this permission can make status corrections, even if they do not have permission to edit those SLOs. slos_read: View SLOs and status corrections. slos_write: Create, edit, and delete SLOs. synthetics_global_variable_read: View, search, and use Synthetics global variables. synthetics_global_variable_write: Create, edit, and delete global variables for Synthetics. synthetics_private_location_read: View, search, and use Synthetics private locations. synthetics_private_location_write: Create and delete private locations in addition to having access to the associated installation guidelines. synthetics_read: List and view configured Synthetic tests and test results. synthetics_write: Create, edit, and delete Synthetic tests. teams_manage: Manage Teams. Create, delete, rename, and edit metadata of all Teams. To control Team membership across all Teams, use the User Access Manage permission. teams_read: Read Teams data. A User with this permission can view Team names, metadata, and which Users are on each Team. test_optimization_read: View Test Optimization. timeseries_query: Query Timeseries data. usage_read: View your organization's usage and usage attribution. user_access_invite: Invite other users to your organization. user_access_manage: Disable users, manage user roles, manage SAML-to-role mappings, and configure logs restriction queries. user_access_read: View users and their roles and settings. workflows_read: View workflows. workflows_run: Run workflows. workflows_write: Create, edit, and delete workflows. tokenUrl: /oauth2/v1/token type: oauth2 apiKeyAuth: description: Your Datadog API Key. in: header name: DD-API-KEY type: apiKey x-env-name: DD_API_KEY appKeyAuth: description: Your Datadog APP Key. in: header name: DD-APPLICATION-KEY type: apiKey x-env-name: DD_APP_KEY bearerAuth: scheme: bearer type: http x-env-name: DD_BEARER_TOKEN x-group-parameters: true x-merge-override: paths: false